From 9178e4ce729b15b09e800c8c4e43e737fe806cc6 Mon Sep 17 00:00:00 2001 From: ManikaDhiman Date: Fri, 10 May 2019 09:52:59 -0700 Subject: [PATCH 01/90] Added 19H1 new policy doc and policy --- .../policy-configuration-service-provider.md | 9 ++ .../mdm/policy-csp-servicecontrolmanager.md | 115 ++++++++++++++++++ 2 files changed, 124 insertions(+) create mode 100644 windows/client-management/mdm/policy-csp-servicecontrolmanager.md diff --git a/windows/client-management/mdm/policy-configuration-service-provider.md b/windows/client-management/mdm/policy-configuration-service-provider.md index a27926a537..58bba60460 100644 --- a/windows/client-management/mdm/policy-configuration-service-provider.md +++ b/windows/client-management/mdm/policy-configuration-service-provider.md @@ -2927,6 +2927,13 @@ The following diagram shows the Policy configuration service provider in tree fo +### ServiceControlManager policies +
+
+ ServiceControlManager/SvchostProcessMitigation +
+
+ ### Settings policies
@@ -4112,6 +4119,7 @@ The following diagram shows the Policy configuration service provider in tree fo - [RemoteShell/SpecifyMaxProcesses](./policy-csp-remoteshell.md#remoteshell-specifymaxprocesses) - [RemoteShell/SpecifyMaxRemoteShells](./policy-csp-remoteshell.md#remoteshell-specifymaxremoteshells) - [RemoteShell/SpecifyShellTimeout](./policy-csp-remoteshell.md#remoteshell-specifyshelltimeout) +- [ServiceControlManager/SvchostProcessMitigation](./policy-csp-servicecontrolmanager.md#servicecontrolmanager-svchostprocessmitigation) - [Storage/EnhancedStorageDevices](./policy-csp-storage.md#storage-enhancedstoragedevices) - [System/BootStartDriverInitialization](./policy-csp-system.md#system-bootstartdriverinitialization) - [System/DisableSystemRestore](./policy-csp-system.md#system-disablesystemrestore) @@ -4833,6 +4841,7 @@ The following diagram shows the Policy configuration service provider in tree fo - [Search/PreventIndexingLowDiskSpaceMB](./policy-csp-search.md#search-preventindexinglowdiskspacemb) - [Search/PreventRemoteQueries](./policy-csp-search.md#search-preventremotequeries) - [Security/ClearTPMIfNotReady](./policy-csp-security.md#security-cleartpmifnotready) +- [ServiceControlManager/SvchostProcessMitigation](./policy-csp-servicecontrolmanager.md#servicecontrolmanager-svchostprocessmitigation) - [Settings/AllowOnlineTips](./policy-csp-settings.md#settings-allowonlinetips) - [Settings/ConfigureTaskbarCalendar](./policy-csp-settings.md#settings-configuretaskbarcalendar) - [Settings/PageVisibilityList](./policy-csp-settings.md#settings-pagevisibilitylist) diff --git a/windows/client-management/mdm/policy-csp-servicecontrolmanager.md b/windows/client-management/mdm/policy-csp-servicecontrolmanager.md new file mode 100644 index 0000000000..a2558d44fc --- /dev/null +++ b/windows/client-management/mdm/policy-csp-servicecontrolmanager.md @@ -0,0 +1,115 @@ +--- +title: Policy CSP - ServiceControlManager +description: Policy CSP - ServiceControlManager +ms.author: Heidi.Lohr +ms.topic: article +ms.prod: w10 +ms.technology: windows +author: Heidilohr +ms.date: 05/10/2019 +--- + +# Policy CSP - ServiceControlManager + +> [!WARNING] +> Some information relates to prereleased products, which may be substantially modified before it's commercially released. Microsoft makes no warranties, expressed or implied, concerning the information provided here. + + +
+ + +## ServiceControlManager policies + +
+
+ ServiceControlManager/SvchostProcessMitigation +
+
+ +
+ + +**ServiceControlManager/SvchostProcessMitigation** + + + + + + + + + + + + + + + + + + + + + +
HomeProBusinessEnterpriseEducationMobileMobile Enterprise
cross markcross markcheck mark6check mark6check mark6
+ + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +This policy setting enables process mitigation options on svchost.exe processes. + +If you enable this policy setting, built-in system services hosted in svchost.exe processes will have stricter security policies enabled on them. + +This includes Microsoft to sign a policy requiring all binaries loaded on SVCHOST processes and a policy disallowing dynamically generated code. + +If you disable or do not configure this policy setting, the stricter security settings will not be applied. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). + +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). + +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Enable svchost.exe mitigation options* +- GP name: *SvchostProcessMitigationEnable* +- GP path: *System/Service Control Manager Settings/Security Settings* +- GP ADMX file name: *ServiceControlManager.admx* + + + +Supported values: +- disabled - Do not add ACG/CIG enforcement and other process mitigation/code integrity policies to SVCHOST processes. +- enabled - Add ACG/CIG enforcement and other process mitigation/code integrity policies to SVCHOST processes. + + + + + + + + + + + +
+ +Footnotes: + +- 1 - Added in Windows 10, version 1607. +- 2 - Added in Windows 10, version 1703. +- 3 - Added in Windows 10, version 1709. +- 4 - Added in Windows 10, version 1803. +- 5 - Added in Windows 10, version 1809. +- 6 - Added in Windows 10, version 1903. \ No newline at end of file From 0698551ddba4bd99d3d06c7550a103103680f912 Mon Sep 17 00:00:00 2001 From: Orlando Rodriguez <49177883+ojrb@users.noreply.github.com> Date: Fri, 10 May 2019 12:52:08 -0500 Subject: [PATCH 02/90] Update hello-hybrid-key-trust-prereqs.md --- .../hello-hybrid-key-trust-prereqs.md | 15 ++++++++++++++- 1 file changed, 14 insertions(+), 1 deletion(-) diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust-prereqs.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust-prereqs.md index 1993139da7..73a2919976 100644 --- a/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust-prereqs.md +++ b/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust-prereqs.md @@ -58,7 +58,20 @@ The Windows Hello for Business deployment depends on an enterprise public key in Key trust deployments do not need client issued certificates for on-premises authentication. Active Directory user accounts are automatically configured for public key mapping by Azure AD Connect synchronizing the public key of the registered Windows Hello for Business credential to an attribute on the user's Active Directory object. -The minimum required enterprise certificate authority that can be used with Windows Hello for Business is Windows Server 2012. +The minimum required enterprise certificate authority that can be used with Windows Hello for Business is Windows Server 2012, but you can use a 3rd Party enterprise certification authority too. The detailed requieriments for the Domain Controller certificate are shown below. + +* The certificate must have a CRL distribution-point extension that points to a valid certificate revocation list (CRL). +* Optionally, the certificate Subject section should contain the directory path of the server object (the distinguished name) +* The certificate Key Usage section must contain: +Digital Signature, Key Encipherment +* Optionally, the