diff --git a/.openpublishing.redirection.windows-configuration.json b/.openpublishing.redirection.windows-configuration.json index 971d493152..d92acf14b2 100644 --- a/.openpublishing.redirection.windows-configuration.json +++ b/.openpublishing.redirection.windows-configuration.json @@ -162,7 +162,7 @@ }, { "source_path": "windows/configuration/start-taskbar-lockscreen.md", - "redirect_url": "/windows/configuration/windows-10-start-layout-options-and-policies", + "redirect_url": "/windows/configuration/start/policy-settings", "redirect_document_id": false }, { @@ -287,7 +287,7 @@ }, { "source_path": "windows/configuration/customize-and-export-start-layout.md", - "redirect_url": "/windows/configuration/start/customize-and-export-start-layout", + "redirect_url": "/windows/configuration/start/layout", "redirect_document_id": false }, { @@ -422,12 +422,12 @@ }, { "source_path": "windows/configuration/start-layout-xml-desktop.md", - "redirect_url": "/windows/configuration/start/start-layout-xml-desktop", + "redirect_url": "/windows/configuration/start/layout", "redirect_document_id": false }, { "source_path": "windows/configuration/start-secondary-tiles.md", - "redirect_url": "/windows/configuration/start/start-secondary-tiles", + "redirect_url": "/windows/configuration/start/layout", "redirect_document_id": false }, { @@ -442,7 +442,7 @@ }, { "source_path": "windows/configuration/supported-csp-start-menu-layout-windows.md", - "redirect_url": "/windows/configuration/start/supported-csp-start-menu-layout-windows", + "redirect_url": "/windows/configuration/start/policy-settings", "redirect_document_id": false }, { @@ -452,7 +452,7 @@ }, { "source_path": "windows/configuration/windows-10-start-layout-options-and-policies.md", - "redirect_url": "/windows/configuration/start/windows-10-start-layout-options-and-policies", + "redirect_url": "/windows/configuration/start/policy-settings", "redirect_document_id": false }, { @@ -822,22 +822,22 @@ }, { "source_path": "windows/configuration/start/customize-start-menu-layout-windows-11.md", - "redirect_url": "/windows/configuration/start/customize-and-export-start-layout", + "redirect_url": "/windows/configuration/start/layout", "redirect_document_id": false }, { "source_path": "windows/configuration/start/customize-windows-10-start-screens-by-using-group-policy.md", - "redirect_url": "/windows/configuration/start/customize-and-export-start-layout", + "redirect_url": "/windows/configuration/start/layout", "redirect_document_id": false }, { "source_path": "windows/configuration/start/customize-windows-10-start-screens-by-using-mobile-device-management.md", - "redirect_url": "/windows/configuration/start/customize-and-export-start-layout", + "redirect_url": "/windows/configuration/start/layout", "redirect_document_id": false }, { "source_path": "windows/configuration/start/customize-windows-10-start-screens-by-using-provisioning-packages-and-icd.md", - "redirect_url": "/windows/configuration/start/customize-and-export-start-layout", + "redirect_url": "/windows/configuration/start/layout", "redirect_document_id": false }, { @@ -850,6 +850,11 @@ "redirect_url": "/windows/configuration/taskbar/", "redirect_document_id": false }, + { + "source_path": "windows/configuration/start/supported-csp-start-menu-layout-windows.md", + "redirect_url": "/windows/configuration/start/policy-settings", + "redirect_document_id": false + }, { "source_path": "windows/configuration/tips/manage-tips-and-suggestions.md", "redirect_url": "/windows/configuration", @@ -864,6 +869,26 @@ "source_path": "windows/configuration/taskbar/supported-csp-taskbar-windows.md", "redirect_url": "/windows/configuration/taskbar/policy-settings", "redirect_document_id": false + }, + { + "source_path": "windows/configuration/start/start-layout-xml-desktop.md", + "redirect_url": "/windows/configuration/start/layout", + "redirect_document_id": false + }, + { + "source_path": "windows/configuration/start/customize-and-export-start-layout.md", + "redirect_url": "/windows/configuration/start/layout", + "redirect_document_id": false + }, + { + "source_path": "windows/configuration/start/windows-10-start-layout-options-and-policies.md", + "redirect_url": "/windows/configuration/start/policy-settings", + "redirect_document_id": false + }, + { + "source_path": "windows/configuration/start/start-secondary-tiles.md", + "redirect_url": "/windows/configuration/start/layout", + "redirect_document_id": false } ] } \ No newline at end of file diff --git a/education/windows/change-home-to-edu.md b/education/windows/change-home-to-edu.md index caa984b456..88685f15ae 100644 --- a/education/windows/change-home-to-edu.md +++ b/education/windows/change-home-to-edu.md @@ -1,7 +1,7 @@ --- title: Upgrade Windows Home to Windows Education on student-owned devices description: Learn how IT Pros can upgrade student-owned devices from Windows Home to Windows Education using Mobile Device Management or Kivuto OnTheHub with qualifying subscriptions. -ms.date: 08/07/2023 +ms.date: 04/10/2024 ms.topic: how-to author: scottbreenmsft ms.author: scbree @@ -16,30 +16,30 @@ ms.collection: ## Overview -Customers with qualifying subscriptions can upgrade student-owned and institution-owned devices from *Windows Home* to *Windows Education*, which is designed for both the classroom and remote learning. +Customers with qualifying subscriptions can upgrade student-owned and institution-owned devices from *Windows Home* to *Windows Education*, which is designed for both the classroom and remote learning. > [!NOTE] > To be qualified for this process, customers must have a Windows Education subscription that includes the student use benefit and must have access to the Volume Licensing Service Center (VLSC) or the Microsoft 365 Admin Center. -IT admins can upgrade student devices using a multiple activation key (MAK) manually or through Mobile Device Management (MDM). Alternatively, IT admins can set up a portal through [Kivuto OnTheHub](http://onthehub.com) where students can request a *Windows Pro Education* product key. The table below provides the recommended method depending on the scenario. +IT admins can upgrade student devices using a multiple activation key (MAK) manually or through Mobile Device Management (MDM). Alternatively, IT admins can set up a portal through [Kivuto OnTheHub](http://onthehub.com) where students can request a *Windows Pro Education* product key. The following table provides the recommended method depending on the scenario. | Method | Product key source | Device ownership | Best for | |-|-|-|-| | MDM | VLSC | Personal (student-owned) | IT admin initiated via MDM | -| Kivuto | Kivuto | Personal (student-owned) | Initiated on device by student, parent or guardian | +| Kivuto | Kivuto | Personal (student-owned) | Initiated on device by student, parent, or guardian | | Provisioning package | VLSC | Personal (student-owned) or Corporate (institution-owned) | IT admin initiated at first boot | These methods apply to devices with *Windows Home* installed; institution-owned devices can be upgraded from *Windows Professional* or *Windows Pro Edu* to *Windows Education* or *Windows Enterprise* using [Windows 10/11 Subscription Activation](/windows/deployment/windows-10-subscription-activation). ## User Notifications -Users aren't notified their device has been or will be upgraded to Windows Education when using MDM. It's the responsibility of the institution to notify their users. Institutions should notify their users that MDM will initiate an upgrade to Windows Education and this upgrade will give the institution extra capabilities, such as installing applications. +Users aren't notified when their device is upgraded to Windows Education when using MDM. It's the responsibility of the institution to notify their users. Institutions should notify their users that MDM initiates an upgrade to Windows Education, and that the upgrade gives the institution extra capabilities, such as installing applications. Device users can disconnect from MDM in the Settings app, to prevent further actions from being taken on their personal device. For instructions on disconnecting from MDM, see [Remove your Windows device from management](/mem/intune/user-help/unenroll-your-device-from-intune-windows). ## Why upgrade student-owned devices from Windows Home to Windows Education? -Some school institutions want to streamline student onboarding for student-owned devices using MDM. Typical MDM requirements include installing certificates, configuring WiFi profiles and installing applications. On Windows, MDM uses Configuration Service Providers (CSPs) to configure settings. Some CSPs aren't available on Windows Home, which can limit the capabilities. Some of the CSPs not available in Windows Home that can affect typical student onboarding are: +Some school institutions want to streamline student onboarding for student-owned devices using MDM. Typical MDM requirements include installing certificates, configuring WiFi profiles, and installing applications. On Windows, MDM uses Configuration Service Providers (CSPs) to configure settings. Some CSPs aren't available on Windows Home, which can limit the capabilities. Some of the CSPs not available in Windows Home that can affect typical student onboarding are: - [EnterpriseDesktopAppManagement](/windows/client-management/mdm/enterprisemodernappmanagement-csp) - which enables deployment of Windows installer or Win32 applications. - [DeliveryOptimization](/windows/client-management/mdm/policy-csp-deliveryoptimization) - which enables configuration of Delivery Optimization. @@ -48,11 +48,11 @@ A full list of CSPs are available at [Configuration service provider reference]( ## Requirements for using a MAK to upgrade from Windows Home to Windows Education -- Access to Volume Licensing Service Center (VLSC) or the Microsoft 365 Admin Center. +- Access to Volume Licensing Service Center (VLSC) or the Microsoft 365 Admin Center - A qualifying Windows subscription such as: - - Windows A3, or; - - Windows A5. -- A pre-installed and activated instance of Windows 10 Home or Windows 11 Home. + - Windows A3, or + - Windows A5 +- A preinstalled and activated instance of Windows 10 Home or Windows 11 Home You can find more information in the [Microsoft Product Terms](https://www.microsoft.com/licensing/terms/productoffering). @@ -67,20 +67,20 @@ IT admins with access to the VLSC or the Microsoft 365 Admin Center, can find th It's critical that MAKs are protected whenever they're used. The following processes provide the best protection for a MAK being applied to a device: -- Provisioning package by institution approved staff; -- Manual entry by institution approved staff (don't distribute the key via email); -- Mobile Device Management (like Microsoft Intune) via [WindowsLicensing CSP](/windows/client-management/mdm/windowslicensing-csp); +- Provisioning package by institution approved staff +- Manual entry by institution approved staff (don't distribute the key via email) +- Mobile Device Management (like Microsoft Intune) via [WindowsLicensing CSP](/windows/client-management/mdm/windowslicensing-csp) > [!IMPORTANT] > If you are using a Mobile Device Management product other than Microsoft Intune, ensure the key isn't accessible by students. -- Operating System Deployment processes with tools such as Microsoft Deployment Toolkit or Microsoft Configuration Manager. +- Operating System Deployment processes with tools such as Microsoft Deployment Toolkit or Microsoft Configuration Manager For a full list of methods to perform a Windows edition upgrade and more details, see [Windows 10 edition upgrade](/windows/deployment/upgrade/windows-10-edition-upgrades). -## Downgrading, resetting, reinstalling and graduation rights +## Downgrading, resetting, reinstalling, and graduation rights After upgrading from *Windows Home* to *Windows Education* there are some considerations for what happens during downgrade, reset or reinstall of the operating system. -The table below highlights the differences by upgrade product key type: +The following table highlights the differences by upgrade product key type: | Product Key Type | Downgrade (in-place) | Reset | Student reinstall | |-|-|-|-| @@ -93,27 +93,27 @@ It isn't possible to downgrade to *Windows Home* from *Windows Education* withou ### Reset -If the computer is reset, Windows Education will be retained. +If the computer is reset, Windows Education is retained. ### Reinstall -The Education upgrade doesn't apply to reinstalling Windows. Use the original Windows edition when reinstalling Windows. The original product key or [firmware-embedded product key](#what-is-a-firmware-embedded-activation-key) will be used to activate Windows. +The Education upgrade doesn't apply to reinstalling Windows. Use the original Windows edition when reinstalling Windows. The original product key or [firmware-embedded product key](#what-is-a-firmware-embedded-activation-key) is used to activate Windows. -If students require a *Windows Pro Education* key that can work on a new install of Windows, they should use [Kivuto OnTheHub](http://onthehub.com) to request a key prior to graduation. +If students require a *Windows Pro Education* key that can work on a new install of Windows, they should use [Kivuto OnTheHub](http://onthehub.com) to request a key before graduation. For details on product keys and reinstalling Windows, see [Find your Windows product key](https://support.microsoft.com/windows/find-your-windows-product-key-aaa2bf69-7b2b-9f13-f581-a806abf0a886). ### Resale -The license will remain installed on the device if resold and the same conditions above apply for downgrade, reset or reinstall. +The license remains installed on the device if resold and the same conditions apply for downgrade, reset, or reinstall. ## Step by step process for customers to upgrade student-owned devices using Microsoft Intune -These steps provide instructions on how to use Microsoft Intune to upgrade devices from Home to Education. +These steps provide instructions on how to use Microsoft Intune to upgrade devices from Home to Education. ### Step 1: Create a Windows Home edition filter -These steps configure a filter that will only apply to devices running the *Windows Home edition*. This filter will ensure only devices running *Windows Home edition* are upgraded. For more information about filters, see [Create filters in Microsoft Intune](/mem/intune/fundamentals/filters). +These steps configure a filter that only applies to devices running the *Windows Home edition*, ensuring that only devices running *Windows Home edition* are upgraded. For more information about filters, see [Create filters in Microsoft Intune](/mem/intune/fundamentals/filters). - Start in the [**Microsoft Intune admin center**](https://go.microsoft.com/fwlink/?linkid=2109431) - Select **Tenant administration** > **Filters** @@ -130,7 +130,7 @@ These steps configure a filter that will only apply to devices running the *Wind > [!NOTE] > Ensure you've selected OR as the operator in the right And/Or column - + :::image type="content" source="images/change-home-to-edu-windows-home-edition-intune-filter.png" alt-text="Example of configuring the Windows Home filter"::: - Optionally select scope tags as required @@ -153,14 +153,14 @@ These steps create and assign a Windows edition upgrade policy. For more informa - Change **Edition to upgrade** to **Windows 10/11 Education** - In the **Product Key**, enter your *Windows 10/11 Education MAK* - Select **Next** - + :::image type="content" source="images/change-home-to-edu-windows-edition-upgrade-policy.png" alt-text="Example of configuring the Windows upgrade policy in Microsoft Intune"::: - Optionally select scope tags as required and select **Next** -- On the **assignments** screen; +- On the **assignments** screen: - Select **Add all devices** - Next to **All devices**, select **Edit filter** - + > [!NOTE] > You can also target other security groups that contain a smaller scope of users or devices and apply the filter rather than All devices. @@ -171,7 +171,7 @@ These steps create and assign a Windows edition upgrade policy. For more informa - Don't configure any applicability rules and select **next** - Review your settings and select **Create** -The edition upgrade policy will now apply to all existing and new Windows Home edition devices targeted. +The edition upgrade policy applies to all existing and new Windows Home edition devices targeted. ### Step 3: Report on device edition @@ -191,11 +191,11 @@ You can check the Windows versions of managed devices in the Microsoft Intune ad Increases to MAK Activation quantity can be requested by contacting [VLSC support](/licensing/contact-us) and may be granted by exception. A request can be made by accounts with the VLSC Administrator, Key Administrator, or Key Viewer permissions. The request should include the following information: -- Agreement/Enrollment Number or License ID and Authorization. -- Product Name (includes version and edition). -- Last five characters of the product key. -- The number of host activations required. -- Business Justification or Reason for Deployment. +- Agreement/Enrollment Number or License ID and Authorization +- Product Name (includes version and edition) +- Last five characters of the product key +- The number of host activations required +- Business Justification or Reason for Deployment ### What is a firmware-embedded activation key? @@ -205,7 +205,7 @@ A firmware-embedded activation key is a Windows product key that is installed in (Get-CimInstance -query 'select * from SoftwareLicensingService').OA3xOriginalProductKey ``` -If the device has a firmware-embedded activation key, it will be displayed in the output. Otherwise, the device doesn't have a firmware embedded activation key. Most OEM-provided devices designed to run Windows 8 or later will have a firmware-embedded key. +If the device has a firmware-embedded activation key, it's displayed in the output. Otherwise the device doesn't have a firmware embedded activation key. Most OEM-provided devices designed to run Windows 8 or later have a firmware-embedded key. A firmware embedded key is only required to upgrade using Subscription Activation, a MAK upgrade doesn't require the firmware embedded key. diff --git a/education/windows/configure-aad-google-trust.md b/education/windows/configure-aad-google-trust.md index 75606b7b94..00367e56dc 100644 --- a/education/windows/configure-aad-google-trust.md +++ b/education/windows/configure-aad-google-trust.md @@ -1,15 +1,15 @@ --- title: Configure federation between Google Workspace and Microsoft Entra ID description: Configuration of a federated trust between Google Workspace and Microsoft Entra ID, with Google Workspace acting as an identity provider (IdP) for Microsoft Entra ID. -ms.date: 09/11/2023 +ms.date: 04/10/2024 ms.topic: how-to appliesto: --- # Configure federation between Google Workspace and Microsoft Entra ID -This article describes the steps required to configure Google Workspace as an identity provider (IdP) for Azure AD.\ -Once configured, users will be able to sign in to Microsoft Entra ID with their Google Workspace credentials. +This article describes the steps required to configure Google Workspace as an identity provider (IdP) for Microsoft Entra ID.\ +Once configured, users can sign in to Microsoft Entra ID with their Google Workspace credentials. ## Prerequisites @@ -27,11 +27,11 @@ To test federation, the following prerequisites must be met: > [!IMPORTANT] > Users require an email address defined in Google Workspace, which is used to match the users in Microsoft Entra ID. > For more information about identity matching, see [Identity matching in Microsoft Entra ID](federated-sign-in.md#identity-matching-in-microsoft-entra-id). -1. Individual Microsoft Entra accounts already created: each Google Workspace user will require a matching account defined in Microsoft Entra ID. These accounts are commonly created through automated solutions, for example: +1. Individual Microsoft Entra accounts already created: each Google Workspace user requires a matching account defined in Microsoft Entra ID. These accounts are commonly created through automated solutions, for example: - School Data Sync (SDS) - Microsoft Entra Connect Sync for environment with on-premises AD DS - PowerShell scripts that call the Microsoft Graph API - - Provisioning tools offered by the IdP - this capability is offered by Google Workspace through [auto-provisioning](https://support.google.com/a/answer/7365072) + - Provisioning tools offered by the IdP - Google Workspace offers [autoprovisioning](https://support.google.com/a/answer/7365072) @@ -42,12 +42,12 @@ To test federation, the following prerequisites must be met: 1. Select **Add app > Search for apps** and search for *microsoft* 1. In the search results page, hover over the *Microsoft Office 365 - Web (SAML)* app and select **Select** :::image type="content" source="images/google/google-admin-search-app.png" alt-text="Screenshot showing Google Workspace and the search button for Microsoft Office 365 SAML app."::: -1. On the **Google Identity Provider details** page, select **Download Metadata** and take note of the location where the **IdP metadata** - *GoogleIDPMetadata.xml* - file is saved, as it will be used to setup Microsoft Entra ID later +1. On the **Google Identity Provider details** page, select **Download Metadata** and take note of the location where the **IdP metadata** - *GoogleIDPMetadata.xml* - file is saved, as it's used to set up Microsoft Entra ID later 1. On the **Service provider detail's** page - Select the option **Signed response** - Verify that the Name ID format is set to **PERSISTENT** - - Depending on how the Microsoft Entra users have been provisioned in Microsoft Entra ID, you may need to adjust the **Name ID** mapping.\ - If using Google auto-provisioning, select **Basic Information > Primary email** + - Depending on how the Microsoft Entra users have been provisioned in Microsoft Entra ID, you might need to adjust the **Name ID** mapping.\ + If using Google autoprovisioning, select **Basic Information > Primary email** - Select **Continue** 1. On the **Attribute mapping** page, map the Google attributes to the Microsoft Entra attributes @@ -136,7 +136,7 @@ AdditionalProperties : {} From a private browser session, navigate to https://portal.azure.com and sign in with a Google Workspace account: 1. As username, use the email as defined in Google Workspace -1. The user will be redirected to Google Workspace to sign in -1. After Google Workspace authentication, the user will be redirected back to Microsoft Entra ID and signed in +1. The user is redirected to Google Workspace to sign in +1. After Google Workspace authentication, the user is redirected back to Microsoft Entra ID and signed in :::image type="content" source="images/google/google-sso.gif" alt-text="A GIF that shows the user authenticating the Azure portal using a Google Workspace federated identity."::: diff --git a/education/windows/edu-stickers.md b/education/windows/edu-stickers.md index 1097092176..889b10b393 100644 --- a/education/windows/edu-stickers.md +++ b/education/windows/edu-stickers.md @@ -1,7 +1,7 @@ --- title: Configure Stickers for Windows 11 SE description: Learn about the Stickers feature and how to configure it via Intune and provisioning package. -ms.date: 11/09/2023 +ms.date: 04/10/2024 ms.topic: how-to appliesto: - ✅ Windows 11 SE @@ -25,7 +25,7 @@ With Stickers, students feel more attached to the device as they feel as if it's ## Enable Stickers -Stickers aren't enabled by default. Follow the instructions below to configure your devices using either Microsoft Intune or a provisioning package (PPKG). +Stickers aren't enabled by default. The following instructions describe how to configure your devices using either Microsoft Intune or a provisioning package (PPKG). #### [:::image type="icon" source="images/icons/intune.svg"::: **Intune**](#tab/intune) @@ -62,14 +62,14 @@ Content-Type: application/json ## How to use Stickers -Once the Stickers feature is enabled, the sticker editor can be opened by either: +Once the Stickers feature is enabled, open sticker editor by either: - using the contextual menu on the desktop and selecting the option **Add or edit stickers** - opening the Settings app > **Personalization** > **Background** > **Add stickers** :::image type="content" source="./images/win-11-se-stickers-menu.png" alt-text="Windows 11 SE desktop contextual menu to open the sticker editor" border="true"::: -Multiple stickers can be added from the picker by selecting them. The stickers can be resized, positioned or deleted from the desktop by using the mouse, keyboard, or touch. +Multiple stickers can be added from the picker by selecting them. The stickers can be resized, positioned, or deleted from the desktop by using the mouse, keyboard, or touch. :::image type="content" source="./images/win-11-se-stickers-animation.gif" alt-text="animation showing Windows 11 SE desktop with 4 pirate stickers being resized and moved" border="true"::: diff --git a/education/windows/edu-themes.md b/education/windows/edu-themes.md index c30c7fd79a..b0d6efa639 100644 --- a/education/windows/edu-themes.md +++ b/education/windows/edu-themes.md @@ -1,7 +1,7 @@ --- title: Configure education themes for Windows 11 description: Learn about education themes for Windows 11 and how to configure them via Intune and provisioning package. -ms.date: 09/11/2023 +ms.date: 04/10/2024 ms.topic: how-to appliesto: - ✅ Windows 11 diff --git a/education/windows/federated-sign-in.md b/education/windows/federated-sign-in.md index 3d414e043d..9c6425ae8e 100644 --- a/education/windows/federated-sign-in.md +++ b/education/windows/federated-sign-in.md @@ -1,7 +1,7 @@ --- title: Configure federated sign-in for Windows devices description: Learn how federated sign-in in Windows works and how to configure it. -ms.date: 09/11/2023 +ms.date: 04/10/2024 ms.topic: how-to appliesto: - ✅ Windows 11 diff --git a/education/windows/get-minecraft-for-education.md b/education/windows/get-minecraft-for-education.md index 4e8222d98d..d5a0cb61fa 100644 --- a/education/windows/get-minecraft-for-education.md +++ b/education/windows/get-minecraft-for-education.md @@ -2,7 +2,7 @@ title: Get and deploy Minecraft Education description: Learn how to obtain and distribute Minecraft Education to Windows devices. ms.topic: how-to -ms.date: 09/11/2023 +ms.date: 04/10/2024 ms.collection: - education - tier2 @@ -16,15 +16,15 @@ Minecraft Education is a game-based platform that inspires creative and inclusiv **Prepare students for the future**: learners develop key skills like problem solving, collaboration, digital citizenship, and critical thinking to help them thrive now and in the future workplace. Spark a passion for STEM. -**Game based learning**: unlock creativity and deep learning with immersive content created with partners including BBC Earth, NASA, and the Nobel Peace Center. Inspire students to engage in real-world topics, with culturally relevant lessons and build challenges.  +**Game based learning**: unlock creativity and deep learning with immersive content created with partners including BBC Earth, NASA, and the Nobel Peace Center. Inspire students to engage in real-world topics, with culturally relevant lessons and build challenges.  ## Minecraft Education key features -- Multiplayer mode enables collaboration in-game across platforms, devices, and hybrid environments  -- Code Builder supports block-based coding, JavaScript, and Python with intuitive interface and in-game execution  -- Immersive Reader helps players read and translate text  -- Camera and Book & Quill items allow documentation and export of in-game creations  -- Integration with Microsoft Teams and Flipgrid supports assessment and teacher controls  +- Multiplayer mode enables collaboration in-game across platforms, devices, and hybrid environments  +- Code Builder supports block-based coding, JavaScript, and Python with intuitive interface and in-game execution  +- Immersive Reader helps players read and translate text  +- Camera and Book & Quill items allow documentation and export of in-game creations  +- Integration with Microsoft Teams and Flipgrid supports assessment and teacher controls  ## Try or purchase Minecraft Education @@ -34,7 +34,7 @@ Organizations can [purchase subscriptions][EDU-2] directly in the *Microsoft 3 When you sign up for a Minecraft Education trial, or purchase a subscription, Minecraft Education licenses are linked to your Microsoft Entra tenant. If you don't have a Microsoft Entra tenant: -- Microsoft-verified academic organizations can set up a free [Office 365 Education subscription][EDU-3], which includes a Microsoft Entra tenant +- Microsoft-verified academic organizations can set up a free [Office 365 Education subscription][EDU-3], which includes a Microsoft Entra tenant - Non-Microsoft-verified academic organizations can set up a free Microsoft Entra tenant when they [purchase Minecraft Education commercial licenses][EDU-4] ### Direct purchase @@ -78,7 +78,7 @@ To pay with an invoice: 1. During the purchase, select **Add a new payment method.** 2. Select the **Invoice** option, and provide the information needed for an invoice. The **PO number** item allows you to add a tracking number or info that is meaningful to your organization. -For more information about invoices and how to pay by invoice, see [Payment options for your Microsoft subscription][M365-1]. +For more information about invoices and how to pay by invoice, see [Payment options for your Microsoft subscription][M365-1]. ## Assign Minecraft Education licenses diff --git a/education/windows/set-up-school-pcs-provisioning-package.md b/education/windows/set-up-school-pcs-provisioning-package.md index 6086d0f017..8b49992af0 100644 --- a/education/windows/set-up-school-pcs-provisioning-package.md +++ b/education/windows/set-up-school-pcs-provisioning-package.md @@ -1,7 +1,7 @@ --- title: What's in Set up School PCs provisioning package description: Learn about the settings that are configured in the provisioning package created with the Set up School PCs app. -ms.date: 06/02/2023 +ms.date: 04/10/2024 ms.topic: reference appliesto: - ✅ Windows 10 @@ -34,15 +34,15 @@ For a more detailed look at the policies, see the Windows article [Set up shared | Disk level caching | 50% | Sets 50% of total disk space to be used as the disk space threshold for account caching. | | Disk level deletion | For shared device setup, 25%; for single device-student setup, 0%. | When devices are optimized for shared use, the policy sets 25% of total disk space as the disk space threshold for account caching. When devices are optimized for use by a single student, the policy sets the value to 0% and doesn't delete accounts. | | Enable account manager | True | Enables automatic account management. | -| Inactive threshold | For shared device setup, 30 days; for single device-student setup, 180 days. | After 30 or 180 days, respectively, if an account hasn't signed in, it will be deleted. | +| Inactive threshold | For shared device setup, 30 days; for single device-student setup, 180 days. | After the threshold, if an account hasn't signed in, its user profile is deleted. | | Kiosk Mode AMUID | `Microsoft.Windows.SecureAssessmentBrowser_cw5n1h2txyewy!App` | Configures the kiosk account on student devices to only run the Take a Test secure assessment browser. | | Kiosk Mode User Tile Display Text | Take a Test | Displays "Take a Test" as the name of the kiosk account on student devices. | | Restrict local storage | For shared device setup, True; for single device-student setup, False. | When devices are optimized for shared use across multiple PCs, this policy forces students to save to the cloud to prevent data loss. When your devices are optimized for use by a single student, this policy doesn't prevent students from saving on the PCs local hard drive. | | Maintenance start time | 0 - midnight | The maintenance start time when automatic maintenance tasks, such as Windows Update, run on student devices. | -| Max page file size in MB | 1024 | Sets the maximum size of the paging file to 1024 MB. Applies only to systems with less than 32-GB storage and at least 3 GB of RAM. | +| Max page file size in MB | 1024 | Sets the maximum size of the paging file to 1,024 MB. Applies only to systems with less than 32-GB storage and at least 3 GB of RAM. | | Set power policies | True | Prevents users from changing power settings and turns off hibernate. Also overrides all power state transitions to sleep, such as lid close. | | Sign in on resume | True | Requires the device user to sign in with a password when the PC wakes from sleep. | -| Sleep timeout | 3600 seconds | Specifies the maximum idle time before the PC should sleep. If you don't set sleep timeout, the default time, 3600 seconds (1 hour), is applied. | +| Sleep timeout | 3,600 seconds | Specifies the maximum idle time before the PC should sleep. If you don't set sleep timeout, the default time, 3,600 seconds (1 hour), is applied. | ## MDM and local group policies @@ -58,7 +58,7 @@ For a more detailed look of each policy listed, see [Policy CSP](/windows/client | Hide OOBE for desktop | True | Hides the interactive OOBE flow for Windows 10. | | Download Mode | 1 - HTTP blended with peering behind the same NAT | Specifies the download method that Delivery Optimization can use in downloads of Windows Updates, Apps, and App updates | | Select when Preview Builds and Feature Updates are received | 32 - Semi-annual Channel. Device gets feature updates from Semi-annual Channel | Specifies how frequently devices receive preview builds and feature updates. | -| Allow auto update | 4 - Auto-installs and restarts without device-user control | When an auto update is available, it auto-installs and restarts the device without any input or action from the device user. | +| Allow auto update | 4 - Autoinstalls and restarts without device-user control | When an auto update is available, it autoinstalls and restarts the device without any input or action from the device user. | | Configure automatic updates | 3 - Set to install at 3am | Scheduled time to install updates. | | Update power policy for cart restarts | 1 - Configured | Skips all restart checks to ensure that the reboot will happen at the scheduled install time. | | Select when Preview Builds and Feature Updates are received | 365 days | Defers Feature Updates for the specified number of days. When not specified, defaults to 365 days. | @@ -70,7 +70,7 @@ For a more detailed look of each policy listed, see [Policy CSP](/windows/client | Allow add provisioning package | Disabled | Students can't add and upload new provisioning packages to their device. | | Allow remove provisioning package | Disabled | Students can't remove packages that you've uploaded to their device, including the Set up School PCs app | | Start Layout | Enabled | Lets you specify the Start layout for users and prevents them from changing the configuration. | -| Import Edge Assets | Enabled | Import Microsoft Edge assets, such as PNG and JPG files, for secondary tiles on the Start layout. Tiles will appear as weblinks and will be tied to the relevant image asset files. | +| Import Microsoft Edge Assets | Enabled | Import Microsoft Edge assets, such as PNG and JPG files, for secondary tiles on the Start layout. Tiles will appear as weblinks and will be tied to the relevant image asset files. | | Allow pinned folder downloads | 1 - The shortcut is visible and disables the setting in the Settings app | Makes the Downloads shortcut on the Start menu visible to students. | | Allow pinned folder File Explorer | 1 - The shortcut is visible and disables the setting in the Settings app | Makes the File Explorer shortcut on the Start menu visible to students. | | Personalization | Deploy lock screen image | Set to the image you picked when you customized the lock screen during device setup. If you didn't customize the image, the computer will show the default. | @@ -112,7 +112,7 @@ The time it takes to install a package on a device depends on the: - Number of policies and apps within the package - Other configurations made to the device -Review the table below to estimate your expected provisioning time. A package that only applies Set Up School PC's default configurations will provision the fastest. A package that removes preinstalled apps, through CleanPC, will take much longer to provision. +Review the table below to estimate your expected provisioning time. A package that only applies Set Up School PC's default configurations provisions the fastest. A package that removes preinstalled apps, through CleanPC, will take longer to provision. | Configurations | Connection type | Estimated provisioning time | |--|--|--| diff --git a/education/windows/tutorial-deploy-apps-winse/considerations.md b/education/windows/tutorial-deploy-apps-winse/considerations.md index 73d202a202..7f2a9f9207 100644 --- a/education/windows/tutorial-deploy-apps-winse/considerations.md +++ b/education/windows/tutorial-deploy-apps-winse/considerations.md @@ -1,7 +1,7 @@ --- title: Important considerations before deploying apps with managed installer description: Learn about important aspects to consider before deploying apps with managed installer. -ms.date: 06/19/2023 +ms.date: 04/10/2024 ms.topic: tutorial appliesto: - ✅ Windows 11 SE, version 22H2 and later diff --git a/education/windows/tutorial-deploy-apps-winse/create-policies.md b/education/windows/tutorial-deploy-apps-winse/create-policies.md index 8841f736bd..26e022bbbf 100644 --- a/education/windows/tutorial-deploy-apps-winse/create-policies.md +++ b/education/windows/tutorial-deploy-apps-winse/create-policies.md @@ -1,7 +1,7 @@ --- title: Create policies to enable applications description: Learn how to create policies to enable the installation and execution of apps on Windows SE. -ms.date: 06/19/2023 +ms.date: 04/10/2024 ms.topic: tutorial appliesto: - ✅ Windows 11 SE, version 22H2 and later diff --git a/education/windows/tutorial-deploy-apps-winse/deploy-apps.md b/education/windows/tutorial-deploy-apps-winse/deploy-apps.md index bc3bd28004..62442e2058 100644 --- a/education/windows/tutorial-deploy-apps-winse/deploy-apps.md +++ b/education/windows/tutorial-deploy-apps-winse/deploy-apps.md @@ -1,7 +1,7 @@ --- title: Applications deployment considerations description: Learn how to deploy different types of applications to Windows 11 SE and some considerations before deploying them. -ms.date: 05/23/2023 +ms.date: 04/10/2024 ms.topic: tutorial appliesto: - ✅ Windows 11 SE, version 22H2 and later diff --git a/education/windows/tutorial-deploy-apps-winse/deploy-policies.md b/education/windows/tutorial-deploy-apps-winse/deploy-policies.md index 330d85b61e..63f6143853 100644 --- a/education/windows/tutorial-deploy-apps-winse/deploy-policies.md +++ b/education/windows/tutorial-deploy-apps-winse/deploy-policies.md @@ -1,7 +1,7 @@ --- title: Deploy policies to enable applications description: Learn how to deploy AppLocker policies to enable apps execution on Windows SE devices. -ms.date: 05/23/2023 +ms.date: 04/10/2024 ms.topic: tutorial appliesto: - ✅ Windows 11 SE, version 22H2 and later diff --git a/education/windows/tutorial-deploy-apps-winse/index.md b/education/windows/tutorial-deploy-apps-winse/index.md index ff7cce6a5f..1c09685eed 100644 --- a/education/windows/tutorial-deploy-apps-winse/index.md +++ b/education/windows/tutorial-deploy-apps-winse/index.md @@ -1,7 +1,7 @@ --- title: Deploy applications to Windows 11 SE with Intune description: Learn how to deploy applications to Windows 11 SE with Intune and how to validate the apps. -ms.date: 06/07/2023 +ms.date: 04/10/2024 ms.topic: tutorial appliesto: - ✅ Windows 11 SE, version 22H2 and later diff --git a/education/windows/tutorial-deploy-apps-winse/troubleshoot.md b/education/windows/tutorial-deploy-apps-winse/troubleshoot.md index 631b12b06e..38a3ee9d4c 100644 --- a/education/windows/tutorial-deploy-apps-winse/troubleshoot.md +++ b/education/windows/tutorial-deploy-apps-winse/troubleshoot.md @@ -1,7 +1,7 @@ --- title: Troubleshoot app deployment issues in Windows SE description: Troubleshoot common issues when deploying apps to Windows SE devices. -ms.date: 06/19/2023 +ms.date: 04/10/2024 ms.topic: tutorial appliesto: - ✅ Windows 11 SE, version 22H2 and later @@ -45,10 +45,10 @@ Use the Event Viewer to see if a supplemental policy is deployed correctly. Thes ``` citool.exe -lp ``` - + - For the policy that allows managed installers to run, a policyID `C0DB889B-59C5-453C-B297-399C851934E4` and Friendly Name *[Win-EDU] Microsoft Apps Supplemental Policy - Prod* should be present, and have **Is Currently Enforced** showing as **true** - For any additional policies that you deploy, check that a policy with a matching ID and Friendly Name is shown in the list and the **Is Currently Enforced** and **Is Authorized** properties are both showing as **true** - + :::image type="content" source="images/troubleshoot-citool.png" alt-text="Screenshot of the output of citool.exe with the Win-EDU supplemental policy."::: 1. Check for **error events** with code **3077**: and reference [Understanding Application Control event IDs][WIN-1] diff --git a/education/windows/tutorial-deploy-apps-winse/validate-apps.md b/education/windows/tutorial-deploy-apps-winse/validate-apps.md index a3e128a92e..211638de72 100644 --- a/education/windows/tutorial-deploy-apps-winse/validate-apps.md +++ b/education/windows/tutorial-deploy-apps-winse/validate-apps.md @@ -1,7 +1,7 @@ --- title: Validate the applications deployed to Windows SE devices description: Learn how to validate the applications deployed to Windows SE devices via Intune. -ms.date: 06/19/2023 +ms.date: 04/10/2024 ms.topic: tutorial appliesto: - ✅ Windows 11 SE, version 22H2 and later @@ -65,11 +65,11 @@ To check the installation status of an app from the Intune portal: 1. Select **App > All apps** 1. Select the application you want to check 1. From the **Overview** page, you can verify the overall installation status - + :::image type="content" source="./images/intune-app-install-overview.png" alt-text="Screenshot of the Microsoft Intune admin center - App installation details." lightbox="./images/intune-app-install-overview.png"::: 1. From the **Device install status** page, you can verify the installation status for each device, and the status code that indicates the cause of the failure - + :::image type="content" source="./images/intune-app-install-status.png" alt-text="Screenshot of the Microsoft Intune admin center - App installation status for each device." lightbox="./images/intune-app-install-status.png"::: > [!NOTE] diff --git a/education/windows/windows-11-se-overview.md b/education/windows/windows-11-se-overview.md index eec8f909f1..56477ff62e 100644 --- a/education/windows/windows-11-se-overview.md +++ b/education/windows/windows-11-se-overview.md @@ -102,10 +102,10 @@ The following applications can also run on Windows 11 SE, and can be deployed us | `ContentKeeper Cloud` | 9.01.45 | `Win32` | `ContentKeeper Technologies` | | `DigiExam` | 14.1.0 | `Win32` | `Digiexam` | | `Digital Secure testing browser` | 15.0.0 | `Win32` | `Digiexam` | -| `Dolphin Guide Connect` | 1.25 | `Win32` | `Dolphin Guide Connect` | +| `Dolphin Guide Connect` | 1.27 | `Win32` | `Dolphin Guide Connect` | | `Dragon Professional Individual` | 15.00.100 | `Win32` | `Nuance Communications` | | `DRC INSIGHT Online Assessments` | 14.0.0.0 | `Store` | `Data recognition Corporation` | -| `Duo from Cisco` | 3.0.0 | `Win32` | `Cisco` | +| `Duo from Cisco` | 6.3.0 | `Win32` | `Cisco` | | `Dyknow` | 7.9.13.7 | `Win32` | `Dyknow` | | `e-Speaking Voice and Speech recognition` | 4.4.0.11 | `Win32` | `e-speaking` | | `EasyReader` | 10.0.4.498 | `Win32` | `Dolphin Computer Access` | @@ -114,7 +114,7 @@ The following applications can also run on Windows 11 SE, and can be deployed us | `ESET Endpoint Security` | 10.1.2046.0 | `Win32` | `ESET` | | `ESET Remote Administrator Agent` | 10.0.1126.0 | `Win32` | `ESET` | | `eTests` | 4.0.25 | `Win32` | `CASAS` | -| `Exam Writepad` | 23.2.4.2338 | `Win32` | `Sheldnet` | +| `Exam Writepad` | 23.12.10.1200 | `Win32` | `Sheldnet` | | `FirstVoices Keyboard` | 15.0.270 | `Win32` | `SIL International` | | `FortiClient` | 7.2.0.4034+ | `Win32` | `Fortinet` | | `Free NaturalReader` | 16.1.2 | `Win32` | `Natural Soft` | @@ -126,8 +126,10 @@ The following applications can also run on Windows 11 SE, and can be deployed us | `Immunet` | 7.5.8.21178 | `Win32` | `Immunet` | | `Impero Backdrop Client` | 5.0.151 | `Win32` | `Impero Software` | | `IMT Lazarus` | 2.86.0 | `Win32` | `IMTLazarus` | +| `Inprint` | 3.7.6 | `Win32` | `Inprint` | | `Inspiration 10` | 10.11 | `Win32` | `TechEdology Ltd` | -| `JAWS for Windows` | 2023.2307.37 | `Win32` | `Freedom Scientific` | +| `Instashare` | 1.3.13.0 | `Win32` | `Instashare` | +| `JAWS for Windows` | 2024.2312.53 | `Win32` | `Freedom Scientific` | | `Kite Student Portal` | 9.0.0.0 | `Win32` | `Dynamic Learning Maps` | | `Keyman` | 16.0.142 | `Win32` | `SIL International` | | `Kortext` | 2.3.433.0 | `Store` | `Kortext` | @@ -155,7 +157,7 @@ The following applications can also run on Windows 11 SE, and can be deployed us | `NetSupport School` | 14.00.0012 | `Win32` | `NetSupport` | | `NextUp Talker` | 1.0.49 | `Win32` | `NextUp Technologies` | | `Netsweeper Workstation Agent` | 4.50.54.54 | `Win32` | `Netsweeper` | -| `NonVisual Desktop Access` | 2023.1. | `Win32` | `NV Access` | +| `NonVisual Desktop Access` | 2023.3 | `Win32` | `NV Access` | | `NWEA Secure Testing Browser` | 5.4.387.0 | `Win32` | `NWEA` | | `PC Talker Neo` | 2209 | `Win32` | `Kochi System Development` | | `PC Talker Neo Plus` | 2209 | `Win32` | `Kochi System Development` | @@ -166,7 +168,7 @@ The following applications can also run on Windows 11 SE, and can be deployed us | `ReadAndWriteForWindows` | 12.0.78 | `Win32` | `Texthelp Ltd.` | | `Remote Desktop client (MSRDC)` | 1.2.4487.0 | `Win32` | `Microsoft` | | `Remote Help` | 5.0.1311.0 | `Win32` | `Microsoft` | -| `Respondus Lockdown Browser` | 2.0.9.03 | `Win32` | `Respondus` | +| `Respondus Lockdown Browser` | 2.1.1.05 | `Win32` | `Respondus` | | `Safe Exam Browser` | 3.5.0.544 | `Win32` | `Safe Exam Browser` | |`SchoolYear` | 3.5.4 | `Win32` |`SchoolYear` | |`School Manager` | 3.6.10-1149 | `Win32` |`Linewize` | @@ -175,9 +177,10 @@ The following applications can also run on Windows 11 SE, and can be deployed us | `Senso.Cloud` |2021.11.15.0 | `Win32` | `Senso.Cloud` | | `Skoolnext` | 2.19 | `Win32` | `Skool.net` | | `Smoothwall Monitor` | 2.9.2 | `Win32` | `Smoothwall Ltd` | -| `SuperNova Magnifier & Screen Reader` | 22.03 | `Win32` | `Dolphin Computer Access` | +| `SuperNova Magnifier & Screen Reader` | 22.04 | `Win32` | `Dolphin Computer Access` | | `SuperNova Magnifier & Speech` | 21.03 | `Win32` | `Dolphin Computer Access` | -|`TX Secure Browser` | 15.0.0 | `Win32` | `Cambium Development` | +| `Snapplify` | 6.9.7 | `Win32` | `Snapplify` | +|`TX Secure Browser` | 16.0.0 | `Win32` | `Cambium Development` | | `VitalSourceBookShelf` | 10.2.26.0 | `Win32` | `VitalSource Technologies Inc` | |`WA Secure Browser` | 16.0.0 | `Win32` | `Cambium Development` | | `Winbird` | 19 | `Win32` | `Winbird Co., Ltd.` | @@ -185,8 +188,8 @@ The following applications can also run on Windows 11 SE, and can be deployed us | `Windows SEB` | 3.4.0 | `Win32` | `Illinois Stateboard of Education` | | `Windows Notepad` | 12.0.78 | `Store` | `Microsoft Corporation` | | `Zoom` | 5.12.8 (10232) | `Win32` | `Zoom` | -| `ZoomText Fusion` | 2023.2307.7.400 | `Win32` | `Freedom Scientific` | -| `ZoomText Magnifier/Reader` | 2023.2307.29.400 | `Win32` | `Freedom Scientific` | +| `ZoomText Fusion` | 2024.2310.13.400 | `Win32` | `Freedom Scientific` | +| `ZoomText Magnifier/Reader` | 2024.2312.26.400 | `Win32` | `Freedom Scientific` | ## Add your own applications @@ -224,4 +227,4 @@ For more information on Intune requirements for adding education apps, see [Conf [EDUWIN-1]: /education/windows/tutorial-school-deployment/configure-device-apps [EDUWIN-2]: /education/windows/tutorial-school-deployment/ -[WIN-1]: /windows/whats-new/windows-11-requirements \ No newline at end of file +[WIN-1]: /windows/whats-new/windows-11-requirements diff --git a/windows/client-management/client-tools/quick-assist.md b/windows/client-management/client-tools/quick-assist.md index f902b92204..6239626e67 100644 --- a/windows/client-management/client-tools/quick-assist.md +++ b/windows/client-management/client-tools/quick-assist.md @@ -11,7 +11,7 @@ ms.collection: # Use Quick Assist to help users -Quick Assist is a Microsoft Store application that enables a person to share their device with another person over a remote connection. Your support staff can use it to remotely connect to a user's device and then view its display, make annotations, or take full control. In this way, they can troubleshoot, diagnose technological issues, and provide instructions to users directly on their devices. +Quick Assist is an application that enables a person to share their [Windows](#install-quick-assist-on-windows) or [macOS](#install-quick-assist-on-macos) device with another person over a remote connection. Your support staff can use it to remotely connect to a user's device and then view its display, make annotations, or take full control. In this way, they can troubleshoot, diagnose technological issues, and provide instructions to users directly on their devices. ## Before you begin @@ -89,7 +89,7 @@ Microsoft logs a small amount of session data to monitor the health of the Quick In some scenarios, the helper does require the sharer to respond to application permission prompts (User Account Control), but otherwise the helper has the same permissions as the sharer on the device. -## Install Quick Assist +## Install Quick Assist on Windows ### Install Quick Assist from the Microsoft Store @@ -127,7 +127,7 @@ To install Quick Assist offline, you need to download your APPXBUNDLE and unenco 1. Run the following command to install Quick Assist: `Add-AppxProvisionedPackage -Online -PackagePath "MicrosoftCorporationII.QuickAssist_8wekyb3d8bbwe.AppxBundle" -LicensePath "MicrosoftCorporationII.QuickAssist_8wekyb3d8bbwe_4bc27046-84c5-8679-dcc7-d44c77a47dd0.xml"` 1. After Quick Assist has installed, run this command to confirm that Quick Assist is installed for the user: `Get-AppxPackage *QuickAssist* -AllUsers` -## Microsoft Edge WebView2 +### Microsoft Edge WebView2 The Microsoft Edge WebView2 is a development control that uses Microsoft Edge as the rendering engine to display web content in native apps. The new Quick Assist application has been developed using this control, making it a necessary component for the app to function. @@ -136,6 +136,13 @@ The Microsoft Edge WebView2 is a development control that uses Microsoft Edg For more information on distributing and installing Microsoft Edge WebView2, visit [Distribute your app and the WebView2 Runtime](/microsoft-edge/webview2/concepts/distribution) +## Install Quick Assist on macOS + +Quick Assist for macOS is available for interactions with Microsoft Support. If Microsoft products on your macOS device are not working as expected, contact [Microsoft Support](https://support.microsoft.com/contactus) for assistance. Your Microsoft Support agent will guide you through the process of downloading and installing it on your device. + +> [!NOTE] +> Quick Assist for macOS is not available outside of Microsoft Support interactions. + ## Next steps If you have any problems, questions, or suggestions for Quick Assist, contact us by using the [Feedback Hub app](https://support.microsoft.com/windows/send-feedback-to-microsoft-with-the-feedback-hub-app-f59187f8-8739-22d6-ba93-f66612949332). diff --git a/windows/client-management/mdm/activesync-ddf-file.md b/windows/client-management/mdm/activesync-ddf-file.md index b32ae659db..b48213ce4d 100644 --- a/windows/client-management/mdm/activesync-ddf-file.md +++ b/windows/client-management/mdm/activesync-ddf-file.md @@ -1,7 +1,7 @@ --- title: ActiveSync DDF file description: View the XML file containing the device description framework (DDF) for the ActiveSync configuration service provider. -ms.date: 01/18/2024 +ms.date: 04/10/2024 --- @@ -40,7 +40,7 @@ The following XML file contains the device description framework (DDF) for the A 10.0.10240 1.0 - 0x4;0x1B;0x30;0x31;0x48;0x54;0x62;0x63;0x64;0x65;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xBC;0xBF;0xCA;0xCB;0xCD;0xCF; + 0x4;0x1B;0x30;0x31;0x48;0x54;0x62;0x63;0x64;0x65;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xBC;0xBF;0xCA;0xCB;0xCD;0xCF;0xD2; diff --git a/windows/client-management/mdm/applocker-ddf-file.md b/windows/client-management/mdm/applocker-ddf-file.md index 11f10bf906..f712663818 100644 --- a/windows/client-management/mdm/applocker-ddf-file.md +++ b/windows/client-management/mdm/applocker-ddf-file.md @@ -1,7 +1,7 @@ --- title: AppLocker DDF file description: View the XML file containing the device description framework (DDF) for the AppLocker configuration service provider. -ms.date: 01/18/2024 +ms.date: 04/10/2024 --- @@ -40,7 +40,7 @@ The following XML file contains the device description framework (DDF) for the A 10.0.10586 1.0 - 0x4;0x1B;0x30;0x31;0x48;0x54;0x62;0x63;0x64;0x65;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xBC;0xBF;0xCA;0xCB;0xCD;0xCF; + 0x4;0x1B;0x30;0x31;0x48;0x54;0x62;0x63;0x64;0x65;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xBC;0xBF;0xCA;0xCB;0xCD;0xCF;0xD2; diff --git a/windows/client-management/mdm/assignedaccess-csp.md b/windows/client-management/mdm/assignedaccess-csp.md index df25725c5a..cc69b6bb5a 100644 --- a/windows/client-management/mdm/assignedaccess-csp.md +++ b/windows/client-management/mdm/assignedaccess-csp.md @@ -1,7 +1,7 @@ --- title: AssignedAccess CSP description: Learn more about the AssignedAccess CSP. -ms.date: 02/29/2024 +ms.date: 04/10/2024 --- @@ -14,7 +14,6 @@ ms.date: 02/29/2024 The AssignedAccess configuration service provider (CSP) is used to configure a kiosk or restricted user experience. Once the CSP is executed, the next user login that is associated with the Assigned Access profile puts the device into the kiosk mode specified in the CSP configuration. To learn more about how to configure Assigned Access, see [Configure kiosks and restricted user experiences](/windows/configuration/assigned-access). - @@ -51,7 +50,6 @@ This node accepts an AssignedAccessConfiguration xml as input. To learn how to configure xml file, see [Create an Assigned Access configuration XML file](/windows/configuration/assigned-access/configuration-file) - diff --git a/windows/client-management/mdm/assignedaccess-ddf.md b/windows/client-management/mdm/assignedaccess-ddf.md index f5e0e84d26..5b113fb30f 100644 --- a/windows/client-management/mdm/assignedaccess-ddf.md +++ b/windows/client-management/mdm/assignedaccess-ddf.md @@ -1,7 +1,7 @@ --- title: AssignedAccess DDF file description: View the XML file containing the device description framework (DDF) for the AssignedAccess configuration service provider. -ms.date: 01/18/2024 +ms.date: 04/10/2024 --- @@ -40,7 +40,7 @@ The following XML file contains the device description framework (DDF) for the A 10.0.10240 1.0 - 0x4;0x1B;0x30;0x31;0x48;0x54;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x88;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xBC;0xBF;0xCA;0xCB;0xCD;0xCF; + 0x4;0x1B;0x30;0x31;0x48;0x54;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x88;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xBC;0xBF;0xCA;0xCB;0xCD;0xCF;0xD2; @@ -54,7 +54,7 @@ The following XML file contains the device description framework (DDF) for the A This node can accept and return json string which comprises of account name, and AUMID for Kiosk mode app. -Example: {"User":"domain\\user", "AUMID":"Microsoft.WindowsCalculator_8wekyb3d8bbwe!App"}. +Example: {"User":"domain\\user", "AUMID":"Microsoft.WindowsCalculator_8wekyb3d8bbwe!App"}. When configuring kiosk mode app, account name will be used to find the target user. Account name includes domain name and user name. Domain name can be optional if user name is unique across the system. For a local account, domain name should be machine name. When "Get" is executed on this node, domain name is always returned in the output. diff --git a/windows/client-management/mdm/bitlocker-ddf-file.md b/windows/client-management/mdm/bitlocker-ddf-file.md index 5f89c0bace..738dea71d0 100644 --- a/windows/client-management/mdm/bitlocker-ddf-file.md +++ b/windows/client-management/mdm/bitlocker-ddf-file.md @@ -1,7 +1,7 @@ --- title: BitLocker DDF file description: View the XML file containing the device description framework (DDF) for the BitLocker configuration service provider. -ms.date: 01/18/2024 +ms.date: 04/10/2024 --- @@ -39,7 +39,7 @@ The following XML file contains the device description framework (DDF) for the B 10.0.15063 1.0 - 0x4;0x1B;0x30;0x31;0x48;0x54;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xBC;0xBF;0xCA;0xCB;0xCD;0xCF; + 0x4;0x1B;0x30;0x31;0x48;0x54;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xBC;0xBF;0xCA;0xCB;0xCD;0xCF;0xD2; @@ -142,7 +142,7 @@ The following XML file contains the device description framework (DDF) for the B If you disable or do not configure this policy setting, BitLocker will use the default encryption method of XTS-AES 128-bit or the encryption method specified by any setup script.” The format is string. Sample value for this node to enable this policy and set the encryption methods is: - + EncryptionMethodWithXtsOsDropDown_Name = Select the encryption method for operating system drives. EncryptionMethodWithXtsFdvDropDown_Name = Select the encryption method for fixed data drives. @@ -194,7 +194,7 @@ The following XML file contains the device description framework (DDF) for the B Note: If you want to require the use of a startup PIN and a USB flash drive, you must configure BitLocker settings using the command-line tool manage-bde instead of the BitLocker Drive Encryption setup wizard. The format is string. Sample value for this node to enable this policy is: - + ConfigureNonTPMStartupKeyUsage_Name = Allow BitLocker without a compatible TPM (requires a password or a startup key on a USB flash drive) All of the below settings are for computers with a TPM. @@ -250,7 +250,7 @@ The following XML file contains the device description framework (DDF) for the B NOTE: If minimum PIN length is set below 6 digits, Windows will attempt to update the TPM 2.0 lockout period to be greater than the default when a PIN is changed. If successful, Windows will only reset the TPM lockout period back to default if the TPM is reset. The format is string. Sample value for this node to enable this policy is: - + Disabling the policy will let the system choose the default behaviors. If you want to disable this policy use the following SyncML: @@ -291,7 +291,7 @@ The following XML file contains the device description framework (DDF) for the B Note: Not all characters and languages are supported in pre-boot. It is strongly recommended that you test that the characters you use for the custom message or URL appear correctly on the pre-boot recovery screen. The format is string. Sample value for this node to enable this policy is: - + The possible values for 'xx' are: 0 = Empty @@ -344,7 +344,7 @@ The following XML file contains the device description framework (DDF) for the B If this policy setting is disabled or not configured, the default recovery options are supported for BitLocker recovery. By default a DRA is allowed, the recovery options can be specified by the user including the recovery password and recovery key, and recovery information is not backed up to AD DS. The format is string. Sample value for this node to enable this policy is: - + The possible values for 'xx' are: true = Explicitly allow @@ -402,7 +402,7 @@ The following XML file contains the device description framework (DDF) for the B If you enable this policy setting, you can control the methods available to users to recover data from BitLocker-protected fixed data drives. The format is string. Sample value for this node to enable this policy is: - + The possible values for 'xx' are: true = Explicitly allow @@ -454,7 +454,7 @@ The following XML file contains the device description framework (DDF) for the B If you disable or do not configure this policy setting, all fixed data drives on the computer will be mounted with read and write access. The format is string. Sample value for this node to enable this policy is: - + Disabling the policy will let the system choose the default behaviors. If you want to disable this policy use the following SyncML: @@ -495,7 +495,7 @@ The following XML file contains the device description framework (DDF) for the B Note: This policy setting can be overridden by the group policy settings under User Configuration\Administrative Templates\System\Removable Storage Access. If the "Removable Disks: Deny write access" group policy setting is enabled this policy setting will be ignored. The format is string. Sample value for this node to enable this policy is: - + The possible values for 'xx' are: true = Explicitly allow @@ -575,7 +575,7 @@ The following XML file contains the device description framework (DDF) for the B require reinstallation of Windows. Note: This policy takes effect only if "RequireDeviceEncryption" policy is set to 1. The format is integer. - The expected values for this policy are: + The expected values for this policy are: 1 = This is the default, when the policy is not set. Warning prompt and encryption notification is allowed. 0 = Disables the warning prompt and encryption notification. Starting in Windows 10, next major update, @@ -623,7 +623,7 @@ The following XML file contains the device description framework (DDF) for the B If "AllowWarningForOtherDiskEncryption" is not set, or is set to "1", "RequireDeviceEncryption" policy will not try to encrypt drive(s) if a standard user is the current logged on user in the system. - The expected values for this policy are: + The expected values for this policy are: 1 = "RequireDeviceEncryption" policy will try to enable encryption on all fixed drives even if a current logged in user is standard user. 0 = This is the default, when the policy is not set. If current logged on user is a standard user, "RequireDeviceEncryption" policy @@ -741,7 +741,7 @@ The policy only comes into effect when Active Directory backup for a recovery pa * status\RotateRecoveryPasswordsStatus * status\RotateRecoveryPasswordsRequestID - + Supported Values: String form of request ID. Example format of request ID is GUID. Server can choose the format as needed according to the management tools.\ diff --git a/windows/client-management/mdm/clientcertificateinstall-csp.md b/windows/client-management/mdm/clientcertificateinstall-csp.md index af84e44ec7..89b0a33e28 100644 --- a/windows/client-management/mdm/clientcertificateinstall-csp.md +++ b/windows/client-management/mdm/clientcertificateinstall-csp.md @@ -1,7 +1,7 @@ --- title: ClientCertificateInstall CSP description: Learn more about the ClientCertificateInstall CSP. -ms.date: 01/31/2024 +ms.date: 04/10/2024 --- @@ -9,6 +9,8 @@ ms.date: 01/31/2024 # ClientCertificateInstall CSP +[!INCLUDE [Windows Insider tip](includes/mdm-insider-csp-note.md)] + The ClientCertificateInstall configuration service provider enables the enterprise to install client certificates. A client certificate has a unique ID, which is the *\[UniqueID\]* for this configuration. Each client certificate must have different UniqueIDs for the SCEP enrollment request. @@ -38,6 +40,7 @@ The following list shows the ClientCertificateInstall configuration service prov - [ErrorCode](#devicescepuniqueiderrorcode) - [Install](#devicescepuniqueidinstall) - [AADKeyIdentifierList](#devicescepuniqueidinstallaadkeyidentifierlist) + - [AttestPrivateKey](#devicescepuniqueidinstallattestprivatekey) - [CAThumbprint](#devicescepuniqueidinstallcathumbprint) - [Challenge](#devicescepuniqueidinstallchallenge) - [ContainerName](#devicescepuniqueidinstallcontainername) @@ -76,6 +79,7 @@ The following list shows the ClientCertificateInstall configuration service prov - [ErrorCode](#userscepuniqueiderrorcode) - [Install](#userscepuniqueidinstall) - [AADKeyIdentifierList](#userscepuniqueidinstallaadkeyidentifierlist) + - [AttestPrivateKey](#userscepuniqueidinstallattestprivatekey) - [CAThumbprint](#userscepuniqueidinstallcathumbprint) - [Challenge](#userscepuniqueidinstallchallenge) - [ContainerName](#userscepuniqueidinstallcontainername) @@ -828,6 +832,45 @@ Optional. Specify the Microsoft Entra ID Key Identifier List as a semicolon sepa + +##### Device/SCEP/{UniqueID}/Install/AttestPrivateKey + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | + + + +```Device +./Device/Vendor/MSFT/ClientCertificateInstall/SCEP/{UniqueID}/Install/AttestPrivateKey +``` + + + + +Defines the attest SCEP private key behavior 0 - normal, 1 - best effort, 2 - on error, fail the installation. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | `int` | +| Access Type | Add, Get | + + + + + + + + ##### Device/SCEP/{UniqueID}/Install/CAThumbprint @@ -2402,6 +2445,55 @@ Optional. Specify the Microsoft Entra ID Key Identifier List as a semicolon sepa + +##### User/SCEP/{UniqueID}/Install/AttestPrivateKey + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | + + + +```User +./User/Vendor/MSFT/ClientCertificateInstall/SCEP/{UniqueID}/Install/AttestPrivateKey +``` + + + + +Defines the attest SCEP private key behavior 0 - normal, 1 - best effort, 2 - on error, fail the installation. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | `int` | +| Access Type | Add, Get | + + + +**Allowed values**: + +| Value | Description | +|:--|:--| +| 0 | Don't attest private key. | +| 1 | Attest key, but in case attestation failed, best effort approach - CSR is sent to the server. | +| 2 | Attest key, but in case attestation failed, fail fast (i.e release the key and not issue a CSR to the server). | + + + + + + + + ##### User/SCEP/{UniqueID}/Install/CAThumbprint diff --git a/windows/client-management/mdm/clientcertificateinstall-ddf-file.md b/windows/client-management/mdm/clientcertificateinstall-ddf-file.md index 7648af9a26..2d9b0700a3 100644 --- a/windows/client-management/mdm/clientcertificateinstall-ddf-file.md +++ b/windows/client-management/mdm/clientcertificateinstall-ddf-file.md @@ -1,7 +1,7 @@ --- title: ClientCertificateInstall DDF file description: View the XML file containing the device description framework (DDF) for the ClientCertificateInstall configuration service provider. -ms.date: 01/31/2024 +ms.date: 04/10/2024 --- @@ -72,8 +72,8 @@ The following XML file contains the device description framework (DDF) for the C - Required for PFX certificate installation. A unique ID to differentiate different certificate install requests. -Format is node. + Required for PFX certificate installation. A unique ID to differentiate different certificate install requests. +Format is node. Calling Delete on the this node, should delete the certificates and the keys that were installed by the corresponding PFX blob. @@ -143,7 +143,7 @@ Calling Delete on the this node, should delete the certificates and the keys tha - Optional. + Optional. Specifies the NGC container name (if NGC KSP is chosen for above node). If this node is not specified when NGC KSP is chosen, enrollment will fail. @@ -169,7 +169,7 @@ Specifies the NGC container name (if NGC KSP is chosen for above node). If this - Required. + Required. CRYPT_DATA_BLOB structure that contains a PFX packet with the exported and encrypted certificates and keys. Add on this node will trigger the addition to the PFX certificate. This requires that all the other nodes under UniqueID that are parameters for PFX installation (Container Name, KeyLocation, CertPassword, fKeyExportable) are present before this is called. This will also set the Status node to the current Status of the operation. If Add is called on this node and a blob already exists, it will fail. If Replace is called on this node, the certificates will be overwritten. If Add is called on this node for a new PFX, the certificate will be added. If Replace is called on this node when it does not exist, this will fail. @@ -227,7 +227,7 @@ CRYPT_DATA_BLOB on MSDN can be found at http://msdn.microsoft.com/en-us/library/ 0 Optional. Used to specify if the PFX certificate password is encrypted with a certificate. -If the value is +If the value is 0 - Password is not encrypted 1- Password is encrypted using the MDM certificate by the MDM server 2 - Password is encrypted by a Custom Certificate by the MDM server. When this value is used here, also specify the custom store name in the PFXCertPasswordEncryptionStore node. @@ -353,7 +353,7 @@ If the value is - Optional. + Optional. When a value of "2" is contained iin PFXCertPasswordEncryptionType, specify the store name where the certificate for decrypting the PFXCertPassword is stored. @@ -413,7 +413,7 @@ When a value of "2" is contained iin PFXCertPasswordEncryptionType, specify the - Required for SCEP certificate installation. A unique ID to differentiate different certificate install requests. + Required for SCEP certificate installation. A unique ID to differentiate different certificate install requests. Calling Delete on the this node, should delete the corresponding SCEP certificate @@ -560,6 +560,46 @@ Calling Delete on the this node, should delete the corresponding SCEP certificat + + AttestPrivateKey + + + + + + Defines the attest SCEP private key behavior 0 - normal, 1 - best effort, 2 - on error, fail the installation + + + + + + + + + + + + + + 99.9.99999 + 9.9 + + + + 0 + Do not attest private key + + + 1 + Attest key, but in case attestation failed, best effort approach - CSR is sent to the server + + + 2 + Attest key, but in case attestation failed, fail fast (i.e release the key and not issue a CSR to the server) + + + + SubjectName @@ -596,7 +636,7 @@ Calling Delete on the this node, should delete the corresponding SCEP certificat 3 - Optional. Specify where to keep the private key. Note that even it is protected by TPM, it is not guarded with TPM PIN. + Optional. Specify where to keep the private key. Note that even it is protected by TPM, it is not guarded with TPM PIN. SCEP enrolled cert doesn’t support TPM PIN protection. @@ -640,7 +680,7 @@ SCEP enrolled cert doesn’t support TPM PIN protection. 5 - Optional. When the SCEP server sends pending status, specify device retry waiting time in minutes. + Optional. When the SCEP server sends pending status, specify device retry waiting time in minutes. Default value is: 5 The min value is 1. @@ -725,7 +765,7 @@ The min value is 0 which means no retry. - Required for enrollment. Specify private key length (RSA). + Required for enrollment. Specify private key length (RSA). Valid value: 1024, 2048, 4096. For NGC, only 2048 is the supported keylength. @@ -764,7 +804,7 @@ Valid value: 1024, 2048, 4096. For NGC, only 2048 is the supported keylength. - Required for enrollment. Hash algorithm family (SHA-1, SHA-2, SHA-3) specified by MDM server. If multiple hash algorithm families are specified, they must be separated via +. + Required for enrollment. Hash algorithm family (SHA-1, SHA-2, SHA-3) specified by MDM server. If multiple hash algorithm families are specified, they must be separated via +. For NGC, only SHA256 is supported as the supported algorithm @@ -845,7 +885,7 @@ For NGC, only SHA256 is supported as the supported algorithm Days - Optional. Specify the units for valid period. Valid values are: Days(Default), Months, Years. + Optional. Specify the units for valid period. Valid values are: Days(Default), Months, Years. MDM server expected certificate validation period (ValidPeriodUnits + ValidPerio) the SCEP server as part of certificate enrollment request. It is the server’s decision on how to use this valid period to create the certificate. @@ -885,7 +925,7 @@ MDM server expected certificate validation period (ValidPeriodUnits + ValidPerio 0 - Optional. Specify desired number of units used in validity period. Subjected to SCEP server configuration. Default is 0. The units are defined in ValidPeriod node. Note the valid period specified by MDM will overwrite the valid period specified in cert template. For example, if ValidPeriod is days and ValidPeriodUnits is 30, it means the total valid duration is 30 days. + Optional. Specify desired number of units used in validity period. Subjected to SCEP server configuration. Default is 0. The units are defined in ValidPeriod node. Note the valid period specified by MDM will overwrite the valid period specified in cert template. For example, if ValidPeriod is days and ValidPeriodUnits is 30, it means the total valid duration is 30 days. NOTE: The device only sends the MDM server expected certificate validation period (ValidPeriodUnits + ValidPerio) the SCEP server as part of certificate enrollment request. It is the server’s decision on how to use this valid period to create the certificate. @@ -912,7 +952,7 @@ NOTE: The device only sends the MDM server expected certificate validation perio - Optional. + Optional. Specifies the NGC container name (if NGC KSP is chosen for above node). If this node is not specified when NGC KSP is chosen, enrollment will fail. @@ -1155,8 +1195,8 @@ Valid values are: - Required for PFX certificate installation. A unique ID to differentiate different certificate install requests. -Format is node. + Required for PFX certificate installation. A unique ID to differentiate different certificate install requests. +Format is node. Calling Delete on the this node, should delete the certificates and the keys that were installed by the corresponding PFX blob. @@ -1226,7 +1266,7 @@ Calling Delete on the this node, should delete the certificates and the keys tha - Optional. + Optional. Specifies the NGC container name (if NGC KSP is chosen for above node). If this node is not specified when NGC KSP is chosen, enrollment will fail. @@ -1252,7 +1292,7 @@ Specifies the NGC container name (if NGC KSP is chosen for above node). If this - Required. + Required. CRYPT_DATA_BLOB structure that contains a PFX packet with the exported and encrypted certificates and keys. Add on this node will trigger the addition to the PFX certificate. This requires that all the other nodes under UniqueID that are parameters for PFX installation (Container Name, KeyLocation, CertPassword, fKeyExportable) are present before this is called. This will also set the Status node to the current Status of the operation. If Add is called on this node and a blob already exists, it will fail. If Replace is called on this node, the certificates will be overwritten. If Add is called on this node for a new PFX, the certificate will be added. If Replace is called on this node when it does not exist, this will fail. @@ -1310,7 +1350,7 @@ CRYPT_DATA_BLOB on MSDN can be found at http://msdn.microsoft.com/en-us/library/ 0 Optional. Used to specify if the PFX certificate password is encrypted with a certificate. -If the value is +If the value is 0 - Password is not encrypted 1- Password is encrypted using the MDM certificate by the MDM server 2 - Password is encrypted by a Custom Certificate by the MDM server. When this value is used here, also specify the custom store name in the PFXCertPasswordEncryptionStore node. @@ -1436,7 +1476,7 @@ If the value is - Optional. + Optional. When a value of "2" is contained iin PFXCertPasswordEncryptionType, specify the store name where the certificate for decrypting the PFXCertPassword is stored. @@ -1496,7 +1536,7 @@ When a value of "2" is contained iin PFXCertPasswordEncryptionType, specify the - Required for SCEP certificate installation. A unique ID to differentiate different certificate install requests. + Required for SCEP certificate installation. A unique ID to differentiate different certificate install requests. Calling Delete on the this node, should delete the corresponding SCEP certificate @@ -1643,6 +1683,34 @@ Calling Delete on the this node, should delete the corresponding SCEP certificat + + AttestPrivateKey + + + + + + Defines the attest SCEP private key behavior 0 - normal, 1 - best effort, 2 - on error, fail the installation + + + + + + + + + + + + + + 99.9.99999 + 9.9 + + + + + SubjectName @@ -1679,7 +1747,7 @@ Calling Delete on the this node, should delete the corresponding SCEP certificat 3 - Optional. Specify where to keep the private key. Note that even it is protected by TPM, it is not guarded with TPM PIN. + Optional. Specify where to keep the private key. Note that even it is protected by TPM, it is not guarded with TPM PIN. SCEP enrolled cert doesn’t support TPM PIN protection. @@ -1723,7 +1791,7 @@ SCEP enrolled cert doesn’t support TPM PIN protection. 5 - Optional. When the SCEP server sends pending status, specify device retry waiting time in minutes. + Optional. When the SCEP server sends pending status, specify device retry waiting time in minutes. Default value is: 5 The min value is 1. @@ -1808,7 +1876,7 @@ The min value is 0 which means no retry. - Required for enrollment. Specify private key length (RSA). + Required for enrollment. Specify private key length (RSA). Valid value: 1024, 2048, 4096. For NGC, only 2048 is the supported keylength. @@ -1847,7 +1915,7 @@ Valid value: 1024, 2048, 4096. For NGC, only 2048 is the supported keylength. - Required for enrollment. Hash algorithm family (SHA-1, SHA-2, SHA-3) specified by MDM server. If multiple hash algorithm families are specified, they must be separated via +. + Required for enrollment. Hash algorithm family (SHA-1, SHA-2, SHA-3) specified by MDM server. If multiple hash algorithm families are specified, they must be separated via +. For NGC, only SHA256 is supported as the supported algorithm @@ -1928,7 +1996,7 @@ For NGC, only SHA256 is supported as the supported algorithm Days - Optional. Specify the units for valid period. Valid values are: Days(Default), Months, Years. + Optional. Specify the units for valid period. Valid values are: Days(Default), Months, Years. MDM server expected certificate validation period (ValidPeriodUnits + ValidPerio) the SCEP server as part of certificate enrollment request. It is the server’s decision on how to use this valid period to create the certificate. @@ -1968,7 +2036,7 @@ MDM server expected certificate validation period (ValidPeriodUnits + ValidPerio 0 - Optional. Specify desired number of units used in validity period. Subjected to SCEP server configuration. Default is 0. The units are defined in ValidPeriod node. Note the valid period specified by MDM will overwrite the valid period specified in cert template. For example, if ValidPeriod is days and ValidPeriodUnits is 30, it means the total valid duration is 30 days. + Optional. Specify desired number of units used in validity period. Subjected to SCEP server configuration. Default is 0. The units are defined in ValidPeriod node. Note the valid period specified by MDM will overwrite the valid period specified in cert template. For example, if ValidPeriod is days and ValidPeriodUnits is 30, it means the total valid duration is 30 days. NOTE: The device only sends the MDM server expected certificate validation period (ValidPeriodUnits + ValidPerio) the SCEP server as part of certificate enrollment request. It is the server’s decision on how to use this valid period to create the certificate. @@ -1995,7 +2063,7 @@ NOTE: The device only sends the MDM server expected certificate validation perio - Optional. + Optional. Specifies the NGC container name (if NGC KSP is chosen for above node). If this node is not specified when NGC KSP is chosen, enrollment will fail. diff --git a/windows/client-management/mdm/declaredconfiguration-ddf-file.md b/windows/client-management/mdm/declaredconfiguration-ddf-file.md index 22f6c58926..95751f45be 100644 --- a/windows/client-management/mdm/declaredconfiguration-ddf-file.md +++ b/windows/client-management/mdm/declaredconfiguration-ddf-file.md @@ -1,7 +1,7 @@ --- title: DeclaredConfiguration DDF file description: View the XML file containing the device description framework (DDF) for the DeclaredConfiguration configuration service provider. -ms.date: 01/18/2024 +ms.date: 04/10/2024 --- @@ -40,7 +40,7 @@ The following XML file contains the device description framework (DDF) for the D 99.9.99999 9.9 - 0x4;0x1B;0x30;0x31;0x48;0x54;0x62;0x63;0x64;0x65;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xBC;0xBF;0xCA;0xCB;0xCD;0xCF; + 0x4;0x1B;0x30;0x31;0x48;0x54;0x62;0x63;0x64;0x65;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xBC;0xBF;0xCA;0xCB;0xCD;0xCF;0xD2; diff --git a/windows/client-management/mdm/devdetail-ddf-file.md b/windows/client-management/mdm/devdetail-ddf-file.md index d51d3417ab..6f562d58b4 100644 --- a/windows/client-management/mdm/devdetail-ddf-file.md +++ b/windows/client-management/mdm/devdetail-ddf-file.md @@ -1,7 +1,7 @@ --- title: DevDetail DDF file description: View the XML file containing the device description framework (DDF) for the DevDetail configuration service provider. -ms.date: 01/18/2024 +ms.date: 04/10/2024 --- @@ -40,7 +40,7 @@ The following XML file contains the device description framework (DDF) for the D 10.0.10586 1.0 - 0x4;0x1B;0x30;0x31;0x48;0x54;0x62;0x63;0x64;0x65;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x88;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xBC;0xBF;0xCA;0xCB;0xCD;0xCF; + 0x4;0x1B;0x30;0x31;0x48;0x54;0x62;0x63;0x64;0x65;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x88;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xBC;0xBF;0xCA;0xCB;0xCD;0xCF;0xD2; diff --git a/windows/client-management/mdm/devicemanageability-ddf.md b/windows/client-management/mdm/devicemanageability-ddf.md index e8d4b8243d..cecd7dd921 100644 --- a/windows/client-management/mdm/devicemanageability-ddf.md +++ b/windows/client-management/mdm/devicemanageability-ddf.md @@ -1,7 +1,7 @@ --- title: DeviceManageability DDF file description: View the XML file containing the device description framework (DDF) for the DeviceManageability configuration service provider. -ms.date: 01/18/2024 +ms.date: 04/10/2024 --- @@ -42,7 +42,7 @@ The following XML file contains the device description framework (DDF) for the D 10.0.14393 1.0 - 0x4;0x1B;0x30;0x31;0x48;0x54;0x62;0x63;0x64;0x65;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x88;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xBC;0xBF;0xCA;0xCB;0xCD;0xCF; + 0x4;0x1B;0x30;0x31;0x48;0x54;0x62;0x63;0x64;0x65;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x88;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xBC;0xBF;0xCA;0xCB;0xCD;0xCF;0xD2; diff --git a/windows/client-management/mdm/devicepreparation-csp.md b/windows/client-management/mdm/devicepreparation-csp.md index fee0e44a1b..b93cdfd164 100644 --- a/windows/client-management/mdm/devicepreparation-csp.md +++ b/windows/client-management/mdm/devicepreparation-csp.md @@ -1,7 +1,7 @@ --- title: DevicePreparation CSP description: Learn more about the DevicePreparation CSP. -ms.date: 01/31/2024 +ms.date: 04/10/2024 --- @@ -184,6 +184,15 @@ This node indicates whether the MDM agent was installed or not. When set to true | Default Value | False | + +**Allowed values**: + +| Value | Description | +|:--|:--| +| false (Default) | Mdm Agent Not Installed. | +| true | Mdm Agent Installed. | + + @@ -263,6 +272,15 @@ This node indicates whether an MDM policy was provisioned that requires a reboot | Default Value | False | + +**Allowed values**: + +| Value | Description | +|:--|:--| +| false (Default) | No Reboot Required. | +| true | Reboot Required. | + + @@ -303,6 +321,15 @@ This node determines whether to show the Device Preparation page during OOBE. | Default Value | false | + +**Allowed values**: + +| Value | Description | +|:--|:--| +| false (Default) | Disable Page. | +| true | Enable Page. | + + diff --git a/windows/client-management/mdm/devicepreparation-ddf-file.md b/windows/client-management/mdm/devicepreparation-ddf-file.md index cdccc95934..06ec069113 100644 --- a/windows/client-management/mdm/devicepreparation-ddf-file.md +++ b/windows/client-management/mdm/devicepreparation-ddf-file.md @@ -1,7 +1,7 @@ --- title: DevicePreparation DDF file description: View the XML file containing the device description framework (DDF) for the DevicePreparation configuration service provider. -ms.date: 01/31/2024 +ms.date: 04/10/2024 --- @@ -64,6 +64,16 @@ The following XML file contains the device description framework (DDF) for the D + + + false + Disable Page + + + true + Enable Page + + @@ -320,6 +330,16 @@ The following XML file contains the device description framework (DDF) for the D + + + false + Mdm Agent Not Installed + + + true + Mdm Agent Installed + + @@ -342,6 +362,16 @@ The following XML file contains the device description framework (DDF) for the D + + + false + No Reboot Required + + + true + Reboot Required + + diff --git a/windows/client-management/mdm/devicestatus-ddf.md b/windows/client-management/mdm/devicestatus-ddf.md index 5ddde61818..2eaff3d375 100644 --- a/windows/client-management/mdm/devicestatus-ddf.md +++ b/windows/client-management/mdm/devicestatus-ddf.md @@ -1,7 +1,7 @@ --- title: DeviceStatus DDF file description: View the XML file containing the device description framework (DDF) for the DeviceStatus configuration service provider. -ms.date: 01/18/2024 +ms.date: 04/10/2024 --- @@ -39,7 +39,7 @@ The following XML file contains the device description framework (DDF) for the D 10.0.10586 1.0 - 0x4;0x1B;0x30;0x31;0x48;0x54;0x62;0x63;0x64;0x65;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x88;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xBC;0xBF;0xCA;0xCB;0xCD;0xCF; + 0x4;0x1B;0x30;0x31;0x48;0x54;0x62;0x63;0x64;0x65;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x88;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xBC;0xBF;0xCA;0xCB;0xCD;0xCF;0xD2; diff --git a/windows/client-management/mdm/devinfo-ddf-file.md b/windows/client-management/mdm/devinfo-ddf-file.md index 37290dd8ca..ff9195ba0d 100644 --- a/windows/client-management/mdm/devinfo-ddf-file.md +++ b/windows/client-management/mdm/devinfo-ddf-file.md @@ -1,7 +1,7 @@ --- title: DevInfo DDF file description: View the XML file containing the device description framework (DDF) for the DevInfo configuration service provider. -ms.date: 01/18/2024 +ms.date: 04/10/2024 --- @@ -41,7 +41,7 @@ The following XML file contains the device description framework (DDF) for the D 10.0.10586 1.0 - 0x4;0x1B;0x30;0x31;0x48;0x54;0x62;0x63;0x64;0x65;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x88;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xBC;0xBF;0xCA;0xCB;0xCD;0xCF; + 0x4;0x1B;0x30;0x31;0x48;0x54;0x62;0x63;0x64;0x65;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x88;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xBC;0xBF;0xCA;0xCB;0xCD;0xCF;0xD2; diff --git a/windows/client-management/mdm/diagnosticlog-ddf.md b/windows/client-management/mdm/diagnosticlog-ddf.md index 4b7a116020..9603fc932a 100644 --- a/windows/client-management/mdm/diagnosticlog-ddf.md +++ b/windows/client-management/mdm/diagnosticlog-ddf.md @@ -1,7 +1,7 @@ --- title: DiagnosticLog DDF file description: View the XML file containing the device description framework (DDF) for the DiagnosticLog configuration service provider. -ms.date: 01/18/2024 +ms.date: 04/10/2024 --- @@ -39,7 +39,7 @@ The following XML file contains the device description framework (DDF) for the D 10.0.10586 1.2 - 0x4;0x1B;0x30;0x31;0x48;0x54;0x62;0x63;0x64;0x65;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x88;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xBC;0xBF;0xCA;0xCB;0xCD;0xCF; + 0x4;0x1B;0x30;0x31;0x48;0x54;0x62;0x63;0x64;0x65;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x88;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xBC;0xBF;0xCA;0xCB;0xCD;0xCF;0xD2; diff --git a/windows/client-management/mdm/dmacc-csp.md b/windows/client-management/mdm/dmacc-csp.md index 28cbe9c4f0..271a68b16e 100644 --- a/windows/client-management/mdm/dmacc-csp.md +++ b/windows/client-management/mdm/dmacc-csp.md @@ -1,7 +1,7 @@ --- title: DMAcc CSP description: Learn more about the DMAcc CSP. -ms.date: 01/31/2024 +ms.date: 04/10/2024 --- @@ -709,7 +709,7 @@ Specifies the authentication type. If AAuthLevel is CLCRED, the supported types |:--|:--| | Format | `chr` (string) | | Access Type | Add, Get, Replace | -| Dependency [AAuthlevelDependency] | Dependency Type: `DependsOn`
Dependency URI: `Syncml/DMAcc/[AccountUID]/AppAuth/[ObjectName]/AAuthLevel`
Dependency Allowed Value: `SRVCRED`
Dependency Allowed Value Type: `ENUM`
| +| Dependency [AAuthlevelDependency] | Dependency Type: `DependsOn`
Dependency URI: `SyncML/DMAcc/{AccountUID}/AppAuth/{ObjectName}/AAuthLevel`
Dependency Allowed Value: `SRVCRED`
Dependency Allowed Value Type: `ENUM`
| diff --git a/windows/client-management/mdm/dmacc-ddf-file.md b/windows/client-management/mdm/dmacc-ddf-file.md index 96ba92429a..331ce57c5d 100644 --- a/windows/client-management/mdm/dmacc-ddf-file.md +++ b/windows/client-management/mdm/dmacc-ddf-file.md @@ -1,7 +1,7 @@ --- title: DMAcc DDF file description: View the XML file containing the device description framework (DDF) for the DMAcc configuration service provider. -ms.date: 01/31/2024 +ms.date: 04/10/2024 --- @@ -527,7 +527,7 @@ The following XML file contains the device description framework (DDF) for the D - Syncml/DMAcc/[AccountUID]/AppAuth/[ObjectName]/AAuthLevel + SyncML/DMAcc/{AccountUID}/AppAuth/{ObjectName}/AAuthLevel SRVCRED diff --git a/windows/client-management/mdm/dmclient-csp.md b/windows/client-management/mdm/dmclient-csp.md index 535eaf637a..dec09993f5 100644 --- a/windows/client-management/mdm/dmclient-csp.md +++ b/windows/client-management/mdm/dmclient-csp.md @@ -1,7 +1,7 @@ --- title: DMClient CSP description: Learn more about the DMClient CSP. -ms.date: 01/18/2024 +ms.date: 04/10/2024 --- @@ -632,7 +632,7 @@ This node, when it's set, tells the client to set how many minutes the device sh | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | +| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 21H2 [10.0.22000.2836] and later
✅ Windows 11, version 22H2 [10.0.22621.3235] and later
✅ Windows Insider Preview | @@ -671,7 +671,7 @@ Parent node for ConfigRefresh nodes. | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | +| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 21H2 [10.0.22000.2836] and later
✅ Windows 11, version 22H2 [10.0.22621.3235] and later
✅ Windows Insider Preview | @@ -712,7 +712,7 @@ This node determines the number of minutes between refreshes. | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | +| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 21H2 [10.0.22000.2836] and later
✅ Windows 11, version 22H2 [10.0.22621.3235] and later
✅ Windows Insider Preview | @@ -761,7 +761,7 @@ This node determines whether or not a periodic settings refresh for MDM policies | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | +| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 21H2 [10.0.22000.2836] and later
✅ Windows 11, version 22H2 [10.0.22621.3235] and later
✅ Windows Insider Preview | diff --git a/windows/client-management/mdm/dmclient-ddf-file.md b/windows/client-management/mdm/dmclient-ddf-file.md index 64dd766397..dd09a2d66f 100644 --- a/windows/client-management/mdm/dmclient-ddf-file.md +++ b/windows/client-management/mdm/dmclient-ddf-file.md @@ -1,7 +1,7 @@ --- title: DMClient DDF file description: View the XML file containing the device description framework (DDF) for the DMClient configuration service provider. -ms.date: 01/18/2024 +ms.date: 04/10/2024 --- @@ -40,7 +40,7 @@ The following XML file contains the device description framework (DDF) for the D 10.0.10240 1.0 - 0x4;0x1B;0x30;0x31;0x48;0x54;0x62;0x63;0x64;0x65;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x88;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xBC;0xBF;0xCA;0xCB;0xCD;0xCF; + 0x4;0x1B;0x30;0x31;0x48;0x54;0x62;0x63;0x64;0x65;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x88;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xBC;0xBF;0xCA;0xCB;0xCD;0xCF;0xD2; @@ -477,7 +477,7 @@ The following XML file contains the device description framework (DDF) for the D 10.0.10240 1.0 - 0x4;0x1B;0x30;0x31;0x48;0x54;0x62;0x63;0x64;0x65;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x88;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xBC;0xBF;0xCA;0xCB;0xCD;0xCF; + 0x4;0x1B;0x30;0x31;0x48;0x54;0x62;0x63;0x64;0x65;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x88;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xBC;0xBF;0xCA;0xCB;0xCD;0xCF;0xD2; @@ -2958,7 +2958,7 @@ The following XML file contains the device description framework (DDF) for the D - 99.9.99999 + 99.9.99999, 10.0.22621.3235, 10.0.22000.2836 1.6 diff --git a/windows/client-management/mdm/email2-ddf-file.md b/windows/client-management/mdm/email2-ddf-file.md index 2b9763c045..04e33d681e 100644 --- a/windows/client-management/mdm/email2-ddf-file.md +++ b/windows/client-management/mdm/email2-ddf-file.md @@ -1,7 +1,7 @@ --- title: EMAIL2 DDF file description: View the XML file containing the device description framework (DDF) for the EMAIL2 configuration service provider. -ms.date: 01/18/2024 +ms.date: 04/10/2024 --- @@ -40,7 +40,7 @@ The following XML file contains the device description framework (DDF) for the E 10.0.10240 1.0 - 0x4;0x1B;0x30;0x31;0x48;0x54;0x62;0x63;0x64;0x65;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xBC;0xBF;0xCA;0xCB;0xCD;0xCF; + 0x4;0x1B;0x30;0x31;0x48;0x54;0x62;0x63;0x64;0x65;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xBC;0xBF;0xCA;0xCB;0xCD;0xCF;0xD2; diff --git a/windows/client-management/mdm/enterprisedesktopappmanagement-ddf-file.md b/windows/client-management/mdm/enterprisedesktopappmanagement-ddf-file.md index 3392fcb317..2ca8dc6240 100644 --- a/windows/client-management/mdm/enterprisedesktopappmanagement-ddf-file.md +++ b/windows/client-management/mdm/enterprisedesktopappmanagement-ddf-file.md @@ -1,7 +1,7 @@ --- title: EnterpriseDesktopAppManagement DDF file description: View the XML file containing the device description framework (DDF) for the EnterpriseDesktopAppManagement configuration service provider. -ms.date: 01/18/2024 +ms.date: 04/10/2024 --- @@ -40,7 +40,7 @@ The following XML file contains the device description framework (DDF) for the E 10.0.10586 1.0 - 0x4;0x1B;0x30;0x31;0x48;0x54;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xBC;0xBF;0xCA;0xCB;0xCD;0xCF; + 0x4;0x1B;0x30;0x31;0x48;0x54;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xBC;0xBF;0xCA;0xCB;0xCD;0xCF;0xD2; @@ -400,7 +400,7 @@ The following XML file contains the device description framework (DDF) for the E 10.0.10586 1.0 - 0x4;0x1B;0x30;0x31;0x48;0x54;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xBC;0xBF;0xCA;0xCB;0xCD;0xCF; + 0x4;0x1B;0x30;0x31;0x48;0x54;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xBC;0xBF;0xCA;0xCB;0xCD;0xCF;0xD2; diff --git a/windows/client-management/mdm/enterprisemodernappmanagement-csp.md b/windows/client-management/mdm/enterprisemodernappmanagement-csp.md index 4369995a2e..831a924dde 100644 --- a/windows/client-management/mdm/enterprisemodernappmanagement-csp.md +++ b/windows/client-management/mdm/enterprisemodernappmanagement-csp.md @@ -1,7 +1,7 @@ --- title: EnterpriseModernAppManagement CSP description: Learn more about the EnterpriseModernAppManagement CSP. -ms.date: 01/18/2024 +ms.date: 04/10/2024 --- @@ -4602,7 +4602,7 @@ Specifies HoursBetweenUpdateChecks for a specific package. | Property name | Property value | |:--|:--| -| Format | `bool` | +| Format | `int` | | Access Type | Get, Replace | | Allowed Values | Range: `[8-10000]` | | Default Value | 8 | diff --git a/windows/client-management/mdm/enterprisemodernappmanagement-ddf.md b/windows/client-management/mdm/enterprisemodernappmanagement-ddf.md index 6afb253277..e60f2f2868 100644 --- a/windows/client-management/mdm/enterprisemodernappmanagement-ddf.md +++ b/windows/client-management/mdm/enterprisemodernappmanagement-ddf.md @@ -1,7 +1,7 @@ --- title: EnterpriseModernAppManagement DDF file description: View the XML file containing the device description framework (DDF) for the EnterpriseModernAppManagement configuration service provider. -ms.date: 01/18/2024 +ms.date: 04/10/2024 --- @@ -39,7 +39,7 @@ The following XML file contains the device description framework (DDF) for the E 10.0.10586 1.0 - 0x4;0x1B;0x30;0x31;0x48;0x54;0x62;0x63;0x64;0x65;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x88;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xBC;0xBF;0xCA;0xCB;0xCD;0xCF; + 0x4;0x1B;0x30;0x31;0x48;0x54;0x62;0x63;0x64;0x65;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x88;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xBC;0xBF;0xCA;0xCB;0xCD;0xCF;0xD2; @@ -2587,7 +2587,7 @@ The following XML file contains the device description framework (DDF) for the E 10.0.10586 1.0 - 0x4;0x1B;0x30;0x31;0x48;0x54;0x62;0x63;0x64;0x65;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x88;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xBC;0xBF;0xCA;0xCB;0xCD;0xCF; + 0x4;0x1B;0x30;0x31;0x48;0x54;0x62;0x63;0x64;0x65;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x88;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xBC;0xBF;0xCA;0xCB;0xCD;0xCF;0xD2; @@ -4550,7 +4550,7 @@ The following XML file contains the device description framework (DDF) for the E 8 Specifies HoursBetweenUpdateChecks for a specific package - + diff --git a/windows/client-management/mdm/euiccs-ddf-file.md b/windows/client-management/mdm/euiccs-ddf-file.md index 62059a7c7d..36803e6131 100644 --- a/windows/client-management/mdm/euiccs-ddf-file.md +++ b/windows/client-management/mdm/euiccs-ddf-file.md @@ -1,7 +1,7 @@ --- title: eUICCs DDF file description: View the XML file containing the device description framework (DDF) for the eUICCs configuration service provider. -ms.date: 01/18/2024 +ms.date: 04/10/2024 --- @@ -43,7 +43,7 @@ The following XML file contains the device description framework (DDF) for the e 10.0.16299 1.0 - 0x4;0x1B;0x30;0x31;0x48;0x54;0x62;0x63;0x64;0x65;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xBC;0xBF;0xCA;0xCB;0xCD;0xCF; + 0x4;0x1B;0x30;0x31;0x48;0x54;0x62;0x63;0x64;0x65;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xBC;0xBF;0xCA;0xCB;0xCD;0xCF;0xD2; diff --git a/windows/client-management/mdm/firewall-ddf-file.md b/windows/client-management/mdm/firewall-ddf-file.md index 580516ab56..453ee21804 100644 --- a/windows/client-management/mdm/firewall-ddf-file.md +++ b/windows/client-management/mdm/firewall-ddf-file.md @@ -1,7 +1,7 @@ --- title: Firewall DDF file description: View the XML file containing the device description framework (DDF) for the Firewall configuration service provider. -ms.date: 01/18/2024 +ms.date: 04/10/2024 --- @@ -40,7 +40,7 @@ The following XML file contains the device description framework (DDF) for the F 10.0.16299 1.0 - 0x4;0x1B;0x30;0x31;0x48;0x54;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x88;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xBC;0xBF;0xCA;0xCB;0xCD;0xCF; + 0x4;0x1B;0x30;0x31;0x48;0x54;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x88;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xBC;0xBF;0xCA;0xCB;0xCD;0xCF;0xD2; @@ -4337,6 +4337,7 @@ This is a string in Security Descriptor Definition Language (SDDL) format.. + diff --git a/windows/client-management/mdm/language-pack-management-ddf-file.md b/windows/client-management/mdm/language-pack-management-ddf-file.md index d2589cc4a8..af5086a30c 100644 --- a/windows/client-management/mdm/language-pack-management-ddf-file.md +++ b/windows/client-management/mdm/language-pack-management-ddf-file.md @@ -1,7 +1,7 @@ --- title: LanguagePackManagement DDF file description: View the XML file containing the device description framework (DDF) for the LanguagePackManagement configuration service provider. -ms.date: 01/18/2024 +ms.date: 04/10/2024 --- @@ -42,7 +42,7 @@ The following XML file contains the device description framework (DDF) for the L 99.9.9999 1.0 - 0x4;0x1B;0x30;0x31;0x48;0x54;0x62;0x63;0x64;0x65;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x88;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xBC;0xBF;0xCA;0xCB;0xCD;0xCF; + 0x4;0x1B;0x30;0x31;0x48;0x54;0x62;0x63;0x64;0x65;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x88;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xBC;0xBF;0xCA;0xCB;0xCD;0xCF;0xD2; diff --git a/windows/client-management/mdm/laps-ddf-file.md b/windows/client-management/mdm/laps-ddf-file.md index d347e57374..8ed3954967 100644 --- a/windows/client-management/mdm/laps-ddf-file.md +++ b/windows/client-management/mdm/laps-ddf-file.md @@ -1,7 +1,7 @@ --- title: LAPS DDF file description: View the XML file containing the device description framework (DDF) for the LAPS configuration service provider. -ms.date: 01/31/2024 +ms.date: 04/10/2024 --- @@ -40,7 +40,7 @@ The following XML file contains the device description framework (DDF) for the L 10.0.25145, 10.0.22621.1480, 10.0.22000.1754, 10.0.20348.1663, 10.0.19041.2784, 10.0.17763.4244 1.0 - 0x4;0x1B;0x30;0x31;0x48;0x54;0x62;0x63;0x64;0x65;0x77;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x87;0x88;0x88*;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xB4;0xBC;0xBF;0xCA;0xCB;0xCD; + 0x4;0x1B;0x30;0x31;0x48;0x54;0x62;0x63;0x64;0x65;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x88;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xBC;0xBF;0xCA;0xCB;0xCD;0xCF;0xD2; diff --git a/windows/client-management/mdm/networkproxy-ddf.md b/windows/client-management/mdm/networkproxy-ddf.md index a7ee14b7ab..77e03cd531 100644 --- a/windows/client-management/mdm/networkproxy-ddf.md +++ b/windows/client-management/mdm/networkproxy-ddf.md @@ -1,7 +1,7 @@ --- title: NetworkProxy DDF file description: View the XML file containing the device description framework (DDF) for the NetworkProxy configuration service provider. -ms.date: 01/18/2024 +ms.date: 04/10/2024 --- @@ -40,7 +40,7 @@ The following XML file contains the device description framework (DDF) for the N 10.0.15063 1.0 - 0x4;0x1B;0x30;0x31;0x48;0x54;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x88;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xBC;0xBF;0xCA;0xCB;0xCD;0xCF; + 0x4;0x1B;0x30;0x31;0x48;0x54;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x88;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xBC;0xBF;0xCA;0xCB;0xCD;0xCF;0xD2; diff --git a/windows/client-management/mdm/networkqospolicy-ddf.md b/windows/client-management/mdm/networkqospolicy-ddf.md index 16220bc01f..0a77596722 100644 --- a/windows/client-management/mdm/networkqospolicy-ddf.md +++ b/windows/client-management/mdm/networkqospolicy-ddf.md @@ -1,7 +1,7 @@ --- title: NetworkQoSPolicy DDF file description: View the XML file containing the device description framework (DDF) for the NetworkQoSPolicy configuration service provider. -ms.date: 01/18/2024 +ms.date: 04/10/2024 --- @@ -40,7 +40,7 @@ The following XML file contains the device description framework (DDF) for the N 10.0.19042 1.0 - 0x4;0x1B;0x30;0x31;0x48;0x54;0x62;0x63;0x64;0x65;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x88;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xBC;0xBF;0xCA;0xCB;0xCD;0xCF; + 0x4;0x1B;0x30;0x31;0x48;0x54;0x62;0x63;0x64;0x65;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x88;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xBC;0xBF;0xCA;0xCB;0xCD;0xCF;0xD2; diff --git a/windows/client-management/mdm/nodecache-ddf-file.md b/windows/client-management/mdm/nodecache-ddf-file.md index 0dd13ab94a..80a2ad5119 100644 --- a/windows/client-management/mdm/nodecache-ddf-file.md +++ b/windows/client-management/mdm/nodecache-ddf-file.md @@ -1,7 +1,7 @@ --- title: NodeCache DDF file description: View the XML file containing the device description framework (DDF) for the NodeCache configuration service provider. -ms.date: 01/18/2024 +ms.date: 04/10/2024 --- @@ -40,7 +40,7 @@ The following XML file contains the device description framework (DDF) for the N 10.0.15063 1.1 - 0x4;0x1B;0x30;0x31;0x48;0x54;0x62;0x63;0x64;0x65;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x88;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xBC;0xBF;0xCA;0xCB;0xCD;0xCF; + 0x4;0x1B;0x30;0x31;0x48;0x54;0x62;0x63;0x64;0x65;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x88;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xBC;0xBF;0xCA;0xCB;0xCD;0xCF;0xD2; @@ -294,7 +294,7 @@ The following XML file contains the device description framework (DDF) for the N 10.0.10586 1.0 - 0x4;0x1B;0x30;0x31;0x48;0x54;0x62;0x63;0x64;0x65;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x88;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xBC;0xBF;0xCA;0xCB;0xCD;0xCF; + 0x4;0x1B;0x30;0x31;0x48;0x54;0x62;0x63;0x64;0x65;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x88;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xBC;0xBF;0xCA;0xCB;0xCD;0xCF;0xD2; diff --git a/windows/client-management/mdm/office-ddf.md b/windows/client-management/mdm/office-ddf.md index 1453b24f55..7714d02e5e 100644 --- a/windows/client-management/mdm/office-ddf.md +++ b/windows/client-management/mdm/office-ddf.md @@ -1,7 +1,7 @@ --- title: Office DDF file description: View the XML file containing the device description framework (DDF) for the Office configuration service provider. -ms.date: 01/18/2024 +ms.date: 04/10/2024 --- @@ -40,7 +40,7 @@ The following XML file contains the device description framework (DDF) for the O 10.0.15063 1.0 - 0x4;0x1B;0x30;0x31;0x48;0x54;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xBC;0xBF;0xCA;0xCB;0xCD;0xCF; + 0x4;0x1B;0x30;0x31;0x48;0x54;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xBC;0xBF;0xCA;0xCB;0xCD;0xCF;0xD2; @@ -211,7 +211,7 @@ The following XML file contains the device description framework (DDF) for the O 10.0.15063 1.0 - 0x4;0x1B;0x30;0x31;0x48;0x54;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xBC;0xBF;0xCA;0xCB;0xCD;0xCF; + 0x4;0x1B;0x30;0x31;0x48;0x54;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xBC;0xBF;0xCA;0xCB;0xCD;0xCF;0xD2; diff --git a/windows/client-management/mdm/passportforwork-csp.md b/windows/client-management/mdm/passportforwork-csp.md index 6c581a7335..d9bd9dba10 100644 --- a/windows/client-management/mdm/passportforwork-csp.md +++ b/windows/client-management/mdm/passportforwork-csp.md @@ -1,7 +1,7 @@ --- title: PassportForWork CSP description: Learn more about the PassportForWork CSP. -ms.date: 01/18/2024 +ms.date: 04/10/2024 --- @@ -197,8 +197,8 @@ Disable caching of the Windows Hello for Business credential after sign-in. | Value | Description | |:--|:--| -| false (Default) | Disabled. | -| true | Enabled. | +| false (Default) | Credential Caching Enabled. | +| true | Credential Caching Disabled. | @@ -246,8 +246,8 @@ Don't start Windows Hello provisioning after sign-in. | Value | Description | |:--|:--| -| false (Default) | Post Logon Provisioning Enabled. | -| true | Post Logon Provisioning Disabled. | +| false (Default) | Provisioning Enabled. | +| true | Provisioning Disabled. | diff --git a/windows/client-management/mdm/passportforwork-ddf.md b/windows/client-management/mdm/passportforwork-ddf.md index 92e080ba93..0c1cf45b97 100644 --- a/windows/client-management/mdm/passportforwork-ddf.md +++ b/windows/client-management/mdm/passportforwork-ddf.md @@ -1,7 +1,7 @@ --- title: PassportForWork DDF file description: View the XML file containing the device description framework (DDF) for the PassportForWork configuration service provider. -ms.date: 01/18/2024 +ms.date: 04/10/2024 --- @@ -39,7 +39,7 @@ The following XML file contains the device description framework (DDF) for the P 10.0.10586 1.2 - 0x4;0x1B;0x30;0x31;0x48;0x54;0x62;0x63;0x64;0x65;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x88;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xBC;0xBF;0xCA;0xCB;0xCD;0xCF; + 0x4;0x1B;0x30;0x31;0x48;0x54;0x62;0x63;0x64;0x65;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x88;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xBC;0xBF;0xCA;0xCB;0xCD;0xCF;0xD2; @@ -565,7 +565,7 @@ If you do not configure this policy setting, Windows Hello for Business requires 10.0.10586 1.2 - 0x4;0x1B;0x30;0x31;0x48;0x54;0x62;0x63;0x64;0x65;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x88;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xBC;0xBF;0xCA;0xCB;0xCD;0xCF; + 0x4;0x1B;0x30;0x31;0x48;0x54;0x62;0x63;0x64;0x65;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x88;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xBC;0xBF;0xCA;0xCB;0xCD;0xCF;0xD2; @@ -876,11 +876,11 @@ If you disable or do not configure this policy setting, the PIN recovery secret false - Post Logon Provisioning Enabled + Provisioning Enabled true - Post Logon Provisioning Disabled + Provisioning Disabled @@ -915,11 +915,11 @@ If you disable or do not configure this policy setting, the PIN recovery secret false - Disabled + Credential Caching Enabled true - Enabled + Credential Caching Disabled @@ -934,7 +934,7 @@ If you disable or do not configure this policy setting, the PIN recovery secret False - Windows Hello for Business can use certificates to authenticate to on-premise resources. + Windows Hello for Business can use certificates to authenticate to on-premise resources. If you enable this policy setting, Windows Hello for Business will wait until the device has received a certificate payload from the mobile device management server before provisioning a PIN. diff --git a/windows/client-management/mdm/personaldataencryption-ddf-file.md b/windows/client-management/mdm/personaldataencryption-ddf-file.md index 8cd2a70919..f4f4cd55fc 100644 --- a/windows/client-management/mdm/personaldataencryption-ddf-file.md +++ b/windows/client-management/mdm/personaldataencryption-ddf-file.md @@ -1,7 +1,7 @@ --- title: PDE DDF file description: View the XML file containing the device description framework (DDF) for the PDE configuration service provider. -ms.date: 01/18/2024 +ms.date: 04/10/2024 --- @@ -39,7 +39,7 @@ The following XML file contains the device description framework (DDF) for the P 10.0.22621 1.0 - 0x4;0x1B;0x48;0x54;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x88;0xAB;0xAC;0xBC;0xBF;0xCD;0xCF; + 0x4;0x1B;0x48;0x54;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x88;0xAB;0xAC;0xBC;0xBF;0xCD;0xCF;0xD2; diff --git a/windows/client-management/mdm/personalization-csp.md b/windows/client-management/mdm/personalization-csp.md index 614e47b8a9..bf0dff0947 100644 --- a/windows/client-management/mdm/personalization-csp.md +++ b/windows/client-management/mdm/personalization-csp.md @@ -1,7 +1,7 @@ --- title: Personalization CSP description: Learn more about the Personalization CSP. -ms.date: 03/05/2024 +ms.date: 04/10/2024 --- @@ -9,6 +9,8 @@ ms.date: 03/05/2024 # Personalization CSP +[!INCLUDE [Windows Insider tip](includes/mdm-insider-csp-note.md)] + The Personalization CSP can set the lock screen, desktop background images and company branding on sign-in screen ([BootToCloud mode](policy-csp-clouddesktop.md#boottocloudmode) only). Setting these policies also prevents the user from changing the image. You can also use the Personalization settings in a provisioning package. @@ -36,7 +38,7 @@ The following list shows the Personalization configuration service provider node | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 22H2 [10.0.22621.3235] and later | +| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | @@ -75,7 +77,7 @@ This represents the status of the Company Logo. 1 - Successfully downloaded or c | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 22H2 [10.0.22621.3235] and later | +| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | @@ -114,7 +116,7 @@ An http or https Url to a jpg, jpeg or png image that needs to be downloaded and | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 22H2 [10.0.22621.3235] and later | +| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | @@ -125,7 +127,7 @@ An http or https Url to a jpg, jpeg or png image that needs to be downloaded and -The name of the company to be displayed on the sign-in screen. This setting is currently available for boot to cloud shared pc mode only. +This represents the name of the company. It can be at most 30 characters long. This setting is currently available only for boot to cloud shared pc mode to display the company name on sign-in screen. diff --git a/windows/client-management/mdm/personalization-ddf.md b/windows/client-management/mdm/personalization-ddf.md index 87ccb6cf93..6c5af077dd 100644 --- a/windows/client-management/mdm/personalization-ddf.md +++ b/windows/client-management/mdm/personalization-ddf.md @@ -1,7 +1,7 @@ --- title: Personalization DDF file description: View the XML file containing the device description framework (DDF) for the Personalization configuration service provider. -ms.date: 03/05/2024 +ms.date: 04/10/2024 --- @@ -42,7 +42,7 @@ The following XML file contains the device description framework (DDF) for the P 10.0.16299 1.0 - 0x4;0x1B;0x30;0x31;0x48;0x54;0x77;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x87;0x88;0x88*;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xB4;0xBC;0xBD;0xBF;0xCA;0xCB; + 0x4;0x1B;0x30;0x31;0x48;0x54;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x88;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xBC;0xBF;0xCA;0xCB;0xCD;0xCF;0xD2; @@ -101,7 +101,7 @@ The following XML file contains the device description framework (DDF) for the P - A http or https Url to a jpg, jpeg or png image that needs to be downloaded and used as the Lock Screen Image or a file Url to a local image on the file system that needs to be used as the Lock Screen Image. + A http or https Url to a jpg, jpeg or png image that neeeds to be downloaded and used as the Lock Screen Image or a file Url to a local image on the file system that needs to be used as the Lock Screen Image. @@ -148,7 +148,7 @@ The following XML file contains the device description framework (DDF) for the P - A http or https Url to a jpg, jpeg or png image that needs to be downloaded and used as the Company Logo or a file Url to a local image on the file system that needs to be used as the Company Logo. This setting is currently available for boot to cloud shared pc mode only. + A http or https Url to a jpg, jpeg or png image that neeeds to be downloaded and used as the Company Logo or a file Url to a local image on the file system that needs to be used as the Company Logo. This setting is currently available for boot to cloud shared pc mode only. @@ -162,7 +162,7 @@ The following XML file contains the device description framework (DDF) for the P - 10.0.22621.3235 + 99.9.99999 2.0 @@ -189,7 +189,7 @@ The following XML file contains the device description framework (DDF) for the P - 10.0.22621.3235 + 99.9.99999 2.0 @@ -203,7 +203,7 @@ The following XML file contains the device description framework (DDF) for the P - The name of the company to be displayed on the sign-in screen. This setting is currently available for boot to cloud shared pc mode only. + This represents the name of the company. It can be at most 30 characters long. This setting is currently available only for boot to cloud shared pc mode to display the company name on sign-in screen. @@ -217,7 +217,7 @@ The following XML file contains the device description framework (DDF) for the P - 10.0.22621.3235 + 99.9.99999 2.0 diff --git a/windows/client-management/mdm/policies-in-policy-csp-admx-backed.md b/windows/client-management/mdm/policies-in-policy-csp-admx-backed.md index 254cb8d7aa..d24e808921 100644 --- a/windows/client-management/mdm/policies-in-policy-csp-admx-backed.md +++ b/windows/client-management/mdm/policies-in-policy-csp-admx-backed.md @@ -1,7 +1,7 @@ --- title: ADMX-backed policies in Policy CSP description: Learn about the ADMX-backed policies in Policy CSP. -ms.date: 01/31/2024 +ms.date: 04/10/2024 --- @@ -539,8 +539,6 @@ This article lists the ADMX-backed policies in Policy CSP. - [HelpQualifiedRootDir_Comp](policy-csp-admx-help.md) - [RestrictRunFromHelp_Comp](policy-csp-admx-help.md) - [DisableHHDEP](policy-csp-admx-help.md) -- [AllowChildProcesses](policy-csp-admx-help.md) -- [HideChildProcessMessageBox](policy-csp-admx-help.md) ## ADMX_HelpAndSupport @@ -2537,8 +2535,8 @@ This article lists the ADMX-backed policies in Policy CSP. - [RequireSecureRPCCommunication](policy-csp-remotedesktopservices.md) - [ClientConnectionEncryptionLevel](policy-csp-remotedesktopservices.md) - [DoNotAllowWebAuthnRedirection](policy-csp-remotedesktopservices.md) -- [DisconnectOnLockBasicAuthn](policy-csp-remotedesktopservices.md) -- [DisconnectOnLockWebAccountAuthn](policy-csp-remotedesktopservices.md) +- [DisconnectOnLockLegacyAuthn](policy-csp-remotedesktopservices.md) +- [DisconnectOnLockMicrosoftIdentityAuthn](policy-csp-remotedesktopservices.md) ## RemoteManagement @@ -2590,10 +2588,6 @@ This article lists the ADMX-backed policies in Policy CSP. - [WPDDevicesDenyReadAccessPerDevice](policy-csp-storage.md) - [WPDDevicesDenyWriteAccessPerDevice](policy-csp-storage.md) -## Sudo - -- [EnableSudo](policy-csp-sudo.md) - ## System - [BootStartDriverInitialization](policy-csp-system.md) diff --git a/windows/client-management/mdm/policies-in-policy-csp-supported-by-group-policy.md b/windows/client-management/mdm/policies-in-policy-csp-supported-by-group-policy.md index 40ec4c37e3..49d00a03bf 100644 --- a/windows/client-management/mdm/policies-in-policy-csp-supported-by-group-policy.md +++ b/windows/client-management/mdm/policies-in-policy-csp-supported-by-group-policy.md @@ -1,7 +1,7 @@ --- title: Policies in Policy CSP supported by Group Policy description: Learn about the policies in Policy CSP supported by Group Policy. -ms.date: 01/31/2024 +ms.date: 04/10/2024 --- @@ -659,6 +659,10 @@ This article lists the policies in Policy CSP that have a group policy mapping. - [ConfigStorageSenseDownloadsCleanupThreshold](policy-csp-storage.md) - [ConfigStorageSenseCloudContentDehydrationThreshold](policy-csp-storage.md) +## Sudo + +- [EnableSudo](policy-csp-sudo.md) + ## System - [AllowTelemetry](policy-csp-system.md) diff --git a/windows/client-management/mdm/policy-configuration-service-provider.md b/windows/client-management/mdm/policy-configuration-service-provider.md index efc7033c36..7aa96cc52c 100644 --- a/windows/client-management/mdm/policy-configuration-service-provider.md +++ b/windows/client-management/mdm/policy-configuration-service-provider.md @@ -1,7 +1,7 @@ --- title: Policy CSP description: Learn more about the Policy CSP. -ms.date: 01/31/2024 +ms.date: 04/10/2024 --- diff --git a/windows/client-management/mdm/policy-csp-abovelock.md b/windows/client-management/mdm/policy-csp-abovelock.md index 0c304bbebb..05e84c1ade 100644 --- a/windows/client-management/mdm/policy-csp-abovelock.md +++ b/windows/client-management/mdm/policy-csp-abovelock.md @@ -1,7 +1,7 @@ --- title: AboveLock Policy CSP description: Learn more about the AboveLock Area in Policy CSP. -ms.date: 01/18/2024 +ms.date: 04/10/2024 --- @@ -22,7 +22,7 @@ ms.date: 01/18/2024 | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1507 [10.0.10240] and later | +| ✅ Device
