From ffc8a034c9d47006c3621ec2f201f16748318817 Mon Sep 17 00:00:00 2001
From: Sriraman M S <45987684+msbemba@users.noreply.github.com>
Date: Tue, 8 Nov 2022 22:10:21 +0530
Subject: [PATCH 01/81] Update windows-10-subscription-activation.md
added a note about excluding the Universal Store Service APIs and Web Application in the device compliance policy
reference - https://learn.microsoft.com/en-us/azure/active-directory/conditional-access/howto-conditional-access-policy-compliant-device
Per issue#https://github.com/MicrosoftDocs/windows-itpro-docs/issues/10972
---
windows/deployment/windows-10-subscription-activation.md | 3 +++
1 file changed, 3 insertions(+)
diff --git a/windows/deployment/windows-10-subscription-activation.md b/windows/deployment/windows-10-subscription-activation.md
index 29d62e08fa..81e56f7074 100644
--- a/windows/deployment/windows-10-subscription-activation.md
+++ b/windows/deployment/windows-10-subscription-activation.md
@@ -40,6 +40,9 @@ This article covers the following information:
For more information on how to deploy Enterprise licenses, see [Deploy Windows Enterprise licenses](deploy-enterprise-licenses.md).
+> [!NOTE]
+> Organizations that use the [Subscription Activation](/windows/deployment/windows-10-subscription-activation) feature to enable users to “step-up” from one version of Windows to another, may want to exclude the Universal Store Service APIs and Web Application, AppID 45a330b1-b1ec-4cc1-9161-9f03992aa49f from their device compliance policy.
+
## Subscription activation for Enterprise
Windows Enterprise E3 and E5 are available as online services via subscription. You can deploy Windows Enterprise in your organization without keys and reboots.
From b64fa615d60109386c36adaf8f33215a3b37af8c Mon Sep 17 00:00:00 2001
From: Sriraman M S <45987684+msbemba@users.noreply.github.com>
Date: Wed, 9 Nov 2022 11:20:05 +0530
Subject: [PATCH 02/81] Update
windows/deployment/windows-10-subscription-activation.md
Co-authored-by: JohanFreelancer9 <48568725+JohanFreelancer9@users.noreply.github.com>
---
windows/deployment/windows-10-subscription-activation.md | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/windows/deployment/windows-10-subscription-activation.md b/windows/deployment/windows-10-subscription-activation.md
index 81e56f7074..cf64d2e2d1 100644
--- a/windows/deployment/windows-10-subscription-activation.md
+++ b/windows/deployment/windows-10-subscription-activation.md
@@ -41,7 +41,7 @@ This article covers the following information:
For more information on how to deploy Enterprise licenses, see [Deploy Windows Enterprise licenses](deploy-enterprise-licenses.md).
> [!NOTE]
-> Organizations that use the [Subscription Activation](/windows/deployment/windows-10-subscription-activation) feature to enable users to “step-up” from one version of Windows to another, may want to exclude the Universal Store Service APIs and Web Application, AppID 45a330b1-b1ec-4cc1-9161-9f03992aa49f from their device compliance policy.
+> Organizations that use the [Subscription Activation](/windows/deployment/windows-10-subscription-activation) feature to enable users to upgrade from one version of Windows to another might want to exclude the Universal Store Service APIs and Web Application, AppID 45a330b1-b1ec-4cc1-9161-9f03992aa49f, from their device compliance policy.
## Subscription activation for Enterprise
From c53ab899b4aa177dbe2a8f746d30e11b3b370813 Mon Sep 17 00:00:00 2001
From: mounicabattula <95552440+mounicabattula@users.noreply.github.com>
Date: Mon, 5 Dec 2022 11:36:23 -0800
Subject: [PATCH 03/81] New feature - QU expedite Opt-out
---
.../windows-autopatch/operate/windows-autopatch-wqu-overview.md | 2 ++
1 file changed, 2 insertions(+)
diff --git a/windows/deployment/windows-autopatch/operate/windows-autopatch-wqu-overview.md b/windows/deployment/windows-autopatch/operate/windows-autopatch-wqu-overview.md
index f2d4f477af..2f6a60536a 100644
--- a/windows/deployment/windows-autopatch/operate/windows-autopatch-wqu-overview.md
+++ b/windows/deployment/windows-autopatch/operate/windows-autopatch-wqu-overview.md
@@ -58,6 +58,8 @@ Threat and vulnerability information about a new revision of Windows becomes ava
When running an expedited release, the regular goal of 95% of devices in 21 days no longer applies. Instead, Windows Autopatch greatly accelerates the release schedule of the release to update the environment more quickly. This approach requires an updated schedule for all devices outside of the Test ring since those devices are already getting the update as quickly.
+Windows Autopatch provides the option to opt out of service driven quality updates expedite. To opt out of service driven expedite, customers can go to Release Management blade under Windows Autopatch section under Tenant Administration on [Endpoint Manager admin center](https://go.microsoft.com/fwlink/?linkid=2109431). On the release management blade, the Expedited Quality Updates setting on the Release Settings tab can be used to change the expedite behavior.
+
| Release type | Group | Deferral | Deadline | Grace period |
| ----- | ----- | ----- | ----- | ----- |
| Standard release | Test
First
Fast
Broad | 0
1
6
9 | 0
2
2
5 | 0
2
2
2 |
From c36337077f3f41c11fdcaea2e61e097e225af14f Mon Sep 17 00:00:00 2001
From: Tiara Quan <95256667+tiaraquan@users.noreply.github.com>
Date: Mon, 5 Dec 2022 11:58:58 -0800
Subject: [PATCH 04/81] Update windows-autopatch-wqu-overview.md
Made tweaks.
---
.../operate/windows-autopatch-wqu-overview.md | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/windows/deployment/windows-autopatch/operate/windows-autopatch-wqu-overview.md b/windows/deployment/windows-autopatch/operate/windows-autopatch-wqu-overview.md
index 2f6a60536a..e00180267b 100644
--- a/windows/deployment/windows-autopatch/operate/windows-autopatch-wqu-overview.md
+++ b/windows/deployment/windows-autopatch/operate/windows-autopatch-wqu-overview.md
@@ -58,7 +58,9 @@ Threat and vulnerability information about a new revision of Windows becomes ava
When running an expedited release, the regular goal of 95% of devices in 21 days no longer applies. Instead, Windows Autopatch greatly accelerates the release schedule of the release to update the environment more quickly. This approach requires an updated schedule for all devices outside of the Test ring since those devices are already getting the update as quickly.
-Windows Autopatch provides the option to opt out of service driven quality updates expedite. To opt out of service driven expedite, customers can go to Release Management blade under Windows Autopatch section under Tenant Administration on [Endpoint Manager admin center](https://go.microsoft.com/fwlink/?linkid=2109431). On the release management blade, the Expedited Quality Updates setting on the Release Settings tab can be used to change the expedite behavior.
+### Opt out of expedited releases
+
+Windows Autopatch provides the option to opt out of service-driven expedited quality updates. To opt out of service-driven expedited quality updates, customers can go to the [Microsoft Endpoint Manager portal]((https://go.microsoft.com/fwlink/?linkid=2109431) > Tenant administration > Windows Autopatch > **Release management** blade. In the Release management blade, under the **Release Settings** tab, turn off the **Expedited Quality Updates** setting.
| Release type | Group | Deferral | Deadline | Grace period |
| ----- | ----- | ----- | ----- | ----- |
From f4e6063f6d1d7f4c236792f513b2fb484a8aaa1a Mon Sep 17 00:00:00 2001
From: Tiara Quan <95256667+tiaraquan@users.noreply.github.com>
Date: Mon, 5 Dec 2022 12:02:46 -0800
Subject: [PATCH 05/81] Update windows-autopatch-wqu-overview.md
---
.../windows-autopatch/operate/windows-autopatch-wqu-overview.md | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/windows/deployment/windows-autopatch/operate/windows-autopatch-wqu-overview.md b/windows/deployment/windows-autopatch/operate/windows-autopatch-wqu-overview.md
index e00180267b..63ac721337 100644
--- a/windows/deployment/windows-autopatch/operate/windows-autopatch-wqu-overview.md
+++ b/windows/deployment/windows-autopatch/operate/windows-autopatch-wqu-overview.md
@@ -60,7 +60,7 @@ When running an expedited release, the regular goal of 95% of devices in 21 days
### Opt out of expedited releases
-Windows Autopatch provides the option to opt out of service-driven expedited quality updates. To opt out of service-driven expedited quality updates, customers can go to the [Microsoft Endpoint Manager portal]((https://go.microsoft.com/fwlink/?linkid=2109431) > Tenant administration > Windows Autopatch > **Release management** blade. In the Release management blade, under the **Release Settings** tab, turn off the **Expedited Quality Updates** setting.
+Windows Autopatch provides the option to opt out of service-driven expedited quality updates. To opt out of service-driven expedited quality updates, customers can go to the [Microsoft Endpoint Manager portal](https://go.microsoft.com/fwlink/?linkid=2109431) > Tenant administration > Windows Autopatch > **Release management** blade. In the Release management blade, under the **Release Settings** tab, turn off the **Expedited Quality Updates** setting.
| Release type | Group | Deferral | Deadline | Grace period |
| ----- | ----- | ----- | ----- | ----- |
From 06ae6b451cf97c8a16d68fe73c59cb3fbc7ba728 Mon Sep 17 00:00:00 2001
From: Tiara Quan <95256667+tiaraquan@users.noreply.github.com>
Date: Mon, 5 Dec 2022 12:04:21 -0800
Subject: [PATCH 06/81] Update windows-autopatch-wqu-overview.md
---
.../windows-autopatch/operate/windows-autopatch-wqu-overview.md | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/windows/deployment/windows-autopatch/operate/windows-autopatch-wqu-overview.md b/windows/deployment/windows-autopatch/operate/windows-autopatch-wqu-overview.md
index 63ac721337..a97be2ea9d 100644
--- a/windows/deployment/windows-autopatch/operate/windows-autopatch-wqu-overview.md
+++ b/windows/deployment/windows-autopatch/operate/windows-autopatch-wqu-overview.md
@@ -60,7 +60,7 @@ When running an expedited release, the regular goal of 95% of devices in 21 days
### Opt out of expedited releases
-Windows Autopatch provides the option to opt out of service-driven expedited quality updates. To opt out of service-driven expedited quality updates, customers can go to the [Microsoft Endpoint Manager portal](https://go.microsoft.com/fwlink/?linkid=2109431) > Tenant administration > Windows Autopatch > **Release management** blade. In the Release management blade, under the **Release Settings** tab, turn off the **Expedited Quality Updates** setting.
+Windows Autopatch provides the option to opt out of service-driven expedited quality updates. To opt out of service-driven expedited quality updates, customers can go to the [Microsoft Endpoint Manager portal](https://go.microsoft.com/fwlink/?linkid=2109431) > **Tenant administration** > **Windows Autopatch** > **Release management** blade. In the **Release management** blade, under the **Release Settings** tab, turn off the **Expedited Quality Updates** setting.
| Release type | Group | Deferral | Deadline | Grace period |
| ----- | ----- | ----- | ----- | ----- |
From 5d11db7d9899d8db9e13693ff245f1297efe0192 Mon Sep 17 00:00:00 2001
From: Tiara Quan <95256667+tiaraquan@users.noreply.github.com>
Date: Mon, 5 Dec 2022 12:04:59 -0800
Subject: [PATCH 07/81] Update windows-autopatch-wqu-overview.md
---
.../windows-autopatch/operate/windows-autopatch-wqu-overview.md | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/windows/deployment/windows-autopatch/operate/windows-autopatch-wqu-overview.md b/windows/deployment/windows-autopatch/operate/windows-autopatch-wqu-overview.md
index a97be2ea9d..12c0848bd6 100644
--- a/windows/deployment/windows-autopatch/operate/windows-autopatch-wqu-overview.md
+++ b/windows/deployment/windows-autopatch/operate/windows-autopatch-wqu-overview.md
@@ -60,7 +60,7 @@ When running an expedited release, the regular goal of 95% of devices in 21 days
### Opt out of expedited releases
-Windows Autopatch provides the option to opt out of service-driven expedited quality updates. To opt out of service-driven expedited quality updates, customers can go to the [Microsoft Endpoint Manager portal](https://go.microsoft.com/fwlink/?linkid=2109431) > **Tenant administration** > **Windows Autopatch** > **Release management** blade. In the **Release management** blade, under the **Release Settings** tab, turn off the **Expedited Quality Updates** setting.
+Windows Autopatch provides the option to opt out of service-driven expedited quality updates. To opt out of service-driven expedited quality updates, customers can go to the **[Microsoft Endpoint Manager portal](https://go.microsoft.com/fwlink/?linkid=2109431)** > **Tenant administration** > **Windows Autopatch** > **Release management** blade. In the **Release management** blade, under the **Release Settings** tab, turn off the **Expedited Quality Updates** setting.
| Release type | Group | Deferral | Deadline | Grace period |
| ----- | ----- | ----- | ----- | ----- |
From 38fcce4df4d3df21dbfa1735c79528c9c3b86a78 Mon Sep 17 00:00:00 2001
From: Paolo Matarazzo <74918781+paolomatarazzo@users.noreply.github.com>
Date: Thu, 8 Dec 2022 16:05:05 -0500
Subject: [PATCH 08/81] includes updates
---
windows/security/images/icons/information.svg | 3 +++
windows/security/includes/hello-cloud.md | 11 +++++++++--
.../includes/hello-hybrid-cert-trust-aad.md | 13 ++++++++++---
.../security/includes/hello-hybrid-cert-trust-ad.md | 13 ++++++++++---
.../security/includes/hello-hybrid-cert-trust.md | 13 ++++++++++---
.../includes/hello-hybrid-cloudkerb-trust.md | 13 ++++++++++---
.../security/includes/hello-hybrid-key-trust-ad.md | 13 ++++++++++---
windows/security/includes/hello-hybrid-key-trust.md | 13 ++++++++++---
.../includes/hello-hybrid-keycert-trust-aad.md | 13 ++++++++++---
.../includes/hello-on-premises-cert-trust.md | 13 ++++++++++---
.../includes/hello-on-premises-key-trust.md | 13 ++++++++++---
.../includes/improve-request-performance.md | 10 ++--------
windows/security/includes/machineactionsnote.md | 8 ++------
.../includes/microsoft-defender-api-usgov.md | 10 ++--------
windows/security/includes/microsoft-defender.md | 8 +-------
windows/security/includes/prerelease.md | 8 ++------
16 files changed, 111 insertions(+), 64 deletions(-)
create mode 100644 windows/security/images/icons/information.svg
diff --git a/windows/security/images/icons/information.svg b/windows/security/images/icons/information.svg
new file mode 100644
index 0000000000..bc692eabb9
--- /dev/null
+++ b/windows/security/images/icons/information.svg
@@ -0,0 +1,3 @@
+
\ No newline at end of file
diff --git a/windows/security/includes/hello-cloud.md b/windows/security/includes/hello-cloud.md
index c40ed1027c..e718457806 100644
--- a/windows/security/includes/hello-cloud.md
+++ b/windows/security/includes/hello-cloud.md
@@ -1,6 +1,13 @@
+---
+author: paolomatarazzo
+ms.author: paoloma
+ms.date: 12/08/2022
+ms.topic: include
+---
+
This document describes Windows Hello for Business functionalities or scenarios that apply to:\
-✅ **Deployment type:** [cloud](../identity-protection/hello-for-business/hello-how-it-works-technology.md#cloud-deployment)\
-✅ **Device registration type:** [Azure AD join](../identity-protection/hello-for-business/hello-how-it-works-technology.md#azure-active-directory-join)
+- **Deployment type:** [cloud :::image type="icon" source="../images/icons/information.svg" border="false":::](../identity-protection/hello-for-business/hello-how-it-works-technology.md#cloud-deployment "Learn more here")\
+- **Device registration type:** [Azure AD join :::image type="icon" source="images/icons/information.svg" border="false":::](../identity-protection/hello-for-business/hello-how-it-works-technology.md#azure-active-directory-join "Learn more here")
diff --git a/windows/security/includes/hello-hybrid-cert-trust-aad.md b/windows/security/includes/hello-hybrid-cert-trust-aad.md
index e80912d8b9..26b0afb77e 100644
--- a/windows/security/includes/hello-hybrid-cert-trust-aad.md
+++ b/windows/security/includes/hello-hybrid-cert-trust-aad.md
@@ -1,7 +1,14 @@
+---
+author: paolomatarazzo
+ms.author: paoloma
+ms.date: 12/08/2022
+ms.topic: include
+---
+
This document describes Windows Hello for Business functionalities or scenarios that apply to:\
-✅ **Deployment type:** [hybrid](../identity-protection/hello-for-business/hello-how-it-works-technology.md#hybrid-deployment)\
-✅ **Trust type:** [certificate trust](../identity-protection/hello-for-business/hello-how-it-works-technology.md#certificate-trust)\
-✅ **Device registration type:** [Azure AD join](../identity-protection/hello-for-business/hello-how-it-works-technology.md#azure-active-directory-join)
+- **Deployment type:** [hybrid](../identity-protection/hello-for-business/hello-how-it-works-technology.md#hybrid-deployment)\
+- **Trust type:** [certificate trust](../identity-protection/hello-for-business/hello-how-it-works-technology.md#certificate-trust)\
+- **Device registration type:** [Azure AD join](../identity-protection/hello-for-business/hello-how-it-works-technology.md#azure-active-directory-join)
diff --git a/windows/security/includes/hello-hybrid-cert-trust-ad.md b/windows/security/includes/hello-hybrid-cert-trust-ad.md
index 4ef97bd233..ab68662f8a 100644
--- a/windows/security/includes/hello-hybrid-cert-trust-ad.md
+++ b/windows/security/includes/hello-hybrid-cert-trust-ad.md
@@ -1,7 +1,14 @@
+---
+author: paolomatarazzo
+ms.author: paoloma
+ms.date: 12/08/2022
+ms.topic: include
+---
+
This document describes Windows Hello for Business functionalities or scenarios that apply to:\
-✅ **Deployment type:** [hybrid](../identity-protection/hello-for-business/hello-how-it-works-technology.md#hybrid-deployment)\
-✅ **Trust type:** [certificate trust](../identity-protection/hello-for-business/hello-how-it-works-technology.md#certificate-trust)\
-✅ **Device registration type:** [Hybrid Azure AD join](../identity-protection/hello-for-business/hello-how-it-works-technology.md#hybrid-azure-ad-join)
+- **Deployment type:** [hybrid](../identity-protection/hello-for-business/hello-how-it-works-technology.md#hybrid-deployment)\
+- **Trust type:** [certificate trust](../identity-protection/hello-for-business/hello-how-it-works-technology.md#certificate-trust)\
+- **Device registration type:** [Hybrid Azure AD join](../identity-protection/hello-for-business/hello-how-it-works-technology.md#hybrid-azure-ad-join)
diff --git a/windows/security/includes/hello-hybrid-cert-trust.md b/windows/security/includes/hello-hybrid-cert-trust.md
index 77a897f264..4b880256ab 100644
--- a/windows/security/includes/hello-hybrid-cert-trust.md
+++ b/windows/security/includes/hello-hybrid-cert-trust.md
@@ -1,7 +1,14 @@
+---
+author: paolomatarazzo
+ms.author: paoloma
+ms.date: 12/08/2022
+ms.topic: include
+---
+
This document describes Windows Hello for Business functionalities or scenarios that apply to:\
-✅ **Deployment type:** [hybrid](../identity-protection/hello-for-business/hello-how-it-works-technology.md#hybrid-deployment)\
-✅ **Trust type:** [certificate trust](../identity-protection/hello-for-business/hello-how-it-works-technology.md#certificate-trust)\
-✅ **Device registration type:** [Azure AD join](../identity-protection/hello-for-business/hello-how-it-works-technology.md#azure-active-directory-join), [Hybrid Azure AD join](../identity-protection/hello-for-business/hello-how-it-works-technology.md#hybrid-azure-ad-join)
+- **Deployment type:** [hybrid](../identity-protection/hello-for-business/hello-how-it-works-technology.md#hybrid-deployment)\
+- **Trust type:** [certificate trust](../identity-protection/hello-for-business/hello-how-it-works-technology.md#certificate-trust)\
+- **Device registration type:** [Azure AD join](../identity-protection/hello-for-business/hello-how-it-works-technology.md#azure-active-directory-join), [Hybrid Azure AD join](../identity-protection/hello-for-business/hello-how-it-works-technology.md#hybrid-azure-ad-join)
diff --git a/windows/security/includes/hello-hybrid-cloudkerb-trust.md b/windows/security/includes/hello-hybrid-cloudkerb-trust.md
index 4f68be791b..8ba8d48628 100644
--- a/windows/security/includes/hello-hybrid-cloudkerb-trust.md
+++ b/windows/security/includes/hello-hybrid-cloudkerb-trust.md
@@ -1,7 +1,14 @@
+---
+author: paolomatarazzo
+ms.author: paoloma
+ms.date: 12/08/2022
+ms.topic: include
+---
+
This document describes Windows Hello for Business functionalities or scenarios that apply to:\
-✅ **Deployment type:** [hybrid](../identity-protection/hello-for-business/hello-how-it-works-technology.md#hybrid-deployment)\
-✅ **Trust type:** [cloud Kerberos trust](../identity-protection/hello-for-business/hello-hybrid-cloud-kerberos-trust.md)\
-✅ **Device registration type:** [Azure AD join](../identity-protection/hello-for-business/hello-how-it-works-technology.md#azure-active-directory-join), [Hybrid Azure AD join](../identity-protection/hello-for-business/hello-how-it-works-technology.md#hybrid-azure-ad-join)
+- **Deployment type:** [hybrid](../identity-protection/hello-for-business/hello-how-it-works-technology.md#hybrid-deployment)\
+- **Trust type:** [cloud Kerberos trust](../identity-protection/hello-for-business/hello-hybrid-cloud-kerberos-trust.md)\
+- **Device registration type:** [Azure AD join](../identity-protection/hello-for-business/hello-how-it-works-technology.md#azure-active-directory-join), [Hybrid Azure AD join](../identity-protection/hello-for-business/hello-how-it-works-technology.md#hybrid-azure-ad-join)
diff --git a/windows/security/includes/hello-hybrid-key-trust-ad.md b/windows/security/includes/hello-hybrid-key-trust-ad.md
index 68521a5a14..b222f73c69 100644
--- a/windows/security/includes/hello-hybrid-key-trust-ad.md
+++ b/windows/security/includes/hello-hybrid-key-trust-ad.md
@@ -1,7 +1,14 @@
+---
+author: paolomatarazzo
+ms.author: paoloma
+ms.date: 12/08/2022
+ms.topic: include
+---
+
This document describes Windows Hello for Business functionalities or scenarios that apply to:\
-✅ **Deployment type:** [hybrid](../identity-protection/hello-for-business/hello-how-it-works-technology.md#hybrid-deployment)\
-✅ **Trust type:** [key trust](../identity-protection/hello-for-business/hello-how-it-works-technology.md#key-trust)\
-✅ **Device registration type:** [Hybrid Azure AD join](../identity-protection/hello-for-business/hello-how-it-works-technology.md#hybrid-azure-ad-join)
+- **Deployment type:** [hybrid](../identity-protection/hello-for-business/hello-how-it-works-technology.md#hybrid-deployment)\
+- **Trust type:** [key trust](../identity-protection/hello-for-business/hello-how-it-works-technology.md#key-trust)\
+- **Device registration type:** [Hybrid Azure AD join](../identity-protection/hello-for-business/hello-how-it-works-technology.md#hybrid-azure-ad-join)
diff --git a/windows/security/includes/hello-hybrid-key-trust.md b/windows/security/includes/hello-hybrid-key-trust.md
index fdb7466014..01f38b9396 100644
--- a/windows/security/includes/hello-hybrid-key-trust.md
+++ b/windows/security/includes/hello-hybrid-key-trust.md
@@ -1,7 +1,14 @@
+---
+author: paolomatarazzo
+ms.author: paoloma
+ms.date: 12/08/2022
+ms.topic: include
+---
+
This document describes Windows Hello for Business functionalities or scenarios that apply to:\
-✅ **Deployment type:** [hybrid](../identity-protection/hello-for-business/hello-how-it-works-technology.md#hybrid-deployment)\
-✅ **Trust type:** [key trust](../identity-protection/hello-for-business/hello-how-it-works-technology.md#key-trust)\
-✅ **Device registration type:** [Azure AD join](../identity-protection/hello-for-business/hello-how-it-works-technology.md#azure-active-directory-join), [Hybrid Azure AD join](../identity-protection/hello-for-business/hello-how-it-works-technology.md#hybrid-azure-ad-join)
+- **Deployment type:** [hybrid](../identity-protection/hello-for-business/hello-how-it-works-technology.md#hybrid-deployment)\
+- **Trust type:** [key trust](../identity-protection/hello-for-business/hello-how-it-works-technology.md#key-trust)\
+- **Device registration type:** [Azure AD join](../identity-protection/hello-for-business/hello-how-it-works-technology.md#azure-active-directory-join), [Hybrid Azure AD join](../identity-protection/hello-for-business/hello-how-it-works-technology.md#hybrid-azure-ad-join)
diff --git a/windows/security/includes/hello-hybrid-keycert-trust-aad.md b/windows/security/includes/hello-hybrid-keycert-trust-aad.md
index a8d82200d3..a1b033a214 100644
--- a/windows/security/includes/hello-hybrid-keycert-trust-aad.md
+++ b/windows/security/includes/hello-hybrid-keycert-trust-aad.md
@@ -1,7 +1,14 @@
+---
+author: paolomatarazzo
+ms.author: paoloma
+ms.date: 12/08/2022
+ms.topic: include
+---
+
This document describes Windows Hello for Business functionalities or scenarios that apply to:\
-✅ **Deployment type:** [hybrid](../identity-protection/hello-for-business/hello-how-it-works-technology.md#hybrid-deployment)\
-✅ **Trust type:** [key trust](../identity-protection/hello-for-business/hello-how-it-works-technology.md#key-trust), [certificate trust](../identity-protection/hello-for-business/hello-how-it-works-technology.md#certificate-trust)\
-✅ **Device registration type:** [Azure AD join](../identity-protection/hello-for-business/hello-how-it-works-technology.md#azure-active-directory-join)
+- **Deployment type:** [hybrid](../identity-protection/hello-for-business/hello-how-it-works-technology.md#hybrid-deployment)\
+- **Trust type:** [key trust](../identity-protection/hello-for-business/hello-how-it-works-technology.md#key-trust), [certificate trust](../identity-protection/hello-for-business/hello-how-it-works-technology.md#certificate-trust)\
+- **Device registration type:** [Azure AD join](../identity-protection/hello-for-business/hello-how-it-works-technology.md#azure-active-directory-join)
---
diff --git a/windows/security/includes/hello-on-premises-cert-trust.md b/windows/security/includes/hello-on-premises-cert-trust.md
index 2cc01ac3ac..1fa4f7604b 100644
--- a/windows/security/includes/hello-on-premises-cert-trust.md
+++ b/windows/security/includes/hello-on-premises-cert-trust.md
@@ -1,7 +1,14 @@
+---
+author: paolomatarazzo
+ms.author: paoloma
+ms.date: 12/08/2022
+ms.topic: include
+---
+
This document describes Windows Hello for Business functionalities or scenarios that apply to:\
-✅ **Deployment type:** [on-premises](../identity-protection/hello-for-business/hello-how-it-works-technology.md#on-premises-deployment)\
-✅ **Trust type:** [certificate trust](../identity-protection/hello-for-business/hello-how-it-works-technology.md#certificate-trust)\
-✅ **Device registration type:** Active Directory domain join
+- **Deployment type:** [on-premises](../identity-protection/hello-for-business/hello-how-it-works-technology.md#on-premises-deployment)\
+- **Trust type:** [certificate trust](../identity-protection/hello-for-business/hello-how-it-works-technology.md#certificate-trust)\
+- **Device registration type:** Active Directory domain join
diff --git a/windows/security/includes/hello-on-premises-key-trust.md b/windows/security/includes/hello-on-premises-key-trust.md
index cd6241fa72..b852117610 100644
--- a/windows/security/includes/hello-on-premises-key-trust.md
+++ b/windows/security/includes/hello-on-premises-key-trust.md
@@ -1,7 +1,14 @@
+---
+author: paolomatarazzo
+ms.author: paoloma
+ms.date: 12/08/2022
+ms.topic: include
+---
+
This document describes Windows Hello for Business functionalities or scenarios that apply to:\
-✅ **Deployment type:** [on-premises](../identity-protection/hello-for-business/hello-how-it-works-technology.md#on-premises-deployment)\
-✅ **Trust type:** [key trust](../identity-protection/hello-for-business/hello-how-it-works-technology.md#key-trust)\
-✅ **Device registration type:** Active Directory domain join
+- **Deployment type:** [on-premises](../identity-protection/hello-for-business/hello-how-it-works-technology.md#on-premises-deployment)\
+- **Trust type:** [key trust](../identity-protection/hello-for-business/hello-how-it-works-technology.md#key-trust)\
+- **Device registration type:** Active Directory domain join
diff --git a/windows/security/includes/improve-request-performance.md b/windows/security/includes/improve-request-performance.md
index 24aaa25d9f..f928705138 100644
--- a/windows/security/includes/improve-request-performance.md
+++ b/windows/security/includes/improve-request-performance.md
@@ -1,14 +1,8 @@
---
-title: Improve request performance
-description: Improve request performance
-search.product: eADQiWindows 10XVcnh
-ms.prod: m365-security
-ms.localizationpriority: medium
-ms.collection: M365-security-compliance
-ms.topic: article
author: paolomatarazzo
ms.author: paoloma
-manager: aaroncz
+ms.date: 12/08/2022
+ms.topic: include
---
>[!TIP]
diff --git a/windows/security/includes/machineactionsnote.md b/windows/security/includes/machineactionsnote.md
index 31e3d1ac98..d4b4560d8f 100644
--- a/windows/security/includes/machineactionsnote.md
+++ b/windows/security/includes/machineactionsnote.md
@@ -1,12 +1,8 @@
---
-title: Perform a Machine Action via the Microsoft Defender for Endpoint API
-description: This page focuses on performing a machine action via the Microsoft Defender for Endpoint API.
-ms.date: 08/28/2017
-ms.reviewer:
author: paolomatarazzo
ms.author: paoloma
-manager: aaroncz
-ms.prod: m365-security
+ms.date: 12/08/2022
+ms.topic: include
---
>[!Note]
diff --git a/windows/security/includes/microsoft-defender-api-usgov.md b/windows/security/includes/microsoft-defender-api-usgov.md
index 74cfd90cbb..0b0b2be701 100644
--- a/windows/security/includes/microsoft-defender-api-usgov.md
+++ b/windows/security/includes/microsoft-defender-api-usgov.md
@@ -1,14 +1,8 @@
---
-title: Microsoft Defender for Endpoint API URIs for US Government
-description: Microsoft Defender for Endpoint API URIs for US Government
-search.product: eADQiWindows 10XVcnh
-ms.prod: m365-security
author: paolomatarazzo
ms.author: paoloma
-manager: aaroncz
-ms.localizationpriority: medium
-ms.collection: M365-security-compliance
-ms.topic: article
+ms.date: 12/08/2022
+ms.topic: include
---
>[!NOTE]
diff --git a/windows/security/includes/microsoft-defender.md b/windows/security/includes/microsoft-defender.md
index 0aade34b01..bd9a8d2c0d 100644
--- a/windows/security/includes/microsoft-defender.md
+++ b/windows/security/includes/microsoft-defender.md
@@ -1,13 +1,7 @@
---
-title: Microsoft 365 Defender important guidance
-description: A note in regard to important Microsoft 365 Defender guidance.