certificate Basic Constraints section should contain: +[Subject Type=End Entity, Path Length Constraint=None] +* The certificate Enhanced Key Usage section must contain: Client Authentication (1.3.6.1.5.5.7.3.2) and Server Authentication (1.3.6.1.5.5.7.3.1) +* The certificate Subject Alternative Name section must contain the Domain Name System (DNS) name. +* The certificate template must have an extension that has the BMP data value "DomainController." +* The domain controller certificate must be installed in the local computer's certificate store + + > [!IMPORTANT] > For Azure AD joined device to authenticate to and use on-premises resources, ensure you: From d51bdc2327b1e520721a2e53b33a06aadaa75113 Mon Sep 17 00:00:00 2001 From: illfated Date: Fri, 19 Apr 2019 16:45:28 +0200 Subject: [PATCH 03/90] Surface Hub: note for creating accounts using EAC According to user feedback, using the Exchange Admin Center to create Surface Hub device user accounts requires on-premises Active Directory to synchronize from, for that method to work. Closes #3295 --- devices/surface-hub/create-a-device-account-using-office-365.md | 2 ++ 1 file changed, 2 insertions(+) diff --git a/devices/surface-hub/create-a-device-account-using-office-365.md b/devices/surface-hub/create-a-device-account-using-office-365.md index 2d52e698c0..7166019087 100644 --- a/devices/surface-hub/create-a-device-account-using-office-365.md +++ b/devices/surface-hub/create-a-device-account-using-office-365.md @@ -217,6 +217,8 @@ In order to enable Skype for Business, your environment will need to meet the fo ## Create a device account using the Exchange Admin Center +>[!NOTE] +>This method will only work if you have an on-premises Active Directory that you are syncing from. You can use the Exchange Admin Center to create a device account: From d42a7b0c3b97ca0c8f40495219e917f95e764845 Mon Sep 17 00:00:00 2001 From: Orlando Rodriguez <49177883+ojrb@users.noreply.github.com> Date: Mon, 13 May 2019 11:57:49 -0500 Subject: [PATCH 04/90] Update windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust-prereqs.md Co-Authored-By: Nicole Turner <39884432+nenonix@users.noreply.github.com> --- .../hello-for-business/hello-hybrid-key-trust-prereqs.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust-prereqs.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust-prereqs.md index 73a2919976..2e9bd1375c 100644 --- a/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust-prereqs.md +++ b/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust-prereqs.md @@ -58,7 +58,7 @@ The Windows Hello for Business deployment depends on an enterprise public key in Key trust deployments do not need client issued certificates for on-premises authentication. Active Directory user accounts are automatically configured for public key mapping by Azure AD Connect synchronizing the public key of the registered Windows Hello for Business credential to an attribute on the user's Active Directory object. -The minimum required enterprise certificate authority that can be used with Windows Hello for Business is Windows Server 2012, but you can use a 3rd Party enterprise certification authority too. The detailed requieriments for the Domain Controller certificate are shown below. +The minimum required enterprise certificate authority that can be used with Windows Hello for Business is Windows Server 2012, but you can also use a third-party enterprise certification authority. The detailed requirements for the Domain Controller certificate are shown below. * The certificate must have a CRL distribution-point extension that points to a valid certificate revocation list (CRL). * Optionally, the certificate Subject section should contain the directory path of the server object (the distinguished name) From 250089d828d765c881cb41693a911bf249907ea8 Mon Sep 17 00:00:00 2001 From: Orlando Rodriguez <49177883+ojrb@users.noreply.github.com> Date: Mon, 13 May 2019 11:58:41 -0500 Subject: [PATCH 05/90] Update windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust-prereqs.md Co-Authored-By: Nicole Turner <39884432+nenonix@users.noreply.github.com> --- .../hello-for-business/hello-hybrid-key-trust-prereqs.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust-prereqs.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust-prereqs.md index 2e9bd1375c..cfa4d2724c 100644 --- a/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust-prereqs.md +++ b/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust-prereqs.md @@ -60,7 +60,7 @@ Key trust deployments do not need client issued certificates for on-premises aut The minimum required enterprise certificate authority that can be used with Windows Hello for Business is Windows Server 2012, but you can also use a third-party enterprise certification authority. The detailed requirements for the Domain Controller certificate are shown below. -* The certificate must have a CRL distribution-point extension that points to a valid certificate revocation list (CRL). +* The certificate must have a Certificate Revocation List (CRL) distribution point extension that points to a valid CRL. * Optionally, the certificate Subject section should contain the directory path of the server object (the distinguished name) * The certificate Key Usage section must contain: Digital Signature, Key Encipherment From 70f35d9b556ca77586782b3fa234d89b59e7ebee Mon Sep 17 00:00:00 2001 From: Orlando Rodriguez <49177883+ojrb@users.noreply.github.com> Date: Mon, 13 May 2019 11:59:11 -0500 Subject: [PATCH 06/90] Update windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust-prereqs.md Co-Authored-By: Nicole Turner <39884432+nenonix@users.noreply.github.com> --- .../hello-for-business/hello-hybrid-key-trust-prereqs.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust-prereqs.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust-prereqs.md index cfa4d2724c..8e2a006a40 100644 --- a/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust-prereqs.md +++ b/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust-prereqs.md @@ -61,7 +61,7 @@ Key trust deployments do not need client issued certificates for on-premises aut The minimum required enterprise certificate authority that can be used with Windows Hello for Business is Windows Server 2012, but you can also use a third-party enterprise certification authority. The detailed requirements for the Domain Controller certificate are shown below. * The certificate must have a Certificate Revocation List (CRL) distribution point extension that points to a valid CRL. -* Optionally, the certificate Subject section should contain the directory path of the server object (the distinguished name) +* Optionally, the certificate Subject section should contain the directory path of the server object (the distinguished name). * The certificate Key Usage section must contain: Digital Signature, Key Encipherment * Optionally, the certificate Basic Constraints section should contain: From 6f1af988debf6ac45f39b9d2dd82f20f68fad894 Mon Sep 17 00:00:00 2001 From: Orlando Rodriguez <49177883+ojrb@users.noreply.github.com> Date: Mon, 13 May 2019 11:59:46 -0500 Subject: [PATCH 07/90] Update windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust-prereqs.md Co-Authored-By: Nicole Turner <39884432+nenonix@users.noreply.github.com> --- .../hello-for-business/hello-hybrid-key-trust-prereqs.md | 1 - 1 file changed, 1 deletion(-) diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust-prereqs.