❌ User | Not applicable | ✅ Windows 10, version 1507 [10.0.10240] and later | diff --git a/windows/client-management/mdm/policy-csp-admx-help.md b/windows/client-management/mdm/policy-csp-admx-help.md index ee3e45f1c6..b51b3ad8ab 100644 --- a/windows/client-management/mdm/policy-csp-admx-help.md +++ b/windows/client-management/mdm/policy-csp-admx-help.md @@ -1,7 +1,7 @@ --- title: ADMX_Help Policy CSP description: Learn more about the ADMX_Help Area in Policy CSP. -ms.date: 01/31/2024 +ms.date: 04/10/2024 --- @@ -11,62 +11,10 @@ ms.date: 01/31/2024 [!INCLUDE [ADMX-backed CSP tip](includes/mdm-admx-csp-note.md)] -[!INCLUDE [Windows Insider tip](includes/mdm-insider-csp-note.md)] - - -## AllowChildProcesses - - -| Scope | Editions | Applicable OS | -|:--|:--|:--| -| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | - - - -```Device -./Device/Vendor/MSFT/Policy/Config/ADMX_Help/AllowChildProcesses -``` - - - - - - - - - - - -**Description framework properties**: - -| Property name | Property value | -|:--|:--| -| Format | `chr` (string) | -| Access Type | Add, Delete, Get, Replace | - - - - -[!INCLUDE [ADMX-backed policy note](includes/mdm-admx-policy-note.md)] - -**ADMX mapping**: - -| Name | Value | -|:--|:--| -| Name | AllowChildProcesses | -| ADMX File Name | Help.admx | - - - - - - - - ## DisableHHDEP @@ -200,56 +148,6 @@ For additional options, see the "Restrict these programs from being launched fro - -## HideChildProcessMessageBox - - -| Scope | Editions | Applicable OS | -|:--|:--|:--| -| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | - - - -```Device -./Device/Vendor/MSFT/Policy/Config/ADMX_Help/HideChildProcessMessageBox -``` - - - - - - - - - - - -**Description framework properties**: - -| Property name | Property value | -|:--|:--| -| Format | `chr` (string) | -| Access Type | Add, Delete, Get, Replace | - - - - -[!INCLUDE [ADMX-backed policy note](includes/mdm-admx-policy-note.md)] - -**ADMX mapping**: - -| Name | Value | -|:--|:--| -| Name | HideChildProcessMessageBox | -| ADMX File Name | Help.admx | - - - - - - - - ## RestrictRunFromHelp diff --git a/windows/client-management/mdm/policy-csp-admx-startmenu.md b/windows/client-management/mdm/policy-csp-admx-startmenu.md index 0a223d43d0..387bcff31c 100644 --- a/windows/client-management/mdm/policy-csp-admx-startmenu.md +++ b/windows/client-management/mdm/policy-csp-admx-startmenu.md @@ -1,7 +1,7 @@ --- title: ADMX_StartMenu Policy CSP description: Learn more about the ADMX_StartMenu Area in Policy CSP. -ms.date: 01/18/2024 +ms.date: 04/10/2024 --- @@ -3577,7 +3577,7 @@ This policy setting allows you to remove links and access to Windows Update. - If you enable this policy setting, users are prevented from connecting to the Windows Update Web site. -Enabling this policy setting blocks user access to the Windows Update Web site at< https://windowsupdate.microsoft.com>. Also, the policy setting removes the Windows Update hyperlink from the Start menu and from the Tools menu in Internet Explorer. +Enabling this policy setting blocks user access to the Windows Update Web site at `https://windowsupdate.microsoft.com`. Also, the policy setting removes the Windows Update hyperlink from the Start menu and from the Tools menu in Internet Explorer. Windows Update, the online extension of Windows, offers software updates to keep a user's system up-to-date. The Windows Update Product Catalog determines any system files, security fixes, and Microsoft updates that users need and shows the newest versions available for download. diff --git a/windows/client-management/mdm/policy-csp-applicationmanagement.md b/windows/client-management/mdm/policy-csp-applicationmanagement.md index ba4fc8b016..7b1698c462 100644 --- a/windows/client-management/mdm/policy-csp-applicationmanagement.md +++ b/windows/client-management/mdm/policy-csp-applicationmanagement.md @@ -1,7 +1,7 @@ --- title: ApplicationManagement Policy CSP description: Learn more about the ApplicationManagement Area in Policy CSP. -ms.date: 01/18/2024 +ms.date: 04/10/2024 --- @@ -428,7 +428,7 @@ Manages a Windows app's ability to share data between users who have installed t | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
❌ User | ❌ Pro
✅ Enterprise
✅ Education
❌ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1507 [10.0.10240] and later | +| ✅ Device
❌ User | Not applicable | ✅ Windows 10, version 1507 [10.0.10240] and later | @@ -480,7 +480,7 @@ This policy is deprecated. | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1507 [10.0.10240] and later | +| ✅ Device
❌ User | Not applicable | ✅ Windows 10, version 1507 [10.0.10240] and later | diff --git a/windows/client-management/mdm/policy-csp-browser.md b/windows/client-management/mdm/policy-csp-browser.md index 0831538391..88527a21f7 100644 --- a/windows/client-management/mdm/policy-csp-browser.md +++ b/windows/client-management/mdm/policy-csp-browser.md @@ -1,7 +1,7 @@ --- title: Browser Policy CSP description: Learn more about the Browser Area in Policy CSP. -ms.date: 01/18/2024 +ms.date: 04/10/2024 --- @@ -178,7 +178,7 @@ To verify AllowAutofill is set to 0 (not allowed): | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1507 [10.0.10240] and later | +| ✅ Device
✅ User | Not applicable | ✅ Windows 10, version 1507 [10.0.10240] and later | @@ -2713,7 +2713,7 @@ Important. Discontinued in Windows 10, version 1511. Use the Browser/EnterpriseM | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
✅ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1607 [10.0.14393] and later | +| ✅ Device
✅ User | ❌ Pro
❌ Enterprise
❌ Education
❌ Windows SE
❌ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1607 [10.0.14393] and later | diff --git a/windows/client-management/mdm/policy-csp-connectivity.md b/windows/client-management/mdm/policy-csp-connectivity.md index 26b96531e8..1a15adf8c0 100644 --- a/windows/client-management/mdm/policy-csp-connectivity.md +++ b/windows/client-management/mdm/policy-csp-connectivity.md @@ -1,7 +1,7 @@ --- title: Connectivity Policy CSP description: Learn more about the Connectivity Area in Policy CSP. -ms.date: 01/18/2024 +ms.date: 04/10/2024 --- @@ -252,7 +252,7 @@ To validate, the enterprise can confirm by observing the roaming enable switch i | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1507 [10.0.10240] and later | +| ✅ Device
❌ User | Not applicable | ✅ Windows 10, version 1507 [10.0.10240] and later | @@ -375,7 +375,7 @@ Device that has previously opt-in to MMX will also stop showing on the device li | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1507 [10.0.10240] and later | +| ✅ Device
❌ User | ❌ Pro
❌ Enterprise
❌ Education
❌ Windows SE
❌ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1507 [10.0.10240] and later | diff --git a/windows/client-management/mdm/policy-csp-devicelock.md b/windows/client-management/mdm/policy-csp-devicelock.md index 649a6dada2..1dea6a8e0c 100644 --- a/windows/client-management/mdm/policy-csp-devicelock.md +++ b/windows/client-management/mdm/policy-csp-devicelock.md @@ -1,7 +1,7 @@ --- title: DeviceLock Policy CSP description: Learn more about the DeviceLock Area in Policy CSP. -ms.date: 01/31/2024 +ms.date: 04/10/2024 --- @@ -114,7 +114,7 @@ Allow Administrator account lockout This security setting determines whether the | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1507 [10.0.10240] and later | +| ✅ Device
❌ User | ❌ Pro
❌ Enterprise
❌ Education
❌ Windows SE
❌ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1507 [10.0.10240] and later | @@ -782,7 +782,7 @@ On HoloLens, this timeout is controlled by the device's system sleep timeout, re | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1709 [10.0.16299] and later | +| ✅ Device
❌ User | ❌ Pro
❌ Enterprise
❌ Education
❌ Windows SE
❌ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1709 [10.0.16299] and later | diff --git a/windows/client-management/mdm/policy-csp-experience.md b/windows/client-management/mdm/policy-csp-experience.md index f7ecf4bf2a..3bc6e9af56 100644 --- a/windows/client-management/mdm/policy-csp-experience.md +++ b/windows/client-management/mdm/policy-csp-experience.md @@ -1,7 +1,7 @@ --- title: Experience Policy CSP description: Learn more about the Experience Area in Policy CSP. -ms.date: 01/18/2024 +ms.date: 04/10/2024 --- @@ -100,7 +100,7 @@ Policy change takes effect immediately. | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1507 [10.0.10240] and later | +| ✅ Device
❌ User | Not applicable | ✅ Windows 10, version 1507 [10.0.10240] and later | @@ -833,7 +833,7 @@ This policy allows you to prevent Windows from using diagnostic data to provide | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1507 [10.0.10240] and later | +| ✅ Device
❌ User | Not applicable | ✅ Windows 10, version 1507 [10.0.10240] and later | @@ -949,7 +949,7 @@ Specifies whether to allow app and content suggestions from third-party software | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1507 [10.0.10240] and later | +| ✅ Device
❌ User | Not applicable | ✅ Windows 10, version 1507 [10.0.10240] and later | @@ -1887,7 +1887,7 @@ _**Turn syncing off by default but don’t disable**_ | Scope | Editions | Applicable OS | |:--|:--|:--| -| ❌ Device
✅ User | ❌ Pro
✅ Enterprise
✅ Education
❌ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | +| ❌ Device
✅ User | ❌ Pro
✅ Enterprise
✅ Education
❌ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 22H2 [10.0.22621.900] and later
✅ Windows Insider Preview | diff --git a/windows/client-management/mdm/policy-csp-remotedesktopservices.md b/windows/client-management/mdm/policy-csp-remotedesktopservices.md index 2e7833047e..1af96611e4 100644 --- a/windows/client-management/mdm/policy-csp-remotedesktopservices.md +++ b/windows/client-management/mdm/policy-csp-remotedesktopservices.md @@ -1,7 +1,7 @@ --- title: RemoteDesktopServices Policy CSP description: Learn more about the RemoteDesktopServices Area in Policy CSP. -ms.date: 01/18/2024 +ms.date: 04/10/2024 --- @@ -150,39 +150,39 @@ FIPS compliance can be configured through the System cryptography. Use FIPS comp - -## DisconnectOnLockBasicAuthn + +## DisconnectOnLockLegacyAuthn - + | Scope | Editions | Applicable OS | |:--|:--|:--| | ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | - + - + ```Device -./Device/Vendor/MSFT/Policy/Config/RemoteDesktopServices/DisconnectOnLockBasicAuthn +./Device/Vendor/MSFT/Policy/Config/RemoteDesktopServices/DisconnectOnLockLegacyAuthn ``` - + - + - + - + - + - + **Description framework properties**: | Property name | Property value | |:--|:--| | Format | `chr` (string) | | Access Type | Add, Delete, Get, Replace | - + - + [!INCLUDE [ADMX-backed policy note](includes/mdm-admx-policy-note.md)] @@ -192,47 +192,47 @@ FIPS compliance can be configured through the System cryptography. Use FIPS comp |:--|:--| | Name | TS_DISCONNECT_ON_LOCK_POLICY | | ADMX File Name | terminalserver.admx | - + - + - + - + - -## DisconnectOnLockWebAccountAuthn + +## DisconnectOnLockMicrosoftIdentityAuthn - + | Scope | Editions | Applicable OS | |:--|:--|:--| | ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | - + - + ```Device -./Device/Vendor/MSFT/Policy/Config/RemoteDesktopServices/DisconnectOnLockWebAccountAuthn +./Device/Vendor/MSFT/Policy/Config/RemoteDesktopServices/DisconnectOnLockMicrosoftIdentityAuthn ``` - + - + - + - + - + - + **Description framework properties**: | Property name | Property value | |:--|:--| | Format | `chr` (string) | | Access Type | Add, Delete, Get, Replace | - + - + [!INCLUDE [ADMX-backed policy note](includes/mdm-admx-policy-note.md)] @@ -242,13 +242,13 @@ FIPS compliance can be configured through the System cryptography. Use FIPS comp |:--|:--| | Name | TS_DISCONNECT_ON_LOCK_AAD_POLICY | | ADMX File Name | terminalserver.admx | - + - + - + - + ## DoNotAllowDriveRedirection diff --git a/windows/client-management/mdm/policy-csp-search.md b/windows/client-management/mdm/policy-csp-search.md index ba702af769..1260cd7ab1 100644 --- a/windows/client-management/mdm/policy-csp-search.md +++ b/windows/client-management/mdm/policy-csp-search.md @@ -1,7 +1,7 @@ --- title: Search Policy CSP description: Learn more about the Search Area in Policy CSP. -ms.date: 01/31/2024 +ms.date: 04/10/2024 --- @@ -1116,7 +1116,7 @@ If enabled, clients will be unable to query this computer's index remotely. Thus | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1607 [10.0.14393] and later | +| ✅ Device
❌ User | Not applicable | ✅ Windows 10, version 1607 [10.0.14393] and later | diff --git a/windows/client-management/mdm/policy-csp-security.md b/windows/client-management/mdm/policy-csp-security.md index b1093ffddc..25e55a8941 100644 --- a/windows/client-management/mdm/policy-csp-security.md +++ b/windows/client-management/mdm/policy-csp-security.md @@ -1,7 +1,7 @@ --- title: Security Policy CSP description: Learn more about the Security Area in Policy CSP. -ms.date: 01/18/2024 +ms.date: 04/10/2024 --- @@ -71,7 +71,7 @@ Specifies whether to allow the runtime configuration agent to install provisioni | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1507 [10.0.10240] and later | +| ✅ Device
❌ User | ❌ Pro
❌ Enterprise
❌ Education
❌ Windows SE
❌ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1507 [10.0.10240] and later | @@ -172,7 +172,7 @@ Specifies whether to allow the runtime configuration agent to remove provisionin | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1507 [10.0.10240] and later | +| ✅ Device
❌ User | Not applicable | ✅ Windows 10, version 1507 [10.0.10240] and later | diff --git a/windows/client-management/mdm/policy-csp-start.md b/windows/client-management/mdm/policy-csp-start.md index 8ae3504c72..cfa71536be 100644 --- a/windows/client-management/mdm/policy-csp-start.md +++ b/windows/client-management/mdm/policy-csp-start.md @@ -542,7 +542,7 @@ Allows admin to override the default items pinned to Start. With this policy you can push a new list of pinned apps to override the default/current list of pinned apps in the Windows Start menu. -For more information on how to configure the Start menu, see [Customize the Start menu layout on Windows 11](/windows/configuration/customize-start-menu-layout-windows-11). +For more information on how to configure the Start menu, see [Customize the Start layout](/windows/configuration/start/layout). This string policy takes a JSON file named `LayoutModification.json`. The file enumerates the items to pin and their relative order. diff --git a/windows/client-management/mdm/policy-csp-sudo.md b/windows/client-management/mdm/policy-csp-sudo.md index 13be1bd00e..09a4e3c938 100644 --- a/windows/client-management/mdm/policy-csp-sudo.md +++ b/windows/client-management/mdm/policy-csp-sudo.md @@ -1,7 +1,7 @@ --- title: Sudo Policy CSP description: Learn more about the Sudo Area in Policy CSP. -ms.date: 01/31/2024 +ms.date: 04/10/2024 --- @@ -9,8 +9,6 @@ ms.date: 01/31/2024 # Policy CSP - Sudo -[!INCLUDE [ADMX-backed CSP tip](includes/mdm-admx-csp-note.md)] - [!INCLUDE [Windows Insider tip](includes/mdm-insider-csp-note.md)] @@ -45,21 +43,30 @@ ms.date: 01/31/2024 | Property name | Property value | |:--|:--| -| Format | `chr` (string) | +| Format | `int` | | Access Type | Add, Delete, Get, Replace | +| Default Value | 3 | - - -[!INCLUDE [ADMX-backed policy note](includes/mdm-admx-policy-note.md)] + +**Allowed values**: -**ADMX mapping**: +| Value | Description | +|:--|:--| +| 0 | Sudo is disabled. | +| 1 | Sudo is allowed in 'force new window' mode. | +| 2 | Sudo is allowed in 'disable input' mode. | +| 3 (Default) | Sudo is allowed in 'inline' mode. | + + + +**Group policy mapping**: | Name | Value | |:--|:--| | Name | EnableSudo | -| ADMX File Name | Sudo.admx | - +| Path | Sudo > AT > System | + diff --git a/windows/client-management/mdm/policy-csp-systemservices.md b/windows/client-management/mdm/policy-csp-systemservices.md index b08d9a0c2d..2d9c9595f5 100644 --- a/windows/client-management/mdm/policy-csp-systemservices.md +++ b/windows/client-management/mdm/policy-csp-systemservices.md @@ -1,7 +1,7 @@ --- title: SystemServices Policy CSP description: Learn more about the SystemServices Area in Policy CSP. -ms.date: 01/18/2024 +ms.date: 04/10/2024 --- @@ -9,6 +9,8 @@ ms.date: 01/18/2024 # Policy CSP - SystemServices +[!INCLUDE [Windows Insider tip](includes/mdm-insider-csp-note.md)] + @@ -19,7 +21,7 @@ ms.date: 01/18/2024 | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1803 [10.0.17134] and later | +| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | @@ -169,7 +171,7 @@ This setting determines whether the service's start type is Automatic(2), Manual | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1803 [10.0.17134] and later | +| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | @@ -219,7 +221,7 @@ This setting determines whether the service's start type is Automatic(2), Manual | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1803 [10.0.17134] and later | +| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | @@ -269,7 +271,7 @@ This setting determines whether the service's start type is Automatic(2), Manual | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1803 [10.0.17134] and later | +| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | @@ -319,7 +321,7 @@ This setting determines whether the service's start type is Automatic(2), Manual | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1803 [10.0.17134] and later | +| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | @@ -369,7 +371,7 @@ This setting determines whether the service's start type is Automatic(2), Manual | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1803 [10.0.17134] and later | +| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | @@ -419,7 +421,7 @@ This setting determines whether the service's start type is Automatic(2), Manual | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1803 [10.0.17134] and later | +| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | @@ -469,7 +471,7 @@ This setting determines whether the service's start type is Automatic(2), Manual | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1803 [10.0.17134] and later | +| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | @@ -519,7 +521,7 @@ This setting determines whether the service's start type is Automatic(2), Manual | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1803 [10.0.17134] and later | +| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | @@ -569,7 +571,7 @@ This setting determines whether the service's start type is Automatic(2), Manual | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1803 [10.0.17134] and later | +| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | @@ -619,7 +621,7 @@ This setting determines whether the service's start type is Automatic(2), Manual | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1803 [10.0.17134] and later | +| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | @@ -669,7 +671,7 @@ This setting determines whether the service's start type is Automatic(2), Manual | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1803 [10.0.17134] and later | +| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | @@ -719,7 +721,7 @@ This setting determines whether the service's start type is Automatic(2), Manual | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1803 [10.0.17134] and later | +| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | @@ -769,7 +771,7 @@ This setting determines whether the service's start type is Automatic(2), Manual | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1803 [10.0.17134] and later | +| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | @@ -819,7 +821,7 @@ This setting determines whether the service's start type is Automatic(2), Manual | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1803 [10.0.17134] and later | +| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | @@ -869,7 +871,7 @@ This setting determines whether the service's start type is Automatic(2), Manual | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1803 [10.0.17134] and later | +| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | diff --git a/windows/client-management/mdm/policy-csp-timelanguagesettings.md b/windows/client-management/mdm/policy-csp-timelanguagesettings.md index ec0faa2924..cfd36f3bb7 100644 --- a/windows/client-management/mdm/policy-csp-timelanguagesettings.md +++ b/windows/client-management/mdm/policy-csp-timelanguagesettings.md @@ -1,7 +1,7 @@ --- title: TimeLanguageSettings Policy CSP description: Learn more about the TimeLanguageSettings Area in Policy CSP. -ms.date: 01/18/2024 +ms.date: 04/10/2024 --- @@ -22,7 +22,7 @@ ms.date: 01/18/2024 | Scope | Editions | Applicable OS | |:--|:--|:--| -| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
✅ Windows SE
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 10, version 1703 [10.0.15063] and later | +| ✅ Device
❌ User | Not applicable | ✅ Windows 10, version 1703 [10.0.15063] and later | diff --git a/windows/client-management/mdm/policy-csp-update.md b/windows/client-management/mdm/policy-csp-update.md index d52bea489c..e8dfe5371f 100644 --- a/windows/client-management/mdm/policy-csp-update.md +++ b/windows/client-management/mdm/policy-csp-update.md @@ -1,7 +1,7 @@ --- title: Update Policy CSP description: Learn more about the Update Area in Policy CSP. -ms.date: 02/14/2024 +ms.date: 02/14/2024 --- @@ -1556,7 +1556,8 @@ Configure this policy to specify whether to receive **Windows Feature Updates** - SetPolicyDrivenUpdateSourceForOtherUpdates > [!NOTE] -> If you have not properly configured Update/UpdateServiceUrl correctly to point to your WSUS server, this policy will have no effect. +> - If you have not properly configured Update/UpdateServiceUrl correctly to point to your WSUS server, this policy will have no effect. +> - If you're also using the **Specify settings for optional component installation and component repair** ([ADMX_Servicing](policy-csp-admx-servicing.md)) policy to enable content for FoDs and language packs, see [How to make Features on Demand and language packs available when you're using WSUS or Configuration Manager](/windows/deployment/update/fod-and-lang-packs) to verify your policy configuration. @@ -1694,7 +1695,8 @@ Configure this policy to specify whether to receive **Windows Quality Updates** - SetPolicyDrivenUpdateSourceForOtherUpdates > [!NOTE] -> If you have not properly configured Update/UpdateServiceUrl correctly to point to your WSUS server, this policy will have no effect. +> - If you have not properly configured Update/UpdateServiceUrl correctly to point to your WSUS server, this policy will have no effect. +> - If you're also using the **Specify settings for optional component installation and component repair** ([ADMX_Servicing](policy-csp-admx-servicing.md)) policy to enable content for FoDs and language packs, see [How to make Features on Demand and language packs available when you're using WSUS or Configuration Manager](/windows/deployment/update/fod-and-lang-packs) to verify your policy configuration. diff --git a/windows/client-management/mdm/policy-csp-windowslogon.md b/windows/client-management/mdm/policy-csp-windowslogon.md index 8af407de72..d9c4d40da1 100644 --- a/windows/client-management/mdm/policy-csp-windowslogon.md +++ b/windows/client-management/mdm/policy-csp-windowslogon.md @@ -1,7 +1,7 @@ --- title: WindowsLogon Policy CSP description: Learn more about the WindowsLogon Area in Policy CSP. -ms.date: 01/18/2024 +ms.date: 04/10/2024 --- @@ -34,11 +34,11 @@ ms.date: 01/18/2024 This policy setting controls whether a device will automatically sign in and lock the last interactive user after the system restarts or after a shutdown and cold boot. -This only occurs if the last interactive user didn't sign out before the restart or shutdown. +This only occurs if the last interactive user didn't sign out before the restart or shutdown. If the device is joined to Active Directory or Microsoft Entra ID, this policy only applies to Windows Update restarts. Otherwise, this will apply to both Windows Update restarts and user-initiated restarts and shutdowns. -- If you don't configure this policy setting, it's enabled by default. When the policy is enabled, the user is automatically signed in and the session is automatically locked with all lock screen apps configured for that user after the device boots. +- If you don't configure this policy setting, it's enabled by default. When the policy is enabled, the user is automatically signed in and the session is automatically locked with all lock screen apps configured for that user after the device boots. After enabling this policy, you can configure its settings through the ConfigAutomaticRestartSignOn policy, which configures the mode of automatically signing in and locking the last interactive user after a restart or cold boot . diff --git a/windows/client-management/mdm/printerprovisioning-ddf-file.md b/windows/client-management/mdm/printerprovisioning-ddf-file.md index 3c4a974d93..21cb02133b 100644 --- a/windows/client-management/mdm/printerprovisioning-ddf-file.md +++ b/windows/client-management/mdm/printerprovisioning-ddf-file.md @@ -1,7 +1,7 @@ --- title: PrinterProvisioning DDF file description: View the XML file containing the device description framework (DDF) for the PrinterProvisioning configuration service provider. -ms.date: 01/18/2024 +ms.date: 04/10/2024 --- @@ -40,7 +40,7 @@ The following XML file contains the device description framework (DDF) for the P 10.0.22000, 10.0.19044.1806, 10.0.19043.1806, 10.0.19042.1806 1.0 - 0x4;0x1B;0x30;0x31;0x48;0x54;0x62;0x63;0x64;0x65;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x88;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xBC;0xBF;0xCA;0xCB;0xCD;0xCF; + 0x4;0x1B;0x30;0x31;0x48;0x54;0x62;0x63;0x64;0x65;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x88;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xBC;0xBF;0xCA;0xCB;0xCD;0xCF;0xD2; diff --git a/windows/client-management/mdm/reboot-ddf-file.md b/windows/client-management/mdm/reboot-ddf-file.md index 3b86f5316c..a1c58cf7c1 100644 --- a/windows/client-management/mdm/reboot-ddf-file.md +++ b/windows/client-management/mdm/reboot-ddf-file.md @@ -1,7 +1,7 @@ --- title: Reboot DDF file description: View the XML file containing the device description framework (DDF) for the Reboot configuration service provider. -ms.date: 01/18/2024 +ms.date: 04/10/2024 --- @@ -40,7 +40,7 @@ The following XML file contains the device description framework (DDF) for the R 10.0.14393 1.0 - 0x4;0x1B;0x30;0x31;0x48;0x54;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x88;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xBC;0xBF;0xCA;0xCB;0xCD;0xCF; + 0x4;0x1B;0x30;0x31;0x48;0x54;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x88;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xBC;0xBF;0xCA;0xCB;0xCD;0xCF;0xD2; diff --git a/windows/client-management/mdm/rootcacertificates-ddf-file.md b/windows/client-management/mdm/rootcacertificates-ddf-file.md index d5a746496d..5ae45109b0 100644 --- a/windows/client-management/mdm/rootcacertificates-ddf-file.md +++ b/windows/client-management/mdm/rootcacertificates-ddf-file.md @@ -1,7 +1,7 @@ --- title: RootCATrustedCertificates DDF file description: View the XML file containing the device description framework (DDF) for the RootCATrustedCertificates configuration service provider. -ms.date: 01/18/2024 +ms.date: 04/10/2024 --- @@ -40,7 +40,7 @@ The following XML file contains the device description framework (DDF) for the R 10.0.10586 1.0 - 0x4;0x1B;0x30;0x31;0x48;0x54;0x62;0x63;0x64;0x65;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x88;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xBC;0xBF;0xCA;0xCB;0xCD;0xCF; + 0x4;0x1B;0x30;0x31;0x48;0x54;0x62;0x63;0x64;0x65;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x88;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xBC;0xBF;0xCA;0xCB;0xCD;0xCF;0xD2; @@ -1067,7 +1067,7 @@ The following XML file contains the device description framework (DDF) for the R 10.0.10586 1.0 - 0x4;0x1B;0x30;0x31;0x48;0x54;0x62;0x63;0x64;0x65;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x88;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xBC;0xBF;0xCA;0xCB;0xCD;0xCF; + 0x4;0x1B;0x30;0x31;0x48;0x54;0x62;0x63;0x64;0x65;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x88;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xBC;0xBF;0xCA;0xCB;0xCD;0xCF;0xD2; diff --git a/windows/client-management/mdm/secureassessment-ddf-file.md b/windows/client-management/mdm/secureassessment-ddf-file.md index ef8d526873..c4e5cf2830 100644 --- a/windows/client-management/mdm/secureassessment-ddf-file.md +++ b/windows/client-management/mdm/secureassessment-ddf-file.md @@ -1,7 +1,7 @@ --- title: SecureAssessment DDF file description: View the XML file containing the device description framework (DDF) for the SecureAssessment configuration service provider. -ms.date: 01/18/2024 +ms.date: 04/10/2024 --- @@ -40,7 +40,7 @@ The following XML file contains the device description framework (DDF) for the S 10.0.15063 1.0 - 0x4;0x1B;0x30;0x31;0x48;0x54;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xBC;0xBF;0xCA;0xCB;0xCD;0xCF; + 0x4;0x1B;0x30;0x31;0x48;0x54;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xBC;0xBF;0xCA;0xCB;0xCD;0xCF;0xD2; diff --git a/windows/client-management/mdm/sharedpc-ddf-file.md b/windows/client-management/mdm/sharedpc-ddf-file.md index fd1f225e74..710f837864 100644 --- a/windows/client-management/mdm/sharedpc-ddf-file.md +++ b/windows/client-management/mdm/sharedpc-ddf-file.md @@ -1,7 +1,7 @@ --- title: SharedPC DDF file description: View the XML file containing the device description framework (DDF) for the SharedPC configuration service provider. -ms.date: 01/18/2024 +ms.date: 04/10/2024 --- @@ -40,7 +40,7 @@ The following XML file contains the device description framework (DDF) for the S 10.0.14393 1.0 - 0x4;0x1B;0x30;0x31;0x48;0x54;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xBC;0xBF;0xCA;0xCB;0xCD;0xCF; + 0x4;0x1B;0x30;0x31;0x48;0x54;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xBC;0xBF;0xCA;0xCB;0xCD;0xCF;0xD2; diff --git a/windows/client-management/mdm/supl-ddf-file.md b/windows/client-management/mdm/supl-ddf-file.md index e489dea63b..3f4964bf42 100644 --- a/windows/client-management/mdm/supl-ddf-file.md +++ b/windows/client-management/mdm/supl-ddf-file.md @@ -1,7 +1,7 @@ --- title: SUPL DDF file description: View the XML file containing the device description framework (DDF) for the SUPL configuration service provider. -ms.date: 01/18/2024 +ms.date: 04/10/2024 --- @@ -42,7 +42,7 @@ The following XML file contains the device description framework (DDF) for the S 10.0.10240 1.0 - 0x4;0x1B;0x30;0x31;0x48;0x54;0x62;0x63;0x64;0x65;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xBC;0xBF;0xCA;0xCB;0xCD;0xCF; + 0x4;0x1B;0x30;0x31;0x48;0x54;0x62;0x63;0x64;0x65;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xBC;0xBF;0xCA;0xCB;0xCD;0xCF;0xD2; diff --git a/windows/client-management/mdm/vpnv2-ddf-file.md b/windows/client-management/mdm/vpnv2-ddf-file.md index badf9f29e6..601a0363a7 100644 --- a/windows/client-management/mdm/vpnv2-ddf-file.md +++ b/windows/client-management/mdm/vpnv2-ddf-file.md @@ -1,7 +1,7 @@ --- title: VPNv2 DDF file description: View the XML file containing the device description framework (DDF) for the VPNv2 configuration service provider. -ms.date: 01/18/2024 +ms.date: 04/10/2024 --- @@ -39,7 +39,7 @@ The following XML file contains the device description framework (DDF) for the V 10.0.10586 1.0 - 0x4;0x1B;0x30;0x31;0x48;0x54;0x62;0x63;0x64;0x65;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x88;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xBC;0xBF;0xCA;0xCB;0xCD;0xCF; + 0x4;0x1B;0x30;0x31;0x48;0x54;0x62;0x63;0x64;0x65;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x88;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xBC;0xBF;0xCA;0xCB;0xCD;0xCF;0xD2; @@ -3265,7 +3265,7 @@ The following XML file contains the device description framework (DDF) for the V 10.0.10586 1.0 - 0x4;0x1B;0x30;0x31;0x48;0x54;0x62;0x63;0x64;0x65;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x88;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xBC;0xBF;0xCA;0xCB;0xCD;0xCF; + 0x4;0x1B;0x30;0x31;0x48;0x54;0x62;0x63;0x64;0x65;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x88;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xBC;0xBF;0xCA;0xCB;0xCD;0xCF;0xD2; diff --git a/windows/client-management/mdm/wifi-ddf-file.md b/windows/client-management/mdm/wifi-ddf-file.md index a0ff37f35e..a43971553f 100644 --- a/windows/client-management/mdm/wifi-ddf-file.md +++ b/windows/client-management/mdm/wifi-ddf-file.md @@ -1,7 +1,7 @@ --- title: WiFi DDF file description: View the XML file containing the device description framework (DDF) for the WiFi configuration service provider. -ms.date: 01/18/2024 +ms.date: 04/10/2024 --- @@ -39,7 +39,7 @@ The following XML file contains the device description framework (DDF) for the W 10.0.10586 1.0 - 0x4;0x1B;0x30;0x31;0x48;0x54;0x62;0x63;0x64;0x65;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x88;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xBC;0xBF;0xCA;0xCB;0xCD;0xCF; + 0x4;0x1B;0x30;0x31;0x48;0x54;0x62;0x63;0x64;0x65;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x88;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xBC;0xBF;0xCA;0xCB;0xCD;0xCF;0xD2; @@ -322,7 +322,7 @@ The following XML file contains the device description framework (DDF) for the W 10.0.10586 1.0 - 0x4;0x1B;0x30;0x31;0x48;0x54;0x62;0x63;0x64;0x65;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x88;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xBC;0xBF;0xCA;0xCB;0xCD;0xCF; + 0x4;0x1B;0x30;0x31;0x48;0x54;0x62;0x63;0x64;0x65;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x88;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xBC;0xBF;0xCA;0xCB;0xCD;0xCF;0xD2; diff --git a/windows/client-management/mdm/windowsdefenderapplicationguard-ddf-file.md b/windows/client-management/mdm/windowsdefenderapplicationguard-ddf-file.md index bdee83a712..83c52f17cc 100644 --- a/windows/client-management/mdm/windowsdefenderapplicationguard-ddf-file.md +++ b/windows/client-management/mdm/windowsdefenderapplicationguard-ddf-file.md @@ -1,7 +1,7 @@ --- title: WindowsDefenderApplicationGuard DDF file description: View the XML file containing the device description framework (DDF) for the WindowsDefenderApplicationGuard configuration service provider. -ms.date: 01/18/2024 +ms.date: 04/10/2024 --- @@ -40,7 +40,7 @@ The following XML file contains the device description framework (DDF) for the W 10.0.16299 1.1 - 0x4;0x1B;0x30;0x31;0x48;0x54;0x62;0x63;0x64;0x65;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xBC;0xBF;0xCA;0xCB;0xCD;0xCF; + 0x4;0x1B;0x30;0x31;0x48;0x54;0x62;0x63;0x64;0x65;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xBC;0xBF;0xCA;0xCB;0xCD;0xCF;0xD2; diff --git a/windows/client-management/mdm/windowslicensing-ddf-file.md b/windows/client-management/mdm/windowslicensing-ddf-file.md index 2830112994..a8bb624a6b 100644 --- a/windows/client-management/mdm/windowslicensing-ddf-file.md +++ b/windows/client-management/mdm/windowslicensing-ddf-file.md @@ -1,7 +1,7 @@ --- title: WindowsLicensing DDF file description: View the XML file containing the device description framework (DDF) for the WindowsLicensing configuration service provider. -ms.date: 01/18/2024 +ms.date: 04/10/2024 --- @@ -40,7 +40,7 @@ The following XML file contains the device description framework (DDF) for the W 10.0.10586 1.0 - 0x4;0x1B;0x30;0x31;0x48;0x54;0x62;0x63;0x64;0x65;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xBC;0xBF;0xCD;0xCF; + 0x4;0x1B;0x30;0x31;0x48;0x54;0x62;0x63;0x64;0x65;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xBC;0xBF;0xCD;0xCF;0xD2; diff --git a/windows/client-management/mdm/wirednetwork-ddf-file.md b/windows/client-management/mdm/wirednetwork-ddf-file.md index ba3a3845ed..ddb1f28855 100644 --- a/windows/client-management/mdm/wirednetwork-ddf-file.md +++ b/windows/client-management/mdm/wirednetwork-ddf-file.md @@ -1,7 +1,7 @@ --- title: WiredNetwork DDF file description: View the XML file containing the device description framework (DDF) for the WiredNetwork configuration service provider. -ms.date: 01/18/2024 +ms.date: 04/10/2024 --- @@ -39,7 +39,7 @@ The following XML file contains the device description framework (DDF) for the W 10.0.17763 1.0 - 0x4;0x1B;0x30;0x31;0x48;0x54;0x62;0x63;0x64;0x65;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xBC;0xBF;0xCA;0xCB;0xCD;0xCF; + 0x4;0x1B;0x30;0x31;0x48;0x54;0x62;0x63;0x64;0x65;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xBC;0xBF;0xCA;0xCB;0xCD;0xCF;0xD2; @@ -118,7 +118,7 @@ The following XML file contains the device description framework (DDF) for the W 10.0.17763 1.0 - 0x4;0x1B;0x30;0x31;0x48;0x54;0x62;0x63;0x64;0x65;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xBC;0xBF;0xCA;0xCB;0xCD;0xCF; + 0x4;0x1B;0x30;0x31;0x48;0x54;0x62;0x63;0x64;0x65;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xBC;0xBF;0xCA;0xCB;0xCD;0xCF;0xD2; diff --git a/windows/configuration/assigned-access/configuration-file.md b/windows/configuration/assigned-access/configuration-file.md index 5a96fcc4a4..3d2532b2af 100644 --- a/windows/configuration/assigned-access/configuration-file.md +++ b/windows/configuration/assigned-access/configuration-file.md @@ -232,9 +232,9 @@ Either don't use the node or leave it empty. For a restricted user experience profile (`AllAppList`), you must define the Start layout. The Start layout contains a list of applications that are pinned to the Start menu. You can choose to pin all the allowed applications to the Start menu, or a subset. The easiest way to create a customized Start layout is to configure the Start menu on a test device and then export the layout. -::: zone pivot="windows-10" +To learn how to customize and export a Start menu configuration, see [Customize the Start menu](../start/layout.md). -To learn how to customize and export a Start menu configuration, see [Customize the Start menu](../start/customize-and-export-start-layout.md). +::: zone pivot="windows-10" With the exported Start menu configuration, use the `StartLayout` element and add the content of the XML file. For example: @@ -278,8 +278,6 @@ Example with some apps pinned: ::: zone pivot="windows-11" -To learn how to customize and export a Start menu configuration, see [Customize the Start menu](../start/customize-and-export-start-layout.md). - With the exported Start menu configuration, use the `v5:StartPins` element and add the content of the exported JSON file. For example: ```xml diff --git a/windows/configuration/assigned-access/overview.md b/windows/configuration/assigned-access/overview.md index aaac72ceeb..cef2e32f30 100644 --- a/windows/configuration/assigned-access/overview.md +++ b/windows/configuration/assigned-access/overview.md @@ -155,7 +155,7 @@ Write-Output "Successfully applied Shell Launcher configuration" [!INCLUDE [powershell-wmi-bridge-2](../../../includes/configure/powershell-wmi-bridge-2.md)] -#### [:::image type="icon" source="../images/icons/settings.svg"::: **Settings**](#tab/settings) +#### [:::image type="icon" source="../images/icons/settings-app.svg"::: **Settings**](#tab/settings) Here are the steps to configure a kiosk using the Settings app: @@ -260,7 +260,7 @@ Write-Output "Successfully applied Assigned Access configuration" [!INCLUDE [powershell-wmi-bridge-2](../../../includes/configure/powershell-wmi-bridge-2.md)] -#### [:::image type="icon" source="../images/icons/settings.svg"::: **Settings**](#tab/settings) +#### [:::image type="icon" source="../images/icons/settings-app.svg"::: **Settings**](#tab/settings) This option isn't available using Settings. diff --git a/windows/configuration/assigned-access/quickstart-kiosk.md b/windows/configuration/assigned-access/quickstart-kiosk.md index 60839e646e..0dd9ff9fa7 100644 --- a/windows/configuration/assigned-access/quickstart-kiosk.md +++ b/windows/configuration/assigned-access/quickstart-kiosk.md @@ -64,7 +64,7 @@ Assign the policy to a group that contains as members the devices that you want -#### [:::image type="icon" source="../images/icons/settings.svg"::: **Settings**](#tab/settings) +#### [:::image type="icon" source="../images/icons/settings-app.svg"::: **Settings**](#tab/settings) Here are the steps to configure a kiosk using the Settings app: diff --git a/windows/configuration/images/icons/allapps.svg b/windows/configuration/images/icons/allapps.svg new file mode 100644 index 0000000000..dbcdff6268 --- /dev/null +++ b/windows/configuration/images/icons/allapps.svg @@ -0,0 +1,3 @@ + + + diff --git a/windows/configuration/images/icons/certificate.svg b/windows/configuration/images/icons/certificate.svg new file mode 100644 index 0000000000..956bfc1e42 --- /dev/null +++ b/windows/configuration/images/icons/certificate.svg @@ -0,0 +1,3 @@ + + + diff --git a/windows/configuration/images/icons/cmd.svg b/windows/configuration/images/icons/cmd.svg new file mode 100644 index 0000000000..e712a4fff5 --- /dev/null +++ b/windows/configuration/images/icons/cmd.svg @@ -0,0 +1,9 @@ + + + + + + + + + diff --git a/windows/configuration/images/icons/control-panel.svg b/windows/configuration/images/icons/control-panel.svg new file mode 100644 index 0000000000..6eebbe9be8 --- /dev/null +++ b/windows/configuration/images/icons/control-panel.svg @@ -0,0 +1,9 @@ + + + + + + + + + diff --git a/windows/configuration/images/icons/face.svg b/windows/configuration/images/icons/face.svg new file mode 100644 index 0000000000..a4fa1ca0df --- /dev/null +++ b/windows/configuration/images/icons/face.svg @@ -0,0 +1,3 @@ + + + diff --git a/windows/configuration/images/icons/fingerprint.svg b/windows/configuration/images/icons/fingerprint.svg new file mode 100644 index 0000000000..2494d65659 --- /dev/null +++ b/windows/configuration/images/icons/fingerprint.svg @@ -0,0 +1,3 @@ + + + diff --git a/windows/configuration/images/icons/folder.svg b/windows/configuration/images/icons/folder.svg new file mode 100644 index 0000000000..468edaf961 --- /dev/null +++ b/windows/configuration/images/icons/folder.svg @@ -0,0 +1,3 @@ + + + diff --git a/windows/configuration/images/icons/group-policy.svg b/windows/configuration/images/icons/group-policy.svg index c9cb511415..e6ec2d2c2e 100644 --- a/windows/configuration/images/icons/group-policy.svg +++ b/windows/configuration/images/icons/group-policy.svg @@ -1,9 +1,14 @@ - - + + + + - + - + + + + diff --git a/windows/configuration/images/icons/information.svg b/windows/configuration/images/icons/information.svg index bc692eabb9..4a33944103 100644 --- a/windows/configuration/images/icons/information.svg +++ b/windows/configuration/images/icons/information.svg @@ -1,3 +1,3 @@ - - - \ No newline at end of file + + + diff --git a/windows/configuration/images/icons/insider.svg b/windows/configuration/images/icons/insider.svg new file mode 100644 index 0000000000..fa002fa2a1 --- /dev/null +++ b/windows/configuration/images/icons/insider.svg @@ -0,0 +1,3 @@ + + + diff --git a/windows/configuration/images/icons/intune.svg b/windows/configuration/images/icons/intune.svg index 6e0d938aed..22148b48fb 100644 --- a/windows/configuration/images/icons/intune.svg +++ b/windows/configuration/images/icons/intune.svg @@ -1,24 +1,23 @@ - - - - - - - - - - - - - - - - Icon-intune-329 - - - - - - - - \ No newline at end of file + + + + + + + + + + + + + + + + + + + + + + + diff --git a/windows/configuration/images/icons/iris.svg b/windows/configuration/images/icons/iris.svg new file mode 100644 index 0000000000..465902e0b3 --- /dev/null +++ b/windows/configuration/images/icons/iris.svg @@ -0,0 +1,3 @@ + + + diff --git a/windows/configuration/images/icons/kiosk.svg b/windows/configuration/images/icons/kiosk.svg new file mode 100644 index 0000000000..f975677d19 --- /dev/null +++ b/windows/configuration/images/icons/kiosk.svg @@ -0,0 +1,3 @@ + + + diff --git a/windows/configuration/images/icons/lock.svg b/windows/configuration/images/icons/lock.svg new file mode 100644 index 0000000000..ccd1850fbb --- /dev/null +++ b/windows/configuration/images/icons/lock.svg @@ -0,0 +1,3 @@ + + + diff --git a/windows/configuration/images/icons/notification.svg b/windows/configuration/images/icons/notification.svg new file mode 100644 index 0000000000..0da0f9814d --- /dev/null +++ b/windows/configuration/images/icons/notification.svg @@ -0,0 +1,3 @@ + + + diff --git a/windows/configuration/images/icons/package.svg b/windows/configuration/images/icons/package.svg new file mode 100644 index 0000000000..99c1148922 --- /dev/null +++ b/windows/configuration/images/icons/package.svg @@ -0,0 +1,3 @@ + + + diff --git a/windows/configuration/images/icons/pin-code.svg b/windows/configuration/images/icons/pin-code.svg new file mode 100644 index 0000000000..a5bfdc4148 --- /dev/null +++ b/windows/configuration/images/icons/pin-code.svg @@ -0,0 +1,3 @@ + + + diff --git a/windows/configuration/images/icons/pin.svg b/windows/configuration/images/icons/pin.svg new file mode 100644 index 0000000000..64426df32c --- /dev/null +++ b/windows/configuration/images/icons/pin.svg @@ -0,0 +1,3 @@ + + + diff --git a/windows/configuration/images/icons/power.svg b/windows/configuration/images/icons/power.svg new file mode 100644 index 0000000000..e74606b72c --- /dev/null +++ b/windows/configuration/images/icons/power.svg @@ -0,0 +1,3 @@ + + + diff --git a/windows/configuration/images/icons/powershell.svg b/windows/configuration/images/icons/powershell.svg index b23a99c61d..3d90e2ff6f 100644 --- a/windows/configuration/images/icons/powershell.svg +++ b/windows/configuration/images/icons/powershell.svg @@ -1,9 +1,9 @@ - - + + - + - + diff --git a/windows/configuration/images/icons/registry.svg b/windows/configuration/images/icons/registry.svg index bc4aa2f534..667bce7438 100644 --- a/windows/configuration/images/icons/registry.svg +++ b/windows/configuration/images/icons/registry.svg @@ -1,9 +1,9 @@ - + - + - + diff --git a/windows/configuration/images/icons/rocket.svg b/windows/configuration/images/icons/rocket.svg index 133e0c7daf..ee39fb57aa 100644 --- a/windows/configuration/images/icons/rocket.svg +++ b/windows/configuration/images/icons/rocket.svg @@ -1,19 +1,155 @@ - - - - - - - - + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + - - - - - + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + - diff --git a/windows/configuration/images/icons/sc.svg b/windows/configuration/images/icons/sc.svg new file mode 100644 index 0000000000..d1924ffebb --- /dev/null +++ b/windows/configuration/images/icons/sc.svg @@ -0,0 +1,3 @@ + + + diff --git a/windows/configuration/images/icons/settings-app.svg b/windows/configuration/images/icons/settings-app.svg new file mode 100644 index 0000000000..d62d13fb54 --- /dev/null +++ b/windows/configuration/images/icons/settings-app.svg @@ -0,0 +1,24 @@ + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/windows/configuration/images/icons/settings.svg b/windows/configuration/images/icons/settings.svg index 9ec19d16aa..36da6757f2 100644 --- a/windows/configuration/images/icons/settings.svg +++ b/windows/configuration/images/icons/settings.svg @@ -1,19 +1,3 @@ - - - - - - - - - - - - - - - - - + diff --git a/windows/configuration/images/icons/start.svg b/windows/configuration/images/icons/start.svg new file mode 100644 index 0000000000..a3e6c3d8e8 --- /dev/null +++ b/windows/configuration/images/icons/start.svg @@ -0,0 +1,3 @@ + + + diff --git a/windows/configuration/images/icons/subscription.svg b/windows/configuration/images/icons/subscription.svg new file mode 100644 index 0000000000..ffa73c424e --- /dev/null +++ b/windows/configuration/images/icons/subscription.svg @@ -0,0 +1,3 @@ + + + diff --git a/windows/configuration/images/icons/taskbar.svg b/windows/configuration/images/icons/taskbar.svg new file mode 100644 index 0000000000..1a5a54d980 --- /dev/null +++ b/windows/configuration/images/icons/taskbar.svg @@ -0,0 +1,3 @@ + + + diff --git a/windows/configuration/images/icons/touch.svg b/windows/configuration/images/icons/touch.svg new file mode 100644 index 0000000000..886e616e56 --- /dev/null +++ b/windows/configuration/images/icons/touch.svg @@ -0,0 +1,3 @@ + + + diff --git a/windows/configuration/images/icons/user.svg b/windows/configuration/images/icons/user.svg new file mode 100644 index 0000000000..76c0b2ce5d --- /dev/null +++ b/windows/configuration/images/icons/user.svg @@ -0,0 +1,3 @@ + + + diff --git a/windows/configuration/images/icons/vsc.svg b/windows/configuration/images/icons/vsc.svg new file mode 100644 index 0000000000..cbf23de89e --- /dev/null +++ b/windows/configuration/images/icons/vsc.svg @@ -0,0 +1,3 @@ + + + diff --git a/windows/configuration/images/icons/windows-os.svg b/windows/configuration/images/icons/windows-os.svg deleted file mode 100644 index da64baf975..0000000000 --- a/windows/configuration/images/icons/windows-os.svg +++ /dev/null @@ -1,3 +0,0 @@ - - - \ No newline at end of file diff --git a/windows/configuration/index.yml b/windows/configuration/index.yml index c71df35e46..33f47997d5 100644 --- a/windows/configuration/index.yml +++ b/windows/configuration/index.yml @@ -21,14 +21,18 @@ landingContent: linkLists: - linkListType: how-to-guide links: - - text: Customize the Windows Start menu layout - url: start/customize-and-export-start-layout.md - - text: Customize the Windows taskbar + - text: Configure the Start menu + url: start/index.md + - text: Customize the Taskbar url: taskbar/index.md - - text: Configure Windows Spotlight on the lock screen + - text: Configure the Lock Screen url: lock-screen/windows-spotlight.md - text: Accessibility information for IT pros url: accessibility/index.md + - linkListType: reference + links: + - text: Start policy settings + url: start/policy-settings.md - title: Configure a Windows kiosk linkLists: diff --git a/windows/configuration/start/customize-and-export-start-layout.md b/windows/configuration/start/customize-and-export-start-layout.md deleted file mode 100644 index 4a22ee3b6f..0000000000 --- a/windows/configuration/start/customize-and-export-start-layout.md +++ /dev/null @@ -1,524 +0,0 @@ ---- -title: Customize and export the Start layout -description: Learn how to customize the Windows Start layout and export the configuration to apply to other devices. -ms.topic: how-to -ms.date: 03/04/2024 -zone_pivot_groups: windows-versions-11-10 -appliesto: -ms.collection: - - tier1 ---- - -# Customize and export the Start layout - -> **Looking for OEM information?** See [Customize the Taskbar](/windows-hardware/customize/desktop/customize-the-windows-11-taskbar) and [Customize the Start layout](/windows-hardware/customize/desktop/customize-the-windows-11-start-menu). - -::: zone pivot="windows-11" - -Your organization can deploy a customized Start layout to your Windows 11 devices. Customizing the Start layout is common when you have similar devices used by many users, or you want to pin specific apps. - -For example, you can override the default set of apps with your own a set of pinned apps, and in the order you choose. As an administrator, use this feature to pin apps, remove default pinned apps, order the apps, and more. - -To add apps you want pinned to the Start menu, you use a JSON file. In previous Windows versions, IT administrators used an XML file to customize the Start menu. The XML file isn't available on Windows 11 and later ***unless*** [you're an OEM](/windows-hardware/customize/desktop/customize-the-windows-11-start-menu). - -This article shows you how to export an existing Start menu layout, and use the JSON in a Microsoft Intune policy. - -## Before you begin - -- When you customize the Start layout, you overwrite the entire full layout. A partial Start layout isn't available. Users can pin and unpin apps, and uninstall apps from Start. When a user signs in or Explorer restarts, Windows reapplies the MDM policy. This action restores the specified layout and doesn't retain any user changes. - - To prevent users from making any changes to the Start menu layout, see the [NoChangeStartMenu](/windows/client-management/mdm/policy-csp-admx-startmenu#admx-startmenu-nochangestartmenu) policy. - -- It's recommended to use a mobile device management (MDM) provider. MDM providers help manage your devices, and help manage apps on your devices. You can use Microsoft Intune. Intune is a family of products that include Microsoft Intune, which is a cloud service, and Configuration Manager, which is on-premises. - - In this article, we mention these services. If you're not managing your devices using an MDM provider, the following resources may help you get started: - - - [Endpoint Management at Microsoft](/mem/endpoint-manager-overview) - - [What is Microsoft Intune](/mem/intune/fundamentals/what-is-intune) and [Microsoft Intune planning guide](/mem/intune/fundamentals/intune-planning-guide) - - [What is Configuration Manager?](/mem/configmgr/core/understand/introduction) - -## Start menu features and areas - -In Windows 11, the Start menu is redesigned with a simplified set of apps that are arranged in a grid of pages. There aren't folders, groups, or different-sized app icons: - -:::image type="content" source="./images/start-windows-11.png" alt-text="Sample start menu layout on Windows 11 that shows pinned apps, access to all apps, and recommended files."::: - -Start has the following areas: - -- **Pinned**: Shows pinned apps, or a subset of all of the apps installed on the device. You can create a list of pinned apps you want on the devices using the **ConfigureStartPins** policy. **ConfigureStartPins** overrides the entire layout, which also removes apps that are pinned by default. - - This article shows you [how to use the **ConfigureStartPins** policy](#get-the-pinnedlist-json). - -- **All apps**: Users select this option to see an alphabetical list of all the apps on the device. This section can't be customized using the JSON file. - - The [Start/HideFrequentlyUsedApps CSP](/windows/client-management/mdm/policy-csp-start#start-hidefrequentlyusedapps) exposes settings that configure the "Most used" section, which is at the top of the all apps list. - - In **Intune**, you can configure this Start menu layout feature, and more. For more information on the Start menu settings you can configure in an Intune policy, see [Windows 10/11 device settings to allow or restrict features](/mem/intune/configuration/device-restrictions-windows-10#start). - - In **Group Policy**, there are policies that include settings that control the Start menu layout. Some policies may not work as expected. Be sure to test your policies before broadly deploying them across your devices: - - - `Computer Configuration\Administrative Templates\Start Menu and Taskbar` - - `User Configuration\Administrative Templates\Start Menu and Taskbar` - -- **Recommended**: Shows recently opened files and recently installed apps. This section can only be customized in Windows 11 SE using the following policy. - - - `Computer Configuration\Administrative Templates\Start Menu and Taskbar\Remove Recommended section from Start Menu` - -## Create the JSON file - -On an existing Windows 11 device, set up your own Start layout with the pinned apps you want users to see. Then, use the [Windows PowerShell Export-StartLayout](/powershell/module/startlayout/export-startlayout) cmdlet to export the existing layout to a `LayoutModification.json` file. - -The JSON file controls the Start menu layout, and lists all the apps that are pinned. You can update the JSON file to: - -- Change the order of existing apps. The apps in the JSON file are shown on Start in the same order. -- Add more apps by entering the app ID. For more information, see [Get the pinnedList JSON](#get-the-pinnedlist-json) (in this article). - -If you're familiar with creating JSON files, you can create your own `LayoutModification.json` file. But, it's easier and faster to export the layout from an existing device. - -### Export an existing Start layout - -1. Create a folder to save the `.json` file. For example, create the `C:\Layouts` folder. -1. On a Windows 11 device, open the Windows PowerShell app. -1. Run the following cmdlet. Name the file `LayoutModification.json`. - - ```powershell - Export-StartLayout -Path "C:\Layouts\LayoutModification.json" - - ``` - -### Get the pinnedList JSON - -1. Open the `LayoutModification.json` file in a JSON editor, such as Visual Studio Code or Notepad. For more information, see [edit JSON with Visual Studio Code](https://code.visualstudio.com/docs/languages/json). -1. In the file, you see the `pinnedList` section. This section includes all of the pinned apps. Copy the `pinnedList` content in the JSON file. You'll use it in the next section. - - In the following example, you see that Microsoft Edge, Microsoft Word, the Microsoft Store app, and Notepad are pinned: - - ```json - { - "pinnedList": [ - { "desktopAppId": "MSEdge" }, - { "desktopAppId": "Microsoft.Office.WINWORD.EXE.15" }, - { "packagedAppId": "Microsoft.WindowsStore_8wekyb3d8bbwe!App" }, - { "packagedAppId": "Microsoft.WindowsNotepad_8wekyb3d8bbwe!App" } - ] - } - ``` - -1. Starting with Windows 11, the **ConfigureStartPins** policy is available. This policy uses the `LayoutModification.json` file to add apps to the Pinned section. In your JSON file, you can add more apps to this section using the following keys: - -| Key | Description | -|--|--| -| packagedAppID | Use this option for Universal Windows Platform apps. To pin a UWP app, use the app's AUMID. | -| desktopAppID | Use this option for unpackaged Win32 apps. To pin a Win32 app, use the app's AUMID. If the app doesn't have an AUMID, then enter the `desktopAppLink` instead. | -| desktopAppLink | Use this option for unpackaged Win32 apps that don't have an associated AUMID. To pin this type of app, use the path to the `.lnk` shortcut that points to the app. | - -## Use MDM to create and deploy a pinned list policy - -Now that you have the JSON syntax, you're ready to deploy your customized Start layout to devices in your organization. - -MDM providers can deploy policies to devices managed by the organization, including organization-owned devices, and personal or bring your own device (BYOD). Using an MDM provider, such as Microsoft Intune, you can deploy a policy that configures the pinned list. - -This section shows you how to create a pinned list policy in Intune. There isn't a Group Policy to create a pinned list. - -### Create a pinned list using an Intune policy - -To deploy this policy, the devices must be enrolled, and managed by your organization. For more information, see [What is device enrollment?](/mem/intune/enrollment/device-enrollment). - -1. Sign in to the [Intune admin center](https://go.microsoft.com/fwlink/?linkid=2109431). -1. Select **Devices** > **Configuration profiles** > **Create profile**. -1. Enter the following properties: - - - **Platform**: Select **Windows 10 and later**. - - **Profile**: Select **Templates** > **Custom**. - -1. Select **Create**. -1. In **Basics**, enter the following properties: - - - **Name**: Enter a descriptive name for the profile. Name your profiles so you can easily identify them later. For example, a good profile name is **Win11: Custom Start layout**. - - **Description**: Enter a description for the profile. This setting is optional, and recommended. - -1. Select **Next**. -1. In **Configuration settings** > **OMA-URI**, select **Add**. Add the following properties: - - - **Name**: Enter something like **Configure Start pins**. - - **Description**: Enter a description for the row. This setting is optional, and recommended. - - **OMA-URI**: Enter `./Vendor/MSFT/Policy/Config/Start/ConfigureStartPins`. - - **Data type**: Select **String**. - - **Value**: Paste the JSON you created or updated in the previous section. For example, enter the following text: - - ```json - { - "pinnedList": [ - { "desktopAppId": "MSEdge" }, - { "desktopAppId": "Microsoft.Office.WINWORD.EXE.15" }, - { "packagedAppId": "Microsoft.WindowsStore_8wekyb3d8bbwe!App" }, - { "packagedAppId": "Microsoft.WindowsNotepad_8wekyb3d8bbwe!App" } - ] - } - ``` - - Your settings look similar to the following settings: - - :::image type="content" source="./images/endpoint-manager-admin-center-custom-oma-uri-start-layout.png" alt-text="Custom OMA-URI settings to customize Start menu layout using pinnedList"::: - -1. Select **Save** > **Next** to save your changes. -1. Configure the rest of the policy settings. For more specific information, see [Create a profile with custom settings](/mem/intune/configuration/custom-settings-configure). - -The Windows OS exposes many CSPs that apply to the Start menu. For a list, see [Supported CSP policies for Windows 11 Start menu](supported-csp-start-menu-layout-windows.md). - -### Deploy the policy using Intune - -When the policy is created, you can deploy it now, or deploy it later. Since this policy is a customized Start layout, the policy can be deployed anytime, including before users sign in the first time. - -For more information and guidance on assigning policies to devices in your organization, see [Assign user and device profiles](/mem/intune/configuration/device-profile-assign). - -::: zone-end - -::: zone pivot="windows-10" - -The easiest method for creating a customized Start layout to apply to other Windows 10 devices is to set up the Start screen on a test computer and then export the layout. - -After you export the layout, decide whether you want to apply a *full* Start layout or a *partial* Start layout. - -When a full Start layout is applied, the users can't pin, unpin, or uninstall apps from Start. Users can view and open all apps in the **All Apps** view, but they can't pin any apps to Start. - -When [a partial Start layout](#configure-a-partial-start-layout) is applied, the contents of the specified tile groups can't be changed, but users can move those groups, and can also create and customize their own groups. - -## Customize the Start screen on your test computer - -To prepare a Start layout for export, you simply customize the Start layout on a test computer. - -To prepare a test computer: - -1. Set up a test computer on which to customize the Start layout. Your test computer should have the operating system that is installed on the users' computers (Windows 10 Pro, Enterprise, or Education). Install all apps and services that the Start layout should display. -1. Create a new user account that you'll use to customize the Start layout. - -To customize Start: - -1. Sign in to your test computer with the user account that you created. -1. Customize the Start layout as you want users to see it by using the following techniques: - - - **Pin apps to Start**. From Start, type the name of the app. When the app appears in the search results, right-click the app, and then select **Pin to Start**. - To view all apps, select **All apps** in the bottom-left corner of Start. Right-click any app, and pin or unpin it from Start. - - **Unpin apps** that you don't want to display. To unpin an app, right-click the app, and then select **Unpin from Start**. - - **Drag tiles** on Start to reorder or group apps. - - **Resize tiles**. To resize tiles, right-click the tile and then select **Resize.** - - **Create your own app groups**. Drag the apps to an empty area. To name a group, select above the group of tiles and then type the name in the **Name group** field that appears above the group. - -> [!IMPORTANT] -> If the Start layout includes tiles for apps that are not installed on the device that the layout is later applied to, the tiles for those apps will be blank. The blank tiles will persist until the next time the user signs in, at which time the blank tiles are removed. Some system events may cause the blank tiles to be removed before the next sign-in. - -### Export the Start layout - -When you have the Start layout that you want your users to see, use the [Export-StartLayout](/powershell/module/startlayout/export-startlayout) cmdlet in Windows PowerShell to export the Start layout to an .xml file. Start layout is located by default at C:\Users\username\AppData\Local\Microsoft\Windows\Shell\ - -> [!IMPORTANT] -> If you include secondary Microsoft Edge tiles (tiles that link to specific websites in Microsoft Edge), see [Add custom images to Microsoft Edge secondary tiles](start-secondary-tiles.md) for instructions. - -To export the Start layout to an .xml file: - -1. While signed in with the same account that you used to customize Start, right-click Start, and select **Windows PowerShell**. -1. Run `Export-StartLayout` with the switch `-UseDesktopApplicationID`. For example: - - ```PowerShell - Export-StartLayout -UseDesktopApplicationID -Path layout.xml - ``` - - In the previous command, `-path` is a required parameter that specifies the path and file name for the export file. You can specify a local path or a UNC path (for example, `\\FileServer01\StartLayouts\StartLayoutMarketing.xml`). - - Use a file name of your choice—for example, StartLayoutMarketing.xml. Include the .xml file name extension. The [Export-StartLayout](/powershell/module/startlayout/export-startlayout) cmdlet doesn't append the file name extension, and the policy settings require the extension. - - Example of a layout file produced by `Export-StartLayout`: - - ```xml - - - - - - - - - - - - - - - ``` - -1. (Optional) Edit the .xml file to add [a taskbar configuration](../taskbar/configure.md) or to [modify the exported layout](start-layout-xml-desktop.md). When you make changes to the exported layout, be aware that [the order of the elements in the .xml file is critical.](start-layout-xml-desktop.md#required-order) - -> [!IMPORTANT] -> If the Start layout that you export contains tiles for desktop (Win32) apps or .url links, **Export-StartLayout** will use **DesktopApplicationLinkPath** in the resulting file. Use a text or XML editor to change **DesktopApplicationLinkPath** to **DesktopApplicationID**. See [Specify Start tiles](start-layout-xml-desktop.md#specify-start-tiles) for details on using the app ID in place of the link path. - -> [!NOTE] -> All clients that the start layout applies to must have the apps and other shortcuts present on the local system in the same location as the source for the Start layout. -> -> For scripts and application tile pins to work correctly, follow these rules: -> ->- Executable files and scripts should be listed in \Program Files or wherever the installer of the app places them. ->- Shortcuts that will pinned to Start should be placed in \ProgramData\Microsoft\Windows\Start Menu\Programs. ->- If you place executable files or scripts in the \ProgramData\Microsoft\Windows\Start Menu\Programs folder, they will not pin to Start. ->- Start on Windows 10 does not support subfolders. We only support one folder. For example, \ProgramData\Microsoft\Windows\Start Menu\Programs\Folder. If you go any deeper than one folder, Start will compress the contents of all the subfolder to the top level. ->- Three additional shortcuts are pinned to the start menu after the export. These are shortcuts to %ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs, %APPDATA%\Microsoft\Windows\Start Menu\Programs, and %APPDATA%\Microsoft\Windows\Start Menu\Programs\System Tools\. - -### Configure a partial Start layout - -A partial Start layout enables you to add one or more customized tile groups to users' Start screens or menus, while still allowing users to make changes to other parts of the Start layout. All groups that you add are *locked*, meaning users can't change the contents of those tile groups, however users can change the location of those groups. Locked groups are identified with an icon, as shown in the following image. - -![locked tile group.](images/start-pinned-app.png) - -When a partial Start layout is applied for the first time, the new groups are added to the users' existing Start layouts. If an app tile is in both an existing group and in a new locked group, the duplicate app tile is removed from the existing (unlocked) group. - -When a partial Start layout is applied to a device that already has a StartLayout.xml applied, groups that were added previously are removed and the groups in the new layout are added. - -If the Start layout is applied by Group Policy or MDM, and the policy is removed, the groups remain on the devices but become unlocked. - -To configure a partial Start screen layout: - -1. [Customize the Start layout](#customize-the-start-screen-on-your-test-computer). -1. [Export the Start layout](#export-the-start-layout). -1. Open the layout .xml file. There is a `` element. Add `LayoutCustomizationRestrictionType="OnlySpecifiedGroups"` to the **DefaultLayoutOverride** element as follows: - - ```xml - - ``` - -1. Save the file and apply using any of the deployment methods. - -> [!NOTE] -> Office 2019 tiles might be removed from the Start menu when you upgrade Office 201. This only occurs if Office 2019 app tiles are in a custom group in the Start menu and only contains the Office 2019 app tiles. To avoid this problem, place another app tile in the Office 2019 group prior to the upgrade. For example, add Notepad.exe or calc.exe to the group. This issue occurs because Office 2019 removes and reinstalls the apps when they are upgraded. Start removes empty groups when it detects that all apps for that group have been removed. - -You can deploy the resulting .xml file to devices using one of the following methods: - -- Configuration Service Provider (CSP) -- Group Policy -- Provisioning package - -[!INCLUDE [tab-intro](../../../includes/configure/tab-intro.md)] - -#### [:::image type="icon" source="../images/icons/intune.svg"::: **Intune/CSP**](#tab/intune) - -You can use a mobile device management (MDM) policy to deploy a customized Start and taskbar layout to users. No reimaging is required. The layout can be updated simply by overwriting the `.xml` file that contains the layout. This feature enables you to customize Start layouts for different departments or organizations, with minimal management overhead. - -**Before you begin**: [Customize and export Start layout](customize-and-export-start-layout.md). - ->[!WARNING] ->When a full Start layout is applied with this method, the users cannot pin, unpin, or uninstall apps from Start. Users can view and open all apps in the **All Apps** view, but they cannot pin any apps to Start. When a partial Start layout is applied, the contents of the specified tile groups cannot be changed, but users can move those groups, and can also create and customize their own groups. - -Two features enable Start layout control: - -- The **Export-StartLayout** cmdlet in Windows PowerShell exports a description of the current Start layout in .xml file format. - - >[!NOTE] - >To import the layout of Start to a mounted Windows image, use the [Import-StartLayout](/powershell/module/startlayout/import-startlayout) cmdlet. - -- In Microsoft Intune, you select the Start layout XML file and add it to a device configuration profile. - - >[!NOTE] - >Please do not include XML Prologs like \ in the Start layout XML file. The settings may not be reflected correctly. - -## Create a policy for your customized Start layout - -The following example uses Microsoft Intune to configure an MDM policy that applies a customized Start layout: - -1. Sign in to the [Intune admin center](https://go.microsoft.com/fwlink/?linkid=2109431). - -1. Select **Devices** > **Configuration profiles** > **Create profile**. - -1. Enter the following properties: - - - **Platform**: Select **Windows 10 and later**. - - **Profile type**: Select **Templates** > **Device restrictions** > **Create**. - -1. In **Basics**, enter the following properties: - - - **Name**: Enter a descriptive name for the profile. Name your profiles so you can easily identify it later. For example, a good profile name is **Customize Start menu and taskbar**. - - **Description**: Enter a description for the profile. This setting is optional, but recommended. - -1. Select **Next**. - -1. In **Configuration settings**, select **Start**: - - - If you're using an XML file, select **Start menu layout**. Browse to and select your Start layout XML file. - - If you don't have an XML file, configure the others settings. For more information on these settings, see [Start settings in Microsoft Intune](/mem/intune/configuration/device-restrictions-windows-10#start). - -1. Select **Next**. -1. In **Scope tags**, select **Next**. For more information about scope tags, see [Use RBAC and scope tags for distributed IT](/mem/intune/fundamentals/scope-tags). -1. In **Assignments**, select the user or groups that will receive your profile. Select **Next**. For more information on assigning profiles, see [Assign user and device profiles](/mem/intune/configuration/device-profile-assign). -1. In **Review + create**, review your settings. When you select **Create**, your changes are saved, and the profile is assigned. The policy is also shown in the profiles list. - -> [!NOTE] -> For third party partner MDM solutions, you may need to use an OMA-URI setting for Start layout, based on the [Policy configuration service provider (CSP)](/windows/client-management/mdm/policy-configuration-service-provider). The OMA-URI setting is `./User/Vendor/MSFT/Policy/Config/Start/StartLayout`. - -#### [:::image type="icon" source="../images/icons/provisioning-package.svg"::: **PPKG**](#tab/ppkg) - -You can use a provisioning package that you create with Windows Configuration Designer to deploy a customized Start and taskbar layout to users. No reimaging is required, and the Start and taskbar layout can be updated by overwriting the .xml file that contains the layout. The provisioning package can be applied to a running device. This enables you to customize Start and taskbar layouts for different departments or organizations, with minimal management overhead. - -> [!IMPORTANT] -> If you use a provisioning package to configure the taskbar, your configuration will be reapplied each time the explorer.exe process restarts. If your configuration pins an app and the user unpins that app, the user's change will be overwritten the next time the configuration is applied. To apply a taskbar configuration and allow users to make changes that will persist, apply your configuration by using Group Policy. - -**Before you begin**: [Customize and export Start layout](customize-and-export-start-layout.md) for desktop editions. - -Three features enable Start and taskbar layout control: - -- The **Export-StartLayout** cmdlet in Windows PowerShell exports a description of the current Start layout in .xml file format. - - > [!NOTE] - > To import the layout of Start to a mounted Windows image, use the [Import-StartLayout](/powershell/module/startlayout/import-startlayout) cmdlet. - -- [You can modify the Start .xml file](../taskbar/configure.md) to include `` or create an .xml file just for the taskbar configuration. - -- In Windows Configuration Designer, you use the **Policies/Start/StartLayout** setting to provide the contents of the .xml file that defines the Start and taskbar layout. - - - -## Prepare the Start layout XML file - -The **Export-StartLayout** cmdlet produces an XML file. Because Windows Configuration Designer produces a customizations.xml file that contains the configuration settings, adding the Start layout section to the customizations.xml file directly would result in an XML file embedded in an XML file. Before you add the Start layout section to the customizations.xml file, you must replace the markup characters in your layout.xml with escape characters. - -1. Copy the contents of layout.xml into an online tool that escapes characters. - -1. During the procedure to create a provisioning package, you will copy the text with the escape characters and paste it in the customizations.xml file for your project. - -## Create a provisioning package that contains a customized Start layout - -Use the Windows Configuration Designer tool to create a provisioning package. [Learn how to install Windows Configuration Designer.](../provisioning-packages/provisioning-install-icd.md) - -> [!IMPORTANT] -> When you build a provisioning package, you may include sensitive information in the project files and in the provisioning package (.ppkg) file. Although you have the option to encrypt the .ppkg file, project files are not encrypted. You should store the project files in a secure location and delete the project files when they are no longer needed. - -1. Open Windows Configuration Designer (by default, %systemdrive%\\Program Files (x86)\\Windows Kits\\10\\Assessment and Deployment Kit\\Imaging and Configuration Designer\\x86\\ICD.exe). - -1. Choose **Advanced provisioning**. - -1. Name your project, and click **Next**. - -1. Choose **All Windows desktop editions** and click **Next**. - -1. On **New project**, click **Finish**. The workspace for your package opens. - -1. Expand **Runtime settings** > **Policies** > **Start**, and click **StartLayout**. - - > [!TIP] - > If **Start** is not listed, check the type of settings you selected in step 1. You must create the project using settings for **All Windows desktop editions**. - -1. Enter **layout.xml**. This value creates a placeholder in the customizations.xml file that you will replace with the contents of the layout.xml file in a later step. - -1. Save your project and close Windows Configuration Designer. - -1. In File Explorer, open the project's directory. (The default location is C:\Users\\*user name*\Documents\Windows Imaging and Configuration Designer (WICD)\\*project name*) - -1. Open the customizations.xml file in a text editor. - -1. Replace **layout.xml** with the text from the layout.xml file, [with markup characters replaced with escape characters](#escape). - -1. Save and close the customizations.xml file. - -1. Open Windows Configuration Designer and open your project. - -1. On the **File** menu, select **Save.** - -1. On the **Export** menu, select **Provisioning package**. - -1. Change **Owner** to **IT Admin**, which will set the precedence of this provisioning package higher than provisioning packages applied to this device from other sources, and then select **Next.** - -1. Optional. In the **Provisioning package security** window, you can choose to encrypt the package and enable package signing. - - - **Enable package encryption** - If you select this option, an auto-generated password will be shown on the screen. - - - **Enable package signing** - If you select this option, you must select a valid certificate to use for signing the package. You can specify the certificate by clicking **Browse** and choosing the certificate you want to use to sign the package. - -1. Click **Next** to specify the output location where you want the provisioning package to go when it's built. By default, Windows Imaging and Configuration Designer (ICD) uses the project folder as the output location. - - Optionally, you can click **Browse** to change the default output location. - -1. Click **Next**. - -1. Click **Build** to start building the package. The provisioning package doesn't take long to build. The project information is displayed in the build page and the progress bar indicates the build status. - - If you need to cancel the build, click **Cancel**. This cancels the current build process, closes the wizard, and takes you back to the **Customizations Page**. - -1. If your build fails, an error message will show up that includes a link to the project folder. You can scan the logs to determine what caused the error. Once you fix the issue, try building the package again. - - If your build is successful, the name of the provisioning package, output directory, and project directory will be shown. - - - If you choose, you can build the provisioning package again and pick a different path for the output package. To do this, click **Back** to change the output package name and path, and then click **Next** to start another build. - - If you are done, click **Finish** to close the wizard and go back to the **Customizations Page**. - -1. Copy the provisioning package to the target device. -1. Double-click the ppkg file and allow it to install. - -#### [:::image type="icon" source="../images/icons/group-policy.svg"::: **GPO**](#tab/gpo) - -You can use a Group Policy Object (GPO) to deploy a customized Start and taskbar layout to users in a domain. No reimaging is required, and the layout can be updated simply by overwriting the .xml file that contains the layout. This enables you to customize Start and taskbar layouts for different departments or organizations, with minimal management overhead. - -This topic describes how to update Group Policy settings to display a customized Start and taskbar layout when the users sign in. By creating a domain-based GPO with these settings, you can deploy a customized Start and taskbar layout to users in a domain. - ->[!WARNING] ->When a full Start layout is applied with this method, the users cannot pin, unpin, or uninstall apps from Start. Users can view and open all apps in the **All Apps** view, but they cannot pin any apps to Start. When a partial Start layout is applied, the contents of the specified tile groups cannot be changed, but users can move those groups, and can also create and customize their own groups. When you apply a taskbar layout, users will still be able to pin and unpin apps, and change the order of pinned apps. - -**Before you begin**: [Customize and export Start layout](customize-and-export-start-layout.md) - -## Operating system requirements - -The GPO can be configured from any computer on which the necessary ADMX and ADML files (StartMenu.admx and StartMenu.adml) for Windows 10 are installed. In Group Policy, ADMX files are used to define Registry-based policy settings in the Administrative Templates category. To find out how to create a central store for Administrative Templates files, see [article 929841, written for Windows Vista and still applicable](/troubleshoot/windows-server/group-policy/create-central-store-domain-controller) in the Microsoft Knowledge Base. - -Three features enable Start and taskbar layout control: - -- The [Export-StartLayout](/powershell/module/startlayout/export-startlayout) cmdlet in Windows PowerShell exports a description of the current Start layout in .xml file format. - >[!NOTE] - >To import the layout of Start to a mounted Windows image, use the [Import-StartLayout](/powershell/module/startlayout/import-startlayout) cmdlet. -- [You can modify the Start .xml file](../taskbar/configure.md) to include `` or create an .xml file just for the taskbar configuration. -- In Group Policy, you use the **Start Layout** settings for the **Start Menu and Taskbar** administrative template to set a Start and taskbar layout from an .xml file when the policy is applied. The Group Policy object doesn't support an empty tile layout, so the default tile layout for Windows is loaded in that case. - ->[!NOTE] ->To learn how customize Start to include your line-of-business apps when you deploy Windows 10, see [Customize the Windows 10 Start layout]( https://go.microsoft.com/fwlink/p/?LinkId=620863). - -## Use Group Policy to apply a customized Start layout in a domain - -To apply the Start and taskbar layout to users in a domain, use the Group Policy Management Console (GPMC) to configure a domain-based Group Policy Object (GPO) that sets **Start Layout** policy settings in the **Start Menu and Taskbar** administrative template for users in a domain. - -The GPO applies the Start and taskbar layout at the next user sign-in. Each time the user signs in, the timestamp of the .xml file with the Start and taskbar layout is checked and if a newer version of the file is available, the settings in the latest version of the file are applied. - -The GPO can be configured from any computer on which the necessary ADMX and ADML files (StartMenu.admx and StartMenu.adml) for Windows 10 are installed. - -The .xml file with the Start and taskbar layout must be located on shared network storage that is available to the users' computers when they sign in and the users must have Read-only access to the file. If the file is not available when the first user signs in, Start and the taskbar are not customized during the session, but the user will be prevented from making changes to Start. On subsequent sign-ins, if the file is available at sign-in, the layout it contains will be applied to the user's Start and taskbar. - -For information about deploying GPOs in a domain, see [Working with Group Policy Objects](/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/cc731212(v=ws.11)). - -## Use Group Policy to apply a customized Start layout on the local computer - -You can use the Local Group Policy Editor to provide a customized Start and taskbar layout for any user who signs in on the local computer. To display the customized Start and taskbar layout for any user who signs in, configure **Start Layout** policy settings for the **Start Menu and Taskbar** administrative template. You can use the **Start Menu and Taskbar** administrative template in **User Configuration** or **Computer Configuration**. - ->[!NOTE] ->This procedure applies the policy settings on the local computer only. For information about deploying the Start and taskbar layout to users in a domain, see [Use Group Policy to deploy a customized Start layout in a domain](#bkmk-domaingpodeployment). -> ->This procedure creates a Local Group Policy that applies to all users on the computer. To configure Local Group Policy that applies to a specific user or group on the computer, see [Step-by-Step Guide to Managing Multiple Local Group Policy Objects](/previous-versions/windows/it-pro/windows-vista/cc766291(v=ws.10)). The guide was written for Windows Vista and the procedures still apply to Windows 10. - -This procedure adds the customized Start and taskbar layout to the user configuration, which overrides any Start layout settings in the local computer configuration when a user signs in on the computer. - -To configure Start Layout policy settings in Local Group Policy Editor: - -1. On the test computer, press the Windows key, type **gpedit**, and then select **Edit group policy (Control panel)**. -1. Go to **User Configuration** or **Computer Configuration** > **Administrative Templates** >**Start Menu and Taskbar**. - ![start screen layout policy settings.](images/starttemplate.jpg) -1. Right-click **Start Layout** in the right pane, and click **Edit**. - This opens the **Start Layout** policy settings. - ![policy settings for start screen layout.](images/startlayoutpolicy.jpg) -1. Enter the following settings, and then click **OK**: - 1. Select **Enabled**. - 1. Under **Options**, specify the path to the .xml file that contains the Start and taskbar layout. For example, type **C:\\Users\\Test01\\StartScreenMarketing.xml**. - 1. Optionally, enter a comment to identify the Start and taskbar layout. - - > [!IMPORTANT] - > If you disable Start Layout policy settings that have been in effect and then re-enable the policy, users will not be able to make changes to Start, however the layout in the .xml file will not be reapplied unless the file has been updated. In Windows PowerShell, you can update the timestamp on a file by running the following command: - > - > `(ls ).LastWriteTime = Get-Date` - -## Update a customized Start layout - -After you use Group Policy to apply a customized Start and taskbar layout on a computer or in a domain, you can update the layout simply by replacing the .xml file that is specified in the Start Layout policy settings with a file with a newer timestamp. - -::: zone-end diff --git a/windows/configuration/start/images/customization-start-edge.PNG b/windows/configuration/start/images/customization-start-edge.PNG deleted file mode 100644 index 333833d8c0..0000000000 Binary files a/windows/configuration/start/images/customization-start-edge.PNG and /dev/null differ diff --git a/windows/configuration/start/images/customization-start.PNG b/windows/configuration/start/images/customization-start.PNG deleted file mode 100644 index 4942338181..0000000000 Binary files a/windows/configuration/start/images/customization-start.PNG and /dev/null differ diff --git a/windows/configuration/start/images/edge-with-logo.png b/windows/configuration/start/images/edge-with-logo.png deleted file mode 100644 index cc3504a678..0000000000 Binary files a/windows/configuration/start/images/edge-with-logo.png and /dev/null differ diff --git a/windows/configuration/start/images/edge-without-logo.png b/windows/configuration/start/images/edge-without-logo.png deleted file mode 100644 index 52085a2d68..0000000000 Binary files a/windows/configuration/start/images/edge-without-logo.png and /dev/null differ diff --git a/windows/configuration/start/images/endpoint-manager-admin-center-custom-oma-uri-start-layout.png b/windows/configuration/start/images/endpoint-manager-admin-center-custom-oma-uri-start-layout.png deleted file mode 100644 index cd508b3dea..0000000000 Binary files a/windows/configuration/start/images/endpoint-manager-admin-center-custom-oma-uri-start-layout.png and /dev/null differ diff --git a/windows/configuration/start/images/start-pinned-app.png b/windows/configuration/start/images/start-pinned-app.png deleted file mode 100644 index e1e4a24a00..0000000000 Binary files a/windows/configuration/start/images/start-pinned-app.png and /dev/null differ diff --git a/windows/configuration/start/images/start-windows-11.png b/windows/configuration/start/images/start-windows-11.png deleted file mode 100644 index 9cafb224bf..0000000000 Binary files a/windows/configuration/start/images/start-windows-11.png and /dev/null differ diff --git a/windows/configuration/start/images/startannotated.png b/windows/configuration/start/images/startannotated.png deleted file mode 100644 index 9261fd9078..0000000000 Binary files a/windows/configuration/start/images/startannotated.png and /dev/null differ diff --git a/windows/configuration/start/images/startlayoutpolicy.jpg b/windows/configuration/start/images/startlayoutpolicy.jpg deleted file mode 100644 index d3c8d054fe..0000000000 Binary files a/windows/configuration/start/images/startlayoutpolicy.jpg and /dev/null differ diff --git a/windows/configuration/start/images/starttemplate.jpg b/windows/configuration/start/images/starttemplate.jpg deleted file mode 100644 index 900eed08c5..0000000000 Binary files a/windows/configuration/start/images/starttemplate.jpg and /dev/null differ diff --git a/windows/configuration/start/images/taskbar-generic.png b/windows/configuration/start/images/taskbar-generic.png deleted file mode 100644 index 6d47a6795a..0000000000 Binary files a/windows/configuration/start/images/taskbar-generic.png and /dev/null differ diff --git a/windows/configuration/start/images/windows-10-partial-layout.png b/windows/configuration/start/images/windows-10-partial-layout.png new file mode 100644 index 0000000000..4650cc42cf Binary files /dev/null and b/windows/configuration/start/images/windows-10-partial-layout.png differ diff --git a/windows/configuration/start/images/windows-10-secondary-tile.png b/windows/configuration/start/images/windows-10-secondary-tile.png new file mode 100644 index 0000000000..01e25ef3bc Binary files /dev/null and b/windows/configuration/start/images/windows-10-secondary-tile.png differ diff --git a/windows/configuration/start/images/windows-10-settings.png b/windows/configuration/start/images/windows-10-settings.png new file mode 100644 index 0000000000..496c2a62c2 Binary files /dev/null and b/windows/configuration/start/images/windows-10-settings.png differ diff --git a/windows/configuration/start/images/windows-10.png b/windows/configuration/start/images/windows-10.png new file mode 100644 index 0000000000..98db149a77 Binary files /dev/null and b/windows/configuration/start/images/windows-10.png differ diff --git a/windows/configuration/start/images/windows-11-secondary-tile.png b/windows/configuration/start/images/windows-11-secondary-tile.png new file mode 100644 index 0000000000..7e7600dcc3 Binary files /dev/null and b/windows/configuration/start/images/windows-11-secondary-tile.png differ diff --git a/windows/configuration/start/images/windows-11-settings.png b/windows/configuration/start/images/windows-11-settings.png new file mode 100644 index 0000000000..18150b3ff8 Binary files /dev/null and b/windows/configuration/start/images/windows-11-settings.png differ diff --git a/windows/configuration/start/images/windows-11.png b/windows/configuration/start/images/windows-11.png new file mode 100644 index 0000000000..32925b625e Binary files /dev/null and b/windows/configuration/start/images/windows-11.png differ diff --git a/windows/configuration/start/includes/allow-pinned-folder-documents.md b/windows/configuration/start/includes/allow-pinned-folder-documents.md new file mode 100644 index 0000000000..85de1af61c --- /dev/null +++ b/windows/configuration/start/includes/allow-pinned-folder-documents.md @@ -0,0 +1,18 @@ +--- +author: paolomatarazzo +ms.author: paoloma +ms.date: 04/10/2024 +ms.topic: include +--- + +### Allow pinned folder Documents + +This policy controls the visibility of the Documents shortcut on the *Pinned folder* section of the Start menu: + +- When enabled, the Documents shortcut is displayed in the Pinned folder section of the Start menu +- When disabled, the Documents shortcut is not displayed in the Pinned folder section of the Start menu + +| | Path | +|--|--| +| **CSP** | `./Device/Vendor/MSFT/Policy/Config/Start/`[AllowPinnedFolderDocuments](/windows/client-management/mdm/policy-csp-start#allowpinnedfolderdocuments) | +| **GPO** | Not available. | diff --git a/windows/configuration/start/includes/allow-pinned-folder-downloads.md b/windows/configuration/start/includes/allow-pinned-folder-downloads.md new file mode 100644 index 0000000000..b10fa9128e --- /dev/null +++ b/windows/configuration/start/includes/allow-pinned-folder-downloads.md @@ -0,0 +1,18 @@ +--- +author: paolomatarazzo +ms.author: paoloma +ms.date: 04/10/2024 +ms.topic: include +--- + +### Allow pinned folder Downloads + +This policy controls the visibility of the Downloads shortcut on the *Pinned folder* section of the Start menu: + +- When enabled, the Downloads shortcut is displayed in the Pinned folder section of the Start menu +- When disabled, the Downloads shortcut is not displayed in the Pinned folder section of the Start menu + +| | Path | +|--|--| +| **CSP** | `./Device/Vendor/MSFT/Policy/Config/Start/`[AllowPinnedFolderDownloads](/windows/client-management/mdm/policy-csp-start#allowpinnedfolderdownloads) | +| **GPO** | Not available. | diff --git a/windows/configuration/start/includes/allow-pinned-folder-file-explorer.md b/windows/configuration/start/includes/allow-pinned-folder-file-explorer.md new file mode 100644 index 0000000000..2c0fb926a3 --- /dev/null +++ b/windows/configuration/start/includes/allow-pinned-folder-file-explorer.md @@ -0,0 +1,18 @@ +--- +author: paolomatarazzo +ms.author: paoloma +ms.date: 04/10/2024 +ms.topic: include +--- + +### Allow pinned folder File Explorer + +This policy controls the visibility of the File Explorer shortcut on the *Pinned folder* section of the Start menu: + +- When enabled, the File Explorer shortcut is displayed in the Pinned folder section of the Start menu +- When disabled, the File Explorer shortcut is not displayed in the Pinned folder section of the Start menu + +| | Path | +|--|--| +| **CSP** | `./Device/Vendor/MSFT/Policy/Config/Start/`[AllowPinnedFolderFileExplorer](/windows/client-management/mdm/policy-csp-start#allowpinnedfolderfileexplorer) | +| **GPO** | Not available. | diff --git a/windows/configuration/start/includes/allow-pinned-folder-home-group.md b/windows/configuration/start/includes/allow-pinned-folder-home-group.md new file mode 100644 index 0000000000..933eb328aa --- /dev/null +++ b/windows/configuration/start/includes/allow-pinned-folder-home-group.md @@ -0,0 +1,18 @@ +--- +author: paolomatarazzo +ms.author: paoloma +ms.date: 04/10/2024 +ms.topic: include +--- + +### Allow pinned folder Home Group + +This policy controls the visibility of the Home Group shortcut on the *Pinned folder* section of the Start menu: + +- When enabled, the Home Group shortcut is displayed in the Pinned folder section of the Start menu +- When disabled, the Home Group shortcut is not displayed in the Pinned folder section of the Start menu + +| | Path | +|--|--| +| **CSP** | `./Device/Vendor/MSFT/Policy/Config/Start/`[AllowPinnedFolderHomeGroup](/windows/client-management/mdm/policy-csp-start#allowpinnedfolderhomegroup) | +| **GPO** | Not available. | diff --git a/windows/configuration/start/includes/allow-pinned-folder-music.md b/windows/configuration/start/includes/allow-pinned-folder-music.md new file mode 100644 index 0000000000..b70d8557ba --- /dev/null +++ b/windows/configuration/start/includes/allow-pinned-folder-music.md @@ -0,0 +1,18 @@ +--- +author: paolomatarazzo +ms.author: paoloma +ms.date: 04/10/2024 +ms.topic: include +--- + +### Allow pinned folder Music + +This policy controls the visibility of the Music shortcut on the *Pinned folder* section of the Start menu: + +- When enabled, the Music shortcut is displayed in the Pinned folder section of the Start menu +- When disabled, the Music shortcut is not displayed in the Pinned folder section of the Start menu + +| | Path | +|--|--| +| **CSP** | `./Device/Vendor/MSFT/Policy/Config/Start/`[AllowPinnedFolderMusic](/windows/client-management/mdm/policy-csp-start#allowpinnedfoldermusic) | +| **GPO** | Not available. | diff --git a/windows/configuration/start/includes/allow-pinned-folder-network.md b/windows/configuration/start/includes/allow-pinned-folder-network.md new file mode 100644 index 0000000000..b9e3defc32 --- /dev/null +++ b/windows/configuration/start/includes/allow-pinned-folder-network.md @@ -0,0 +1,18 @@ +--- +author: paolomatarazzo +ms.author: paoloma +ms.date: 04/10/2024 +ms.topic: include +--- + +### Allow pinned folder Network + +This policy controls the visibility of the Network shortcut on the *Pinned folder* section of the Start menu: + +- When enabled, the Network shortcut is displayed in the Pinned folder section of the Start menu +- When disabled, the Network shortcut is not displayed in the Pinned folder section of the Start menu + +| | Path | +|--|--| +| **CSP** | `./Device/Vendor/MSFT/Policy/Config/Start/`[AllowPinnedFolderNetword](/windows/client-management/mdm/policy-csp-start#allowpinnedfoldernetwork) | +| **GPO** | Not available. | diff --git a/windows/configuration/start/includes/allow-pinned-folder-personal-folder.md b/windows/configuration/start/includes/allow-pinned-folder-personal-folder.md new file mode 100644 index 0000000000..c80c7e6a09 --- /dev/null +++ b/windows/configuration/start/includes/allow-pinned-folder-personal-folder.md @@ -0,0 +1,18 @@ +--- +author: paolomatarazzo +ms.author: paoloma +ms.date: 04/10/2024 +ms.topic: include +--- + +### Allow pinned folder Personal Folder + +This policy controls the visibility of the Personal Folder shortcut on the *Pinned folder* section of the Start menu: + +- When enabled, the Personal Folder shortcut is displayed in the Pinned folder section of the Start menu +- When disabled, the Personal Folder shortcut is not displayed in the Pinned folder section of the Start menu + +| | Path | +|--|--| +| **CSP** | `./Device/Vendor/MSFT/Policy/Config/Start/`[AllowPinnedFolderPersonalFolder](/windows/client-management/mdm/policy-csp-start#allowpinnedfolderpersonalfolder) | +| **GPO** | Not available. | diff --git a/windows/configuration/start/includes/allow-pinned-folder-pictures.md b/windows/configuration/start/includes/allow-pinned-folder-pictures.md new file mode 100644 index 0000000000..07c10b8014 --- /dev/null +++ b/windows/configuration/start/includes/allow-pinned-folder-pictures.md @@ -0,0 +1,18 @@ +--- +author: paolomatarazzo +ms.author: paoloma +ms.date: 04/10/2024 +ms.topic: include +--- + +### Allow pinned folder Pictures + +This policy controls the visibility of the Pictures shortcut on the *Pinned folder* section of the Start menu: + +- When enabled, the Pictures shortcut is displayed in the Pinned folder section of the Start menu +- When disabled, the Pictures shortcut is not displayed in the Pinned folder section of the Start menu + +| | Path | +|--|--| +| **CSP** | `./Device/Vendor/MSFT/Policy/Config/Start/`[AllowPinnedFolderPictures](/windows/client-management/mdm/policy-csp-start#allowpinnedfolderpictures) | +| **GPO** | Not available. | diff --git a/windows/configuration/start/includes/allow-pinned-folder-settings.md b/windows/configuration/start/includes/allow-pinned-folder-settings.md new file mode 100644 index 0000000000..0cf19f323f --- /dev/null +++ b/windows/configuration/start/includes/allow-pinned-folder-settings.md @@ -0,0 +1,18 @@ +--- +author: paolomatarazzo +ms.author: paoloma +ms.date: 04/10/2024 +ms.topic: include +--- + +### Allow pinned folder Settings + +This policy controls the visibility of the Settings shortcut on the *Pinned folder* section of the Start menu: + +- When enabled, the Settings shortcut is displayed in the Pinned folder section of the Start menu +- When disabled, the Settings shortcut is not displayed in the Pinned folder section of the Start menu + +| | Path | +|--|--| +| **CSP** | `./Device/Vendor/MSFT/Policy/Config/Start/`[AllowPinnedFolderSettings](/windows/client-management/mdm/policy-csp-start#allowpinnedfoldersettings) | +| **GPO** | Not available. | diff --git a/windows/configuration/start/includes/allow-pinned-folder-videos.md b/windows/configuration/start/includes/allow-pinned-folder-videos.md new file mode 100644 index 0000000000..0d8ccdca7c --- /dev/null +++ b/windows/configuration/start/includes/allow-pinned-folder-videos.md @@ -0,0 +1,18 @@ +--- +author: paolomatarazzo +ms.author: paoloma +ms.date: 04/10/2024 +ms.topic: include +--- + +### Allow pinned folder Videos + +This policy controls the visibility of the Videos shortcut on the *Pinned folder* section of the Start menu: + +- When enabled, the Videos shortcut is displayed in the Pinned folder section of the Start menu +- When disabled, the Videos shortcut is not displayed in the Pinned folder section of the Start menu + +| | Path | +|--|--| +| **CSP** | `./Device/Vendor/MSFT/Policy/Config/Start/`[AllowPinnedFolderVideos](/windows/client-management/mdm/policy-csp-start#allowpinnedfoldervideos) | +| **GPO** | Not available. | diff --git a/windows/configuration/start/includes/clear-history-of-recently-opened-documents-on-exit.md b/windows/configuration/start/includes/clear-history-of-recently-opened-documents-on-exit.md new file mode 100644 index 0000000000..a81f028057 --- /dev/null +++ b/windows/configuration/start/includes/clear-history-of-recently-opened-documents-on-exit.md @@ -0,0 +1,23 @@ +--- +author: paolomatarazzo +ms.author: paoloma +ms.date: 04/10/2024 +ms.topic: include +--- + +### Clear history of recently opened documents on exit + +If you enable this policy setting, shortcuts to recently used files are deleted when the user signs out: + +- The **Recent Items** section on the Start menu is cleared +- Recently and frequently used items in the jump lists of programs in the Start menu and Taskbar are cleared + +If you disable or don't configure this policy setting, the system retains document shortcuts. When a user signs in, the **Recent Items** menu and the jump lists appear as when the user logged off. + +> [!NOTE] +> The system saves document shortcuts in the user profile in the System-drive\Users\User-name\Recent folder. + +| | Path | +|--|--| +| **CSP** | Not available. | +| **GPO** | **User Configuration** > **Administrative Templates** > **Start Menu and Taskbar** > **Clear history of recently opened documents on exit** | diff --git a/windows/configuration/start/includes/clear-the-recent-programs-list-for-new-users.md b/windows/configuration/start/includes/clear-the-recent-programs-list-for-new-users.md new file mode 100644 index 0000000000..cb6caaaf10 --- /dev/null +++ b/windows/configuration/start/includes/clear-the-recent-programs-list-for-new-users.md @@ -0,0 +1,15 @@ +--- +author: paolomatarazzo +ms.author: paoloma +ms.date: 04/10/2024 +ms.topic: include +--- + +### Clear the recent programs list for new users + +If you enable this policy setting, the recent programs list in the start menu is empty for each new user. If you disable or don't configure this policy setting, the start menu *recent programs list* is prepopulated with programs for each new user. + +| | Path | +|--|--| +| **CSP** | Not available. | +| **GPO** | **User Configuration** > **Administrative Templates** > **Start Menu and Taskbar** > **Clear the recent programs list for new users** | diff --git a/windows/configuration/start/includes/clear-tile-notifications-during-log-on.md b/windows/configuration/start/includes/clear-tile-notifications-during-log-on.md new file mode 100644 index 0000000000..59c2b07132 --- /dev/null +++ b/windows/configuration/start/includes/clear-tile-notifications-during-log-on.md @@ -0,0 +1,15 @@ +--- +author: paolomatarazzo +ms.author: paoloma +ms.date: 04/10/2024 +ms.topic: include +--- + +### Clear tile notifications during log on + +If you enable this policy setting, the system deletes tile notifications when the user signs on. As a result, the tiles in the Start menu always show their default content when a user signs in. Any cached versions of the notifications are cleared when the user signs in. If you disable or don't configure this setting, the system retains notifications, and when a user signs in, the tiles appear just as they did when the user signed out, including the history of previous notifications for each tile. This policy setting doesn't prevent new notifications from appearing. + +| | Path | +|--|--| +| **CSP** | ./Device/Vendor/MSFT/[Setting]() | +| **GPO** | **User Configuration** > **Administrative Templates** > **Start Menu and Taskbar** | diff --git a/windows/configuration/start/includes/configure-start-layout.md b/windows/configuration/start/includes/configure-start-layout.md new file mode 100644 index 0000000000..fca0c5315d --- /dev/null +++ b/windows/configuration/start/includes/configure-start-layout.md @@ -0,0 +1,17 @@ +--- +author: paolomatarazzo +ms.author: paoloma +ms.date: 04/10/2024 +ms.topic: include +--- + +### Configure Start layout + +This policy setting lets you specify the Start layout for users, preventing them from changing its configuration. The Start layout you specify must be stored in an XML file that was generated by the `Export-StartLayout` PowerShell cmdlet. To use this setting, you must first manually configure a device's Start layout to the desired look and feel. Then, run the `Export-StartLayout` PowerShell cmdlet on that same device. The cmdlet generates an XML file representing the layout you configured. Once the XML file is generated and moved to the desired file path, use the fully qualified path and name of the XML file. You can use a local path, or a UNC path. If the specified file isn't available when the user signs in, the layout isn't changed. Users can't customize the Start layout while this setting is enabled. If you disable this setting or don't configure it, the Start screen layout isn't changed and users can customize it. + +| | Path | +|--|--| +| **CSP** | [Configure start layout](/windows/client-management/mdm/policy-csp-start#startlayout) | +| **GPO** | **Computer Configuration** > **Administrative Templates** > **Start Menu and Taskbar**