-ms.date:
-ms.reviewer:
-manager: aaroncz
author: paolomatarazzo
ms.author: paoloma
-manager: aaroncz
-ms.prod: m365-security
+ms.date: 12/08/2022
ms.topic: include
---
diff --git a/windows/security/includes/prerelease.md b/windows/security/includes/prerelease.md
index 58b056c484..c0212561bd 100644
--- a/windows/security/includes/prerelease.md
+++ b/windows/security/includes/prerelease.md
@@ -1,12 +1,8 @@
---
-title: Microsoft Defender for Endpoint Pre-release Disclaimer
-description: Disclaimer for pre-release version of Microsoft Defender for Endpoint.
-ms.date: 08/28/2017
-ms.reviewer:
author: paolomatarazzo
ms.author: paoloma
-manager: aaroncz
-ms.prod: m365-security
+ms.date: 12/08/2022
+ms.topic: include
---
> [!IMPORTANT]
From b98951d0c36bd6ecde90b8d8e8f388d4f4b36107 Mon Sep 17 00:00:00 2001
From: Paolo Matarazzo <74918781+paolomatarazzo@users.noreply.github.com>
Date: Thu, 8 Dec 2022 16:18:58 -0500
Subject: [PATCH 09/81] updates
---
windows/security/includes/hello-cloud.md | 11 ++++-------
windows/security/includes/hello-deployment-cloud.md | 8 ++++++++
.../security/includes/hello-hybrid-cert-trust-aad.md | 11 ++++-------
.../security/includes/hello-hybrid-cert-trust-ad.md | 6 +++---
windows/security/includes/hello-hybrid-cert-trust.md | 6 +++---
.../security/includes/hello-hybrid-cloudkerb-trust.md | 6 +++---
.../security/includes/hello-hybrid-key-trust-ad.md | 6 +++---
windows/security/includes/hello-hybrid-key-trust.md | 6 +++---
.../includes/hello-hybrid-keycert-trust-aad.md | 6 +++---
windows/security/includes/hello-intro.md | 8 ++++++++
.../security/includes/hello-on-premises-cert-trust.md | 6 +++---
.../security/includes/hello-on-premises-key-trust.md | 6 +++---
windows/security/includes/hello-outro.md | 10 ++++++++++
windows/security/includes/hello-registration-aadj.md | 8 ++++++++
14 files changed, 66 insertions(+), 38 deletions(-)
create mode 100644 windows/security/includes/hello-deployment-cloud.md
create mode 100644 windows/security/includes/hello-intro.md
create mode 100644 windows/security/includes/hello-outro.md
create mode 100644 windows/security/includes/hello-registration-aadj.md
diff --git a/windows/security/includes/hello-cloud.md b/windows/security/includes/hello-cloud.md
index e718457806..70d63d9230 100644
--- a/windows/security/includes/hello-cloud.md
+++ b/windows/security/includes/hello-cloud.md
@@ -5,10 +5,7 @@ ms.date: 12/08/2022
ms.topic: include
---
-This document describes Windows Hello for Business functionalities or scenarios that apply to:\
-- **Deployment type:** [cloud :::image type="icon" source="../images/icons/information.svg" border="false":::](../identity-protection/hello-for-business/hello-how-it-works-technology.md#cloud-deployment "Learn more here")\
-- **Device registration type:** [Azure AD join :::image type="icon" source="images/icons/information.svg" border="false":::](../identity-protection/hello-for-business/hello-how-it-works-technology.md#azure-active-directory-join "Learn more here")
-
-
-
----
+[!INCLUDE [hello-intro](hello-intro.md)]
+- **Deployment type:** [!INCLUDE [hello-deployment-cloud](hello-deployment-cloud.md)]
+- **Device registration type:** [!INCLUDE [hello-registration-aadj](hello-registration-aadj.md)]
+[!INCLUDE [hello-outro](hello-outro.md)]
\ No newline at end of file
diff --git a/windows/security/includes/hello-deployment-cloud.md b/windows/security/includes/hello-deployment-cloud.md
new file mode 100644
index 0000000000..79cde9e0b1
--- /dev/null
+++ b/windows/security/includes/hello-deployment-cloud.md
@@ -0,0 +1,8 @@
+---
+author: paolomatarazzo
+ms.author: paoloma
+ms.date: 12/08/2022
+ms.topic: include
+---
+
+[cloud :::image type="icon" source="../images/icons/information.svg" border="false":::](../identity-protection/hello-for-business/hello-how-it-works-technology.md#cloud-deployment)
\ No newline at end of file
diff --git a/windows/security/includes/hello-hybrid-cert-trust-aad.md b/windows/security/includes/hello-hybrid-cert-trust-aad.md
index 26b0afb77e..fa4351ad77 100644
--- a/windows/security/includes/hello-hybrid-cert-trust-aad.md
+++ b/windows/security/includes/hello-hybrid-cert-trust-aad.md
@@ -5,11 +5,8 @@ ms.date: 12/08/2022
ms.topic: include
---
-This document describes Windows Hello for Business functionalities or scenarios that apply to:\
-- **Deployment type:** [hybrid](../identity-protection/hello-for-business/hello-how-it-works-technology.md#hybrid-deployment)\
-- **Trust type:** [certificate trust](../identity-protection/hello-for-business/hello-how-it-works-technology.md#certificate-trust)\
+[!INCLUDE [hello-intro](hello-intro.md)]
+- **Deployment type:** [hybrid](../identity-protection/hello-for-business/hello-how-it-works-technology.md#hybrid-deployment)
+- **Trust type:** [certificate trust](../identity-protection/hello-for-business/hello-how-it-works-technology.md#certificate-trust)
- **Device registration type:** [Azure AD join](../identity-protection/hello-for-business/hello-how-it-works-technology.md#azure-active-directory-join)
-
-
-
----
+[!INCLUDE [hello-outro](hello-outro.md)]
\ No newline at end of file
diff --git a/windows/security/includes/hello-hybrid-cert-trust-ad.md b/windows/security/includes/hello-hybrid-cert-trust-ad.md
index ab68662f8a..8b5a2a1ad3 100644
--- a/windows/security/includes/hello-hybrid-cert-trust-ad.md
+++ b/windows/security/includes/hello-hybrid-cert-trust-ad.md
@@ -5,9 +5,9 @@ ms.date: 12/08/2022
ms.topic: include
---
-This document describes Windows Hello for Business functionalities or scenarios that apply to:\
-- **Deployment type:** [hybrid](../identity-protection/hello-for-business/hello-how-it-works-technology.md#hybrid-deployment)\
-- **Trust type:** [certificate trust](../identity-protection/hello-for-business/hello-how-it-works-technology.md#certificate-trust)\
+This document describes Windows Hello for Business functionalities or scenarios that apply to:
+- **Deployment type:** [hybrid](../identity-protection/hello-for-business/hello-how-it-works-technology.md#hybrid-deployment)
+- **Trust type:** [certificate trust](../identity-protection/hello-for-business/hello-how-it-works-technology.md#certificate-trust)
- **Device registration type:** [Hybrid Azure AD join](../identity-protection/hello-for-business/hello-how-it-works-technology.md#hybrid-azure-ad-join)
diff --git a/windows/security/includes/hello-hybrid-cert-trust.md b/windows/security/includes/hello-hybrid-cert-trust.md
index 4b880256ab..c052d404d0 100644
--- a/windows/security/includes/hello-hybrid-cert-trust.md
+++ b/windows/security/includes/hello-hybrid-cert-trust.md
@@ -5,9 +5,9 @@ ms.date: 12/08/2022
ms.topic: include
---
-This document describes Windows Hello for Business functionalities or scenarios that apply to:\
-- **Deployment type:** [hybrid](../identity-protection/hello-for-business/hello-how-it-works-technology.md#hybrid-deployment)\
-- **Trust type:** [certificate trust](../identity-protection/hello-for-business/hello-how-it-works-technology.md#certificate-trust)\
+This document describes Windows Hello for Business functionalities or scenarios that apply to:
+- **Deployment type:** [hybrid](../identity-protection/hello-for-business/hello-how-it-works-technology.md#hybrid-deployment)
+- **Trust type:** [certificate trust](../identity-protection/hello-for-business/hello-how-it-works-technology.md#certificate-trust)
- **Device registration type:** [Azure AD join](../identity-protection/hello-for-business/hello-how-it-works-technology.md#azure-active-directory-join), [Hybrid Azure AD join](../identity-protection/hello-for-business/hello-how-it-works-technology.md#hybrid-azure-ad-join)
diff --git a/windows/security/includes/hello-hybrid-cloudkerb-trust.md b/windows/security/includes/hello-hybrid-cloudkerb-trust.md
index 8ba8d48628..d91c8f5148 100644
--- a/windows/security/includes/hello-hybrid-cloudkerb-trust.md
+++ b/windows/security/includes/hello-hybrid-cloudkerb-trust.md
@@ -5,9 +5,9 @@ ms.date: 12/08/2022
ms.topic: include
---
-This document describes Windows Hello for Business functionalities or scenarios that apply to:\
-- **Deployment type:** [hybrid](../identity-protection/hello-for-business/hello-how-it-works-technology.md#hybrid-deployment)\
-- **Trust type:** [cloud Kerberos trust](../identity-protection/hello-for-business/hello-hybrid-cloud-kerberos-trust.md)\
+This document describes Windows Hello for Business functionalities or scenarios that apply to:
+- **Deployment type:** [hybrid](../identity-protection/hello-for-business/hello-how-it-works-technology.md#hybrid-deployment)
+- **Trust type:** [cloud Kerberos trust](../identity-protection/hello-for-business/hello-hybrid-cloud-kerberos-trust.md)
- **Device registration type:** [Azure AD join](../identity-protection/hello-for-business/hello-how-it-works-technology.md#azure-active-directory-join), [Hybrid Azure AD join](../identity-protection/hello-for-business/hello-how-it-works-technology.md#hybrid-azure-ad-join)
diff --git a/windows/security/includes/hello-hybrid-key-trust-ad.md b/windows/security/includes/hello-hybrid-key-trust-ad.md
index b222f73c69..0bcdd2a570 100644
--- a/windows/security/includes/hello-hybrid-key-trust-ad.md
+++ b/windows/security/includes/hello-hybrid-key-trust-ad.md
@@ -5,9 +5,9 @@ ms.date: 12/08/2022
ms.topic: include
---
-This document describes Windows Hello for Business functionalities or scenarios that apply to:\
-- **Deployment type:** [hybrid](../identity-protection/hello-for-business/hello-how-it-works-technology.md#hybrid-deployment)\
-- **Trust type:** [key trust](../identity-protection/hello-for-business/hello-how-it-works-technology.md#key-trust)\
+This document describes Windows Hello for Business functionalities or scenarios that apply to:
+- **Deployment type:** [hybrid](../identity-protection/hello-for-business/hello-how-it-works-technology.md#hybrid-deployment)
+- **Trust type:** [key trust](../identity-protection/hello-for-business/hello-how-it-works-technology.md#key-trust)
- **Device registration type:** [Hybrid Azure AD join](../identity-protection/hello-for-business/hello-how-it-works-technology.md#hybrid-azure-ad-join)
diff --git a/windows/security/includes/hello-hybrid-key-trust.md b/windows/security/includes/hello-hybrid-key-trust.md
index 01f38b9396..49a6329926 100644
--- a/windows/security/includes/hello-hybrid-key-trust.md
+++ b/windows/security/includes/hello-hybrid-key-trust.md
@@ -5,9 +5,9 @@ ms.date: 12/08/2022
ms.topic: include
---
-This document describes Windows Hello for Business functionalities or scenarios that apply to:\
-- **Deployment type:** [hybrid](../identity-protection/hello-for-business/hello-how-it-works-technology.md#hybrid-deployment)\
-- **Trust type:** [key trust](../identity-protection/hello-for-business/hello-how-it-works-technology.md#key-trust)\
+This document describes Windows Hello for Business functionalities or scenarios that apply to:
+- **Deployment type:** [hybrid](../identity-protection/hello-for-business/hello-how-it-works-technology.md#hybrid-deployment)
+- **Trust type:** [key trust](../identity-protection/hello-for-business/hello-how-it-works-technology.md#key-trust)
- **Device registration type:** [Azure AD join](../identity-protection/hello-for-business/hello-how-it-works-technology.md#azure-active-directory-join), [Hybrid Azure AD join](../identity-protection/hello-for-business/hello-how-it-works-technology.md#hybrid-azure-ad-join)
diff --git a/windows/security/includes/hello-hybrid-keycert-trust-aad.md b/windows/security/includes/hello-hybrid-keycert-trust-aad.md
index a1b033a214..df52c11771 100644
--- a/windows/security/includes/hello-hybrid-keycert-trust-aad.md
+++ b/windows/security/includes/hello-hybrid-keycert-trust-aad.md
@@ -5,9 +5,9 @@ ms.date: 12/08/2022
ms.topic: include
---
-This document describes Windows Hello for Business functionalities or scenarios that apply to:\
-- **Deployment type:** [hybrid](../identity-protection/hello-for-business/hello-how-it-works-technology.md#hybrid-deployment)\
-- **Trust type:** [key trust](../identity-protection/hello-for-business/hello-how-it-works-technology.md#key-trust), [certificate trust](../identity-protection/hello-for-business/hello-how-it-works-technology.md#certificate-trust)\
+This document describes Windows Hello for Business functionalities or scenarios that apply to:
+- **Deployment type:** [hybrid](../identity-protection/hello-for-business/hello-how-it-works-technology.md#hybrid-deployment)
+- **Trust type:** [key trust](../identity-protection/hello-for-business/hello-how-it-works-technology.md#key-trust), [certificate trust](../identity-protection/hello-for-business/hello-how-it-works-technology.md#certificate-trust)
- **Device registration type:** [Azure AD join](../identity-protection/hello-for-business/hello-how-it-works-technology.md#azure-active-directory-join)
diff --git a/windows/security/includes/hello-intro.md b/windows/security/includes/hello-intro.md
new file mode 100644
index 0000000000..46d97c93e6
--- /dev/null
+++ b/windows/security/includes/hello-intro.md
@@ -0,0 +1,8 @@
+---
+author: paolomatarazzo
+ms.author: paoloma
+ms.date: 12/08/2022
+ms.topic: include
+---
+
+This document describes Windows Hello for Business functionalities or scenarios that apply to:
\ No newline at end of file
diff --git a/windows/security/includes/hello-on-premises-cert-trust.md b/windows/security/includes/hello-on-premises-cert-trust.md
index 1fa4f7604b..6bfbf5f58f 100644
--- a/windows/security/includes/hello-on-premises-cert-trust.md
+++ b/windows/security/includes/hello-on-premises-cert-trust.md
@@ -5,9 +5,9 @@ ms.date: 12/08/2022
ms.topic: include
---
-This document describes Windows Hello for Business functionalities or scenarios that apply to:\
-- **Deployment type:** [on-premises](../identity-protection/hello-for-business/hello-how-it-works-technology.md#on-premises-deployment)\
-- **Trust type:** [certificate trust](../identity-protection/hello-for-business/hello-how-it-works-technology.md#certificate-trust)\
+This document describes Windows Hello for Business functionalities or scenarios that apply to:
+- **Deployment type:** [on-premises](../identity-protection/hello-for-business/hello-how-it-works-technology.md#on-premises-deployment)
+- **Trust type:** [certificate trust](../identity-protection/hello-for-business/hello-how-it-works-technology.md#certificate-trust)
- **Device registration type:** Active Directory domain join
diff --git a/windows/security/includes/hello-on-premises-key-trust.md b/windows/security/includes/hello-on-premises-key-trust.md
index b852117610..b6b279c866 100644
--- a/windows/security/includes/hello-on-premises-key-trust.md
+++ b/windows/security/includes/hello-on-premises-key-trust.md
@@ -5,9 +5,9 @@ ms.date: 12/08/2022
ms.topic: include
---
-This document describes Windows Hello for Business functionalities or scenarios that apply to:\
-- **Deployment type:** [on-premises](../identity-protection/hello-for-business/hello-how-it-works-technology.md#on-premises-deployment)\
-- **Trust type:** [key trust](../identity-protection/hello-for-business/hello-how-it-works-technology.md#key-trust)\
+This document describes Windows Hello for Business functionalities or scenarios that apply to:
+- **Deployment type:** [on-premises](../identity-protection/hello-for-business/hello-how-it-works-technology.md#on-premises-deployment)
+- **Trust type:** [key trust](../identity-protection/hello-for-business/hello-how-it-works-technology.md#key-trust)
- **Device registration type:** Active Directory domain join
diff --git a/windows/security/includes/hello-outro.md b/windows/security/includes/hello-outro.md
new file mode 100644
index 0000000000..12b51c9186
--- /dev/null
+++ b/windows/security/includes/hello-outro.md
@@ -0,0 +1,10 @@
+---
+author: paolomatarazzo
+ms.author: paoloma
+ms.date: 12/08/2022
+ms.topic: include
+---
+
+
+
+---
diff --git a/windows/security/includes/hello-registration-aadj.md b/windows/security/includes/hello-registration-aadj.md
new file mode 100644
index 0000000000..a05d0d55a4
--- /dev/null
+++ b/windows/security/includes/hello-registration-aadj.md
@@ -0,0 +1,8 @@
+---
+author: paolomatarazzo
+ms.author: paoloma
+ms.date: 12/08/2022
+ms.topic: include
+---
+
+[Azure AD join :::image type="icon" source="../images/icons/information.svg" border="false":::](../identity-protection/hello-for-business/hello-how-it-works-technology.md#azure-active-directory-join "Learn more here")
\ No newline at end of file
From 40951ba5df88650dd898d6f63bca619a044f542b Mon Sep 17 00:00:00 2001
From: Paolo Matarazzo <74918781+paolomatarazzo@users.noreply.github.com>
Date: Thu, 8 Dec 2022 17:04:10 -0500
Subject: [PATCH 10/81] updates
---
windows/security/includes/hello-deployment-cloud.md | 2 +-
windows/security/includes/hello-deployment-hybrid.md | 8 ++++++++
windows/security/includes/hello-hybrid-cert-trust-aad.md | 2 +-
windows/security/includes/hello-hybrid-cert-trust-ad.md | 9 +++------
windows/security/includes/hello-hybrid-cert-trust.md | 9 +++------
.../security/includes/hello-hybrid-cloudkerb-trust.md | 9 +++------
windows/security/includes/hello-hybrid-key-trust-ad.md | 9 +++------
windows/security/includes/hello-hybrid-key-trust.md | 9 +++------
.../security/includes/hello-hybrid-keycert-trust-aad.md | 8 +++-----
.../security/includes/hello-on-premises-cert-trust.md | 7 ++-----
windows/security/includes/hello-on-premises-key-trust.md | 7 ++-----
11 files changed, 32 insertions(+), 47 deletions(-)
create mode 100644 windows/security/includes/hello-deployment-hybrid.md
diff --git a/windows/security/includes/hello-deployment-cloud.md b/windows/security/includes/hello-deployment-cloud.md
index 79cde9e0b1..352adf1b84 100644
--- a/windows/security/includes/hello-deployment-cloud.md
+++ b/windows/security/includes/hello-deployment-cloud.md
@@ -5,4 +5,4 @@ ms.date: 12/08/2022
ms.topic: include
---
-[cloud :::image type="icon" source="../images/icons/information.svg" border="false":::](../identity-protection/hello-for-business/hello-how-it-works-technology.md#cloud-deployment)
\ No newline at end of file
+[cloud :::image type="icon" source="../images/icons/information.svg" border="false":::](../identity-protection/hello-for-business/hello-how-it-works-technology.md#cloud-deployment "For organizations using cloud-only identities. Device management is usually done via Intune/MDM")
\ No newline at end of file
diff --git a/windows/security/includes/hello-deployment-hybrid.md b/windows/security/includes/hello-deployment-hybrid.md
new file mode 100644
index 0000000000..b35d4b548e
--- /dev/null
+++ b/windows/security/includes/hello-deployment-hybrid.md
@@ -0,0 +1,8 @@
+---
+author: paolomatarazzo
+ms.author: paoloma
+ms.date: 12/08/2022
+ms.topic: include
+---
+
+[hybrid :::image type="icon" source="../images/icons/information.svg" border="false":::](../identity-protection/hello-for-business/hello-how-it-works-technology.md#hybrid-deployment "For organizations using Active Directory identities synchronized to Azure AD. Device management is usually done via Group Policy or Intune/MDM")
\ No newline at end of file
diff --git a/windows/security/includes/hello-hybrid-cert-trust-aad.md b/windows/security/includes/hello-hybrid-cert-trust-aad.md
index fa4351ad77..fbb447b574 100644
--- a/windows/security/includes/hello-hybrid-cert-trust-aad.md
+++ b/windows/security/includes/hello-hybrid-cert-trust-aad.md
@@ -6,7 +6,7 @@ ms.topic: include
---
[!INCLUDE [hello-intro](hello-intro.md)]
-- **Deployment type:** [hybrid](../identity-protection/hello-for-business/hello-how-it-works-technology.md#hybrid-deployment)
+- **Deployment type:** [!INCLUDE [hello-deployment-hybrid](hello-deployment-hybrid.md)]
- **Trust type:** [certificate trust](../identity-protection/hello-for-business/hello-how-it-works-technology.md#certificate-trust)
- **Device registration type:** [Azure AD join](../identity-protection/hello-for-business/hello-how-it-works-technology.md#azure-active-directory-join)
[!INCLUDE [hello-outro](hello-outro.md)]
\ No newline at end of file
diff --git a/windows/security/includes/hello-hybrid-cert-trust-ad.md b/windows/security/includes/hello-hybrid-cert-trust-ad.md
index 8b5a2a1ad3..aa837b36ea 100644
--- a/windows/security/includes/hello-hybrid-cert-trust-ad.md
+++ b/windows/security/includes/hello-hybrid-cert-trust-ad.md
@@ -5,11 +5,8 @@ ms.date: 12/08/2022
ms.topic: include
---
-This document describes Windows Hello for Business functionalities or scenarios that apply to:
-- **Deployment type:** [hybrid](../identity-protection/hello-for-business/hello-how-it-works-technology.md#hybrid-deployment)
+[!INCLUDE [hello-intro](hello-intro.md)]
+- **Deployment type:** [!INCLUDE [hello-deployment-hybrid](hello-deployment-hybrid.md)]
- **Trust type:** [certificate trust](../identity-protection/hello-for-business/hello-how-it-works-technology.md#certificate-trust)
- **Device registration type:** [Hybrid Azure AD join](../identity-protection/hello-for-business/hello-how-it-works-technology.md#hybrid-azure-ad-join)
-
-
-
----
+[!INCLUDE [hello-outro](hello-outro.md)]
\ No newline at end of file
diff --git a/windows/security/includes/hello-hybrid-cert-trust.md b/windows/security/includes/hello-hybrid-cert-trust.md
index c052d404d0..5581cd7265 100644
--- a/windows/security/includes/hello-hybrid-cert-trust.md
+++ b/windows/security/includes/hello-hybrid-cert-trust.md
@@ -5,11 +5,8 @@ ms.date: 12/08/2022
ms.topic: include
---
-This document describes Windows Hello for Business functionalities or scenarios that apply to:
-- **Deployment type:** [hybrid](../identity-protection/hello-for-business/hello-how-it-works-technology.md#hybrid-deployment)
+[!INCLUDE [hello-intro](hello-intro.md)]
+- **Deployment type:** [!INCLUDE [hello-deployment-hybrid](hello-deployment-hybrid.md)]
- **Trust type:** [certificate trust](../identity-protection/hello-for-business/hello-how-it-works-technology.md#certificate-trust)
- **Device registration type:** [Azure AD join](../identity-protection/hello-for-business/hello-how-it-works-technology.md#azure-active-directory-join), [Hybrid Azure AD join](../identity-protection/hello-for-business/hello-how-it-works-technology.md#hybrid-azure-ad-join)
-
-
-
----
+[!INCLUDE [hello-outro](hello-outro.md)]
\ No newline at end of file
diff --git a/windows/security/includes/hello-hybrid-cloudkerb-trust.md b/windows/security/includes/hello-hybrid-cloudkerb-trust.md
index d91c8f5148..355aecc978 100644
--- a/windows/security/includes/hello-hybrid-cloudkerb-trust.md
+++ b/windows/security/includes/hello-hybrid-cloudkerb-trust.md
@@ -5,11 +5,8 @@ ms.date: 12/08/2022
ms.topic: include
---
-This document describes Windows Hello for Business functionalities or scenarios that apply to:
-- **Deployment type:** [hybrid](../identity-protection/hello-for-business/hello-how-it-works-technology.md#hybrid-deployment)
+[!INCLUDE [hello-intro](hello-intro.md)]
+- **Deployment type:** [!INCLUDE [hello-deployment-hybrid](hello-deployment-hybrid.md)]
- **Trust type:** [cloud Kerberos trust](../identity-protection/hello-for-business/hello-hybrid-cloud-kerberos-trust.md)
- **Device registration type:** [Azure AD join](../identity-protection/hello-for-business/hello-how-it-works-technology.md#azure-active-directory-join), [Hybrid Azure AD join](../identity-protection/hello-for-business/hello-how-it-works-technology.md#hybrid-azure-ad-join)
-
-
-
----
+[!INCLUDE [hello-outro](hello-outro.md)]
\ No newline at end of file
diff --git a/windows/security/includes/hello-hybrid-key-trust-ad.md b/windows/security/includes/hello-hybrid-key-trust-ad.md
index 0bcdd2a570..3b9f6d8215 100644
--- a/windows/security/includes/hello-hybrid-key-trust-ad.md
+++ b/windows/security/includes/hello-hybrid-key-trust-ad.md
@@ -5,11 +5,8 @@ ms.date: 12/08/2022
ms.topic: include
---
-This document describes Windows Hello for Business functionalities or scenarios that apply to:
-- **Deployment type:** [hybrid](../identity-protection/hello-for-business/hello-how-it-works-technology.md#hybrid-deployment)
+[!INCLUDE [hello-intro](hello-intro.md)]
+- **Deployment type:** [!INCLUDE [hello-deployment-hybrid](hello-deployment-hybrid.md)]
- **Trust type:** [key trust](../identity-protection/hello-for-business/hello-how-it-works-technology.md#key-trust)
- **Device registration type:** [Hybrid Azure AD join](../identity-protection/hello-for-business/hello-how-it-works-technology.md#hybrid-azure-ad-join)
-
-
-
----
+[!INCLUDE [hello-outro](hello-outro.md)]
\ No newline at end of file
diff --git a/windows/security/includes/hello-hybrid-key-trust.md b/windows/security/includes/hello-hybrid-key-trust.md
index 49a6329926..2113b03d84 100644
--- a/windows/security/includes/hello-hybrid-key-trust.md
+++ b/windows/security/includes/hello-hybrid-key-trust.md
@@ -5,11 +5,8 @@ ms.date: 12/08/2022
ms.topic: include
---
-This document describes Windows Hello for Business functionalities or scenarios that apply to:
-- **Deployment type:** [hybrid](../identity-protection/hello-for-business/hello-how-it-works-technology.md#hybrid-deployment)
+[!INCLUDE [hello-intro](hello-intro.md)]
+- **Deployment type:** [!INCLUDE [hello-deployment-hybrid](hello-deployment-hybrid.md)]
- **Trust type:** [key trust](../identity-protection/hello-for-business/hello-how-it-works-technology.md#key-trust)
- **Device registration type:** [Azure AD join](../identity-protection/hello-for-business/hello-how-it-works-technology.md#azure-active-directory-join), [Hybrid Azure AD join](../identity-protection/hello-for-business/hello-how-it-works-technology.md#hybrid-azure-ad-join)
-
-
-
----
+[!INCLUDE [hello-outro](hello-outro.md)]
\ No newline at end of file
diff --git a/windows/security/includes/hello-hybrid-keycert-trust-aad.md b/windows/security/includes/hello-hybrid-keycert-trust-aad.md
index df52c11771..163c071b47 100644
--- a/windows/security/includes/hello-hybrid-keycert-trust-aad.md
+++ b/windows/security/includes/hello-hybrid-keycert-trust-aad.md