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust-prereqs.md index 8e2a006a40..fa127fbc9c 100644 --- a/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust-prereqs.md +++ b/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust-prereqs.md @@ -63,7 +63,6 @@ The minimum required enterprise certificate authority that can be used with Wind * The certificate must have a Certificate Revocation List (CRL) distribution point extension that points to a valid CRL. * Optionally, the certificate Subject section should contain the directory path of the server object (the distinguished name). * The certificate Key Usage section must contain: -Digital Signature, Key Encipherment * Optionally, the certificate Basic Constraints section should contain: [Subject Type=End Entity, Path Length Constraint=None] * The certificate Enhanced Key Usage section must contain: Client Authentication (1.3.6.1.5.5.7.3.2) and Server Authentication (1.3.6.1.5.5.7.3.1) From 479a1ff8734f6d075d3ef75328f6d9013145d24b Mon Sep 17 00:00:00 2001 From: Orlando Rodriguez <49177883+ojrb@users.noreply.github.com> Date: Mon, 13 May 2019 12:00:13 -0500 Subject: [PATCH 08/90] Update windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust-prereqs.md Co-Authored-By: Nicole Turner <39884432+nenonix@users.noreply.github.com> --- .../hello-for-business/hello-hybrid-key-trust-prereqs.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust-prereqs.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust-prereqs.md index fa127fbc9c..5255ad8eec 100644 --- a/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust-prereqs.md +++ b/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust-prereqs.md @@ -62,7 +62,7 @@ The minimum required enterprise certificate authority that can be used with Wind * The certificate must have a Certificate Revocation List (CRL) distribution point extension that points to a valid CRL. * Optionally, the certificate Subject section should contain the directory path of the server object (the distinguished name). -* The certificate Key Usage section must contain: +* The certificate Key Usage section must contain Digital Signature and Key Encipherment. * Optionally, the certificate Basic Constraints section should contain: [Subject Type=End Entity, Path Length Constraint=None] * The certificate Enhanced Key Usage section must contain: Client Authentication (1.3.6.1.5.5.7.3.2) and Server Authentication (1.3.6.1.5.5.7.3.1) From 72371c8e34b8d360a8036c9f662f20da9f9debe2 Mon Sep 17 00:00:00 2001 From: Orlando Rodriguez <49177883+ojrb@users.noreply.github.com> Date: Mon, 13 May 2019 12:00:31 -0500 Subject: [PATCH 09/90] Update windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust-prereqs.md Co-Authored-By: Nicole Turner <39884432+nenonix@users.noreply.github.com> --- .../hello-for-business/hello-hybrid-key-trust-prereqs.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust-prereqs.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust-prereqs.md index 5255ad8eec..dfe1bdb31d 100644 --- a/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust-prereqs.md +++ b/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust-prereqs.md @@ -65,7 +65,7 @@ The minimum required enterprise certificate authority that can be used with Wind * The certificate Key Usage section must contain Digital Signature and Key Encipherment. * Optionally, the certificate Basic Constraints section should contain: [Subject Type=End Entity, Path Length Constraint=None] -* The certificate Enhanced Key Usage section must contain: Client Authentication (1.3.6.1.5.5.7.3.2) and Server Authentication (1.3.6.1.5.5.7.3.1) +* The certificate Enhanced Key Usage section must contain Client Authentication (1.3.6.1.5.5.7.3.2) and Server Authentication (1.3.6.1.5.5.7.3.1). * The certificate Subject Alternative Name section must contain the Domain Name System (DNS) name. * The certificate template must have an extension that has the BMP data value "DomainController." * The domain controller certificate must be installed in the local computer's certificate store From 6f42299166ef7a8eb90d449098abd5fd088c077a Mon Sep 17 00:00:00 2001 From: Orlando Rodriguez <49177883+ojrb@users.noreply.github.com> Date: Mon, 13 May 2019 12:00:54 -0500 Subject: [PATCH 10/90] Update windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust-prereqs.md Co-Authored-By: Nicole Turner <39884432+nenonix@users.noreply.github.com> --- .../hello-for-business/hello-hybrid-key-trust-prereqs.md | 1 - 1 file changed, 1 deletion(-) diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust-prereqs.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust-prereqs.md index dfe1bdb31d..c6ad8bf880 100644 --- a/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust-prereqs.md +++ b/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust-prereqs.md @@ -64,7 +64,6 @@ The minimum required enterprise certificate authority that can be used with Wind * Optionally, the certificate Subject section should contain the directory path of the server object (the distinguished name). * The certificate Key Usage section must contain Digital Signature and Key Encipherment. * Optionally, the certificate Basic Constraints section should contain: -[Subject Type=End Entity, Path Length Constraint=None] * The certificate Enhanced Key Usage section must contain Client Authentication (1.3.6.1.5.5.7.3.2) and Server Authentication (1.3.6.1.5.5.7.3.1). * The certificate Subject Alternative Name section must contain the Domain Name System (DNS) name. * The certificate template must have an extension that has the BMP data value "DomainController." From dca438d5b4f8cbf5c36ad1d1d5085956a2a00dd4 Mon Sep 17 00:00:00 2001 From: Orlando Rodriguez <49177883+ojrb@users.noreply.github.com> Date: Mon, 13 May 2019 12:01:09 -0500 Subject: [PATCH 11/90] Update windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust-prereqs.md Co-Authored-By: Nicole Turner <39884432+nenonix@users.noreply.github.com> --- .../hello-for-business/hello-hybrid-key-trust-prereqs.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust-prereqs.