**User Configuration** > **Administrative Templates** > **Start Menu and Taskbar** | + +For more information, see [Customize the Start layout](../layout.md). diff --git a/windows/configuration/start/includes/configure-start-pins.md b/windows/configuration/start/includes/configure-start-pins.md new file mode 100644 index 0000000000..9f24b17c31 --- /dev/null +++ b/windows/configuration/start/includes/configure-start-pins.md @@ -0,0 +1,19 @@ +--- +author: paolomatarazzo +ms.author: paoloma +ms.date: 10/30/2023 +ms.topic: include +--- + +### Configure Start pins + +This policy setting lets you specify a new list of pinned apps to override the default/current list of pinned apps in the Windows Start menu. + +The policy setting accepts a JSON file that contains the list of items to pin, and their order. + +| | Path | +|--|--| +| **CSP** | `./Device/Vendor/MSFT/Policy/Config/Start/`[ConfigureStartPins](/windows/client-management/mdm/policy-csp-start#configurestartpins)

`./User/Vendor/MSFT/Policy/Config/Start/`[ConfigureStartPins](/windows/client-management/mdm/policy-csp-start#configurestartpins)| +| **GPO** | Not available | + +For more information, see [Customize the Start layout](../layout.md). diff --git a/windows/configuration/start/includes/disable-context-menus.md b/windows/configuration/start/includes/disable-context-menus.md new file mode 100644 index 0000000000..e502478b6f --- /dev/null +++ b/windows/configuration/start/includes/disable-context-menus.md @@ -0,0 +1,15 @@ +--- +author: paolomatarazzo +ms.author: paoloma +ms.date: 04/10/2024 +ms.topic: include +--- + +### Disable context menus + +With this policy setting you can prevent users from opening the context menus in the Start menu. If you enable this policy, then invocations of context menus within the Start menu is ignored. + +| | Path | +|--|--| +| **CSP** | `./Device/Vendor/MSFT/Policy/Config/Start/`[DisableContextMenus](/windows/client-management/mdm/policy-csp-start#disablecontextmenus)