@@ -5,10 +5,8 @@ ms.date: 12/08/2022
ms.topic: include
---
-This document describes Windows Hello for Business functionalities or scenarios that apply to:
-- **Deployment type:** [hybrid](../identity-protection/hello-for-business/hello-how-it-works-technology.md#hybrid-deployment)
+[!INCLUDE [hello-intro](hello-intro.md)]
+- **Deployment type:** [!INCLUDE [hello-deployment-hybrid](hello-deployment-hybrid.md)]
- **Trust type:** [key trust](../identity-protection/hello-for-business/hello-how-it-works-technology.md#key-trust), [certificate trust](../identity-protection/hello-for-business/hello-how-it-works-technology.md#certificate-trust)
- **Device registration type:** [Azure AD join](../identity-protection/hello-for-business/hello-how-it-works-technology.md#azure-active-directory-join)
-
-
----
+[!INCLUDE [hello-outro](hello-outro.md)]
\ No newline at end of file
diff --git a/windows/security/includes/hello-on-premises-cert-trust.md b/windows/security/includes/hello-on-premises-cert-trust.md
index 6bfbf5f58f..6087d95918 100644
--- a/windows/security/includes/hello-on-premises-cert-trust.md
+++ b/windows/security/includes/hello-on-premises-cert-trust.md
@@ -5,11 +5,8 @@ ms.date: 12/08/2022
ms.topic: include
---
-This document describes Windows Hello for Business functionalities or scenarios that apply to:
+[!INCLUDE [hello-intro](hello-intro.md)]
- **Deployment type:** [on-premises](../identity-protection/hello-for-business/hello-how-it-works-technology.md#on-premises-deployment)
- **Trust type:** [certificate trust](../identity-protection/hello-for-business/hello-how-it-works-technology.md#certificate-trust)
- **Device registration type:** Active Directory domain join
-
-
-
----
+[!INCLUDE [hello-outro](hello-outro.md)]
\ No newline at end of file
diff --git a/windows/security/includes/hello-on-premises-key-trust.md b/windows/security/includes/hello-on-premises-key-trust.md
index b6b279c866..b99e5efa5f 100644
--- a/windows/security/includes/hello-on-premises-key-trust.md
+++ b/windows/security/includes/hello-on-premises-key-trust.md
@@ -5,11 +5,8 @@ ms.date: 12/08/2022
ms.topic: include
---
-This document describes Windows Hello for Business functionalities or scenarios that apply to:
+[!INCLUDE [hello-intro](hello-intro.md)]
- **Deployment type:** [on-premises](../identity-protection/hello-for-business/hello-how-it-works-technology.md#on-premises-deployment)
- **Trust type:** [key trust](../identity-protection/hello-for-business/hello-how-it-works-technology.md#key-trust)
- **Device registration type:** Active Directory domain join
-
-
-
----
+[!INCLUDE [hello-outro](hello-outro.md)]
\ No newline at end of file
From 74021014f773817d21a841f3384350e35cd8d759 Mon Sep 17 00:00:00 2001
From: Paolo Matarazzo <74918781+paolomatarazzo@users.noreply.github.com>
Date: Thu, 8 Dec 2022 17:08:28 -0500
Subject: [PATCH 11/81] updates
---
windows/security/includes/hello-outro.md | 3 +--
1 file changed, 1 insertion(+), 2 deletions(-)
diff --git a/windows/security/includes/hello-outro.md b/windows/security/includes/hello-outro.md
index 12b51c9186..30e19adeb0 100644
--- a/windows/security/includes/hello-outro.md
+++ b/windows/security/includes/hello-outro.md
@@ -6,5 +6,4 @@ ms.topic: include
---
-
----
+---
\ No newline at end of file
From 3b7cbcba029d4987a3428b77f7b3e16a7ff30a74 Mon Sep 17 00:00:00 2001
From: Paolo Matarazzo <74918781+paolomatarazzo@users.noreply.github.com>
Date: Thu, 8 Dec 2022 17:16:20 -0500
Subject: [PATCH 12/81] updates
---
windows/security/includes/hello-outro.md | 1 +
1 file changed, 1 insertion(+)
diff --git a/windows/security/includes/hello-outro.md b/windows/security/includes/hello-outro.md
index 30e19adeb0..fd179664e7 100644
--- a/windows/security/includes/hello-outro.md
+++ b/windows/security/includes/hello-outro.md
@@ -6,4 +6,5 @@ ms.topic: include
---
+
---
\ No newline at end of file
From beabb37cd42ea10dc1873b18a8ad09ad88e49998 Mon Sep 17 00:00:00 2001
From: Paolo Matarazzo <74918781+paolomatarazzo@users.noreply.github.com>
Date: Thu, 8 Dec 2022 17:21:55 -0500
Subject: [PATCH 13/81] updates
---
windows/security/includes/hello-outro.md | 2 --
1 file changed, 2 deletions(-)
diff --git a/windows/security/includes/hello-outro.md b/windows/security/includes/hello-outro.md
index fd179664e7..8279c94503 100644
--- a/windows/security/includes/hello-outro.md
+++ b/windows/security/includes/hello-outro.md
@@ -5,6 +5,4 @@ ms.date: 12/08/2022
ms.topic: include
---
-
-
---
\ No newline at end of file
From 421f41d2a0e322b488ddba2aa1f7ba09b82430a1 Mon Sep 17 00:00:00 2001
From: Paolo Matarazzo <74918781+paolomatarazzo@users.noreply.github.com>
Date: Thu, 8 Dec 2022 17:40:29 -0500
Subject: [PATCH 14/81] updates
---
windows/security/includes/hello-cloud.md | 2 +-
windows/security/includes/hello-deployment-onpremises.md | 8 ++++++++
windows/security/includes/hello-hybrid-cert-trust-aad.md | 4 ++--
windows/security/includes/hello-hybrid-cert-trust-ad.md | 4 ++--
windows/security/includes/hello-hybrid-cert-trust.md | 2 +-
windows/security/includes/hello-hybrid-cloudkerb-trust.md | 2 +-
windows/security/includes/hello-hybrid-key-trust-ad.md | 2 +-
windows/security/includes/hello-hybrid-key-trust.md | 2 +-
.../security/includes/hello-hybrid-keycert-trust-aad.md | 2 +-
windows/security/includes/hello-on-premises-cert-trust.md | 4 ++--
windows/security/includes/hello-on-premises-key-trust.md | 4 ++--
windows/security/includes/hello-outro.md | 8 --------
windows/security/includes/hello-trust-certificate.md | 8 ++++++++
13 files changed, 30 insertions(+), 22 deletions(-)
create mode 100644 windows/security/includes/hello-deployment-onpremises.md
delete mode 100644 windows/security/includes/hello-outro.md
create mode 100644 windows/security/includes/hello-trust-certificate.md
diff --git a/windows/security/includes/hello-cloud.md b/windows/security/includes/hello-cloud.md
index 70d63d9230..a0dfb0fb3e 100644
--- a/windows/security/includes/hello-cloud.md
+++ b/windows/security/includes/hello-cloud.md
@@ -8,4 +8,4 @@ ms.topic: include
[!INCLUDE [hello-intro](hello-intro.md)]
- **Deployment type:** [!INCLUDE [hello-deployment-cloud](hello-deployment-cloud.md)]
- **Device registration type:** [!INCLUDE [hello-registration-aadj](hello-registration-aadj.md)]
-[!INCLUDE [hello-outro](hello-outro.md)]
\ No newline at end of file
+---
\ No newline at end of file
diff --git a/windows/security/includes/hello-deployment-onpremises.md b/windows/security/includes/hello-deployment-onpremises.md
new file mode 100644
index 0000000000..8746a5e9c7
--- /dev/null
+++ b/windows/security/includes/hello-deployment-onpremises.md
@@ -0,0 +1,8 @@
+---
+author: paolomatarazzo
+ms.author: paoloma
+ms.date: 12/08/2022
+ms.topic: include
+---
+
+[on-premises :::image type="icon" source="../images/icons/information.svg" border="false":::](../identity-protection/hello-for-business/hello-how-it-works-technology.md#on-premises-deployment "For organizations using Active Directory identities, not synchronized to Azure AD. Device management is usually done via Group Policy")
\ No newline at end of file
diff --git a/windows/security/includes/hello-hybrid-cert-trust-aad.md b/windows/security/includes/hello-hybrid-cert-trust-aad.md
index fbb447b574..e1ecb19dc4 100644
--- a/windows/security/includes/hello-hybrid-cert-trust-aad.md
+++ b/windows/security/includes/hello-hybrid-cert-trust-aad.md
@@ -7,6 +7,6 @@ ms.topic: include
[!INCLUDE [hello-intro](hello-intro.md)]
- **Deployment type:** [!INCLUDE [hello-deployment-hybrid](hello-deployment-hybrid.md)]
-- **Trust type:** [certificate trust](../identity-protection/hello-for-business/hello-how-it-works-technology.md#certificate-trust)
+- **Trust type:** [!INCLUDE [hello-trust-certificate](hello-trust-certificate.md)]
- **Device registration type:** [Azure AD join](../identity-protection/hello-for-business/hello-how-it-works-technology.md#azure-active-directory-join)
-[!INCLUDE [hello-outro](hello-outro.md)]
\ No newline at end of file
+---
\ No newline at end of file
diff --git a/windows/security/includes/hello-hybrid-cert-trust-ad.md b/windows/security/includes/hello-hybrid-cert-trust-ad.md
index aa837b36ea..6a207c6874 100644
--- a/windows/security/includes/hello-hybrid-cert-trust-ad.md
+++ b/windows/security/includes/hello-hybrid-cert-trust-ad.md
@@ -7,6 +7,6 @@ ms.topic: include
[!INCLUDE [hello-intro](hello-intro.md)]
- **Deployment type:** [!INCLUDE [hello-deployment-hybrid](hello-deployment-hybrid.md)]
-- **Trust type:** [certificate trust](../identity-protection/hello-for-business/hello-how-it-works-technology.md#certificate-trust)
+- **Trust type:** [!INCLUDE [hello-trust-certificate](hello-trust-certificate.md)]
- **Device registration type:** [Hybrid Azure AD join](../identity-protection/hello-for-business/hello-how-it-works-technology.md#hybrid-azure-ad-join)
-[!INCLUDE [hello-outro](hello-outro.md)]
\ No newline at end of file
+---
\ No newline at end of file
diff --git a/windows/security/includes/hello-hybrid-cert-trust.md b/windows/security/includes/hello-hybrid-cert-trust.md
index 5581cd7265..ae7090346f 100644
--- a/windows/security/includes/hello-hybrid-cert-trust.md
+++ b/windows/security/includes/hello-hybrid-cert-trust.md
@@ -9,4 +9,4 @@ ms.topic: include
- **Deployment type:** [!INCLUDE [hello-deployment-hybrid](hello-deployment-hybrid.md)]
- **Trust type:** [certificate trust](../identity-protection/hello-for-business/hello-how-it-works-technology.md#certificate-trust)
- **Device registration type:** [Azure AD join](../identity-protection/hello-for-business/hello-how-it-works-technology.md#azure-active-directory-join), [Hybrid Azure AD join](../identity-protection/hello-for-business/hello-how-it-works-technology.md#hybrid-azure-ad-join)
-[!INCLUDE [hello-outro](hello-outro.md)]
\ No newline at end of file
+---
\ No newline at end of file
diff --git a/windows/security/includes/hello-hybrid-cloudkerb-trust.md b/windows/security/includes/hello-hybrid-cloudkerb-trust.md
index 355aecc978..dc67aa794f 100644
--- a/windows/security/includes/hello-hybrid-cloudkerb-trust.md
+++ b/windows/security/includes/hello-hybrid-cloudkerb-trust.md
@@ -9,4 +9,4 @@ ms.topic: include
- **Deployment type:** [!INCLUDE [hello-deployment-hybrid](hello-deployment-hybrid.md)]
- **Trust type:** [cloud Kerberos trust](../identity-protection/hello-for-business/hello-hybrid-cloud-kerberos-trust.md)
- **Device registration type:** [Azure AD join](../identity-protection/hello-for-business/hello-how-it-works-technology.md#azure-active-directory-join), [Hybrid Azure AD join](../identity-protection/hello-for-business/hello-how-it-works-technology.md#hybrid-azure-ad-join)
-[!INCLUDE [hello-outro](hello-outro.md)]
\ No newline at end of file
+---
\ No newline at end of file
diff --git a/windows/security/includes/hello-hybrid-key-trust-ad.md b/windows/security/includes/hello-hybrid-key-trust-ad.md
index 3b9f6d8215..4f84a118dc 100644
--- a/windows/security/includes/hello-hybrid-key-trust-ad.md
+++ b/windows/security/includes/hello-hybrid-key-trust-ad.md
@@ -9,4 +9,4 @@ ms.topic: include
- **Deployment type:** [!INCLUDE [hello-deployment-hybrid](hello-deployment-hybrid.md)]
- **Trust type:** [key trust](../identity-protection/hello-for-business/hello-how-it-works-technology.md#key-trust)
- **Device registration type:** [Hybrid Azure AD join](../identity-protection/hello-for-business/hello-how-it-works-technology.md#hybrid-azure-ad-join)
-[!INCLUDE [hello-outro](hello-outro.md)]
\ No newline at end of file
+---
\ No newline at end of file
diff --git a/windows/security/includes/hello-hybrid-key-trust.md b/windows/security/includes/hello-hybrid-key-trust.md
index 2113b03d84..5319cbb313 100644
--- a/windows/security/includes/hello-hybrid-key-trust.md
+++ b/windows/security/includes/hello-hybrid-key-trust.md
@@ -9,4 +9,4 @@ ms.topic: include
- **Deployment type:** [!INCLUDE [hello-deployment-hybrid](hello-deployment-hybrid.md)]
- **Trust type:** [key trust](../identity-protection/hello-for-business/hello-how-it-works-technology.md#key-trust)
- **Device registration type:** [Azure AD join](../identity-protection/hello-for-business/hello-how-it-works-technology.md#azure-active-directory-join), [Hybrid Azure AD join](../identity-protection/hello-for-business/hello-how-it-works-technology.md#hybrid-azure-ad-join)
-[!INCLUDE [hello-outro](hello-outro.md)]
\ No newline at end of file
+---
\ No newline at end of file
diff --git a/windows/security/includes/hello-hybrid-keycert-trust-aad.md b/windows/security/includes/hello-hybrid-keycert-trust-aad.md
index 163c071b47..201071e3d7 100644
--- a/windows/security/includes/hello-hybrid-keycert-trust-aad.md
+++ b/windows/security/includes/hello-hybrid-keycert-trust-aad.md
@@ -9,4 +9,4 @@ ms.topic: include
- **Deployment type:** [!INCLUDE [hello-deployment-hybrid](hello-deployment-hybrid.md)]
- **Trust type:** [key trust](../identity-protection/hello-for-business/hello-how-it-works-technology.md#key-trust), [certificate trust](../identity-protection/hello-for-business/hello-how-it-works-technology.md#certificate-trust)
- **Device registration type:** [Azure AD join](../identity-protection/hello-for-business/hello-how-it-works-technology.md#azure-active-directory-join)
-[!INCLUDE [hello-outro](hello-outro.md)]
\ No newline at end of file
+---
\ No newline at end of file
diff --git a/windows/security/includes/hello-on-premises-cert-trust.md b/windows/security/includes/hello-on-premises-cert-trust.md
index 6087d95918..84f2bd6c15 100644
--- a/windows/security/includes/hello-on-premises-cert-trust.md
+++ b/windows/security/includes/hello-on-premises-cert-trust.md
@@ -6,7 +6,7 @@ ms.topic: include
---
[!INCLUDE [hello-intro](hello-intro.md)]
-- **Deployment type:** [on-premises](../identity-protection/hello-for-business/hello-how-it-works-technology.md#on-premises-deployment)
+- **Deployment type:** [!INCLUDE [hello-deployment-onpremises](hello-deployment-onpremises.md)]
- **Trust type:** [certificate trust](../identity-protection/hello-for-business/hello-how-it-works-technology.md#certificate-trust)
- **Device registration type:** Active Directory domain join
-[!INCLUDE [hello-outro](hello-outro.md)]
\ No newline at end of file
+---
\ No newline at end of file
diff --git a/windows/security/includes/hello-on-premises-key-trust.md b/windows/security/includes/hello-on-premises-key-trust.md
index b99e5efa5f..9990eed8b9 100644
--- a/windows/security/includes/hello-on-premises-key-trust.md
+++ b/windows/security/includes/hello-on-premises-key-trust.md
@@ -6,7 +6,7 @@ ms.topic: include
---
[!INCLUDE [hello-intro](hello-intro.md)]
-- **Deployment type:** [on-premises](../identity-protection/hello-for-business/hello-how-it-works-technology.md#on-premises-deployment)
+- **Deployment type:** [!INCLUDE [hello-deployment-onpremises](hello-deployment-onpremises.md)]
- **Trust type:** [key trust](../identity-protection/hello-for-business/hello-how-it-works-technology.md#key-trust)
- **Device registration type:** Active Directory domain join
-[!INCLUDE [hello-outro](hello-outro.md)]
\ No newline at end of file
+---
\ No newline at end of file
diff --git a/windows/security/includes/hello-outro.md b/windows/security/includes/hello-outro.md
deleted file mode 100644
index 8279c94503..0000000000
--- a/windows/security/includes/hello-outro.md
+++ /dev/null
@@ -1,8 +0,0 @@
----
-author: paolomatarazzo
-ms.author: paoloma
-ms.date: 12/08/2022
-ms.topic: include
----
-
----
\ No newline at end of file
diff --git a/windows/security/includes/hello-trust-certificate.md b/windows/security/includes/hello-trust-certificate.md
new file mode 100644
index 0000000000..d3735aa9aa
--- /dev/null
+++ b/windows/security/includes/hello-trust-certificate.md
@@ -0,0 +1,8 @@
+---
+author: paolomatarazzo
+ms.author: paoloma
+ms.date: 12/08/2022
+ms.topic: include
+---
+
+[certificate trust :::image type="icon" source="../images/icons/information.svg" border="false":::](../identity-protection/hello-for-business/hello-how-it-works-technology.md#certificate-trust "This trust type uses a user certificate to authenticate to Active Directory")
\ No newline at end of file
From 4a1cd06dbc7801602df0d60d39418b7e5fb02d71 Mon Sep 17 00:00:00 2001
From: Paolo Matarazzo <74918781+paolomatarazzo@users.noreply.github.com>
Date: Thu, 8 Dec 2022 17:55:56 -0500
Subject: [PATCH 15/81] updates
---
windows/security/includes/hello-hybrid-cert-trust.md | 2 +-
windows/security/includes/hello-hybrid-keycert-trust-aad.md | 2 +-
windows/security/includes/hello-on-premises-cert-trust.md | 2 +-
windows/security/includes/hello-trust-certificate.md | 2 +-
4 files changed, 4 insertions(+), 4 deletions(-)
diff --git a/windows/security/includes/hello-hybrid-cert-trust.md b/windows/security/includes/hello-hybrid-cert-trust.md
index ae7090346f..2fdd3bda52 100644
--- a/windows/security/includes/hello-hybrid-cert-trust.md
+++ b/windows/security/includes/hello-hybrid-cert-trust.md
@@ -7,6 +7,6 @@ ms.topic: include
[!INCLUDE [hello-intro](hello-intro.md)]
- **Deployment type:** [!INCLUDE [hello-deployment-hybrid](hello-deployment-hybrid.md)]
-- **Trust type:** [certificate trust](../identity-protection/hello-for-business/hello-how-it-works-technology.md#certificate-trust)
+- **Trust type:** [!INCLUDE [hello-trust-certificate](hello-trust-certificate.md)]
- **Device registration type:** [Azure AD join](../identity-protection/hello-for-business/hello-how-it-works-technology.md#azure-active-directory-join), [Hybrid Azure AD join](../identity-protection/hello-for-business/hello-how-it-works-technology.md#hybrid-azure-ad-join)
---
\ No newline at end of file
diff --git a/windows/security/includes/hello-hybrid-keycert-trust-aad.md b/windows/security/includes/hello-hybrid-keycert-trust-aad.md
index 201071e3d7..dfc0d12624 100644
--- a/windows/security/includes/hello-hybrid-keycert-trust-aad.md
+++ b/windows/security/includes/hello-hybrid-keycert-trust-aad.md
@@ -7,6 +7,6 @@ ms.topic: include
[!INCLUDE [hello-intro](hello-intro.md)]
- **Deployment type:** [!INCLUDE [hello-deployment-hybrid](hello-deployment-hybrid.md)]
-- **Trust type:** [key trust](../identity-protection/hello-for-business/hello-how-it-works-technology.md#key-trust), [certificate trust](../identity-protection/hello-for-business/hello-how-it-works-technology.md#certificate-trust)
+- **Trust type:** [key trust](../identity-protection/hello-for-business/hello-how-it-works-technology.md#key-trust), [!INCLUDE [hello-trust-certificate](hello-trust-certificate.md)]
- **Device registration type:** [Azure AD join](../identity-protection/hello-for-business/hello-how-it-works-technology.md#azure-active-directory-join)
---
\ No newline at end of file
diff --git a/windows/security/includes/hello-on-premises-cert-trust.md b/windows/security/includes/hello-on-premises-cert-trust.md
index 84f2bd6c15..ab18370114 100644
--- a/windows/security/includes/hello-on-premises-cert-trust.md
+++ b/windows/security/includes/hello-on-premises-cert-trust.md
@@ -7,6 +7,6 @@ ms.topic: include
[!INCLUDE [hello-intro](hello-intro.md)]
- **Deployment type:** [!INCLUDE [hello-deployment-onpremises](hello-deployment-onpremises.md)]
-- **Trust type:** [certificate trust](../identity-protection/hello-for-business/hello-how-it-works-technology.md#certificate-trust)
+- **Trust type:** [!INCLUDE [hello-trust-certificate](hello-trust-certificate.md)]
- **Device registration type:** Active Directory domain join
---
\ No newline at end of file
diff --git a/windows/security/includes/hello-trust-certificate.md b/windows/security/includes/hello-trust-certificate.md
index d3735aa9aa..82dfd5e203 100644
--- a/windows/security/includes/hello-trust-certificate.md
+++ b/windows/security/includes/hello-trust-certificate.md
@@ -5,4 +5,4 @@ ms.date: 12/08/2022
ms.topic: include
---
-[certificate trust :::image type="icon" source="../images/icons/information.svg" border="false":::](../identity-protection/hello-for-business/hello-how-it-works-technology.md#certificate-trust "This trust type uses a user certificate to authenticate to Active Directory")
\ No newline at end of file
+[certificate trust :::image type="icon" source="../images/icons/information.svg" border="false":::](../identity-protection/hello-for-business/hello-how-it-works-technology.md#certificate-trust "This trust type uses a certificate to authenticate the user to Active Directory")
\ No newline at end of file
From 4107e0d024bac744b043c1988f8fee2491db969b Mon Sep 17 00:00:00 2001
From: Sarah Barrett
Date: Thu, 8 Dec 2022 15:48:52 -0800
Subject: [PATCH 16/81] Turn off extendBreadcrumbs
---
browsers/edge/docfx.json | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/browsers/edge/docfx.json b/browsers/edge/docfx.json
index d786e0bbfb..d36533a87e 100644
--- a/browsers/edge/docfx.json
+++ b/browsers/edge/docfx.json
@@ -28,7 +28,7 @@
],
"globalMetadata": {
"recommendations": true,
- "breadcrumb_path": "/microsoft-edge/deploy/breadcrumb/toc.json",
+ "breadcrumb_path": "/microsoft-edge/breadcrumbs/toc.json",
"ROBOTS": "INDEX, FOLLOW",
"ms.technology": "microsoft-edge",
"audience": "ITPro",
From 929a0c56335be262a1565024000d86ee5a0c5c43 Mon Sep 17 00:00:00 2001
From: Sarah Barrett
Date: Thu, 8 Dec 2022 15:52:12 -0800
Subject: [PATCH 17/81] Update breadcrumb
---
browsers/edge/breadcrumb/toc.yml | 10 +++-------
1 file changed, 3 insertions(+), 7 deletions(-)
diff --git a/browsers/edge/breadcrumb/toc.yml b/browsers/edge/breadcrumb/toc.yml
index f417737985..83065b36a9 100644
--- a/browsers/edge/breadcrumb/toc.yml
+++ b/browsers/edge/breadcrumb/toc.yml
@@ -1,7 +1,3 @@
-- name: Docs
- tocHref: /
- topicHref: /
- items:
- - name: Microsoft Edge deployment
- tocHref: /microsoft-edge/deploy
- topicHref: /microsoft-edge/deploy/index
\ No newline at end of file
+- name: Microsoft Edge
+ tocHref: /microsoft-edge/
+ topicHref: /microsoft-edge/index
From 4d98e8be802c6c8ccbefea400664c409fcd35cc5 Mon Sep 17 00:00:00 2001
From: Paolo Matarazzo <74918781+paolomatarazzo@users.noreply.github.com>
Date: Fri, 9 Dec 2022 11:50:50 -0500
Subject: [PATCH 18/81] updates
---
windows/security/includes/hello-join-aadj.md | 8 ++++++++
windows/security/includes/hello-join-domain.md | 8 ++++++++
2 files changed, 16 insertions(+)
create mode 100644 windows/security/includes/hello-join-aadj.md
create mode 100644 windows/security/includes/hello-join-domain.md
diff --git a/windows/security/includes/hello-join-aadj.md b/windows/security/includes/hello-join-aadj.md
new file mode 100644
index 0000000000..5709970576
--- /dev/null
+++ b/windows/security/includes/hello-join-aadj.md
@@ -0,0 +1,8 @@
+---
+author: paolomatarazzo
+ms.author: paoloma
+ms.date: 12/08/2022
+ms.topic: include
+---
+
+[Azure AD join :::image type="icon" source="../images/icons/information.svg" border="false":::](../identity-protection/hello-for-business/hello-how-it-works-technology.md#azure-active-directory-join "Devices that are Azure AD joined do not have any dependencies on Active Directory. Only local users accounts and Azure AD users can sign in to these devices")
\ No newline at end of file
diff --git a/windows/security/includes/hello-join-domain.md b/windows/security/includes/hello-join-domain.md
new file mode 100644
index 0000000000..56f0037453
--- /dev/null
+++ b/windows/security/includes/hello-join-domain.md
@@ -0,0 +1,8 @@
+---
+author: paolomatarazzo
+ms.author: paoloma
+ms.date: 12/08/2022
+ms.topic: include
+---
+
+[Domain join :::image type="icon" source="../images/icons/information.svg" border="false":::](../identity-protection/hello-for-business/hello-how-it-works-technology.md "Devices that are domain joined do not have any dependencies on Azure AD. Only local users accounts and Active Directory users can sign in to these devices")
\ No newline at end of file
From 874870428f56e04ede580233b9ca5a2effa07e28 Mon Sep 17 00:00:00 2001
From: Paolo Matarazzo <74918781+paolomatarazzo@users.noreply.github.com>
Date: Fri, 9 Dec 2022 11:51:03 -0500
Subject: [PATCH 19/81] updates
---
.../hello-for-business/retired/hello-how-it-works.md | 3 +--
windows/security/includes/hello-cloud.md | 2 +-
windows/security/includes/hello-deployment-cloud.md | 2 +-
windows/security/includes/hello-hybrid-cert-trust-aad.md | 2 +-
windows/security/includes/hello-hybrid-cert-trust-ad.md | 4 ++--
windows/security/includes/hello-hybrid-cert-trust.md | 2 +-
windows/security/includes/hello-hybrid-cloudkerb-trust.md | 4 ++--
windows/security/includes/hello-hybrid-key-trust-ad.md | 4 ++--
windows/security/includes/hello-hybrid-key-trust.md | 4 ++--
.../security/includes/hello-hybrid-keycert-trust-aad.md | 4 ++--
windows/security/includes/hello-join-hybrid.md | 8 ++++++++
windows/security/includes/hello-on-premises-cert-trust.md | 2 +-
windows/security/includes/hello-on-premises-key-trust.md | 2 +-
windows/security/includes/hello-registration-aadj.md | 8 --------
windows/security/includes/hello-trust-certificate.md | 2 +-
windows/security/includes/hello-trust-cloud-kerberos.md | 8 ++++++++
windows/security/includes/hello-trust-key.md | 8 ++++++++
17 files changed, 42 insertions(+), 27 deletions(-)
create mode 100644 windows/security/includes/hello-join-hybrid.md
delete mode 100644 windows/security/includes/hello-registration-aadj.md
create mode 100644 windows/security/includes/hello-trust-cloud-kerberos.md
create mode 100644 windows/security/includes/hello-trust-key.md
diff --git a/windows/security/identity-protection/hello-for-business/retired/hello-how-it-works.md b/windows/security/identity-protection/hello-for-business/retired/hello-how-it-works.md
index 5aa1fcad6a..1987c05d33 100644
--- a/windows/security/identity-protection/hello-for-business/retired/hello-how-it-works.md
+++ b/windows/security/identity-protection/hello-for-business/retired/hello-how-it-works.md
@@ -3,8 +3,7 @@ title: How Windows Hello for Business works (Windows)
description: Learn about registration, authentication, key material, and infrastructure for Windows Hello for Business.