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust-prereqs.md index c6ad8bf880..86afa736bf 100644 --- a/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust-prereqs.md +++ b/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust-prereqs.md @@ -66,7 +66,7 @@ The minimum required enterprise certificate authority that can be used with Wind * Optionally, the certificate Basic Constraints section should contain: * The certificate Enhanced Key Usage section must contain Client Authentication (1.3.6.1.5.5.7.3.2) and Server Authentication (1.3.6.1.5.5.7.3.1). * The certificate Subject Alternative Name section must contain the Domain Name System (DNS) name. -* The certificate template must have an extension that has the BMP data value "DomainController." +* The certificate template must have an extension that has the BMP data value "DomainController". * The domain controller certificate must be installed in the local computer's certificate store From 3aa10bc1504fdadd15316df6265672b3d99120bb Mon Sep 17 00:00:00 2001 From: Orlando Rodriguez <49177883+ojrb@users.noreply.github.com> Date: Mon, 13 May 2019 12:01:35 -0500 Subject: [PATCH 12/90] Update windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust-prereqs.md Co-Authored-By: Nicole Turner <39884432+nenonix@users.noreply.github.com> --- .../hello-for-business/hello-hybrid-key-trust-prereqs.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust-prereqs.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust-prereqs.md index 86afa736bf..9b3432c015 100644 --- a/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust-prereqs.md +++ b/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust-prereqs.md @@ -67,7 +67,7 @@ The minimum required enterprise certificate authority that can be used with Wind * The certificate Enhanced Key Usage section must contain Client Authentication (1.3.6.1.5.5.7.3.2) and Server Authentication (1.3.6.1.5.5.7.3.1). * The certificate Subject Alternative Name section must contain the Domain Name System (DNS) name. * The certificate template must have an extension that has the BMP data value "DomainController". -* The domain controller certificate must be installed in the local computer's certificate store +* The domain controller certificate must be installed in the local computer's certificate store. From 111800e5bd586ad579d72d28a7bba9c9b36fce22 Mon Sep 17 00:00:00 2001 From: MaratMussabekov <48041687+MaratMussabekov@users.noreply.github.com> Date: Wed, 15 May 2019 10:19:09 +0500 Subject: [PATCH 13/90] update windows-defender-exploit-guard.md --- .../windows-defender-exploit-guard.md | 15 +++++++++------ 1 file changed, 9 insertions(+), 6 deletions(-) diff --git a/windows/security/threat-protection/windows-defender-exploit-guard/windows-defender-exploit-guard.md b/windows/security/threat-protection/windows-defender-exploit-guard/windows-defender-exploit-guard.md index 32055b2546..957c81811a 100644 --- a/windows/security/threat-protection/windows-defender-exploit-guard/windows-defender-exploit-guard.md +++ b/windows/security/threat-protection/windows-defender-exploit-guard/windows-defender-exploit-guard.md @@ -57,12 +57,15 @@ This section covers requirements for each feature in Windows Defender EG. | ![supported](./images/ball_50.png) | Supported | | ![supported, full reporting](./images/ball_full.png) | Recommended. Includes full, automated reporting into the Windows Defender ATP console. Provides additional cloud-powered capabilities, including the Network protection ability to block apps from accessing low-reputation websites and an attack surface reduction rule that blocks executable files that meet age or prevalence criteria.| -| Feature | Windows 10 Home | Windows 10 Professional | Windows 10 E3 | Windows 10 E5 | -| ----------------- | :------------------------------------: | :---------------------------: | :-------------------------: | :--------------------------------------: | -| Exploit protection | ![supported](./images/ball_50.png) | ![supported](./images/ball_50.png) | ![supported, enhanced](./images/ball_50.png) | ![supported, full reporting](./images/ball_full.png) | -| Attack surface reduction rules | ![not supported](./images/ball_empty.png) | ![not supported](./images/ball_empty.png) | ![supported, limited reporting](./images/ball_50.png) | ![supported, full reporting](./images/ball_full.png) | -| Network protection | ![not supported](./images/ball_empty.png) | ![not supported](./images/ball_empty.png) | ![supported, limited reporting](./images/ball_50.png) | ![supported, full reporting](./images/ball_full.png) | -| Controlled folder access | ![supported, limited reporting](./images/ball_50.png) | ![supported, limited reporting](./images/ball_50.png) | ![supported, limited reporting](./images/ball_50.png) | ![supported, full reporting](./images/ball_full.png) | +| Feature | Windows 10 Home | Windows 10 Professional | Windows 10 Enterprise | Windows 10 with Enterprise E3 subscription | Windows 10 with Enterprise E5 subscription | +| ----------------- | :------------------------------------: | :---------------------------: | :-------------------------: | :--------------------------------------: | :--------------------------------------: | +| Exploit protection | ![supported](./images/ball_50.png) | ![supported](./images/ball_50.png) | ![supported, enhanced](./images/ball_50.png) | ![supported, enhanced](./images/ball_50.png) | ![supported, full reporting](./images/ball_full.png) | +| Attack surface reduction rules | ![not supported](./images/ball_empty.png) | ![not supported](./images/ball_empty.png) | ![supported, limited reporting](./images/ball_50.png) | ![supported, limited reporting](./images/ball_50.png) | ![supported, full reporting](./images/ball_full.png) | +| Network protection | ![not supported](./images/ball_empty.png) | ![not supported](./images/ball_empty.png) | ![supported, limited reporting](./images/ball_50.png) | ![supported, limited reporting](./images/ball_50.png) | ![supported, full reporting](./images/ball_full.png) | +| Controlled folder access | ![supported, limited reporting](./images/ball_50.png) | ![supported, limited reporting](./images/ball_50.png) | ![supported, limited reporting](./images/ball_50.png) | ![supported, limited reporting](./images/ball_50.png) | ![supported, full reporting](./images/ball_full.png) | + +>[!NOTE] +> [Identity & Threat Protection package](https://www.microsoft.com/microsoft-365/blog/2019/01/02/introducing-new-advanced-security-and-compliance-offerings-for-microsoft-365/), available for Microsoft 365 E3 customers, provides the same Windows Defender ATP capabilities as Enterprise E5 subscription. The following table lists which features in Windows Defender EG require enabling [real-time protection](../windows-defender-antivirus/configure-real-time-protection-windows-defender-antivirus.md) from Windows Defender Antivirus. From 3586e4e66216238a436bd3ec69076f9ecbe91c98 Mon Sep 17 00:00:00 2001 From: Marcus <49599477+h3xmarcux@users.noreply.github.com> Date: Wed, 15 May 2019 15:18:46 +0100 Subject: [PATCH 14/90] Update advanced-security-auditing-faq.md --- .../auditing/advanced-security-auditing-faq.