`./User/Vendor/MSFT/Policy/Config/Start/`[DisableContextMenus](/windows/client-management/mdm/policy-csp-start#disablecontextmenus)| +| **GPO** | **Computer Configuration** > **Administrative Templates** > **Start Menu and Taskbar**

**User Configuration** > **Administrative Templates** > **Start Menu and Taskbar** > **Disable context menus in the Start Menu** | diff --git a/windows/configuration/start/includes/disable-search.md b/windows/configuration/start/includes/disable-search.md new file mode 100644 index 0000000000..5de3b6fa11 --- /dev/null +++ b/windows/configuration/start/includes/disable-search.md @@ -0,0 +1,16 @@ +--- +author: paolomatarazzo +ms.author: paoloma +ms.date: 04/10/2024 +ms.topic: include +--- + +### Disable search + +When you enable this policy setting, the Search UI and all its entry points are disabled, such as keyboard shortcuts, touchpad gestures, and type-to-search in the Start menu. The Start menu's search box and Search Taskbar buttons are hidden. If you disable or don't configure this policy setting, users can open the Search UI and its different entry points are available. + + +| | Path | +|--|--| +| **CSP** | `./Device/Vendor/MSFT/Policy/Config/Search/`[DisableSearch](/windows/client-management/mdm/policy-csp-search#disablesearch)| +| **GPO** | **Computer Configuration** > **Windows Components** > **Search** > **Fully disable Search UI** | diff --git a/windows/configuration/start/includes/do-not-use-the-search-based-method-when-resolving-shell-shortcuts.md b/windows/configuration/start/includes/do-not-use-the-search-based-method-when-resolving-shell-shortcuts.md new file mode 100644 index 0000000000..55a74cc190 --- /dev/null +++ b/windows/configuration/start/includes/do-not-use-the-search-based-method-when-resolving-shell-shortcuts.md @@ -0,0 +1,15 @@ +--- +author: paolomatarazzo +ms.author: paoloma +ms.date: 04/10/2024 +ms.topic: include +--- + +### Don't use the search-based method when resolving shell shortcuts + +This policy setting prevents the system from conducting a comprehensive search of the target drive to resolve a shortcut. If you enable this policy setting, the system doesn't conduct the final drive search. It just displays a message explaining that the file isn't found. If you disable or don't configure this policy setting, by default, when the system can't find the target file for a shortcut (.lnk), it searches all paths associated with the shortcut. If the target file is located on an NTFS partition, the system then uses the target's file ID to find a path. If the resulting path isn't correct, it conducts a comprehensive search of the target drive in an attempt to find the file. Note: This policy setting only applies to target files on NTFS partitions. FAT partitions don't have this ID tracking and search capability. + +| | Path | +|--|--| +| **CSP** | ./Device/Vendor/MSFT/[Setting]() | +| **GPO** | **User Configuration** > **Administrative Templates** > **Start Menu and Taskbar** > **Do not use the search-based method when resolving shell shortcuts** | diff --git a/windows/configuration/start/includes/do-not-use-the-tracking-based-method-when-resolving-shell-shortcuts.md b/windows/configuration/start/includes/do-not-use-the-tracking-based-method-when-resolving-shell-shortcuts.md new file mode 100644 index 0000000000..a877effc15 --- /dev/null +++ b/windows/configuration/start/includes/do-not-use-the-tracking-based-method-when-resolving-shell-shortcuts.md @@ -0,0 +1,15 @@ +--- +author: paolomatarazzo +ms.author: paoloma +ms.date: 04/10/2024 +ms.topic: include +--- + +### Don't use the tracking-based method when resolving shell shortcuts + +This policy setting prevents the system from using NTFS tracking features to resolve a shortcut. If you enable this policy setting, the system doesn't try to locate the file by using its file ID. It skips this step and begins a comprehensive search of the drive specified in the target path. If you disable or don't configure this policy setting, by default, when the system can't find the target file for a shortcut (.lnk), it searches all paths associated with the shortcut. If the target file is located on an NTFS partition, the system then uses the target's file ID to find a path. If the resulting path isn't correct, it conducts a comprehensive search of the target drive in an attempt to find the file. Note: This policy setting only applies to target files on NTFS partitions. FAT partitions don't have this ID tracking and search capability. + +| | Path | +|--|--| +| **CSP** | ./Device/Vendor/MSFT/[Setting]() | +| **GPO** | **User Configuration** > **Administrative Templates** > **Start Menu and Taskbar** > **Do not use the tracking-based method when resolving shell shortcuts** | diff --git a/windows/configuration/start/includes/example-assets.md b/windows/configuration/start/includes/example-assets.md new file mode 100644 index 0000000000..1a9db2bdb8 --- /dev/null +++ b/windows/configuration/start/includes/example-assets.md @@ -0,0 +1,21 @@ +--- +author: paolomatarazzo +ms.author: paoloma +ms.date: 03/13/2024 +ms.topic: include +--- + +Example of the output of the PowerShell cmdlet `Export-StartLayoutEdgeAssets`: + +```xml + + + + Base64 encoded value of the logo + + + + Base64 encoded value of the logo + + +``` \ No newline at end of file diff --git a/windows/configuration/start/includes/example-secondary-tiles.md b/windows/configuration/start/includes/example-secondary-tiles.md new file mode 100644 index 0000000000..1f1a7197b5 --- /dev/null +++ b/windows/configuration/start/includes/example-secondary-tiles.md @@ -0,0 +1,24 @@ +--- +author: paolomatarazzo +ms.author: paoloma +ms.date: 03/13/2024 +ms.topic: include +--- + +Example of secondary tiles in XML generated by the PowerShell cmdlet `Export-StartLayout`: + +```xml + +``` diff --git a/windows/configuration/start/includes/example-start-layout.md b/windows/configuration/start/includes/example-start-layout.md new file mode 100644 index 0000000000..94957b8fa9 --- /dev/null +++ b/windows/configuration/start/includes/example-start-layout.md @@ -0,0 +1,57 @@ +--- +author: paolomatarazzo +ms.author: paoloma +ms.date: 03/13/2024 +ms.topic: include +--- + +::: zone pivot="windows-10" + +```xml + + + + + + + + + + + + + + + + + + + + + + +``` + +::: zone-end + +::: zone pivot="windows-11" + +```json +{ + "pinnedList": [ + {"desktopAppLink": "%ALLUSERSPROFILE%\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Edge.lnk" }, + { "packagedAppId": "windows.immersivecontrolpanel_cw5n1h2txyewy!microsoft.windows.immersivecontrolpanel" }, + { "desktopAppLink": "%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\File Explorer.lnk" }, + { "desktopAppLink": "%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell.lnk" }, + { "packagedAppId": "Microsoft.WindowsTerminal_8wekyb3d8bbwe!App" }, + { "packagedAppId": "Microsoft.Paint_8wekyb3d8bbwe!App" }, + { "packagedAppId": "Microsoft.Windows.Photos_8wekyb3d8bbwe!App" }, + { "packagedAppId": "MicrosoftCorporationII.QuickAssist_8wekyb3d8bbwe!App" }, + { "packagedAppId": "Microsoft.MicrosoftStickyNotes_8wekyb3d8bbwe!App" }, + { "packagedAppId": "Microsoft.SecHealthUI_8wekyb3d8bbwe!SecHealthUI" }, + { "packagedAppId": "Microsoft.OutlookForWindows_8wekyb3d8bbwe!Microsoft.OutlookforWindows"} + ] +} +``` + +::: zone-end diff --git a/windows/configuration/start/includes/force-start-size.md b/windows/configuration/start/includes/force-start-size.md new file mode 100644 index 0000000000..2f1dda1496 --- /dev/null +++ b/windows/configuration/start/includes/force-start-size.md @@ -0,0 +1,15 @@ +--- +author: paolomatarazzo +ms.author: paoloma +ms.date: 04/10/2024 +ms.topic: include +--- + +### Force Start size + +If you enable this policy and set it to Start menu or full screen Start, Start is set to that size and users can't change the size of Start in Settings. If you disable or don't configure this policy setting, Windows automatically selects the size based on hardware form factor and users can change the size of Start in Settings. + +| | Path | +|--|--| +| **CSP** | `./User/Vendor/MSFT/Policy/Config/Start/`[ForceStartSize](/windows/client-management/mdm/policy-csp-start#forcestartsize)

`./Device/Vendor/MSFT/Policy/Config/Start/`[ForceStartSize](/windows/client-management/mdm/policy-csp-start#forcestartsize) | +| **GPO** | **Computer Configuration** > **Administrative Templates** > **Start Menu and Taskbar**

**User Configuration** > **Administrative Templates** > **Start Menu and Taskbar** > **Force Start to be either full screen size or menu size** | diff --git a/windows/configuration/start/includes/hide-app-list.md b/windows/configuration/start/includes/hide-app-list.md new file mode 100644 index 0000000000..6185e19f8f --- /dev/null +++ b/windows/configuration/start/includes/hide-app-list.md @@ -0,0 +1,20 @@ +--- +author: paolomatarazzo +ms.author: paoloma +ms.date: 04/10/2024 +ms.topic: include +--- + +### Hide app list + +If you enable this setting, the Start Menu will either collapse or remove the all apps list from the Start menu: + +- **Collapse** doesn't display the app list next to the pinned tiles in Start. An **All apps** button is displayed on Start to open the all apps list. This is equivalent to setting the **Show app list in Start** in Settings to **Off** +- **Collapse and disable setting** is the same as the collapse option and disable the **Show app list in Start menu** in Settings, so users can't turn it to On +- **Remove and disable setting** removes the all apps list from Start and disable the **Show app list in Start menu** in Settings, so users can't turn it to On +- If you disable or don't configure this setting, the all apps list is visible by default, and the user can change **Show app list in Start** in Settings + +| | Path | +|--|--| +| **CSP** | `./Device/Vendor/MSFT/Policy/Config/Start/`[HideAppList](/windows/client-management/mdm/policy-csp-start#hideapplist)

`./User/Vendor/MSFT/Policy/Config/Start/`[HideAppList](/windows/client-management/mdm/policy-csp-start#hideapplist) | +| **GPO** | **Computer Configuration** > **Administrative Templates** > **Start Menu and Taskbar** > **Remove All Programs list from the Start menu**

**User Configuration** > **Administrative Templates** > **Start Menu and Taskbar** > **Remove All Programs list from the Start menu** | diff --git a/windows/configuration/start/includes/hide-change-account-settings.md b/windows/configuration/start/includes/hide-change-account-settings.md new file mode 100644 index 0000000000..4e0e563b3e --- /dev/null +++ b/windows/configuration/start/includes/hide-change-account-settings.md @@ -0,0 +1,13 @@ +--- +author: paolomatarazzo +ms.author: paoloma +ms.date: 10/30/2023 +ms.topic: include +--- + +### Hide change account settings + +| | Path | +|--|--| +| **CSP** | `./Device/Vendor/MSFT/Policy/Config/Start/`[HideChangeAccountSettings](/windows/client-management/mdm/policy-csp-start#hidechangeaccountsettings)| +| **GPO** | Not available. | diff --git a/windows/configuration/start/includes/hide-frequently-used-apps.md b/windows/configuration/start/includes/hide-frequently-used-apps.md new file mode 100644 index 0000000000..65ff38d497 --- /dev/null +++ b/windows/configuration/start/includes/hide-frequently-used-apps.md @@ -0,0 +1,17 @@ +--- +author: paolomatarazzo +ms.author: paoloma +ms.date: 04/10/2024 +ms.topic: include +--- + +### Hide frequently used apps + +If you enable this setting, the frequently used programs list is removed from the Start menu. + +If you disable this setting or don't configure it, the frequently used programs list remains on the simple Start menu. + +| | Path | +|--|--| +| **CSP** | `./Device/Vendor/MSFT/Policy/Config/Start/`[HideFrequentlyUsedApps](/windows/client-management/mdm/policy-csp-start#hidefrequentlyusedapps)

`./User/Vendor/MSFT/Policy/Config/Start/`[HideFrequentlyUsedApps](/windows/client-management/mdm/policy-csp-start#hidefrequentlyusedapps) | +| **GPO** | **User Configuration** > **Administrative Templates** > **Start Menu and Taskbar** > **Remove frequent programs from the Start Menu** | diff --git a/windows/configuration/start/includes/hide-hibernate.md b/windows/configuration/start/includes/hide-hibernate.md new file mode 100644 index 0000000000..e7b39cbb1d --- /dev/null +++ b/windows/configuration/start/includes/hide-hibernate.md @@ -0,0 +1,13 @@ +--- +author: paolomatarazzo +ms.author: paoloma +ms.date: 04/10/2024 +ms.topic: include +--- + +### Hide Hibernate + +| | Path | +|--|--| +| **CSP** | `./Device/Vendor/MSFT/Policy/Config/Start/`[HideHibernate](/windows/client-management/mdm/policy-csp-start#hidehibernate) | +| **GPO** | Not available. | diff --git a/windows/configuration/start/includes/hide-lock.md b/windows/configuration/start/includes/hide-lock.md new file mode 100644 index 0000000000..e43dff0cfa --- /dev/null +++ b/windows/configuration/start/includes/hide-lock.md @@ -0,0 +1,13 @@ +--- +author: paolomatarazzo +ms.author: paoloma +ms.date: 04/10/2024 +ms.topic: include +--- + +### Hide Lock + +| | Path | +|--|--| +| **CSP** | `./Device/Vendor/MSFT/Policy/Config/Start/`[HideSignOut](/windows/client-management/mdm/policy-csp-start#hidelock) | +| **GPO** | Not available. | diff --git a/windows/configuration/start/includes/hide-most-used-lists.md b/windows/configuration/start/includes/hide-most-used-lists.md new file mode 100644 index 0000000000..e6f6eb2231 --- /dev/null +++ b/windows/configuration/start/includes/hide-most-used-lists.md @@ -0,0 +1,23 @@ +--- +author: paolomatarazzo +ms.author: paoloma +ms.date: 04/10/2024 +ms.topic: include +--- + +### Hide most used lists + +If you enable this policy setting, you can configure Start menu to show or hide the list of user's most used apps, regardless of user settings: + +- Selecting **Show** forces the *Most used* list in the Start menu, and users can't change to hide it using the Settings app +- Selecting **Hide** disables the *Most used* list, and users can't change to show it using the Settings app +- Selecting **Not Configured**, allow users to turn on or off the display of **Most used** list using the Settings app. This is default behavior. + +> [!NOTE] +> +> This policy setting has the precedence over the *Hide frequently used apps* policy setting. + +| | Path | +|--|--| +| **CSP** | `./Device/Vendor/MSFT/Policy/Config/Start/`[ShowOrHideMostUsedApps](/windows/client-management/mdm/policy-csp-start#showorhidemostusedapps)

`./User/Vendor/MSFT/Policy/Config/Start/`[ShowOrHideMostUsedApps](/windows/client-management/mdm/policy-csp-start#showorhidemostusedapps)| +| **GPO** | **Computer Configuration** > **Administrative Templates** > **Start Menu and Taskbar** > **Show or hide "Most used" list from Start menu**

**User Configuration** > **Administrative Templates** > **Start Menu and Taskbar** > **Show or hide "Most used" list from Start menu** | diff --git a/windows/configuration/start/includes/hide-power-button.md b/windows/configuration/start/includes/hide-power-button.md new file mode 100644 index 0000000000..2c5fb58ca9 --- /dev/null +++ b/windows/configuration/start/includes/hide-power-button.md @@ -0,0 +1,17 @@ +--- +author: paolomatarazzo +ms.author: paoloma +ms.date: 04/10/2024 +ms.topic: include +--- + +### Hide Power button + +| | Path | +|--|--| +| **CSP** | `./Device/Vendor/MSFT/Policy/Config/Start/`[HidePowerButton](/windows/client-management/mdm/policy-csp-start#hidepowerbutton) | +| **GPO** | Not available. | + +hiderestart +hideshutdown +hidesleep \ No newline at end of file diff --git a/windows/configuration/start/includes/hide-recent-jumplists.md b/windows/configuration/start/includes/hide-recent-jumplists.md new file mode 100644 index 0000000000..6e9a6b15ac --- /dev/null +++ b/windows/configuration/start/includes/hide-recent-jumplists.md @@ -0,0 +1,25 @@ +--- +author: paolomatarazzo +ms.author: paoloma +ms.date: 04/10/2024 +ms.topic: include +--- + +### Hide recent jumplists + +Prevents the operating system and installed programs from creating and displaying shortcuts to recently opened documents. + +- If you enable this setting: + - The system and apps don't create shortcuts to documents opened + - The system empties the Recent Items menu on the Start menu, and apps don't display shortcuts at the bottom of the File menu + - The Jump Lists in the Start Menu and Taskbar don't show lists of recently or frequently used files, folders, or websites +If you disable or don't configure this setting + - The system stores and displays shortcuts to recently and frequently used files, folders, and websites + +If you enable this setting but don't enable the "Remove Recent Items menu from Start Menu" setting, the Recent Items menu appears on the Start menu, but it's empty. If you enable this setting, but then later disable it or set it to *Not Configured*, the document shortcuts saved before the setting was enabled reappear in the Recent Items menu and program File menus, and Jump Lists. This setting doesn't hide or prevent the user from pinning files, folders, or websites to the Jump Lists. This setting doesn't hide document shortcuts displayed in the Open dialog box. + +| | Path | +|--|--| +| **CSP** | `./Device/Vendor/MSFT/Policy/Config/Start/`[HideRecentJumplists](/windows/client-management/mdm/policy-csp-start#hiderecentjumplists)

`./User/Vendor/MSFT/Policy/Config/Start/`[HideRecentJumplists](/windows/client-management/mdm/policy-csp-start#hiderecentjumplists) | +| **GPO** | **Computer Configuration** > **Administrative Templates** > **Start Menu and Taskbar** > **Do not keep history of recently opened documents**

**User Configuration** > **Administrative Templates** > **Start Menu and Taskbar** > **Do not keep history of recently opened documents**| + diff --git a/windows/configuration/start/includes/hide-recently-added-apps.md b/windows/configuration/start/includes/hide-recently-added-apps.md new file mode 100644 index 0000000000..43c642e888 --- /dev/null +++ b/windows/configuration/start/includes/hide-recently-added-apps.md @@ -0,0 +1,17 @@ +--- +author: paolomatarazzo +ms.author: paoloma +ms.date: 04/10/2024 +ms.topic: include +--- + +### Hide recently added apps + +With this policy setting, you can prevent the Start menu from displaying a list of recently installed applications. + +If you enable this policy, the Start menu doesn't display the **Recently added** list. The corresponding setting is also disabled in Settings. + +| | Path | +|--|--| +| **CSP** | `./Device/Vendor/MSFT/Policy/Config/Start/`[HideRecentlyAddedApps](/windows/client-management/mdm/policy-csp-start#hiderecentlyaddedapps)

`./User/Vendor/MSFT/Policy/Config/Start/`[HideRecentlyAddedApps](/windows/client-management/mdm/policy-csp-start#hiderecentlyaddedapps) | +| **GPO** | **Computer Configuration** > **Administrative Templates** > **Start Menu and Taskbar**

**User Configuration** > **Administrative Templates** > **Start Menu and Taskbar** > **Remove "Recently added" list from Start Menu** | diff --git a/windows/configuration/start/includes/hide-recommended-personalized-sites.md b/windows/configuration/start/includes/hide-recommended-personalized-sites.md new file mode 100644 index 0000000000..899e17d18a --- /dev/null +++ b/windows/configuration/start/includes/hide-recommended-personalized-sites.md @@ -0,0 +1,15 @@ +--- +author: paolomatarazzo +ms.author: paoloma +ms.date: 04/10/2024 +ms.topic: include +--- + +### Hide recommended personalized sites + +Remove Personalized Website Recommendations from the Recommended section in the Start Menu. + +| | Path | +|--|--| +| **CSP** | `./User/Vendor/MSFT/Policy/Config/Start/`[HideRecommendedPersonalizedSites](/windows/client-management/mdm/policy-csp-start#hiderecommendedpersonalizedsites)

`./Device/Vendor/MSFT/Policy/Config/Start/`[HideRecommendedPersonalizedSites](/windows/client-management/mdm/policy-csp-start#hiderecommendedpersonalizedsites) | +| **GPO** | **Computer Configuration** > **Administrative Templates** > **Start Menu and Taskbar**

**User Configuration** > **Administrative Templates** > **Start Menu and Taskbar** > **Remove Personalized Website Recommendations from the Recommended section in the Start Menu**| \ No newline at end of file diff --git a/windows/configuration/start/includes/hide-recommended-section.md b/windows/configuration/start/includes/hide-recommended-section.md new file mode 100644 index 0000000000..0331a54e2e --- /dev/null +++ b/windows/configuration/start/includes/hide-recommended-section.md @@ -0,0 +1,15 @@ +--- +author: paolomatarazzo +ms.author: paoloma +ms.date: 04/10/2024 +ms.topic: include +--- + +### Hide recommended section + +This policy setting prevents the Start menu from displaying a list of recommended applications and files. If you enable this policy setting, the Start menu doesn't show the section containing a list of recommended files and apps. + +| | Path | +|--|--| +| **CSP** | `./User/Vendor/MSFT/Policy/Config/Start/`[HideRecommendedSection](/windows/client-management/mdm/policy-csp-start#hiderecommendedsection)

`./Device/Vendor/MSFT/Policy/Config/Start/`[HideRecommendedSection](/windows/client-management/mdm/policy-csp-start#hiderecommendedsection) | +| **GPO** | **Computer Configuration** > **Administrative Templates** > **Start Menu and Taskbar**

**User Configuration** > **Administrative Templates** > **Start Menu and Taskbar** > **Remove Recommended section from Start Menu** | diff --git a/windows/configuration/start/includes/hide-restart.md b/windows/configuration/start/includes/hide-restart.md new file mode 100644 index 0000000000..b62480ae4b --- /dev/null +++ b/windows/configuration/start/includes/hide-restart.md @@ -0,0 +1,16 @@ +--- +author: paolomatarazzo +ms.author: paoloma +ms.date: 04/10/2024 +ms.topic: include +--- + +### Hide Restart + +| | Path | +|--|--| +| **CSP** | `./Device/Vendor/MSFT/Policy/Config/Start/`[HideRestart](/windows/client-management/mdm/policy-csp-start#hiderestart) | +| **GPO** | Not available. | + +hideshutdown +hidesleep \ No newline at end of file diff --git a/windows/configuration/start/includes/hide-shut-down.md b/windows/configuration/start/includes/hide-shut-down.md new file mode 100644 index 0000000000..ff8957dcf0 --- /dev/null +++ b/windows/configuration/start/includes/hide-shut-down.md @@ -0,0 +1,13 @@ +--- +author: paolomatarazzo +ms.author: paoloma +ms.date: 04/10/2024 +ms.topic: include +--- + +### Hide Shut down + +| | Path | +|--|--| +| **CSP** | `./Device/Vendor/MSFT/Policy/Config/Start/`[HideShutDown](/windows/client-management/mdm/policy-csp-start#hideshutdown) | +| **GPO** | Not available. | diff --git a/windows/configuration/start/includes/hide-signout.md b/windows/configuration/start/includes/hide-signout.md new file mode 100644 index 0000000000..9a6ef3d422 --- /dev/null +++ b/windows/configuration/start/includes/hide-signout.md @@ -0,0 +1,22 @@ +--- +author: paolomatarazzo +ms.author: paoloma +ms.date: 04/10/2024 +ms.topic: include +--- + +### Hide Sign out + +With this policy setting you can remove the **Sign out** item from the Start menu and prevents users from restoring it: + +- If you enable this policy setting, the **Sign out** item doesn't appear in the Start menu +- If you disable or don't configure this policy setting, users can use the **Sign out** item in the Start menu + +> [!NOTE] +> +> This policy setting affects the Start menu only. It doesn't affect the **Sign out** item on the Windows Security dialog box that appears when you press CTRL+ALT+DEL, and it doesn't prevent users from using other methods to sign out. + +| | Path | +|--|--| +| **CSP** | `./Device/Vendor/MSFT/Policy/Config/Start/`[HideSignOut](/windows/client-management/mdm/policy-csp-start#hidesignout) | +| **GPO** | **User Configuration** > **Administrative Templates** > **Start Menu and Taskbar** > **Remove Logoff on the Start Menu** | diff --git a/windows/configuration/start/includes/hide-sleep.md b/windows/configuration/start/includes/hide-sleep.md new file mode 100644 index 0000000000..dd866139e3 --- /dev/null +++ b/windows/configuration/start/includes/hide-sleep.md @@ -0,0 +1,13 @@ +--- +author: paolomatarazzo +ms.author: paoloma +ms.date: 04/10/2024 +ms.topic: include +--- + +### Hide Sleep + +| | Path | +|--|--| +| **CSP** | `./Device/Vendor/MSFT/Policy/Config/Start/`[HideSleep](/windows/client-management/mdm/policy-csp-start#hidesleep) | +| **GPO** | Not available. | diff --git a/windows/configuration/start/includes/hide-switch-account.md b/windows/configuration/start/includes/hide-switch-account.md new file mode 100644 index 0000000000..5bbe1c5e7a --- /dev/null +++ b/windows/configuration/start/includes/hide-switch-account.md @@ -0,0 +1,13 @@ +--- +author: paolomatarazzo +ms.author: paoloma +ms.date: 04/10/2024 +ms.topic: include +--- + +### Hide Switch account + +| | Path | +|--|--| +| **CSP** | `./Device/Vendor/MSFT/Policy/Config/Start/`[HideSwitchAccount](/windows/client-management/mdm/policy-csp-start#hideswitchaccount) | +| **GPO** | Not available. | diff --git a/windows/configuration/start/includes/hide-user-tile.md b/windows/configuration/start/includes/hide-user-tile.md new file mode 100644 index 0000000000..18e35f9e1f --- /dev/null +++ b/windows/configuration/start/includes/hide-user-tile.md @@ -0,0 +1,13 @@ +--- +author: paolomatarazzo +ms.author: paoloma +ms.date: 10/30/2023 +ms.topic: include +--- + +### Hide User tile + +| | Path | +|--|--| +| **CSP** | `./Device/Vendor/MSFT/Policy/Config/Start/`[HideUserTile](/windows/client-management/mdm/policy-csp-start#hideusertile)| +| **GPO** | Not available. | diff --git a/windows/configuration/start/includes/import-edge-assets.md b/windows/configuration/start/includes/import-edge-assets.md new file mode 100644 index 0000000000..c74bd471b5 --- /dev/null +++ b/windows/configuration/start/includes/import-edge-assets.md @@ -0,0 +1,13 @@ +--- +author: paolomatarazzo +ms.author: paoloma +ms.date: 10/30/2023 +ms.topic: include +--- + +### Import Edge assets + +| | Path | +|--|--| +| **CSP** | `./Device/Vendor/MSFT/Policy/Config/Start/`[ImportEdgeAssets](/windows/client-management/mdm/policy-csp-start#importedgeassets)| +| **GPO** | Not available | diff --git a/windows/configuration/start/includes/prevent-changes-to-taskbar-and-start-menu-settings.md b/windows/configuration/start/includes/prevent-changes-to-taskbar-and-start-menu-settings.md new file mode 100644 index 0000000000..59b825838b --- /dev/null +++ b/windows/configuration/start/includes/prevent-changes-to-taskbar-and-start-menu-settings.md @@ -0,0 +1,18 @@ +--- +author: paolomatarazzo +ms.author: paoloma +ms.date: 04/10/2024 +ms.topic: include +--- + +### Prevent changes to Taskbar and Start Menu settings + +With this policy setting you can prevent changes to Taskbar and Start menu settings: + +- If you enable this policy setting, users can't change the Taskbar or Start properties +- If you disable or don't configure this policy setting, the Taskbar and Start Menu items are available from Settings on the Start menu + +| | Path | +|--|--| +| **CSP** | Not available. | +| **GPO** | **Computer Configuration** > **Administrative Templates** > **Start Menu and Taskbar** > **Prevent changes to Taskbar and Start Menu Settings**