ms.date: 10/16/2017
appliesto:
- - ✅ Windows 10
- - ✅ Windows 11
+- ✅ Windows 10 and later
ms.topic: article
---
# How Windows Hello for Business works in Windows devices
diff --git a/windows/security/includes/hello-cloud.md b/windows/security/includes/hello-cloud.md
index a0dfb0fb3e..e1f813e099 100644
--- a/windows/security/includes/hello-cloud.md
+++ b/windows/security/includes/hello-cloud.md
@@ -7,5 +7,5 @@ ms.topic: include
[!INCLUDE [hello-intro](hello-intro.md)]
- **Deployment type:** [!INCLUDE [hello-deployment-cloud](hello-deployment-cloud.md)]
-- **Device registration type:** [!INCLUDE [hello-registration-aadj](hello-registration-aadj.md)]
+- **Join type:** [!INCLUDE [hello-registration-aadj](hello-registration-aadj.md)]
---
\ No newline at end of file
diff --git a/windows/security/includes/hello-deployment-cloud.md b/windows/security/includes/hello-deployment-cloud.md
index 352adf1b84..8152da9722 100644
--- a/windows/security/includes/hello-deployment-cloud.md
+++ b/windows/security/includes/hello-deployment-cloud.md
@@ -5,4 +5,4 @@ ms.date: 12/08/2022
ms.topic: include
---
-[cloud :::image type="icon" source="../images/icons/information.svg" border="false":::](../identity-protection/hello-for-business/hello-how-it-works-technology.md#cloud-deployment "For organizations using cloud-only identities. Device management is usually done via Intune/MDM")
\ No newline at end of file
+[cloud :::image type="icon" source="../images/icons/information.svg" border="false":::](../identity-protection/hello-for-business/hello-how-it-works-technology.md#cloud-deployment "For organizations using Azure AD-only identities. Device management is usually done via Intune/MDM")
\ No newline at end of file
diff --git a/windows/security/includes/hello-hybrid-cert-trust-aad.md b/windows/security/includes/hello-hybrid-cert-trust-aad.md
index e1ecb19dc4..475eef648c 100644
--- a/windows/security/includes/hello-hybrid-cert-trust-aad.md
+++ b/windows/security/includes/hello-hybrid-cert-trust-aad.md
@@ -8,5 +8,5 @@ ms.topic: include
[!INCLUDE [hello-intro](hello-intro.md)]
- **Deployment type:** [!INCLUDE [hello-deployment-hybrid](hello-deployment-hybrid.md)]
- **Trust type:** [!INCLUDE [hello-trust-certificate](hello-trust-certificate.md)]
-- **Device registration type:** [Azure AD join](../identity-protection/hello-for-business/hello-how-it-works-technology.md#azure-active-directory-join)
+- **Join type:** [!INCLUDE [hello-join-aadj](hello-join-aadj.md)]
---
\ No newline at end of file
diff --git a/windows/security/includes/hello-hybrid-cert-trust-ad.md b/windows/security/includes/hello-hybrid-cert-trust-ad.md
index 6a207c6874..4691d86bc0 100644
--- a/windows/security/includes/hello-hybrid-cert-trust-ad.md
+++ b/windows/security/includes/hello-hybrid-cert-trust-ad.md
@@ -7,6 +7,6 @@ ms.topic: include
[!INCLUDE [hello-intro](hello-intro.md)]
- **Deployment type:** [!INCLUDE [hello-deployment-hybrid](hello-deployment-hybrid.md)]
-- **Trust type:** [!INCLUDE [hello-trust-certificate](hello-trust-certificate.md)]
-- **Device registration type:** [Hybrid Azure AD join](../identity-protection/hello-for-business/hello-how-it-works-technology.md#hybrid-azure-ad-join)
+- **Trust type:** [!INCLUDE [hello-trust-cloud-kerberos](hello-trust-cloud-kerberos.md)]
+- **Join type:** [!INCLUDE [hello-join-hybrid](hello-join-hybrid.md)]
---
\ No newline at end of file
diff --git a/windows/security/includes/hello-hybrid-cert-trust.md b/windows/security/includes/hello-hybrid-cert-trust.md
index 2fdd3bda52..8257bb90b0 100644
--- a/windows/security/includes/hello-hybrid-cert-trust.md
+++ b/windows/security/includes/hello-hybrid-cert-trust.md
@@ -8,5 +8,5 @@ ms.topic: include
[!INCLUDE [hello-intro](hello-intro.md)]
- **Deployment type:** [!INCLUDE [hello-deployment-hybrid](hello-deployment-hybrid.md)]
- **Trust type:** [!INCLUDE [hello-trust-certificate](hello-trust-certificate.md)]
-- **Device registration type:** [Azure AD join](../identity-protection/hello-for-business/hello-how-it-works-technology.md#azure-active-directory-join), [Hybrid Azure AD join](../identity-protection/hello-for-business/hello-how-it-works-technology.md#hybrid-azure-ad-join)
+- **Join type:** [!INCLUDE [hello-join-aadj](hello-join-aadj.md)], [!INCLUDE [hello-join-hybrid](hello-join-hybrid.md)]
---
\ No newline at end of file
diff --git a/windows/security/includes/hello-hybrid-cloudkerb-trust.md b/windows/security/includes/hello-hybrid-cloudkerb-trust.md
index dc67aa794f..c18d03021c 100644
--- a/windows/security/includes/hello-hybrid-cloudkerb-trust.md
+++ b/windows/security/includes/hello-hybrid-cloudkerb-trust.md
@@ -7,6 +7,6 @@ ms.topic: include
[!INCLUDE [hello-intro](hello-intro.md)]
- **Deployment type:** [!INCLUDE [hello-deployment-hybrid](hello-deployment-hybrid.md)]
-- **Trust type:** [cloud Kerberos trust](../identity-protection/hello-for-business/hello-hybrid-cloud-kerberos-trust.md)
-- **Device registration type:** [Azure AD join](../identity-protection/hello-for-business/hello-how-it-works-technology.md#azure-active-directory-join), [Hybrid Azure AD join](../identity-protection/hello-for-business/hello-how-it-works-technology.md#hybrid-azure-ad-join)
+- **Trust type:** [!INCLUDE [hello-trust-cloud-kerberos](hello-trust-cloud-kerberos.md)]
+- **Join type:** [!INCLUDE [hello-join-aadj](hello-join-aadj.md)], [!INCLUDE [hello-join-hybrid](hello-join-hybrid.md)]
---
\ No newline at end of file
diff --git a/windows/security/includes/hello-hybrid-key-trust-ad.md b/windows/security/includes/hello-hybrid-key-trust-ad.md
index 4f84a118dc..a5074f5bd4 100644
--- a/windows/security/includes/hello-hybrid-key-trust-ad.md
+++ b/windows/security/includes/hello-hybrid-key-trust-ad.md
@@ -7,6 +7,6 @@ ms.topic: include
[!INCLUDE [hello-intro](hello-intro.md)]
- **Deployment type:** [!INCLUDE [hello-deployment-hybrid](hello-deployment-hybrid.md)]
-- **Trust type:** [key trust](../identity-protection/hello-for-business/hello-how-it-works-technology.md#key-trust)
-- **Device registration type:** [Hybrid Azure AD join](../identity-protection/hello-for-business/hello-how-it-works-technology.md#hybrid-azure-ad-join)
+- **Trust type:** [!INCLUDE [hello-trust-key](hello-trust-key.md)]
+- **Join type:** [!INCLUDE [hello-join-hybrid](hello-join-hybrid.md)]
---
\ No newline at end of file
diff --git a/windows/security/includes/hello-hybrid-key-trust.md b/windows/security/includes/hello-hybrid-key-trust.md
index 5319cbb313..6f655a6c2b 100644
--- a/windows/security/includes/hello-hybrid-key-trust.md
+++ b/windows/security/includes/hello-hybrid-key-trust.md
@@ -7,6 +7,6 @@ ms.topic: include
[!INCLUDE [hello-intro](hello-intro.md)]
- **Deployment type:** [!INCLUDE [hello-deployment-hybrid](hello-deployment-hybrid.md)]
-- **Trust type:** [key trust](../identity-protection/hello-for-business/hello-how-it-works-technology.md#key-trust)
-- **Device registration type:** [Azure AD join](../identity-protection/hello-for-business/hello-how-it-works-technology.md#azure-active-directory-join), [Hybrid Azure AD join](../identity-protection/hello-for-business/hello-how-it-works-technology.md#hybrid-azure-ad-join)
+- **Trust type:** [!INCLUDE [hello-trust-key](hello-trust-key.md)]
+- **Join type:** [!INCLUDE [hello-join-aadj](hello-join-aadj.md)], [!INCLUDE [hello-join-hybrid](hello-join-hybrid.md)]
---
\ No newline at end of file
diff --git a/windows/security/includes/hello-hybrid-keycert-trust-aad.md b/windows/security/includes/hello-hybrid-keycert-trust-aad.md
index dfc0d12624..664db48668 100644
--- a/windows/security/includes/hello-hybrid-keycert-trust-aad.md
+++ b/windows/security/includes/hello-hybrid-keycert-trust-aad.md
@@ -7,6 +7,6 @@ ms.topic: include
[!INCLUDE [hello-intro](hello-intro.md)]
- **Deployment type:** [!INCLUDE [hello-deployment-hybrid](hello-deployment-hybrid.md)]
-- **Trust type:** [key trust](../identity-protection/hello-for-business/hello-how-it-works-technology.md#key-trust), [!INCLUDE [hello-trust-certificate](hello-trust-certificate.md)]
-- **Device registration type:** [Azure AD join](../identity-protection/hello-for-business/hello-how-it-works-technology.md#azure-active-directory-join)
+- **Trust type:** - **Trust type:** [!INCLUDE [hello-trust-key](hello-trust-key.md)], [!INCLUDE [hello-trust-certificate](hello-trust-certificate.md)]
+- **Join type:** [!INCLUDE [hello-join-aadj](hello-join-aadj.md)]
---
\ No newline at end of file
diff --git a/windows/security/includes/hello-join-hybrid.md b/windows/security/includes/hello-join-hybrid.md
new file mode 100644
index 0000000000..550c6ee26d
--- /dev/null
+++ b/windows/security/includes/hello-join-hybrid.md
@@ -0,0 +1,8 @@
+---
+author: paolomatarazzo
+ms.author: paoloma
+ms.date: 12/08/2022
+ms.topic: include
+---
+
+[Hybrid Azure AD join :::image type="icon" source="../images/icons/information.svg" border="false":::](../identity-protection/hello-for-business/hello-how-it-works-technology.md#hybrid-azure-ad-join "Devices that are hybrid Azure AD joined do not have any dependencies on Azure AD. Only local users accounts and Active Directory users can sign in to these devices. If an Active Directory user is synchronized to Azure AD, she can can have single-sign on to both Active Directory and Azure AD-protected resources")
\ No newline at end of file
diff --git a/windows/security/includes/hello-on-premises-cert-trust.md b/windows/security/includes/hello-on-premises-cert-trust.md
index ab18370114..b106b5b8c8 100644
--- a/windows/security/includes/hello-on-premises-cert-trust.md
+++ b/windows/security/includes/hello-on-premises-cert-trust.md
@@ -8,5 +8,5 @@ ms.topic: include
[!INCLUDE [hello-intro](hello-intro.md)]
- **Deployment type:** [!INCLUDE [hello-deployment-onpremises](hello-deployment-onpremises.md)]
- **Trust type:** [!INCLUDE [hello-trust-certificate](hello-trust-certificate.md)]
-- **Device registration type:** Active Directory domain join
+- **Join type:** [!INCLUDE [hello-join-domain](hello-join-domain.md)]
---
\ No newline at end of file
diff --git a/windows/security/includes/hello-on-premises-key-trust.md b/windows/security/includes/hello-on-premises-key-trust.md
index 9990eed8b9..2a31c533c2 100644
--- a/windows/security/includes/hello-on-premises-key-trust.md
+++ b/windows/security/includes/hello-on-premises-key-trust.md
@@ -8,5 +8,5 @@ ms.topic: include
[!INCLUDE [hello-intro](hello-intro.md)]
- **Deployment type:** [!INCLUDE [hello-deployment-onpremises](hello-deployment-onpremises.md)]
- **Trust type:** [key trust](../identity-protection/hello-for-business/hello-how-it-works-technology.md#key-trust)
-- **Device registration type:** Active Directory domain join
+- **Join type:** [!INCLUDE [hello-join-domain](hello-join-domain.md)]
---
\ No newline at end of file
diff --git a/windows/security/includes/hello-registration-aadj.md b/windows/security/includes/hello-registration-aadj.md
deleted file mode 100644
index a05d0d55a4..0000000000
--- a/windows/security/includes/hello-registration-aadj.md
+++ /dev/null
@@ -1,8 +0,0 @@
----
-author: paolomatarazzo
-ms.author: paoloma
-ms.date: 12/08/2022
-ms.topic: include
----
-
-[Azure AD join :::image type="icon" source="../images/icons/information.svg" border="false":::](../identity-protection/hello-for-business/hello-how-it-works-technology.md#azure-active-directory-join "Learn more here")
\ No newline at end of file
diff --git a/windows/security/includes/hello-trust-certificate.md b/windows/security/includes/hello-trust-certificate.md
index 82dfd5e203..ffc705fde0 100644
--- a/windows/security/includes/hello-trust-certificate.md
+++ b/windows/security/includes/hello-trust-certificate.md
@@ -5,4 +5,4 @@ ms.date: 12/08/2022
ms.topic: include
---
-[certificate trust :::image type="icon" source="../images/icons/information.svg" border="false":::](../identity-protection/hello-for-business/hello-how-it-works-technology.md#certificate-trust "This trust type uses a certificate to authenticate the user to Active Directory")
\ No newline at end of file
+[certificate trust :::image type="icon" source="../images/icons/information.svg" border="false":::](../identity-protection/hello-for-business/hello-how-it-works-technology.md#certificate-trust "This trust type uses a certificate to authenticate the users to Active Directory. It's required to issue certificates to the users and to the domain controllers")
\ No newline at end of file
diff --git a/windows/security/includes/hello-trust-cloud-kerberos.md b/windows/security/includes/hello-trust-cloud-kerberos.md
new file mode 100644
index 0000000000..76dfb6c4a1
--- /dev/null
+++ b/windows/security/includes/hello-trust-cloud-kerberos.md
@@ -0,0 +1,8 @@
+---
+author: paolomatarazzo
+ms.author: paoloma
+ms.date: 12/08/2022
+ms.topic: include
+---
+
+[cloud Kerberos trust :::image type="icon" source="../images/icons/information.svg" border="false":::](../identity-protection/hello-for-business/hello-how-it-works-technology.md#cloud-kerberos-trust "This trust type uses security keys to authenticate the users to Active Directory. It's not required to issue any certificates, making it the recommended choice for environments that do not need certificate authentication.")
\ No newline at end of file
diff --git a/windows/security/includes/hello-trust-key.md b/windows/security/includes/hello-trust-key.md
new file mode 100644
index 0000000000..133f7f5204
--- /dev/null
+++ b/windows/security/includes/hello-trust-key.md
@@ -0,0 +1,8 @@
+---
+author: paolomatarazzo
+ms.author: paoloma
+ms.date: 12/08/2022
+ms.topic: include
+---
+
+[key trust :::image type="icon" source="../images/icons/information.svg" border="false":::](../identity-protection/hello-for-business/hello-how-it-works-technology.md#key-trust "This trust type uses a raw key to authenticate the users to Active Directory. It's not required to issue certificates to users, but it's required to deploy certificates to domain controllers")
\ No newline at end of file
From 7e19753acc05d5d84ecb54beb2d43b56a7282371 Mon Sep 17 00:00:00 2001
From: Paolo Matarazzo <74918781+paolomatarazzo@users.noreply.github.com>
Date: Fri, 9 Dec 2022 15:25:21 -0500
Subject: [PATCH 20/81] updates
---
windows/security/includes/hello-cloud.md | 2 +-
windows/security/includes/hello-hybrid-cert-trust-aad.md | 2 +-
windows/security/includes/hello-hybrid-cert-trust.md | 2 +-
windows/security/includes/hello-hybrid-cloudkerb-trust.md | 2 +-
windows/security/includes/hello-hybrid-key-trust.md | 2 +-
windows/security/includes/hello-hybrid-keycert-trust-aad.md | 2 +-
.../security/includes/{hello-join-aadj.md => hello-join-aad.md} | 0
windows/security/includes/hello-join-hybrid.md | 2 +-
8 files changed, 7 insertions(+), 7 deletions(-)
rename windows/security/includes/{hello-join-aadj.md => hello-join-aad.md} (100%)
diff --git a/windows/security/includes/hello-cloud.md b/windows/security/includes/hello-cloud.md
index e1f813e099..d7e1053eea 100644
--- a/windows/security/includes/hello-cloud.md
+++ b/windows/security/includes/hello-cloud.md
@@ -7,5 +7,5 @@ ms.topic: include
[!INCLUDE [hello-intro](hello-intro.md)]
- **Deployment type:** [!INCLUDE [hello-deployment-cloud](hello-deployment-cloud.md)]
-- **Join type:** [!INCLUDE [hello-registration-aadj](hello-registration-aadj.md)]
+- **Join type:** [!INCLUDE [hello-join-aad](hello-registration-aadj.md)]
---
\ No newline at end of file
diff --git a/windows/security/includes/hello-hybrid-cert-trust-aad.md b/windows/security/includes/hello-hybrid-cert-trust-aad.md
index 475eef648c..57c03e95a3 100644
--- a/windows/security/includes/hello-hybrid-cert-trust-aad.md
+++ b/windows/security/includes/hello-hybrid-cert-trust-aad.md
@@ -8,5 +8,5 @@ ms.topic: include
[!INCLUDE [hello-intro](hello-intro.md)]
- **Deployment type:** [!INCLUDE [hello-deployment-hybrid](hello-deployment-hybrid.md)]
- **Trust type:** [!INCLUDE [hello-trust-certificate](hello-trust-certificate.md)]
-- **Join type:** [!INCLUDE [hello-join-aadj](hello-join-aadj.md)]
+- **Join type:** [!INCLUDE [hello-join-aadj](hello-join-aad.md)]
---
\ No newline at end of file
diff --git a/windows/security/includes/hello-hybrid-cert-trust.md b/windows/security/includes/hello-hybrid-cert-trust.md
index 8257bb90b0..d6ca6e8f5d 100644
--- a/windows/security/includes/hello-hybrid-cert-trust.md
+++ b/windows/security/includes/hello-hybrid-cert-trust.md
@@ -8,5 +8,5 @@ ms.topic: include
[!INCLUDE [hello-intro](hello-intro.md)]
- **Deployment type:** [!INCLUDE [hello-deployment-hybrid](hello-deployment-hybrid.md)]
- **Trust type:** [!INCLUDE [hello-trust-certificate](hello-trust-certificate.md)]
-- **Join type:** [!INCLUDE [hello-join-aadj](hello-join-aadj.md)], [!INCLUDE [hello-join-hybrid](hello-join-hybrid.md)]
+- **Join type:** [!INCLUDE [hello-join-aadj](hello-join-aad.md)], [!INCLUDE [hello-join-hybrid](hello-join-hybrid.md)]
---
\ No newline at end of file
diff --git a/windows/security/includes/hello-hybrid-cloudkerb-trust.md b/windows/security/includes/hello-hybrid-cloudkerb-trust.md
index c18d03021c..61346cd80e 100644
--- a/windows/security/includes/hello-hybrid-cloudkerb-trust.md
+++ b/windows/security/includes/hello-hybrid-cloudkerb-trust.md
@@ -8,5 +8,5 @@ ms.topic: include
[!INCLUDE [hello-intro](hello-intro.md)]
- **Deployment type:** [!INCLUDE [hello-deployment-hybrid](hello-deployment-hybrid.md)]
- **Trust type:** [!INCLUDE [hello-trust-cloud-kerberos](hello-trust-cloud-kerberos.md)]
-- **Join type:** [!INCLUDE [hello-join-aadj](hello-join-aadj.md)], [!INCLUDE [hello-join-hybrid](hello-join-hybrid.md)]
+- **Join type:** [!INCLUDE [hello-join-aadj](hello-join-aad.md)], [!INCLUDE [hello-join-hybrid](hello-join-hybrid.md)]
---
\ No newline at end of file
diff --git a/windows/security/includes/hello-hybrid-key-trust.md b/windows/security/includes/hello-hybrid-key-trust.md
index 6f655a6c2b..d9feebc213 100644
--- a/windows/security/includes/hello-hybrid-key-trust.md
+++ b/windows/security/includes/hello-hybrid-key-trust.md
@@ -8,5 +8,5 @@ ms.topic: include
[!INCLUDE [hello-intro](hello-intro.md)]
- **Deployment type:** [!INCLUDE [hello-deployment-hybrid](hello-deployment-hybrid.md)]
- **Trust type:** [!INCLUDE [hello-trust-key](hello-trust-key.md)]
-- **Join type:** [!INCLUDE [hello-join-aadj](hello-join-aadj.md)], [!INCLUDE [hello-join-hybrid](hello-join-hybrid.md)]
+- **Join type:** [!INCLUDE [hello-join-aadj](hello-join-aad.md)], [!INCLUDE [hello-join-hybrid](hello-join-hybrid.md)]
---
\ No newline at end of file
diff --git a/windows/security/includes/hello-hybrid-keycert-trust-aad.md b/windows/security/includes/hello-hybrid-keycert-trust-aad.md
index 664db48668..abdacf0e93 100644
--- a/windows/security/includes/hello-hybrid-keycert-trust-aad.md
+++ b/windows/security/includes/hello-hybrid-keycert-trust-aad.md
@@ -8,5 +8,5 @@ ms.topic: include
[!INCLUDE [hello-intro](hello-intro.md)]
- **Deployment type:** [!INCLUDE [hello-deployment-hybrid](hello-deployment-hybrid.md)]
- **Trust type:** - **Trust type:** [!INCLUDE [hello-trust-key](hello-trust-key.md)], [!INCLUDE [hello-trust-certificate](hello-trust-certificate.md)]
-- **Join type:** [!INCLUDE [hello-join-aadj](hello-join-aadj.md)]
+- **Join type:** [!INCLUDE [hello-join-aadj](hello-join-aad.md)]
---
\ No newline at end of file
diff --git a/windows/security/includes/hello-join-aadj.md b/windows/security/includes/hello-join-aad.md
similarity index 100%
rename from windows/security/includes/hello-join-aadj.md
rename to windows/security/includes/hello-join-aad.md
diff --git a/windows/security/includes/hello-join-hybrid.md b/windows/security/includes/hello-join-hybrid.md
index 550c6ee26d..93777d9174 100644
--- a/windows/security/includes/hello-join-hybrid.md
+++ b/windows/security/includes/hello-join-hybrid.md
@@ -5,4 +5,4 @@ ms.date: 12/08/2022
ms.topic: include
---
-[Hybrid Azure AD join :::image type="icon" source="../images/icons/information.svg" border="false":::](../identity-protection/hello-for-business/hello-how-it-works-technology.md#hybrid-azure-ad-join "Devices that are hybrid Azure AD joined do not have any dependencies on Azure AD. Only local users accounts and Active Directory users can sign in to these devices. If an Active Directory user is synchronized to Azure AD, she can can have single-sign on to both Active Directory and Azure AD-protected resources")
\ No newline at end of file
+[Hybrid Azure AD join :::image type="icon" source="../images/icons/information.svg" border="false":::](../identity-protection/hello-for-business/hello-how-it-works-technology.md#hybrid-azure-ad-join "Devices that are hybrid Azure AD joined don't have any dependencies on Azure AD. Only local users accounts and Active Directory users can sign in to these devices. Active Directory users that are synchronized to Azure AD will have single-sign on to both Active Directory and Azure AD-protected resources")
\ No newline at end of file
From b5a795ecd4ccf871609ff258347461106f3796ba Mon Sep 17 00:00:00 2001
From: Paolo Matarazzo <74918781+paolomatarazzo@users.noreply.github.com>
Date: Fri, 9 Dec 2022 15:31:46 -0500
Subject: [PATCH 21/81] updates
---
windows/security/includes/hello-cloud.md | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/windows/security/includes/hello-cloud.md b/windows/security/includes/hello-cloud.md
index d7e1053eea..1c41485f11 100644
--- a/windows/security/includes/hello-cloud.md
+++ b/windows/security/includes/hello-cloud.md
@@ -7,5 +7,5 @@ ms.topic: include
[!INCLUDE [hello-intro](hello-intro.md)]
- **Deployment type:** [!INCLUDE [hello-deployment-cloud](hello-deployment-cloud.md)]
-- **Join type:** [!INCLUDE [hello-join-aad](hello-registration-aadj.md)]
+- **Join type:** [!INCLUDE [hello-join-aad](hello-join-aad.md)]
---
\ No newline at end of file
From c7332c5ac07c781313137999ade1a959ebe45c86 Mon Sep 17 00:00:00 2001
From: Tiara Quan <95256667+tiaraquan@users.noreply.github.com>
Date: Fri, 9 Dec 2022 13:31:54 -0800
Subject: [PATCH 22/81] Update windows-autopatch-wqu-overview.md
---
.../windows-autopatch/operate/windows-autopatch-wqu-overview.md | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/windows/deployment/windows-autopatch/operate/windows-autopatch-wqu-overview.md b/windows/deployment/windows-autopatch/operate/windows-autopatch-wqu-overview.md
index 12c0848bd6..b834b4c886 100644
--- a/windows/deployment/windows-autopatch/operate/windows-autopatch-wqu-overview.md
+++ b/windows/deployment/windows-autopatch/operate/windows-autopatch-wqu-overview.md
@@ -60,7 +60,7 @@ When running an expedited release, the regular goal of 95% of devices in 21 days
### Opt out of expedited releases
-Windows Autopatch provides the option to opt out of service-driven expedited quality updates. To opt out of service-driven expedited quality updates, customers can go to the **[Microsoft Endpoint Manager portal](https://go.microsoft.com/fwlink/?linkid=2109431)** > **Tenant administration** > **Windows Autopatch** > **Release management** blade. In the **Release management** blade, under the **Release Settings** tab, turn off the **Expedited Quality Updates** setting.
+Windows Autopatch provides the option to opt out of service-driven expedited quality updates. To opt out of service-driven expedited quality updates, customers can go to the **[Microsoft Endpoint Manager portal](https://go.microsoft.com/fwlink/?linkid=2109431)** > **Tenant administration** > **Windows Autopatch** > **Release management** blade. In the **Release management** blade, under the **Release settings** tab, turn off the **Expedited Quality Updates** setting.
| Release type | Group | Deferral | Deadline | Grace period |
| ----- | ----- | ----- | ----- | ----- |
From a130110bab8a66a9aa7300471087efbb7da86be2 Mon Sep 17 00:00:00 2001
From: Paolo Matarazzo <74918781+paolomatarazzo@users.noreply.github.com>
Date: Fri, 9 Dec 2022 16:46:40 -0500
Subject: [PATCH 23/81] updates
---
.../hello-aad-join-cloud-only-deploy.md | 4 ++--
.../hello-how-it-works-technology.md | 22 +++++++++++++++++++
2 files changed, 24 insertions(+), 2 deletions(-)
diff --git a/windows/security/identity-protection/hello-for-business/hello-aad-join-cloud-only-deploy.md b/windows/security/identity-protection/hello-for-business/hello-aad-join-cloud-only-deploy.md
index 721ddca258..814f5855d9 100644
--- a/windows/security/identity-protection/hello-for-business/hello-aad-join-cloud-only-deploy.md
+++ b/windows/security/identity-protection/hello-for-business/hello-aad-join-cloud-only-deploy.md
@@ -17,7 +17,7 @@ When you Azure Active Directory (Azure AD) join a Windows device, the system pro
You may wish to disable the automatic Windows Hello for Business enrollment prompts if you aren't ready to use it in your environment. Instructions on how to disable Windows Hello for Business enrollment in a cloud only environment are included below.
> [!NOTE]
-> During the out-of-box experience (OOBE) flow of an Azure AD join, you will see a provisioning PIN when you don’t have Intune. You can always cancel the PIN screen and set this cancellation with registry keys to prevent future prompts.
+> During the out-of-box experience (OOBE) flow of an Azure AD join, you will see a provisioning PIN when you don't have Intune. You can always cancel the PIN screen and set this cancellation with registry keys to prevent future prompts.
## Prerequisites
@@ -25,7 +25,7 @@ Cloud only deployments will use Azure AD multi-factor authentication (MFA) durin
The necessary Windows Hello for Business prerequisites are located at [Cloud Only Deployment](hello-identity-verification.md#azure-ad-cloud-only-deployment).
-Also note that it's possible for federated domains to enable the “Supports MFA” flag in your federated domain settings. This flag tells Azure AD that the federated IDP will perform the MFA challenge.
+Also note that it's possible for federated domains to enable the *Supports MFA* flag in your federated domain settings. This flag tells Azure AD that the federated IDP will perform the MFA challenge.
Check and view this setting with the following MSOnline PowerShell command:
diff --git a/windows/security/identity-protection/hello-for-business/hello-how-it-works-technology.md b/windows/security/identity-protection/hello-for-business/hello-how-it-works-technology.md
index ad5eec8634..fedf93f60e 100644
--- a/windows/security/identity-protection/hello-for-business/hello-how-it-works-technology.md
+++ b/windows/security/identity-protection/hello-for-business/hello-how-it-works-technology.md
@@ -70,6 +70,7 @@ The certificate trust model uses a securely issued certificate based on the user
- [Deployment type](#deployment-type)
- [Hybrid Azure AD join](#hybrid-azure-ad-join)
- [Hybrid deployment](#hybrid-deployment)
+- [Cloud Kerberos trust](#cloud-kerberos-trust)
- [Key trust](#key-trust)
- [On-premises deployment](#on-premises-deployment)
- [Trust type](#trust-type)
@@ -102,6 +103,27 @@ In Windows 10 and Windows 11, cloud experience host is an application used while
[Windows Hello for Business and device registration](./hello-how-it-works-device-registration.md)
+## Cloud Kerberos trust
+
+The cloud Kerberos trust model offers a simplified deployment experience, when compared to the key trust model.\
+With cloud Kerberos trust, there's no need to deploy certificated to the users or to the domain controllers, which is ideal for those environments without a PKI.
+
+Giving the simplicity offered by this model, cloud Kerberos trust is the recommended deployment model when compared to the key trust model. It is also the preferred deployment model if you do not need to support certificate authentication scenarios.
+
+### Related to cloud Kerberos trust
+
+- [Deployment type](#deployment-type)
+- [Hybrid Azure AD join](#hybrid-azure-ad-join)
+- [Hybrid deployment](#hybrid-deployment)
+- [Cloud Kerberos trust](#cloud-kerberos-trust)
+- [Key trust](#key-trust)
+- [On-premises deployment](#on-premises-deployment)
+- [Trust type](#trust-type)
+
+### More information about cloud Kerberos trust
+
+[Cloud Kerberos trust deployment](hello-hybrid-cloud-kerberos-trust.md)
+
## Deployment type
Windows Hello for Business has three deployment models to accommodate the needs of different organizations. The three deployment models include:
From 33df09e23ef3072982c26897ca907c202fa580ec Mon Sep 17 00:00:00 2001
From: Tiara Quan <95256667+tiaraquan@users.noreply.github.com>
Date: Fri, 9 Dec 2022 14:21:19 -0800
Subject: [PATCH 24/81] Update windows-autopatch-wqu-overview.md
---
.../windows-autopatch/operate/windows-autopatch-wqu-overview.md | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/windows/deployment/windows-autopatch/operate/windows-autopatch-wqu-overview.md b/windows/deployment/windows-autopatch/operate/windows-autopatch-wqu-overview.md
index b834b4c886..2e1935639e 100644
--- a/windows/deployment/windows-autopatch/operate/windows-autopatch-wqu-overview.md
+++ b/windows/deployment/windows-autopatch/operate/windows-autopatch-wqu-overview.md
@@ -76,7 +76,7 @@ If Windows Autopatch detects a [significant issue with a release](../operate/win
If we pause the release, a policy will be deployed which prevents devices from updating while the issue is investigated. Once the issue is resolved, the release will be resumed.
-You can pause or resume a Windows quality update from the Release management tab in the [Endpoint Manager admin center](https://go.microsoft.com/fwlink/?linkid=2109431).
+You can pause or resume a Windows quality update from the **Release management** tab in the [Endpoint Manager admin center](https://go.microsoft.com/fwlink/?linkid=2109431).
## Incidents and outages
From f45f3082a84807015c31f10ef82140f3681ca4bf Mon Sep 17 00:00:00 2001
From: mounicabattula <95552440+mounicabattula@users.noreply.github.com>
Date: Fri, 9 Dec 2022 14:28:31 -0800
Subject: [PATCH 25/81] Update windows-autopatch-wqu-overview.md
Added changes for OOB
---
.../operate/windows-autopatch-wqu-overview.md | 6 ++++++
1 file changed, 6 insertions(+)
diff --git a/windows/deployment/windows-autopatch/operate/windows-autopatch-wqu-overview.md b/windows/deployment/windows-autopatch/operate/windows-autopatch-wqu-overview.md
index 2e1935639e..6854aa174f 100644
--- a/windows/deployment/windows-autopatch/operate/windows-autopatch-wqu-overview.md
+++ b/windows/deployment/windows-autopatch/operate/windows-autopatch-wqu-overview.md
@@ -70,6 +70,12 @@ Windows Autopatch provides the option to opt out of service-driven expedited qua
> [!NOTE]
> Windows Autopatch doesn't allow customers to request expedited releases.
+## Out of Band release
+
+Windows Autopatch schedules and deploys required Out of Band (OOB) updates released outside of the normal schedule. Customers can view the deployed OOB quality updates on the **Release Management** blade on the **[Microsoft Endpoint Manager portal](https://go.microsoft.com/fwlink/?linkid=2109431)**.
+
+To view deployed OOB quality updates, customers can go to the Endpoint Manager admin center > Tenant administration > Windows Autopatch > Release management pane. Under the Release Announcements tab, customers can view the knowledge base (KB) articles corresponding to the deployed OOB quality updates. In case of a normal quality update release, KBs for the specific release will be available to the customers to view in the Release Announcements tab. Note that the announcements will be removed from the Release announcements tab when the next quality update is released. Further, if quality updates are paused for a ring, the OOB updates will also be paused.
+
## Pausing and resuming a release
If Windows Autopatch detects a [significant issue with a release](../operate/windows-autopatch-wqu-signals.md), we may decide to pause that release.
From 16de507861983d6dbbe460f3a91dc7a82a8378bf Mon Sep 17 00:00:00 2001
From: mounicabattula <95552440+mounicabattula@users.noreply.github.com>
Date: Fri, 9 Dec 2022 14:30:39 -0800
Subject: [PATCH 26/81] Adding Section for OOB
Adding section for OOB
---
.../windows-autopatch/operate/windows-autopatch-wqu-overview.md | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/windows/deployment/windows-autopatch/operate/windows-autopatch-wqu-overview.md b/windows/deployment/windows-autopatch/operate/windows-autopatch-wqu-overview.md
index 6854aa174f..d63d67b12a 100644
--- a/windows/deployment/windows-autopatch/operate/windows-autopatch-wqu-overview.md
+++ b/windows/deployment/windows-autopatch/operate/windows-autopatch-wqu-overview.md
@@ -74,7 +74,7 @@ Windows Autopatch provides the option to opt out of service-driven expedited qua
Windows Autopatch schedules and deploys required Out of Band (OOB) updates released outside of the normal schedule. Customers can view the deployed OOB quality updates on the **Release Management** blade on the **[Microsoft Endpoint Manager portal](https://go.microsoft.com/fwlink/?linkid=2109431)**.
-To view deployed OOB quality updates, customers can go to the Endpoint Manager admin center > Tenant administration > Windows Autopatch > Release management pane. Under the Release Announcements tab, customers can view the knowledge base (KB) articles corresponding to the deployed OOB quality updates. In case of a normal quality update release, KBs for the specific release will be available to the customers to view in the Release Announcements tab. Note that the announcements will be removed from the Release announcements tab when the next quality update is released. Further, if quality updates are paused for a ring, the OOB updates will also be paused.
+To view deployed OOB quality updates, customers can go to the Endpoint Manager admin center > Tenant administration > Windows Autopatch > Release management pane. Under the Release Announcements tab, customers can view the knowledge base (KB) articles corresponding to the deployed OOB quality updates. In case of a normal quality update release, KBs for the specific release will be available to the customers to view in the Release Announcements tab. Note that the announcements will be removed from the Release announcements tab when the next quality update is released. Further, if quality updates are paused for a ring , the OOB updates will also be paused.
## Pausing and resuming a release
From eaa9a2321afbd02729743d1f552e98247441a06b Mon Sep 17 00:00:00 2001
From: Tiara Quan <95256667+tiaraquan@users.noreply.github.com>
Date: Fri, 9 Dec 2022 14:36:55 -0800
Subject: [PATCH 27/81] Create windows-autopatch-wqu-overview.md
Reviewed OOB
---
.../operate/windows-autopatch-wqu-overview.md | 14 ++++++++++----
1 file changed, 10 insertions(+), 4 deletions(-)
diff --git a/windows/deployment/windows-autopatch/operate/windows-autopatch-wqu-overview.md b/windows/deployment/windows-autopatch/operate/windows-autopatch-wqu-overview.md
index d63d67b12a..f2968ce393 100644
--- a/windows/deployment/windows-autopatch/operate/windows-autopatch-wqu-overview.md
+++ b/windows/deployment/windows-autopatch/operate/windows-autopatch-wqu-overview.md
@@ -60,7 +60,7 @@ When running an expedited release, the regular goal of 95% of devices in 21 days
### Opt out of expedited releases
-Windows Autopatch provides the option to opt out of service-driven expedited quality updates. To opt out of service-driven expedited quality updates, customers can go to the **[Microsoft Endpoint Manager portal](https://go.microsoft.com/fwlink/?linkid=2109431)** > **Tenant administration** > **Windows Autopatch** > **Release management** blade. In the **Release management** blade, under the **Release settings** tab, turn off the **Expedited Quality Updates** setting.