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/auditing/advanced-security-auditing-faq.md b/windows/security/threat-protection/auditing/advanced-security-auditing-faq.md index 6935b85eb1..3d4c6fe39a 100644 --- a/windows/security/threat-protection/auditing/advanced-security-auditing-faq.md +++ b/windows/security/threat-protection/auditing/advanced-security-auditing-faq.md @@ -83,7 +83,7 @@ The rules that govern how Group Policy settings are applied propagate to the sub | - | - | - | -| | Detailed File Share Auditing | Success | Failure | Success | | Process Creation Auditing | Disabled | Success | Disabled | -| Logon Auditing | Success | Failure | Failure | +| Logon Auditing | Success | Failure | Success | ## What is the difference between an object DACL and an object SACL? From 13d8ad3af499a258e2f748ec71c252ff43d7fe04 Mon Sep 17 00:00:00 2001 From: Jose Ortega Date: Wed, 15 May 2019 17:29:56 -0500 Subject: [PATCH 15/90] Do a Reboot for Restart the PC. --- ...windows-operating-system-components-to-microsoft-services.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services.md b/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services.md index 11f72817b6..69de4938f5 100644 --- a/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services.md +++ b/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services.md @@ -769,7 +769,7 @@ To remove the News app: -or- >[!IMPORTANT] -> If you have any issues with these commands, do a system reboot and try the scripts again. +> If you have any issues with these commands, restart the PC and try the scripts again. > - Remove the app for new user accounts. From an elevated command prompt, run the following Windows PowerShell command: **Get-AppxProvisionedPackage -Online | Where-Object {$\_.PackageName -Like "Microsoft.BingNews"} | ForEach-Object { Remove-AppxProvisionedPackage -Online -PackageName $\_.PackageName}** From e5b83dc638fe50dc32fae1d283465bccf11e789e Mon Sep 17 00:00:00 2001 From: "Trond B. Krokli" <38162891+illfated@users.noreply.github.com> Date: Thu, 16 May 2019 02:56:41 +0200 Subject: [PATCH 16/90] Update devices/surface-hub/create-a-device-account-using-office-365.md Pragmatic grammar change. --- devices/surface-hub/create-a-device-account-using-office-365.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/devices/surface-hub/create-a-device-account-using-office-365.md b/devices/surface-hub/create-a-device-account-using-office-365.md index 7166019087..d1fbebaa56 100644 --- a/devices/surface-hub/create-a-device-account-using-office-365.md +++ b/devices/surface-hub/create-a-device-account-using-office-365.md @@ -218,7 +218,7 @@ In order to enable Skype for Business, your environment will need to meet the fo ## Create a device account using the Exchange Admin Center >[!NOTE] ->This method will only work if you have an on-premises Active Directory that you are syncing from. +> This method will only work if you are syncing from an on-premises Active Directory. You can use the Exchange Admin Center to create a device account: From 73c4c68274a2c4b7c52884ab29e822febd5b4534 Mon Sep 17 00:00:00 2001 From: MaratMussabekov <48041687+MaratMussabekov@users.noreply.github.com> Date: Thu, 16 May 2019 10:28:13 +0500 Subject: [PATCH 17/90] update windows-defender-exploit-guard.md --- .../windows-defender-exploit-guard.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/windows-defender-exploit-guard/windows-defender-exploit-guard.md b/windows/security/threat-protection/windows-defender-exploit-guard/windows-defender-exploit-guard.md index 957c81811a..da228553fc 100644 --- a/windows/security/threat-protection/windows-defender-exploit-guard/windows-defender-exploit-guard.md +++ b/windows/security/threat-protection/windows-defender-exploit-guard/windows-defender-exploit-guard.md @@ -65,7 +65,7 @@ This section covers requirements for each feature in Windows Defender EG. | Controlled folder access | ![supported, limited reporting](./images/ball_50.png) | ![supported, limited reporting](./images/ball_50.png) | ![supported, limited reporting](./images/ball_50.png) | ![supported, limited reporting](./images/ball_50.png) | ![supported, full reporting](./images/ball_full.png) | >[!NOTE] -> [Identity & Threat Protection package](https://www.microsoft.com/microsoft-365/blog/2019/01/02/introducing-new-advanced-security-and-compliance-offerings-for-microsoft-365/), available for Microsoft 365 E3 customers, provides the same Windows Defender ATP capabilities as Enterprise E5 subscription. +> The [Identity & Threat Protection package](https://www.microsoft.com/microsoft-365/blog/2019/01/02/introducing-new-advanced-security-and-compliance-offerings-for-microsoft-365/), available for Microsoft 365 E3 customers, provides the same Windows Defender ATP capabilities as Enterprise E5 subscription. The following table lists which features in Windows Defender EG require enabling [real-time protection](../windows-defender-antivirus/configure-real-time-protection-windows-defender-antivirus.md) from Windows Defender Antivirus. From ad020077ac6c17a8f95057765b4a4e413e7a14e5 Mon Sep 17 00:00:00 2001 From: Jose Ortega Date: Thu, 16 May 2019 01:22:04 -0500 Subject: [PATCH 18/90] Resolving ISsue#915 --- .../whats-new-windows-10-version-1803.md | 15 ++++++++------- 1 file changed, 8 insertions(+), 7 deletions(-) diff --git a/windows/whats-new/whats-new-windows-10-version-1803.md b/windows/whats-new/whats-new-windows-10-version-1803.md index a4846edc0d..359a0c2ae5 100644 --- a/windows/whats-new/whats-new-windows-10-version-1803.md +++ b/windows/whats-new/whats-new-windows-10-version-1803.md @@ -22,11 +22,8 @@ This article lists new and updated features and content that are of interest to The following 3-minute video summarizes some of the new features that are available for IT Pros in this release. -  - > [!video https://www.microsoft.com/en-us/videoplayer/embed/RE21ada?autoplay=false] - ## Deployment ### Windows Autopilot @@ -135,7 +132,7 @@ Portions of the work done during the offline phases of a Windows update have bee ### Co-management -Intune and System Center Configuration Manager policies have been added to enable hybrid Azure AD-joined authentication. Mobile Device Management (MDM) has added over 150 new policies and settings in this release, including the [MDMWinsOverGP](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-controlpolicyconflict) policy, to enable easier transition to cloud-based management. +**Intune** and **System Center Configuration Manager** policies have been added to enable hybrid Azure AD-joined authentication. Mobile Device Management (MDM) has added over 150 new policies and settings in this release, including the [MDMWinsOverGP](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-controlpolicyconflict) policy, to enable easier transition to cloud-based management. For more information, see [What's New in MDM enrollment and management](https://docs.microsoft.com/windows/client-management/mdm/new-in-windows-mdm-enrollment-management#whatsnew1803) @@ -231,8 +228,12 @@ Support in [Windows Defender Application Guard](#windows-defender-application-gu ## See Also -[Windows 10 Features](https://www.microsoft.com/windows/features): Review general information about Windows 10 features.
-[What's New in Windows 10](https://docs.microsoft.com/windows/whats-new/): See what’s new in other versions of Windows 10.
-[What's new in Windows 10, version 1709](https://docs.microsoft.com/windows-hardware/get-started/what-s-new-in-windows): See what’s new in Windows 10 hardware.