**User Configuration** > **Administrative Templates** > **Start Menu and Taskbar** > **Prevent changes to Taskbar and Start Menu Settings**| diff --git a/windows/configuration/start/includes/prevent-users-from-customizing-their-start.md b/windows/configuration/start/includes/prevent-users-from-customizing-their-start.md new file mode 100644 index 0000000000..eeeaae273e --- /dev/null +++ b/windows/configuration/start/includes/prevent-users-from-customizing-their-start.md @@ -0,0 +1,18 @@ +--- +author: paolomatarazzo +ms.author: paoloma +ms.date: 04/10/2024 +ms.topic: include +--- + +### Prevent users from customizing their Start + +With this policy setting you can prevent users from changing their Start menu layout: + +- If you enable this setting, users can't pin/unpin a Start menu element, and rearrange elements +- If you disable or don't configure this setting, users can pin/unpin elements, and rearrange elements + +| | Path | +|--|--| +| **CSP** | Not available. | +| **GPO** | **User Configuration** > **Administrative Templates** > **Start Menu and Taskbar** > **Prevent users from customizing their Start**| diff --git a/windows/configuration/start/includes/prevent-users-from-uninstalling-applications-from-start.md b/windows/configuration/start/includes/prevent-users-from-uninstalling-applications-from-start.md new file mode 100644 index 0000000000..53add991f5 --- /dev/null +++ b/windows/configuration/start/includes/prevent-users-from-uninstalling-applications-from-start.md @@ -0,0 +1,15 @@ +--- +author: paolomatarazzo +ms.author: paoloma +ms.date: 04/10/2024 +ms.topic: include +--- + +### Prevent users from uninstalling applications from Start + +If you enable this setting, users can't uninstall apps from Start. If you disable this setting or don't configure it, users can access the uninstall command from Start. + +| | Path | +|--|--| +| **CSP** | Not available. | +| **GPO** | **Computer Configuration** > **Administrative Templates** > **Start Menu and Taskbar**

**User Configuration** > **Administrative Templates** > **Start Menu and Taskbar** > **Prevent users from uninstalling applications from Start**| diff --git a/windows/configuration/start/includes/remove-and-prevent-access-to-the-shut-down-restart-sleep-and-hibernate-commands.md b/windows/configuration/start/includes/remove-and-prevent-access-to-the-shut-down-restart-sleep-and-hibernate-commands.md new file mode 100644 index 0000000000..324fe427b0 --- /dev/null +++ b/windows/configuration/start/includes/remove-and-prevent-access-to-the-shut-down-restart-sleep-and-hibernate-commands.md @@ -0,0 +1,18 @@ +--- +author: paolomatarazzo +ms.author: paoloma +ms.date: 04/10/2024 +ms.topic: include +--- + +### Remove and prevent access to the Shut Down, Restart, Sleep, and Hibernate commands + +With this policy setting, you can prevent users from performing the following commands from the Windows security screen, the sign in screen, and the Start menu: Shut Down, Restart, Sleep, and Hibernate. This policy setting doesn't prevent users from running Windows-based programs that perform these functions: + +- If you enable this policy setting, the shutdown, restart, sleep, and hibernate commands are removed from the Start menu. The Power button is also removed from the Windows Security screen, which appears when you press CTRL+ALT+DELETE, and from the sign in screen +- If you disable or don't configure this policy setting, the Power button and the Shut Down, Restart, Sleep, and Hibernate commands are available on the Start menu. The Power button on the Windows Security and sign in screens is also available + +| | Path | +|--|--| +| **CSP** | Not available | +| **GPO** | **Computer Configuration** > **Administrative Templates** > **Start Menu and Taskbar**

**User Configuration** > **Administrative Templates** > **Start Menu and Taskbar** > **Remove and prevent access to the Shut Down, Restart, Sleep, and Hibernate commands** | diff --git a/windows/configuration/start/includes/remove-common-program-groups.md b/windows/configuration/start/includes/remove-common-program-groups.md new file mode 100644 index 0000000000..3c0479536c --- /dev/null +++ b/windows/configuration/start/includes/remove-common-program-groups.md @@ -0,0 +1,15 @@ +--- +author: paolomatarazzo +ms.author: paoloma +ms.date: 04/10/2024 +ms.topic: include +--- + +### Remove common program groups + +This policy setting removes items in the *All Users* profile from the Programs menu on the Start menu. By default, the Programs menu contains items from the *All Users* profile and items from the user's profile. If you enable this setting, only items in the user's profile appear in the Programs menu. + +| | Path | +|--|--| +| **CSP** | Not available. | +| **GPO** | **User Configuration** > **Administrative Templates** > **Start Menu and Taskbar** > **Remove common program groups from Start Menu** | diff --git a/windows/configuration/start/includes/show-run-as-different-user-command.md b/windows/configuration/start/includes/show-run-as-different-user-command.md new file mode 100644 index 0000000000..edd8c3f2c4 --- /dev/null +++ b/windows/configuration/start/includes/show-run-as-different-user-command.md @@ -0,0 +1,18 @@ +--- +author: paolomatarazzo +ms.author: paoloma +ms.date: 04/10/2024 +ms.topic: include +--- + +### Show *Run as different user* command + +With this policy setting, you can hide the *Run as different user* command on the Start application bar. If you enable it, users can access the **Run as different user** command from Start. If you disable or don't configure this setting, users can't access the **Run as different user** command from Start for any applications. + +> [!NOTE] +> This setting doesn't prevent users from using other methods, such as the SHIFT right-click menu on application's jumplists in the taskbar to issue the *Run as different user* command. + +| | Path | +|--|--| +| **CSP** | Not available | +| **GPO** | **User Configuration** > **Administrative Templates** > **Start Menu and Taskbar** > **Show "Run as different user" command on Start** | diff --git a/windows/configuration/start/index.md b/windows/configuration/start/index.md new file mode 100644 index 0000000000..c78ef0401d --- /dev/null +++ b/windows/configuration/start/index.md @@ -0,0 +1,85 @@ +--- +title: Configure the Start menu +description: Learn how to configure the Windows Start menu to provide quick access to the tools and applications that users need most. +ms.topic: overview +ms.date: 04/10/2024 +zone_pivot_groups: windows-versions-11-10 +appliesto: +--- + +# Configure the Start menu + +The Windows Start menu is a pivotal element in the Windows operating system, serving as a central hub for launching applications and managing tasks. For organizations, the ability to configure the Start menu's behavior through policy settings can be highly beneficial, particularly in environments where certain roles or functions necessitate tailored access to applications and tools. + +For instance, in kiosk settings, organizations can configure the Start menu to limit access to a single application or a specific set of applications, ensuring that the kiosk serves its intended purpose without allowing for unnecessary or potentially disruptive interactions. This is useful in public spaces or in scenarios where devices are intended for a single function, such as information stands or check-in counters. + +Frontline workers, who often operate in fast-paced and dynamic environments, can benefit from a Start menu that is configured to provide quick access to the tools and applications they need most. This streamlined approach can enhance productivity and reduce the time spent navigating through unnecessary options. + +In educational settings, students can benefit from a Start menu that is customized to provide access to educational tools and resources while restricting distractions. By configuring policy settings, educational institutions can create a focused and conducive learning environment. + +## Start structure + +The Start menu structure consists five main areas, which you can configure to meet your organization's needs. These areas are as follows: + +:::row::: +:::column span="2"::: +::: zone pivot="windows-10" +1. **Start layout**: contains the arrangement of tiles that link to applications, folders, websites, or files +1. **All apps**: contains an alphabetical list of all installed applications. The list can include dynamic sections, such as *Most used* and *Recently added* +1. **Account**: contains links to change user account settings, sign out, lock the device, or switch user +1. **Pinned folders**: contains a customizable list of folders for quick access +1. **Power**: contains links to power options, such as shutdown, restart, and sleep +::: zone-end +::: zone pivot="windows-11" +1. **Start layout**: the *Pinned* section contains the arrangement of pins that link to applications, folders, websites, or files. The *Recommended* section is designed to enhance user productivity by providing quick access to frequently used apps, documents, or websites +1. **All apps**: contains an alphabetical list of all installed applications. The list can include dynamic sections, such as *Most used* and *Recently added* +1. **Account**: contains links to change user account settings, sign out, lock the device, or switch user +1. **Pinned folders**: contains a customizable list of folders for quick access +1. **Power**: contains links to power options, such as shutdown, restart, and sleep +::: zone-end +:::column-end::: +:::column span="2"::: +::: zone pivot="windows-10" + :::image type="content" source="./images/windows-10-settings.png" alt-text="Sample start menu layout with its components highlighted." border="false" lightbox="./images/windows-10-settings.png"::: +::: zone-end +::: zone pivot="windows-11" + :::image type="content" source="./images/windows-11-settings.png" alt-text="Sample start menu layout with its components highlighted." border="false" lightbox="./images/windows-11-settings.png"::: +::: zone-end + :::column-end::: +:::row-end::: + +## Configuration options + +There are several options to configure the Windows Start menu. + +If you need to configure a device for a single user, you can pin/unpin applications to Start and rearrange them. Start can be further customized from Settings. Go to **Settings** > **Personalization** > **[Start](ms-settings:personalization-start)**. + +For advanced customizations and when you need to configure multiple devices, you can use one of the following options: + +- Configuration Service Provider (CSP): commonly used for devices managed by a Mobile Device Management (MDM) solution, like Microsoft Intune. CSPs can also be configured with [provisioning packages](../provisioning-packages/how-it-pros-can-use-configuration-service-providers.md#csps-in-windows-configuration-designer), which are used at deployment time or for unmanaged devices. To configure Start, use the [Start Policy CSP][WIN-1] +- Group policy (GPO): used for devices that are Active Directory joined or Microsoft Entra hybrid joined, and not managed by a device management solution. Group policy can also be used for devices that aren't joined to an Active Directory domain, using the local group policy editor + +> [!NOTE] +> While many of the Start menu policy settings can be configured using both CSP and GPO, there are some settings that are only available using the Start Policy CSP. To learn about the available policy settings to configure the Start menu via CSP and GPO, see [Start menu policy settings](policy-settings.md). + +::: zone pivot="windows-10" +The configuration of the Start layout requires the use of an XML file that specifies the layout. To learn more about how to create and apply an XML file to configure the Start layout, see [Customize the Start layout](layout.md). +::: zone-end + +::: zone pivot="windows-11" +The configuration of the Start layout requires the use of a JSON file that specifies the layout. To learn more about how to create and apply a JSON file to configure the Start layout, see [Customize the Start layout](layout.md). + +> [!IMPORTANT] +> The JSON file can be applied to devices using the [Start policy CSP][WIN-1] only. It's not possible to apply the JSON file using group policy. +::: zone-end + +## Next steps + +In the next sections, you can learn more about the options available to configure Start menu settings using the Configuration Service Provider (CSP) and Group Policy (GPO): + +- [Customize the Start layout](layout.md) +- [Start menu policy settings](policy-settings.md) + + + +[WIN-1]: /windows/client-management/mdm/policy-csp-start \ No newline at end of file diff --git a/windows/configuration/start/layout.md b/windows/configuration/start/layout.md new file mode 100644 index 0000000000..8a771280ae --- /dev/null +++ b/windows/configuration/start/layout.md @@ -0,0 +1,693 @@ +--- +title: Customize the Start layout +description: Learn how to customize the Windows Start layout, export its configuration, and deploy the customization to other devices. +ms.topic: how-to +ms.date: 04/10/2024 +zone_pivot_groups: windows-versions-11-10 +appliesto: +--- + +# Customize the Start layout + +Implementing a customized Start layout across your organization's devices empowers administrators with direct control over the Start menu configuration. With this capability, you can specify a tailored set of pinned applications, arranged according to preference. Utilize this feature to strategically pin desired apps, eliminate default pinned apps, and organize the application display to align with operational requirements. + +This article describes how to customize the Start layout, export its configuration, and deploy the customization to other devices. + +> [!NOTE] +> If you are looking for OEM information, see the article [Customize the Start layout](/windows-hardware/customize/desktop/customize-the-windows-11-start-menu). + +## Customization process + +To customize the Windows Start layout and deploy its configuration to other devices, follow these steps: + +1. Configure the Start layout to meet your requirements from a reference device +1. Export the Start layout configuration to a configuration file +1. Deploy the configuration file using one of the available options + +> [!TIP] +> While you can create your own configuration file, it's easier and faster to export the layout from an existing device. + +### Customize the Start layout on a reference device + +To prepare a Start layout for export, customize the Start layout on a reference device. To prepare a reference device: + +1. Set up a device on which to customize the Start layout, which should have the operating system that is installed on the users' devices +1. Install all apps and services that the Start layout should display +1. Create a new user account that you use to customize the Start layout + +To customize Start: + +::: zone pivot="windows-10" + +1. Sign in to the reference device with the user account that you created +1. Customize the Start layout as you want users to see it by using the following techniques: + + - **Pin apps to Start**. From Start, type the name of the app. When the app appears in the search results, right-click the app and select **Pin to Start** + To view all apps, select **All apps**. Right-click any app, and pin or unpin it from Start + - **Unpin apps** that you don't want to display. To unpin an app, right-click the app, and then select **Unpin from Start** + - **Drag existing apps** on Start to reorder or group them + - **Resize tiles**. To resize tiles, right-click the tile and then select **Resize** + - **Create your own app groups**. Drag the apps to an empty area. To name a group, select above the group of tiles and then type the name in the **Name group** field that appears above the group + +> [!IMPORTANT] +> If the Start layout includes tiles for apps that are not installed on the target device, the tiles for those apps will be blank. The blank tiles persist until the next time the user signs in, at which time the blank tiles are removed. + +::: zone-end + +::: zone pivot="windows-11" + +1. Sign in to the reference device with the user account that you created +1. Customize the **Pinned** section of the Start layout as you want users to see it by using the following techniques: + + - **Pin apps to Start**. From Start, type the name of the app. When the app appears in the search results, right-click the app and select **Pin to Start** + To view all apps, select **All apps**. Right-click any app, and pin or unpin it from Start + - **Unpin apps** that you don't want to display. To unpin an app, right-click the app, and then select **Unpin from Start** + - **Drag existing apps** on Start to reorder them + +> [!IMPORTANT] +> If the Start layout includes pins for apps that aren't installed on the target device, the pins for those apps aren't created until the apps are installed. + +::: zone-end + +### Export the Start layout configuration + +Once the Start layout is configured to meet your requirements, use the Windows PowerShell [Export-StartLayout][PS-1] cmdlet to export the existing layout to a configuration file. + +::: zone pivot="windows-10" +The exported customization consists of an XML file containing a list of tiles that define the Start layout. + +> [!NOTE] +> You can find the default Start layout template in `%LOCALAPPDATA%\Microsoft\windows\Shell\DefaultLayouts.xml`. + +To export the Start layout to an XML file: + +1. While signed in with the same account that you used to customize Start, create a folder to save the `.xml` file. For example, create the `C:\Layouts` folder +1. Open Windows PowerShell +1. Run the following cmdlet: + + ```powershell + Export-StartLayout -UseDesktopApplicationID -Path "C:\Layouts\LayoutModification.xml" + ``` + +1. (Optional) Edit the XML file to add [a taskbar configuration](../taskbar/configure.md) or to make any modifications to the Start layout + +::: zone-end + +::: zone pivot="windows-11" + +The exported customization consists of a JSON file containing a list of pins that define the Start layout. + +To export the Start layout to a JSON file: + +1. While signed in with the same account that you used to customize Start, create a folder to save the `.json` file. For example, create the `C:\Layouts` folder +1. Open Windows PowerShell +1. Run the following cmdlet: + + ```powershell + Export-StartLayout -Path "C:\Layouts\LayoutModification.json" + ``` + +::: zone-end + +### Start layout example + +Here you can find an example of Start layout that you can use as a reference: + +[!INCLUDE [example-start-layout](includes/example-start-layout.md)] + +### Change the configuration file + +::: zone pivot="windows-10" + +> [!CAUTION] +> When you make changes to the exported layout, be aware that the XML file must adhere to an [XML schema definition (XSD)](xsd.md). +> +> The XML file requires the following order for tags directly under the `LayoutModificationTemplate` node: +> +> 1. `LayoutOptions` +> 1. `DefaultLayoutOverride` +> 1. `RequiredStartGroupsCollection` +> 1. `AppendDownloadOfficeTile` - OR - `AppendOfficeSuite` (only one Office option can be used at a time) +> 1. `AppendOfficeSuiteChoice` +> 1. `TopMFUApps` +> 1. `CustomTaskbarLayoutCollection` +> 1. `InkWorkspaceTopApps` +> 1. `StartLayoutCollection` +> +> Comments are not supported in the `LayoutModification.xml` file. + +> [!NOTE] +> `RequiredStartGroupsCollection` and `AppendGroup` syntax only apply when the `Import-StartLayout` method is used for building and deploying Windows images. + +You can edit the XML file to make any modifications to the Start layout. For example, you can include `` to include the Taskbar customization. + +If the Start layout that you export contains tiles for desktop apps or URL links, `Export-StartLayout` uses `DesktopApplicationLinkPath` in the resulting file. Use a text or XML editor to change `DesktopApplicationLinkPath` to `DesktopApplicationID`. + +For scripts and application tile pins to work correctly, follow these rules: + +- Executable files and scripts should be listed in `%ProgramFiles%` or wherever the installer of the app places them +- Shortcuts that pin to Start should be placed in `%ProgramData%\Microsoft\Windows\Start Menu\Programs` +- If you place executable files or scripts in the `%ProgramData%\Microsoft\Windows\Start Menu\Programs` folder, they don't pin to Start + +> [!NOTE] +> All devices that you apply the Start layout to, must have the apps and other shortcuts present on the local system in the same location as the source for the Start layout. + +After you export the layout, decide whether you want to apply a *full* Start layout or a *partial* Start layout: + +- When a full Start layout is applied, the users can't pin, unpin, or uninstall apps from Start. Users can view and open all apps in the **All Apps** view, but they can't pin any apps to Start +- When a partial Start layout is applied, the contents of the specified tile groups can't be changed, but users can move those groups, and can also create and customize their own groups + +### Supported elements and attributes + +| Element | Description | +|--|--| +| `LayoutModificationTemplate` | Use to describe the changes to the default Start layout | +| [LayoutOptions](#layoutoptions) | Use to specify:
- Whether to use full screen Start on the desktop
- The number of tile columns in the Start menu | +| `RequiredStartGroupsCollection` | Use to contain collection of `RequiredStartGroups` | +| [RequiredStartGroups](#requiredstartgroups) | Use to contain the `AppendGroup` tags, which represent groups that can be appended to the default Start layout | +| [AppendGroup](#appendgroup) | Use to specify the tiles that need to be appended to the default Start layout | +| [start:Tile](#specify-start-tiles) | Use to specify a UWP app | +| `start:Folder`| Use to specify a folder of icons; can include [Tile](#starttile), [SecondaryTile](#startsecondarytile), and [DesktopApplicationTile](#startdesktopapplicationtile) | +| [start:DesktopApplicationTile](#startdesktopapplicationtile) | Use to specify any of the following:
- A Windows desktop application with a known AppUserModelID
- An application in a known folder with a link in a legacy Start Menu folder
- A Windows desktop application link in a legacy Start Menu folder
- A Web link tile with an associated `.url` file that is in a legacy Start Menu folder | +| [start:SecondaryTile](#startsecondarytile) | Use to pin a Web link through a Microsoft Edge secondary tile | +| [AppendOfficeSuite](#appendofficesuite) | Use to add the in-box installed Office suite to Start. For more information, see [Customize the Office suite of tiles](/windows-hardware/customize/desktop/customize-start-layout#customize-the-office-suite-of-tiles).

Don't use this tag with `AppendDownloadOfficeTile` | +| [AppendDownloadOfficeTile](#appenddownloadofficetile) | Use to add a specific **Download Office** tile to a specific location in Start

Do not use this tag with `AppendOfficeSuite` | + +#### LayoutOptions + +New devices running Windows 10 for desktop editions default to a Start menu with two columns of tiles unless boot to tablet mode is enabled. Devices with screens that are under 10" have boot to tablet mode enabled by default. For these devices, users see the full screen Start on the desktop. You can adjust the following features: + +- Boot to tablet mode can be set on or off +- Set full screen Start on desktop to on or off + To do this, add the `LayoutOptions` element in your LayoutModification.xml file and set the FullScreenStart attribute to true or false +- Specify the number of columns in the Start menu to 1 or 2 + To do this, add the `LayoutOptions` element in your LayoutModification.xml file and set the StartTileGroupsColumnCount attribute to 1 or 2 + +The following example shows how to use the `LayoutOptions` element to specify full screen Start on the desktop and to use one column in the Start menu: + +```xml + +``` + +#### RequiredStartGroups + +The `RequiredStartGroups` tag contains `AppendGroup` tags that represent groups that you can append to the default Start layout. + +The groups have the following constraints: + +- Two groups that are six columns wide, or equivalent to the width of three medium tiles +- Two medium-sized tile rows in height. Windows ignores any tiles that are pinned beyond the second row +- No limit to the number of apps that can be pinned. There's a theoretical limit of 24 tiles per group (four small tiles per medium square x three columns x two rows) + +>[!IMPORTANT] +>You can add a maximum of two `AppendGroup` tags per `RequiredStartGroups` tag. + +You can also assign regions to the append groups in the `RequiredStartGroups` tag's using the optional `Region` attribute or you can use the multivariant capabilities in Windows provisioning. If you're using the `Region` attribute, you must use a two-letter country code to specify the country/region that the append group(s) apply to. To specify more than one country/region, use a pipe (`|`) delimiter as shown in the following example: + +```XML + +``` + +- If the country/region setting for the Windows device matches a `RequiredStartGroups`, then the tiles laid out within the `RequiredStartGroups` is applied to Start +- If you specify a region-agnostic `RequiredStartGroups` (or one without the optional Region attribute), then the region-agnostic `RequiredStartGroups` is applied to Start + +#### AppendGroup + +`AppendGroup` tags specify a group of tiles to append to Start. There's a maximum of two `AppendGroup` tags allowed per `RequiredStartGroups` tag. + +For Windows 10 for desktop editions, AppendGroup tags contain `start:Tile`, `start:DesktopApplicationTile`, or `start:SecondaryTile` tags. + +You can specify any number of tiles in an `AppendGroup`, but you can't specify a tile with a `Row` attribute greater than one. The Start layout doesn't support overlapping tiles. + +#### Specify Start tiles + +To pin tiles to Start, partners must use the right tile depending on what you want to pin. + +#### Tile size and coordinates + +All tile types require a size (`Size`) and coordinates (`Row` and `Column`) attributes, regardless of the tile type that you use when prepinning items to Start. + +The following table describes the attributes that you must use to specify the size and location for the tile. + +| Attribute | Description | +| --- | --- | +| `Size` | Determines how large the tile is.

- 1x1 - small tile
- 2x2 - medium tile
- 4x2 - wide tile
- 4x4 - large tile | +| `Row` | Specifies the row where the tile appears. | +| `Column` | Specifies the column where the tile appears. | + +For example, a tile with `Size="2x2"`, `Row="2"`, and `Column="2"` results in a tile located at (2,2) where (0,0) is the top-left corner of a group. + +#### start:Tile + +You can use the `start:Tile` tag to pin a UWP app to Start. You must set the `AppUserModelID` attribute to the application user model ID (AUMID) of the corresponding app. + +#### start:DesktopApplicationTile + +You can use the `start:DesktopApplicationTile` tag to pin a Windows desktop application to Start. There are two ways you can specify a Windows desktop application: + +- Use a path to a shortcut link (.lnk file) to a Windows desktop application. + + >[!NOTE] + >Use `DesktopApplicationID` rather than `DesktopApplicationLinkPath` if the application is installed after the user's first sign-in. + + To pin a Windows desktop application through this method, you must first add the `.lnk` file in the specified location when the device first boots. + + The following example shows how to pin the Command Prompt: + + ```XML + + ``` + + You must set the `DesktopApplicationLinkPath` attribute to the .lnk file that points to the Windows desktop application. The path also supports environment variables. + + If you're pointing to a third-party Windows desktop application and the layout is being applied before the first boot, you must put the `.lnk` file in a legacy Start Menu directory before first boot. For example, `%APPDATA%\Microsoft\Windows\Start Menu\Programs\` or the all users profile `%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\`. + +- Use the AUMID, if this is known. If the Windows desktop application doesn't have one, use the shortcut link option. + +Learn how to [Find the Application User Model ID of an installed app](../store/find-aumid.md). + + The following example shows how to pin the File Explorer Windows desktop application: + + ```XML + + ``` + +You can also use the `start:DesktopApplicationTile` tag as one of the methods for pinning a Web link to Start. The other method is to use a Microsoft Edge secondary tile. + +To pin a legacy `.url` shortcut to Start, you must create a `.url` file (right-click on the desktop, select **New** > **Shortcut**, and then type a Web URL). You must add this `.url` file in a legacy Start Menu directory before first boot; for example, `%APPDATA%\Microsoft\Windows\Start Menu\Programs\` or the all users profile `%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\`. + +The following example shows how to create a tile of the Web site's URL, which you can treat similarly to a Windows desktop application tile: + +```XML + +``` + +>[!NOTE] +>`Export-StartLayout` uses `DesktopApplicationLinkPath` for the .url shortcut. You must change `DesktopApplicationLinkPath` to `DesktopApplicationID` and provide the URL. + +#### start:SecondaryTile + +You can use the `start:SecondaryTile` tag to pin a web link through a Microsoft Edge secondary tile. This method doesn't require more actions compared to the method of using legacy `.url` shortcuts (through the `start:DesktopApplicationTile` tag). + +The following example shows how to create a tile of the Web site's URL using the Microsoft Edge secondary tile: + +```XML + +``` + +The following table describes the other attributes that you can use with the `start:SecondaryTile` tag in addition to `Size`, `Row`, and `Column`. + +| Attribute | Required/optional | Description | +| --- | --- | --- | +| `AppUserModelID` | Required | Must point to Microsoft Edge. | +| `TileID` | Required | Must uniquely identify your Web site tile. | +| `Arguments` | Required | Must contain the URL of your Web site. | +| `DisplayName` | Required | Must specify the text that you want users to see. | +| `Square150x150LogoUri` | Required | Specifies the logo to use on the 2x2 tile. | +| `Wide310x150LogoUri` | Optional | Specifies the logo to use on the 4x2 tile. | +| `ShowNameOnSquare150x150Logo` | Optional | Specifies whether the display name is shown on the 2x2 tile. The values you can use for this attribute are true or false. | +| `ShowNameOnWide310x150Logo` | Optional | Specifies whether the display name is shown on the 4x2 tile. The values you can use for this attribute are true or false. | +| `BackgroundColor` | Optional | Specifies the color of the tile. You can specify the value in ARGB hexadecimal (for example, `#FF112233`) or specify `transparent`. | +| `ForegroundText` | Optional | Specifies the color of the foreground text. Set the value to either `light` or `dark`. | + +Secondary Microsoft Edge tiles have the same size and location behavior as a Universal Windows app, Windows 8 app, or Windows 8.1 app. + +#### AppendOfficeSuite + +You can use the `AppendOfficeSuite` tag to add the in-box installed Office suite of apps to Start. + +>[!NOTE] +>The OEM must have installed Office for this tag to work. + +The following example shows how to add the `AppendOfficeSuite` tag to your `LayoutModification.xml` file to append the Office suite to Start: + +```XML + + + +``` + +#### AppendOfficeSuiteChoice + +You have two options in this tag: + +- `` +- `` + +Use `Choice=DesktopBridgeSubscription` on devices that have Office 365 preinstalled. This sets the heading of the Office suite of tiles to `Office 365`, to highlight the Office 365 apps that you've made available on the device. + +Use `Choice=DesktopBridge` on devices shipping with [perpetual licenses for Office](/archive/blogs/ausoemteam/choosing-the-right-office-version-for-your-customers). This sets the heading of the Office suite of tiles to **Create**. + +For more information, see [Customize the Office suite of tiles](/windows-hardware/customize/desktop/customize-start-layout#customize-the-office-suite-of-tiles). + +#### AppendDownloadOfficeTile + +You can use the `AppendDownloadOfficeTile` tag to append the Office trial installer to Start. This tag adds the **Download Office** tile to Start and the download tile will appear at the bottom right-hand side of the second group. + +>[!NOTE] +>The OEM must have installed the Office trial installer for this tag to work. + +The following example shows how to add the `AppendDownloadOfficeTile` tag to your LayoutModification.xml file: + +```XML + + + +``` + +#### Configure a partial Start layout + +:::row::: +:::column span="2"::: + +A partial Start layout enables you to add one or more customized tile groups to users' Start screens or menus, while still allowing users to make changes to other parts of the Start layout. All groups that you add are *locked*, meaning users can't change the contents of those tile groups, however users can change the location of those groups. Locked groups are identified with an icon, as shown in the following image. + +:::column-end::: +:::column span="2"::: + +:::image type="content" source="images/windows-10-partial-layout.png" alt-text="Screenshot of the Windows 10 Start menu with partial layout." lightbox="images/windows-10-partial-layout.png"::: + +:::column-end::: +:::row-end::: + +When a partial Start layout is applied for the first time, the new groups are added to the users' existing Start layouts. If an app tile is in both an existing group and in a new locked group, the duplicate app tile is removed from the existing (unlocked) group. + +If you apply a partial Start layout to a device with an existing Start layout applied, groups that were added previously are removed, and the groups in the new layout are added. + +> [!NOTE] +> If you remove the policy setting, the groups remain on the devices but become unlocked. + +To configure a partial Start screen layout, modify the `` element as follows: + +```xml + +``` + +::: zone-end + +::: zone pivot="windows-11" + +You can edit the JSON file to make any modifications to the **Pinned** section of the Start layout. For example, you can change the order of the pinned elements, or add new apps. + +1. Open the `LayoutModification.json` file in a JSON editor, such as Visual Studio Code or Notepad +1. The `pinnedList` section includes all the pins that are applied to the Start layout + +You can add more apps to the section using the following keys: + +| Key | Description | +|--|--| +| `packagedAppID` | Used for Universal Windows Platform (UWP) apps. To pin a UWP app, use the app's AUMID. | +| `desktopAppID` | Used for desktop apps. To pin a desktop app, use the app's AUMID. If the app doesn't have an AUMID, use the `desktopAppLink` instead. | +| `desktopAppLink` | Used for desktop apps that don't have an associated AUMID. To pin this type of app, use the path to the `.lnk` shortcut that points to the app. | + +::: zone-end + +Learn how to [Find the Application User Model ID of an installed app](../store/find-aumid.md). + +### Deploy the Start layout configuration + +[!INCLUDE [tab-intro](../../../includes/configure/tab-intro.md)] + +::: zone pivot="windows-10" + +#### [:::image type="icon" source="../images/icons/intune.svg"::: **Intune/CSP**](#tab/intune-10) + +To configure devices with Microsoft Intune, [create a Settings catalog policy](/mem/intune/configuration/settings-catalog) and use one of the following settings: + +| Category | Setting name | Value | +|--|--|--| +| **Start** | Start Layout | Content of the XML file| +| **Start** | Start Layout (User) | Content of the XML file| + +[!INCLUDE [intune-settings-catalog-2](../../../includes/configure/intune-settings-catalog-2.md)] + +Alternatively, you can configure devices using a [custom policy][MEM-1] with the [Start CSP][WIN-1]. Use one of the following settings: + +| Setting | +|--| +| - **OMA-URI:** `./User/Vendor/MSFT/Policy/Config/Start/`[StartLayout](/windows/client-management/mdm/policy-csp-Start#startlayout)
- **String:**
- **Value:** content of the XML file | +| - **OMA-URI:** `./Device/Vendor/MSFT/Policy/Config/Start/`[StartLayout](/windows/client-management/mdm/policy-csp-Start#startlayout)
- **Data type:**
- **Value:** content of the XML file | + +[!INCLUDE [intune-custom-settings-2](../../../includes/configure/intune-custom-settings-2.md)] + +#### [:::image type="icon" source="../images/icons/provisioning-package.svg"::: **PPKG**](#tab/ppkg-10) + +[!INCLUDE [provisioning-package-1](../../../includes/configure/provisioning-package-1.md)] + +- **Path:** `Policies/Start/StartLayout` +- **Value:** content of the XML file + +> [!NOTE] +> The content of the file must be entered as a single line in the `Value` field. Use a text editor to remove any line breaks from the XML file, usually with a function called *join lines*. + +[!INCLUDE [provisioning-package-2](../../../includes/configure/provisioning-package-2.md)] + +### Use Windows Provisioning multivariant support + +The Windows Provisioning multivariant capability allows you to declare target conditions that, when met, supply specific customizations for each variant condition. For Start customization, you can create specific layouts for each variant that you have. To do this, you must create a separate LayoutModification.xml file for each variant that you want to support and then include these in your provisioning package. For more information on how to do this, see [Create a provisioning package with multivariant settings](../provisioning-packages/provisioning-multivariant.md). + +The provisioning engine chooses the right customization file based on the target conditions that were met, adds the file in the location that's specified for the setting, and then uses the specific file to customize Start. To differentiate between layouts, you can add modifiers to the LayoutModification.xml filename such as "LayoutCustomization1". Regardless of the modifier that you use, the provisioning engine will always output "LayoutCustomization.xml" so that the operating system has a consistent file name to query against. + +For example, if you want to ensure that there's a specific layout for a certain condition, you can: + +1. Create a specific layout customization file and then name it LayoutCustomization1.xml +1. Include the file as part of your provisioning package +1. Create your multivariant target and reference the XML file within the target condition in the main customization XML file + +The following example shows what the overall customization file might look like with multivariant support for Start: + +```XML + + + + {6aaa4dfa-00d7-4aaa-8adf-73c6a7e2501e} + My Provisioning Package + 1.0 + OEM + 50 + + + + + + + + + + + + + + + + + 1 + 1 + 1 + + + 1 + + + + + + + + + c:\users\\appdata\local\Microsoft\Windows\Shell\LayoutCustomization1.XML + + 1 + + + + + + +``` + +When the condition is met, the provisioning engine takes the XML file and places it in the location that the operating system has set and then the Start subsystem reads the file and applies the specific customized layout. + +You must repeat this process for all variants that you want to support so that each variant can have a distinct layout for each of the conditions and targets that need to be supported. For example, if you add a `Language` condition, you can create a Start layout that has its own localized group. + +#### [:::image type="icon" source="../images/icons/group-policy.svg"::: **GPO**](#tab/gpo) + +To configure a device with group policy, use the [Local Group Policy Editor](/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/cc731745(v=ws.10)). To configure multiple devices joined to Active Directory, [create or edit](/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/cc754740(v=ws.11)) a group policy object (GPO) and use one of the following settings: + +| Group policy path | Group policy setting | Value | +| - | - | - | +|**Computer Configuration** > **Administrative Templates** > **Start Menu and Taskbar**| Start Layout | Path to the XML file | +|**User Configuration** > **Administrative Templates** > **Start Menu and Taskbar**| Start Layout | Path to the XML file | + +[!INCLUDE [gpo-settings-2](../../../includes/configure/gpo-settings-2.md)] + +The GPO applies the Start and taskbar layout at the next user sign-in. Each time the user signs in, the timestamp of the .xml file with the Start and taskbar layout is checked and if a newer version of the file is available, the settings in the latest version of the file are applied. + +--- + +>[!NOTE] +>You can apply a Start layout to a mounted Windows image, with the PowerShell [Import-StartLayout](/powershell/module/startlayout/import-startlayout) cmdlet. +>Don't include XML Prologs like \ in the Start layout XML file. + +::: zone-end + +::: zone pivot="windows-11" + +> [!IMPORTANT] +> The JSON file can be applied to devices using the [Start policy CSP][WIN-1] only. It's not possible to apply the JSON file using group policy. + +#### [:::image type="icon" source="../images/icons/intune.svg"::: **Intune/CSP**](#tab/intune-11) + +To configure devices with Microsoft Intune, [create a Settings catalog policy](/mem/intune/configuration/settings-catalog) and use one of the following settings: + +| Category | Setting name | Value | +|--|--|--| +| **Start** | Configure Start Pins | Content of the JSON file| +| **Start** | Configure Start Pins (User) | Content of the JSON file| + +[!INCLUDE [intune-settings-catalog-2](../../../includes/configure/intune-settings-catalog-2.md)] + +Alternatively, you can configure devices using a [custom policy][MEM-1] with the [Start CSP][WIN-1]. Use one of the following settings: + +| Setting | +|--| +| - **OMA-URI:** `./User/Vendor/MSFT/Policy/Config/Start/`[ConfigureStartPins](/windows/client-management/mdm/policy-csp-Start#configurestartpins)
- **String:**
- **Value:** content of the JSON file | +| - **OMA-URI:** `./Device/Vendor/MSFT/Policy/Config/Start/`[ConfigureStartPins](/windows/client-management/mdm/policy-csp-Start#configurestartpins)
- **Data type:**
- **Value:** content of the JSON file | + +[!INCLUDE [intune-custom-settings-2](../../../includes/configure/intune-custom-settings-2.md)] + +#### [:::image type="icon" source="../images/icons/provisioning-package.svg"::: **PPKG**](#tab/ppkg-11) + +[!INCLUDE [provisioning-package-1](../../../includes/configure/provisioning-package-1.md)] + +- **Path:** `Policies/Start/ConfigureStartPins` +- **Value:** content of the JSON file + +> [!NOTE] +> The content of the file must be entered as a single line in the `Value` field. Use a text editor to remove any line breaks from the JSON file, usually with a function called *join lines*. + +[!INCLUDE [provisioning-package-2](../../../includes/configure/provisioning-package-2.md)] + +--- + +::: zone-end + +## User experience + +:::row::: +:::column span="2"::: + +After the settings are applied, sign in to the device. The Start layout that you configured is applied to the Start menu. + +::: zone pivot="windows-10" + +When a full Start layout is applied with policy settings, users can't pin, unpin, or uninstall apps from Start. Users can view and open all apps in the **All Apps** view, but they can't change the Start layout. When you apply a partial Start layout, the content of the specified tile groups can't be changed, but users can move the groups, and can create and customize their own groups. + +::: zone-end + +::: zone pivot="windows-11" + +When you configure the Start layout with policy settings, you overwrite the entire layout. Users can change the order of the pinned elements, pin, or unpin items. When a user signs in again, the Start layout specified in the policy setting is reapplied, without retaining any user changes. + +::: zone-end + +:::column-end::: +:::column span="2"::: +::: zone pivot="windows-10" + :::image type="content" source="images/windows-10.png" alt-text="Screenshot of the Windows 10 Start menu." border="false" lightbox="images/windows-10.png"::: +::: zone-end + +::: zone pivot="windows-11" + :::image type="content" source="images/windows-11.png" alt-text="Screenshot of the Windows 11 Start menu." border="false" lightbox="images/windows-11.png"::: +::: zone-end + +:::column-end::: +:::row-end::: + +## Next steps + +- To learn more about the policy settings available to configure the Start menu using the Configuration Service Provider (CSP) and Group Policy (GPO), see [Start menu policy settings](policy-settings.md). +- To learn how to configure the taskbar, see [Configure the Windows taskbar](../taskbar/index.md). + + + +[MEM-1]: /mem/intune/configuration/custom-settings-windows-10 +[PS-1]: /powershell/module/startlayout/export-startlayout +[WIN-1]: /windows/client-management/mdm/policy-csp-start + + + diff --git a/windows/configuration/start/policy-settings.md b/windows/configuration/start/policy-settings.md new file mode 100644 index 0000000000..9dd5437ffc --- /dev/null +++ b/windows/configuration/start/policy-settings.md @@ -0,0 +1,194 @@ +--- +title: Start policy settings +description: Learn about the policy settings to configure the Windows Start menu. +ms.topic: reference +ms.date: 04/10/2024 +appliesto: +zone_pivot_groups: windows-versions-11-10 +--- + +# Start menu policy settings + +This reference article outlines the policy settings available for customizing the Start menu experience, using Configuration Service Provider (CSP) or group policy (GPO). For information about how to configure these settings, see [Configure the Start menu](index.md). + +The settings are categorized and presented in alphabetical order to facilitate navigation and configuration. + +:::row::: +:::column span="2"::: + +1. **Start layout**: settings to control the Start menu appearance and its behavior +1. **All apps options**: settings to control the All apps list +1. **Account options**: settings to control the options exposed when selecting the user account icon +1. **Pinned folders**: settings to control the folders pinned for quick access +1. **Power options**: settings to control the options exposed when selecting the power button + +:::column-end::: +:::column span="2"::: +::: zone pivot="windows-10" + :::image type="content" source="./images/windows-10-settings.png" alt-text="Sample start menu layout with its components highlighted." border="false" lightbox="./images/windows-10-settings.png"::: +::: zone-end + +::: zone pivot="windows-11" + :::image type="content" source="./images/windows-11-settings.png" alt-text="Sample start menu layout with its components highlighted." border="false" lightbox="./images/windows-11-settings.png"::: +::: zone-end + + :::column-end::: +:::row-end::: + +Select one of the tabs to see the list of available settings: + +#### [:::image type="icon" source="../images/icons/start.svg"::: **Layout**](#tab/start) + +::: zone pivot="windows-11" +|Policy name| CSP | GPO | +|-|-|-| +|[Configure Start pins](#configure-start-pins)|✅|❌| +|[Disable context menus](#disable-context-menus)|✅|✅| +|[Disable search](#disable-search)|✅|✅| +|[Don't use the search-based method when resolving shell shortcuts](#dont-use-the-search-based-method-when-resolving-shell-shortcuts)|❌|✅| +|[Don't use the tracking-based method when resolving shell shortcuts](#dont-use-the-tracking-based-method-when-resolving-shell-shortcuts)|❌|✅| +|[Prevent changes to Taskbar and Start Menu Settings](#prevent-changes-to-taskbar-and-start-menu-settings)|❌|✅| +|[Prevent users from customizing their Start](#prevent-users-from-customizing-their-start)|❌|✅| +|[Prevent users from uninstalling applications from Start](#prevent-users-from-uninstalling-applications-from-start)|❌|✅| +|[Remove common program groups](#remove-common-program-groups)|❌|✅| +|[Show **Run as different user** command](#show-run-as-different-user-command)|❌|✅| + +### Recommended section + +|Policy name| CSP | GPO | +|-|-|-| +|[Clear history of recently opened documents on exit](#clear-history-of-recently-opened-documents-on-exit)|❌|✅| +|[Hide recently added apps](#hide-recently-added-apps)|✅|✅| +|[Hide recent jumplists](#hide-recent-jumplists)|✅|✅| +|[Hide recommended personalized sites](#hide-recommended-personalized-sites)|✅|✅| +|[Hide recommended section](#hide-recommended-section)|✅|✅| + +::: zone-end + +::: zone pivot="windows-10" +|Policy name| CSP | GPO | +|-|-|-| +|[Clear history of recently opened documents on exit](#clear-history-of-recently-opened-documents-on-exit)|❌|✅| +|[Clear tile notifications during log on](#clear-tile-notifications-during-log-on)|❌|✅| +|[Configure Start layout](#configure-start-layout)|✅|✅| +|[Disable context menus](#disable-context-menus)|✅|✅| +|[Don't use the search-based method when resolving shell shortcuts](#dont-use-the-search-based-method-when-resolving-shell-shortcuts)|❌|✅| +|[Don't use the tracking-based method when resolving shell shortcuts](#dont-use-the-tracking-based-method-when-resolving-shell-shortcuts)|❌|✅| +|[Force Start size](#force-start-size)|✅|✅| +|[Hide recently added apps](#hide-recently-added-apps)|✅|✅| +|[Import Edge assets](#import-edge-assets)|✅|❌| +|[Prevent changes to Taskbar and Start Menu Settings](#prevent-changes-to-taskbar-and-start-menu-settings)|❌|✅| +|[Prevent users from customizing their Start](#prevent-users-from-customizing-their-start)|❌|✅| +|[Prevent users from uninstalling applications from Start](#prevent-users-from-uninstalling-applications-from-start)|❌|✅| +|[Remove common program groups](#remove-common-program-groups)|❌|✅| +|[Show **Run as different user** command](#show-run-as-different-user-command)|❌|✅| +::: zone-end + +[!INCLUDE [clear-history-of-recently-opened-documents-on-exit](includes/clear-history-of-recently-opened-documents-on-exit.md)] +::: zone pivot="windows-10" +[!INCLUDE [clear-tile-notifications-during-log-on](includes/clear-tile-notifications-during-log-on.md)] +[!INCLUDE [configure-start-layout](includes/configure-start-layout.md)] +::: zone-end +::: zone pivot="windows-11" +[!INCLUDE [configure-start-pins](includes/configure-start-pins.md)] +::: zone-end +[!INCLUDE [disable-context-menus](includes/disable-context-menus.md)] +::: zone pivot="windows-11" +[!INCLUDE [disable-search](includes/disable-search.md)] +::: zone-end +[!INCLUDE [do-not-use-the-search-based-method-when-resolving-shell-shortcuts](includes/do-not-use-the-search-based-method-when-resolving-shell-shortcuts.md)] +[!INCLUDE [do-not-use-the-tracking-based-method-when-resolving-shell-shortcuts](includes/do-not-use-the-tracking-based-method-when-resolving-shell-shortcuts.md)] +::: zone pivot="windows-10" +[!INCLUDE [force-start-size](includes/force-start-size.md)] +::: zone-end +[!INCLUDE [hide-recently-added-apps](includes/hide-recently-added-apps.md)] +[!INCLUDE [hide-recent-jumplists](includes/hide-recent-jumplists.md)] +::: zone pivot="windows-11" +[!INCLUDE [hide-recommended-personalized-sites](includes/hide-recommended-personalized-sites.md)] +[!INCLUDE [hide-recommended-section](includes/hide-recommended-section.md)] +::: zone-end +::: zone pivot="windows-10" +[!INCLUDE [import-edge-assets](includes/import-edge-assets.md)] +::: zone-end +[!INCLUDE [prevent-changes-to-taskbar-and-start-menu-settings](includes/prevent-changes-to-taskbar-and-start-menu-settings.md)] +[!INCLUDE [prevent-users-from-customizing-their-start](includes/prevent-users-from-customizing-their-start.md)] +[!INCLUDE [prevent-users-from-uninstalling-applications-from-start](includes/prevent-users-from-uninstalling-applications-from-start.md)] +[!INCLUDE [remove-common-program-groups](includes/remove-common-program-groups.md)] +[!INCLUDE [show-run-as-different-user-command](includes/show-run-as-different-user-command.md)] + +#### [:::image type="icon" source="../images/icons/allapps.svg"::: **All apps**](#tab/allapps) + +|Policy name| CSP | GPO | +|-|-|-| +|[Clear the recent programs list for new users](#clear-the-recent-programs-list-for-new-users)|❌|✅| +|[Hide app list](#hide-app-list)|✅|✅| +|[Hide frequently used apps](#hide-frequently-used-apps)|✅|✅| +|[Hide most used lists](#hide-most-used-lists)|✅|✅| + +[!INCLUDE [clear-the-recent-programs-list-for-new-users](includes/clear-the-recent-programs-list-for-new-users.md)] +[!INCLUDE [hide-app-list](includes/hide-app-list.md)] +[!INCLUDE [hide-frequently-used-apps](includes/hide-frequently-used-apps.md)] +[!INCLUDE [hide-most-used-lists](includes/hide-most-used-lists.md)] + +#### [:::image type="icon" source="../images/icons/user.svg"::: **Account options**](#tab/user) + +|Policy name| CSP | GPO | +|-|-|-| +|[Hide **Change account settings**](#hide-change-account-settings)|✅|❌| +|[Hide **Lock**](#hide-lock)|✅|❌| +|[Hide **Sign out**](#hide-sign-out)|✅|✅| +|[Hide **Switch account**](#hide-switch-account)|✅|❌| +|[Hide user tile](#hide-user-tile)|✅|❌| + +[!INCLUDE [hide-change-account-settings](includes/hide-change-account-settings.md)] +[!INCLUDE [hide-lock](includes/hide-lock.md)] +[!INCLUDE [hide-signout](includes/hide-signout.md)] +[!INCLUDE [hide-switch-user](includes/hide-switch-account.md)] +[!INCLUDE [hide-switch-user](includes/hide-user-tile.md)] + +#### [:::image type="icon" source="../images/icons/folder.svg"::: **Pinned folders**](#tab/folders) + +|Policy name| CSP | GPO | +|-|-|-| +|[Allow pinned folder Documents](#allow-pinned-folder-documents)|✅|❌| +|[Allow pinned folder Downloads](#allow-pinned-folder-downloads)|✅|❌| +|[Allow pinned folder File Explorer](#allow-pinned-folder-file-explorer)|✅|❌| +|[Allow pinned folder Home Group](#allow-pinned-folder-home-group)|✅|❌| +|[Allow pinned folder Music](#allow-pinned-folder-music)|✅|❌| +|[Allow pinned folder Network](#allow-pinned-folder-network)|✅|❌| +|[Allow pinned folder Personal Folder](#allow-pinned-folder-personal-folder)|✅|❌| +|[Allow pinned folder Pictures](#allow-pinned-folder-pictures)|✅|❌| +|[Allow pinned folder Settings](#allow-pinned-folder-settings)|✅|❌| +|[Allow pinned folder Videos](#allow-pinned-folder-videos)|✅|❌| + +[!INCLUDE [allow-pinned-folder-documents](includes/allow-pinned-folder-documents.md)] +[!INCLUDE [allow-pinned-folder-downloads](includes/allow-pinned-folder-downloads.md)] +[!INCLUDE [allow-pinned-folder-file-explorer](includes/allow-pinned-folder-file-explorer.md)] +[!INCLUDE [allow-pinned-folder-home-group](includes/allow-pinned-folder-home-group.md)] +[!INCLUDE [allow-pinned-folder-music](includes/allow-pinned-folder-music.md)] +[!INCLUDE [allow-pinned-folder-network](includes/allow-pinned-folder-network.md)] +[!INCLUDE [allow-pinned-folder-personal-folder](includes/allow-pinned-folder-personal-folder.md)] +[!INCLUDE [allow-pinned-folder-pictures](includes/allow-pinned-folder-pictures.md)] +[!INCLUDE [allow-pinned-folder-settings](includes/allow-pinned-folder-settings.md)] +[!INCLUDE [allow-pinned-folder-videos](includes/allow-pinned-folder-videos.md)] + +#### [:::image type="icon" source="../images/icons/power.svg"::: **Power options**](#tab/power) + +|Policy name| CSP | GPO | +|-|-|-| +|[Hide **Hibernate** ](#hide-hibernate)|✅|❌| +|[Hide **Power** button](#hide-power-button)|✅|❌| +|[Hide **Restart**](#hide-restart)|✅|❌| +|[Hide **Shut down**](#hide-shut-down)|✅|❌| +|[Hide **Sleep**](#hide-sleep)|✅|❌| +|[Remove and prevent access to the shut down restart sleep and hibernate commands](#remove-and-prevent-access-to-the-shut-down-restart-sleep-and-hibernate-commands)|❌|✅| + +[!INCLUDE [hide-hibernate](includes/hide-hibernate.md)] +[!INCLUDE [hide-power-button](includes/hide-power-button.md)] +[!INCLUDE [hide-restart](includes/hide-restart.md)] +[!INCLUDE [hide-shut-down](includes/hide-shut-down.md)] +[!INCLUDE [hide-sleep](includes/hide-sleep.md)] + +[!INCLUDE [remove-and-prevent-access-to-the-shut-down-restart-sleep-and-hibernate-commands](includes/remove-and-prevent-access-to-the-shut-down-restart-sleep-and-hibernate-commands.md)] + +--- diff --git a/windows/configuration/start/start-layout-xml-desktop.md b/windows/configuration/start/start-layout-xml-desktop.md deleted file mode 100644 index a0c742fc52..0000000000 --- a/windows/configuration/start/start-layout-xml-desktop.md +++ /dev/null @@ -1,526 +0,0 @@ ---- -title: Start layout XML for desktop editions of Windows 10 -description: This article describes the options for customizing Start layout in LayoutModification.xml for Windows 10 desktop editions. -ms.topic: reference -ms.date: 10/02/2018 -appliesto: -- ✅ Windows 10 ---- - -# Start layout XML for desktop editions of Windows 10 (reference) - ->**Looking for consumer information?** See [Customize the Start menu](https://go.microsoft.com/fwlink/p/?LinkId=623630) - -On Windows 10 for desktop editions, the customized Start works by: - -- Windows 10 checks the chosen base default layout, such as the desktop edition and whether Cortana is supported for the country/region. -- Windows 10 reads the LayoutModification.xml file and allows groups to be appended to Start. The groups have the following constraints: - - Two groups that are six columns wide, or equivalent to the width of three medium tiles. - - Two medium-sized tile rows in height. Windows 10 ignores any tiles that are pinned beyond the second row. - - No limit to the number of apps that can be pinned. There's a theoretical limit of 24 tiles per group (four small tiles per medium square x 3 columns x 2 rows). - ->[!NOTE] ->To use the layout modification XML to configure Start with roaming user profiles, see [Deploying Roaming User Profiles](/windows-server/storage/folder-redirection/deploy-roaming-user-profiles#step-7-optionally-specify-a-start-layout-for-windows-10-pcs). - -## LayoutModification XML - -IT admins can provision the Start layout using a LayoutModification.xml file. This file supports several mechanisms to modify or replace the default Start layout and its tiles. The easiest method for creating a LayoutModification.xml file is by using the Export-StartLayout cmdlet; see [Customize and export Start layout](customize-and-export-start-layout.md) for instructions. - -### Required order - -The XML schema for `LayoutModification.xml` requires the following order for tags directly under the LayoutModificationTemplate node: - -1. LayoutOptions -1. DefaultLayoutOverride -1. RequiredStartGroupsCollection -1. AppendDownloadOfficeTile - OR - AppendOfficeSuite (only one Office option can be used at a time) -1. AppendOfficeSuiteChoice -1. TopMFUApps -1. CustomTaskbarLayoutCollection -1. InkWorkspaceTopApps -1. StartLayoutCollection - -Comments are not supported in the `LayoutModification.xml` file. - -### Supported elements and attributes - ->[!NOTE] ->To make sure the Start layout XML parser processes your file correctly, follow these guidelines when working with your LayoutModification.xml file: -> ->- Do not leave spaces or white lines in between each element. ->- Do not add comments inside the StartLayout node or any of its children elements. ->- Do not add multiple rows of comments. - -The following table lists the supported elements and attributes for the LayoutModification.xml file. - -> [!NOTE] -> RequiredStartGroupsCollection and AppendGroup syntax only apply when the Import-StartLayout method is used for building and deploying Windows images. - -| Element | Attributes | Description | -| --- | --- | --- | -| LayoutModificationTemplate | xmlns
xmlns:defaultlayout
xmlns:start
Version | Use to describe the changes to the default Start layout | -| [LayoutOptions](#layoutoptions)

Parent:
LayoutModificationTemplate | StartTileGroupsColumnCount
FullScreenStart | Use to specify:
- Whether to use full screen Start on the desktop
- The number of tile columns in the Start menu | -| RequiredStartGroupsCollection

Parent:
LayoutModificationTemplate | n/a | Use to contain collection of RequiredStartGroups | -| [RequiredStartGroups](#requiredstartgroups)

Parent:
RequiredStartGroupsCollection | Region | Use to contain the AppendGroup tags, which represent groups that can be appended to the default Start layout | -| [AppendGroup](#appendgroup)

Parent:
RequiredStartGroups | Name | Use to specify the tiles that need to be appended to the default Start layout | -| [start:Tile](#specify-start-tiles)

Parent:
AppendGroup | AppUserModelID
Size
Row
Column | Use to specify any of the following:
- A Universal Windows app
- A Windows 8 or Windows 8.1 app

Note that AppUserModelID is case-sensitive. | -| start:Folder

Parent:
start:Group | Name (in Windows 10, version 1809 and later only)
Size
Row
Column
LocalizedNameResourcetag | Use to specify a folder of icons; can include [Tile](#start-tile), [SecondaryTile](#start-secondarytile), and [DesktopApplicationTile](#start-desktopapplicationtile). | -| start:DesktopApplicationTile

Parent:
AppendGroup | DesktopApplicationID
DesktopApplicationLinkPath
Size
Row
Column | Use to specify any of the following:
- A Windows desktop application with a known AppUserModelID
- An application in a known folder with a link in a legacy Start Menu folder
- A Windows desktop application link in a legacy Start Menu folder
- A Web link tile with an associated `.url` file that is in a legacy Start Menu folder | -| start:SecondaryTile

Parent:
AppendGroup | AppUserModelID
TileID
Arguments
DisplayName
Square150x150LogoUri
ShowNameOnSquare150x150Logo
ShowNameOnWide310x150Logo
Wide310x150LogoUri
BackgroundColor
ForegroundText
IsSuggestedApp
Size
Row
Column | Use to pin a Web link through a Microsoft Edge secondary tile. Note that AppUserModelID is case-sensitive. | -| TopMFUApps

Parent:
LayoutModificationTemplate | n/a | Use to add up to three default apps to the frequently used apps section in the system area.

**Note**: Only applies to versions of Windows 10 earlier than version 1701. In Windows 10, version 1709, you can no longer pin apps to the Most Frequently Used apps list in Start. | -| Tile

Parent:
TopMFUApps | AppUserModelID | Use with the TopMFUApps tags to specify an app with a known AppUserModelID.

**Note**: Only applies to versions of Windows 10 earlier than version 1701. In Windows 10, version 1709, you can no longer pin apps to the Most Frequently Used apps list in Start. | -| DesktopApplicationTile

Parent:
TopMFUApps | LinkFilePath | Use with the TopMFUApps tags to specify an app without a known AppUserModelID.

**Note**: Only applies to versions of Windows 10 earlier than version 1701. In Windows 10, version 1709, you can no longer pin apps to the Most Frequently Used apps list in Start. | -| AppendOfficeSuite

Parent:
LayoutModificationTemplate | n/a | Use to add the in-box installed Office suite to Start. For more information, see [Customize the Office suite of tiles](/windows-hardware/customize/desktop/customize-start-layout#customize-the-office-suite-of-tiles).

Don't use this tag with AppendDownloadOfficeTile. | -| AppendDownloadOfficeTile

Parent:
LayoutModificationTemplate | n/a | Use to add a specific **Download Office** tile to a specific location in Start

Do not use this tag with AppendOfficeSuite | - -### LayoutOptions - -New devices running Windows 10 for desktop editions will default to a Start menu with two columns of tiles unless boot to tablet mode is enabled. Devices with screens that are under 10" have boot to tablet mode enabled by default. For these devices, users see the full screen Start on the desktop. You can adjust the following features: - -- Boot to tablet mode can be set on or off -- Set full screen Start on desktop to on or off - To do this, add the LayoutOptions element in your LayoutModification.xml file and set the FullScreenStart attribute to true or false -- Specify the number of columns in the Start menu to 1 or 2 - To do this, add the LayoutOptions element in your LayoutModification.xml file and set the StartTileGroupsColumnCount attribute to 1 or 2 - -The following example shows how to use the LayoutOptions element to specify full screen Start on the desktop and to use one column in the Start menu: - -```XML - - - -``` - -For devices being upgraded to Windows 10 for desktop editions: - -- Devices being upgraded from Windows 7 will default to a Start menu with one column. -- Devices being upgraded from Windows 8.1 or Windows 8.1 Upgrade will default to a Start menu with two columns. - -### RequiredStartGroups - -The **RequiredStartGroups** tag contains **AppendGroup** tags that represent groups that you can append to the default Start layout. - ->[!IMPORTANT] ->For Windows 10 for desktop editions, you can add a maximum of two (2) **AppendGroup** tags per **RequiredStartGroups** tag. - -You can also assign regions to the append groups in the **RequiredStartGroups** tag's using the optional **Region** attribute or you can use the multivariant capabilities in Windows provisioning. If you're using the **Region** attribute, you must use a two-letter country code to specify the country/region that the append group(s) apply to. To specify more than one country/region, use a pipe ("|") delimiter as shown in the following example: - -```XML - -``` - -If the country/region setting for the Windows device matches a **RequiredStartGroups**, then the tiles laid out within the **RequiredStartGroups** is applied to Start. - -If you specify a region-agnostic **RequiredStartGroups** (or one without the optional Region attribute), then the region-agnostic **RequiredStartGroups** is applied to Start. - -### AppendGroup - -**AppendGroup** tags specify a group of tiles that will be appended to Start. There is a maximum of two **AppendGroup** tags allowed per **RequiredStartGroups** tag. - -For Windows 10 for desktop editions, AppendGroup tags contain start:Tile, start:DesktopApplicationTile, or start:SecondaryTile tags. - -You can specify any number of tiles in an **AppendGroup**, but you can't specify a tile with a **Row** attribute greater than 1. The Start layout doesn't support overlapping tiles. - -### Specify Start tiles - -To pin tiles to Start, partners must use the right tile depending on what you want to pin. - -#### Tile size and coordinates - -All tile types require a size (**Size**) and coordinates (**Row** and **Column**) attributes regardless of the tile type that you use when prepinning items to Start. - -The following table describes the attributes that you must use to specify the size and location for the tile. - -| Attribute | Description | -| --- | --- | -| Size | Determines how large the tile will be.