+Windows Autopatch provides the option to opt out of service-driven expedited quality updates. To opt out of service-driven expedited quality updates, you can go to the **[Microsoft Endpoint Manager portal](https://go.microsoft.com/fwlink/?linkid=2109431)** > **Tenant administration** > **Windows Autopatch** > **Release management** blade. In the **Release management** blade, under the **Release settings** tab, turn off the **Expedited Quality Updates** setting.
| Release type | Group | Deferral | Deadline | Grace period |
| ----- | ----- | ----- | ----- | ----- |
@@ -70,11 +70,17 @@ Windows Autopatch provides the option to opt out of service-driven expedited qua
> [!NOTE]
> Windows Autopatch doesn't allow customers to request expedited releases.
-## Out of Band release
+## Out of Band releases
-Windows Autopatch schedules and deploys required Out of Band (OOB) updates released outside of the normal schedule. Customers can view the deployed OOB quality updates on the **Release Management** blade on the **[Microsoft Endpoint Manager portal](https://go.microsoft.com/fwlink/?linkid=2109431)**.
+Windows Autopatch schedules and deploys required Out of Band (OOB) updates released outside of the normal schedule. You can view the deployed OOB quality updates in the **Release Management** blade in the **[Microsoft Endpoint Manager portal](https://go.microsoft.com/fwlink/?linkid=2109431)**.
-To view deployed OOB quality updates, customers can go to the Endpoint Manager admin center > Tenant administration > Windows Autopatch > Release management pane. Under the Release Announcements tab, customers can view the knowledge base (KB) articles corresponding to the deployed OOB quality updates. In case of a normal quality update release, KBs for the specific release will be available to the customers to view in the Release Announcements tab. Note that the announcements will be removed from the Release announcements tab when the next quality update is released. Further, if quality updates are paused for a ring , the OOB updates will also be paused.
+**To view deployed OOB quality updates:**
+
+1. Go to [Endpoint Manager admin center](https://go.microsoft.com/fwlink/?linkid=2109431) > **Tenant administration** > **Windows Autopatch** > **Release management**.
+2. Under the **Release Announcements** tab, you can view the knowledge base (KB) articles corresponding to deployed OOB and normal Windows quality updates.
+
+> [!Note]
+> Announcements will be **removed** from the Release announcements tab when the next quality update is released. Further, if quality updates are paused for a deployment ring, the OOB updates will also be paused.
## Pausing and resuming a release
From d41e645589f28fa9113f1279cf95164c2dde48c5 Mon Sep 17 00:00:00 2001
From: Tiara Quan <95256667+tiaraquan@users.noreply.github.com>
Date: Fri, 9 Dec 2022 14:39:01 -0800
Subject: [PATCH 28/81] Update windows-autopatch-wqu-overview.md
---
.../windows-autopatch/operate/windows-autopatch-wqu-overview.md | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/windows/deployment/windows-autopatch/operate/windows-autopatch-wqu-overview.md b/windows/deployment/windows-autopatch/operate/windows-autopatch-wqu-overview.md
index f2968ce393..0479ead7f6 100644
--- a/windows/deployment/windows-autopatch/operate/windows-autopatch-wqu-overview.md
+++ b/windows/deployment/windows-autopatch/operate/windows-autopatch-wqu-overview.md
@@ -77,7 +77,7 @@ Windows Autopatch schedules and deploys required Out of Band (OOB) updates relea
**To view deployed OOB quality updates:**
1. Go to [Endpoint Manager admin center](https://go.microsoft.com/fwlink/?linkid=2109431) > **Tenant administration** > **Windows Autopatch** > **Release management**.
-2. Under the **Release Announcements** tab, you can view the knowledge base (KB) articles corresponding to deployed OOB and normal Windows quality updates.
+2. Under the **Release Announcements** tab, you can view the knowledge base (KB) articles corresponding to deployed OOB and regular Windows quality updates.
> [!Note]
> Announcements will be **removed** from the Release announcements tab when the next quality update is released. Further, if quality updates are paused for a deployment ring, the OOB updates will also be paused.
From 23dbfb36576fce268942e87f6c1a0d4e2215a442 Mon Sep 17 00:00:00 2001
From: Paolo Matarazzo <74918781+paolomatarazzo@users.noreply.github.com>
Date: Sat, 10 Dec 2022 09:21:01 -0500
Subject: [PATCH 29/81] updates
---
.../hello-for-business/hello-how-it-works-technology.md | 9 +++++----
.../hello-for-business/hello-identity-verification.md | 2 +-
windows/security/includes/hello-trust-cloud-kerberos.md | 2 +-
3 files changed, 7 insertions(+), 6 deletions(-)
diff --git a/windows/security/identity-protection/hello-for-business/hello-how-it-works-technology.md b/windows/security/identity-protection/hello-for-business/hello-how-it-works-technology.md
index fedf93f60e..7bec9c2543 100644
--- a/windows/security/identity-protection/hello-for-business/hello-how-it-works-technology.md
+++ b/windows/security/identity-protection/hello-for-business/hello-how-it-works-technology.md
@@ -105,17 +105,16 @@ In Windows 10 and Windows 11, cloud experience host is an application used while
## Cloud Kerberos trust
-The cloud Kerberos trust model offers a simplified deployment experience, when compared to the key trust model.\
-With cloud Kerberos trust, there's no need to deploy certificated to the users or to the domain controllers, which is ideal for those environments without a PKI.
+The cloud Kerberos trust model offers a simplified deployment experience, when compared to the other trust types.\
+With cloud Kerberos trust, there's no need to deploy certificates to the users or to the domain controllers, which is ideal for environments without an existing PKI.
-Giving the simplicity offered by this model, cloud Kerberos trust is the recommended deployment model when compared to the key trust model. It is also the preferred deployment model if you do not need to support certificate authentication scenarios.
+Giving the simplicity offered by this model, cloud Kerberos trust is the recommended model when compared to the key trust model. It is also the preferred deployment model if you do not need to support certificate authentication scenarios.
### Related to cloud Kerberos trust
- [Deployment type](#deployment-type)
- [Hybrid Azure AD join](#hybrid-azure-ad-join)
- [Hybrid deployment](#hybrid-deployment)
-- [Cloud Kerberos trust](#cloud-kerberos-trust)
- [Key trust](#key-trust)
- [On-premises deployment](#on-premises-deployment)
- [Trust type](#trust-type)
@@ -245,6 +244,7 @@ The key trust model uses the user's Windows Hello for Business identity to authe
### Related to key trust
+- [Cloud Kerberos trust](#cloud-kerberos-trust)
- [Certificate trust](#certificate-trust)
- [Deployment type](#deployment-type)
- [Hybrid Azure AD join](#hybrid-azure-ad-join)
@@ -336,6 +336,7 @@ The trust type determines how a user authenticates to the Active Directory to ac
### Related to trust type
+- [Cloud Kerberos trust](#cloud-kerberos-trust)
- [Certificate trust](#certificate-trust)
- [Hybrid deployment](#hybrid-deployment)
- [Key trust](#key-trust)
diff --git a/windows/security/identity-protection/hello-for-business/hello-identity-verification.md b/windows/security/identity-protection/hello-for-business/hello-identity-verification.md
index 37b6335a50..51c809a805 100644
--- a/windows/security/identity-protection/hello-for-business/hello-identity-verification.md
+++ b/windows/security/identity-protection/hello-for-business/hello-identity-verification.md
@@ -6,7 +6,7 @@ ms.collection:
- highpri
ms.date: 2/15/2022
appliesto:
-- ✅ Windows 10 and later
+ - ✅ Windows 10 and later
ms.topic: article
---
diff --git a/windows/security/includes/hello-trust-cloud-kerberos.md b/windows/security/includes/hello-trust-cloud-kerberos.md
index 76dfb6c4a1..5ddac53ba9 100644
--- a/windows/security/includes/hello-trust-cloud-kerberos.md
+++ b/windows/security/includes/hello-trust-cloud-kerberos.md
@@ -5,4 +5,4 @@ ms.date: 12/08/2022
ms.topic: include
---
-[cloud Kerberos trust :::image type="icon" source="../images/icons/information.svg" border="false":::](../identity-protection/hello-for-business/hello-how-it-works-technology.md#cloud-kerberos-trust "This trust type uses security keys to authenticate the users to Active Directory. It's not required to issue any certificates, making it the recommended choice for environments that do not need certificate authentication.")
\ No newline at end of file
+[cloud Kerberos trust :::image type="icon" source="../images/icons/information.svg" border="false":::](../identity-protection/hello-for-business/hello-how-it-works-technology.md#cloud-kerberos-trust "This trust type uses security keys to authenticate the users to Active Directory. It's not required to issue any certificates, making it the recommended choice for environments that do not need certificate authentication")
\ No newline at end of file
From edeeb6a85f8063d0612f364e17fc04176cd229af Mon Sep 17 00:00:00 2001
From: Paolo Matarazzo <74918781+paolomatarazzo@users.noreply.github.com>
Date: Sat, 10 Dec 2022 09:40:19 -0500
Subject: [PATCH 30/81] updates
---
.../hello-for-business/hello-cert-trust-policy-settings.md | 2 +-
.../hello-for-business/hello-feature-pin-reset.md | 2 +-
.../hello-for-business/hello-manage-in-organization.md | 2 +-
.../identity-protection/hello-for-business/hello-overview.md | 2 +-
.../hello-for-business/hello-why-pin-is-better-than-password.md | 2 +-
5 files changed, 5 insertions(+), 5 deletions(-)
diff --git a/windows/security/identity-protection/hello-for-business/hello-cert-trust-policy-settings.md b/windows/security/identity-protection/hello-for-business/hello-cert-trust-policy-settings.md
index 6c48751b0b..1ee4530318 100644
--- a/windows/security/identity-protection/hello-for-business/hello-cert-trust-policy-settings.md
+++ b/windows/security/identity-protection/hello-for-business/hello-cert-trust-policy-settings.md
@@ -5,7 +5,7 @@ ms.collection:
- highpri
ms.date: 08/20/2018
appliesto:
-- ✅ Windows 10 and later
+- ✅ Windows 10 and later
- ✅ Windows Server 2016 and later
ms.topic: article
---
diff --git a/windows/security/identity-protection/hello-for-business/hello-feature-pin-reset.md b/windows/security/identity-protection/hello-for-business/hello-feature-pin-reset.md
index 561975c7a9..e1aa2e7acb 100644
--- a/windows/security/identity-protection/hello-for-business/hello-feature-pin-reset.md
+++ b/windows/security/identity-protection/hello-for-business/hello-feature-pin-reset.md
@@ -5,7 +5,7 @@ ms.collection:
- highpri
ms.date: 07/29/2022
appliesto:
-- ✅ Windows 10 and later
+- ✅ Windows 10 and later
ms.topic: article
---
diff --git a/windows/security/identity-protection/hello-for-business/hello-manage-in-organization.md b/windows/security/identity-protection/hello-for-business/hello-manage-in-organization.md
index b32ad3664c..a548960eab 100644
--- a/windows/security/identity-protection/hello-for-business/hello-manage-in-organization.md
+++ b/windows/security/identity-protection/hello-for-business/hello-manage-in-organization.md
@@ -5,7 +5,7 @@ ms.collection:
- highpri
ms.date: 2/15/2022
appliesto:
-- ✅ Windows 10 and later
+- ✅ Windows 10 and later
ms.topic: article
---
diff --git a/windows/security/identity-protection/hello-for-business/hello-overview.md b/windows/security/identity-protection/hello-for-business/hello-overview.md
index 49a2cc77ce..50d6d7f166 100644
--- a/windows/security/identity-protection/hello-for-business/hello-overview.md
+++ b/windows/security/identity-protection/hello-for-business/hello-overview.md
@@ -5,7 +5,7 @@ ms.collection:
- highpri
ms.topic: conceptual
appliesto:
- - ✅ Windows 10 and later
+ - ✅ Windows 10 and later
ms.date: 12/31/2017
---
# Windows Hello for Business Overview
diff --git a/windows/security/identity-protection/hello-for-business/hello-why-pin-is-better-than-password.md b/windows/security/identity-protection/hello-for-business/hello-why-pin-is-better-than-password.md
index ca25fdee58..89fe8f84ce 100644
--- a/windows/security/identity-protection/hello-for-business/hello-why-pin-is-better-than-password.md
+++ b/windows/security/identity-protection/hello-for-business/hello-why-pin-is-better-than-password.md
@@ -5,7 +5,7 @@ ms.collection:
- highpri
ms.date: 10/23/2017
appliesto:
-- ✅ Windows 10 and later
+- ✅ Windows 10 and later
ms.topic: article
---
# Why a PIN is better than an online password
From e9b2e73e2174d9856355d07bcf9bbe16aa9ea988 Mon Sep 17 00:00:00 2001
From: Paolo Matarazzo <74918781+paolomatarazzo@users.noreply.github.com>
Date: Mon, 12 Dec 2022 07:52:55 -0500
Subject: [PATCH 31/81] updates
---
.../hello-key-trust-validate-ad-prereq.md | 42 +++---
.../hello-key-trust-validate-pki.md | 123 +++++++++---------
2 files changed, 76 insertions(+), 89 deletions(-)
diff --git a/windows/security/identity-protection/hello-for-business/hello-key-trust-validate-ad-prereq.md b/windows/security/identity-protection/hello-for-business/hello-key-trust-validate-ad-prereq.md
index 57080612a2..6afbd7f245 100644
--- a/windows/security/identity-protection/hello-for-business/hello-key-trust-validate-ad-prereq.md
+++ b/windows/security/identity-protection/hello-for-business/hello-key-trust-validate-ad-prereq.md
@@ -1,39 +1,31 @@
---
title: Key registration for on-premises deployment of Windows Hello for Business
-description: How to Validate Active Directory prerequisites for Windows Hello for Business when deploying with the key trust model.
-ms.date: 08/19/2018
+description: Validate Active Directory prerequisites when deploying Windows Hello for Business in a key trust model.
+ms.date: 12/12/2022
appliesto:
- ✅ Windows 10 and later
-ms.topic: article
+ms.topic: tutorial
---
-# Validate Active Directory prerequisites - Key Trust
+# Validate Active Directory prerequisites
[!INCLUDE [hello-on-premises-key-trust](../../includes/hello-on-premises-key-trust.md)]
-Key trust deployments need an adequate number of 2016 or later domain controllers to ensure successful user authentication with Windows Hello for Business. To learn more about domain controller planning for key trust deployments, read the [Windows Hello for Business planning guide](hello-planning-guide.md), the [Planning an adequate number of Windows Server 2016 or later Domain Controllers for Windows Hello for Business deployments](hello-adequate-domain-controllers.md) section.
+Key trust deployments need an adequate number of domain controllers to ensure successful user authentication with Windows Hello for Business. To learn more about domain controller planning for key trust deployments, read the [Windows Hello for Business planning guide](hello-planning-guide.md) and the [Planning an adequate number of Domain Controllers for Windows Hello for Business deployments](hello-adequate-domain-controllers.md) section.
-> [!NOTE]
->There was an issue with key trust authentication on Windows Server 2019. If you are planning to use Windows Server 2019 domain controllers refer to [KB4487044](https://support.microsoft.com/en-us/help/4487044/windows-10-update-kb4487044) to fix this issue.
+The key registration process for the on-premises deployment of Windows Hello for Business requires the Windows Server 2016 Active Directory or later schema. The key-trust model receives the schema extension when the first Windows Server 2016 domain controller is added to the forest.
-The key registration process for the On-premises deployment of Windows Hello for Business needs the Windows Server 2016 Active Directory or later schema. The key-trust model receives the schema extension when the first Windows Server 2016 domain controller is added to the forest. The minimum required domain functional and forest functional levels for Windows Hello for Business deployment is Windows Server 2008 R2.
+## Create the Windows Hello for Business Users security group
-## Create the Windows Hello for Business Users Security Global Group
+The *Windows Hello for Business Users* group is used to make it easy to deploy Windows Hello for Business in phases. You assign Group Policy permissions to this group to simplify the deployment by adding the users to the group. This provides users with the proper permissions to provision Windows Hello for Business.
-The Windows Hello for Business Users group is used to make it easy to deploy Windows Hello for Business in phases. You assign Group Policy permissions to this group to simplify the deployment by simply adding the users to the group. This provides users with the proper permissions to provision Windows Hello for Business.
+Sign-in to a domain controller or to a management workstation with a *Domain Administrator* equivalent credentials.
-Sign-in a domain controller or management workstation with _Domain Admin_ equivalent credentials.
+1. Open **Active Directory Users and Computers**
+1. Select **View > Advanced Features**
+1. Expand the domain node from the navigation pane
+1. Right-click the **Users** container. Select **New > Group**
+1. Type *Windows Hello for Business Users* in the **Group Name**
+1. Select **OK**
-1. Open **Active Directory Users and Computers**.
-2. Click **View** and click **Advanced Features**.
-3. Expand the domain node from the navigation pane.
-4. Right-click the **Users** container. Click **New**. Click **Group**.
-5. Type **Windows Hello for Business Users** in the **Group Name** text box.
-6. Click **OK**.
-
-
-## Follow the Windows Hello for Business on premises certificate trust deployment guide
-1. Validate Active Directory prerequisites (*You are here*)
-2. [Validate and Configure Public Key Infrastructure](hello-key-trust-validate-pki.md)
-3. [Prepare and Deploy Windows Server 2016 Active Directory Federation Services](hello-key-trust-adfs.md)
-4. [Validate and Deploy Multifactor Authentication Services (MFA)](hello-key-trust-validate-deploy-mfa.md)
-5. [Configure Windows Hello for Business Policy settings](hello-key-trust-policy-settings.md)
+> [!div class="nextstepaction"]
+> [Next: validate and configure PKI >](hello-key-trust-validate-pki.md)
\ No newline at end of file
diff --git a/windows/security/identity-protection/hello-for-business/hello-key-trust-validate-pki.md b/windows/security/identity-protection/hello-for-business/hello-key-trust-validate-pki.md
index c3a9226714..fdcab4e3f3 100644
--- a/windows/security/identity-protection/hello-for-business/hello-key-trust-validate-pki.md
+++ b/windows/security/identity-protection/hello-for-business/hello-key-trust-validate-pki.md
@@ -1,99 +1,99 @@
---
-title: Validate Public Key Infrastructure - key trust model (Windows Hello for Business)
-description: How to Validate Public Key Infrastructure for Windows Hello for Business, under a key trust model.
-ms.date: 08/19/2018
+title: Validate and configure the Public Key Infrastructure
+description: Validate the Public Key Infrastructure when deploying Windows Hello for Business in a key trust model.
+ms.date: 12/12/2022
appliesto:
- ✅ Windows 10 and later
-ms.topic: article
+ms.topic: tutorial
---
-# Validate and Configure Public Key Infrastructure - Key Trust
+# Validate and configure the Public Key Infrastructure
[!INCLUDE [hello-on-premises-key-trust](../../includes/hello-on-premises-key-trust.md)]
-Windows Hello for Business must have a public key infrastructure regardless of the deployment or trust model. All trust models depend on the domain controllers having a certificate. The certificate serves as a root of trust for clients to ensure they are not communicating with a rogue domain controller.
+Windows Hello for Business must have a Public Key Infrastructure (PKI) when using the *key trust* or *certificate trust* models. The domain controllers must have a certificate, which serves as a root of trust for clients, to ensure they are not communicating with a rogue domain controller.
## Deploy an enterprise certificate authority
-This guide assumes most enterprises have an existing public key infrastructure. Windows Hello for Business depends on a Windows enterprise public key infrastructure running the Active Directory Certificate Services role from Windows Server 2012 or later.
+This guide assumes most enterprises have an existing public key infrastructure. Windows Hello for Business depends on an enterprise PKI running the Windows Server *Active Directory Certificate Services* role.
-### Lab-based public key infrastructure
+### Lab-based PKI
-The following instructions may be used to deploy simple public key infrastructure that is suitable for a lab environment.
+The following instructions may be used to deploy simple public key infrastructure that is suitable **for a lab environment**.
-Sign in using **Enterprise Admin** equivalent credentials on Windows Server 2012 or later server where you want the certificate authority installed.
+Sign in using *Enterprise Administrator* equivalent credentials on a Windows Server where you want the certificate authority installed.
>[!NOTE]
>Never install a certificate authority on a domain controller in a production environment.
-1. Open an elevated Windows PowerShell prompt.
-2. Use the following command to install the Active Directory Certificate Services role.
+1. Open an elevated Windows PowerShell prompt
+1. Use the following command to install the Active Directory Certificate Services role.
```PowerShell
Add-WindowsFeature Adcs-Cert-Authority -IncludeManagementTools
```
-
-3. Use the following command to configure the Certificate Authority using a basic certificate authority configuration.
+3. Use the following command to configure the Certificate Authority using a basic certificate authority configuration
```PowerShell
Install-AdcsCertificationAuthority
- ```
+ ```
-## Configure a Production Public Key Infrastructure
+## Configure a PKI
-If you do have an existing public key infrastructure, please review [Certification Authority Guidance](/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/hh831574(v=ws.11)) from Microsoft TechNet to properly design your infrastructure. Then, consult the [Test Lab Guide: Deploying an AD CS Two-Tier PKI Hierarchy](/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/hh831348(v=ws.11)) for instructions on how to configure your public key infrastructure using the information from your design session.
+If you do have an existing PKI, review [Certification Authority Guidance](/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/hh831574(v=ws.11)) to properly design your infrastructure. Then, consult the [Test Lab Guide: Deploying an AD CS Two-Tier PKI Hierarchy](/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/hh831348(v=ws.11)) for instructions on how to configure your PKI using the information from your design session.
### Configure Domain Controller Certificates
-Clients need to trust domain controllers and the best way to do this is to ensure each domain controller has a Kerberos Authentication certificate. Installing a certificate on the domain controller enables the Key Distribution Center (KDC) to prove its identity to other members of the domain. This provides clients a root of trust external to the domain—namely the enterprise certificate authority.
+Clients must to trust the domain controllers, and the way to do this is to ensure each domain controller has a *Kerberos Authentication* certificate. Installing a certificate on the domain controllers enables the Key Distribution Center (KDC) to prove its identity to other members of the domain. The certificates provide clients a root of trust external to the domain, namely the enterprise certificate authority.
-Domain controllers automatically request a domain controller certificate (if published) when they discover an enterprise certificate authority is added to Active Directory. However, certificates based on the Domain Controller and Domain Controller Authentication certificate templates do not include the KDC Authentication object identifier (OID), which was later added to the Kerberos RFC. Therefore, domain controllers need to request a certificate based on the Kerberos Authentication certificate template.
+Domain controllers automatically request a domain controller certificate (if published) when they discover an enterprise certificate authority is added to Active Directory. However, certificates based on the Domain Controller and Domain Controller Authentication certificate templates do not include the *KDC Authentication* object identifier (OID), which was later added to the Kerberos RFC. Therefore, domain controllers need to request a certificate based on the *Kerberos Authentication* certificate template.
-By default, the Active Directory Certificate Authority provides and publishes the Kerberos Authentication certificate template. However, the cryptography configuration included in the provided template is based on older and less performant cryptography APIs. To ensure domain controllers request the proper certificate with the best available cryptography, use the Kerberos Authentication certificate template as a baseline to create an updated domain controller certificate template.
+By default, the Active Directory certificate authority provides and publishes the *Kerberos Authentication* certificate template. The cryptography configuration included in the template is based on older and less performant cryptography APIs. To ensure domain controllers request the proper certificate with the best available cryptography, use the *Kerberos Authentication* certificate template as a *baseline* to create an updated domain controller certificate template.
-Sign in to a certificate authority or management workstations with **Domain Admin** equivalent credentials.
+Sign in to a certificate authority or management workstations with *Domain Admintistrator* equivalent credentials.
-1. Open the **Certificate Authority** management console.
-
-2. Right-click **Certificate Templates** and click **Manage**.
-
-3. In the **Certificate Template Console**, right-click the **Kerberos Authentication** template in the details pane and click **Duplicate Template**.
-
-4. On the **Compatibility** tab, clear the **Show resulting changes** check box. Select **Windows Server 2008 R2** from the **Certification Authority** list. Select **Windows 7.Server 2008 R2** from the **Certification Recipient** list.
-
-5. On the **General** tab, type **Domain Controller Authentication (Kerberos)** in Template display name. Adjust the validity and renewal period to meet your enterprise’s needs.
+1. Open the **Certificate Authority** management console
+1. Right-click **Certificate Templates > Manage**
+1. In the **Certificate Template Console**, right-click the **Kerberos Authentication** template in the details pane and select **Duplicate Template**
+1. On the **Compatibility** tab:
+ - Clear the **Show resulting changes** check box
+ - Select **Windows Server 2008 R2** from the **Certification Authority** list
+ - Select **Windows 7.Server 2008 R2** from the **Certification Recipient** list
+1. On the **General** tab
+ - Type *Domain Controller Authentication (Kerberos)* in Template display name
+ - Adjust the validity and renewal period to meet your enterprise's needs
> [!NOTE]
- > If you use different template names, you’ll need to remember and substitute these names in different portions of the lab.
+ > If you use different template names, you'll need to remember and substitute these names in different portions of the lab.
-6. On the **Subject Name** tab, select the **Build from this Active Directory information** button if it is not already selected. Select **None** from the **Subject name format** list. Select **DNS name** from the **Include this information in alternate subject** list. Clear all other items.
+1. On the **Subject Name** tab:
+ - Select the **Build from this Active Directory information** button if it is not already selected
+ - Select **None** from the **Subject name format** list
+ - Select **DNS name** from the **Include this information in alternate subject** list
+ - Clear all other items
+1. On the **Cryptography** tab:
+ - select **Key Storage Provider** from the **Provider Category** list
+ - Select **RSA** from the **Algorithm name** list
+ - Type *2048* in the **Minimum key size** text box
+ - Select **SHA256** from the **Request hash** list
+1. Select **OK**
+1. Close the console
-7. On the **Cryptography** tab, select **Key Storage Provider** from the **Provider Category** list. Select **RSA** from the **Algorithm name** list. Type **2048** in the **Minimum key size** text box. Select **SHA256** from the **Request hash** list. Click **OK**.
+### Supersede the existing domain controller certificate
-8. Close the console.
+The domain controllers may have an existing domain controller certificate. The Active Directory Certificate Services provides a default certificate template for domain controllers called *domain controller certificate*. Later releases of Windows Server provided a new certificate template called *domain controller authentication certificate*. These certificate templates were provided prior to the update of the Kerberos specification that stated Key Distribution Centers (KDCs) performing certificate authentication needed to include the *KDC Authentication* extension.
-### Superseding the existing Domain Controller certificate
+The *Kerberos Authentication* certificate template is the most current certificate template designated for domain controllers, and should be the one you deploy to all your domain controllers.\
+The *autoenrollment* feature allows to easily replace the domain controller certificates. Use the following configuration to replace older domain controller certificates with new ones, using the *Kerberos Authentication* certificate template.
-Many domain controllers may have an existing domain controller certificate. The Active Directory Certificate Services provides a default certificate template from domain controllers—the domain controller certificate template. Later releases provided a new certificate template—the domain controller authentication certificate template. These certificate templates were provided prior to update of the Kerberos specification that stated Key Distribution Centers (KDCs) performing certificate authentication needed to include the KDC Authentication extension.
+Sign in to a certificate authority or management workstations with *Enterprise Administrator* equivalent credentials
-The Kerberos Authentication certificate template is the most current certificate template designated for domain controllers and should be the one you deploy to all your domain controllers (2008 or later). The autoenrollment feature in Windows enables you to effortlessly replace these domain controller certificates. You can use the following configuration to replace older domain controller certificates with a new certificate using the Kerberos Authentication certificate template.
-
-Sign in to a certificate authority or management workstations with _Enterprise Admin_ equivalent credentials.
-
-1. Open the **Certificate Authority** management console.
-
-2. Right-click **Certificate Templates** and click **Manage**.
-
-3. In the **Certificate Template Console**, right-click the **Domain Controller Authentication (Kerberos)** (or the name of the certificate template you created in the previous section) template in the details pane and click **Properties**.
-
-4. Click the **Superseded Templates** tab. Click **Add**.
-
-5. From the **Add Superseded Template** dialog, select the **Domain Controller** certificate template and click **OK**. Click **Add**.
-
-6. From the **Add Superseded Template** dialog, select the **Domain Controller Authentication** certificate template and click **OK**.
-
-7. From the **Add Superseded Template dialog**, select the **Kerberos Authentication** certificate template and click **OK**.
-
-8. Add any other enterprise certificate templates that were previously configured for domain controllers to the **Superseded Templates** tab.
-
-9. Click **OK** and close the **Certificate Templates** console.
+1. Open the **Certificate Authority** management console
+1. Right-click **Certificate Templates > Manage**
+1. In the **Certificate Template Console**, right-click the *Domain Controller Authentication (Kerberos)* (or the name of the certificate template you created in the previous section) template in the details pane and select **Properties**
+1. Select the **Superseded Templates** tab. Select **Add**
+1. From the **Add Superseded Template** dialog, select the *Domain Controller* certificate template and select **OK > Add**
+1. From the **Add Superseded Template** dialog, select the *Domain Controller Authentication* certificate template and select **OK**
+1. From the **Add Superseded Template dialog**, select the *Kerberos Authentication* certificate template and select **OK**
+1. Add any other enterprise certificate templates that were previously configured for domain controllers to the **Superseded Templates** tab
+1. Select **OK** and close the **Certificate Templates** console
The certificate template is configured to supersede all the certificate templates provided in the certificate templates superseded templates list. However, the certificate template and the superseding of certificate templates is not active until you publish the certificate template to one or more certificate authorities.
@@ -236,10 +236,5 @@ Alternatively, you can forcefully trigger automatic certificate enrollment using
Use the event logs to monitor certificate enrollment and archive. Review the configuration, such as publishing certificate templates to issuing certificate authority and the allow auto enrollment permissions.