+[Windows 10 Features](https://www.microsoft.com/windows/features): Review general information about Windows 10 features. + +[What's New in Windows 10](https://docs.microsoft.com/windows/whats-new/): See what’s new in other versions of Windows 10. + +[What's new in Windows 10, version 1709](https://docs.microsoft.com/windows-hardware/get-started/what-s-new-in-windows): See what’s new in Windows 10 hardware. + [Windows 10 Fall Creators Update Next Generation Security](https://www.youtube.com/watch?v=JDGMNFwyUg8): YouTube video about Windows Defender ATP in Windows 10, version 1709. + From 590ba2a7ecfa171d0dd4abb8dac043d09680fdc7 Mon Sep 17 00:00:00 2001 From: alexander7567 <1144391+alexander7567@users.noreply.github.com> Date: Thu, 16 May 2019 10:16:53 -0400 Subject: [PATCH 19/90] Fixed missing colon in path Fixed missing colon in path --- .../client-management/advanced-troubleshooting-boot-problems.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/client-management/advanced-troubleshooting-boot-problems.md b/windows/client-management/advanced-troubleshooting-boot-problems.md index 101ca103bc..b80840d43d 100644 --- a/windows/client-management/advanced-troubleshooting-boot-problems.md +++ b/windows/client-management/advanced-troubleshooting-boot-problems.md @@ -385,6 +385,6 @@ If the dump file shows an error that is related to a driver (for example, window 1. Start WinRE, and open a Command Prompt window. 2. Start a text editor, such as Notepad. - 3. Navigate to C\Windows\System32\Config\. + 3. Navigate to C:\Windows\System32\Config\. 4. Rename the all five hives by appending ".old" to the name. 5. Copy all the hives from the Regback folder, paste them in the Config folder, and then try to start the computer in Normal mode. From 3279e783ff5721e26416fe24157a90498403d8cf Mon Sep 17 00:00:00 2001 From: Jose Gabriel Ortega Castro Date: Thu, 16 May 2019 11:17:29 -0500 Subject: [PATCH 20/90] Update windows/whats-new/whats-new-windows-10-version-1803.md Co-Authored-By: Nicole Turner <39884432+nenonix@users.noreply.github.com> --- windows/whats-new/whats-new-windows-10-version-1803.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/whats-new/whats-new-windows-10-version-1803.md b/windows/whats-new/whats-new-windows-10-version-1803.md index 359a0c2ae5..b0aa87146e 100644 --- a/windows/whats-new/whats-new-windows-10-version-1803.md +++ b/windows/whats-new/whats-new-windows-10-version-1803.md @@ -228,7 +228,7 @@ Support in [Windows Defender Application Guard](#windows-defender-application-gu ## See Also -[Windows 10 Features](https://www.microsoft.com/windows/features): Review general information about Windows 10 features. +- [Windows 10 Features](https://www.microsoft.com/windows/features): Review general information about Windows 10 features. [What's New in Windows 10](https://docs.microsoft.com/windows/whats-new/): See what’s new in other versions of Windows 10. From 7e3c471554b2d1cbb176262bb34acdc35d2846e7 Mon Sep 17 00:00:00 2001 From: Jose Gabriel Ortega Castro Date: Thu, 16 May 2019 11:17:42 -0500 Subject: [PATCH 21/90] Update windows/whats-new/whats-new-windows-10-version-1803.md Co-Authored-By: Nicole Turner <39884432+nenonix@users.noreply.github.com> --- windows/whats-new/whats-new-windows-10-version-1803.md | 1 - 1 file changed, 1 deletion(-) diff --git a/windows/whats-new/whats-new-windows-10-version-1803.md b/windows/whats-new/whats-new-windows-10-version-1803.md index b0aa87146e..4976aba0c4 100644 --- a/windows/whats-new/whats-new-windows-10-version-1803.md +++ b/windows/whats-new/whats-new-windows-10-version-1803.md @@ -229,7 +229,6 @@ Support in [Windows Defender Application Guard](#windows-defender-application-gu ## See Also - [Windows 10 Features](https://www.microsoft.com/windows/features): Review general information about Windows 10 features. - [What's New in Windows 10](https://docs.microsoft.com/windows/whats-new/): See what’s new in other versions of Windows 10. [What's new in Windows 10, version 1709](https://docs.microsoft.com/windows-hardware/get-started/what-s-new-in-windows): See what’s new in Windows 10 hardware. From c307294550eaf40eb189a8a73f2679bfc725dcfa Mon Sep 17 00:00:00 2001 From: Jose Gabriel Ortega Castro Date: Thu, 16 May 2019 11:17:49 -0500 Subject: [PATCH 22/90] Update windows/whats-new/whats-new-windows-10-version-1803.md Co-Authored-By: Nicole Turner <39884432+nenonix@users.noreply.github.com> --- windows/whats-new/whats-new-windows-10-version-1803.md | 1 - 1 file changed, 1 deletion(-) diff --git a/windows/whats-new/whats-new-windows-10-version-1803.md b/windows/whats-new/whats-new-windows-10-version-1803.md index 4976aba0c4..b303d7d580 100644 --- a/windows/whats-new/whats-new-windows-10-version-1803.md +++ b/windows/whats-new/whats-new-windows-10-version-1803.md @@ -230,7 +230,6 @@ Support in [Windows Defender Application Guard](#windows-defender-application-gu - [Windows 10 Features](https://www.microsoft.com/windows/features): Review general information about Windows 10 features. [What's New in Windows 10](https://docs.microsoft.com/windows/whats-new/): See what’s new in other versions of Windows 10. - [What's new in Windows 10, version 1709](https://docs.microsoft.com/windows-hardware/get-started/what-s-new-in-windows): See what’s new in Windows 10 hardware. [Windows 10 Fall Creators Update Next Generation Security](https://www.youtube.com/watch?v=JDGMNFwyUg8): YouTube video about Windows Defender ATP in Windows 10, version 1709. From 0557f502a02d9a9a7293b12f82d483ee7577396c Mon Sep 17 00:00:00 2001 From: Jose Gabriel Ortega Castro Date: Thu, 16 May 2019 11:17:57 -0500 Subject: [PATCH 23/90] Update windows/whats-new/whats-new-windows-10-version-1803.md Co-Authored-By: Nicole Turner <39884432+nenonix@users.noreply.github.com> --- windows/whats-new/whats-new-windows-10-version-1803.md | 1 - 1 file changed, 1 deletion(-) diff --git a/windows/whats-new/whats-new-windows-10-version-1803.md b/windows/whats-new/whats-new-windows-10-version-1803.md index b303d7d580..8ff528af58 100644 --- a/windows/whats-new/whats-new-windows-10-version-1803.md +++ b/windows/whats-new/whats-new-windows-10-version-1803.md @@ -231,7 +231,6 @@ Support in [Windows Defender Application Guard](#windows-defender-application-gu - [Windows 10 Features](https://www.microsoft.com/windows/features): Review general information about Windows 10 features. [What's New in Windows 10](https://docs.microsoft.com/windows/whats-new/): See what’s new in other versions of Windows 10. [What's new in Windows 10, version 1709](https://docs.microsoft.com/windows-hardware/get-started/what-s-new-in-windows): See what’s new in Windows 10 hardware. - [Windows 10 Fall Creators Update Next Generation Security](https://www.youtube.com/watch?v=JDGMNFwyUg8): YouTube video about Windows Defender ATP in Windows 10, version 1709. From 66d8ae4a07ab0f86234bf97985d834aec332f5ce Mon Sep 17 00:00:00 2001 From: Jose Gabriel Ortega Castro Date: Thu, 16 May 2019 11:18:06 -0500 Subject: [PATCH 24/90] Update windows/whats-new/whats-new-windows-10-version-1803.md Co-Authored-By: Nicole Turner <39884432+nenonix@users.noreply.github.com> --- windows/whats-new/whats-new-windows-10-version-1803.