- 1x1 - small tile
- 2x2 - medium tile
- 4x2 - wide tile
- 4x4 - large tile | -| Row | Specifies the row where the tile will appear. | -| Column | Specifies the column where the tile will appear. | - -For example, a tile with Size="2x2", Row="2", and Column="2" results in a tile located at (2,2) where (0,0) is the top-left corner of a group. - - -#### start:Tile - -You can use the **start:Tile** tag to pin any of the following apps to Start: - -- A Universal Windows app -- A Windows 8 app or Windows 8.1 app - -To specify any one of these apps, you must set the **AppUserModelID** attribute to the application user model ID that's associated with the corresponding app. - ->[!IMPORTANT] ->**AppUserModelID** (AUMID) is case-sensitive. - -The following example shows how to pin the Microsoft Edge Universal Windows app: - - ```XML - - ``` - - -#### start:DesktopApplicationTile - -You can use the **start:DesktopApplicationTile** tag to pin a Windows desktop application to Start. There are two ways you can specify a Windows desktop application: - -- Use a path to a shortcut link (.lnk file) to a Windows desktop application. - - >[!NOTE] - >In Start layouts for Windows 10, version 1703, you should use **DesktopApplicationID** rather than **DesktopApplicationLinkPath** if you are using Group Policy or MDM to apply the start layout and the application was installed after the user's first sign-in. - - To pin a Windows desktop application through this method, you must first add the .lnk file in the specified location when the device first boots. - - The following example shows how to pin the Command Prompt: - - ```XML - - ``` - - You must set the **DesktopApplicationLinkPath** attribute to the .lnk file that points to the Windows desktop application. The path also supports environment variables. - - If you are pointing to a third-party Windows desktop application and the layout is being applied before the first boot, you must put the .lnk file in a legacy Start Menu directory before first boot; for example, "%APPDATA%\Microsoft\Windows\Start Menu\Programs\" or the all users profile "%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\". - -- Use the application's application user model ID, if this is known. If the Windows desktop application doesn't have one, use the shortcut link option. - - You can use the [Get-StartApps cmdlet](/powershell/module/startlayout/get-startapps) on a PC that has the application pinned to Start to obtain the app ID. - - To pin a Windows desktop application through this method, you must set the **DesktopApplicationID** attribute to the application user model ID that's associated with the corresponding app. - - The following example shows how to pin the File Explorer Windows desktop application: - - ```XML - - ``` - -You can also use the **start:DesktopApplicationTile** tag as one of the methods for pinning a Web link to Start. The other method is to use a Microsoft Edge secondary tile. - -To pin a legacy `.url` shortcut to Start, you must create a `.url` file (right-click on the desktop, select **New** > **Shortcut**, and then type a Web URL). You must add this `.url` file in a legacy Start Menu directory before first boot; for example, `%APPDATA%\Microsoft\Windows\Start Menu\Programs\` or the all users profile `%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\`. - -The following example shows how to create a tile of the Web site's URL, which you can treat similarly to a Windows desktop application tile: - -```XML - -``` - ->[!NOTE] ->In Windows 10, version 1703, **Export-StartLayout** will use **DesktopApplicationLinkPath** for the .url shortcut. You must change **DesktopApplicationLinkPath** to **DesktopApplicationID** and provide the URL. - - -#### start:SecondaryTile - -You can use the **start:SecondaryTile** tag to pin a Web link through a Microsoft Edge secondary tile. This method doesn't require any additional action compared to the method of using legacy `.url` shortcuts (through the start:DesktopApplicationTile tag). - -The following example shows how to create a tile of the Web site's URL using the Microsoft Edge secondary tile: - -```XML - -``` - -The following table describes the other attributes that you can use with the **start:SecondaryTile** tag in addition to **Size**, **Row**, and **Column**. - -| Attribute | Required/optional | Description | -| --- | --- | --- | -| AppUserModelID | Required | Must point to Microsoft Edge. Note that AppUserModelID is case-sensitive. | -| TileID | Required | Must uniquely identify your Web site tile. | -| Arguments | Required | Must contain the URL of your Web site. | -| DisplayName | Required | Must specify the text that you want users to see. | -| Square150x150LogoUri | Required | Specifies the logo to use on the 2x2 tile. | -| Wide310x150LogoUri | Optional | Specifies the logo to use on the 4x2 tile. | -| ShowNameOnSquare150x150Logo | Optional | Specifies whether the display name is shown on the 2x2 tile. The values you can use for this attribute are true or false. | -| ShowNameOnWide310x150Logo | Optional | Specifies whether the display name is shown on the 4x2 tile. The values you can use for this attribute are true or false. | -| BackgroundColor | Optional | Specifies the color of the tile. You can specify the value in ARGB hexadecimal (for example, #FF112233) or specify "transparent". | -| ForegroundText | Optional | Specifies the color of the foreground text. Set the value to either "light" or "dark". | - -Secondary Microsoft Edge tiles have the same size and location behavior as a Universal Windows app, Windows 8 app, or Windows 8.1 app. - -#### TopMFUApps - ->[!NOTE] ->Only applies to versions of Windows 10 earlier than version 1701. In Windows 10, version 1709, you can no longer pin apps to the Most Frequently Used apps list in Start. - -You can use the **TopMFUApps** tag to add up to 3 default apps to the frequently used apps section in the system area, which delivers system-driven lists to the user including important or frequently accessed system locations and recently installed apps. - -You can use this tag to add: - -- Apps with an **AppUserModelID** attribute - This includes Windows desktop applications that have a known application user model ID. Use a **Tile** tag with the **AppUserModelID** attribute set to the app's application user model ID. -- Apps without a **AppUserModelID** attribute - For these apps, you must create a .lnk file that points to the installed app and place the .lnk file in the `%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs` directory. Use a **DesktopApplicationTile** tag with the **LinkFilePath** attribute set to the .lnk file name and path. - -The following example shows how to modify your LayoutModification.xml file to add both kinds of apps to the system area in Start: - - ```XML - - - - - - - -``` - -#### AppendOfficeSuite - -You can use the **AppendOfficeSuite** tag to add the in-box installed Office suite of apps to Start. - ->[!NOTE] ->The OEM must have installed Office for this tag to work. - -The following example shows how to add the **AppendOfficeSuite** tag to your LayoutModification.xml file to append the full Universal Office suite to Start: - -```XML - - - -``` - -#### AppendOfficeSuiteChoice - -This tag is added in Windows 10, version 1801. You have two options in this tag: - -- `` -- `` - -Use `Choice=DesktopBridgeSubscription` on devices running Windows 10, version 1803, that have Office 365 preinstalled. This will set the heading of the Office suite of tiles to **Office 365**, to highlight the Office 365 apps that you've made available on the device. - -Use `Choice=DesktopBridge` on devices running versions of Windows 10 earlier than version 1803, and on devices shipping with [perpetual licenses for Office](/archive/blogs/ausoemteam/choosing-the-right-office-version-for-your-customers). This will set the heading of the Office suite of tiles to **Create**. - -For more information, see [Customize the Office suite of tiles](/windows-hardware/customize/desktop/customize-start-layout#customize-the-office-suite-of-tiles). - -#### AppendDownloadOfficeTile - -You can use the **AppendDownloadOfficeTile** tag to append the Office trial installer to Start. This tag adds the **Download Office** tile to Start and the download tile will appear at the bottom right-hand side of the second group. - ->[!NOTE] ->The OEM must have installed the Office trial installer for this tag to work. - -The following example shows how to add the **AppendDownloadOfficeTile** tag to your LayoutModification.xml file: - -```XML - - - -``` - -## Sample LayoutModification.xml - -The following sample LayoutModification.xml shows how you can configure the Start layout for devices running Windows 10 for desktop editions: - -```XML - - - - - - - - - - - - - - - - - - - - - - - - - -``` - -## Use Windows Provisioning multivariant support - -The Windows Provisioning multivariant capability allows you to declare target conditions that, when met, supply specific customizations for each variant condition. For Start customization, you can create specific layouts for each variant that you have. To do this, you must create a separate LayoutModification.xml file for each variant that you want to support and then include these in your provisioning package. For more information on how to do this, see [Create a provisioning package with multivariant settings](../provisioning-packages/provisioning-multivariant.md). - -The provisioning engine chooses the right customization file based on the target conditions that were met, adds the file in the location that's specified for the setting, and then uses the specific file to customize Start. To differentiate between layouts, you can add modifiers to the LayoutModification.xml filename such as "LayoutCustomization1". Regardless of the modifier that you use, the provisioning engine will always output "LayoutCustomization.xml" so that the operating system has a consistent file name to query against. - -For example, if you want to ensure that there's a specific layout for a certain condition, you can: - -1. Create a specific layout customization file and then name it LayoutCustomization1.xml. -1. Include the file as part of your provisioning package. -1. Create your multivariant target and reference the XML file within the target condition in the main customization XML file. - -The following example shows what the overall customization file might look like with multivariant support for Start: - -```XML - - - - {6aaa4dfa-00d7-4aaa-8adf-73c6a7e2501e} - My Provisioning Package - 1.0 - OEM - 50 - - - - - - - - - - - - - - - - - - - - - - 1 - - 1 - - 1 - - - - - - 1 - - - - - - - - - - - - c:\users\\appdata\local\Microsoft\Windows\Shell\LayoutCustomization1.XML - - 1 - - - - - - -``` - -When the condition is met, the provisioning engine takes the XML file and places it in the location that the operating system has set and then the Start subsystem reads the file and applies the specific customized layout. - -You must repeat this process for all variants that you want to support so that each variant can have a distinct layout for each of the conditions and targets that need to be supported. For example, if you add a **Language** condition, you can create a Start layout that has its own localized group. - -## Add the LayoutModification.xml file to the device - -Once you have created your LayoutModification.xml file to customize devices that will run Windows 10 for desktop editions, you can use Windows ICD methods to add the XML file to the device. - -1. In the **Available customizations** pane, expand **Runtime settings**, select **Start** > Select the **StartLayout** setting. -1. In the middle pane, click **Browse** to open File Explorer. -1. In the File Explorer window, navigate to the location where you saved your LayoutModification.xml file. - -1. Select the file and then click **Open**. - -This should set the value of **StartLayout**. The setting appears in the **Selected customizations** pane. - ->[!NOTE] ->There is currently no way to add the .url and .lnk files through Windows ICD. - -Once you have created the LayoutModification.xml file and it is present in the device, the system overrides the base default layout and any Unattend settings used to customize Start. diff --git a/windows/configuration/start/start-secondary-tiles.md b/windows/configuration/start/start-secondary-tiles.md deleted file mode 100644 index 17a578d2dd..0000000000 --- a/windows/configuration/start/start-secondary-tiles.md +++ /dev/null @@ -1,192 +0,0 @@ ---- -title: Add image for secondary Microsoft Edge tiles -description: Add app tiles on Windows 10 that's a secondary tile. -ms.topic: how-to -ms.date: 12/31/2017 ---- - -# Add image for secondary Microsoft Edge tiles - -App tiles are the Start screen tiles that represent and launch an app. A tile that allows a user to go to a specific location in an app is a *secondary tile*. Some examples of secondary tiles include: - -- Weather updates for a specific city in a weather app -- A summary of upcoming events in a calendar app -- Status and updates from an important contact in a social app -- A website in Microsoft Edge - -Suppose that the [Start layout that you export](customize-and-export-start-layout.md) had two secondary tiles, such as in the following image: - -![tile for MSN and for a SharePoint site.](images/edge-with-logo.png) - -By using the PowerShell cmdlet `export-StartLayoutEdgeAssets` and the policy setting `ImportEdgeAssets`, the tiles display the same as they did on the device from which you exported the Start layout. - -![tile for MSN and for a SharePoint site.](images/edge-with-logo.png) - -Example of secondary tiles in XML generated by Export-StartLayout: - -```xml - -``` - -## Export Start layout and assets - -1. Follow the instructions in [Customize and export Start layout](customize-and-export-start-layout.md#customize-the-start-screen-on-your-test-computer) to customize the Start screen on your test computer. -1. Open Windows PowerShell as an administrator and enter the following command: - - ```powershell - Export-StartLayout -path .xml - ``` - - In the previous command, `-path` is a required parameter that specifies the path and file name for the export file. You can specify a local path or a UNC path (for example, \\\\FileServer01\\StartLayouts\\StartLayoutMarketing.xml). - - Use a file name of your choice—for example, StartLayoutMarketing.xml. Include the .xml file name extension. The [Export-StartLayout](/powershell/module/startlayout/export-startlayout) cmdlet doesn't append the file name extension, and the policy settings require the extension. - -1. If you'd like to change the image for a secondary tile to your own custom image, open the layout.xml file, and look for the images that the tile references. - - For example, your layout.xml contains `Square150x150LogoUri="ms-appdata:///local/PinnedTiles/21581260870/hires.png" Wide310x150LogoUri="ms-appx:///"` - - - Open `C:\Users\\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\LocalState\PinnedTiles\21581260870\` and replace those images with your customized images. - -1. In Windows PowerShell, enter the following command: - - ```powershell - Export-StartLayoutEdgeAssets assets.xml - ``` - -## Configure policy settings - -You can apply the customized Start layout with images for secondary tiles by using mobile device management (MDM) or a provisioning package. However, because you're including the images for secondary tiles, you must configure another setting to import the Edge assets. - -### Using MDM - -In Microsoft Intune, you create a device restrictions policy to apply to device group. For other MDM solutions, you may need to use an OMA-URI setting for Start layout, based on the [Policy configuration service provider (CSP)](/windows/client-management/mdm/policy-configuration-service-provider). The OMA-URI setting is `./User/Vendor/MSFT/Policy/Config/Start/StartLayout`. - -1. Sign in to the [Intune admin center](https://go.microsoft.com/fwlink/?linkid=2109431). -1. Select **Devices** > **Configuration profiles** > **Create profile**. -1. Enter the following properties: - - - **Platform**: Select **Windows 10 and later**. - - **Profile**: Select **Templates** > **Device restrictions**. - -1. Select **Create**. -1. In **Basics**, enter the following properties: - - - **Name**: Enter a descriptive name for the policy. Name your policies so you can easily identify them later. - - **Description**: Enter a description for the policy. This setting is optional, but recommended. - -1. Select **Next**. - -1. In **Configuration settings**, select **Start**. Configure the following properties: - - - **Start menu layout**: Browse to, and select your Start layout XML file. - - **Pin websites to tiles in Start menu**: Browse to, and select your assets XML file. - - There are more Start menu settings you can configure. For more information on these settings, see [Start settings in Intune](/intune/device-restrictions-windows-10#start) - -1. Select **Next**. -1. In **Scope tags** (optional), assign a tag to filter the profile to specific IT groups, such as `US-NC IT Team` or `JohnGlenn_ITDepartment`. For more information about scope tags, see [Use RBAC and scope tags for distributed IT](/mem/intune/fundamentals/scope-tags). - - Select **Next**. - -1. In **Assignments**, select the users or groups that will receive your profile. For more information on assigning profiles, see [Assign user and device profiles](/mem/intune/configuration/device-profile-assign). - - Select **Next**. - -1. In **Review + create**, review your settings. When you select **Create**, your changes are saved, and the profile is assigned. The policy is also shown in the profiles list. - -### Using a provisioning package - -#### Prepare the Start layout and Edge assets XML files - -The **export-StartLayout** and **export-StartLayoutEdgeAssets** cmdlets produce XML files. Because Windows Configuration Designer produces a customizations.xml file that contains the configuration settings, adding the Start layout and Edge assets sections to the customizations.xml file directly would result in an XML file embedded in an XML file. Before you add the Start layout and Edge assets sections to the customizations.xml file, you must replace the markup characters in your layout.xml with escape characters. - -1. Copy the contents of layout.xml into an online tool that escapes characters. - -1. Copy the contents of assets.xml into an online tool that escapes characters. - -1. When you create a provisioning package, you'll copy the text with the escape characters and paste it in the customizations.xml file for your project. - -#### Create a provisioning package that contains a customized Start layout - -Use the Windows Configuration Designer tool to create a provisioning package. [Learn how to install Windows Configuration Designer.](../provisioning-packages/provisioning-install-icd.md) - ->[!IMPORTANT] ->When you build a provisioning package, you may include sensitive information in the project files and in the provisioning package (.ppkg) file. Although you have the option to encrypt the .ppkg file, project files are not encrypted. You should store the project files in a secure location and delete the project files when they are no longer needed. - -1. Open Windows Configuration Designer (by default, %systemdrive%\\Program Files (x86)\\Windows Kits\\10\\Assessment and Deployment Kit\\Imaging and Configuration Designer\\x86\\ICD.exe). - -1. Choose **Advanced provisioning**. - -1. Name your project, and select **Next**. - -1. Choose **All Windows desktop editions** and select **Next**. - -1. On **New project**, select **Finish**. The workspace for your package opens. - -1. Expand **Runtime settings** > **Policies** > **Start**, and select **StartLayout**. - - >[!TIP] - >If **Start** is not listed, check the type of settings you selected in step 1. You must create the project using settings for **All Windows desktop editions**. - -1. Enter **layout.xml**. This value creates a placeholder in the customizations.xml file that you'll replace with the contents of the layout.xml file in a later step. - -1. In the **Available customizations** pane, select **ImportEdgeAssets**. - -1. Enter **assets.xml**. This value creates a placeholder in the customizations.xml file that you'll replace with the contents of the assets.xml file in a later step. - -1. Save your project and close Windows Configuration Designer. - -1. In File Explorer, open the project's directory. (The default location is C:\Users\\*user name*\Documents\Windows Imaging and Configuration Designer (WICD)\\*project name*) - -1. Open the customizations.xml file in a text editor. - -1. Replace **layout.xml** with the text from the layout.xml file, [with markup characters replaced with escape characters](#escape). - -1. Replace **assets.xml** with the text from the assets.xml file, [with markup characters replaced with escape characters](#escape). - -1. Save and close the customizations.xml file. - -1. Open Windows Configuration Designer and open your project. - -1. On the **File** menu, select **Save.** - -1. On the **Export** menu, select **Provisioning package**. - -1. Change **Owner** to **IT Admin**, which will set the precedence of this provisioning package higher than provisioning packages applied to this device from other sources, and then select **Next.** - -1. Optional. In the **Provisioning package security** window, you can choose to encrypt the package and enable package signing. - - - **Enable package encryption** - If you select this option, an auto-generated password will be shown on the screen. - - - **Enable package signing** - If you select this option, you must select a valid certificate to use for signing the package. You can specify the certificate by clicking **Select...** and choosing the certificate you want to use to sign the package. - -1. Select **Next** to specify the output location where you want the provisioning package to go when it's built. By default, Windows Imaging and Configuration Designer (ICD) uses the project folder as the output location. - - Optionally, you can select **Browse** to change the default output location. - -1. Select **Next**. - -1. Select **Build** to start building the package. The provisioning package doesn't take long to build. The project information is displayed in the build page and the progress bar indicates the build status. - - If you need to cancel the build, select **Cancel**. It cancels the current build process, closes the wizard, and takes you back to the **Customizations Page**. - -1. If your build fails, an error message will show up that includes a link to the project folder. You can scan the logs to determine what caused the error. Once you fix the issue, try building the package again. - - If your build is successful, the name of the provisioning package, output directory, and project directory will be shown. - - - If you choose, you can build the provisioning package again and pick a different path for the output package. To change the path, select **Back** to change the output package name and path, and then select **Next** to start another build. - - If you're done, select **Finish** to close the wizard and go back to the **Customizations Page**. - -1. Copy the provisioning package to the target device. -1. Double-click the ppkg file and allow it to install. diff --git a/windows/configuration/start/supported-csp-start-menu-layout-windows.md b/windows/configuration/start/supported-csp-start-menu-layout-windows.md deleted file mode 100644 index a42bb23a00..0000000000 --- a/windows/configuration/start/supported-csp-start-menu-layout-windows.md +++ /dev/null @@ -1,71 +0,0 @@ ---- -title: Supported CSP policies to customize Start menu on Windows 11 | Microsoft Docs -description: See a list of the Policy CSP - Start items that are supported on Windows 11 to customize the Start menu. -ms.date: 12/31/2017 -ms.topic: reference -appliesto: -- ✅ Windows 11 ---- - -# Supported configuration service provider (CSP) policies for Windows 11 Start menu - -The Windows OS exposes CSPs that are used by MDM providers, like [Microsoft Intune](/mem/intune/fundamentals/what-is-intune). In an MDM policy, these CSPs are settings that you configure in a policy. When the policy is ready, you deploy the policy to your devices. - -This article lists the CSPs that are available to customize the Start menu for Windows 11 devices. Windows 11 uses the [Policy CSP - Start](/windows/client-management/mdm/policy-csp-start). For more general information, see [Configuration service provider (CSP) reference](/windows/client-management/mdm/configuration-service-provider-reference). - -For information on customizing the Start menu layout using policy, see [Customize the Start menu layout](customize-and-export-start-layout.md). - -## Existing Windows CSP policies that Windows 11 supports - -- [Start/AllowPinnedFolderDocuments](/windows/client-management/mdm/policy-csp-start#start-allowpinnedfolderdocuments) -- [Start/AllowPinnedFolderDownloads](/windows/client-management/mdm/policy-csp-start#start-allowpinnedfolderfileexplorer) -- [Start/AllowPinnedFolderFileExplorer](/windows/client-management/mdm/policy-csp-start#start-allowpinnedfolderhomegroup) -- [Start/AllowPinnedFolderHomeGroup](/windows/client-management/mdm/policy-csp-start#start-allowpinnedfolderhomegroup) -- [Start/AllowPinnedFolderMusic](/windows/client-management/mdm/policy-csp-start#start-allowpinnedfoldermusic) -- [Start/AllowPinnedFolderNetwork](/windows/client-management/mdm/policy-csp-start#start-allowpinnedfoldernetwork) -- [Start/AllowPinnedFolderPersonalFolder](/windows/client-management/mdm/policy-csp-start#start-allowpinnedfolderpersonalfolder) -- [Start/AllowPinnedFolderPictures](/windows/client-management/mdm/policy-csp-start#start-allowpinnedfolderpictures) -- [Start/AllowPinnedFolderSettings](/windows/client-management/mdm/policy-csp-start#start-allowpinnedfoldersettings) -- [Start/AllowPinnedFolderVideos](/windows/client-management/mdm/policy-csp-start#start-allowpinnedfoldervideos) -- [Start/HideChangeAccountSettings](/windows/client-management/mdm/policy-csp-start#start-hidechangeaccountsettings) -- [Start/HideHibernate](/windows/client-management/mdm/policy-csp-start#start-hidehibernate) -- [Start/HideLock](/windows/client-management/mdm/policy-csp-start#start-hidelock) -- [Start/HidePowerButton](/windows/client-management/mdm/policy-csp-start#start-hidepowerbutton) -- [Start/HideRestart](/windows/client-management/mdm/policy-csp-start#start-hiderestart) -- [Start/HideShutDown](/windows/client-management/mdm/policy-csp-start#start-hideshutdown) -- [Start/HideSignOut](/windows/client-management/mdm/policy-csp-start#start-hidesignout) -- [Start/HideSleep](/windows/client-management/mdm/policy-csp-start#start-hidesleep) -- [Start/HideSwitchAccount](/windows/client-management/mdm/policy-csp-start#start-hideswitchaccount) -- [Start/HideUserTile](/windows/client-management/mdm/policy-csp-start#start-hideusertile) -- [Start/HideRecentJumplists](/windows/client-management/mdm/policy-csp-start#start-hiderecentjumplists) -- [Start/NoPinningToTaskbar](/windows/client-management/mdm/policy-csp-start#start-nopinningtotaskbar) -- **Start/ShowOrHideMostUsedApps**: New policy starting with Windows 11. This policy enforces always showing Most Used Apps, or always hiding Most Used Apps in the Start menu. If you use this policy, the [Start/HideFrequentlyUsedApps](/windows/client-management/mdm/policy-csp-start#start-hidefrequentlyusedapps) policy is ignored. - - The [Start/HideFrequentlyUsedApps](/windows/client-management/mdm/policy-csp-start#start-hidefrequentlyusedapps) policy enforces hiding Most Used Apps on the Start menu. You can't use this policy to enforce always showing Most Used Apps on the Start menu. - -**The following policies are supported starting with Windows 11, version 22H2:** - -- [Start/HideAppList](/windows/client-management/mdm/policy-csp-start#start-hideapplist) -- [Start/DisableContextMenus](/windows/client-management/mdm/policy-csp-start#start-disablecontextmenus) - -## Existing CSP policies that Windows 11 doesn't support - -- [Start/StartLayout](/windows/client-management/mdm/policy-csp-start#start-startlayout) - - Group policy: `User Configuration\Administrative Templates\Start Menu and Taskbar\Start Layout` - -- [Start/HideRecentlyAddedApps](/windows/client-management/mdm/policy-csp-start#start-hiderecentlyaddedapps) -- Group policy: `Computer Configuration\Administrative Templates\Start Menu and Taskbar\Remove "Recently added" list from Start Menu` - -> [!NOTE] -> The following two policies are supported starting in Windows 11, version 22H2 - -- [Start/HideAppList](/windows/client-management/mdm/policy-csp-start#start-hideapplist) - - Group policy: - - `Computer Configuration\Administrative Templates\Start Menu and Taskbar\Remove All Programs list from the Start menu` - - `User Configuration\Administrative Templates\Start Menu and Taskbar\Remove All Programs list from the Start menu` - -- [Start/DisableContextMenus](/windows/client-management/mdm/policy-csp-start#start-disablecontextmenus) - - Group policy: - - - `Computer Configuration\Administrative Templates\Start Menu and Taskbar\Disable context menus in the Start Menu` - - `User Configuration\Administrative Templates\Start Menu and Taskbar\Disable context menus in the Start Menu` diff --git a/windows/configuration/start/toc.yml b/windows/configuration/start/toc.yml index 77492cb6fe..13f6bda470 100644 --- a/windows/configuration/start/toc.yml +++ b/windows/configuration/start/toc.yml @@ -1,15 +1,12 @@ items: -- name: Customize and export the Start layout - href: customize-and-export-start-layout.md -- name: Supported Start menu CSPs - href: supported-csp-start-menu-layout-windows.md -- name: Start layout and taskbar - href: windows-10-start-layout-options-and-policies.md -- name: Use XML - items: - - name: Add image for secondary Microsoft Edge tiles - href: start-secondary-tiles.md - - name: Start layout XML for Windows 10 desktop editions (reference) - href: start-layout-xml-desktop.md +- name: Overview + href: index.md + displayName: Configure the Start menu +- name: Customize the Start layout + href: layout.md +- name: Policy settings + href: policy-settings.md +- name: XML schema definition (XSD) + href: xsd.md - name: Troubleshoot Start menu errors 🔗 href: /troubleshoot/windows-client/shell-experience/troubleshoot-start-menu-errors diff --git a/windows/configuration/start/windows-10-start-layout-options-and-policies.md b/windows/configuration/start/windows-10-start-layout-options-and-policies.md deleted file mode 100644 index aa22d3e5da..0000000000 --- a/windows/configuration/start/windows-10-start-layout-options-and-policies.md +++ /dev/null @@ -1,190 +0,0 @@ ---- -title: Customize and manage the Windows 10 Start and taskbar layout -description: On Windows devices, customize the start menu layout and taskbar using XML, group policy, provisioning package, or MDM policy. You can add pinned folders, add a start menu size, pin apps to the taskbar, and more. -ms.topic: how-to -ms.date: 08/05/2021 -appliesto: -- ✅ Windows 10 ---- - -# Customize the Start menu and taskbar layout on Windows 10 and later devices - -> **Looking for consumer information?** [See what's on the Start menu](https://support.microsoft.com/help/17195/windows-10-see-whats-on-the-menu) -> -> **Looking for OEM information?** See [Customize the Taskbar](/windows-hardware/customize/desktop/customize-the-windows-11-taskbar) and [Customize the Start layout](/windows-hardware/customize/desktop/customize-the-windows-11-start-menu). - -Your organization can deploy a customized Start and taskbar to Windows 10 Professional, Enterprise, or Education devices. Use a standard, customized Start layout on devices that are common to multiple users, and devices that are locked down. Configuring the taskbar allows you to pin useful apps for your users, and remove apps that are pinned by default. - ->[!NOTE] ->Support for applying a customized taskbar using MDM is added in Windows 10, version 1701. - -As administrator, you can use these features to customize Start and taskbar to meet your organization needs. This article describes the different ways you can customize Start and taskbar, and lists the Start policies. It also includes taskbar information on a clean operating system (OS) installation, and when an OS is upgraded. - ->[!NOTE] ->For information on using the layout modification XML to configure Start with roaming user profiles, see [Deploy Roaming User Profiles](/windows-server/storage/folder-redirection/deploy-roaming-user-profiles#step-7-optionally-specify-a-start-layout-for-windows-10-pcs). -> ->Using CopyProfile for Start menu customization in Windows 10 isn't supported. For more information [Customize the Default User Profile by Using CopyProfile](/windows-hardware/manufacture/desktop/customize-the-default-user-profile-by-using-copyprofile) - -## Use XML - -On an existing Windows device, you can set up the **Start** screen, and then export the layout to an XML file. When you have the XML file, add this file to a group policy, a Windows Configuration Designer provisioning package, or a mobile device management (MDM) policy. Using these methods, you can deploy the XML file to your devices. When the devices receive your policy, they'll use the layout configured in the XML file. - -For more information, see [Customize and export Start layout](customize-and-export-start-layout.md). - -For the **taskbar**, you can use the same XML file as the start screen. Or, you can create a new XML file. When you have the XML file, add this file to a group policy or a provisioning package. Using these methods, you can deploy the XML file to your devices. When the devices receive your policy, they'll use the taskbar settings you configured in the XML file. - -For more information, see [Configure Windows 10 taskbar](../taskbar/configure.md). - -## Use group policy - -Using group policy objects (GPO), you can manage different parts of the Start menu and taskbar. You don't need to reimage the devices. Using administrative templates, you configure settings in a policy, and then deploy this policy to your devices. [Start menu policy settings](#start-menu-policy-settings) (in this article) lists the policies you can configure. - -## Use provisioning packages - -Provisioning packages are containers that include a set of configuration settings. They're designed to configure a device quickly, without installing a new image. For more information on what provisioning packages are, and what they do, see [Provisioning packages](../provisioning-packages/provisioning-packages.md). - -Using a provisioning package, you can customize the Start and taskbar. - -## Use a mobile device management (MDM) solution - -Using an MDM solution, you add an XML file to a policy, and then deploy this policy to your devices. - -If you use Microsoft Intune for your MDM solution, then you can use settings to configure Start and the taskbar. For more information on the settings you can configure, see [Start settings in Microsoft Intune](/mem/intune/configuration/device-restrictions-windows-10#start). - -## Start menu policy settings - -![start layout sections.](images/startannotated.png) - -The following list includes the different Start options, and any policy or local settings. The settings in the list can also be used in a provisioning package. If you use a provisioning package, see the [Windows Configuration Designer reference](../wcd/wcd-policies.md#start). - -- **User tile** - - **Group policy**: `User Configuration\Administrative Templates\Start Menu and Taskbar\Remove Logoff on the Start menu` - - **Local setting**: None - - **MDM policy**: - - Start/HideUserTile - - Start/HideSwitchAccount - - Start/HideSignOut - - Start/HideLock - - Start/HideChangeAccountSettings - -- **Most used** - - **Group policy**: `User Configuration\Administrative Templates\Start Menu and Taskbar\Remove frequent programs from the Start menu` - - **Local setting**: Settings > Personalization > Start > Show most used apps - - **MDM policy**: Start/HideFrequentlyUsedApps - -- **Suggestions, Dynamically inserted app tile** - - **Group policy**: `Computer Configuration\Administrative Templates\Windows Components\Cloud Content\Turn off Microsoft consumer experiences` - - This policy also enables or disables notifications for: - - - A user's Microsoft account - - App tiles that Microsoft dynamically adds to the default Start menu - - - **Local setting**: Settings > Personalization > Start > Occasionally show suggestions in Start - - **MDM policy**: Allow Windows Consumer Features - -- **Recently added** - - **Group policy**: `Computer configuration\Administrative Template\Start Menu and Taskbar\Remove "Recently Added" list from Start Menu` - - This policy applies to: - - - Windows 10 version 1803 and later - - - **Local setting**: Settings > Personalization > Start > Show recently added apps - - **MDM policy**: Start/HideRecentlyAddedApps - -- **Pinned folders** - - **Local setting**: Settings > Personalization > Start > Choose which folders appear on Start - - **MDM policy**: AllowPinnedFolder - -- **Power** - - **Group policy**: `User Configuration\Administrative Templates\Start Menu and Taskbar\Remove and prevent access to the Shut Down, Restart, Sleep, and Hibernate commands` - - **Local setting**: None - - **MDM policy**: - - Start/HidePowerButton - - Start/HideHibernate - - Start/HideRestart - - Start/HideShutDown - - Start/HideSleep - -- **Start layout** - - **Group policy**: `User Configuration\Administrative Templates\Start Menu and Taskbar\Prevent users from customizing their Start screen` - - When a full Start screen layout is imported with Group Policy or MDM, users can't pin, unpin, or uninstall apps from the Start screen. Users can see and open all apps in the **All Apps** view, but they can't pin any apps to the Start screen. When a partial Start screen layout is imported, users can't change the tile groups applied by the partial layout. They can change other tile groups, and create their own tile groups. - - **Start layout** policy can be used to pin apps to the taskbar based on an XML File you provide. Users can change the order of pinned apps, unpin apps, and pin more apps to the taskbar. - - - **Local setting**: None - - **MDM policy**: - - Start layout - - ImportEdgeAssets - -- **Jump lists** - - **Group policy**: `User Configuration\Administrative Templates\Start Menu and Taskbar\Do not keep history of recently opened documents` - - **Local setting**: Settings > Personalization > Start > Show recently opened items in Jump Lists on Start or the taskbar - - **MDM policy**: Start/HideRecentJumplists - -- **Start size** - - **Group policy**: `User Configuration\Administrative Templates\Start Menu and Taskbar\Force Start to be either full screen size or menu size` - - **Local setting**: Settings > Personalization > Start > Use Start full screen - - **MDM policy**: Force Start size - -- **App list** - - **Local setting**: Settings > Personalization > Start > Show app list in Start menu - - **MDM policy**: Start/HideAppList - -- **All settings** - - **Group policy**: `User Configuration\Administrative Templates\Prevent changes to Taskbar and Start Menu Settings` - - **Local setting**: None - -- **Taskbar** - - **Local setting**: None - - **MDM policy**: Start/NoPinningToTaskbar - -> [!NOTE] -> In the **Settings** app > **Personalization** > **Start**, there is a **Show more tiles on Start** option. The default tile layout for Start tiles is 3 columns of medium sized tiles. **Show more tiles on Start** enables 4 columns. To configure the 4-column layout when you [customize and export a Start layout](customize-and-export-start-layout.md), turn on the **Show more tiles** setting, and then arrange your tiles. - -## Taskbar options - -Starting in Windows 10 version 1607, you can pin more apps to the taskbar, and remove default pinned apps from the taskbar. You can select different taskbar configurations based on device locale or region. - -There are three app categories that could be pinned to a taskbar: - -- Apps pinned by the user -- Default Windows apps pinned during the OS installation, such as Microsoft Edge, File Explorer, and Store -- Apps pinned by your organization, such as in an unattended Windows setup - - In an unattended Windows setup file, it's recommended to use the [layoutmodification.xml method](../taskbar/configure.md) to configure the taskbar options. It's not recommended to use [TaskbarLinks](/windows-hardware/customize/desktop/unattend/microsoft-windows-shell-setup-taskbarlinks). - -The following example shows how apps are pinned. In OS configured to use a right-to-left language, the taskbar order is reversed: - -- Windows default apps to the left (blue circle) -- Apps pinned by the user in the center (orange triangle) -- Apps that you pin using XML to the right (green square) - -![Windows left, user center, enterprise to the right.](images/taskbar-generic.png) - -If you apply the taskbar configuration to a clean install or an update, users can still: - -- Pin more apps -- Change the order of pinned apps -- Unpin any app - -> [!TIP] -> In Windows 10 version 1703, you can apply the `Start/NoPinningToTaskbar` MDM policy. This policy prevents users from pinning and unpinning apps on the taskbar. - -### Taskbar configuration applied to clean install of Windows 10 - -In a clean install, if you apply a taskbar layout, only the following apps are pinned to the taskbar: - -- Apps you specifically add -- Any default apps you don't remove - -After the layout is applied, users can pin more apps to the taskbar. - -## Start layout configuration errors - -If your Start layout customization isn't applied as you expect, open the **Event Viewer**. Go to **Applications and Services Log** > **Microsoft** > **Windows** > **ShellCommon-StartLayoutPopulation** > **Operational**. Look for the following events: - -- **Event 22**: The XML is malformed. The specified file isn't valid XML. This event can happen if the file has extra spaces or unexpected characters. Or, if the file isn't saved in the UTF8 format. -- **Event 64**: The XML is valid, and has unexpected values. This event can happen when the configuration isn't understood, elements aren't in [the required order](start-layout-xml-desktop.md#required-order), or source isn't found, such as a missing or misspelled `.lnk`. diff --git a/windows/configuration/start/xsd.md b/windows/configuration/start/xsd.md new file mode 100644 index 0000000000..714f0aa70f --- /dev/null +++ b/windows/configuration/start/xsd.md @@ -0,0 +1,432 @@ +--- +title: Start XML Schema Definition (XSD) +description: Start XSD reference article. +ms.topic: reference +ms.date: 04/10/2024 +appliesto: +- ✅ Windows 10 +--- + +# Start XML Schema Definition (XSD) + +This reference article contains the Start XML schema definition (XSD). + +## StartLayout + +```xml + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +``` + +## LayoutModification + +```xml + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +``` + +## FullDefaultLayout + +```xml + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +``` diff --git a/windows/configuration/store/toc.yml b/windows/configuration/store/toc.yml new file mode 100644 index 0000000000..1be495bbbe --- /dev/null +++ b/windows/configuration/store/toc.yml @@ -0,0 +1,5 @@ +items: + - name: Configure access to Microsoft Store + href: index.md + - name: Find the AUMID of an installed app + href: find-aumid.md \ No newline at end of file diff --git a/windows/configuration/taskbar/images/pin-add-10.png b/windows/configuration/taskbar/images/pin-add-10.png new file mode 100644 index 0000000000..398028ee4b Binary files /dev/null and b/windows/configuration/taskbar/images/pin-add-10.png differ diff --git a/windows/configuration/taskbar/images/pin-add-11.png b/windows/configuration/taskbar/images/pin-add-11.png new file mode 100644 index 0000000000..de84d0154c Binary files /dev/null and b/windows/configuration/taskbar/images/pin-add-11.png differ diff --git a/windows/configuration/taskbar/images/pin-layout-10.png b/windows/configuration/taskbar/images/pin-layout-10.png new file mode 100644 index 0000000000..463655d37e Binary files /dev/null and b/windows/configuration/taskbar/images/pin-layout-10.png differ diff --git a/windows/configuration/taskbar/images/pin-layout-11.png b/windows/configuration/taskbar/images/pin-layout-11.png new file mode 100644 index 0000000000..717f210776 Binary files /dev/null and b/windows/configuration/taskbar/images/pin-layout-11.png differ diff --git a/windows/configuration/taskbar/images/pin-remove-10.png b/windows/configuration/taskbar/images/pin-remove-10.png new file mode 100644 index 0000000000..7d8671887b Binary files /dev/null and b/windows/configuration/taskbar/images/pin-remove-10.png differ diff --git a/windows/configuration/taskbar/images/pin-remove-11.png b/windows/configuration/taskbar/images/pin-remove-11.png new file mode 100644 index 0000000000..d815923516 Binary files /dev/null and b/windows/configuration/taskbar/images/pin-remove-11.png differ diff --git a/windows/configuration/taskbar/images/pin-replace-10.png b/windows/configuration/taskbar/images/pin-replace-10.png new file mode 100644 index 0000000000..31b1bfd98a Binary files /dev/null and b/windows/configuration/taskbar/images/pin-replace-10.png differ diff --git a/windows/configuration/taskbar/images/pin-replace-11.png b/windows/configuration/taskbar/images/pin-replace-11.png new file mode 100644 index 0000000000..ce90eebcad Binary files /dev/null and b/windows/configuration/taskbar/images/pin-replace-11.png differ diff --git a/windows/configuration/taskbar/images/start-layout-group-policy.png b/windows/configuration/taskbar/images/start-layout-group-policy.png deleted file mode 100644 index 99252bd139..0000000000 Binary files a/windows/configuration/taskbar/images/start-layout-group-policy.png and /dev/null differ diff --git a/windows/configuration/taskbar/images/taskbar-10.png b/windows/configuration/taskbar/images/taskbar-10.png new file mode 100644 index 0000000000..d99c1dd15d Binary files /dev/null and b/windows/configuration/taskbar/images/taskbar-10.png differ diff --git a/windows/configuration/taskbar/images/taskbar-11.png b/windows/configuration/taskbar/images/taskbar-11.png new file mode 100644 index 0000000000..accd2c6f8f Binary files /dev/null and b/windows/configuration/taskbar/images/taskbar-11.png differ diff --git a/windows/configuration/taskbar/images/taskbar-default-plus.png b/windows/configuration/taskbar/images/taskbar-default-plus.png deleted file mode 100644 index 8afcebac09..0000000000 Binary files a/windows/configuration/taskbar/images/taskbar-default-plus.png and /dev/null differ diff --git a/windows/configuration/taskbar/images/taskbar-default-removed.png b/windows/configuration/taskbar/images/taskbar-default-removed.png deleted file mode 100644 index b3ff924e9f..0000000000 Binary files a/windows/configuration/taskbar/images/taskbar-default-removed.png and /dev/null differ diff --git a/windows/configuration/taskbar/images/taskbar-default.png b/windows/configuration/taskbar/images/taskbar-default.png deleted file mode 100644 index 41c6c72258..0000000000 Binary files a/windows/configuration/taskbar/images/taskbar-default.png and /dev/null differ diff --git a/windows/configuration/taskbar/images/taskbar-generic.png b/windows/configuration/taskbar/images/taskbar-generic.png deleted file mode 100644 index 6d47a6795a..0000000000 Binary files a/windows/configuration/taskbar/images/taskbar-generic.png and /dev/null differ diff --git a/windows/configuration/taskbar/images/taskbar-region-defr.png b/windows/configuration/taskbar/images/taskbar-region-defr.png deleted file mode 100644 index 6d707b16f4..0000000000 Binary files a/windows/configuration/taskbar/images/taskbar-region-defr.png and /dev/null differ diff --git a/windows/configuration/taskbar/images/taskbar-region-other.png b/windows/configuration/taskbar/images/taskbar-region-other.png deleted file mode 100644 index fab367ef7a..0000000000 Binary files a/windows/configuration/taskbar/images/taskbar-region-other.png and /dev/null differ diff --git a/windows/configuration/taskbar/images/taskbar-region-usuk.png b/windows/configuration/taskbar/images/taskbar-region-usuk.png deleted file mode 100644 index 6bba65ee81..0000000000 Binary files a/windows/configuration/taskbar/images/taskbar-region-usuk.png and /dev/null differ diff --git a/windows/configuration/taskbar/images/taskbar-sections-10.png b/windows/configuration/taskbar/images/taskbar-sections-10.png new file mode 100644 index 0000000000..eec49c3d24 Binary files /dev/null and b/windows/configuration/taskbar/images/taskbar-sections-10.png differ diff --git a/windows/configuration/taskbar/images/taskbar-sections-11.png b/windows/configuration/taskbar/images/taskbar-sections-11.png new file mode 100644 index 0000000000..3e14e85b9d Binary files /dev/null and b/windows/configuration/taskbar/images/taskbar-sections-11.png differ diff --git a/windows/configuration/taskbar/includes/allow-widgets.md b/windows/configuration/taskbar/includes/allow-widgets.md new file mode 100644 index 0000000000..83a0bb12e7 --- /dev/null +++ b/windows/configuration/taskbar/includes/allow-widgets.md @@ -0,0 +1,18 @@ +--- +author: paolomatarazzo +ms.author: paoloma +ms.date: 04/11/2024 +ms.topic: include +--- + +### Allow widgets + +This policy specifies whether the widgets feature is allowed on the device. + +- Widgets are turned on by default, unless you change this in your settings +- If you turn on this policy setting, widgets are enabled automatically, unless you turn it off in your settings + +| | Path | +|--|--| +| **CSP** | `./Device/Vendor/MSFT/Policy/Config/NewsAndInterests/`[AllowNewsAndInterests](/windows/client-management/mdm/policy-csp-newsandinterests#allownewsandinterests) | +| **GPO** | **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Widgets** | diff --git a/windows/configuration/taskbar/includes/configure-start-layout.md b/windows/configuration/taskbar/includes/configure-start-layout.md new file mode 100644 index 0000000000..7edd14def2 --- /dev/null +++ b/windows/configuration/taskbar/includes/configure-start-layout.md @@ -0,0 +1,19 @@ +--- +author: paolomatarazzo +ms.author: paoloma +ms.date: 04/10/2024 +ms.topic: include +--- + +### Configure Start layout + + + +This policy setting lets you specify the applications pinned to the taskbar. The layout that you specify has an XML format. + +| | Path | +|--|--| +| **CSP** | - `./Device/Vendor/MSFT/Policy/Config/Start/StartLayout`/[Configure start layout](/windows/client-management/mdm/policy-csp-start#startlayout)

- `./User/Vendor/MSFT/Policy/Config/Start/StartLayout`/[Configure start layout](/windows/client-management/mdm/policy-csp-start#startlayout) | +| **GPO** | **Computer Configuration** > **Administrative Templates** > **Start Menu and Taskbar**

**User Configuration** > **Administrative Templates** > **Start Menu and Taskbar** | + +For more information, see [Customize the taskbar pinned applications](../pinned-apps.md). diff --git a/windows/configuration/taskbar/includes/configures-search-on-the-taskbar.md b/windows/configuration/taskbar/includes/configures-search-on-the-taskbar.md new file mode 100644 index 0000000000..3382db1ac7 --- /dev/null +++ b/windows/configuration/taskbar/includes/configures-search-on-the-taskbar.md @@ -0,0 +1,21 @@ +--- +author: paolomatarazzo +ms.author: paoloma +ms.date: 04/11/2024 +ms.topic: include +--- + +### Configures search on the taskbar + +This policy setting allows you to configure search on the taskbar. + +- If you enable this policy setting and set it to **hide**, search on taskbar is hidden by default. Users can't change it in Settings +- If you enable this policy setting and set it to **search icon only**, the search icon is displayed on the taskbar by default. Users can't change it in Settings +- If you enable this policy setting and set it to **search icon and label**, the search icon and label are displayed on the taskbar by default. Users can't change it in Settings +- If you enable this policy setting and set it to **search box**, the search box is displayed on the taskbar by default. Users can't change it in Settings +- If you disable or don't configure this policy setting, search on taskbar is configured according to the defaults for your Windows edition. Users can change search on taskbar in Settings + +| | Path | +|--|--| +| **CSP** | `./Device/Vendor/MSFT/Policy/Config/Search/`[ConfigureSearchOnTaskbarMode](/windows/client-management/mdm/policy-csp-search#configuresearchontaskbarmode) | +| **GPO** | **Computer Configuration** > **Windows Components** > **Search** | diff --git a/windows/configuration/taskbar/includes/disable-editing-quick-settings.md b/windows/configuration/taskbar/includes/disable-editing-quick-settings.md new file mode 100644 index 0000000000..d1f29ba96d --- /dev/null +++ b/windows/configuration/taskbar/includes/disable-editing-quick-settings.md @@ -0,0 +1,16 @@ +--- +author: paolomatarazzo +ms.author: paoloma +ms.date: 03/18/2024 +ms.topic: include +--- + +### Disable editing Quick Settings + +- If you enable this policy setting, users can't modify Quick Settings +- If you disable or don't configure this policy setting, users can edit Quick Settings + +| | Path | +|--|--| +| **CSP** | `./Device/Vendor/MSFT/Policy/Config/Start/`[DisableEditingQuickSettings](/windows/client-management/mdm/policy-csp-start#disableeditingquicksettings)| +| **GPO** | **Computer Configuration** > **Administrative Templates** > **Start Menu and Taskbar** > **Disable editing quick settings** | diff --git a/windows/configuration/taskbar/includes/do-not-allow-pinning-items-in-jump-lists.md b/windows/configuration/taskbar/includes/do-not-allow-pinning-items-in-jump-lists.md new file mode 100644 index 0000000000..22d26069ab --- /dev/null +++ b/windows/configuration/taskbar/includes/do-not-allow-pinning-items-in-jump-lists.md @@ -0,0 +1,18 @@ +--- +author: paolomatarazzo +ms.author: paoloma +ms.date: 04/11/2024 +ms.topic: include +--- + +### Do not allow pinning items in Jump Lists + +With this policy setting you control the pinning of items in Jump Lists. + +- If you enable this policy setting, users can't pin files, folders, websites, or other items to their Jump Lists in the Start Menu and Taskbar. Users can't unpin existing items pinned to their Jump Lists. Existing items already pinned to their Jump Lists continue to show +- If you disable or don't configure this policy setting, users can pin files, folders, websites, and other items to a program's Jump List so that the items are always present in this menu + +| | Path | +|--|--| +| **CSP** | Not available. | +| **GPO** | **User Configuration** > **Administrative Templates** > **Start Menu and Taskbar** | diff --git a/windows/configuration/taskbar/includes/do-not-allow-pinning-programs-to-the-taskbar.md b/windows/configuration/taskbar/includes/do-not-allow-pinning-programs-to-the-taskbar.md new file mode 100644 index 0000000000..70b4320f49 --- /dev/null +++ b/windows/configuration/taskbar/includes/do-not-allow-pinning-programs-to-the-taskbar.md @@ -0,0 +1,18 @@ +--- +author: paolomatarazzo +ms.author: paoloma +ms.date: 04/11/2024 +ms.topic: include +--- + +### Do not allow pinning programs to the Taskbar + +This policy setting allows you to control pinning programs to the Taskbar. + +- If you enable this policy setting, users can't change the programs currently pinned to the Taskbar. If any programs are already pinned to the Taskbar, these programs continue to show in the Taskbar. However, users can't unpin these programs already pinned to the Taskbar, and they can't pin new programs to the Taskbar +- If you disable or don't configure this policy setting, users can change the programs currently pinned to the Taskbar + +| | Path | +|--|--| +| **CSP** | `./Device/Vendor/MSFT/Policy/Config/Start/`[NoPinningToTaskbar](/windows/client-management/mdm/policy-csp-start#nopinningtotaskbar) | +| **GPO** | **User Configuration** > **Administrative Templates** > **Start Menu and Taskbar** | diff --git a/windows/configuration/taskbar/includes/do-not-allow-pinning-store-app-to-the-taskbar.md b/windows/configuration/taskbar/includes/do-not-allow-pinning-store-app-to-the-taskbar.md new file mode 100644 index 0000000000..a394034ed7 --- /dev/null +++ b/windows/configuration/taskbar/includes/do-not-allow-pinning-store-app-to-the-taskbar.md @@ -0,0 +1,18 @@ +--- +author: paolomatarazzo +ms.author: paoloma +ms.date: 04/11/2024 +ms.topic: include +--- + +### Do not allow pinning Store app to the Taskbar + +This policy setting allows you to control pinning the Store app to the Taskbar. + +- If you enable this policy setting, users can't pin the Store app to the Taskbar. If the Store app is already pinned to the Taskbar, it will be removed from the Taskbar on next sign in +- If you disable or don't configure this policy setting, users can pin the Store app to the Taskbar + +| | Path | +|--|--| +| **CSP** | Not available. | +| **GPO** | **User Configuration** > **Administrative Templates** > **Start Menu and Taskbar** | diff --git a/windows/configuration/taskbar/includes/do-not-allow-taskbars-on-more-than-one-display.md b/windows/configuration/taskbar/includes/do-not-allow-taskbars-on-more-than-one-display.md new file mode 100644 index 0000000000..7766466c8c --- /dev/null +++ b/windows/configuration/taskbar/includes/do-not-allow-taskbars-on-more-than-one-display.md @@ -0,0 +1,15 @@ +--- +author: paolomatarazzo +ms.author: paoloma +ms.date: 04/11/2024 +ms.topic: include +--- + +### Do not allow taskbars on more than one display + +This policy setting allows you to prevent taskbars from being displayed on more than one monitor. If you enable this policy setting, users aren't able to show taskbars on more than one display. The multiple display section is not enabled in the taskbar properties dialog. If you disable or don't configure this policy setting, users can show taskbars on more than one display. + +| | Path | +|--|--| +| **CSP** | Not available. | +| **GPO** | **User Configuration** > **Administrative Templates** > **Start Menu and Taskbar** | diff --git a/windows/configuration/taskbar/includes/do-not-display-or-track-items-in-jump-lists-from-remote-locations.md b/windows/configuration/taskbar/includes/do-not-display-or-track-items-in-jump-lists-from-remote-locations.md new file mode 100644 index 0000000000..fb0d96e2d0 --- /dev/null +++ b/windows/configuration/taskbar/includes/do-not-display-or-track-items-in-jump-lists-from-remote-locations.md @@ -0,0 +1,21 @@ +--- +author: paolomatarazzo +ms.author: paoloma +ms.date: 04/11/2024 +ms.topic: include +--- + +### Do not display or track items in Jump Lists from remote locations + +This policy setting allows you to control displaying or tracking items in Jump Lists from remote locations. The Start Menu and Taskbar display Jump Lists off of programs. These menus include files, folders, websites, and other relevant items for that program. This helps users more easily reopen their most important documents and other tasks. + +- If you enable this policy setting, the Start Menu and Taskbar only track the files that the user opens locally on this computer. Files that the user opens over the network from remote computers aren't tracked or shown in the Jump Lists. Use this setting to reduce network traffic, particularly over slow network connections +- If you disable or don't configure this policy setting, all files that the user opens appear in the menus, including files located remotely on another computer + +> [!NOTE] +> This setting doesn't prevent Windows from displaying remote files that the user has explicitly pinned to the Jump Lists. + +| | Path | +|--|--| +| **CSP** | Not available. | +| **GPO** | **User Configuration** > **Administrative Templates** > **Start Menu and Taskbar** | diff --git a/windows/configuration/taskbar/includes/example-add-pins.md b/windows/configuration/taskbar/includes/example-add-pins.md new file mode 100644 index 0000000000..06a78334f7 --- /dev/null +++ b/windows/configuration/taskbar/includes/example-add-pins.md @@ -0,0 +1,27 @@ +--- +author: paolomatarazzo +ms.author: paoloma +ms.date: 03/13/2024 +ms.topic: include +--- + +```xml + + + + + + + + + + + + + +``` diff --git a/windows/configuration/taskbar/includes/example-region.md b/windows/configuration/taskbar/includes/example-region.md new file mode 100644 index 0000000000..7c3c8f4eba --- /dev/null +++ b/windows/configuration/taskbar/includes/example-region.md @@ -0,0 +1,43 @@ +--- +author: paolomatarazzo +ms.author: paoloma +ms.date: 03/13/2024 +ms.topic: include +--- + +```xml + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +``` diff --git a/windows/configuration/taskbar/includes/example-remove-pins.md b/windows/configuration/taskbar/includes/example-remove-pins.md new file mode 100644 index 0000000000..e2f95fc832 --- /dev/null +++ b/windows/configuration/taskbar/includes/example-remove-pins.md @@ -0,0 +1,24 @@ +--- +author: paolomatarazzo +ms.author: paoloma +ms.date: 03/13/2024 +ms.topic: include +--- + +```xml + + + + + + + + + + +``` diff --git a/windows/configuration/taskbar/includes/example-replace-pins.md b/windows/configuration/taskbar/includes/example-replace-pins.md new file mode 100644 index 0000000000..ccd014ee99 --- /dev/null +++ b/windows/configuration/taskbar/includes/example-replace-pins.md @@ -0,0 +1,27 @@ +--- +author: paolomatarazzo +ms.author: paoloma +ms.date: 03/13/2024 +ms.topic: include +--- + +```xml + + + + + + + + + + + + + +``` diff --git a/windows/configuration/taskbar/includes/example.md b/windows/configuration/taskbar/includes/example.md new file mode 100644 index 0000000000..4a31f71fce --- /dev/null +++ b/windows/configuration/taskbar/includes/example.md @@ -0,0 +1,53 @@ +--- +author: paolomatarazzo +ms.author: paoloma +ms.date: 03/13/2024 +ms.topic: include +--- + +```xml + + + + + + + + + +``` + +::: zone pivot="windows-10" + +### Sample taskbar configuration added to Start layout XML file + +If you configure the Start layout using policy settings, you can modify the existing XML file by adding the taskbar customizations to it. Here's an example of a Start layout XML file that includes the `CustomTaskbarLayoutCollection` node. + +```xml + + + + + + + + + + + + + + + + + + + +``` + +::: zone-end diff --git a/windows/configuration/taskbar/includes/hide-recent-jumplists.md b/windows/configuration/taskbar/includes/hide-recent-jumplists.md new file mode 100644 index 0000000000..67c433344f --- /dev/null +++ b/windows/configuration/taskbar/includes/hide-recent-jumplists.md @@ -0,0 +1,23 @@ +--- +author: paolomatarazzo +ms.author: paoloma +ms.date: 04/12/2024 +ms.topic: include +--- + +### Hide recent jumplists + +Prevents the operating system and installed programs from creating and displaying shortcuts to recently opened documents. + +- If you enable this setting: + - The system and apps don't create shortcuts to documents opened + - The system empties the Recent Items menu on the Start menu, and apps don't display shortcuts at the bottom of the File menu + - The Jump Lists in the Start Menu and Taskbar don't show lists of recently or frequently used files, folders, or websites +- If you disable or don't configure this setting, the system stores and displays shortcuts to recently and frequently used files, folders, and websites +- If you enable this setting but don't enable the **Remove Recent Items menu from Start Menu** setting, the Recent Items menu appears on the Start menu, but it's empty. +- If you enable this setting, but then later disable it or set it to **Not Configured**, the document shortcuts saved before the setting was enabled reappear in the Recent Items menu and program File menus, and Jump Lists. This setting doesn't hide or prevent the user from pinning files, folders, or websites to the Jump Lists. This setting doesn't hide document shortcuts displayed in the Open dialog box + +| | Path | +|--|--| +| **CSP** | - `./Device/Vendor/MSFT/Policy/Config/Start/`[HideRecentJumplists](/windows/client-management/mdm/policy-csp-start#hiderecentjumplists)

- `./User/Vendor/MSFT/Policy/Config/Start/`[HideRecentJumplists](/windows/client-management/mdm/policy-csp-start#hiderecentjumplists) | +| **GPO** | **Computer Configuration** > **Administrative Templates** > **Start Menu and Taskbar** > **don't keep history of recently opened documents**

**User Configuration** > **Administrative Templates** > **Start Menu and Taskbar** > **don't keep history of recently opened documents**| diff --git a/windows/configuration/taskbar/includes/hide-the-notification-area.md b/windows/configuration/taskbar/includes/hide-the-notification-area.md new file mode 100644 index 0000000000..1313ae901b --- /dev/null +++ b/windows/configuration/taskbar/includes/hide-the-notification-area.md @@ -0,0 +1,15 @@ +--- +author: paolomatarazzo +ms.author: paoloma +ms.date: 04/11/2024 +ms.topic: include +--- + +### Hide the notification area + +This setting affects the notification area (previously called the "system tray") on the taskbar. Description: The notification area is located at the far right end of the task bar and includes the icons for current notifications and the system clock. If this setting is enabled, the user?s entire notification area, including the notification icons, is hidden. The taskbar displays only the Start button, taskbar buttons, custom toolbars (if any), and the system clock. If this setting is disabled or isn't configured, the notification area is shown in the user's taskbar. Note: Enabling this setting overrides the "Turn off notification area cleanup" setting, because if the notification area is hidden, there's no need to clean up the icons. + +| | Path | +|--|--| +| **CSP** | Not available. | +| **GPO** | **User Configuration** > **Administrative Templates** > **Start Menu and Taskbar** | diff --git a/windows/configuration/taskbar/includes/hide-the-taskview-button.md b/windows/configuration/taskbar/includes/hide-the-taskview-button.md new file mode 100644 index 0000000000..aa95d9a03f --- /dev/null +++ b/windows/configuration/taskbar/includes/hide-the-taskview-button.md @@ -0,0 +1,15 @@ +--- +author: paolomatarazzo +ms.author: paoloma +ms.date: 04/11/2024 +ms.topic: include +--- + +### Hide the TaskView button + +This policy setting allows you to hide the TaskView button. If you enable this policy setting, the TaskView button is hidden and the Settings toggle disabled. + +| | Path | +|--|--| +| **CSP** |- `./Device/Vendor/MSFT/Policy/Config/Start/`[HideTaskViewButton](/windows/client-management/mdm/policy-csp-start#hidetaskviewbutton)

- `./User/Vendor/MSFT/Policy/Config/Start/`[HideTaskViewButton](/windows/client-management/mdm/policy-csp-start#hidetaskviewbutton) | +| **GPO** |- **User Configuration** > **Administrative Templates** > **Start Menu and Taskbar**

- **Computer Configuration** > **Administrative Templates** > **Start Menu and Taskbar** | diff --git a/windows/configuration/taskbar/includes/lock-all-taskbar-settings.md b/windows/configuration/taskbar/includes/lock-all-taskbar-settings.md new file mode 100644 index 0000000000..59e7e89884 --- /dev/null +++ b/windows/configuration/taskbar/includes/lock-all-taskbar-settings.md @@ -0,0 +1,18 @@ +--- +author: paolomatarazzo +ms.author: paoloma +ms.date: 04/11/2024 +ms.topic: include +--- + +### Lock all taskbar settings + +With this policy setting you lock all taskbar settings. + +- If you enable this policy setting, the user can't access the taskbar control panel. The user can't resize, move, or rearrange toolbars on their taskbar +- If you disable or don't configure this policy setting, the user can set any taskbar setting that isn't prevented by another policy setting + +| | Path | +|--|--| +| **CSP** | Not available. | +| **GPO** | **User Configuration** > **Administrative Templates** > **Start Menu and Taskbar** | diff --git a/windows/configuration/taskbar/includes/lock-the-taskbar.md b/windows/configuration/taskbar/includes/lock-the-taskbar.md new file mode 100644 index 0000000000..2f5694702d --- /dev/null +++ b/windows/configuration/taskbar/includes/lock-the-taskbar.md @@ -0,0 +1,15 @@ +--- +author: paolomatarazzo +ms.author: paoloma +ms.date: 04/11/2024 +ms.topic: include +--- + +### Lock the Taskbar + +This setting affects the taskbar, which is used to switch between running applications. The taskbar includes the Start button, list of currently running tasks, and the notification area. By default, the taskbar is located at the bottom of the screen, but it can be dragged to any side of the screen. When it's locked, it can't be moved or resized. If you enable this setting, it prevents the user from moving or resizing the taskbar. While the taskbar is locked, autohide and other taskbar options are still available in Taskbar properties. If you disable this setting or don't configure it, the user can configure the taskbar position. Note: Enabling this setting also locks the QuickLaunch bar and any other toolbars that the user has on their taskbar. The toolbar's position is locked, and the user can't show and hide various toolbars using the taskbar context menu. + +| | Path | +|--|--| +| **CSP** | Not available. | +| **GPO** | **User Configuration** > **Administrative Templates** > **Start Menu and Taskbar** | diff --git a/windows/configuration/taskbar/includes/prevent-changes-to-taskbar-and-start-menu-settings.md b/windows/configuration/taskbar/includes/prevent-changes-to-taskbar-and-start-menu-settings.md new file mode 100644 index 0000000000..a159c12d82 --- /dev/null +++ b/windows/configuration/taskbar/includes/prevent-changes-to-taskbar-and-start-menu-settings.md @@ -0,0 +1,18 @@ +--- +author: paolomatarazzo +ms.author: paoloma +ms.date: 04/11/2024 +ms.topic: include +--- + +### Prevent changes to Taskbar and Start Menu Settings + +With this policy setting you prevent changes to taskbar and Start settings. + +- If you enable this policy setting, the user can't open the Taskbar properties dialog box. If the user right-clicks the taskbar and then selects Properties, a message appears explaining that a setting prevents the action +- If you disable or don't configure this policy setting, the Taskbar and Start menu items are available from Settings on the Start menu + +| | Path | +|--|--| +| **CSP** | Not available. | +| **GPO** | - **User Configuration** > **Administrative Templates** > **Start Menu and Taskbar**