-## Follow the Windows Hello for Business on premises key trust deployment guide
-
-1. [Validate Active Directory prerequisites](hello-key-trust-validate-ad-prereq.md)
-2. Validate and Configure Public Key Infrastructure (*You are here*)
-3. [Prepare and Deploy Windows Server 2016 Active Directory Federation Services](hello-key-trust-adfs.md)
-4. [Validate and Deploy Multifactor Authentication Services (MFA)](hello-key-trust-validate-deploy-mfa.md)
-5. [Configure Windows Hello for Business Policy settings](hello-key-trust-policy-settings.md)
+> [!div class="nextstepaction"]
+> [Next: prepare and deploy AD FS >](hello-key-trust-adfs.md)
\ No newline at end of file
From 1872d46ff62e6830e86a5883e0ee99324ae30b36 Mon Sep 17 00:00:00 2001
From: Paolo Matarazzo <74918781+paolomatarazzo@users.noreply.github.com>
Date: Mon, 12 Dec 2022 07:58:27 -0500
Subject: [PATCH 32/81] updates
---
windows/security/includes/hello-hybrid-keycert-trust-aad.md | 2 +-
windows/security/includes/hello-on-premises-key-trust.md | 2 +-
2 files changed, 2 insertions(+), 2 deletions(-)
diff --git a/windows/security/includes/hello-hybrid-keycert-trust-aad.md b/windows/security/includes/hello-hybrid-keycert-trust-aad.md
index abdacf0e93..4c073f0897 100644
--- a/windows/security/includes/hello-hybrid-keycert-trust-aad.md
+++ b/windows/security/includes/hello-hybrid-keycert-trust-aad.md
@@ -7,6 +7,6 @@ ms.topic: include
[!INCLUDE [hello-intro](hello-intro.md)]
- **Deployment type:** [!INCLUDE [hello-deployment-hybrid](hello-deployment-hybrid.md)]
-- **Trust type:** - **Trust type:** [!INCLUDE [hello-trust-key](hello-trust-key.md)], [!INCLUDE [hello-trust-certificate](hello-trust-certificate.md)]
+- **Trust type:** [!INCLUDE [hello-trust-key](hello-trust-key.md)], [!INCLUDE [hello-trust-certificate](hello-trust-certificate.md)]
- **Join type:** [!INCLUDE [hello-join-aadj](hello-join-aad.md)]
---
\ No newline at end of file
diff --git a/windows/security/includes/hello-on-premises-key-trust.md b/windows/security/includes/hello-on-premises-key-trust.md
index 2a31c533c2..f290b0d975 100644
--- a/windows/security/includes/hello-on-premises-key-trust.md
+++ b/windows/security/includes/hello-on-premises-key-trust.md
@@ -7,6 +7,6 @@ ms.topic: include
[!INCLUDE [hello-intro](hello-intro.md)]
- **Deployment type:** [!INCLUDE [hello-deployment-onpremises](hello-deployment-onpremises.md)]
-- **Trust type:** [key trust](../identity-protection/hello-for-business/hello-how-it-works-technology.md#key-trust)
+- **Trust type:** [!INCLUDE [hello-trust-key](hello-trust-key.md)]
- **Join type:** [!INCLUDE [hello-join-domain](hello-join-domain.md)]
---
\ No newline at end of file
From 066958a306d791357e5406e8a5ae6e1774ef028b Mon Sep 17 00:00:00 2001
From: Paolo Matarazzo <74918781+paolomatarazzo@users.noreply.github.com>
Date: Mon, 12 Dec 2022 08:55:48 -0500
Subject: [PATCH 33/81] updates
---
.../hello-key-trust-validate-ad-prereq.md | 2 +-
.../hello-key-trust-validate-pki.md | 84 +++++++++----------
2 files changed, 42 insertions(+), 44 deletions(-)
diff --git a/windows/security/identity-protection/hello-for-business/hello-key-trust-validate-ad-prereq.md b/windows/security/identity-protection/hello-for-business/hello-key-trust-validate-ad-prereq.md
index 6afbd7f245..1d66a37be8 100644
--- a/windows/security/identity-protection/hello-for-business/hello-key-trust-validate-ad-prereq.md
+++ b/windows/security/identity-protection/hello-for-business/hello-key-trust-validate-ad-prereq.md
@@ -12,7 +12,7 @@ ms.topic: tutorial
Key trust deployments need an adequate number of domain controllers to ensure successful user authentication with Windows Hello for Business. To learn more about domain controller planning for key trust deployments, read the [Windows Hello for Business planning guide](hello-planning-guide.md) and the [Planning an adequate number of Domain Controllers for Windows Hello for Business deployments](hello-adequate-domain-controllers.md) section.
-The key registration process for the on-premises deployment of Windows Hello for Business requires the Windows Server 2016 Active Directory or later schema. The key-trust model receives the schema extension when the first Windows Server 2016 domain controller is added to the forest.
+The key registration process for the on-premises deployment of Windows Hello for Business requires the Windows Server 2016 Active Directory or later schema.
## Create the Windows Hello for Business Users security group
diff --git a/windows/security/identity-protection/hello-for-business/hello-key-trust-validate-pki.md b/windows/security/identity-protection/hello-for-business/hello-key-trust-validate-pki.md
index fdcab4e3f3..d199c27b42 100644
--- a/windows/security/identity-protection/hello-for-business/hello-key-trust-validate-pki.md
+++ b/windows/security/identity-protection/hello-for-business/hello-key-trust-validate-pki.md
@@ -12,7 +12,7 @@ ms.topic: tutorial
Windows Hello for Business must have a Public Key Infrastructure (PKI) when using the *key trust* or *certificate trust* models. The domain controllers must have a certificate, which serves as a root of trust for clients, to ensure they are not communicating with a rogue domain controller.
-## Deploy an enterprise certificate authority
+## Deploy an enterprise certification authority
This guide assumes most enterprises have an existing public key infrastructure. Windows Hello for Business depends on an enterprise PKI running the Windows Server *Active Directory Certificate Services* role.
@@ -20,17 +20,17 @@ This guide assumes most enterprises have an existing public key infrastructure.
The following instructions may be used to deploy simple public key infrastructure that is suitable **for a lab environment**.
-Sign in using *Enterprise Administrator* equivalent credentials on a Windows Server where you want the certificate authority installed.
+Sign in using *Enterprise Administrator* equivalent credentials on a Windows Server where you want the certification authority installed.
>[!NOTE]
->Never install a certificate authority on a domain controller in a production environment.
+>Never install a certification authority on a domain controller in a production environment.
1. Open an elevated Windows PowerShell prompt
1. Use the following command to install the Active Directory Certificate Services role.
```PowerShell
Add-WindowsFeature Adcs-Cert-Authority -IncludeManagementTools
```
-3. Use the following command to configure the Certificate Authority using a basic certificate authority configuration
+3. Use the following command to configure the certification authority using a basic certification authority configuration
```PowerShell
Install-AdcsCertificationAuthority
```
@@ -41,39 +41,37 @@ If you do have an existing PKI, review [Certification Authority Guidance](/previ
### Configure Domain Controller Certificates
-Clients must to trust the domain controllers, and the way to do this is to ensure each domain controller has a *Kerberos Authentication* certificate. Installing a certificate on the domain controllers enables the Key Distribution Center (KDC) to prove its identity to other members of the domain. The certificates provide clients a root of trust external to the domain, namely the enterprise certificate authority.
+Clients must to trust the domain controllers, and the way to do this is to ensure each domain controller has a *Kerberos Authentication* certificate. Installing a certificate on the domain controllers enables the Key Distribution Center (KDC) to prove its identity to other members of the domain. The certificates provide clients a root of trust external to the domain, namely the enterprise certification authority.
-Domain controllers automatically request a domain controller certificate (if published) when they discover an enterprise certificate authority is added to Active Directory. However, certificates based on the Domain Controller and Domain Controller Authentication certificate templates do not include the *KDC Authentication* object identifier (OID), which was later added to the Kerberos RFC. Therefore, domain controllers need to request a certificate based on the *Kerberos Authentication* certificate template.
+Domain controllers automatically request a domain controller certificate (if published) when they discover an enterprise certification authority is added to Active Directory. However, certificates based on the Domain Controller and Domain Controller Authentication certificate templates do not include the *KDC Authentication* object identifier (OID), which was later added to the Kerberos RFC. Therefore, domain controllers need to request a certificate based on the *Kerberos Authentication* certificate template.
-By default, the Active Directory certificate authority provides and publishes the *Kerberos Authentication* certificate template. The cryptography configuration included in the template is based on older and less performant cryptography APIs. To ensure domain controllers request the proper certificate with the best available cryptography, use the *Kerberos Authentication* certificate template as a *baseline* to create an updated domain controller certificate template.
+By default, the Active Directory certification authority provides and publishes the *Kerberos Authentication* certificate template. The cryptography configuration included in the template is based on older and less performant cryptography APIs. To ensure domain controllers request the proper certificate with the best available cryptography, use the *Kerberos Authentication* certificate template as a *baseline* to create an updated domain controller certificate template.
-Sign in to a certificate authority or management workstations with *Domain Admintistrator* equivalent credentials.
+Sign in to a certification authority or management workstations with *Domain Admintistrator* equivalent credentials.
-1. Open the **Certificate Authority** management console
+1. Open the **Certification Authority** management console
1. Right-click **Certificate Templates > Manage**
1. In the **Certificate Template Console**, right-click the **Kerberos Authentication** template in the details pane and select **Duplicate Template**
1. On the **Compatibility** tab:
- - Clear the **Show resulting changes** check box
- - Select **Windows Server 2008 R2** from the **Certification Authority** list
- - Select **Windows 7.Server 2008 R2** from the **Certification Recipient** list
+ - Clear the **Show resulting changes** check box
+ - Select **Windows Server 2016** from the **Certification Authority** list
+ - Select **Windows 10 / Windows Server 2016** from the **Certification Recipient** list
1. On the **General** tab
- - Type *Domain Controller Authentication (Kerberos)* in Template display name
- - Adjust the validity and renewal period to meet your enterprise's needs
-
- > [!NOTE]
- > If you use different template names, you'll need to remember and substitute these names in different portions of the lab.
-
+ - Type *Domain Controller Authentication (Kerberos)* in Template display name
+ - Adjust the validity and renewal period to meet your enterprise's needs
+ > [!NOTE]
+ > If you use different template names, you'll need to remember and substitute these names in different portions of the lab.
1. On the **Subject Name** tab:
- - Select the **Build from this Active Directory information** button if it is not already selected
- - Select **None** from the **Subject name format** list
- - Select **DNS name** from the **Include this information in alternate subject** list
- - Clear all other items
+ - Select the **Build from this Active Directory information** button if it is not already selected
+ - Select **None** from the **Subject name format** list
+ - Select **DNS name** from the **Include this information in alternate subject** list
+ - Clear all other items
1. On the **Cryptography** tab:
- - select **Key Storage Provider** from the **Provider Category** list
- - Select **RSA** from the **Algorithm name** list
- - Type *2048* in the **Minimum key size** text box
- - Select **SHA256** from the **Request hash** list
-1. Select **OK**
+ - select **Key Storage Provider** from the **Provider Category** list
+ - Select **RSA** from the **Algorithm name** list
+ - Type *2048* in the **Minimum key size** text box
+ - Select **SHA256** from the **Request hash** list
+1. Select **OK**
1. Close the console
### Supersede the existing domain controller certificate
@@ -83,27 +81,27 @@ The domain controllers may have an existing domain controller certificate. The A
The *Kerberos Authentication* certificate template is the most current certificate template designated for domain controllers, and should be the one you deploy to all your domain controllers.\
The *autoenrollment* feature allows to easily replace the domain controller certificates. Use the following configuration to replace older domain controller certificates with new ones, using the *Kerberos Authentication* certificate template.
-Sign in to a certificate authority or management workstations with *Enterprise Administrator* equivalent credentials
+Sign in to a certification authority or management workstations with *Enterprise Administrator* equivalent credentials
-1. Open the **Certificate Authority** management console
+1. Open the **Certification Authority** management console
1. Right-click **Certificate Templates > Manage**
1. In the **Certificate Template Console**, right-click the *Domain Controller Authentication (Kerberos)* (or the name of the certificate template you created in the previous section) template in the details pane and select **Properties**
1. Select the **Superseded Templates** tab. Select **Add**
1. From the **Add Superseded Template** dialog, select the *Domain Controller* certificate template and select **OK > Add**
1. From the **Add Superseded Template** dialog, select the *Domain Controller Authentication* certificate template and select **OK**
-1. From the **Add Superseded Template dialog**, select the *Kerberos Authentication* certificate template and select **OK**
+1. From the **Add Superseded Template** dialog, select the *Kerberos Authentication* certificate template and select **OK**
1. Add any other enterprise certificate templates that were previously configured for domain controllers to the **Superseded Templates** tab
1. Select **OK** and close the **Certificate Templates** console
-The certificate template is configured to supersede all the certificate templates provided in the certificate templates superseded templates list. However, the certificate template and the superseding of certificate templates is not active until you publish the certificate template to one or more certificate authorities.
+The certificate template is configured to supersede all the certificate templates provided in the certificate templates superseded templates list. However, the certificate template and the superseding of certificate templates is not active until the certificate template is published to one or more certificate authorities.
### Configure an Internal Web Server Certificate template
Windows clients use the https protocol when communicating with Active Directory Federation Services. To meet this need, you must issue a server authentication certificate to all the nodes in the Active Directory Federation Services farm. On-premises deployments can use a server authentication certificate issued by their enterprise PKI. You must configure a server authentication certificate template so the host running the Active Directory Federation Service can request the certificate.
-Sign in to a certificate authority or management workstations with _Domain Admin_ equivalent credentials.
+Sign in to a certification authority or management workstations with _Domain Admin_ equivalent credentials.
-1. Open the **Certificate Authority** management console.
+1. Open the **Certification Authority** management console.
2. Right-click **Certificate Templates** and click **Manage**.
@@ -128,13 +126,13 @@ Sign in to a certificate authority or management workstations with _Domain Admin
### Unpublish Superseded Certificate Templates
-The certificate authority only issues certificates based on published certificate templates. For defense in depth security, it is a good practice to unpublish certificate templates that the certificate authority is not configured to issue. This includes the pre-published certificate template from the role installation and any superseded certificate templates.
+The certification authority only issues certificates based on published certificate templates. For defense in depth security, it is a good practice to unpublish certificate templates that the certification authority is not configured to issue. This includes the pre-published certificate template from the role installation and any superseded certificate templates.
The newly created domain controller authentication certificate template supersedes previous domain controller certificate templates. Therefore, you need to unpublish these certificate templates from all issuing certificate authorities.
-Sign in to the certificate authority or management workstation with _Enterprise Admin_ equivalent credentials.
+Sign in to the certification authority or management workstation with _Enterprise Admin_ equivalent credentials.
-1. Open the **Certificate Authority** management console.
+1. Open the **Certification Authority** management console.
2. Expand the parent node from the navigation pane.
@@ -144,13 +142,13 @@ Sign in to the certificate authority or management workstation with _Enterprise
5. Repeat step 4 for the **Domain Controller Authentication** and **Kerberos Authentication** certificate templates.
-### Publish Certificate Templates to the Certificate Authority
+### Publish Certificate Templates to the certification authority
-The certificate authority may only issue certificates for certificate templates that are published to that certificate authority. If you have more than one certificate authority and you want that certificate authority to issue certificates based on a specific certificate template, then you must publish the certificate template to all certificate authorities that are expected to issue the certificate.
+The certification authority may only issue certificates for certificate templates that are published to that certification authority. If you have more than one certification authority and you want that certification authority to issue certificates based on a specific certificate template, then you must publish the certificate template to all certificate authorities that are expected to issue the certificate.
-Sign in to the certificate authority or management workstations with **Enterprise Admin** equivalent credentials.
+Sign in to the certification authority or management workstations with **Enterprise Admin** equivalent credentials.
-1. Open the **Certificate Authority** management console.
+1. Open the **Certification Authority** management console.
2. Expand the parent node from the navigation pane.
@@ -158,11 +156,11 @@ Sign in to the certificate authority or management workstations with **Enterpris
4. Right-click the **Certificate Templates** node. Click **New**, and click **Certificate Template** to issue.
-5. In the **Enable Certificates Templates** window, select the **Domain Controller Authentication (Kerberos)**, and **Internal Web Server** templates you created in the previous steps. Click **OK** to publish the selected certificate templates to the certificate authority.
+5. In the **Enable Certificates Templates** window, select the **Domain Controller Authentication (Kerberos)**, and **Internal Web Server** templates you created in the previous steps. Click **OK** to publish the selected certificate templates to the certification authority.
6. If you published the Domain Controller Authentication (Kerberos) certificate template, then you should unpublish the certificate templates you included in the superseded templates list.
- \* To unpublish a certificate template, right-click the certificate template you want to unpublish in the details pane of the Certificate Authority console and select **Delete**. Click **Yes** to confirm the operation.
+ \* To unpublish a certificate template, right-click the certificate template you want to unpublish in the details pane of the certification authority console and select **Delete**. Click **Yes** to confirm the operation.
7. Close the console.
@@ -234,7 +232,7 @@ Windows triggers automatic certificate enrollment for the computer during boot,
Alternatively, you can forcefully trigger automatic certificate enrollment using `certreq -autoenroll -q` from an elevated command prompt.
-Use the event logs to monitor certificate enrollment and archive. Review the configuration, such as publishing certificate templates to issuing certificate authority and the allow auto enrollment permissions.
+Use the event logs to monitor certificate enrollment and archive. Review the configuration, such as publishing certificate templates to issuing certification authority and the allow auto enrollment permissions.
> [!div class="nextstepaction"]
> [Next: prepare and deploy AD FS >](hello-key-trust-adfs.md)
\ No newline at end of file
From 97652a4827466b317db61e9a48865e2e48e9909d Mon Sep 17 00:00:00 2001
From: Paolo Matarazzo <74918781+paolomatarazzo@users.noreply.github.com>
Date: Mon, 12 Dec 2022 09:19:27 -0500
Subject: [PATCH 34/81] updates
---
.../hello-key-trust-validate-pki.md | 187 +++++++++---------
1 file changed, 89 insertions(+), 98 deletions(-)
diff --git a/windows/security/identity-protection/hello-for-business/hello-key-trust-validate-pki.md b/windows/security/identity-protection/hello-for-business/hello-key-trust-validate-pki.md
index d199c27b42..e8935dcb1b 100644
--- a/windows/security/identity-protection/hello-for-business/hello-key-trust-validate-pki.md
+++ b/windows/security/identity-protection/hello-for-business/hello-key-trust-validate-pki.md
@@ -10,7 +10,7 @@ ms.topic: tutorial
[!INCLUDE [hello-on-premises-key-trust](../../includes/hello-on-premises-key-trust.md)]
-Windows Hello for Business must have a Public Key Infrastructure (PKI) when using the *key trust* or *certificate trust* models. The domain controllers must have a certificate, which serves as a root of trust for clients, to ensure they are not communicating with a rogue domain controller.
+Windows Hello for Business must have a Public Key Infrastructure (PKI) when using the *key trust* or *certificate trust* models. The domain controllers must have a certificate, which serves as a root of trust for clients, to ensure they are not communicating with a rogue domain controller.
## Deploy an enterprise certification authority
@@ -37,9 +37,9 @@ Sign in using *Enterprise Administrator* equivalent credentials on a Windows Ser
## Configure a PKI
-If you do have an existing PKI, review [Certification Authority Guidance](/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/hh831574(v=ws.11)) to properly design your infrastructure. Then, consult the [Test Lab Guide: Deploying an AD CS Two-Tier PKI Hierarchy](/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/hh831348(v=ws.11)) for instructions on how to configure your PKI using the information from your design session.
+If you have an existing PKI, review [Certification Authority Guidance](/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/hh831574(v=ws.11)) to properly design your infrastructure. Then, consult the [Test Lab Guide: Deploying an AD CS Two-Tier PKI Hierarchy](/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/hh831348(v=ws.11)) for instructions on how to configure your PKI using the information from your design session.
-### Configure Domain Controller Certificates
+### Configure domain controller certificates
Clients must to trust the domain controllers, and the way to do this is to ensure each domain controller has a *Kerberos Authentication* certificate. Installing a certificate on the domain controllers enables the Key Distribution Center (KDC) to prove its identity to other members of the domain. The certificates provide clients a root of trust external to the domain, namely the enterprise certification authority.
@@ -74,14 +74,14 @@ Sign in to a certification authority or management workstations with *Domain Adm
1. Select **OK**
1. Close the console
-### Supersede the existing domain controller certificate
+### Supersede existing domain controller certificates
-The domain controllers may have an existing domain controller certificate. The Active Directory Certificate Services provides a default certificate template for domain controllers called *domain controller certificate*. Later releases of Windows Server provided a new certificate template called *domain controller authentication certificate*. These certificate templates were provided prior to the update of the Kerberos specification that stated Key Distribution Centers (KDCs) performing certificate authentication needed to include the *KDC Authentication* extension.
+The domain controllers may have an existing domain controller certificate. The Active Directory Certificate Services provides a default certificate template for domain controllers called *domain controller certificate*. Later releases of Windows Server provided a new certificate template called *domain controller authentication certificate*. These certificate templates were provided prior to the update of the Kerberos specification that stated Key Distribution Centers (KDCs) performing certificate authentication needed to include the *KDC Authentication* extension.
The *Kerberos Authentication* certificate template is the most current certificate template designated for domain controllers, and should be the one you deploy to all your domain controllers.\
The *autoenrollment* feature allows to easily replace the domain controller certificates. Use the following configuration to replace older domain controller certificates with new ones, using the *Kerberos Authentication* certificate template.
-Sign in to a certification authority or management workstations with *Enterprise Administrator* equivalent credentials
+Sign in to a certification authority or management workstations with *Enterprise Administrator* equivalent credentials.
1. Open the **Certification Authority** management console
1. Right-click **Certificate Templates > Manage**
@@ -95,42 +95,46 @@ Sign in to a certification authority or management workstations with *Enterprise
The certificate template is configured to supersede all the certificate templates provided in the certificate templates superseded templates list. However, the certificate template and the superseding of certificate templates is not active until the certificate template is published to one or more certificate authorities.
-### Configure an Internal Web Server Certificate template
+### Configure an internal web server certificate template
-Windows clients use the https protocol when communicating with Active Directory Federation Services. To meet this need, you must issue a server authentication certificate to all the nodes in the Active Directory Federation Services farm. On-premises deployments can use a server authentication certificate issued by their enterprise PKI. You must configure a server authentication certificate template so the host running the Active Directory Federation Service can request the certificate.
+Windows clients use the https protocol when communicating with Active Directory Federation Services (AD FS). To meet this need, you must issue a server authentication certificate to all the nodes in the AD FS farm. On-premises deployments can use a server authentication certificate issued by their enterprise PKI. You must configure a server authentication certificate template so the host running theAD FS can request the certificate.
-Sign in to a certification authority or management workstations with _Domain Admin_ equivalent credentials.
+Sign in to a certification authority or management workstations with *Domain Administrator* equivalent credentials.
-1. Open the **Certification Authority** management console.
-
-2. Right-click **Certificate Templates** and click **Manage**.
-
-3. In the **Certificate Template Console**, right-click the **Web Server** template in the details pane and click **Duplicate Template**.
-
-4. On the **Compatibility** tab, clear the **Show resulting changes** check box. Select **Windows Server 2012** or **Windows Server 2012 R2** from the **Certification Authority** list. Select **Windows Server 2012** or **Windows Server 2012 R2** from the **Certification Recipient** list.
-
-5. On the **General** tab, type **Internal Web Server** in **Template display name**. Adjust the validity and renewal period to meet your enterprise’s needs.
-
- > [!NOTE]
- > If you use different template names, you’ll need to remember and substitute these names in different portions of the lab.
-
-6. On the **Request Handling** tab, select **Allow private key to be exported**.
-
-7. On the **Subject** tab, select the **Supply in the request** button if it is not already selected.
-
-8. On the **Security** tab, Click **Add**. Type **Domain Computers** in the **Enter the object names to select** box. Click **OK**. Select the **Allow** check box next to the **Enroll** permission.
-
-9. On the **Cryptography** tab, select **Key Storage Provider** from the **Provider Category** list. Select **RSA** from the **Algorithm name** list. Type **2048** in the **Minimum key size** text box. Select **SHA256** from the **Request hash** list. Click **OK**.
-
-10. Close the console.
+1. Open the **Certification Authority** management console
+1. Right-click **Certificate Templates** and select **Manage**
+1. In the **Certificate Template Console**, right-click the **Web Server** template in the details pane and select **Duplicate Template**
+1. On the **Compatibility** tab:
+ - Clear the **Show resulting changes** check box
+ - Select **Windows Server 2016** from the **Certification Authority** list
+ - Select **Windows 10 / Windows Server 2016** from the **Certification Recipient** list
+1. On the **General** tab:
+ - Type *Internal Web Server* in **Template display name**
+ - Adjust the validity and renewal period to meet your enterprise's needs
+ > [!NOTE]
+ > If you use different template names, you'll need to remember and substitute these names in different portions of the lab.
+1. On the **Request Handling** tab, select **Allow private key to be exported**
+1. On the **Subject** tab, select the **Supply in the request** button if it is not already selected
+1. On the **Security** tab:
+ - Select **Add**
+ - Type **Domain Computers** in the **Enter the object names to select** box
+ - Select **OK**
+ - Select the **Allow** check box next to the **Enroll** permission
+1. On the **Cryptography** tab:
+ - Select **Key Storage Provider** from the **Provider Category** list
+ - Select **RSA** from the **Algorithm name** list
+ - Type *2048* in the **Minimum key size** text box
+ - Select **SHA256** from the **Request hash** list
+ - Select **OK**
+1. Close the console
### Unpublish Superseded Certificate Templates
-The certification authority only issues certificates based on published certificate templates. For defense in depth security, it is a good practice to unpublish certificate templates that the certification authority is not configured to issue. This includes the pre-published certificate template from the role installation and any superseded certificate templates.
+The certification authority only issues certificates based on published certificate templates. For defense in depth security, it is a good practice to unpublish certificate templates that the certification authority is not configured to issue. This includes the pre-published certificate template from the role installation and any superseded certificate templates.
-The newly created domain controller authentication certificate template supersedes previous domain controller certificate templates. Therefore, you need to unpublish these certificate templates from all issuing certificate authorities.
+The newly created *domain controller authentication* certificate template supersedes previous domain controller certificate templates. Therefore, you need to unpublish these certificate templates from all issuing certificate authorities.
-Sign in to the certification authority or management workstation with _Enterprise Admin_ equivalent credentials.
+Sign in to the certification authority or management workstation with *Enterprise Administrator* equivalent credentials.
1. Open the **Certification Authority** management console.
@@ -138,101 +142,88 @@ Sign in to the certification authority or management workstation with _Enterpris
3. Click **Certificate Templates** in the navigation pane.
-4. Right-click the **Domain Controller** certificate template in the content pane and select **Delete**. Click **Yes** on the **Disable certificate templates** window.
+4. Right-click the **Domain Controller** certificate template in the content pane and select **Delete**. Click **Yes** on the **Disable certificate templates** window.
5. Repeat step 4 for the **Domain Controller Authentication** and **Kerberos Authentication** certificate templates.
### Publish Certificate Templates to the certification authority
-The certification authority may only issue certificates for certificate templates that are published to that certification authority. If you have more than one certification authority and you want that certification authority to issue certificates based on a specific certificate template, then you must publish the certificate template to all certificate authorities that are expected to issue the certificate.
+The certification authority may only issue certificates for certificate templates that are published to that certification authority. If you have more than one certification authority and you want that certification authority to issue certificates based on a specific certificate template, then you must publish the certificate template to all certificate authorities that are expected to issue the certificate.
Sign in to the certification authority or management workstations with **Enterprise Admin** equivalent credentials.
-1. Open the **Certification Authority** management console.
+1. Open the **Certification Authority** management console
+1. Expand the parent node from the navigation pane
+1. Select **Certificate Templates** in the navigation pane
+1. Right-click the **Certificate Templates** node. Select **New > Certificate Template** to issue
+1. In the **Enable Certificates Templates** window, select the *Domain Controller Authentication (Kerberos)*, and *Internal Web Server* templates you created in the previous steps. Select **OK** to publish the selected certificate templates to the certification authority
+1. If you published the *Domain Controller Authentication (Kerberos)* certificate template, then unpublish the certificate templates you included in the superseded templates list
+ - To unpublish a certificate template, right-click the certificate template you want to unpublish and select **Delete**. Select **Yes** to confirm the operation
+1. Close the console
-2. Expand the parent node from the navigation pane.
+### Configure automatic certificate enrollment for the domain controllers
-3. Click **Certificate Templates** in the navigation pane.
+Domain controllers automatically request a certificate from the *Domain controller certificate* template. However, domain controllers are unaware of newer certificate templates or superseded configurations on certificate templates. To continue automatic enrollment and renewal of domain controller certificates that understand newer certificate template and superseded certificate template configurations, create and configure a Group Policy object for automatic certificate enrollment, linking the Group Policy object to the *Domain Controllers* OU.
-4. Right-click the **Certificate Templates** node. Click **New**, and click **Certificate Template** to issue.
-
-5. In the **Enable Certificates Templates** window, select the **Domain Controller Authentication (Kerberos)**, and **Internal Web Server** templates you created in the previous steps. Click **OK** to publish the selected certificate templates to the certification authority.
-
-6. If you published the Domain Controller Authentication (Kerberos) certificate template, then you should unpublish the certificate templates you included in the superseded templates list.
-
- \* To unpublish a certificate template, right-click the certificate template you want to unpublish in the details pane of the certification authority console and select **Delete**. Click **Yes** to confirm the operation.
-
-7. Close the console.
-
-### Configure Domain Controllers for Automatic Certificate Enrollment
-
-Domain controllers automatically request a certificate from the domain controller certificate template. However, the domain controller is unaware of newer certificate templates or superseded configurations on certificate templates. To continue automatic enrollment and renewal of domain controller certificates that understand newer certificate template and superseded certificate template configurations, create and configure a Group Policy object for automatic certificate enrollment and link the Group Policy object to the Domain Controllers OU.
-
-1. Start the **Group Policy Management Console** (gpmc.msc)
-
-2. Expand the domain and select the **Group Policy Object** node in the navigation pane.
-
-3. Right-click **Group Policy object** and select **New**
-
-4. Type *Domain Controller Auto Certificate Enrollment* in the name box and click **OK**.
-
-5. Right-click the **Domain Controller Auto Certificate Enrollment** Group Policy object and click **Edit**.
-
-6. In the navigation pane, expand **Policies** under **Computer Configuration**.
-
-7. Expand **Windows Settings**, **Security Settings**, and click **Public Key Policies**.
-
-8. In the details pane, right-click **Certificate Services Client – Auto-Enrollment** and select **Properties**.
-
-9. Select **Enabled** from the **Configuration Model** list.
-
-10. Select the **Renew expired certificates, update pending certificates, and remove revoked certificates** check box.
-
-11. Select the **Update certificates that use certificate templates** check box.
-
-12. Click **OK**. Close the **Group Policy Management Editor**.
+1. Open the **Group Policy Management Console** (gpmc.msc)
+1. Expand the domain and select the **Group Policy Object** node in the navigation pane
+1. Right-click **Group Policy object** and select **New**
+1. Type *Domain Controller Auto Certificate Enrollment* in the name box and select **OK**
+1. Right-click the **Domain Controller Auto Certificate Enrollment** Group Policy object and select **Edit**
+1. In the navigation pane, expand **Policies** under **Computer Configuration**
+1. Expand **Windows Settings > Security Settings > Public Key Policies**
+1. In the details pane, right-click **Certificate Services Client - Auto-Enrollment** and select **Properties**
+1. Select **Enabled** from the **Configuration Model** list
+1. Select the **Renew expired certificates, update pending certificates, and remove revoked certificates** check box
+1. Select the **Update certificates that use certificate templates** check box
+1. Select **OK**
+1. Close the **Group Policy Management Editor**
### Deploy the Domain Controller Auto Certificate Enrollment Group Policy Object
-Sign in to domain controller or management workstations with _Domain Admin_ equivalent credentials.
+Sign in to domain controller or management workstations with *Domain Administrator* equivalent credentials.
-1. Start the **Group Policy Management Console** (gpmc.msc).
+1. Start the **Group Policy Management Console** (gpmc.msc)
+1. In the navigation pane, expand the domain and expand the node with the Active Directory domain name. Right-click the **Domain Controllers** organizational unit and select **Link an existing GPO…**
+1. In the **Select GPO** dialog box, select *Domain Controller Auto Certificate Enrollment* or the name of the domain controller certificate enrollment Group Policy object you previously created
+1. Select **OK**
-2. In the navigation pane, expand the domain and expand the node that has your Active Directory domain name. Right-click the **Domain Controllers** organizational unit and click **Link an existing GPO…**.
+## Validate the configuration
-3. In the **Select GPO** dialog box, select **Domain Controller Auto Certificate Enrollment** or the name of the domain controller certificate enrollment Group Policy object you previously created and click **OK**.
+Windows Hello for Business is a distributed system, which on the surface appears complex and difficult. The key to a successful Windows Hello for Business deployment is to validate phases of work prior to moving to the next phase.
-### Validating your work
+You want to confirm your domain controllers enroll the correct certificates and not any unnecessary (superseded) certificate templates. You need to check each domain controller that autoenrollment for the computer occurred.
-Windows Hello for Business is a distributed system, which on the surface appears complex and difficult. The key to a successful Windows Hello for Business deployment is to validate phases of work prior to moving to the next phase.
+### Use the Event Logs
-You want to confirm your domain controllers enroll the correct certificates and not any unnecessary (superseded) certificate templates. You need to check each domain controller that autoenrollment for the computer occurred.
+Sign in to domain controller or management workstations with *Domain Administrator* equivalent credentials.