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/whats-new/whats-new-windows-10-version-1803.md b/windows/whats-new/whats-new-windows-10-version-1803.md index 8ff528af58..0f56c2a037 100644 --- a/windows/whats-new/whats-new-windows-10-version-1803.md +++ b/windows/whats-new/whats-new-windows-10-version-1803.md @@ -231,6 +231,6 @@ Support in [Windows Defender Application Guard](#windows-defender-application-gu - [Windows 10 Features](https://www.microsoft.com/windows/features): Review general information about Windows 10 features. [What's New in Windows 10](https://docs.microsoft.com/windows/whats-new/): See what’s new in other versions of Windows 10. [What's new in Windows 10, version 1709](https://docs.microsoft.com/windows-hardware/get-started/what-s-new-in-windows): See what’s new in Windows 10 hardware. -[Windows 10 Fall Creators Update Next Generation Security](https://www.youtube.com/watch?v=JDGMNFwyUg8): YouTube video about Windows Defender ATP in Windows 10, version 1709. +- [Windows 10 Fall Creators Update Next Generation Security](https://www.youtube.com/watch?v=JDGMNFwyUg8): YouTube video about Windows Defender ATP in Windows 10, version 1709. From 800d7f46112996a0c0fd85910340ff7801ac283d Mon Sep 17 00:00:00 2001 From: Jose Gabriel Ortega Castro Date: Thu, 16 May 2019 11:18:16 -0500 Subject: [PATCH 25/90] Update windows/whats-new/whats-new-windows-10-version-1803.md Co-Authored-By: Nicole Turner <39884432+nenonix@users.noreply.github.com> --- windows/whats-new/whats-new-windows-10-version-1803.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/whats-new/whats-new-windows-10-version-1803.md b/windows/whats-new/whats-new-windows-10-version-1803.md index 0f56c2a037..edf483eab6 100644 --- a/windows/whats-new/whats-new-windows-10-version-1803.md +++ b/windows/whats-new/whats-new-windows-10-version-1803.md @@ -230,7 +230,7 @@ Support in [Windows Defender Application Guard](#windows-defender-application-gu - [Windows 10 Features](https://www.microsoft.com/windows/features): Review general information about Windows 10 features. [What's New in Windows 10](https://docs.microsoft.com/windows/whats-new/): See what’s new in other versions of Windows 10. -[What's new in Windows 10, version 1709](https://docs.microsoft.com/windows-hardware/get-started/what-s-new-in-windows): See what’s new in Windows 10 hardware. +- [What's new in Windows 10, version 1709](https://docs.microsoft.com/windows-hardware/get-started/what-s-new-in-windows): See what’s new in Windows 10 hardware. - [Windows 10 Fall Creators Update Next Generation Security](https://www.youtube.com/watch?v=JDGMNFwyUg8): YouTube video about Windows Defender ATP in Windows 10, version 1709. From 60cf9d4e55b19e1f158a115337ec8a175686c28d Mon Sep 17 00:00:00 2001 From: Jose Gabriel Ortega Castro Date: Thu, 16 May 2019 11:18:42 -0500 Subject: [PATCH 26/90] Update windows/whats-new/whats-new-windows-10-version-1803.md Co-Authored-By: Nicole Turner <39884432+nenonix@users.noreply.github.com> --- windows/whats-new/whats-new-windows-10-version-1803.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/whats-new/whats-new-windows-10-version-1803.md b/windows/whats-new/whats-new-windows-10-version-1803.md index edf483eab6..220d35e86c 100644 --- a/windows/whats-new/whats-new-windows-10-version-1803.md +++ b/windows/whats-new/whats-new-windows-10-version-1803.md @@ -229,7 +229,7 @@ Support in [Windows Defender Application Guard](#windows-defender-application-gu ## See Also - [Windows 10 Features](https://www.microsoft.com/windows/features): Review general information about Windows 10 features. -[What's New in Windows 10](https://docs.microsoft.com/windows/whats-new/): See what’s new in other versions of Windows 10. +- [What's New in Windows 10](https://docs.microsoft.com/windows/whats-new/): See what’s new in other versions of Windows 10. - [What's new in Windows 10, version 1709](https://docs.microsoft.com/windows-hardware/get-started/what-s-new-in-windows): See what’s new in Windows 10 hardware. - [Windows 10 Fall Creators Update Next Generation Security](https://www.youtube.com/watch?v=JDGMNFwyUg8): YouTube video about Windows Defender ATP in Windows 10, version 1709. From c5ae6b310f7d669c18483802fb3b6c7c49477343 Mon Sep 17 00:00:00 2001 From: John Rajunas Date: Thu, 16 May 2019 12:49:20 -0400 Subject: [PATCH 27/90] Change "Windows Management Instruction" Proposing the correct the phrase "Windows Management Instruction" to "Windows Management Instrumentation" to more accurately reflect the proper meaning of the acronym WMI in this context, and to match the rest of the topic's use of "WMI". --- ...iguration-management-reference-windows-defender-antivirus.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/windows-defender-antivirus/configuration-management-reference-windows-defender-antivirus.md b/windows/security/threat-protection/windows-defender-antivirus/configuration-management-reference-windows-defender-antivirus.md index 901c6c4995..471d647e37 100644 --- a/windows/security/threat-protection/windows-defender-antivirus/configuration-management-reference-windows-defender-antivirus.md +++ b/windows/security/threat-protection/windows-defender-antivirus/configuration-management-reference-windows-defender-antivirus.md @@ -26,7 +26,7 @@ You can manage and configure Windows Defender Antivirus with the following tools - System Center Configuration Manager - Group Policy - PowerShell cmdlets -- Windows Management Instruction (WMI) +- Windows Management Instrumentation (WMI) - The mpcmdrun.exe utility The topics in this section provide further information, links, and resources for using these tools to manage and configure Windows Defender Antivirus. From 9fd74e4aa21426c7eb7e9a542a159135e97319fc Mon Sep 17 00:00:00 2001 From: MaratMussabekov <48041687+MaratMussabekov@users.noreply.github.com> Date: Fri, 17 May 2019 12:00:30 +0500 Subject: [PATCH 28/90] update windows-defender-exploit-guard.md --- .../windows-defender-exploit-guard.