- **Computer Configuration** > **Administrative Templates** > **Start Menu and Taskbar** | diff --git a/windows/configuration/taskbar/includes/prevent-grouping-of-taskbar-items.md b/windows/configuration/taskbar/includes/prevent-grouping-of-taskbar-items.md new file mode 100644 index 0000000000..eb97a11ff8 --- /dev/null +++ b/windows/configuration/taskbar/includes/prevent-grouping-of-taskbar-items.md @@ -0,0 +1,18 @@ +--- +author: paolomatarazzo +ms.author: paoloma +ms.date: 04/11/2024 +ms.topic: include +--- + +### Prevent grouping of taskbar items + +Taskbar grouping consolidates similar applications when there's no room on the taskbar. It kicks in when the user's taskbar is full. + +- If you enable this policy setting, it prevents the taskbar from grouping items that share the same program name. By default, this setting is always enabled +- If you disable or don't configure it, items on the taskbar that share the same program are grouped together. The users have the option to disable grouping if they choose + +| | Path | +|--|--| +| **CSP** | Not available. | +| **GPO** | **User Configuration** > **Administrative Templates** > **Start Menu and Taskbar** | diff --git a/windows/configuration/taskbar/includes/prevent-users-from-adding-or-removing-toolbars.md b/windows/configuration/taskbar/includes/prevent-users-from-adding-or-removing-toolbars.md new file mode 100644 index 0000000000..da36dcc670 --- /dev/null +++ b/windows/configuration/taskbar/includes/prevent-users-from-adding-or-removing-toolbars.md @@ -0,0 +1,18 @@ +--- +author: paolomatarazzo +ms.author: paoloma +ms.date: 04/11/2024 +ms.topic: include +--- + +### Prevent users from adding or removing toolbars + +With this policy setting you prevent users from adding or removing toolbars. + +- If you enable this policy setting, the user isn't allowed to add or remove any toolbars to the taskbar. Applications can't add toolbars either +- If you disable or don't configure this policy setting, the users and applications can add toolbars to the taskbar + +| | Path | +|--|--| +| **CSP** | Not available. | +| **GPO** | **User Configuration** > **Administrative Templates** > **Start Menu and Taskbar** | diff --git a/windows/configuration/taskbar/includes/prevent-users-from-moving-taskbar-to-another-screen-dock-location.md b/windows/configuration/taskbar/includes/prevent-users-from-moving-taskbar-to-another-screen-dock-location.md new file mode 100644 index 0000000000..953135ecf3 --- /dev/null +++ b/windows/configuration/taskbar/includes/prevent-users-from-moving-taskbar-to-another-screen-dock-location.md @@ -0,0 +1,18 @@ +--- +author: paolomatarazzo +ms.author: paoloma +ms.date: 04/11/2024 +ms.topic: include +--- + +### Prevent users from moving taskbar to another screen dock location + +With this policy setting you prevent users from moving taskbar to another screen dock location. + +- If you enable this policy setting, users can't drag their taskbar to another area of the monitor(s) +- If you disable or don't configure this policy setting, users can drag their taskbar to another area of the monitor, unless prevented by another policy setting + +| | Path | +|--|--| +| **CSP** | Not available. | +| **GPO** | **User Configuration** > **Administrative Templates** > **Start Menu and Taskbar** | diff --git a/windows/configuration/taskbar/includes/prevent-users-from-rearranging-toolbars.md b/windows/configuration/taskbar/includes/prevent-users-from-rearranging-toolbars.md new file mode 100644 index 0000000000..0e64eb8a09 --- /dev/null +++ b/windows/configuration/taskbar/includes/prevent-users-from-rearranging-toolbars.md @@ -0,0 +1,18 @@ +--- +author: paolomatarazzo +ms.author: paoloma +ms.date: 04/11/2024 +ms.topic: include +--- + +### Prevent users from rearranging toolbars + +With this policy setting you prevent users from rearranging toolbars. + +- If you enable this policy setting, users can't drag or drop toolbars to the taskbar +- If you disable or don't configure this policy setting, users can rearrange the toolbars on the taskbar + +| | Path | +|--|--| +| **CSP** | Not available. | +| **GPO** | **User Configuration** > **Administrative Templates** > **Start Menu and Taskbar** | diff --git a/windows/configuration/taskbar/includes/prevent-users-from-resizing-the-taskbar.md b/windows/configuration/taskbar/includes/prevent-users-from-resizing-the-taskbar.md new file mode 100644 index 0000000000..cddb749761 --- /dev/null +++ b/windows/configuration/taskbar/includes/prevent-users-from-resizing-the-taskbar.md @@ -0,0 +1,18 @@ +--- +author: paolomatarazzo +ms.author: paoloma +ms.date: 04/11/2024 +ms.topic: include +--- + +### Prevent users from resizing the taskbar + +With this policy setting you prevent users from resizing the taskbar. + +- If you enable this policy setting, users can't resize their taskbar +- If you disable or don't configure this policy setting, users can resize their taskbar, unless prevented by another setting + +| | Path | +|--|--| +| **CSP** | Not available. | +| **GPO** | **User Configuration** > **Administrative Templates** > **Start Menu and Taskbar** | diff --git a/windows/configuration/taskbar/includes/remove-access-to-the-context-menus-for-the-taskbar.md b/windows/configuration/taskbar/includes/remove-access-to-the-context-menus-for-the-taskbar.md new file mode 100644 index 0000000000..5ff72e3932 --- /dev/null +++ b/windows/configuration/taskbar/includes/remove-access-to-the-context-menus-for-the-taskbar.md @@ -0,0 +1,20 @@ +--- +author: paolomatarazzo +ms.author: paoloma +ms.date: 04/11/2024 +ms.topic: include +--- + +### Remove access to the context menus for the taskbar + +With this policy setting you can remove access to the context menus for the taskbar. + +- If you enable this policy setting, the menus that appear when you right-click the taskbar and items on the taskbar are hidden. For example the Start button, the clock, and the taskbar buttons. +- If you disable or don't configure this policy setting, the context menus for the taskbar are available + +This policy setting doesn't prevent users from using other methods to issue the commands that appear on these menus. + +| | Path | +|--|--| +| **CSP** | Not available. | +| **GPO** | - **User Configuration** > **Administrative Templates** > **Start Menu and Taskbar**

- **Computer Configuration** > **Administrative Templates** > **Start Menu and Taskbar** | diff --git a/windows/configuration/taskbar/includes/remove-clock-from-the-system-notification-area.md b/windows/configuration/taskbar/includes/remove-clock-from-the-system-notification-area.md new file mode 100644 index 0000000000..569921f889 --- /dev/null +++ b/windows/configuration/taskbar/includes/remove-clock-from-the-system-notification-area.md @@ -0,0 +1,16 @@ +--- +author: paolomatarazzo +ms.author: paoloma +ms.date: 04/11/2024 +ms.topic: include +--- + +### Remove Clock from the system notification area + +- If you enable this policy setting, the clock isn't displayed in the system notification area +- If you disable or don't configure this policy setting, the default behavior accur, and the clock appears in the notification area + +| | Path | +|--|--| +| **CSP** | Not available. | +| **GPO** | **User Configuration** > **Administrative Templates** > **Start Menu and Taskbar** | diff --git a/windows/configuration/taskbar/includes/remove-notifications-and-action-center.md b/windows/configuration/taskbar/includes/remove-notifications-and-action-center.md new file mode 100644 index 0000000000..850a20179f --- /dev/null +++ b/windows/configuration/taskbar/includes/remove-notifications-and-action-center.md @@ -0,0 +1,20 @@ +--- +author: paolomatarazzo +ms.author: paoloma +ms.date: 04/11/2024 +ms.topic: include +--- + +### Remove Notifications and Action Center + +This policy setting removes *Notifications* and *Action Center* from the notification area on the taskbar. + +The notification area is located at the far right end of the taskbar, and includes icons for current notifications and the system clock. + +- If this setting is enabled, Notifications and Action Center aren't displayed in the notification area. The user can read notifications when they appear, but they can't review any notifications they miss +- If you disable or don't configure this policy setting, Notification and Security and Maintenance are displayed on the taskbar + +| | Path | +|--|--| +| **CSP** | Not available. | +| **GPO** | **User Configuration** > **Administrative Templates** > **Start Menu and Taskbar** | diff --git a/windows/configuration/taskbar/includes/remove-pinned-programs-from-the-taskbar.md b/windows/configuration/taskbar/includes/remove-pinned-programs-from-the-taskbar.md new file mode 100644 index 0000000000..069de94c04 --- /dev/null +++ b/windows/configuration/taskbar/includes/remove-pinned-programs-from-the-taskbar.md @@ -0,0 +1,18 @@ +--- +author: paolomatarazzo +ms.author: paoloma +ms.date: 04/11/2024 +ms.topic: include +--- + +### Remove pinned programs from the Taskbar + +This policy setting allows you to remove pinned programs from the taskbar. + +- If you enable this policy setting, pinned programs are removed from the taskbar. Users can't pin programs to the taskbar +- If you disable or don't configure this policy setting, users can pin programs so that the program shortcuts stay on the taskbar + +| | Path | +|--|--| +| **CSP** | Not available. | +| **GPO** | - **User Configuration** > **Administrative Templates** > **Start Menu and Taskbar**

- **Computer Configuration** > **Administrative Templates** > **Start Menu and Taskbar** | diff --git a/windows/configuration/taskbar/includes/remove-quick-settings.md b/windows/configuration/taskbar/includes/remove-quick-settings.md new file mode 100644 index 0000000000..55eaca637d --- /dev/null +++ b/windows/configuration/taskbar/includes/remove-quick-settings.md @@ -0,0 +1,20 @@ +--- +author: paolomatarazzo +ms.author: paoloma +ms.date: 04/11/2024 +ms.topic: include +--- + +### Remove Quick Settings + +This policy setting removes Quick Settings from the bottom right area on the taskbar. The Quick Settings area is located at the left of the clock in the taskbar and includes icons for current network and volume. + +If this setting is enabled, Quick Settings isn't displayed in the Quick Settings area. + +> [!NOTE] +> A reboot is required for this policy setting to take effect. + +| | Path | +|--|--| +| **CSP** | `./User/Vendor/MSFT/Policy/Config/Start/`[DisableControlCenter](/windows/client-management/mdm/policy-csp-start#disablecontrolcenter) | +| **GPO** | **User Configuration** > **Administrative Templates** > **Start Menu and Taskbar** | diff --git a/windows/configuration/taskbar/includes/remove-the-battery-meter.md b/windows/configuration/taskbar/includes/remove-the-battery-meter.md new file mode 100644 index 0000000000..445dba6aa5 --- /dev/null +++ b/windows/configuration/taskbar/includes/remove-the-battery-meter.md @@ -0,0 +1,18 @@ +--- +author: paolomatarazzo +ms.author: paoloma +ms.date: 04/11/2024 +ms.topic: include +--- + +### Remove the battery meter + +With this policy setting you can remove the battery meter from the system control area. + +- If you enable this policy setting, the battery meter isn't displayed in the system notification area +- If you disable or don't configure this policy setting, the battery meter is displayed in the system notification area + +| | Path | +|--|--| +| **CSP** | Not available. | +| **GPO** | **User Configuration** > **Administrative Templates** > **Start Menu and Taskbar** | diff --git a/windows/configuration/taskbar/includes/remove-the-meet-now-icon.md b/windows/configuration/taskbar/includes/remove-the-meet-now-icon.md new file mode 100644 index 0000000000..75cd22365b --- /dev/null +++ b/windows/configuration/taskbar/includes/remove-the-meet-now-icon.md @@ -0,0 +1,18 @@ +--- +author: paolomatarazzo +ms.author: paoloma +ms.date: 04/11/2024 +ms.topic: include +--- + +### Remove the Meet Now icon + +With this policy setting allows you can remove the Meet Now icon from the system control area. + +- If you enable this policy setting, the Meet Now icon isn't displayed in the system notification area +- If you disable or don't configure this policy setting, the Meet Now icon is displayed in the system notification area + +| | Path | +|--|--| +| **CSP** | Not available. | +| **GPO** | **User Configuration** > **Administrative Templates** > **Start Menu and Taskbar** | diff --git a/windows/configuration/taskbar/includes/remove-the-networking-icon.md b/windows/configuration/taskbar/includes/remove-the-networking-icon.md new file mode 100644 index 0000000000..a1825e5f0e --- /dev/null +++ b/windows/configuration/taskbar/includes/remove-the-networking-icon.md @@ -0,0 +1,18 @@ +--- +author: paolomatarazzo +ms.author: paoloma +ms.date: 04/11/2024 +ms.topic: include +--- + +### Remove the networking icon + +With this policy setting you can remove the networking icon from the system control area. + +- If you enable this policy setting, the networking icon isn't displayed in the system notification area +- If you disable or don't configure this policy setting, the networking icon is displayed in the system notification area + +| | Path | +|--|--| +| **CSP** | Not available. | +| **GPO** | **User Configuration** > **Administrative Templates** > **Start Menu and Taskbar** | diff --git a/windows/configuration/taskbar/includes/remove-the-people-bar-from-the-taskbar.md b/windows/configuration/taskbar/includes/remove-the-people-bar-from-the-taskbar.md new file mode 100644 index 0000000000..679df69fde --- /dev/null +++ b/windows/configuration/taskbar/includes/remove-the-people-bar-from-the-taskbar.md @@ -0,0 +1,15 @@ +--- +author: paolomatarazzo +ms.author: paoloma +ms.date: 04/11/2024 +ms.topic: include +--- + +### Remove the People Bar from the taskbar + +With this policy allows you can remove the People Bar from the taskbar and disables the My People experience. If you enable this policy setting, the people icon is removed from the taskbar, the corresponding settings toggle is removed from the taskbar settings page, and users can't pin people to the taskbar. + +| | Path | +|--|--| +| **CSP** | `./User/Vendor/MSFT/Policy/Config/Start/`[HidePeopleBar](/windows/client-management/mdm/policy-csp-start#hidepeoplebar) | +| **GPO** | **User Configuration** > **Administrative Templates** > **Start Menu and Taskbar** | diff --git a/windows/configuration/taskbar/includes/remove-the-volume-control-icon.md b/windows/configuration/taskbar/includes/remove-the-volume-control-icon.md new file mode 100644 index 0000000000..8e34ed3d84 --- /dev/null +++ b/windows/configuration/taskbar/includes/remove-the-volume-control-icon.md @@ -0,0 +1,18 @@ +--- +author: paolomatarazzo +ms.author: paoloma +ms.date: 04/11/2024 +ms.topic: include +--- + +### Remove the volume control icon + +With this policy setting you can remove the volume control icon from the system control area. + +- If you enable this policy setting, the volume control icon isn't displayed in the system notification area +- If you disable or don't configure this policy setting, the volume control icon is displayed in the system notification area + +| | Path | +|--|--| +| **CSP** | Not available. | +| **GPO** | **User Configuration** > **Administrative Templates** > **Start Menu and Taskbar** | diff --git a/windows/configuration/taskbar/includes/show-additional-calendar.md b/windows/configuration/taskbar/includes/show-additional-calendar.md new file mode 100644 index 0000000000..39ecd45a89 --- /dev/null +++ b/windows/configuration/taskbar/includes/show-additional-calendar.md @@ -0,0 +1,22 @@ +--- +author: paolomatarazzo +ms.author: paoloma +ms.date: 04/11/2024 +ms.topic: include +--- + +### Show additional calendar + +By default, the calendar is set according to the locale of the operating system, and users can show an additional calendar. + +- For `zh-CN` and `zh-SG` locales, an additional calendar shows the lunar month and date and holiday names in Simplified Chinese (Lunar) by default +- For `zh-TW`, `zh-HK`, and `zh-MO` locales, an additional calendar shows the lunar month and date and holiday names in Traditional Chinese (Lunar) by default + +- If you enable this policy setting, users can show an additional calendar in either Simplified Chinese (Lunar) or Traditional Chinese (Lunar), regardless of the locale +- If you disable this policy setting, users can't show an additional calendar, regardless of the locale +- If you don't configure this policy setting, the calendar will be set according to the default logic + +| | Path | +|--|--| +| **CSP** | Not available. | +| **GPO** | **User Configuration** > **Administrative Templates** > **Start Menu and Taskbar** | diff --git a/windows/configuration/taskbar/includes/simplify-quick-settings-layout.md b/windows/configuration/taskbar/includes/simplify-quick-settings-layout.md new file mode 100644 index 0000000000..ea3d57141e --- /dev/null +++ b/windows/configuration/taskbar/includes/simplify-quick-settings-layout.md @@ -0,0 +1,16 @@ +--- +author: paolomatarazzo +ms.author: paoloma +ms.date: 04/11/2024 +ms.topic: include +--- + +### Simplify Quick Settings Layout + +- If you enable this policy, Quick Settings is reduced to only having the Wi-Fi, Bluetooth, Accessibility, and VPN buttons. The brightness slider, volume slider, and battery indicator and link to the Settings app +- If you disable or don't configure this policy setting, the regular Quick Settings layout appears whenever Quick Settings is invoked + +| | Path | +|--|--| +| **CSP** | `./Device/Vendor/MSFT/Policy/Config/Start/`[SimplifyQuickSettings](/windows/client-management/mdm/policy-csp-start#simplifyquicksettings) | +| **GPO** | **Computer Configuration** > **Administrative Templates** > **Start Menu and Taskbar** | diff --git a/windows/configuration/taskbar/includes/turn-off-automatic-promotion-of-notification-icons-to-the-taskbar.md b/windows/configuration/taskbar/includes/turn-off-automatic-promotion-of-notification-icons-to-the-taskbar.md new file mode 100644 index 0000000000..4e9527beef --- /dev/null +++ b/windows/configuration/taskbar/includes/turn-off-automatic-promotion-of-notification-icons-to-the-taskbar.md @@ -0,0 +1,18 @@ +--- +author: paolomatarazzo +ms.author: paoloma +ms.date: 04/11/2024 +ms.topic: include +--- + +### Turn off automatic promotion of notification icons to the taskbar + +With this policy setting you can turn off automatic promotion of notification icons to the taskbar. + +- If you enable this policy setting, newly added notification icons aren't temporarily promoted to the Taskbar. Users can still configure icons to be shown or hidden in the Notification Control Panel. +- If you disable or don't configure this policy setting, newly added notification icons are temporarily promoted to the Taskbar + +| | Path | +|--|--| +| **CSP** | Not available. | +| **GPO** | **User Configuration** > **Administrative Templates** > **Start Menu and Taskbar** | diff --git a/windows/configuration/taskbar/includes/turn-off-notification-area-cleanup.md b/windows/configuration/taskbar/includes/turn-off-notification-area-cleanup.md new file mode 100644 index 0000000000..56f39f1f65 --- /dev/null +++ b/windows/configuration/taskbar/includes/turn-off-notification-area-cleanup.md @@ -0,0 +1,21 @@ +--- +author: paolomatarazzo +ms.author: paoloma +ms.date: 04/11/2024 +ms.topic: include +--- + +### Turn off notification area cleanup + +This setting affects the notification area, also called the *system tray*. The notification area is located in the task bar, generally at the bottom of the screen, and it includes the clock and current notifications. + +This setting determines whether the items are always expanded or always collapsed. By default, notifications are collapsed. The notification cleanup `<<` icon can be referred to as the *notification chevron*. + +- If you enable this setting, the system notification area expands to show all of the notifications that use this area +- If you disable this setting, the system notification area always collapses notifications +- If you don't configure it, the user can choose if they want notifications collapsed or expanded + +| | Path | +|--|--| +| **CSP** | Not available. | +| **GPO** | **User Configuration** > **Administrative Templates** > **Start Menu and Taskbar** | diff --git a/windows/configuration/taskbar/includes/turn-off-windows-copilot.md b/windows/configuration/taskbar/includes/turn-off-windows-copilot.md new file mode 100644 index 0000000000..69b9f7fd71 --- /dev/null +++ b/windows/configuration/taskbar/includes/turn-off-windows-copilot.md @@ -0,0 +1,18 @@ +--- +author: paolomatarazzo +ms.author: paoloma +ms.date: 04/11/2024 +ms.topic: include +--- + +### Turn off Windows Copilot + +This policy setting allows you to turn off Windows Copilot. + +- If you enable this policy setting, users can't use Copilot. The Copilot icon doesn't appear on the taskbar either +- If you disable or don't configure this policy setting, users can use Copilot, if available + +| | Path | +|--|--| +| **CSP** | `./User/Vendor/MSFT/Policy/Config/WindowsAI/`[TurnOffWindowsCopilot](/windows/client-management/mdm/policy-csp-windowsai#turnoffwindowscopilot) | +| **GPO** | **User Configuration** > **Administrative Templates** > **Windows Components** > **Windows Copilot** | diff --git a/windows/configuration/taskbar/index.md b/windows/configuration/taskbar/index.md index 8061acd2b6..04b5c9de37 100644 --- a/windows/configuration/taskbar/index.md +++ b/windows/configuration/taskbar/index.md @@ -1,540 +1,105 @@ --- -title: Configure Windows taskbar +title: Configure the Windows taskbar description: Administrators can pin more apps to the taskbar and remove default pinned apps from the taskbar by adding a section to a layout modification XML file. ms.topic: how-to -ms.date: 08/18/2023 +ms.date: 04/17/2024 appliesto: zone_pivot_groups: windows-versions-11-10 --- -# Configure Windows Taskbar +# Configure the Windows taskbar -::: zone pivot="windows-10" - -Starting in Windows 10, version 1607, administrators can pin more apps to the taskbar and remove default pinned apps from the taskbar by adding a `` section to a layout modification XML file. This method never removes user-pinned apps from the taskbar. - -> [!NOTE] -> The only aspect of the taskbar that can currently be configured by the layout modification XML file is the layout. - -You can specify different taskbar configurations based on device locale and region. There's no limit on the number of apps that you can pin. You specify apps using the [Application User Model ID (AUMID)](../kiosk/find-the-application-user-model-id-of-an-installed-app.md) or Desktop Application Link Path (the local path to the application). - -If you specify an app to be pinned that isn't provisioned for the user on the computer, the pinned icon won't appear on the taskbar. - -The order of apps in the XML file dictates the order of pinned apps on the taskbar from left to right, starting to the right of any existing apps pinned by the user. - -> [!NOTE] -> In operating systems configured to use a right-to-left language, the taskbar order will be reversed. - -The following example shows how apps will be pinned: Windows default apps to the left (blue circle), apps pinned by the user in the center (orange triangle), and apps that you pin using the XML file to the right (green square). - -![Windows left, user center, enterprise to the right.](images/taskbar-generic.png) - -## Configure taskbar (general) - -To configure the taskbar: - -1. Create the XML file - - If you're also [customizing the Start layout](../start/customize-and-export-start-layout.md), use `Export-StartLayout` to create the XML, and then add the `` section from [the following sample](#sample-taskbar-configuration-added-to-start-layout-xml-file) to the file. - - If you're only configuring the taskbar, use [the following sample](#sample-taskbar-configuration-xml-file) to create a layout modification XML file -1. Edit and save the XML file. You can use [AUMID](../kiosk/find-the-application-user-model-id-of-an-installed-app.md) or Desktop Application Link Path to identify the apps to pin to the taskbar - - Add `xmlns:taskbar="http://schemas.microsoft.com/Start/2014/TaskbarLayout"` to the first line of the file, before the closing \>. - - Use `` and [AUMID](../kiosk/find-the-application-user-model-id-of-an-installed-app.md) to pin Universal Windows Platform apps - - Use `` and Desktop Application Link Path to pin desktop applications -1. Apply the layout modification XML file to devices using Group Policy or a provisioning package. - ->[!IMPORTANT] ->If you use a provisioning package or import-startlayout to configure the taskbar, your configuration will be reapplied each time the explorer.exe process restarts. If your configuration pins an app and the user then unpins that app, the user's change will be overwritten the next time the configuration is applied. To apply a taskbar configuration that allows users to make changes that will persist, apply your configuration by using Group Policy. -> ->If you use Group Policy and your configuration only contains a taskbar layout, the default Windows tile layout will be applied and cannot be changed by users. If you use Group Policy and your configuration includes taskbar and a full Start layout, users can only make changes to the taskbar. If you use Group Policy and your configuration includes taskbar and a [partial Start layout](../start/customize-and-export-start-layout.md#configure-a-partial-start-layout), users can make changes to the taskbar and to tile groups not defined in the partial Start layout. - -### Tips for finding AUMID and Desktop Application Link Path - -In the layout modification XML file, you'll need to add entries for applications in the XML markup. In order to pin an application, you need either its AUMID or Desktop Application Link Path. - -The easiest way to find this data for an application is to: - -1. Pin the application to the Start menu on a reference or testing PC -1. Open Windows PowerShell and run the `Export-StartLayout` cmdlet -1. Open the generated XML file -1. Look for an entry corresponding to the app you pinned -1. Look for a property labeled `AppUserModelID` or `DesktopApplicationLinkPath` - -### Sample taskbar configuration XML file - -```xml - - - - - - - - - - - -``` - -### Sample taskbar configuration added to Start layout XML file - -```xml - - - - - - - - - - - - - - - - - - - - - - - - -``` - -## Keep default apps and add your own - -The `` section will append listed apps to the taskbar by default. The following sample keeps the default apps pinned and adds pins for Paint, Microsoft Reader, and a command prompt. - -```xml - - - - - - - - - - - - -``` - -**Before:** - -![default apps pinned to taskbar.](images/taskbar-default.png) - -**After:** - - ![additional apps pinned to taskbar.](images/taskbar-default-plus.png) - -## Remove default apps and add your own - -By adding `PinListPlacement="Replace"` to ``, you remove all default pinned apps; only the apps that you specify will be pinned to the taskbar. - -If you only want to remove some of the default pinned apps, you would use this method to remove all default pinned apps and then include the default app that you want to keep in your list of pinned apps. - -```xml - - - - - - - - - - - - -``` - -**Before:** - -![Taskbar with default apps.](images/taskbar-default.png) - -**After:** - -![Taskbar with default apps removed.](images/taskbar-default-removed.png) - -## Remove default apps - -By adding `PinListPlacement="Replace"` to ``, you remove all default pinned apps. - -```xml - - - - - - - - - - -``` - -## Configure taskbar by country or region - -The following example shows you how to configure taskbars by country or region. When the layout is applied to a computer, if there's no `` node with a region tag for the current region, the first `` node that has no specified region will be applied. When you specify one or more countries or regions in a `` node, the specified apps are pinned on computers configured for any of the specified countries or regions. - -```xml - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -``` - -When the preceding example XML file is applied, the resulting taskbar for computers in the US or UK: - -![taskbar for US and UK locale.](images/taskbar-region-usuk.png) - -The resulting taskbar for computers in Germany or France: - -![taskbar for DE and FR locale.](images/taskbar-region-defr.png) - -The resulting taskbar for computers in any other country region: - -![taskbar for all other regions.](images/taskbar-region-other.png) - -> [!NOTE] -> [Look up country and region codes (use the ISO Short column)](/previous-versions/commerce-server/ee799297(v=cs.20)) - -## Layout Modification Template schema definition - -```xml - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -``` - -::: zone-end +The Windows taskbar is an essential component of the Windows operating system. The taskbar acts as a versatile platform for multitasking and quick access to applications and system notifications. For organizations, the ability to customize the taskbar's layout and features through policy settings is invaluable, especially in scenarios where specific roles or functions require streamlined access to certain tools and programs. ::: zone pivot="windows-11" -> **Looking for OEM information?** See [Customize the Taskbar](/windows-hardware/customize/desktop/customize-the-windows-11-taskbar) and [Customize the Start layout](/windows-hardware/customize/desktop/customize-the-windows-11-start-menu). - -Your organization can deploy a customized taskbar to your Windows devices. Customizing the taskbar is common when your organization uses a common set of apps, or wants to bring attention to specific apps. You can also remove the default pinned apps. - -For example, you can override the default set of apps with your own a set of pinned apps, and in the order you choose. As an administrator, use this feature to pin apps, remove default pinned apps, order the apps, and more on the taskbar. - -To add apps you want pinned to the taskbar, you use an XML file. You can use an existing XML file, or create a new file. If you have an XML file that's used on Windows 10 devices, you can also use it on Windows 11 devices. You may have to update the App IDs. - -This article shows you how to create the XML file, add apps to the XML, and deploy the XML file. To learn how to customize the taskbar buttons, see [CSP policies to customize Windows 11 taskbar buttons](supported-csp-taskbar-windows.md#csp-policies-to-customize-windows-11-taskbar-buttons). - -## Before you begin - -- There isn't a limit on the number of apps that you can pin. In the XML file, add apps using the [Application User Model ID (AUMID)](../kiosk/find-the-application-user-model-id-of-an-installed-app.md) or Desktop Application Link Path (the local path to the app). -- There are some situations that an app pinned in your XML file won't be pinned in the taskbar. For example, if an app isn't approved or installed for a user, then the pinned icon won't show on the taskbar. -- The order of apps in the XML file dictates the order of pinned apps on the taskbar, from left to right, and to the right of any existing apps pinned by the user. If the OS is configured to use a right-to-left language, then the taskbar order is reversed. -- Some classic Windows applications are packaged differently than they were in previous versions of Windows, including Notepad and File Explorer. Be sure to enter the correct AppID. For more information, see [Application User Model ID (AUMID)](../kiosk/find-the-application-user-model-id-of-an-installed-app.md) and [Get the AUMID and Desktop app link path](#get-the-aumid-and-desktop-app-link-path) (in this article). -- It's recommended to use a Mobile Device Management (MDM) provider. MDM providers help manage your devices, and help manage apps on your devices. You can use Microsoft Intune. Intune is a family of products that include Microsoft Intune, which is a cloud service, and Configuration Manager, which is on-premises. - - In this article, we mention these services. If you're not managing your devices using an MDM provider, the following resources may help you get started: - - - [Endpoint Management at Microsoft](/mem/endpoint-manager-overview) - - [What is Microsoft Intune](/mem/intune/fundamentals/what-is-intune) and [Microsoft Intune planning guide](/mem/intune/fundamentals/intune-planning-guide) - - [What is Configuration Manager?](/mem/configmgr/core/understand/introduction) - -## Create the XML file - -1. In a text editor, such as Visual Studio Code, create a new XML file. To help you get started, you can copy and paste the following XML sample. The sample pins 2 apps to the taskbar - File Explorer and the Command Prompt: - - ```xml - - - - - - - - - - - - ``` - -1. In the `` node, add (or remove) the apps you want pinned. You can pin Universal Windows Platform (UWP) apps and desktop apps: - - - ``: Select this option for UWP apps. Add the [AUMID](../kiosk/find-the-application-user-model-id-of-an-installed-app.md) of the UWP app. - - ``: Select this option for desktop apps. Add the Desktop Application Link Path of the desktop app. - - You can pin as many apps as you want. Just keep adding them to the list. Remember, the app order in the list is the same order the apps are shown on the taskbar. - - For more information, see [Get the AUMID and Desktop app link path](#get-the-aumid-and-desktop-app-link-path) (in this article). - -1. In the `` node, the apps you add are pinned after the default apps. If you want to remove the default apps, and only show the apps you add in the XML file, then add `PinListPlacement="Replace"`: - - - ``: Keeps the default pinned apps. After the default apps, the apps you add are pinned. - - ``: Unpins the default apps. Only the apps you add are pinned. - - If you want to remove some of the default pinned apps, then add `PinListPlacement="Replace"`. When you add your apps to ``, include the default apps you still want pinned. - -1. In the `` node, use `region=" | "` to use different taskbar configurations based on the device locale and region. - - In the following XML example, two regions are added: `US|UK` and `DE|FR`: - - ```xml - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - ``` - - The taskbar applies when: - - - If the `` node has a country or region, then the apps are pinned on devices configured for that country or region. - - If the `` node doesn't have a region tag for the current region, then the first `` node with no region is applied. - -1. Save the file, and name the file so you know what it is. For example, name the file something like `TaskbarLayoutModification.xml`. Once you have the file, it's ready to be deployed to your Windows devices. - -## Use Group Policy or MDM to create and deploy a taskbar policy - -Now that you have the XML file with your customized taskbar, you're ready to deploy it to devices in your organization. You can deploy your taskbar XML file using Group Policy, or using an MDM provider, like Microsoft Intune. - -This section shows you how to deploy the XML both ways. - -### Use Group Policy to deploy your XML file - -Use the following steps to add your XML file to a group policy, and apply the policy: - -1. Open your policy editor. For example, open Group Policy Management Console (GPMC) for domain-based group policies, or open `gpedit` for local policies. -1. Go to one of the following policies: - - - `Computer Configuration\Administrative Templates\Start Menu and Taskbar\Start Layout` - - `User Configuration\Administrative Templates\Start Menu and Taskbar\Start Layout` - -1. Double-select `Start Layout` > **Enable**. Enter the fully qualified path to your XML file, including the XML file name. You can enter a local path, like `C:\StartLayouts\TaskbarLayoutModification.xml`, or a network path, like `\\Server\Share\TaskbarLayoutModification.xml`. Be sure you enter the correct file path. If using a network share, be sure to give users read access to the XML file. If the file isn't available when the user signs in, then the taskbar isn't changed. Users can't customize the taskbar when this setting is enabled. - - Your policy looks like the following policy: - - :::image type="content" source="images/start-layout-group-policy.png" alt-text="Add your taskbar layout XML file to the Start Layout policy on Windows devices."::: - - The `User Configuration\Administrative Templates\Start Menu and Taskbar` policy includes other settings that control the taskbar. Some policies may not work as expected. Be sure to test your policies before broadly deploying them across your devices. - -1. When you apply the policy, the taskbar includes your changes. The next time users sign in, they'll see the changes. - - For more information on using group policies, see [Implement Group Policy Objects](/training/modules/implement-group-policy-objects/). - -### Create a Microsoft Intune policy to deploy your XML file - -MDM providers can deploy policies to devices managed by the organization, including organization-owned devices, and personal or bring your own device (BYOD). Using an MDM provider, such as Microsoft Intune, you can deploy a policy that configures the pinned list. - -Use the following steps to create an Intune policy that deploys your taskbar XML file: - -1. Sign in to the [Intune admin center](https://go.microsoft.com/fwlink/?linkid=2109431). - -1. Select **Devices** > **Configuration profiles** > **Create profile**. - -1. Enter the following properties: - - - **Platform**: Select **Windows 10 and later**. - - **Profile type**: Select **Templates** > **Device restrictions** > **Create**. - -1. In **Basics**, enter the following properties: - - - **Name**: Enter a descriptive name for the profile. Name your profiles so you can easily identify it later. For example, a good profile name is **Win11: Custom taskbar**. - - **Description**: Enter a description for the profile. This setting is optional, and recommended. - -1. Select **Next**. - -1. In **Configuration settings**, select **Start** > **Start menu layout**. Browse to, and select your taskbar XML file. - -1. Select **Next**, and configure the rest of the policy settings. For more specific information, see [Configure device restriction settings](/mem/intune/configuration/device-restrictions-configure). - -1. When the policy is created, you can deploy it now, or deploy it later. Since this policy is a customized taskbar, the policy can also be deployed before users sign in the first time. - - For more information and guidance on assigning policies using Microsoft Intune, see [Assign user and device profiles](/mem/intune/configuration/device-profile-assign). - -> [!NOTE] -> For third party partner MDM solutions, you may need to use an OMA-URI setting for Start layout, based on the [Policy configuration service provider (CSP)](/windows/client-management/mdm/policy-configuration-service-provider). The OMA-URI setting is `./User/Vendor/MSFT/Policy/Config/Start/StartLayout`. - -## Get the AUMID and Desktop app link path - -In the layout modification XML file, you add apps in the XML markup. To pin an app, you enter the AUMID or Desktop Application Link Path. The easiest way to find this app information is to use the [Export-StartLayout](/powershell/module/startlayout/export-startlayout) Windows PowerShell cmdlet: - -1. On an existing Windows 11 device, pin the app to the Start menu. -1. Create a folder to save an output file. For example, create the `C:\Layouts` folder. -1. Open the Windows PowerShell app, and run the following cmdlet: - - ```powershell - Export-StartLayout -Path "C:\Layouts\GetIDorPath.xml" - ``` - -1. Open the generated GetIDorPath.xml file, and look for the app you pinned. When you find the app, get the AppID or Path. Add these properties to your XML file. - -## Pin order for all apps - -On a taskbar, the following apps are typically pinned: - -- Apps pinned by the user -- Default Windows apps pinned during the OS installation, such as Microsoft Edge, File Explorer, and Microsoft Store. -- Apps pinned by your organization, such as in an unattended Windows setup. - - In an unattended Windows setup file, use the XML file you created in this article. It's not recommended to use [TaskbarLinks](/windows-hardware/customize/desktop/unattend/microsoft-windows-shell-setup-taskbarlinks). - -Apps are pinned in the following order: - -1. Windows default apps are pinned first. -1. User-pinned apps are pinned after the Windows default apps. -1. XML-pinned apps are pinned after the user-pinned apps. - -If the OS is configured to use a right-to-left language, then the taskbar order is reversed. - -## OS install and upgrade - -- On a clean install of the Windows client, if you apply a taskbar layout, the following apps are pinned to the taskbar: - - - Apps you specifically add - - Any default apps you don't remove - - After the taskbar layout is applied, users can pin more apps, change the order, and unpin apps. - -- On a Windows client upgrade, apps are already pinned to the taskbar. These apps may have been pinned by a user, by an image, or by using Windows unattended setup. For upgrades, the taskbar layout applies the following behavior: - - - If users pinned apps to the taskbar, then those pinned apps remain. New apps are pinned after the existing user-pinned apps. - - If the apps are pinned during the install or by a policy (not by a user), and the apps aren't pinned in an updated layout file, then the apps are unpinned. - - If a user didn't pin an app, and the same app is pinned in the updated layout file, then the app is pinned after any existing pinned apps. - - New apps in updated layout file are pinned after the user's pinned apps. - - After the layout is applied, users can pin more apps, change the order, and unpin apps. +:::image type="content" source="images/taskbar-11.png" alt-text="Screenshot of the Windows 11 taskbar." border="false" lightbox="./images/taskbar-11.png"::: ::: zone-end + +::: zone pivot="windows-10" + +:::image type="content" source="images/taskbar-10.png" alt-text="Screenshot of the Windows 10 taskbar." border="false" lightbox="./images/taskbar-10.png"::: + +::: zone-end + +For example, students can benefit from a customized taskbar that can provide access to educational tools and resources, minimizing distractions and optimizing the learning environment. + +Frontline workers, who often operate in fast-paced and dynamic settings, can benefit from a taskbar that is configured to provide immediate access to the most critical applications and functions they need. The taskbar customization can streamline workflows and enhance productivity by reducing the time spent navigating through unnecessary applications or menus. + +Kiosks, which are designed for public use, can also take advantage of taskbar customization to offer a simplified and focused interface. This can help users quickly find the information or services they're looking for, which is useful in environments like retail, information centers, or public service areas. + +Overall, the ability to customize the Windows taskbar using policy settings enables organizations to create a more controlled, efficient, and user-friendly computing environment tailored to the specific needs of different user groups. + +## Taskbar structure + +The Windows taskbar consists of several key components that can be customized to meet the needs of different scenarios. + +::: zone pivot="windows-11" + +Let's review the components of the Windows taskbar by dividing it into three areas: + +1. The *left area* contains Widgets, which provide personalized news, weather, and other information +1. The *center area* contains: + 1. Start menu + 1. Search + 1. Task view + 1. Pinned and running apps +1. The *right area* contains: + 1. The system tray, which displays icons like the pen menu, touch keyboard, virtual touchpad, and any application icons that are running in the background like OneDrive, Teams, or antivirus software + 1. Quick Actions + 1. Calendar + 1. Action Center + 1. Copilot + +:::image type="content" source="images/taskbar-sections-11.png" alt-text="Screenshot of the Windows 11 taskbar with the three areas highlighted." border="false" lightbox="./images/taskbar-sections-11.png"::: + +::: zone-end + +::: zone pivot="windows-10" + +Let's review the components of the Windows taskbar by dividing it into two areas: + +1. The *left area* contains: + - Start menu + - Search + - Cortana + - Task view + - Pinned and running apps + +1. The *right area* contains: + - People + - News and interests + - The system tray, which displays icons like the pen menu, touch keyboard, virtual touchpad, power, network, volume, and any application icons that are running in the background like OneDrive, Teams, or antivirus software + - Calendar + - Action center + - Copilot + +:::image type="content" source="images/taskbar-sections-10.png" alt-text="Screenshot of the Windows 11 taskbar with the two areas highlighted." border="false" lightbox="./images/taskbar-sections-10.png"::: + +::: zone-end + +## Configuration options + +There are several options to configure the Windows taskbar. + +If you need to configure a device for a single user, you can pin/unpin applications to the taskbar and rearrange them. The taskbar can be further customized from Settings. Go to **Settings** > **Personalization** > **[Taskbar](ms-settings:taskbar)**. + +For advanced customizations and when you need to configure multiple devices, you can use one of the following options: + +- Configuration Service Provider (CSP): commonly used for devices managed by a Mobile Device Management (MDM) solution, like Microsoft Intune. CSPs can also be configured with [provisioning packages](../provisioning-packages/how-it-pros-can-use-configuration-service-providers.md#csps-in-windows-configuration-designer), which are used at deployment time or for unmanaged devices. To configure the taskbar, use the [Start Policy CSP][WIN-1] +- Group policy (GPO): used for devices that are Active Directory joined or Microsoft Entra hybrid joined, and not managed by a device management solution. Group policy can also be used for devices that aren't joined to an Active Directory domain, using the local group policy editor + +> [!NOTE] +> While many of the taskbar policy settings can be configured using both CSP and GPO, there are some settings that are exclusive to one or the other. To learn about the available policy settings to configure the Start menu via CSP and GPO, see [Taskbar policy settings](policy-settings.md). + +## Next steps + +In the next sections, you can learn more about the options available to configure Start menu settings using the Configuration Service Provider (CSP) and Group Policy (GPO): + +- [Taskbar policy settings](policy-settings.md) +- [Configure the taskbar pinned applications](pinned-apps.md) + + + +[WIN-1]: /windows/client-management/mdm/policy-csp-start diff --git a/windows/configuration/taskbar/pinned-apps.md b/windows/configuration/taskbar/pinned-apps.md new file mode 100644 index 0000000000..d38c8a7d60 --- /dev/null +++ b/windows/configuration/taskbar/pinned-apps.md @@ -0,0 +1,233 @@ +--- +title: Configure the applications pinned to the taskbar +description: Learn how to configure the applications pinned to the Windows taskbar. +ms.topic: how-to +ms.date: 04/17/2024 +appliesto: +zone_pivot_groups: windows-versions-11-10 +--- + +# Configure the applications pinned to the taskbar + +The configuration of the applications pinned to the taskbar is done with the use of an XML file. This article describes how to create and deploy the XML configuration file. + +> [!NOTE] +> If you are looking for OEM information, see the article [Customize the Taskbar](/windows-hardware/customize/desktop/customize-the-windows-11-taskbar). + +To learn about all the policy settings to customize the taskbar layout and configure the taskbar behaviors, see [Taskbar policy settings](policy-settings.md). + +## Before you begin + +Here are some considerations before you start configuring the taskbar pinned applications: + +- There's no limit to the number of apps that you can pin +- In the XML file, add apps using the Application User Model ID (AUMID), the Desktop Application ID, or the Desktop Application Link Path +- Some classic Windows applications are packaged differently than they were in previous versions of Windows, including Notepad and File Explorer. Make sure to enter the correct Application ID. To learn more, see [Find the Application User Model ID of an installed app](../store/find-aumid.md) +- If you specify an app to be pinned that isn't provisioned for the user on the device, the pinned icon doesn't appear on the taskbar +- The order of applications in the XML file dictates the order of pinned apps on the taskbar, from left to right. If the OS is configured to use a right-to-left language, then the taskbar order is reversed +- Applications can be pinned using the following methods: + - Default Windows apps, pinned during the OS installation. For example: Microsoft Edge, File Explorer, and Store. These applications are pinned first (blue square) + - Pinned manually by the user. These applications are usually pinned next to the default pinned apps (red circle) + - Pinned via policy settings. These applications are pinned after the apps pinned manually by the user (green triangle) + +::: zone pivot="windows-10" + +:::image type="content" source="images/pin-layout-10.png" border="false" lightbox="images/pin-layout-10.png" alt-text="Screenshot of the taskbar with Windows default pinned apps, user pinned apps, and policy-pinned apps."::: + +::: zone-end + +::: zone pivot="windows-11" + +:::image type="content" source="images/pin-layout-11.png" border="false" lightbox="images/pin-layout-11.png" alt-text="Screenshot of the taskbar with Windows default pinned apps, user pinned apps, and policy-pinned apps."::: + +::: zone-end + +## Configuration steps + +The following steps describe how to configure the taskbar pinned applications using policy settings: + +1. Create the XML file. You can start with the [XML example](#taskbar-layout-example) +1. Edit the XML file to meet your requirements and save it +1. Deploy the XML file to devices using configuration service provider (CSP), provisioning packages (PPKG), or group policy (GPO) + +>[!IMPORTANT] +>If you use a provisioning package or `import-startlayout` to configure the taskbar, your configuration will be reapplied each time the `explorer.exe` process restarts. If your configuration pins an app and the user then unpins that app, the user's change will be overwritten the next time the configuration is applied. To apply a taskbar configuration that allows users to make changes that will persist, apply your configuration by using CSP or GPO. + +::: zone pivot="windows-10" + +>[!NOTE] +>If you use GPO and your configuration only contains a taskbar layout, the default Windows tile layout will be applied and cannot be changed by users. If you use GPO and your configuration includes taskbar and a full Start layout, users can only make changes to the taskbar. If you use Group Policy and your configuration includes taskbar and a partial Start layout, users can make changes to the taskbar and to tile groups not defined in the partial Start layout. +> +> For more information, see [Configure the Start menu](../start/index.md). + +::: zone-end + +## Taskbar layout example + +Here you can find an example of taskbar layout that you can use as a reference: + +[!INCLUDE [example](includes/example.md)] + +### Modify the configuration file + +> [!CAUTION] +> When you make changes to the XML file, be aware that the XML format must adhere to an [XML schema definition (XSD)](xsd.md). + +You can change the apps pinned to the taskbar by modifying the `` node. + +1. In the `` node, add (or remove) the apps you want pinned. You can pin Universal Windows Platform (UWP) apps and desktop apps: + - ``: Select this option for UWP apps. Add the *AUMID* of the UWP app + - ``: Select this option for desktop apps. Add the *Desktop Application ID* or the *Desktop Application Link Path* of the desktop app +1. In the `` node, the apps you add are pinned after the default apps. If you want to remove the default apps, and only show the apps you add in the XML file, then add `PinListPlacement="Replace"`: + - ``: Keeps the default pinned apps. After the default apps, the apps you add are pinned + - ``: Unpins the default apps. Only the apps you add are pinned. If you want to remove some of the default pinned apps, then add `PinListPlacement="Replace"`. When you add your apps to ``, include the default apps you still want pinned +1. In the `` node, use `region=" | "` to use different taskbar configurations based on the device locale and region +1. Save the file + +For practical examples of how to add, remove, or replace pinned apps, see the following sections: + +- [Add pins](#example-add-pins) +- [Remove default pins](#example-remove-pins) +- [Replace default pins](#example-replace-pins) +- [Configure the taskbar by country or region](#example-configure-the-taskbar-by-country-or-region) + +#### Example: add pins + +The `` section appends the listed apps to the taskbar by default. The following sample keeps the default apps pinned and adds pins for Paint, Microsoft Reader, and a command prompt. + +[!INCLUDE [example-add-pins](includes/example-add-pins.md)] + +**Before and after:** + +::: zone pivot="windows-11" +:::image type="content" source="images/pin-add-11.png" alt-text="Screenshot of the Windows 11 taskbar, before and after adding pins." border="false" lightbox="./images/pin-add-11.png"::: +::: zone-end + +::: zone pivot="windows-10" +:::image type="content" source="images/pin-add-10.png" alt-text="Screenshot of the Windows 10 taskbar, before and after adding pins." border="false" lightbox="./images/pin-add-10.png"::: +::: zone-end + +#### Example: remove pins + +To remove all pins, add `PinListPlacement="Replace"` to ``. + +[!INCLUDE [example-remove-pins](includes/example-remove-pins.md)] + +**Before and after:** + +::: zone pivot="windows-11" +:::image type="content" source="images/pin-remove-11.png" alt-text="Screenshot of the Windows 11 taskbar, before and after removing pins." border="false" lightbox="images/pin-remove-11.png"::: +::: zone-end + +::: zone pivot="windows-10" +:::image type="content" source="images/pin-remove-10.png" alt-text="Screenshot of the Windows 10 taskbar, before and after removing pins." border="false" lightbox="images/pin-remove-10.png"::: +::: zone-end + +#### Example: replace pins + +To replace all default pins and add your own pins, add `PinListPlacement="Replace"` to ``. Then, add the pins that you want to `TaskbarPinList`. + +[!INCLUDE [example-replace-pins](includes/example-replace-pins.md)] + +**Before and after:** + +::: zone pivot="windows-11" +:::image type="content" source="images/pin-replace-11.png" alt-text="Screenshot of the Windows 11 taskbar, before and after replacing pins." border="false" lightbox="images/pin-replace-11.png"::: +::: zone-end + +::: zone pivot="windows-10" +:::image type="content" source="images/pin-replace-10.png" alt-text="Screenshot of the Windows 10 taskbar, before and after replacing pins." border="false" lightbox="images/pin-replace-10.png"::: +::: zone-end + +#### Example: configure the taskbar by country or region + +In the following XML example, two regions are added: `US|UK` and `DE|FR|IT`: + +[!INCLUDE [example](includes/example-region.md)] + +- If the `` node has region matching the one configured on the device, then the configuration applies +- If the `` node doesn't have a region matching the one configured on the device, then the first `` node without region applies + +> [!NOTE] +> [Look up country and region codes (use the ISO Short column)](/previous-versions/commerce-server/ee799297(v=cs.20)) + +## Deploy the taskbar configuration + +[!INCLUDE [tab-intro](../../../includes/configure/tab-intro.md)] + +#### [:::image type="icon" source="../images/icons/intune.svg"::: **Intune/CSP**](#tab/intune) + +To configure devices with Microsoft Intune, [create a Settings catalog policy](/mem/intune/configuration/settings-catalog) and use one of the following settings: + +| Category | Setting name | Value | +|--|--|--| +| **Start** | Start Layout | Content of the XML file| +| **Start** | Start Layout (User) | Content of the XML file| + +[!INCLUDE [intune-settings-catalog-2](../../../includes/configure/intune-settings-catalog-2.md)] + +Alternatively, you can configure devices using a [custom policy][MEM-1] with the [Start CSP][WIN-1]. Use one of the following settings: + +| Setting | +|--| +| - **OMA-URI:** `./User/Vendor/MSFT/Policy/Config/Start/`[StartLayout](/windows/client-management/mdm/policy-csp-Start#startlayout)
- **String:**
- **Value:** content of the XML file | +| - **OMA-URI:** `./Device/Vendor/MSFT/Policy/Config/Start/`[StartLayout](/windows/client-management/mdm/policy-csp-Start#startlayout)
- **Data type:**
- **Value:** content of the XML file | + +[!INCLUDE [intune-custom-settings-2](../../../includes/configure/intune-custom-settings-2.md)] + +#### [:::image type="icon" source="../images/icons/provisioning-package.svg"::: **PPKG**](#tab/ppkg) + +[!INCLUDE [provisioning-package-1](../../../includes/configure/provisioning-package-1.md)] + +- **Path:** `Policies/Start/StartLayout` +- **Value:** content of the XML file + +> [!NOTE] +> The content of the file must be entered as a single line in the `Value` field. Use a text editor to remove any line breaks from the XML file, usually with a function called *join lines*. + +[!INCLUDE [provisioning-package-2](../../../includes/configure/provisioning-package-2.md)] + +#### [:::image type="icon" source="../images/icons/group-policy.svg"::: **GPO**](#tab/gpo) + +To configure a device with group policy, use the [Local Group Policy Editor](/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/cc731745(v=ws.10)). To configure multiple devices joined to Active Directory, [create or edit](/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/cc754740(v=ws.11)) a group policy object (GPO) and use one of the following settings: + +| Group policy path | Group policy setting | Value | +| - | - | - | +|**Computer Configuration** > **Administrative Templates** > **Start Menu and Taskbar**| Start Layout | Path to the XML file | +|**User Configuration** > **Administrative Templates** > **Start Menu and Taskbar**| Start Layout | Path to the XML file | + +[!INCLUDE [gpo-settings-2](../../../includes/configure/gpo-settings-2.md)] + +The GPO applies the Start and taskbar layout at the next user sign-in. Each time the user signs in, the timestamp of the .xml file with the Start and taskbar layout is checked and if a newer version of the file is available, the settings in the latest version of the file are applied. + +--- + +## User experience + +After the taskbar layout is applied, the users must sign out and sign in again to see the new layout. Unless prohibited via policy settings, users can pin more apps, change the order, and unpin apps from the taskbar. + +### OS install and upgrade experience + +On a clean install of Windows, if you apply a taskbar layout, the following apps are pinned to the taskbar: + +- Any default apps you don't remove +- Apps that you specifically pin in the XML file + +On a Windows OS upgrade, apps are already pinned to the taskbar. The taskbar layout applies the following logic: + +- If users pinned apps to the taskbar, then those pinned apps remain. New apps are pinned after the existing user-pinned apps +- If the apps are pinned during the install or by a policy (not by a user), and the apps aren't pinned in an updated layout file, then the apps are unpinned +- If a user didn't pin an app, and the same app is pinned in the updated layout file, then the app is pinned after any existing pinned apps +- New apps in updated layout file are pinned after the user's pinned apps + +If you apply the taskbar configuration to a clean install or an update, users can still: + +- Pin more apps +- Change the order of pinned apps +- Unpin any app + +## Next steps + +Learn more about the options available to configure Start menu settings using the Configuration Service Provider (CSP) and Group Policy (GPO): + +- [Taskbar policy settings](policy-settings.md) diff --git a/windows/configuration/taskbar/policy-settings.md b/windows/configuration/taskbar/policy-settings.md index b4f8a0c732..cf9fa4a5ea 100644 --- a/windows/configuration/taskbar/policy-settings.md +++ b/windows/configuration/taskbar/policy-settings.md @@ -1,73 +1,186 @@ --- -title: Supported CSP policies to customize the Taskbar on Windows 11 -description: See a list of the Policy CSP - Start items that are supported on Windows 11 to customize the Taskbar. -ms.date: 12/31/2017 -ms.topic: article +title: Taskbar policy settings +description: Learn about the policy settings to configure the Windows taskbar. +ms.topic: reference +ms.date: 04/17/2024 appliesto: -- ✅ Windows 11 ---- +zone_pivot_groups: windows-versions-11-10 +--- -# Supported configuration service provider (CSP) policies for Windows 11 taskbar +# Taskbar policy settings -The Windows OS exposes CSPs that are used by MDM providers, like [Microsoft Intune](/mem/intune/fundamentals/what-is-intune). In an MDM policy, these CSPs are settings that you configure. When the policy is ready, you deploy the policy to your devices. This article lists the CSPs that are available to customize the Taskbar for Windows 11 devices. +This reference article outlines the policy settings available for customizing the Windows taskbar, using Configuration Service Provider (CSP) or group policy (GPO). For information about how to configure these settings, see [Configure the Windows taskbar](index.md). -For more general information, see [Configuration service provider (CSP) reference](/windows/client-management/mdm/configuration-service-provider-reference). +The settings are categorized and presented in alphabetical order to facilitate navigation and configuration. -## CSP policies to customize Windows 11 taskbar buttons +1. **Taskbar layout**: settings to control the taskbar layout and appearance +1. **Taskbar behaviors**: settings to control the taskbar behaviors and the users' allowed actions -- [Search/ConfigureSearchOnTaskbarMode](/windows/client-management/mdm/policy-csp-search#configuresearchontaskbarmode) - - Group policy: `Computer Configuration\Administrative Templates\Windows Components\Search\Configures search on the taskbar` - - Local setting: Settings > Personalization > Taskbar > Search +Select one of the tabs to see the list of available settings: -- [Start/HideTaskViewButton](/windows/client-management/mdm/policy-csp-start#hidetaskviewbutton) - - Group policy: `Computer and User Configuration\Administrative Templates\Start Menu and Taskbar\Hide the TaskView button` - - Local setting: Settings > Personalization > Taskbar > Task view +#### [:::image type="icon" source="../images/icons/taskbar.svg"::: **Taskbar layout**](#tab/taskbar) -- [NewsAndInterests/AllowNewsAndInterests](/windows/client-management/mdm/policy-csp-newsandinterests#allownewsandinterests) - - Group policy: `Computer Configuration\Administrative Templates\Windows Components\Widgets\Allow widgets` - - Local setting: Settings > Personalization > Taskbar > Widgets +::: zone pivot="windows-11" -- [Experience/ConfigureChatIcon](/windows/client-management/mdm/policy-csp-experience#configurechaticonvisibilityonthetaskbar) - - Group policy: `Computer Configuration\Administrative Templates\Windows Components\Chat\Configure the Chat icon setting` - - Local setting: Settings > Personalization > Taskbar > Chat +|Setting Name|CSP|GPO| +|-|-|-| +|[Allow widgets](#allow-widgets)|✅|✅| +|[Configure Start layout](#configure-start-layout)|✅|✅| +|[Configures search on the taskbar](#configures-search-on-the-taskbar)|✅|✅| +|[Do not display or track items in Jump Lists from remote locations](#do-not-display-or-track-items-in-jump-lists-from-remote-locations)|❌|✅| +|[Hide recent jumplists](#hide-recent-jumplists)|✅|✅| +|[Hide the TaskView button](#hide-the-taskview-button)|✅|✅| +|[Remove Clock from the system notification area](#remove-clock-from-the-system-notification-area)|❌|✅| +|[Remove Notifications and Action Center](#remove-notifications-and-action-center)|❌|✅| +|[Remove pinned programs from the Taskbar](#remove-pinned-programs-from-the-taskbar)|❌|✅| +|[Remove Quick Settings](#remove-quick-settings)|✅|✅| +|[Show additional calendar](#show-additional-calendar)|❌|✅| +|[Simplify Quick Settings Layout](#simplify-quick-settings-layout)|✅|✅| +|[Turn off automatic promotion of notification icons to the taskbar](#turn-off-automatic-promotion-of-notification-icons-to-the-taskbar)|❌|✅| +|[Turn off Windows Copilot](#turn-off-windows-copilot)|✅|✅| -## Existing CSP policies that Windows 11 taskbar supports +::: zone-end -- [Start/HideRecentJumplists](/windows/client-management/mdm/policy-csp-start#hiderecentjumplists) - - Group policy: `User Configuration\Administrative Templates\Start Menu and Taskbar\Do not keep history of recently opened documents` - - Local setting: Settings > Personalization > Start > Show recently opened items in Jump Lists on Start or the taskbar +::: zone pivot="windows-10" -- [Start/NoPinningToTaskbar](/windows/client-management/mdm/policy-csp-start#nopinningtotaskbar) - - Group policy: `User Configuration\Administrative Templates\Start Menu and Taskbar\Do not allow pinning programs to the Taskbar` - - Local setting: None +|Setting Name|CSP|GPO| +|-|-|-| +|[Allow widgets](#allow-widgets)|✅|✅| +|[Configure Start layout](#configure-start-layout)|✅|✅| +|[Configures search on the taskbar](#configures-search-on-the-taskbar)|✅|✅| +|[Do not display or track items in Jump Lists from remote locations](#do-not-display-or-track-items-in-jump-lists-from-remote-locations)|❌|✅| +|[Hide recent jumplists](#hide-recent-jumplists)|✅|✅| +|[Hide the notification area](#hide-the-notification-area)|❌|✅| +|[Remove Clock from the system notification area](#remove-clock-from-the-system-notification-area)|❌|✅| +|[Remove Notifications and Action Center](#remove-notifications-and-action-center)|❌|✅| +|[Remove pinned programs from the Taskbar](#remove-pinned-programs-from-the-taskbar)|❌|✅| +|[Remove the battery meter](#remove-the-battery-meter)|❌|✅| +|[Remove the Meet Now icon](#remove-the-meet-now-icon)|❌|✅| +|[Remove the networking icon](#remove-the-networking-icon)|❌|✅| +|[Remove the People Bar from the taskbar](#remove-the-people-bar-from-the-taskbar)|✅|✅| +|[Remove the volume control icon](#remove-the-volume-control-icon)|❌|✅| +|[Show additional calendar](#show-additional-calendar)|❌|✅| +|[Turn off automatic promotion of notification icons to the taskbar](#turn-off-automatic-promotion-of-notification-icons-to-the-taskbar)|❌|✅| +|[Turn off notification area cleanup](#turn-off-notification-area-cleanup)|❌|✅| +|[Turn off Windows Copilot](#turn-off-windows-copilot)|✅|✅| -## Existing CSP policies that Windows 11 doesn't support +::: zone-end -The following list includes some of the CSP policies that aren't supported on Windows 11: +[!INCLUDE [allow-widgets](includes/allow-widgets.md)] +[!INCLUDE [configure-start-layout](includes/configure-start-layout.md)] +[!INCLUDE [configures-search-on-the-taskbar](includes/configures-search-on-the-taskbar.md)] +[!INCLUDE [do-not-display-or-track-items-in-jump-lists-from-remote-locations](includes/do-not-display-or-track-items-in-jump-lists-from-remote-locations.md)] -- [ADMX_Taskbar/TaskbarLockAll](/windows/client-management/mdm/policy-csp-admx-taskbar#taskbarlockall) - - Group policy: `User Configuration\Administrative Templates\Start Menu and Taskbar\Lock all taskbar settings` +::: zone pivot="windows-10" +[!INCLUDE [hide-the-notification-area](includes/hide-the-notification-area.md)] +::: zone-end -- [ADMX_Taskbar/TaskbarNoAddRemoveToolbar](/windows/client-management/mdm/policy-csp-admx-taskbar#taskbarnoaddremovetoolbar) - - Group policy: `User Configuration\Administrative Templates\Start Menu and Taskbar\Prevent users from adding or removing toolbars` +[!INCLUDE [hide-recent-jumplists](includes/hide-recent-jumplists.md)] -- [ADMX_Taskbar/TaskbarNoDragToolbar](/windows/client-management/mdm/policy-csp-admx-taskbar#taskbarnodragtoolbar) - - Group policy: `User Configuration\Administrative Templates\Start Menu and Taskbar\Prevent users from rearranging toolbars` +::: zone pivot="windows-11" +[!INCLUDE [hide-the-taskview-button](includes/hide-the-taskview-button.md)] +::: zone-end -- [ADMX_Taskbar/TaskbarNoRedock](/windows/client-management/mdm/policy-csp-admx-taskbar#taskbarnoredock) - - Group policy: `User Configuration\Administrative Templates\Start Menu and Taskbar\Prevent users from moving taskbar to another screen dock location` +[!INCLUDE [remove-clock-from-the-system-notification-area](includes/remove-clock-from-the-system-notification-area.md)] +[!INCLUDE [remove-notifications-and-action-center](includes/remove-notifications-and-action-center.md)] +[!INCLUDE [remove-pinned-programs-from-the-taskbar](includes/remove-pinned-programs-from-the-taskbar.md)] -- [ADMX_Taskbar/TaskbarNoResize](/windows/client-management/mdm/policy-csp-admx-taskbar#taskbarnoresize) - - Group policy: `User Configuration\Administrative Templates\Start Menu and Taskbar\Prevent users from resizing the taskbar` +::: zone pivot="windows-11" +[!INCLUDE [remove-quick-settings](includes/remove-quick-settings.md)] +::: zone-end -- [ADMX_StartMenu/NoToolbarsOnTaskbar](/windows/client-management/mdm/policy-csp-admx-startmenu#notoolbarsontaskbar) - - Group policy: `User Configuration\Administrative Templates\Start Menu and Taskbar\Do not display any custom toolbars in the taskbar` +::: zone pivot="windows-10" +[!INCLUDE [remove-the-battery-meter](includes/remove-the-battery-meter.md)] +[!INCLUDE [remove-the-meet-now-icon](includes/remove-the-meet-now-icon.md)] +[!INCLUDE [remove-the-networking-icon](includes/remove-the-networking-icon.md)] +[!INCLUDE [remove-the-people-bar-from-the-taskbar](includes/remove-the-people-bar-from-the-taskbar.md)] +[!INCLUDE [remove-the-volume-control-icon](includes/remove-the-volume-control-icon.md)] +::: zone-end -- [ADMX_StartMenu/NoTaskGrouping](/windows/client-management/mdm/policy-csp-admx-startmenu#notaskgrouping) - - Group policy: `User Configuration\Administrative Templates\Start Menu and Taskbar\Prevent grouping of taskbar items` +[!INCLUDE [show-additional-calendar](includes/show-additional-calendar.md)] -- [ADMX_StartMenu/QuickLaunchEnabled](/windows/client-management/mdm/policy-csp-admx-startmenu#quicklaunchenabled) - - Group policy: `User Configuration\Administrative Templates\Start Menu and Taskbar\Show QuickLaunch on Taskbar` +::: zone pivot="windows-11" +[!INCLUDE [simplify-quick-settings-layout](includes/simplify-quick-settings-layout.md)] +::: zone-end -- [Start/HidePeopleBar](/windows/client-management/mdm/policy-csp-start#hidepeoplebar) - - Group policy: `User Configuration\Administrative Templates\Start Menu and Taskbar\Remove the People Bar from the taskbar` +[!INCLUDE [turn-off-automatic-promotion-of-notification-icons-to-the-taskbar](includes/turn-off-automatic-promotion-of-notification-icons-to-the-taskbar.md)] + +::: zone pivot="windows-10" +[!INCLUDE [turn-off-notification-area-cleanup](includes/turn-off-notification-area-cleanup.md)] +::: zone-end + +[!INCLUDE [turn-off-windows-copilot](includes/turn-off-windows-copilot.md)] + +#### [:::image type="icon" source="../images/icons/touch.svg"::: **Taskbar behaviors**](#tab/actions) + +::: zone pivot="windows-11" + +|Setting Name|CSP|GPO| +|-|-|-| +|[Disable editing Quick Settings](#disable-editing-quick-settings)|✅|✅| +|[Do not allow pinning items in Jump Lists](#do-not-allow-pinning-items-in-jump-lists)|❌|✅| +|[Do not allow pinning programs to the Taskbar](#do-not-allow-pinning-programs-to-the-taskbar)|✅|✅| +|[Do not allow pinning Store app to the Taskbar](#do-not-allow-pinning-store-app-to-the-taskbar)|❌|✅| +|[Do not allow taskbars on more than one display](#do-not-allow-taskbars-on-more-than-one-display)|❌|✅| +|[Prevent changes to Taskbar and Start Menu Settings](#prevent-changes-to-taskbar-and-start-menu-settings)|❌|✅| +|[Prevent grouping of taskbar items](#prevent-grouping-of-taskbar-items)|❌|✅| +|[Remove access to the context menus for the taskbar](#remove-access-to-the-context-menus-for-the-taskbar)|❌|✅| + +::: zone-end + +::: zone pivot="windows-10" + +|Setting Name|CSP|GPO| +|-|-|-| +|[Do not allow pinning items in Jump Lists](#do-not-allow-pinning-items-in-jump-lists)|❌|✅| +|[Do not allow pinning programs to the Taskbar](#do-not-allow-pinning-programs-to-the-taskbar)|✅|✅| +|[Do not allow pinning Store app to the Taskbar](#do-not-allow-pinning-store-app-to-the-taskbar)|❌|✅| +|[Lock all taskbar settings](#lock-all-taskbar-settings)|❌|✅| +|[Lock the Taskbar](#lock-the-taskbar)|❌|✅| +|[Prevent changes to Taskbar and Start Menu Settings](#prevent-changes-to-taskbar-and-start-menu-settings)|❌|✅| +|[Prevent grouping of taskbar items](#prevent-grouping-of-taskbar-items)|❌|✅| +|[Prevent users from adding or removing toolbars](#prevent-users-from-adding-or-removing-toolbars)|❌|✅| +|[Prevent users from moving taskbar to another screen dock location](#prevent-users-from-moving-taskbar-to-another-screen-dock-location)|❌|✅| +|[Prevent users from rearranging toolbars](#prevent-users-from-rearranging-toolbars)|❌|✅| +|[Prevent users from resizing the taskbar](#prevent-users-from-resizing-the-taskbar)|❌|✅| +|[Remove access to the context menus for the taskbar](#remove-access-to-the-context-menus-for-the-taskbar)|❌|✅| +|[Turn off notification area cleanup](#turn-off-notification-area-cleanup)|❌|✅| + +::: zone-end + +::: zone pivot="windows-11" +[!INCLUDE [disable-editing-quick-settings](includes/disable-editing-quick-settings.md)] +::: zone-end + +[!INCLUDE [do-not-allow-pinning-items-in-jump-lists](includes/do-not-allow-pinning-items-in-jump-lists.md)] +[!INCLUDE [do-not-allow-pinning-programs-to-the-taskbar](includes/do-not-allow-pinning-programs-to-the-taskbar.md)] +[!INCLUDE [do-not-allow-pinning-store-app-to-the-taskbar](includes/do-not-allow-pinning-store-app-to-the-taskbar.md)] +[!INCLUDE [do-not-allow-taskbars-on-more-than-one-display](includes/do-not-allow-taskbars-on-more-than-one-display.md)] + +::: zone pivot="windows-10" +[!INCLUDE [lock-all-taskbar-settings](includes/lock-all-taskbar-settings.md)] +[!INCLUDE [lock-the-taskbar](includes/lock-the-taskbar.md)] +::: zone-end + +[!INCLUDE [prevent-changes-to-taskbar-and-start-menu-settings](includes/prevent-changes-to-taskbar-and-start-menu-settings.md)] +[!INCLUDE [prevent-grouping-of-taskbar-items](includes/prevent-grouping-of-taskbar-items.md)] + +::: zone pivot="windows-10" +[!INCLUDE [prevent-users-from-adding-or-removing-toolbars](includes/prevent-users-from-adding-or-removing-toolbars.md)] +[!INCLUDE [prevent-users-from-moving-taskbar-to-another-screen-dock-location](includes/prevent-users-from-moving-taskbar-to-another-screen-dock-location.md)] +[!INCLUDE [prevent-users-from-rearranging-toolbars](includes/prevent-users-from-rearranging-toolbars.md)] +[!INCLUDE [prevent-users-from-resizing-the-taskbar](includes/prevent-users-from-resizing-the-taskbar.md)] +::: zone-end + +[!INCLUDE [remove-access-to-the-context-menus-for-the-taskbar](includes/remove-access-to-the-context-menus-for-the-taskbar.md)] +[!INCLUDE [turn-off-automatic-promotion-of-notification-icons-to-the-taskbar](includes/turn-off-automatic-promotion-of-notification-icons-to-the-taskbar.md)] + +::: zone pivot="windows-10" +[!INCLUDE [turn-off-notification-area-cleanup](includes/turn-off-notification-area-cleanup.md)] +::: zone-end + +--- + +## Next steps + +The configuration of pinned applications to the taskbar requires the use of an XML file that specifies their pinning order. To learn more about how to create and apply an XML file to configure pinned applications, see [Configure the taskbar pinned applications](pinned-apps.md). diff --git a/windows/configuration/taskbar/toc.yml b/windows/configuration/taskbar/toc.yml index c3601e77ec..a20dbfb893 100644 --- a/windows/configuration/taskbar/toc.yml +++ b/windows/configuration/taskbar/toc.yml @@ -1,5 +1,10 @@ items: -- name: Customize the Taskbar +- name: Overview href: index.md -- name: Supported Taskbar CSPs - href: policy-settings.md \ No newline at end of file + displayName: Configure the Windows taskbar +- name: Policy settings + href: policy-settings.md +- name: Configure the pinned applications + href: pinned-apps.md +- name: XML schema definition (XSD) + href: xsd.md \ No newline at end of file diff --git a/windows/configuration/taskbar/xsd.md b/windows/configuration/taskbar/xsd.md new file mode 100644 index 0000000000..c6d5ded3aa --- /dev/null +++ b/windows/configuration/taskbar/xsd.md @@ -0,0 +1,61 @@ +--- +title: Taskbar XML Schema Definition (XSD) +description: Taskbar XSD reference article. +ms.topic: reference +ms.date: 02/15/2024 +--- + +# Taskbar XML Schema Definition (XSD) + +This reference article contains the Taskbar XML schema definition (XSD). + +## TaskbarLayout + +```xml + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +``` diff --git a/windows/configuration/toc.yml b/windows/configuration/toc.yml index 25256515be..6feefd28bf 100644 --- a/windows/configuration/toc.yml +++ b/windows/configuration/toc.yml @@ -3,20 +3,14 @@ items: href: index.yml - name: Accessibility information for IT Pros href: accessibility/index.md -- name: Customize the appearance - items: - - name: Start - href: start/toc.yml - - name: Taskbar - href: taskbar/toc.yml - - name: Windows Spotlight - href: lock-screen/windows-spotlight.md +- name: Start + href: start/toc.yml +- name: Taskbar + href: taskbar/toc.yml +- name: Spotlight + href: lock-screen/windows-spotlight.md - name: Microsoft Store - items: - - name: Configure access to Microsoft Store - href: store/index.md - - name: Find the AUMID of an installed app - href: store/find-aumid.md + href: store/toc.yml - name: Cellular settings href: cellular/provisioning-apn.md - name: Kiosks and restricted user experiences diff --git a/windows/deployment/TOC.yml b/windows/deployment/TOC.yml index 5defe8d8ca..f6033a422c 100644 --- a/windows/deployment/TOC.yml +++ b/windows/deployment/TOC.yml @@ -372,6 +372,8 @@ href: update/update-other-microsoft-products.md - name: Delivery Optimization reference href: do/waas-delivery-optimization-reference.md?toc=/windows/deployment/toc.json&bc=/windows/deployment/breadcrumb/toc.json + - name: FoD and language packs for WSUS and Configuration Manager + href: update/fod-and-lang-packs.md - name: Windows client in S mode href: s-mode.md - name: Switch to Windows client Pro or Enterprise from S mode diff --git a/windows/deployment/update/fod-and-lang-packs.md b/windows/deployment/update/fod-and-lang-packs.md index f7968c1ebc..87d5304815 100644 --- a/windows/deployment/update/fod-and-lang-packs.md +++ b/windows/deployment/update/fod-and-lang-packs.md @@ -3,7 +3,7 @@ title: FoD and language packs for WSUS and Configuration Manager description: Learn how to make FoD and language packs available to clients when you're using WSUS or Configuration Manager. ms.service: windows-client ms.subservice: itpro-updates -ms.topic: conceptual +ms.topic: reference ms.author: mstewart author: mestew ms.localizationpriority: medium @@ -13,28 +13,44 @@ appliesto: - ✅ Windows 10 - ✅ Microsoft Configuration Manager - ✅ WSUS -ms.date: 03/13/2019 +ms.date: 04/22/2024 --- # How to make Features on Demand and language packs available when you're using WSUS or Configuration Manager + +This reference article describes how to make Features on Demand (FoDs) and language packs available when you're using Windows Server Update Services (WSUS) or Configuration Manager for specific versions of Windows. -This article describes how to make Features on Demand and language packs available when you're using WSUS or Configuration Manager for specific versions of Windows. +## High-level changes affecting Features on Demand and language pack content -## Version information for Features on Demand and language packs +The following changes for FoD and language pack content affected how client policy needs to be configured: + +- Starting in Windows 10 version 1709, you can't use WSUS to host [Features on Demand](/windows-hardware/manufacture/desktop/features-on-demand-v2--capabilities) (FoDs) locally. +- Starting with Windows 10 version 1803, language packs can no longer be hosted on WSUS. -In Windows 10 version 21H2 and later, non-Administrator user accounts can add both a display language and its corresponding language features. +Due to these changes, the **Specify settings for optional component installation and component repair** ([ADMX_Servicing](/windows/client-management/mdm/policy-csp-admx-servicing)) policy, located under `Computer Configuration\Administrative Templates\System` was used to specify alternate ways to acquire FoDs and language packs, along with content for corruption repair. This policy allows specifying one alternate location. It's important to note the policy behaves differently across OS versions. For more information, see the [Version specific information for Features on Demand and language packs](#version-specific-information-for-features-on-demand-and-language-packs) section. -As of Windows 10 version 1709, you can't use Windows Server Update Services (WSUS) to host [Features on Demand](/windows-hardware/manufacture/desktop/features-on-demand-v2--capabilities) (FODs) locally. Starting with Windows 10 version 1803, language packs can no longer be hosted on WSUS. +The introduction of the **Specify source service for specific classes of Windows Updates** ([SetPolicyDrivenUpdateSourceFor](/windows/client-management/mdm/policy-csp-update#setpolicydrivenupdatesourceforfeatureupdates)) policy in Windows 10, version 2004 further complicated configuring settings for FoD and language pack content. -The **Specify settings for optional component installation and component repair** policy, located under `Computer Configuration\Administrative Templates\System` in the Group Policy Editor, can be used to specify alternate ways to acquire FOD packages, language packages, and content for corruption repair. However, it's important to note this policy only allows specifying one alternate location and behaves differently across OS versions. +Starting in Windows 11, version 22H2, on-premises Unified Update Platform (UUP) updates were introduced. FoDs and language packs are available from WSUS again. It's no longer necessary to use the **Specify settings for optional component installation and component repair** policy for FoD and language pack content. -In Windows 10 versions 1709 and 1803, changing the **Specify settings for optional component installation and component repair** policy to download content from Windows Update enables acquisition of FOD packages while also enabling corruption repair. Specifying a network location works for either, depending on the content is found at that location. Changing this policy on these OS versions doesn't influence how language packs are acquired. +## Version specific information for Features on Demand and language packs -In Windows 10 version 1809 and beyond, changing the **Specify settings for optional component installation and component repair** policy also influences how language packs are acquired, however language packs can only be acquired directly from Windows Update. It's currently not possible to acquire them from a network share. Specifying a network location works for FOD packages or corruption repair, depending on the content at that location. +Windows 11, version 22H2, and later clients use on-premises Unified Update Platform (UUP) updates with WSUS and Microsoft Configuration Manager. These clients don't need to use **Specify settings for optional component installation and component repair** for FoDs and language packs since the content is available in WSUS due to on-premises UUP. + +For Windows 10, version 2004 through Windows 11, version 21H2, clients can't download FoDs or language packs when **Specify settings for optional component installation and component repair** is set to Windows Update and **Specify source service for specific classes of Windows Updates** ([SetPolicyDrivenUpdateSourceFor](/windows/client-management/mdm/policy-csp-update#setpolicydrivenupdatesourceforfeatureupdates)) for either feature or quality updates is set to WSUS. If you need this content, you can set **Specify settings for optional component installation and component repair** to Windows Update and then either: +- Change the source selection for feature and quality updates to Windows Update +- Allow all classes of updates to come from WSUS by not configuring any source selections + +> [!Note] +> In Windows 10 version 21H2 and later, non-Administrator user accounts can add both a display language and its corresponding language features. + +In Windows 10 version 1809 and later, changing the **Specify settings for optional component installation and component repair** policy also influences how language packs are acquired, however language packs can only be acquired directly from Windows Update (until Windows 11 version 22H2). It's currently not possible to acquire them from a network share. Specifying a network location works for FoD packages or corruption repair, depending on the content at that location. + +In Windows 10 versions 1709 and 1803, changing the **Specify settings for optional component installation and component repair** policy to download content from Windows Update enables acquisition of FoD packages while also enabling corruption repair. Specifying a network location works for either, depending on the content is found at that location. Changing this policy on these OS versions doesn't influence how language packs are acquired. For all OS versions, changing the **Specify settings for optional component installation and component repair** policy doesn't affect how OS updates are distributed. They continue to come from WSUS, Configuration Manager, or other sources as you have scheduled them, even while optional content is sourced from Windows Update or a network location. -Learn about other client management options, including using Group Policy and administrative templates, in [Manage clients in Windows 10](/windows/client-management/). +Learn about other client management options, including using Group Policy and administrative templates, in [Manage Windows clients](/windows/client-management/). ## More resources diff --git a/windows/deployment/update/optional-content.md b/windows/deployment/update/optional-content.md index 7f6fffc7b4..9984fc897b 100644 --- a/windows/deployment/update/optional-content.md +++ b/windows/deployment/update/optional-content.md @@ -11,11 +11,11 @@ ms.localizationpriority: medium appliesto: - ✅ Windows 11 - ✅ Windows 10 -ms.date: 03/15/2023 +ms.date: 04/22/2024 --- # Migrating and acquiring optional Windows content during updates - + This article provides some background on the problem of keeping language resources and Features on Demand during operating system updates and offers guidance to help you move forward in the short term and prepare for the long term. When you update the operating system, it's critical to keep language resources and Features on Demand (FODs). Many commercial organizations use Configuration Manager or other management tools to distribute and orchestrate Windows client setup using a local Windows image or WIM file (a *media-based* or *task-sequence-based* update). Others do in-place updates using an approved Windows client feature update by using Windows Server Update Services (WSUS), Configuration Manager, or equivalent tools (a *servicing-based* update). @@ -28,7 +28,8 @@ Optional content includes the following items: - General Features on Demand also referred to as FODs (for example, Windows Mixed Reality) - Language-based and regional FODs (for example, Language.Basic~~~ja-jp~0.0.1.0) -- Local Experience Packs +- Local Experience Packs +- Language packs Optional content isn't included by default in the Windows image file that is part of the operating system media available in the Volume Licensing Service Center (VLSC). Instead, it's released as an additional ISO file on VLSC. Shipping these features out of the operating system media and shipping them separately reduces the disk footprint of Windows. This approach provides more space for user's data. It also reduces the time needed to service the operating system, whether installing a monthly quality update or upgrading to a newer version. A smaller default Windows image also means less data to transmit over the network. @@ -137,7 +138,8 @@ Several of the options address ways to address optional content migration issues - This setting doesn't support installing language packs from an alternate source file path, only Features on Demand. If the policy is configured to acquire content from Windows Update, language packs will be acquired. - If this setting isn't configured or disabled, files are downloaded from the default Windows Update location, for example Windows Update for Business or WSUS. -For more information, see [Configure a Windows Repair Source](/windows-hardware/manufacture/desktop/configure-a-windows-repair-source). + +For more information, see [Configure a Windows Repair Source](/windows-hardware/manufacture/desktop/configure-a-windows-repair-source) and [How to make Features on Demand and language packs available when you're using WSUS or Configuration Manager](fod-and-lang-packs.md). ## More resources diff --git a/windows/deployment/update/waas-manage-updates-wsus.md b/windows/deployment/update/waas-manage-updates-wsus.md index 6506f11e90..548b26fb85 100644 --- a/windows/deployment/update/waas-manage-updates-wsus.md +++ b/windows/deployment/update/waas-manage-updates-wsus.md @@ -15,11 +15,11 @@ appliesto: - ✅ Windows 11 - ✅ Windows 10 - ✅ WSUS -ms.date: 12/31/2017 +ms.date: 04/22/2024 --- # Deploy Windows client updates using Windows Server Update Services (WSUS) - + > **Looking for consumer information?** See [Windows Update: FAQ](https://support.microsoft.com/help/12373/windows-update-faq) diff --git a/windows/deployment/update/wufb-wsus.md b/windows/deployment/update/wufb-wsus.md index 5f5374ac96..6062716b60 100644 --- a/windows/deployment/update/wufb-wsus.md +++ b/windows/deployment/update/wufb-wsus.md @@ -11,10 +11,10 @@ ms.localizationpriority: medium appliesto: - ✅ Windows 11 - ✅ Windows 10 -ms.date: 01/13/2022 +ms.date: 04/22/2024 --- -# Use Windows Update for Business and WSUS together +# Use Windows Update for Business and WSUS together > **Looking for consumer information?** See [Windows Update: FAQ](https://support.microsoft.com/help/12373/windows-update-faq) @@ -69,7 +69,8 @@ The policy can be configured using the following two methods: > [!NOTE] > - You should configure **all** of these policies if you are using CSPs. -> - Editing the registry to change the behavior of update policies isn't recommended. Use Group Policy or the Configuration Service Provider (CSP) policy instead of directly writing to the registry. However, if you choose to edit the registry, ensure you've configured the `UseUpdateClassPolicySource` registry key too, or the scan source won't be altered. +> - Editing the registry to change the behavior of update policies isn't recommended. Use Group Policy or the Configuration Service Provider (CSP) policy instead of directly writing to the registry. However, if you choose to edit the registry, ensure you've configured the `UseUpdateClassPolicySource` registry key too, or the scan source won't be altered. +> - If you're also using the **Specify settings for optional component installation and component repair** policy to enable content for FoDs and language packs, see [How to make Features on Demand and language packs available when you're using WSUS or Configuration Manager](fod-and-lang-packs.md) to verify your policy configuration. - [Update/SetPolicyDrivenUpdateSourceForDriverUpdates](/windows/client-management/mdm/policy-csp-update#update-setpolicydrivenupdatesourcefordriver) - [Update/SetPolicyDrivenUpdateSourceForFeatureUpdates](/windows/client-management/mdm/policy-csp-update#update-setpolicydrivenupdatesourceforfeature) diff --git a/windows/deployment/usmt/usmt-what-does-usmt-migrate.md b/windows/deployment/usmt/usmt-what-does-usmt-migrate.md index cee6051fd0..b069f9ac46 100644 --- a/windows/deployment/usmt/usmt-what-does-usmt-migrate.md +++ b/windows/deployment/usmt/usmt-what-does-usmt-migrate.md @@ -57,7 +57,7 @@ This section describes the user data that USMT migrates by default, using the `M > [!IMPORTANT] > - > USMT doesn't migrate the Start menu layout. To migrate a user's Start menu, settings must be exported and then imported using the Windows PowerShell cmdlets **Export-StartLayout** and **Import-StartLayout**. For more information, see [USMT common issues](/troubleshoot/windows-client/deployment/usmt-common-issues#usmt-doesnt-migrate-the-start-layout). + > USMT doesn't migrate the Start menu layout. To migrate a user's Start menu, settings must be exported and then imported using the Windows PowerShell cmdlets `Export-StartLayout` and **Import-StartLayout**. For more information, see [USMT common issues](/troubleshoot/windows-client/deployment/usmt-common-issues#usmt-doesnt-migrate-the-start-layout). - **Folders from the All Users and Public profiles.** When the `MigUser.xml` file is specified, USMT also migrates the following from the **Public** profile in Windows: @@ -118,7 +118,7 @@ USMT migrates operating-system components to a destination computer. The followi 1. Right-clicking on the Start menu and then selecting **Computer Management**. 1. In the **Computer Management** console, expand **System tools** > **Local Users and Groups** > **Groups**. 1. Inspect the individual groups in the results pane to see what users belong to what groups. - + The use of a **\** section in the `Config.xml` file is required when running an offline migration. - Microsoft Open Database Connectivity (ODBC) settings. @@ -210,7 +210,7 @@ Also note the following items: ### Start menu layout -USMT doesn't migrate the Start menu layout. To migrate a user's Start menu, settings must be exported and then imported using the Windows PowerShell cmdlets **Export-StartLayout** and **Import-StartLayout**. For more information, see [USMT common issues](/troubleshoot/windows-client/deployment/usmt-common-issues#usmt-doesnt-migrate-the-start-layout). +USMT doesn't migrate the Start menu layout. To migrate a user's Start menu, settings must be exported and then imported using the Windows PowerShell cmdlets `Export-StartLayout` and **Import-StartLayout**. For more information, see [USMT common issues](/troubleshoot/windows-client/deployment/usmt-common-issues#usmt-doesnt-migrate-the-start-layout). ### User profiles from Active Directory to Microsoft Entra ID diff --git a/windows/deployment/windows-autopatch/TOC.yml b/windows/deployment/windows-autopatch/TOC.yml index 619348bcdd..3e1a68db6b 100644 --- a/windows/deployment/windows-autopatch/TOC.yml +++ b/windows/deployment/windows-autopatch/TOC.yml @@ -90,6 +90,8 @@ href: operate/windows-autopatch-groups-windows-quality-update-status-report.md - name: Quality update trending report href: operate/windows-autopatch-groups-windows-quality-update-trending-report.md + - name: Reliability report + href: operate/windows-autopatch-reliability-report.md - name: Windows feature update reports href: items: diff --git a/windows/deployment/windows-autopatch/operate/windows-autopatch-groups-windows-quality-and-feature-update-reports-overview.md b/windows/deployment/windows-autopatch/operate/windows-autopatch-groups-windows-quality-and-feature-update-reports-overview.md index 91f758db48..9d5cd07373 100644 --- a/windows/deployment/windows-autopatch/operate/windows-autopatch-groups-windows-quality-and-feature-update-reports-overview.md +++ b/windows/deployment/windows-autopatch/operate/windows-autopatch-groups-windows-quality-and-feature-update-reports-overview.md @@ -33,6 +33,7 @@ The Windows quality report types are organized into the following focus areas: | ----- | ----- | | Organizational | The [Summary dashboard](../operate/windows-autopatch-groups-windows-quality-update-summary-dashboard.md) provide the current update status summary for all devices.