-#### Use the Event Logs
+1. Using the Event Viewer, navigate to the **Application and Services > Microsoft > Windows > CertificateServices-Lifecycles-System** event log
+1. Look for an event indicating a new certificate enrollment (autoenrollment):
+ - The details of the event include the certificate template on which the certificate was issued
+ - The name of the certificate template used to issue the certificate should match the certificate template name included in the event
+ - The certificate thumbprint and EKUs for the certificate are also included in the event
+ - The EKU needed for proper Windows Hello for Business authentication is Kerberos Authentication, in addition to other EKUs provide by the certificate template
-Windows Server 2012 and later include Certificate Lifecycle events to determine the lifecycles of certificates for both users and computers. Using the Event Viewer, navigate to the CertificateServices-Lifecycles-System event log under Application and Services/Microsoft/Windows.
+Certificates superseded by your new domain controller certificate generate an archive event in the event log. The archive event contains the certificate template name and thumbprint of the certificate that was superseded by the new certificate.
-Look for an event indicating a new certificate enrollment (autoenrollment). The details of the event include the certificate template on which the certificate was issued. The name of the certificate template used to issue the certificate should match the certificate template name included in the event. The certificate thumbprint and EKUs for the certificate are also included in the event. The EKU needed for proper Windows Hello for Business authentication is Kerberos Authentication, in addition to other EKUs provide by the certificate template.
+### Certificate Manager
-Certificates superseded by your new domain controller certificate generate an archive event in the CertificateServices-Lifecycles-System event. The archive event contains the certificate template name and thumbprint of the certificate that was superseded by the new certificate.
+You can use the Certificate Manager console to validate the domain controller has the properly enrolled certificate based on the correct certificate template with the proper EKUs. Use **certlm.msc** to view certificate in the local computers certificate stores. Expand the **Personal** store and view the certificates enrolled for the computer. Archived certificates do not appear in Certificate Manager.
-#### Certificate Manager
+### Certutil.exe
-You can use the Certificate Manager console to validate the domain controller has the properly enrolled certificate based on the correct certificate template with the proper EKUs. Use **certlm.msc** to view certificate in the local computers certificate stores. Expand the **Personal** store and view the certificates enrolled for the computer. Archived certificates do not appear in Certificate Manager.
+You can use `certutil.exe` command to view enrolled certificates in the local computer. Certutil shows enrolled and archived certificates for the local computer. From an elevated command prompt, run `certutil.exe -q -store my` to view locally enrolled certificates.
-#### Certutil.exe
+To view detailed information about each certificate in the store, use `certutil.exe -q -v -store my` to validate automatic certificate enrollment enrolled the proper certificates.
-You can use **certutil.exe** to view enrolled certificates in the local computer. Certutil shows enrolled and archived certificates for the local computer. From an elevated command prompt, run `certutil -q -store my` to view locally enrolled certificates.
+### Troubleshooting
-To view detailed information about each certificate in the store, use `certutil -q -v -store my` to validate automatic certificate enrollment enrolled the proper certificates.
+Windows triggers automatic certificate enrollment for the computer during boot, and when Group Policy updates. You can refresh Group Policy from an elevated command prompt using `gpupdate.exe /force`.
-#### Troubleshooting
+Alternatively, you can forcefully trigger automatic certificate enrollment using `certreq.exe -autoenroll -q` from an elevated command prompt.
-Windows triggers automatic certificate enrollment for the computer during boot, and when Group Policy updates. You can refresh Group Policy from an elevated command prompt using `gpupdate /force`.
-
-Alternatively, you can forcefully trigger automatic certificate enrollment using `certreq -autoenroll -q` from an elevated command prompt.
-
-Use the event logs to monitor certificate enrollment and archive. Review the configuration, such as publishing certificate templates to issuing certification authority and the allow auto enrollment permissions.
+Use the event logs to monitor certificate enrollment and archive. Review the configuration, such as publishing certificate templates to issuing certification authority and the allow auto enrollment permissions.
> [!div class="nextstepaction"]
> [Next: prepare and deploy AD FS >](hello-key-trust-adfs.md)
\ No newline at end of file
From 80e5c86d7414d579faa6de135362f52cdb244f13 Mon Sep 17 00:00:00 2001
From: Paolo Matarazzo <74918781+paolomatarazzo@users.noreply.github.com>
Date: Mon, 12 Dec 2022 09:41:30 -0500
Subject: [PATCH 35/81] updates
---
.../hello-key-trust-validate-pki.md | 57 +++++++++----------
.../security/includes/hello-join-domain.md | 2 +-
.../security/includes/hello-join-hybrid.md | 2 +-
3 files changed, 28 insertions(+), 33 deletions(-)
diff --git a/windows/security/identity-protection/hello-for-business/hello-key-trust-validate-pki.md b/windows/security/identity-protection/hello-for-business/hello-key-trust-validate-pki.md
index e8935dcb1b..ae2142daec 100644
--- a/windows/security/identity-protection/hello-for-business/hello-key-trust-validate-pki.md
+++ b/windows/security/identity-protection/hello-for-business/hello-key-trust-validate-pki.md
@@ -10,7 +10,7 @@ ms.topic: tutorial
[!INCLUDE [hello-on-premises-key-trust](../../includes/hello-on-premises-key-trust.md)]
-Windows Hello for Business must have a Public Key Infrastructure (PKI) when using the *key trust* or *certificate trust* models. The domain controllers must have a certificate, which serves as a root of trust for clients, to ensure they are not communicating with a rogue domain controller.
+Windows Hello for Business must have a Public Key Infrastructure (PKI) when using the *key trust* or *certificate trust* models. The domain controllers must have a certificate, which serves as a root of trust for clients. The certificate ensures that clients don't communicate with rogue domain controllers.
## Deploy an enterprise certification authority
@@ -20,7 +20,7 @@ This guide assumes most enterprises have an existing public key infrastructure.
The following instructions may be used to deploy simple public key infrastructure that is suitable **for a lab environment**.
-Sign in using *Enterprise Administrator* equivalent credentials on a Windows Server where you want the certification authority installed.
+Sign in using *Enterprise Administrator* equivalent credentials on a Windows Server where you want the certification authority (CA) installed.
>[!NOTE]
>Never install a certification authority on a domain controller in a production environment.
@@ -30,7 +30,7 @@ Sign in using *Enterprise Administrator* equivalent credentials on a Windows Ser
```PowerShell
Add-WindowsFeature Adcs-Cert-Authority -IncludeManagementTools
```
-3. Use the following command to configure the certification authority using a basic certification authority configuration
+3. Use the following command to configure the CA using a basic certification authority configuration
```PowerShell
Install-AdcsCertificationAuthority
```
@@ -41,13 +41,13 @@ If you have an existing PKI, review [Certification Authority Guidance](/previous
### Configure domain controller certificates
-Clients must to trust the domain controllers, and the way to do this is to ensure each domain controller has a *Kerberos Authentication* certificate. Installing a certificate on the domain controllers enables the Key Distribution Center (KDC) to prove its identity to other members of the domain. The certificates provide clients a root of trust external to the domain, namely the enterprise certification authority.
+Clients must trust the domain controllers, and to it each domain controller must have a *Kerberos Authentication* certificate. Installing a certificate on the domain controllers enables the Key Distribution Center (KDC) to prove its identity to other members of the domain. The certificates provide clients a root of trust external to the domain, namely the *enterprise certification authority*.
-Domain controllers automatically request a domain controller certificate (if published) when they discover an enterprise certification authority is added to Active Directory. However, certificates based on the Domain Controller and Domain Controller Authentication certificate templates do not include the *KDC Authentication* object identifier (OID), which was later added to the Kerberos RFC. Therefore, domain controllers need to request a certificate based on the *Kerberos Authentication* certificate template.
+Domain controllers automatically request a domain controller certificate (if published) when they discover an enterprise CA is added to Active Directory. However, certificates based on the Domain Controller and Domain Controller Authentication certificate templates don't include the *KDC Authentication* object identifier (OID), which was later added to the Kerberos RFC. Therefore, domain controllers need to request a certificate based on the *Kerberos Authentication* certificate template.
-By default, the Active Directory certification authority provides and publishes the *Kerberos Authentication* certificate template. The cryptography configuration included in the template is based on older and less performant cryptography APIs. To ensure domain controllers request the proper certificate with the best available cryptography, use the *Kerberos Authentication* certificate template as a *baseline* to create an updated domain controller certificate template.
+By default, the Active Directory CA provides and publishes the *Kerberos Authentication* certificate template. The cryptography configuration included in the template is based on older and less performant cryptography APIs. To ensure domain controllers request the proper certificate with the best available cryptography, use the *Kerberos Authentication* certificate template as a *baseline* to create an updated domain controller certificate template.
-Sign in to a certification authority or management workstations with *Domain Admintistrator* equivalent credentials.
+Sign in to a CA or management workstations with *Domain Admintistrator* equivalent credentials.
1. Open the **Certification Authority** management console
1. Right-click **Certificate Templates > Manage**
@@ -62,7 +62,7 @@ Sign in to a certification authority or management workstations with *Domain Adm
> [!NOTE]
> If you use different template names, you'll need to remember and substitute these names in different portions of the lab.
1. On the **Subject Name** tab:
- - Select the **Build from this Active Directory information** button if it is not already selected
+ - Select the **Build from this Active Directory information** button if it isn't already selected
- Select **None** from the **Subject name format** list
- Select **DNS name** from the **Include this information in alternate subject** list
- Clear all other items
@@ -79,9 +79,9 @@ Sign in to a certification authority or management workstations with *Domain Adm
The domain controllers may have an existing domain controller certificate. The Active Directory Certificate Services provides a default certificate template for domain controllers called *domain controller certificate*. Later releases of Windows Server provided a new certificate template called *domain controller authentication certificate*. These certificate templates were provided prior to the update of the Kerberos specification that stated Key Distribution Centers (KDCs) performing certificate authentication needed to include the *KDC Authentication* extension.
The *Kerberos Authentication* certificate template is the most current certificate template designated for domain controllers, and should be the one you deploy to all your domain controllers.\
-The *autoenrollment* feature allows to easily replace the domain controller certificates. Use the following configuration to replace older domain controller certificates with new ones, using the *Kerberos Authentication* certificate template.
+The *autoenrollment* feature allows to replace the domain controller certificates. Use the following configuration to replace older domain controller certificates with new ones, using the *Kerberos Authentication* certificate template.
-Sign in to a certification authority or management workstations with *Enterprise Administrator* equivalent credentials.
+Sign in to a CA or management workstations with *Enterprise Administrator* equivalent credentials.
1. Open the **Certification Authority** management console
1. Right-click **Certificate Templates > Manage**
@@ -93,13 +93,13 @@ Sign in to a certification authority or management workstations with *Enterprise
1. Add any other enterprise certificate templates that were previously configured for domain controllers to the **Superseded Templates** tab
1. Select **OK** and close the **Certificate Templates** console
-The certificate template is configured to supersede all the certificate templates provided in the certificate templates superseded templates list. However, the certificate template and the superseding of certificate templates is not active until the certificate template is published to one or more certificate authorities.
+The certificate template is configured to supersede all the certificate templates provided in the certificate templates superseded templates list. However, the certificate template and the superseding of certificate templates isn't active until the certificate template is published to one or more certificate authorities.
### Configure an internal web server certificate template
Windows clients use the https protocol when communicating with Active Directory Federation Services (AD FS). To meet this need, you must issue a server authentication certificate to all the nodes in the AD FS farm. On-premises deployments can use a server authentication certificate issued by their enterprise PKI. You must configure a server authentication certificate template so the host running theAD FS can request the certificate.
-Sign in to a certification authority or management workstations with *Domain Administrator* equivalent credentials.
+Sign in to a CA or management workstations with *Domain Administrator* equivalent credentials.
1. Open the **Certification Authority** management console
1. Right-click **Certificate Templates** and select **Manage**
@@ -114,7 +114,7 @@ Sign in to a certification authority or management workstations with *Domain Adm
> [!NOTE]
> If you use different template names, you'll need to remember and substitute these names in different portions of the lab.
1. On the **Request Handling** tab, select **Allow private key to be exported**
-1. On the **Subject** tab, select the **Supply in the request** button if it is not already selected
+1. On the **Subject** tab, select the **Supply in the request** button if it isn't already selected
1. On the **Security** tab:
- Select **Add**
- Type **Domain Computers** in the **Enter the object names to select** box
@@ -130,27 +130,22 @@ Sign in to a certification authority or management workstations with *Domain Adm
### Unpublish Superseded Certificate Templates
-The certification authority only issues certificates based on published certificate templates. For defense in depth security, it is a good practice to unpublish certificate templates that the certification authority is not configured to issue. This includes the pre-published certificate template from the role installation and any superseded certificate templates.
+The certification authority only issues certificates based on published certificate templates. For security, it's a good practice to unpublish certificate templates that the CA isn't configured to issue. This includes the pre-published certificate template from the role installation and any superseded certificate templates.
The newly created *domain controller authentication* certificate template supersedes previous domain controller certificate templates. Therefore, you need to unpublish these certificate templates from all issuing certificate authorities.
-Sign in to the certification authority or management workstation with *Enterprise Administrator* equivalent credentials.
+Sign in to the CA or management workstation with *Enterprise Administrator* equivalent credentials.
-1. Open the **Certification Authority** management console.
+1. Open the **Certification Authority** management console
+1. Expand the parent node from the navigation pane > **Certificate Templates**
+1. Right-click the *Domain Controller* certificate template and select **Delete**. Select **Yes** on the **Disable certificate templates** window
+1. Repeat step 3 for the *Domain Controller Authentication* and *Kerberos Authentication* certificate templates
-2. Expand the parent node from the navigation pane.
+### Publish certificate templates to the CA
-3. Click **Certificate Templates** in the navigation pane.
+A certification authority can only issue certificates for certificate templates that are published to it. If you have more than one CA, and you want more CAs to issue certificates based on the certificate template, then you must publish the certificate template to them.
-4. Right-click the **Domain Controller** certificate template in the content pane and select **Delete**. Click **Yes** on the **Disable certificate templates** window.
-
-5. Repeat step 4 for the **Domain Controller Authentication** and **Kerberos Authentication** certificate templates.
-
-### Publish Certificate Templates to the certification authority
-
-The certification authority may only issue certificates for certificate templates that are published to that certification authority. If you have more than one certification authority and you want that certification authority to issue certificates based on a specific certificate template, then you must publish the certificate template to all certificate authorities that are expected to issue the certificate.
-
-Sign in to the certification authority or management workstations with **Enterprise Admin** equivalent credentials.
+Sign in to the CA or management workstations with **Enterprise Admin** equivalent credentials.
1. Open the **Certification Authority** management console
1. Expand the parent node from the navigation pane
@@ -163,7 +158,7 @@ Sign in to the certification authority or management workstations with **Enterpr
### Configure automatic certificate enrollment for the domain controllers
-Domain controllers automatically request a certificate from the *Domain controller certificate* template. However, domain controllers are unaware of newer certificate templates or superseded configurations on certificate templates. To continue automatic enrollment and renewal of domain controller certificates that understand newer certificate template and superseded certificate template configurations, create and configure a Group Policy object for automatic certificate enrollment, linking the Group Policy object to the *Domain Controllers* OU.
+Domain controllers automatically request a certificate from the *Domain controller certificate* template. However, domain controllers are unaware of newer certificate templates or superseded configurations on certificate templates. To continue automatic enrollment and renewal of domain controller certificates, create and configure a Group Policy Object (GPO) for automatic certificate enrollment, linking the Group Policy object to the *Domain Controllers* Organizational Unit (OU).
1. Open the **Group Policy Management Console** (gpmc.msc)
1. Expand the domain and select the **Group Policy Object** node in the navigation pane
@@ -179,7 +174,7 @@ Domain controllers automatically request a certificate from the *Domain controll
1. Select **OK**
1. Close the **Group Policy Management Editor**
-### Deploy the Domain Controller Auto Certificate Enrollment Group Policy Object
+### Deploy the domain controller auto certificate enrollment GPO
Sign in to domain controller or management workstations with *Domain Administrator* equivalent credentials.
@@ -194,7 +189,7 @@ Windows Hello for Business is a distributed system, which on the surface appears
You want to confirm your domain controllers enroll the correct certificates and not any unnecessary (superseded) certificate templates. You need to check each domain controller that autoenrollment for the computer occurred.
-### Use the Event Logs
+### Use the event logs
Sign in to domain controller or management workstations with *Domain Administrator* equivalent credentials.
@@ -209,7 +204,7 @@ Certificates superseded by your new domain controller certificate generate an ar
### Certificate Manager
-You can use the Certificate Manager console to validate the domain controller has the properly enrolled certificate based on the correct certificate template with the proper EKUs. Use **certlm.msc** to view certificate in the local computers certificate stores. Expand the **Personal** store and view the certificates enrolled for the computer. Archived certificates do not appear in Certificate Manager.
+You can use the Certificate Manager console to validate the domain controller has the properly enrolled certificate based on the correct certificate template with the proper EKUs. Use **certlm.msc** to view certificate in the local computers certificate stores. Expand the **Personal** store and view the certificates enrolled for the computer. Archived certificates don't appear in Certificate Manager.
### Certutil.exe
diff --git a/windows/security/includes/hello-join-domain.md b/windows/security/includes/hello-join-domain.md
index 56f0037453..0385e2089a 100644
--- a/windows/security/includes/hello-join-domain.md
+++ b/windows/security/includes/hello-join-domain.md
@@ -5,4 +5,4 @@ ms.date: 12/08/2022
ms.topic: include
---
-[Domain join :::image type="icon" source="../images/icons/information.svg" border="false":::](../identity-protection/hello-for-business/hello-how-it-works-technology.md "Devices that are domain joined do not have any dependencies on Azure AD. Only local users accounts and Active Directory users can sign in to these devices")
\ No newline at end of file
+[domain join :::image type="icon" source="../images/icons/information.svg" border="false":::](../identity-protection/hello-for-business/hello-how-it-works-technology.md "Devices that are domain joined do not have any dependencies on Azure AD. Only local users accounts and Active Directory users can sign in to these devices")
\ No newline at end of file
diff --git a/windows/security/includes/hello-join-hybrid.md b/windows/security/includes/hello-join-hybrid.md
index 93777d9174..3d3e75c6b6 100644
--- a/windows/security/includes/hello-join-hybrid.md
+++ b/windows/security/includes/hello-join-hybrid.md
@@ -5,4 +5,4 @@ ms.date: 12/08/2022
ms.topic: include
---
-[Hybrid Azure AD join :::image type="icon" source="../images/icons/information.svg" border="false":::](../identity-protection/hello-for-business/hello-how-it-works-technology.md#hybrid-azure-ad-join "Devices that are hybrid Azure AD joined don't have any dependencies on Azure AD. Only local users accounts and Active Directory users can sign in to these devices. Active Directory users that are synchronized to Azure AD will have single-sign on to both Active Directory and Azure AD-protected resources")
\ No newline at end of file
+[hybrid Azure AD join :::image type="icon" source="../images/icons/information.svg" border="false":::](../identity-protection/hello-for-business/hello-how-it-works-technology.md#hybrid-azure-ad-join "Devices that are hybrid Azure AD joined don't have any dependencies on Azure AD. Only local users accounts and Active Directory users can sign in to these devices. Active Directory users that are synchronized to Azure AD will have single-sign on to both Active Directory and Azure AD-protected resources")
\ No newline at end of file
From 69f4f5ad630ef58ac086dad67a54eb41ec1f27b9 Mon Sep 17 00:00:00 2001
From: Paolo Matarazzo <74918781+paolomatarazzo@users.noreply.github.com>
Date: Mon, 12 Dec 2022 10:04:31 -0500
Subject: [PATCH 36/81] updates
---
.../hello-key-trust-adfs.md | 104 ++++++------------
.../hello-key-trust-validate-ad-prereq.md | 1 +
.../hello-key-trust-validate-pki.md | 1 +
3 files changed, 35 insertions(+), 71 deletions(-)
diff --git a/windows/security/identity-protection/hello-for-business/hello-key-trust-adfs.md b/windows/security/identity-protection/hello-for-business/hello-key-trust-adfs.md
index 4a8dc18965..c5fc582c76 100644
--- a/windows/security/identity-protection/hello-for-business/hello-key-trust-adfs.md
+++ b/windows/security/identity-protection/hello-for-business/hello-key-trust-adfs.md
@@ -1,69 +1,59 @@
---
-title: Prepare & Deploy Windows Active Directory Federation Services with key trust (Windows Hello for Business)
-description: How to Prepare and Deploy Windows Server 2016 Active Directory Federation Services for Windows Hello for Business using key trust.
+title: Prepare and deploy Active Directory Federation Services
+description: Learn how to configure Active Directory Federation Services to support the Windows Hello for Business key trust model.
ms.date: 08/19/2018
appliesto:
- ✅ Windows 10 and later
+- ✅ Windows Server 2016 and later
ms.topic: article
---
-# Prepare and Deploy Windows Server 2016 Active Directory Federation Services with Key Trust
+# Prepare and deploy Active Directory Federation Services
[!INCLUDE [hello-on-premises-key-trust](../../includes/hello-on-premises-key-trust.md)]
-Windows Hello for Business works exclusively with the Active Directory Federation Service role included with Windows Server 2016 and requires an additional server update. The on-premises key trust deployment uses Active Directory Federation Services roles for key registration and device registration.
+Windows Hello for Business works exclusively with the Active Directory Federation Service (AD FS) role included with Windows Server. The on-premises key trust deployment model uses AD FS for *key registration* and *device registration*.
-The following guidance describes deploying a new instance of Active Directory Federation Services 2016 using the Windows Information Database as the configuration database, which is ideal for environments with no more than 30 federation servers and no more than 100 relying party trusts.
+The following guidance describes the deployment of a new instance of AD FS using the Windows Information Database (WID) as the configuration database.\
+WID is ideal for environments with no more than **30 federation servers** and no more than **100 relying party trusts**. If your environment exceeds either of these factors, or needs to provide *SAML artifact resolution*, *token replay detection*, or needs AD FS to operate as a federated provider role, then the deployment requires the use of SQL as a configuration database.\
+To deploy AD FS using SQL as its configuration database, review the [Deploying a Federation Server Farm](/windows-server/identity/ad-fs/deployment/deploying-a-federation-server-farm) checklist.
-If your environment exceeds either of these factors or needs to provide SAML artifact resolution, token replay detection, or needs Active Directory Federation Services to operate in a federated provider role, then your deployment needs to use a SQL for your configuration database. To deploy the Active Directory Federation Services using SQL as its configuration database, please review the [Deploying a Federation Server Farm](/windows-server/identity/ad-fs/deployment/deploying-a-federation-server-farm) checklist.
+A new AD FS farm should have a minimum of two federation servers for proper load balancing, which can be accomplished with external networking peripherals, or with using the Network Load Balancing Role included in Windows Server.
-If your environment has an existing instance of Active Directory Federation Services, then you’ll need to upgrade all nodes in the farm to Windows Server 2016 along with the Windows Server 2016 update. If your environment uses Windows Internal Database (WID) for the configuration database, please read [Upgrading to AD FS in Windows Server 2016 using a WID database](/windows-server/identity/ad-fs/deployment/upgrading-to-ad-fs-in-windows-server-2016) to upgrade your environment. If your environment uses SQL for the configuration database, please read [Upgrading to AD FS in Windows Server 2016 with SQL Server](/windows-server/identity/ad-fs/deployment/upgrading-to-ad-fs-in-windows-server-2016-sql) to upgrade your environment.
+Prepare the AD FS deployment by installing and **updating** two Windows Servers. Ensure the update listed below is applied to each server before continuing.
-Ensure you apply the Windows Server 2016 Update to all nodes in the farm after you have successfully completed the upgrade.
+## Enroll for a TLS server authentication certificate
-A new Active Directory Federation Services farm should have a minimum of two federation servers for proper load balancing, which can be accomplished with external networking peripherals, or with using the Network Load Balancing Role included in Windows Server.
+Typically, a federation service is an edge facing role. However, the federation services and instance used with the on-premises deployment of Windows Hello for Business does not need Internet connectivity.
-Prepare the Active Directory Federation Services deployment by installing and updating two Windows Server 2016 Servers. Ensure the update listed below is applied to each server before continuing.
+The AD FS role needs a *server authentication* certificate for the federation services, and you can use a certificate issued by your enterprise (internal) CA. The server authentication certificate should have the following names included in the certificate, if you are requesting an individual certificate for each node in the federation farm:
+ - **Subject Name**: the internal FQDN of the federation server
+ - **Subject Alternate Name**: the federation service name (e.g. *sts.corp.contoso.com*) or an appropriate wildcard entry (e.g. *.corp.contoso.com*)
-## Update Windows Server 2016
+The federation service name is set when the AD FS role is configured. You can choose any name, but that name must be different than the name of the server or host. For example, you can name the host server *adfs* and the federation service *sts*. In this example, the FQDN of the host is *adfs.corp.contoso.com* and the FQDN of the federation service is *sts.corp.contoso.com*.
-Sign-in the federation server with _local admin_ equivalent credentials.
-1. Ensure Windows Server 2016 is current by running **Windows Update** from **Settings**. Continue this process until no further updates are needed. If you’re not using Windows Update for updates, please review the [Windows Server 2016 update history page](https://support.microsoft.com/help/4000825/windows-10-windows-server-2016-update-history) to make sure you have the latest updates available installed.
-2. Ensure the latest server updates to the federation server includes [KB4088889 (14393.2155)](https://support.microsoft.com/help/4088889).
+You can also issue one certificate for all hosts in the farm. If you chose this option, leave the subject name *blank*, and include all the names in the subject alternate name when creating the certificate request. All names should include the FQDN of each host in the farm and the federation service name.
->[!IMPORTANT]
->The above referenced updates are mandatory for Windows Hello for Business all on-premises deployment and hybrid certificate trust deployments for domain joined computers.
+When creating a wildcard certificate, mark the private key as exportable, so that the same certificate can be deployed across each federation server and web application proxy within the AD FS farm. Note that the certificate must be trusted (chain to a trusted root CA). Once you have successfully requested and enrolled the server authentication certificate on one node, you can export the certificate and private key to a PFX file using the Certificate Manager console. You can then import the certificate on the remaining nodes in the AD FS farm.
-## Enroll for a TLS Server Authentication Certificate
+Be sure to enroll or import the certificate into the AD FS server's computer certificate store. Also, ensure all nodes in the farm have the proper TLS server authentication certificate.
-Key trust Windows Hello for Business on-premises deployments need a federation server for device registration and key registration. Typically, a federation service is an edge facing role. However, the federation services and instance used with the on-premises deployment of Windows Hello for Business does not need Internet connectivity.
+### AD FS authentication certificate enrollment
-The AD FS role needs a server authentication certificate for the federation services, but you can use a certificate issued by your enterprise (internal) certificate authority. The server authentication certificate should have the following names included in the certificate if you are requesting an individual certificate for each node in the federation farm:
-* Subject Name: The internal FQDN of the federation server (the name of the computer running AD FS)
-* Subject Alternate Name: Your federation service name, such as *fs.corp.contoso.com* (or an appropriate wildcard entry such as *.corp.contoso.com)
+Sign-in the federation server with *domain administrator* equivalent credentials.
-You configure your federation service name when you configure the AD FS role. You can choose any name, but that name must be different than the name of the server or host. For example, you can name the host server **adfs** and the federation service **fs**. The FQDN of the host is adfs.corp.contoso.com and the FQDN of the federation service is fs.corp.contoso.com.
+1. Start the Local Computer **Certificate Manager** (certlm.msc)
+1. Expand the **Personal** node in the navigation pane
+1. Right-click **Personal**. Select **All Tasks > Request New Certificate**
+1. Select **Next** on the **Before You Begin** page
+1. Select **Next** on the **Select Certificate Enrollment Policy** page
+1. On the **Request Certificates** page, select the **Internal Web Server** check box
+1. Select the **More information is required to enroll for this certificate. Click here to configure settings** link
+ 
+1. Under **Subject name**, select **Common Name** from the **Type** list. Type the FQDN of the computer hosting the AD FS role and then select **Add**
+1. Under **Alternative name**, select **DNS** from the **Type** list. Type the FQDN of the name that you will use for your federation services (*sts.corp.contoso.com*). The name you use here MUST match the name you use when configuring the AD FS server role. Select **Add** and **OK** when finished
+1. Select **Enroll**
-You can, however, issue one certificate for all hosts in the farm. If you chose this option, then leave the subject name blank, and include all the names in the subject alternate name when creating the certificate request. All names should include the FQDN of each host in the farm and the federation service name.
-
-When creating a wildcard certificate, it is recommended that you mark the private key as exportable so that the same certificate can be deployed across each federation server and web application proxy within your AD FS farm. Note that the certificate must be trusted (chain to a trusted root CA). Once you have successfully requested and enrolled the server authentication certificate on one node, you can export the certificate and private key to a PFX file using the Certificate Manager console. You can then import the certificate on the remaining nodes in the AD FS farm.
-
-Be sure to enroll or import the certificate into the AD FS server’s computer certificate store. Also, ensure all nodes in the farm have the proper TLS server authentication certificate.
-
-### Internal Server Authentication Certificate Enrollment
-
-Sign-in the federation server with domain administrator equivalent credentials.
-1. Start the Local Computer **Certificate Manager** (certlm.msc).
-2. Expand the **Personal** node in the navigation pane.
-3. Right-click **Personal**. Select **All Tasks** and **Request New Certificate**.
-4. Click **Next** on the **Before You Begin** page.
-5. Click **Next** on the **Select Certificate Enrollment Policy** page.
-6. On the **Request Certificates** page, Select the **Internal Web Server** check box.
-7. Click the **More information is required to enroll for this certificate. Click here to configure settings** link
- 
-8. Under **Subject name**, select **Common Name** from the **Type** list. Type the FQDN of the computer hosting the Active Directory Federation Services role and then click **Add**. Under **Alternative name**, select **DNS** from the **Type** list. Type the FQDN of the name you will use for your federation services (fs.corp.contoso.com). The name you use here MUST match the name you use when configuring the Active Directory Federation Services server role. Click **Add**. Click **OK** when finished.
-9. Click **Enroll**.
-
-A server authentication certificate should appear in the computer’s Personal certificate store.
+A server authentication certificate should appear in the computer's personal certificate store.
## Deploy the Active Directory Federation Service Role
@@ -131,11 +121,6 @@ Sign-in a domain controller or management workstation with _Domain Admin_ equiva
## Configure the Active Directory Federation Service Role
->[!IMPORTANT]
->Follow the procedures below based on the domain controllers deployed in your environment. If the domain controller is not listed below, then it is not supported for Windows Hello for Business.
-
-### Windows Server 2016, 2012 R2 or later Domain Controllers
-
Use the following procedures to configure AD FS when your environment uses **Windows Server 2012 or later Domain Controllers**. If you are not using Windows Server 2012 or later Domain Controllers, follow the procedures under the [Configure the Active Directory Federation Service Role (Windows Server 2008 or 2008R2 Domain Controllers)](#windows-server-2008-or-2008-r2-domain-controllers) section.
Sign-in the federation server with _Domain Admin_ equivalent credentials. These procedures assume you are configuring the first federation server in a federation server farm.
@@ -154,29 +139,6 @@ Sign-in the federation server with _Domain Admin_ equivalent credentials. These
11. On the **Pre-requisite Checks** page, click **Configure**.
12. When the process completes, click **Close**.
-### Windows Server 2008 or 2008 R2 Domain Controllers
-
-Use the following procedures to configure AD FS when your environment uses **Windows Server 2008 or 2008 R2 Domain Controllers**. If you are not using Windows Server 2008 or 2008 R2 Domain Controllers, follow the procedures under the [Configure the Active Directory Federation Service Role (Windows Server 2012 or later Domain Controllers)](#windows-server-2012-or-later-domain-controllers) section.