The [Quality update status report](../operate/windows-autopatch-groups-windows-quality-update-status-report.md) provides the current update status of all devices at the device level. | | Device trends | The [Quality update trending report](../operate/windows-autopatch-groups-windows-quality-update-trending-report.md) provides the update status trend of all devices over the last 90 days. | +| [Reliability report](../operate/windows-autopatch-reliability-report.md) | The Reliability report provides a reliability score for each Windows quality update cycle based on stop error codes detected on managed devices. | ## Windows feature update reports diff --git a/windows/deployment/windows-autopatch/operate/windows-autopatch-reliability-report.md b/windows/deployment/windows-autopatch/operate/windows-autopatch-reliability-report.md new file mode 100644 index 0000000000..e3a3f4b0c5 --- /dev/null +++ b/windows/deployment/windows-autopatch/operate/windows-autopatch-reliability-report.md @@ -0,0 +1,120 @@ +--- +title: Reliability report +description: This article describes the reliability score for each Windows quality update cycle based on stop error codes detected on managed devices. +ms.date: 04/09/2024 +ms.service: windows-client +ms.subservice: itpro-updates +ms.topic: how-to +ms.localizationpriority: medium +author: tiaraquan +ms.author: tiaraquan +manager: aaroncz +ms.reviewer: hathind +ms.collection: + - highpri + - tier1 +--- + +# Reliability report (public preview) + +> [!IMPORTANT] +> This feature is in **public preview**. It's being actively developed, and might not be complete. + +The Reliability report provides a reliability score for each Windows quality update cycle based on [stop error codes](/troubleshoot/windows-client/performance/stop-error-or-blue-screen-error-troubleshooting) detected on managed devices. Scores are determined at both the service and tenant level. Details on modules associated with stop error codes at the tenant level are provided to better understand how devices are affected. + +> [!NOTE] +> **The Reliability report applies to quality updates only**. The Reliability report doesn't currently support Windows feature updates.

Scores used in this report are calculated based on devices running both Windows 10 and Windows 11 versions.

+ +With this feature, IT admins can access the following information: + +| Information type | Description | +| ----- | ----- | +| Your score | **Your score** is a calculated tenant reliability score based on stop error codes detected on managed devices that updated successfully during the current update cycle. **Your score** is the latest single-day score in the current Windows quality update cycle. The monthly score values can be viewed under the **Trending** tab. | +| Baseline | Use the **Baseline** to compare your score with past quality update cycles. You can choose the desired historical record from the **Comparison baseline** dropdown menu at the top of the page. **Baseline** is a single-day score calculated the same number of days from the start of patching as your score. | +| Service-level | Use the **Service-level** to compare **your score** with a score computed across tenants in the Azure Data Scale Unit covering your geographic region. **Service-level** is a single-day score calculated the same number of days from the start of patching as **your score**. | +| Score details | **Score details** provides information about specific modules associated with stop error code occurrence, occurrence rate, and affected devices. View single-day or multi-day results by selecting from the **Duration** menu. Data can be exported for offline reference. | +| Trending | **Trending** provides a graphical visualization of reliability scores at both tenant and service level on a customizable timeline of 1 - 12 months. Monthly scores represent the aggregated value for a complete update cycle (second Tuesday of the month). | +| Insights | **Insights** identifies noteworthy trends that might be useful in implementing reliability improvement opportunities. | +| Affected devices | **Affected devices** are the number of unique devices associated with stop error code events. | + +## Report availability + +The Reliability report relies on device policies being configured properly. It's important to confirm that the minimum requirements are met to access the full Reliability report. + +| Data collection policies set | Devices registered in Autopatch | Devices updated | Report availability | +| ----- | ------ | ----- | ----- | +| No | - | - | No report available.

In this state, a ribbon appears on the landing page alerting the user that the diagnostic data needed to generate a report appears to be turned off. The report is available 24 and 48 hours after the following conditions are met:

  • [Diagnostic data device configuration policies enabled](../references/windows-autopatch-changes-to-tenant.md#device-configuration-policies)
  • At least 100 devices registered in Autopatch
  • At least 100 of these registered devices completed a quality update in the current update cycle (second Tuesday of the month)

| +| Yes | 0 | - | The report includes only the historical comparison baseline and service-level score. The tenant and module impact scores are unavailable until 100 devices are updated. | +| Yes | 0 < n < 100 | 0 < n < 100 | The report includes module failure details, historical comparison baseline, and service-level score. The tenant score is unavailable until 100 devices are updated. | +| Yes | n >= 100 | 0 < n < 100 | The report includes module failure details, historical comparison baseline score, and service-level score. The tenant and module impact scores are unavailable until 100 devices are updated. | +| Yes | n >= 100 | n >= 100 | Full reporting available | + +## View the Reliability report + +**To view the Reliability report:** + +1. Go to the [Microsoft Intune admin center](https://go.microsoft.com/fwlink/?linkid=2109431). +2. Navigate to **Reports** > **Windows Autopatch** > **Windows quality updates**. +3. Select the **Reports** tab. +4. Select **Reliability report**. + +> [!NOTE] +> To use the Reliability report capability, ensure that at least 100 devices are registered in the Windows Autopatch service and capable of successfully completing a quality update. The report relies on device stop error code data being available to Microsoft (transmission of this data may take up to 24 hours).

A score is generated when:

  • 100 or more devices have completed updating to the latest quality update
  • Windows Autopatch receives the stop error code data related to that update cycle

Windows Autopatch data collection must be enabled according to the [configuration policies](../references/windows-autopatch-changes-to-tenant.md#device-configuration-policies) set during tenant onboarding. For more information about data collection, see [Privacy](../overview/windows-autopatch-privacy.md)

+ +## Report information + +The following information is available as default columns in the Reliability report: + +> [!NOTE] +> The report is refreshed no more than once every 24 hours with data received from your Windows Autopatch managed devices. Manual data refresh is not supported. The last refreshed date and time can be found at the top of the page. For more information about how often Windows Autopatch receives data from your managed devices, see [Data latency](../operate/windows-autopatch-groups-windows-quality-and-feature-update-reports-overview.md#about-data-latency). + +### Score details + +| Column | Description | +| ----- | ----- | +| Module name | Name of module associated with stop error code detection. | +| Version | Version of module associated with stop error code detection. | +| Unique devices | Number of unique devices seeing a stop error code occurrence associated with a specific module name and version. This information is hyperlinked to the **Devices affected** flyout. | +| Total events | Total number of stop error codes detected associated with a specific module name and version. | +| Module score impact | **Your score** associated with specific module name and version. | +| Timeline | This information is hyperlinked to **Module details** flyout. | + +### Export file + +| Column | Description | +| ----- | ----- | +| DeviceName | Device name | +| MicrosoftEntraDeviceId | Microsoft Entra device ID | +| Model | Device model | +| Manufacturer | Device manufacturer | +| AutopatchGroup | Autopatch group assignment for the affected device | +| LatestOccurrence | Time of the most recent reported failure | +| WindowsVersion | Windows version (Windows 10 or Windows 11) | +| OSVersion | OS version | +| ModuleName | Name of the module associated with stop error code detection | +| Version | Version of the module associated with stop error code detection | +| BugCheckCode | Bug check code associated with stop error code | +| TenantId | Your Microsoft Entra tenant ID | + +### Devices affected + +| Column | Description | +| ----- | ----- | +| Device name | Device name | +| Microsoft Entra device ID | Microsoft Entra device ID | +| Model | Device model | +| Manufacturer | Device manufacturer | +| Autopatch group | Autopatch group assignment for the affected device | +| Latest occurrence | Time of the most recent reported failure | + +### Module details + +| Display selection | Description | +| ----- | ----- | +| Unique devices | Number of unique devices affected by module failure and the associated version | +| Total events | Number of occurrences by module failure and the associated version | +| Module impact | Score impact by module and version representing the relative importance of module failure. Higher positive values describe module failures that have a greater impact on the tenant and should be addressed with higher priority. Negative values describe module failures that have a lower-than-average impact on the tenant and thus can be treated with lower priority. Values around `0` describe module failures with average impact on the tenant. | + +## Known limitations + +The Reliability report supports tenant and service-level score data going back to September 2023. Data before that date isn't supported. A full 12 months of score data will be available to select from the menu dropdowns in September 2024. diff --git a/windows/deployment/windows-autopatch/whats-new/windows-autopatch-whats-new-2024.md b/windows/deployment/windows-autopatch/whats-new/windows-autopatch-whats-new-2024.md index af55139038..8144875c9e 100644 --- a/windows/deployment/windows-autopatch/whats-new/windows-autopatch-whats-new-2024.md +++ b/windows/deployment/windows-autopatch/whats-new/windows-autopatch-whats-new-2024.md @@ -27,7 +27,8 @@ Minor corrections such as typos, style, or formatting issues aren't listed. | Article | Description | | ----- | ----- | -| [Resolve policy conflicts](../operate/windows-autopatch-resolve-policy-conflicts.md) | Added [Resolve policy conflicts](../operate/windows-autopatch-resolve-policy-conflicts.md) feature | +| [Reliability report](../operate/windows-autopatch-reliability-report.md) | Added the [Reliability report](../operate/windows-autopatch-reliability-report.md) feature | +| [Resolve policy conflicts](../operate/windows-autopatch-resolve-policy-conflicts.md) | Added the [Resolve policy conflicts](../operate/windows-autopatch-resolve-policy-conflicts.md) feature | ## February 2024 diff --git a/windows/privacy/windows-11-endpoints-non-enterprise-editions.md b/windows/privacy/windows-11-endpoints-non-enterprise-editions.md index f27e7c4961..386320c5f8 100644 --- a/windows/privacy/windows-11-endpoints-non-enterprise-editions.md +++ b/windows/privacy/windows-11-endpoints-non-enterprise-editions.md @@ -32,7 +32,7 @@ The following methodology was used to derive the network endpoints: > [!NOTE] > Microsoft uses global load balancers that can appear in network trace-routes. For example, an endpoint for *.akadns.net might be used to load balance requests to an Azure datacenter, which can change over time. -## Windows 11 Family +## Windows 11 Home | **Area** | **Description** | **Protocol** | **Destination** | |-----------|--------------- |------------- |-----------------| diff --git a/windows/privacy/windows-endpoints-1809-non-enterprise-editions.md b/windows/privacy/windows-endpoints-1809-non-enterprise-editions.md index b4736b74ce..aebe78e618 100644 --- a/windows/privacy/windows-endpoints-1809-non-enterprise-editions.md +++ b/windows/privacy/windows-endpoints-1809-non-enterprise-editions.md @@ -32,7 +32,7 @@ We used the following methodology to derive these network endpoints: > [!NOTE] > Microsoft uses global load balancers that can appear in network trace-routes. For example, an endpoint for *.akadns.net might be used to load balance requests to an Azure datacenter, which can change over time. -## Windows 10 Family +## Windows 10 Home | **Destination** | **Protocol** | **Description** | | --- | --- | --- | diff --git a/windows/privacy/windows-endpoints-1903-non-enterprise-editions.md b/windows/privacy/windows-endpoints-1903-non-enterprise-editions.md index b558fc1c1e..3640d0e89a 100644 --- a/windows/privacy/windows-endpoints-1903-non-enterprise-editions.md +++ b/windows/privacy/windows-endpoints-1903-non-enterprise-editions.md @@ -36,7 +36,7 @@ The following methodology was used to derive the network endpoints: > [!NOTE] > Microsoft uses global load balancers that can appear in network trace-routes. For example, an endpoint for *.akadns.net might be used to load balance requests to an Azure datacenter, which can change over time. -## Windows 10 Family +## Windows 10 Home | Destination | Protocol | Description | | ----------- | -------- | ----------- | diff --git a/windows/privacy/windows-endpoints-1909-non-enterprise-editions.md b/windows/privacy/windows-endpoints-1909-non-enterprise-editions.md index a0bfa21291..efebab8e60 100644 --- a/windows/privacy/windows-endpoints-1909-non-enterprise-editions.md +++ b/windows/privacy/windows-endpoints-1909-non-enterprise-editions.md @@ -34,7 +34,7 @@ The following methodology was used to derive the network endpoints: > [!NOTE] > Microsoft uses global load balancers that can appear in network trace-routes. For example, an endpoint for *.akadns.net might be used to load balance requests to an Azure datacenter, which can change over time. -## Windows 10 Family +## Windows 10 Home | **Destination** | **Protocol** | **Description** | | --- | --- | --- | diff --git a/windows/privacy/windows-endpoints-2004-non-enterprise-editions.md b/windows/privacy/windows-endpoints-2004-non-enterprise-editions.md index c8f28f8ea4..8836b64032 100644 --- a/windows/privacy/windows-endpoints-2004-non-enterprise-editions.md +++ b/windows/privacy/windows-endpoints-2004-non-enterprise-editions.md @@ -35,7 +35,7 @@ The following methodology was used to derive the network endpoints: > [!NOTE] > Microsoft uses global load balancers that can appear in network trace-routes. For example, an endpoint for *.akadns.net might be used to load balance requests to an Azure datacenter, which can change over time. -## Windows 10 Family +## Windows 10 Home | **Destination** | **Protocol** | **Description** | | --- | --- | --- | diff --git a/windows/privacy/windows-endpoints-20H2-non-enterprise-editions.md b/windows/privacy/windows-endpoints-20H2-non-enterprise-editions.md index f41413a60a..c57c257926 100644 --- a/windows/privacy/windows-endpoints-20H2-non-enterprise-editions.md +++ b/windows/privacy/windows-endpoints-20H2-non-enterprise-editions.md @@ -34,7 +34,7 @@ The following methodology was used to derive the network endpoints: > [!NOTE] > Microsoft uses global load balancers that can appear in network trace-routes. For example, an endpoint for *.akadns.net might be used to load balance requests to an Azure datacenter, which can change over time. -## Windows 10 Family +## Windows 10 Home | **Area** | **Description** | **Protocol** | **Destination** | |-----------|--------------- |------------- |-----------------| diff --git a/windows/privacy/windows-endpoints-21H1-non-enterprise-editions.md b/windows/privacy/windows-endpoints-21H1-non-enterprise-editions.md index ae92428145..01a9f50103 100644 --- a/windows/privacy/windows-endpoints-21H1-non-enterprise-editions.md +++ b/windows/privacy/windows-endpoints-21H1-non-enterprise-editions.md @@ -34,7 +34,7 @@ The following methodology was used to derive the network endpoints: > [!NOTE] > Microsoft uses global load balancers that can appear in network trace-routes. For example, an endpoint for *.akadns.net might be used to load balance requests to an Azure datacenter, which can change over time. -## Windows 10 Family +## Windows 10 Home | **Area** | **Description** | **Protocol** | **Destination** | |-----------|--------------- |------------- |-----------------| diff --git a/windows/security/application-security/application-control/windows-defender-application-control/AppIdTagging/design-create-appid-tagging-policies.md b/windows/security/application-security/application-control/windows-defender-application-control/AppIdTagging/design-create-appid-tagging-policies.md index 9407cacded..a677075cdb 100644 --- a/windows/security/application-security/application-control/windows-defender-application-control/AppIdTagging/design-create-appid-tagging-policies.md +++ b/windows/security/application-security/application-control/windows-defender-application-control/AppIdTagging/design-create-appid-tagging-policies.md @@ -77,7 +77,7 @@ Using this method, you create an AppId Tagging policy directly using the WDAC Po 4. Set the name and ID on the policy, which is helpful for future debugging: ```powershell - Set-CIPolicyIdInfo -ResetPolicyId -PolicyName "MyPolicyName" -PolicyId "MyPolicyId"" -AppIdTaggingPolicy -FilePath ".\AppIdPolicy.xml" + Set-CIPolicyIdInfo -ResetPolicyId -PolicyName "MyPolicyName" -PolicyId "MyPolicyId" -AppIdTaggingPolicy -FilePath ".\AppIdPolicy.xml" ``` The policyID GUID is returned by the PowerShell command if successful. diff --git a/windows/security/application-security/application-control/windows-defender-application-control/design/deploy-multiple-wdac-policies.md b/windows/security/application-security/application-control/windows-defender-application-control/design/deploy-multiple-wdac-policies.md index 1d76e0e5a9..38c5700dab 100644 --- a/windows/security/application-security/application-control/windows-defender-application-control/design/deploy-multiple-wdac-policies.md +++ b/windows/security/application-security/application-control/windows-defender-application-control/design/deploy-multiple-wdac-policies.md @@ -2,7 +2,7 @@ title: Use multiple Windows Defender Application Control Policies description: Windows Defender Application Control supports multiple code integrity policies for one device. ms.localizationpriority: medium -ms.date: 07/19/2021 +ms.date: 04/15/2024 ms.topic: article --- @@ -11,17 +11,22 @@ ms.topic: article >[!NOTE] >Some capabilities of Windows Defender Application Control (WDAC) are only available on specific Windows versions. Learn more about the [Windows Defender Application Control feature availability](../feature-availability.md). -Prior to Windows 10 1903, Windows Defender Application Control only supported a single active policy on a system at any given time. This limited customers in situations where multiple policies with different intents would be useful. Beginning with Windows 10 version 1903, WDAC supports up to 32 active policies on a device at once in order to enable the following scenarios: +Beginning with Windows 10 version 1903 and Windows Server 2022, you can deploy multiple Windows Defender Application Control (WDAC) policies side-by-side on a device. To allow more than 32 active policies, install the Windows security update released on, or after, April 9, 2024 and then restart the device. With these updates, there's no limit for the number of policies you can deploy at once to a given device. Until you install the Windows security update released on or after April 9, 2024, your device is limited to 32 active policies and you must not exceed that number. + +>[!NOTE] +>The policy limit was not removed on Windows 11 21H2 and will remain limited to 32 policies. + +Here are some common scenarios where multiple side-by-side policies are useful: 1. Enforce and Audit Side-by-Side - To validate policy changes before deploying in enforcement mode, users can now deploy an audit-mode base policy side by side with an existing enforcement-mode base policy 2. Multiple Base Policies - Users can enforce two or more base policies simultaneously in order to allow simpler policy targeting for policies with different scope/intent - - If two base policies exist on a device, an application has to be allowed by both to run + - If two base policies exist on a device, an application must pass both policies for it to run 3. Supplemental Policies - Users can deploy one or more supplemental policies to expand a base policy - A supplemental policy expands a single base policy, and multiple supplemental policies can expand the same base policy - - For supplemental policies, applications that are allowed by either the base policy or its supplemental policy/policies are allowed to run + - For supplemental policies, applications allowed by either the base policy or its supplemental policy/policies run > [!NOTE] > Pre-1903 systems do not support the use of Multiple Policy Format WDAC policies. @@ -31,11 +36,11 @@ Prior to Windows 10 1903, Windows Defender Application Control only supported a - Multiple base policies: intersection - Only applications allowed by both policies run without generating block events - Base + supplemental policy: union - - Files that are allowed by either the base policy or the supplemental policy aren't blocked + - Files allowed by either the base policy or the supplemental policy run ## Creating WDAC policies in Multiple Policy Format -In order to allow multiple policies to exist and take effect on a single system, policies must be created using the new Multiple Policy Format. The "MultiplePolicyFormat" switch in [New-CIPolicy](/powershell/module/configci/new-cipolicy?preserve-view=true&view=win10-ps) results in 1) unique GUIDs being generated for the policy ID and 2) the policy type being specified as base. The below example describes the process of creating a new policy in the multiple policy format. +In order to allow multiple policies to exist and take effect on a single system, policies must be created using the new Multiple Policy Format. The "MultiplePolicyFormat" switch in [New-CIPolicy](/powershell/module/configci/new-cipolicy?preserve-view=true&view=win10-ps) results in 1) unique values generated for the policy ID and 2) the policy type set as a Base policy. The below example describes the process of creating a new policy in the multiple policy format. ```powershell New-CIPolicy -MultiplePolicyFormat -ScanPath "" -UserPEs -FilePath ".\policy.xml" -Level FilePublisher -Fallback SignedVersion,Publisher,Hash @@ -55,7 +60,7 @@ Add-SignerRule -FilePath ".\policy.xml" -CertificatePath [-K ### Supplemental policy creation -In order to create a supplemental policy, begin by creating a new policy in the Multiple Policy Format as shown above. From there, use Set-CIPolicyIdInfo to convert it to a supplemental policy and specify which base policy it expands. You can use either SupplementsBasePolicyID or BasePolicyToSupplementPath to specify the base policy. +In order to create a supplemental policy, begin by creating a new policy in the Multiple Policy Format as shown earlier. From there, use Set-CIPolicyIdInfo to convert it to a supplemental policy and specify which base policy it expands. You can use either SupplementsBasePolicyID or BasePolicyToSupplementPath to specify the base policy. - "SupplementsBasePolicyID": GUID of base policy that the supplemental policy applies to - "BasePolicyToSupplementPath": path to base policy file that the supplemental policy applies to @@ -66,11 +71,11 @@ Set-CIPolicyIdInfo -FilePath ".\supplemental_policy.xml" [-SupplementsBasePolicy ### Merging policies -When you're merging policies, the policy type and ID of the leftmost/first policy specified is used. If the leftmost is a base policy with ID \, then regardless of what the GUIDs and types are for any subsequent policies, the merged policy will be a base policy with ID \. +When you're merging policies, the policy type and ID of the leftmost/first policy specified is used. If the leftmost is a base policy with ID \, then regardless of what the GUIDs and types are for any subsequent policies, the merged policy is a base policy with ID \. ## Deploying multiple policies -In order to deploy multiple Windows Defender Application Control policies, you must either deploy them locally by copying the `*.cip` policy files into the proper folder or by using the ApplicationControl CSP, which is supported by Microsoft Intune's custom OMA-URI feature. +In order to deploy multiple Windows Defender Application Control policies, you must either deploy them locally by copying the `*.cip` policy files into the proper folder or by using the ApplicationControl CSP. ### Deploying multiple policies locally @@ -86,15 +91,9 @@ To deploy policies locally using the new multiple policy format, follow these st Multiple Windows Defender Application Control policies can be managed from an MDM server through ApplicationControl configuration service provider (CSP). The CSP also provides support for rebootless policy deployment.
-However, when policies are unenrolled from an MDM server, the CSP will attempt to remove every policy from devices, not just the policies added by the CSP. The reason for this is that the ApplicationControl CSP doesn't track enrollment sources for individual policies, even though it will query all policies on a device, regardless if they were deployed by the CSP. +However, when policies are unenrolled from an MDM server, the CSP attempts to remove every policy not actively deployed, not just the policies added by the CSP. This behavior happens because the system doesn't know what deployment methods were used to apply individual policies. For more information on deploying multiple policies, optionally using Microsoft Intune's custom OMA-URI capability, see [ApplicationControl CSP](/windows/client-management/mdm/applicationcontrol-csp). > [!NOTE] > WMI and GP do not currently support multiple policies. Instead, customers who cannot directly access the MDM stack should use the [ApplicationControl CSP via the MDM Bridge WMI Provider](/windows/client-management/mdm/applicationcontrol-csp#powershell-and-wmi-bridge-usage-guidance) to manage Multiple Policy Format Windows Defender Application Control policies. - -### Known Issues in Multiple Policy Format - -* If the maximum number of policies is exceeded, the device may bluescreen referencing ci.dll with a bug check value of 0x0000003b. -* If policies are loaded without requiring a reboot such as `PS_UpdateAndCompareCIPolicy`, they will still count towards this limit. -* This may pose an especially large challenge if the value of `{PolicyGUID}.cip` changes between releases. It may result in a long window between a change and the resultant reboot. diff --git a/windows/security/application-security/application-control/windows-defender-application-control/operations/known-issues.md b/windows/security/application-security/application-control/windows-defender-application-control/operations/known-issues.md index 91af264958..2522308d55 100644 --- a/windows/security/application-security/application-control/windows-defender-application-control/operations/known-issues.md +++ b/windows/security/application-security/application-control/windows-defender-application-control/operations/known-issues.md @@ -2,7 +2,7 @@ title: WDAC Admin Tips & Known Issues description: WDAC Known Issues ms.manager: jsuther -ms.date: 11/22/2023 +ms.date: 04/15/2024 ms.topic: article ms.localizationpriority: medium --- @@ -43,32 +43,30 @@ When the WDAC engine evaluates files against the active set of policies on the d 4. Lastly, WDAC makes a cloud call to the ISG to get reputation about the file, if the policy enables the ISG option. -5. If no explicit rule exists for the file and it's not allowed based on ISG or MI, then the file is blocked implicitly. +5. Any file not allowed by an explicit rule or based on ISG or MI is blocked implicitly. ## Known issues ### Boot stop failure (blue screen) occurs if more than 32 policies are active -If the maximum number of policies is exceeded, the device will bluescreen referencing ci.dll with a bug check value of 0x0000003b. Consider this maximum policy count limit when planning your WDAC policies. Any [Windows inbox policies](/windows/security/threat-protection/windows-defender-application-control/operations/inbox-wdac-policies) that are active on the device also count towards this limit. +Until you apply the Windows security update released on or after April 9, 2024, your device is limited to 32 active policies. If the maximum number of policies is exceeded, the device bluescreens referencing ci.dll with a bug check value of 0x0000003b. Consider this maximum policy count limit when planning your WDAC policies. Any [Windows inbox policies](/windows/security/threat-protection/windows-defender-application-control/operations/inbox-wdac-policies) that are active on the device also count towards this limit. To remove the maximum policy limit, install the Windows security update released on, or after, April 9, 2024 and then restart the device. Otherwise, reduce the number of policies on the device to remain below 32 policies. + +**Note:** The policy limit was not removed on Windows 11 21H2, and will remain limited to 32 policies. ### Audit mode policies can change the behavior for some apps or cause app crashes -Although WDAC audit mode is designed to avoid impact to apps, some features are always on/always enforced with any WDAC policy that includes the option **0 Enabled:UMCI**. Here's a list of known system changes in audit mode: +Although WDAC audit mode is designed to avoid impact to apps, some features are always on/always enforced with any WDAC policy that turns on user mode code integrity (UMCI) with the option **0 Enabled:UMCI**. Here's a list of known system changes in audit mode: - Some script hosts might block code or run code with fewer privileges even in audit mode. See [Script enforcement with WDAC](/windows/security/application-security/application-control/windows-defender-application-control/design/script-enforcement) for information about individual script host behaviors. - Option **19 Enabled:Dynamic Code Security** is always enforced if any UMCI policy includes that option. See [WDAC and .NET](/windows/security/application-security/application-control/windows-defender-application-control/design/wdac-and-dotnet#wdac-and-net-hardening). -### Managed Installer and ISG may cause excessive events - -When Managed Installer and ISG are enabled, 3091 and 3092 events are logged when a file didn't have Managed Installer or ISG authorization, regardless of whether the file was allowed. These events were moved to the verbose channel beginning with the September 2022 Update Preview since the events don't indicate an issue with the policy. - ### .NET native images may generate false positive block events In some cases, the code integrity logs where Windows Defender Application Control errors and warnings are written include error events for native images generated for .NET assemblies. Typically, native image blocks are functionally benign as a blocked native image falls back to its corresponding assembly and .NET regenerates the native image at its next scheduled maintenance window. ### Signatures using elliptical curve cryptography (ECC) aren't supported -WDAC signer-based rules only work with RSA cryptography. ECC algorithms, such as ECDSA, aren't supported. If you try to allow files by signature based on ECC signatures, you'll see VerificationError = 23 on the corresponding 3089 signature information events. You can authorize the files instead by hash or file attribute rules, or using other signer rules if the file is also signed with signatures using RSA. +WDAC signer-based rules only work with RSA cryptography. ECC algorithms, such as ECDSA, aren't supported. If WDAC blocks a file based on ECC signatures, the corresponding 3089 signature information events show VerificationError = 23. You can authorize the files instead by hash or file attribute rules, or using other signer rules if the file is also signed with signatures using RSA. ### MSI installers are treated as user writeable on Windows 10 when allowed by FilePath rule @@ -88,18 +86,19 @@ As a workaround, download the MSI file and run it locally: ```console msiexec -i c:\temp\Windows10_Version_1511_ADMX.msi ``` + ### Slow boot and performance with custom policies -WDAC evaluates all processes that run, including inbox Windows processes. If policies don't build off the WDAC templates or don't trust the Windows signers, you'll see slower boot times, degraded performance and possibly boot issues. For these reasons, you should use the [WDAC base templates](../design/example-wdac-base-policies.md) whenever possible to create your policies. +WDAC evaluates all processes that run, including inbox Windows processes. You can cause slower boot times, degraded performance, and possibly boot issues if your policies don't build upon the WDAC templates or don't trust the Windows signers. For these reasons, you should use the [WDAC base templates](../design/example-wdac-base-policies.md) whenever possible to create your policies. #### AppId Tagging policy considerations -If the AppId Tagging Policy wasn't built off the WDAC base templates or doesn't allow the Windows in-box signers, you'll notice a significant increase in boot times (~2 minutes). +AppId Tagging policies that aren't built upon the WDAC base templates or don't allow the Windows in-box signers might cause a significant increase in boot times (~2 minutes). -If you can't allowlist the Windows signers, or build off the WDAC base templates, it's recommended to add the following rule to your policies to improve the performance: +If you can't allowlist the Windows signers or build off the WDAC base templates, add the following rule to your policies to improve the performance: :::image type="content" source="../images/known-issue-appid-dll-rule.png" alt-text="Allow all dlls in the policy."::: :::image type="content" source="../images/known-issue-appid-dll-rule-xml.png" alt-text="Allow all dll files in the xml policy."::: -Since AppId Tagging policies evaluate but can't tag dll files, this rule will short circuit dll evaluation and improve evaluation performance. +Since AppId Tagging policies evaluate but can't tag dll files, this rule short circuits dll evaluation and improve evaluation performance. diff --git a/windows/security/identity-protection/hello-for-business/pin-reset.md b/windows/security/identity-protection/hello-for-business/pin-reset.md index 14caaa3144..7fd61f161a 100644 --- a/windows/security/identity-protection/hello-for-business/pin-reset.md +++ b/windows/security/identity-protection/hello-for-business/pin-reset.md @@ -121,7 +121,6 @@ GET https://graph.microsoft.com/v1.0/organization?$select=id #### [:::image type="icon" source="../../images/icons/group-policy.svg"::: **GPO**](#tab/gpo) -[!INCLUDE [gpo-settings-1](../../../../includes/configure/gpo-settings-1.md)] [!INCLUDE [gpo-settings-1](../../../../includes/configure/gpo-settings-1.md)] | Group policy path | Group policy setting | Value | diff --git a/windows/security/identity-protection/web-sign-in/index.md b/windows/security/identity-protection/web-sign-in/index.md index 61c01d2a42..86e2b4b834 100644 --- a/windows/security/identity-protection/web-sign-in/index.md +++ b/windows/security/identity-protection/web-sign-in/index.md @@ -1,7 +1,7 @@ --- title: Web sign-in for Windows description: Learn how Web sign-in in Windows works, key scenarios, and how to configure it. -ms.date: 03/12/2023 +ms.date: 04/10/2024 ms.topic: how-to appliesto: - ✅ Windows 11 diff --git a/windows/security/images/icons/subscription-add.svg b/windows/security/images/icons/subscription-add.svg new file mode 100644 index 0000000000..ffa73c424e --- /dev/null +++ b/windows/security/images/icons/subscription-add.svg @@ -0,0 +1,3 @@ + + + diff --git a/windows/security/images/icons/subscription.svg b/windows/security/images/icons/subscription.svg index ffa73c424e..ce4771b082 100644 --- a/windows/security/images/icons/subscription.svg +++ b/windows/security/images/icons/subscription.svg @@ -1,3 +1,3 @@ - - + + diff --git a/windows/security/licensing-and-edition-requirements.md b/windows/security/licensing-and-edition-requirements.md index 5514543d97..00c468a2dd 100644 --- a/windows/security/licensing-and-edition-requirements.md +++ b/windows/security/licensing-and-edition-requirements.md @@ -2,7 +2,7 @@ title: Windows security features licensing and edition requirements description: Learn about Windows licensing and edition requirements for the features included in Windows. ms.topic: conceptual -ms.date: 06/15/2023 +ms.date: 04/10/2024 appliesto: - ✅ Windows 11 ms.author: paoloma @@ -15,7 +15,7 @@ This article lists the security features that are available in Windows. Select one of the two tabs to learn about licensing requirements to use the security features, or to learn about the Windows edition requirements that support them: -#### [:::image type="icon" source="images/icons/subscription.svg" border="false"::: **Licensing requirements**](#tab/licensing) +#### [:::image type="icon" source="images/icons/subscription-add.svg" border="false"::: **Licensing requirements**](#tab/licensing) [!INCLUDE [licensing-requirements](../../includes/licensing/_licensing-requirements.md)] diff --git a/windows/security/operating-system-security/data-protection/configure-s-mime.md b/windows/security/operating-system-security/data-protection/configure-s-mime.md index 4d5e976fde..7781de30a9 100644 --- a/windows/security/operating-system-security/data-protection/configure-s-mime.md +++ b/windows/security/operating-system-security/data-protection/configure-s-mime.md @@ -2,7 +2,7 @@ title: Configure S/MIME for Windows description: S/MIME lets users encrypt outgoing messages and attachments so that only intended recipients with a digital ID, also known as a certificate, can read them. Learn how to configure S/MIME for Windows. ms.topic: how-to -ms.date: 05/31/2023 +ms.date: 04/10/2024 --- diff --git a/windows/security/security-foundations/index.md b/windows/security/security-foundations/index.md index 0f47d591b2..0275431b52 100644 --- a/windows/security/security-foundations/index.md +++ b/windows/security/security-foundations/index.md @@ -2,7 +2,7 @@ title: Windows security foundations description: Get an overview of security foundations, including the security development lifecycle, common criteria, and the bug bounty program. ms.topic: overview -ms.date: 06/15/2023 +ms.date: 04/10/2024 author: paolomatarazzo ms.author: paoloma --- @@ -15,4 +15,4 @@ Our strong security foundation uses Microsoft Security Development Lifecycle (SD Use the links in the following table to learn more about the security foundations: -[!INCLUDE [operating-system-security](../includes/sections/security-foundations.md)] +[!INCLUDE [security-foundations](../includes/sections/security-foundations.md)]