-
-Sign-in the federation server with _Domain Admin_ equivalent credentials. These instructions assume you are configuring the first federation server in a federation server farm.
-1. Start **Server Manager**.
-2. Click the notification flag in the upper right corner. Click **Configure federation services on this server**.
- 
-
-3. On the **Welcome** page, click **Create the first federation server farm** and click **Next**.
-4. Click **Next** on the **Connect to Active Directory Domain Services** page.
-5. On the **Specify Service Properties** page, select the recently enrolled or imported certificate from the **SSL Certificate** list. The certificate is likely named after your federation service, such as fs.corp.mstepdemo.net or fs.mstepdemo.net.
-6. Select the federation service name from the **Federation Service Name** list.
-7. Type the Federation Service Display Name in the text box. This is the name users see when signing in. Click **Next**.
-8. On the **Specify Service Account** page, Select **Use an existing domain user account or group Managed Service Account** and click **Select**.
- * In the **Select User or Service Account** dialog box, type the name of the previously created AD FS service account (example adfssvc) and click **OK**. Type the password for the AD FS service account and click **Next**.
-9. On the **Specify Configuration Database** page, select **Create a database on this server using Windows Internal Database** and click **Next**.
-10. On the **Review Options** page, click **Next**.
-11. On the **Pre-requisite Checks** page, click **Configure**.
-12. When the process completes, click **Close**.
-13. Do not restart the AD FS server. You will do this later.
-
-
### Add the AD FS Service account to the KeyAdmins group
The KeyAdmins global group provides the AD FS service with the permissions needed to perform key registration.
diff --git a/windows/security/identity-protection/hello-for-business/hello-key-trust-validate-ad-prereq.md b/windows/security/identity-protection/hello-for-business/hello-key-trust-validate-ad-prereq.md
index 1d66a37be8..5a09bb7ef6 100644
--- a/windows/security/identity-protection/hello-for-business/hello-key-trust-validate-ad-prereq.md
+++ b/windows/security/identity-protection/hello-for-business/hello-key-trust-validate-ad-prereq.md
@@ -4,6 +4,7 @@ description: Validate Active Directory prerequisites when deploying Windows Hell
ms.date: 12/12/2022
appliesto:
- ✅ Windows 10 and later
+- ✅ Windows Server 2016 and later
ms.topic: tutorial
---
# Validate Active Directory prerequisites
diff --git a/windows/security/identity-protection/hello-for-business/hello-key-trust-validate-pki.md b/windows/security/identity-protection/hello-for-business/hello-key-trust-validate-pki.md
index ae2142daec..ba923d7b2a 100644
--- a/windows/security/identity-protection/hello-for-business/hello-key-trust-validate-pki.md
+++ b/windows/security/identity-protection/hello-for-business/hello-key-trust-validate-pki.md
@@ -4,6 +4,7 @@ description: Validate the Public Key Infrastructure when deploying Windows Hello
ms.date: 12/12/2022
appliesto:
- ✅ Windows 10 and later
+- ✅ Windows Server 2016 and later
ms.topic: tutorial
---
# Validate and configure the Public Key Infrastructure
From 6cdfb1d2f284cfdca0078037b69d0566012bf4f8 Mon Sep 17 00:00:00 2001
From: Paolo Matarazzo <74918781+paolomatarazzo@users.noreply.github.com>
Date: Mon, 12 Dec 2022 10:25:05 -0500
Subject: [PATCH 37/81] updates
---
.../hello-key-trust-adfs.md | 6 +++---
.../images/hello-internal-web-server-cert.png | Bin 131616 -> 397629 bytes
2 files changed, 3 insertions(+), 3 deletions(-)
diff --git a/windows/security/identity-protection/hello-for-business/hello-key-trust-adfs.md b/windows/security/identity-protection/hello-for-business/hello-key-trust-adfs.md
index c5fc582c76..86e1e8c728 100644
--- a/windows/security/identity-protection/hello-for-business/hello-key-trust-adfs.md
+++ b/windows/security/identity-protection/hello-for-business/hello-key-trust-adfs.md
@@ -19,7 +19,7 @@ To deploy AD FS using SQL as its configuration database, review the [Deploying a
A new AD FS farm should have a minimum of two federation servers for proper load balancing, which can be accomplished with external networking peripherals, or with using the Network Load Balancing Role included in Windows Server.
-Prepare the AD FS deployment by installing and **updating** two Windows Servers. Ensure the update listed below is applied to each server before continuing.
+Prepare the AD FS deployment by installing and **updating** two Windows Servers.
## Enroll for a TLS server authentication certificate
@@ -27,7 +27,7 @@ Typically, a federation service is an edge facing role. However, the federation
The AD FS role needs a *server authentication* certificate for the federation services, and you can use a certificate issued by your enterprise (internal) CA. The server authentication certificate should have the following names included in the certificate, if you are requesting an individual certificate for each node in the federation farm:
- **Subject Name**: the internal FQDN of the federation server
- - **Subject Alternate Name**: the federation service name (e.g. *sts.corp.contoso.com*) or an appropriate wildcard entry (e.g. *.corp.contoso.com*)
+ - **Subject Alternate Name**: the federation service name (e.g. *sts.corp.contoso.com*) or an appropriate wildcard entry (e.g. *\*.corp.contoso.com*)
The federation service name is set when the AD FS role is configured. You can choose any name, but that name must be different than the name of the server or host. For example, you can name the host server *adfs* and the federation service *sts*. In this example, the FQDN of the host is *adfs.corp.contoso.com* and the FQDN of the federation service is *sts.corp.contoso.com*.
@@ -47,7 +47,7 @@ Sign-in the federation server with *domain administrator* equivalent credentials
1. Select **Next** on the **Before You Begin** page
1. Select **Next** on the **Select Certificate Enrollment Policy** page
1. On the **Request Certificates** page, select the **Internal Web Server** check box
-1. Select the **More information is required to enroll for this certificate. Click here to configure settings** link
+1. Select the **⚠️ More information is required to enroll for this certificate. Click here to configure settings** link

1. Under **Subject name**, select **Common Name** from the **Type** list. Type the FQDN of the computer hosting the AD FS role and then select **Add**
1. Under **Alternative name**, select **DNS** from the **Type** list. Type the FQDN of the name that you will use for your federation services (*sts.corp.contoso.com*). The name you use here MUST match the name you use when configuring the AD FS server role. Select **Add** and **OK** when finished
diff --git a/windows/security/identity-protection/hello-for-business/images/hello-internal-web-server-cert.png b/windows/security/identity-protection/hello-for-business/images/hello-internal-web-server-cert.png
index cc78ba41cfccd7204a1ce5cc3c1a809af1182cb7..63697551ad556e9f92eb39a435b2377cd57b9ab4 100644
GIT binary patch
literal 397629
zcmV)4K+3;~P)Lse3|zip4UEm
zuhj*l2l+q(h3c;EwbnlOh{nBVukLCTkVqsFi4Tbc;lKZmaWN4dQ
z6+qR$)a4@(7!0ufMTkKq<_-OO4M7QWzcnLtnoeyf)rEZF$a0!kq6l7x_i^{
zJ`Jto&BzPC4Ie1>5f9l0y|N{2TR%r_b3A!{8wJ@OTq?K8;;}h_bpG8dkw-q=n0DX4
zaqREUkvwJB5yChUNOMZ2W2a;7eRFR|ch|S!(+*>pYU^Wr)yok3r&&5XWpJcBl;hQo
zZ*nJAM^oy)h566sa?>Mw1x)0Jv13Ddwr!vAU>k@HMU&r@p0WHvKHQF&ng$ozGbHMG
z65ix1Weoktamty>GIwm*nldVnS}sx33mj~#r1lwCv&W<~x9Q@1fSCkt`-X_5TuA-#
zKeKg{R$z5*x=d?JuE+cF9p{hPJk_<^|Mt{(7GbbQsSTP9KQE#Imje4gKL%il#o*bGo$MBl;jzRu&yh>1vzyVx3{U5g31NN
z1fq;YT9%gIlF5QC4XE`E!Rwb!C0qUZeBN`4kP@NRiuHWPaylXB3;BT*#(G@dxXE;_6}47yEug&Mv@D=RsHLLR3a-`XY)S;8B=0Fti3lkr?+buIurhn)
z6Xno88&9omDJ3LII<^VS6}1S@Pp1=VDLAjI
zztCf5lv0G2L>(PXz8EPHPNx&r^BGmYL)U@KRb|2Cv+0Vuu2>#USe6BkkB`WCQQG=(
zUu#7vD^8~e5CNsg_mmQH&LB$KZv{kzoU+m&^l{%P<&Dr>O2N7ogD
zg`2yHHDN#z_2)GB(*`dk-Prem0^>r|6V0C;*jBkR~PIf`>v(^$;+Hbw1QmP)fn+bOJN$T*G*H`$qI?
zDXv$DNc1YG&0{s#7nyL%qHCnB+1Ixs4^8JVYG*v9&~B5jye!B$2bmFhU}pJU<{XOa%
zx+qf87u-OR@XSk~txS8_Gy?p#Sly}1SL$f*0&XYRqR(wq18&h4h}#tcg+EvNiyI$j
zx#M@=2W-OUx%O=Q*$|lNvR(2N9EhNS0avzoueG93bpSyY#F95D|0=VZ@ChjsmSmu!
z@{`T(ZuYmak05{v54w*wYg0%{0MJa*2-Y5f&pRn#2
z7cF679P6nH9G>zCl-?+iS5VHyW!eCfl#_!PT&w)53wBmoN-03C$e9d3R{k`(Xf0^=
zOriv)wmISJC0QtY9T9kqquM|L=-*COBM7d)i3|vVTp6WQFc+jGAY;x6l`FU!uWVjW
zVuJh$FwyjJzu^G~n*pFGAYBz`Y=CPI!pd&~yf&Fw9H3_|4w9MkIdmx#eZoaI5tPp8
zAW)e=3NVq58v#-Q1G}Vaq;p6Cd#Rx!Qe>Ep6#=l}
zdd?lcMh2Vw5FsrY3-udPR=#YkEV{{5wU0$77=Ud2f{wph87U`ZN`UE5X5=MzvVg!J
z>jN%jSYN>3H@yJBfzw*eQBj^HRpPZ&AN!=6YZ1tl4JHQjic%}GgO}{Qjw-i`f{=cz
ztquT4OLn^{g?gqEgEsxF|N7(`3mgGfY6{Uma&HuLRB#ZLTNWnUM3Ybd
zfBJP!2L-#+N9>PoDXa4i|7-(yp0*3cYq^i6D~rs}kS?}sR05uEq-86G-klT#8GT8SA~ewFLb(o$5P}V
z`@$bnAS}Ms{=ItI!R_5kbX}9E-Y98{RPkbD1tEwCl}lT|2G1xkqv|s-<9s%tVr*9{
ztE*c3q8p<`3ef3-I{_(^15YF1)BN+d$@;Z<2}-}37u(iby%kIm#!0+EZe?*gh>TLajuU`+4XWq(ruYdDN&
zZ4bk}H<{VJHU<1`o|%N!PZP!(`vC1n);U8!lhwz@vWTaw(~-m*uB=kt2zHwXX%7NZ
z$2Vz5MO};cTh19NB?WAnhg>nxF7;#M+Rt#?@#tmkvkl_m#Lc2X}~W&C#TBtptUe^t-ZB`27HV0J?$p+&%T
zXnjE&54xpK=H*(0ehynZQRqT`04N1uDh)^+is#BGC@}DyfdHs0Fc|>zWl0XaB0SIP
zExxYnR3FxE?D}jRTNtNGfD}v|SVEAxGWs#uoCV|!c`o$jhX)XVwG_a;KpWp}YEMMK
zl2NLFkckMVyy$z|(;Ng@7r9rlwY98B>OBg`_!r$MeN-!>))fqq755e=LSndVY-R|R
zNg6i_dZpu@<4oc;E3-n=$>Jfdpf$LiK+rtvx;__BjplO{IqI`a=0FjP(fkf#Kz)fD
zi5{}wlz8*uWm2zz{)cPL*oU0rbQzlhm5-co#}4ZhIuLUF73MUs5sHZ$t3=^QtJ
zFZ1N{tD;_aZoGZ2B$r_uFC4$={c_2xciyHzt;*l)b+8Mv9HJGk6)}!0dR9&G-Zu?J#zo-uGHCM
zJjlts^j%NcUF|u@&&|m1kUBoLMf;}8nB9dZ+U1eolM1@>EWbfKLp2B5_
zAnZ}^NcEbmr2vWCt4Kg_3SA$@rUGx~Jr;j+k8BKppo4j%R*ZS11lMu)U!?nj28xXy
zLw+Rl9^~dVy$L@+6xGSxrgGk}f{t=jyI7y3gbelOg63hMbabf~SO5zIs3VXbKW7D0
zNI@1JWWjjdj+Syb>RKIejAPBiJ$Nx&&v6>^Mm{*$X#j@`dIWQ8WiaHJxEzfY9WCuq
zxPloaCDGk3>elaeL>lV&RsDFn9dlO_Ixtm4k{v{r_rjPW=xmCf+2d(C9#nvm@*fUl+dRR}GkwKPze$d7Wf0Xo5ht^;y=@qu-?
zc=*W=QP$-cx9UlzrGy)7@Z>K7x+y+XL>>;S^yME}VNEcik^WoHi0&fH<)A|q~
z@%Hq2ssZ0Ij6^8~Cfmx;z^gXL+W4szVFQL`Y(X}}Tpx3rJIwRbHeMplfNoM5eGnPW
zL@4TwE}qi_!F-F%DL!F}9w1XFVIH**HxfdGLVp!+W6MvS*=O@doOc)!a>hVR1F0qS
zfO&8S*`o%~24#XVxivEw0HZx)8&fIAkSc**(}zAM$S3W0qbBw>Z_B)m?RxPwSg|E!}LI3RgR}9UV
z8~)BndoA4@r;(TD$xXBjeZmMp#yu4eZ8^}iW33;F;Var?=k>|(>IGtJ%(@B!&>s!h
zR1^
zzlS~~y4=nqUYzz_nV&H|w
zmNaAnkb58eCC%!f1UJB<>JjafJtiNK#L>${C{(cOGmEb|<(4+Gti_Me5(CH<-eJog
zA-9304xSnyFt)(Ka05F86z#Leyr;~=Fh
z03Gbub@EQId<_pFb<8C1?^+qlBH)R5rS|<1LEBoZ$FMXyYEeMQVqB)&IHEjl0A2&R
z{KznK7bCazA2}a0MZl%PWY&&&*DA;S^Ri$`8KqWHzcKWP
zcVVn7$G07v4gJSlP)dsjU27XFt;z#)1;v=wjlSsF*`|+i^K8%~vDic)WR;PG(`k|T
zv}HvpD@+zh-&frl>=L3jqG=NIfzq_seWkA(__zj-1N6Ys7d!Q=4$oSb5*&ELrU2?1~2lPGl
zvMSG--G=VBW{1&^P3icSdyWP9-;}R?Ofx!J>uK{#R4rD1-`4)yR;>CZZT!Q1wha$_
zacB{KBSF>}KwT@=dIr>kCwrVai+w5HSj3GM_l6=l##u@QmsLIF
zlIt7RhRPKP>Ma-mqyG42i0jIv(QY^#JB=M2S{}fQYqp1ZFIHyo%3VLtxI30+HA~ki
zpsYZk!II6xeypBHua)Y_%S|gd~p@eZ@1+OiMXbA{j^>;h+U;Q$y-dk0#cJcq5)*ySvD<9(S
zDcb8ae`cE&p>Hg&%{%M5qHqm;QoyBnj8b{Oc?G+!1i&h1V2HQ1dNo^2>~&oQJhu%Q
z$5X5_W0tndZ96I3z0tS<$PC^1(G8DcUh$B*L%eAF*vBq&-5q466Ip>;o0Hq7f_?A#
z$}S^u3M7~w0Jw;fNGZAQtrpYN`<+{i)4nL}`?lefLZ7y9C&HgdAJ+PyKMxy_`358;FKK{0aZSI`juc?4k4;V~Wv^
zL%np#eG1mdouyIt?Q^7;t7oQmZ!i4@S0}U5m
zjau*}2HlY+?p3j0Jz>wQ^p@0_OwU&F7npS;A1Qu#j!k#1&bZi7L#(TgC*wpHBRsqp
z3*w1D?dgDHtf9^4h*>Iz(Bn6Qa?tS+8@8{5E}&$g(I&-?OP9L%tYp8$$>o4JFu
zwXJz%Eoh7Uctmz2nmWOju4*8P9OrFdgsj2Its$Y4kkW!|b=pnlJDh86ZtHxhwx7ZL
zQl!b-G5O-zumSTtiu~(d*r#jzki5+9cyUrOx0Wz`!_|v-K$yHgE5s8`c*ic7E{pm+
zUT{YwVH)s&n5iwDSjv#azj|*e*f0V;&R4y_ixo`D0UWV+a?Yp_Pb{f2dgrxc=e481
z9Z@c`TjmKW%K|7a%c7UuRF_d}w_JcV>vMVE09Jdpu4m_$jc?zWN#0@IJeg99i%MV<
znyxNFLRwlIVw~E=Jk+$FS}WGF!n!tsbxjsq7>MrpK64iz(m`!&zY3A{Cs7h`jw^`6
zE$vEmMYy1hpx|iSOb9@`l2&SQj4h=e?22R6=(AhiTey|bQ^s$Ti_~;*2XrQrKLHG@
zUqIGMYjK17zG3G>#rb@eO$;;{a(xKyXm6l>KS>ynZ{*o!Nk)T(@etVwmx~RlX)aPd
z;HAih#lwS+(ix(b^|c^~ETwh98MEbL+4!@(ZLtnSgR$<&rTA
zOEMI1e_O0mb{=kZ>Hz~~Vi$DJL!EYESyk`!Or(2tda)MB^K`;XqF*IOuX?yDD4$af
z^HCo%M#P1D9%z?~!Q)pOaYTf)ELfIB#-f&AOT7lD&L*s3#$o_SO(B6HH;j?*t~NzV
z0v9s@DI-zA&zCd)#)9NCad>=PLnN;hu|W#HO2Kr{S0F
zX6BA5N7JWQQqQN`-+!qzH%gAZ^V~WoNoM%=d7!V`VV-oOPjdvo3`}{^4IQ17Cb2EFwn&L&tQ_uTaF>r}FyN
zv+Yotp@%zm<=#)8VJ6SMm~DF1_1I8#H}f4ZX?$^IcG|{NAt_DXl#HKVNJjbzZ6%!94>dW`m2lbMc^2!Lru^H3BIQSz95u}lWH
z{ZN;EpKd`1%|j(V39bHRr%*z1=LME+9%|+5y_3=IVX=LX%|3M
zuIi;u-B?Z3i`vyd1Mp_m>Ds5ilk)b&YkXZH7xd^Bks9w2ZNpjo#xt`IyAA4P~
z(O|lR;(%QQ+ZC+ODWSkB!;Skof
z2v}&kJ?agMt=s>znYUy^$No|*TQZ@y-VC=v)i=u
z>URvPsYT7h$2O0+d?_OYJQq-(Yehbtqa1dR<+!B-ZF3aj6s1P8w;y7N8&!j{ASf8`7b5>-n%FKM*4uid-{mK
zvwXngrvf}J_{mRyia-3V_xL})`U-#XiSRE!Cj9FU3E&5yYS4ME61K$@N4JyJ(-rX-
z!psi5()N4OD-?NC-7csvS?Dvebh5H%z|IS5bAuXDIk|Dsv`|x2Cfwvt?ET50=SW%*
zl#6uj5XABVMvHym=q
zHh>6BP*}9bHkDHJ&KC8E8Fp?3=O70He4)weEjAEm&6ik_;W(%Bhun5{yN2MPjveuB
z;7=TT2LA1j9<$Fk8zf`CaYNhwFt@mS#uEcR(HtzM8q(Gf12yEsjh${;a~Krc`ebjT
z)%ueX0ad{@XQ8#lW;-dz*DK5&fI5ODMw(;Alw^}3eD0Li@YQ6>kGUF6UT^h!dM%}Z
zT@Bt^a@Drel!%Z|O9QEf@wl$%0DMKzT&SzHDqu=pw&eAZ0gLA;x5_7dFK8NOxdaSA
z(Hp_-)T4PkN`ENFT@IQg2#BpW+LL*AukznPdXalPbqsF0kn`0&QCOOGvF(UOmejj
zt6uq;yagnuiJ>71_c@&;001BWNklI*
zE(sMPW0y`#8{@+z;C9)Rg$ytU#*P=pXMIp>#gdb5IE4FYRQGX^ttJ~l)3#0LMpNgS
zwO}0REwRvfu7}$Mnvyuv5sF2W(eT%nC(up+is*wg(2nE-vH=wVS!(Z&VSMMW
ze_0DSy~FbEC;0fOAU*yHzw_=5{@#xg{xg2UuO5Ma@v-7xeRz+*d}2J6PoVN+ENKze
zC!nBcSO9IH#t^chGwxn?T#3{IsccM
zab$~L$=^IC+JGIjZu||d|F00bZBVDQwvGDXrfyMy#=qhBi|J+-9DJbz*j_^DCuPv(
z-=60S%iW*Oli)gK*UO#08I}|-%7ZM^8FyYKBjQ)1h!gf=GY
zR_ffQwWHbw3OiLC+ZpseTbp(4hefBW03tc&tyNY(A0Jwv0Eq#(b>s5aQQO+8{Bb~c
zVp2G$;O|FXHm@cF<_H=SPgm(2`qlx=Fm8wvPD=o?G{$DFDfDem)Mno7h8>5;1dw>y
zfk-@fYg#)EU-6ydAY!_J(
z^%qSwnQpRT8wLVQWt6fG{jB{_o4;>7#%my;U?{QNigtOAT=YW(yPwPf@lsZla@G(I
z4CemGb@PDd_8kBPci%3IMCg}9785gh{XV=X0;zr3(K|0u^O#K}z?hUH&*g%hU>LC{TqvrkGW+1S5GKy@;uuE+oAOa=vGOY@RavkI|8~x;9Ce{^<
z7OOTV^6})Jmca%va5qwEyl7+D^e=hYW=kd2pOsmsf~_~Gm~Ty%{F;H*;d1#Gt1P+h
z43`6ThFI^Rn{)Os6E^-GsIQFGE(hxXZZsujvZig~usPwiR`w_BT0kf*PHD9`r4p{g
zc`Up2z}UCL_ua$C;0{x&^9GPIjMon&4>=Vm)XNl
zj9%u_F2;FX-J8GD$*bzVoN>wv%oE-CdgrB7k!^8r`3%qstnZN$;dkBufBS94-+ucg
zeugjc@bm%Y>odN7%J{Y{NLcVbCG|F4ft0~Z!Z%L|Uw$H-=!Bo182{*}AMo}UEB@&5
zE&lnZ1%Lc?!e4w>J$NmsAQMoDq%1X_K%?t(=&!j=_t!9ee~k{daoH2bCst-_sm7Nbjic?&@DargbqRpL+pq
z3!G;r?my4gnYYz4awjT0EziFOqw1zo-NgTX(lbHT-o%)}4LfB=OaDlIuZ4pyxP`)5
zU9-GH9!DUqjTZZTFV8jeXsmO;uCO+q>-r;UDE?CG*l5~RcCCUfG2L)^5mi3dDTj&<
z(_t5j%XQVPlpp3C)Y>-m$+RgK+BnQV{m|IH_k6uJlo<=Wr5gtMolECX?NGf)&7OHFG3g9PGts{RqexVEWCKLxy!2R$zfhhU
z2-fZ8o_wa9|DI
z#iZbS3qugQqhA-Loa9F9vPyj{7dK_IF{<%N@;6{~o&@L*H=tAOM{N4hHXj5`jq=*~
zIQGBGeY||h`q~kTo=zFJ>SJl`(Q)DzNDaw6jbn4uCIq3DI{>OeCp*||{T(-&%o8)_
zZ|{l6X7hBln5YV%s>dOjLh5vazQB-t)HH<4E6YV$d0Bi6g*Pp?k0Sx;tAq3Mx9PQ7
zR_A*ZF_Z0DDk?Qy;uDN4Gx;nQ~_s2fgK%e!$4bXUk!22D9oR>LuM54b4
zowvF3I=sPQ?An+!{s8b8!@gldw*sn@$z29;0=VF`yur`jo$w#LeZucQe21Un8^)1d^@ss=!|K)BQ3UV6Jqe@s0duO>UEn*JM8faMj4Y$RELR21)x~(jMRE
zG~GyP*T94CUR*@IWO}U;BC-_CvF{^214kTiiKCm^U}I`_qqHC3&?}nH?-VaaW7B%Ub1^NKDX&3z;dq^^08pk~=H$qAA!W&rFPo9#x)_jh}lvo?P6f82Vjd>F
zr`4v5ZV_%A2W6&&kefY@`KY#0Ia%Esd=uq_R~JZd@LFmf;{n^LA@>
z&RNipj|NPcybDn3z%WC3V8>?lEuEIk^Ui?7zF$KbkpdU`n5WMa!L5|^_^bccJaan`
z%yJF;uH
zanHkH==-6cSURd>xP3|_Uda{eC0N8eO+1VR=(J0GDjP2ie2DGqZ4>GLfj`O*2Yhub
zm9>bpbt>PE#EbW#TzFMoj?L@VfFJ>4nhQn~r*qoc}
z1lujXM=9yWIzt~_vDpID2lG_4&4SLuj)sQWWD&-XTws)&4r1j85tvC|X`ptkK~s$e
zk;)Yp9pnm*ws(gy?>to<$gx$eY(Gk!GD>}NK#{bcQzE!`YMcvH@0N-NlG#Rus}Tj!
z5c(T!To76e)J-P>-p2Nv8*f89j5OkyPk&K%r2ziNi;|>x)7R=v%bOWvGnYBI>pGso
zSb#tC&4Q|4#$=})L|>O$L=R{@Q|F_OM;_$-qD8_@kN2BmLBDrpso1707t`B#@$~~W
zxp7d{DpH+2jHlKst?y==7JzIDk~eFsQ9zAm7Yt_9ZLY3yu)$7v9#&Z!uM{JA3|{DSgb0mD&W2kbhm29h3ED5^CZ{j>cwl^
z-Pq;NS(T{)Ka}{YX;X{uK)zCigAuZ=Y=?QbEYOCMH%8WeEeF#5Z(b_%#Y(-CPe+R$
z)77eWfk?XW?J^O~km?(|7m>3)y*`@Vn`=`PPX_x?$?lKabWH|t@51MHyfXGs5n5NM
z(oCe889z(b{%4D7)FnHG9g;0Np0E9p76=Ju93LrUPTO6)2uysQUb~*U@-KDXxEMpT
z*>6j>n7#1gO=Vt}?=1{+AzfbUY=0&*4{jN2^Rlh_>u|xb^5UX<9^;fCu_k*@rkP!~
z(d>uXN^K0<(
zqo`V2E9udEA8LU*F7bnN#QphV*J|gy0b;TA<=tzb{y(=Mr5-f@Gi1^K6HBg#6kZgZ58@V
zFR=2@*k
zLsc29$2+(%2o*>bzyA*Sum7!Y@V|dW_@gfqJ`v+g2~PxM5U9#gfh94L2f^0~8BnE7
zptXXPU~!;lxgoATfighv-eWy89-q$mPzo|Je)Gimo9{CI^Pez2{LQ!cU%xrypMOF4
z;t{Aw!s>>Wy{;wyoW#3dK2x1TqL-%Qz|7Uv-xPuE(9TMmf*{o1_ZTrYp>R(@g&9AC
zF~ae~J|A4~x%K+o%T{*MwUyqXDqoN;*WVkf|AyBmyxLt|TzVcSx4n#av^^B%J8DFgAn#Qsx6c55}v}!@k~|rfz964$QDR^tq1WJNkQgZ|fCv$!zVP-7_RS4*H!1
zNHc>ycd0HMR8<2lJb89hQe>Q8%6*M)?*3dZ;H;
z7jQa)!sBr)`*Bwy)U$5U`l2v=C}hZ&lbOO>kcp1I!o_
zKeN?C{yW=zIN|&GeC}w8^6H*X785aNInJ6>E6dD#G!Vrv01BRcq`wJZDd1?Lq<~VR
zSHQ*Q=|n`xONPZ~)MA{kEuy+GT|B=CbcP@G7vM)OiCI~XNt4BnR8L6uQUG1svYxmz
z5N<6EWVN`dtYwK8s~i_616QIgMN+zfFo_b7;9!Dz2FeZO($7m;T%o%+EgDGDoLB59
zzVO5VaJvY|j+)zAEG=?pcJroYlv0tiv}5HJ4r0ORMp*BuS6+=m+mA=vn-I*Z*@f`_
z>i+RmYsI>*(r3$pQ#v(%Tf9fIxV7qhRx7aTxk~CibmiTu{8g~F_MXbtMnK|Pb~;OO
z6cc#45NX`hAqV4EJI>AQx7-^@o`^s>NjzbTvAeG5Q$INpLoSVmU7*FFu6a%OwRN(w
zmWI4&c8dliee>`Zk58XmuUj17CT~GsB|>Hb<-93V`n(6yqyBask`kyCR2Ij+C^qJW
zok&1uw$OsELJ6@!td57xgShoa)eF0rG?1XTU4%UH@K**}}
z#yQoLKhsHf&!k}t!q-oP^j$?>-e7rni~sQ9Tl^RQAmckC{CEFs!6OntX|~DuYnpyd
z2pxCzUasK7g_^RP=e@!wjz)LP+Z$vli`1FHU~cz58QEY)EQ`A$drA)W-+{GG%Xgpy
zu4S27s+U(%ubiU7nsn3sMb6W1oWVu
z>g8+;noET(5O(OgKu?^`&B)^p;WNt%a8HT-;*O`GAw2!mkGZ|pcR%BDmU|Oztmu#q
z0A?3ueslScTK$3b-Ou}k+(EFqhwX^6CKabid!D
zJ1@}wxz&%>dAQnH-(Va!J1^edw)wmJJ$yA&VD%2YVVqr@O%8(Cm(%|He$j@{ohFUG
zN=3&XYgp7F*UZ5k1EV*Af@YY=sV&g__pS~4e$+WIAOo^kSMNRtiLlAu)#h!TiI;gLxc
z`prHlkilWSU~)9dHY-oM&%s-Zh`@G)ej*E2NAwV6mc_Nj&@~bR`DK_4DV3v803aBpqQHy#{>sWJs=`fUI_9=|Ke)AyOLu)Bm*A)OGrQBVxXMGSw
zqMzG$w0)3e8EXu1(+5(1?PN`WtkkQ2Zu-PG7J|c){MoUv2o3lQ<9?=W82~EdTnf^|
zDexeGfHR%WVO;rGgnO)RVjIK8ZJ$0eR;N+-We
zFEWx6B=iEpDAmw0Enm;Cj;%p0J7~xZ_$6iX(7m16E}5#WpOi<|1FcAvHMJqx!vdtP
z4;mRWTSDw^C)YPNFIpR2Ka{l~d1S{ZCkzR_V0v5o!t@K<#sWka*yUR+rw@_?*OGG1
z-jB6bAE)BXSDR0!0;@LH_y!i=0;rOg>>U7`q&eY31^)63q|A7FWSkP?-+9OQgC8e+
zyS~Mre0+mH{qh~Y`09-Bm{GVOqhevXGiYJPLZVbH<_7CTqUx#J!Q_-sDWTRPu^!$q
zN~(C^g1`6UjNe|r!(Ti-0r;(cenIGus}{v)Of$u>^XS&(&3sN-d-Q1q$BMp@;Wqdv
z4)twmqpgLg8f>y@#d$^>d}fH*E~)QKn7kt>avfZ