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/windows-defender-exploit-guard/windows-defender-exploit-guard.md b/windows/security/threat-protection/windows-defender-exploit-guard/windows-defender-exploit-guard.md index da228553fc..45b1954386 100644 --- a/windows/security/threat-protection/windows-defender-exploit-guard/windows-defender-exploit-guard.md +++ b/windows/security/threat-protection/windows-defender-exploit-guard/windows-defender-exploit-guard.md @@ -65,7 +65,7 @@ This section covers requirements for each feature in Windows Defender EG. | Controlled folder access | ![supported, limited reporting](./images/ball_50.png) | ![supported, limited reporting](./images/ball_50.png) | ![supported, limited reporting](./images/ball_50.png) | ![supported, limited reporting](./images/ball_50.png) | ![supported, full reporting](./images/ball_full.png) | >[!NOTE] -> The [Identity & Threat Protection package](https://www.microsoft.com/microsoft-365/blog/2019/01/02/introducing-new-advanced-security-and-compliance-offerings-for-microsoft-365/), available for Microsoft 365 E3 customers, provides the same Windows Defender ATP capabilities as Enterprise E5 subscription. +> The [Identity & Threat Protection package](https://www.microsoft.com/microsoft-365/blog/2019/01/02/introducing-new-advanced-security-and-compliance-offerings-for-microsoft-365/), available for Microsoft 365 E3 customers, provides the same Windows Defender ATP capabilities as the Enterprise E5 subscription. The following table lists which features in Windows Defender EG require enabling [real-time protection](../windows-defender-antivirus/configure-real-time-protection-windows-defender-antivirus.md) from Windows Defender Antivirus. From 707ecda1ab12f0a332e02544480c4c6973030bf5 Mon Sep 17 00:00:00 2001 From: illfated Date: Fri, 17 May 2019 10:32:39 +0200 Subject: [PATCH 29/90] Update hello-how-it-works-technology.md (TPM section) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit - replace 3 occurrences of the character `�` with a normal No-Break Space character (ASCII 32) - remove 13 redundant blank lines at the end of the document (redundant whitespace) --- .../hello-how-it-works-technology.md | 17 ++--------------- 1 file changed, 2 insertions(+), 15 deletions(-) diff --git a/windows/security/identity-protection/hello-for-business/hello-how-it-works-technology.md b/windows/security/identity-protection/hello-for-business/hello-how-it-works-technology.md index 99026497a4..c8fbed37c7 100644 --- a/windows/security/identity-protection/hello-for-business/hello-how-it-works-technology.md +++ b/windows/security/identity-protection/hello-for-business/hello-how-it-works-technology.md @@ -284,9 +284,9 @@ A TPM implements controls that meet the specification described by the Trusted C - The first TPM specification, version 1.2, was published in February 2005 by the TCG and standardized under ISO / IEC 11889 standard. - The latest TPM specification, referred to as TPM 2.0, was released in April 2014 and has been approved by the ISO/IEC Joint Technical Committee (JTC) as ISO/IEC 11889:2015. -Windows�10 uses the TPM for cryptographic calculations as part of health attestation and to protect the keys for BitLocker, Windows Hello, virtual smart cards, and other public key certificates. For more information, see [TPM requirements in Windows 10](https://go.microsoft.com/fwlink/p/?LinkId=733948). +Windows 10 uses the TPM for cryptographic calculations as part of health attestation and to protect the keys for BitLocker, Windows Hello, virtual smart cards, and other public key certificates. For more information, see [TPM requirements in Windows 10](https://go.microsoft.com/fwlink/p/?LinkId=733948). -Windows�10 recognizes versions 1.2 and 2.0 TPM specifications produced by the TCG. For the most recent and modern security features, Windows�10 supports only TPM 2.0. +Windows 10 recognizes versions 1.2 and 2.0 TPM specifications produced by the TCG. For the most recent and modern security features, Windows 10 supports only TPM 2.0. TPM 2.0 provides a major revision to the capabilities over TPM 1.2: @@ -316,16 +316,3 @@ In a simplified manner, the TPM is a passive component with limited resources. I [Return to Top](hello-how-it-works-technology.md) - - - - - - - - - - - - - From 959f88dbd27966614e2401cbea3fdfec98a035b0 Mon Sep 17 00:00:00 2001 From: ManikaDhiman Date: Fri, 17 May 2019 12:50:09 -0700 Subject: [PATCH 30/90] Updated SKU --- .../client-management/mdm/policy-csp-servicecontrolmanager.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/client-management/mdm/policy-csp-servicecontrolmanager.md b/windows/client-management/mdm/policy-csp-servicecontrolmanager.md index a2558d44fc..ec32296079 100644 --- a/windows/client-management/mdm/policy-csp-servicecontrolmanager.md +++ b/windows/client-management/mdm/policy-csp-servicecontrolmanager.md @@ -44,7 +44,7 @@ ms.date: 05/10/2019 cross mark - cross mark + check mark6 check mark6 check mark6 check mark6 From 5480ba46fe2edcc6eac8281bb918b6a8e805eeda Mon Sep 17 00:00:00 2001 From: ManikaDhiman Date: Fri, 17 May 2019 14:52:36 -0700 Subject: [PATCH 31/90] Update SKU --- .../client-management/mdm/policy-csp-servicecontrolmanager.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/client-management/mdm/policy-csp-servicecontrolmanager.md b/windows/client-management/mdm/policy-csp-servicecontrolmanager.md index ec32296079..a2558d44fc 100644 --- a/windows/client-management/mdm/policy-csp-servicecontrolmanager.md +++ b/windows/client-management/mdm/policy-csp-servicecontrolmanager.md @@ -44,7 +44,7 @@ ms.date: 05/10/2019 cross mark - check mark6 + cross mark check mark6 check mark6 check mark6 From 7e5a521e9daf4492560ad8268a507d2d0679214a Mon Sep 17 00:00:00 2001 From: ManikaDhiman Date: Fri, 17 May 2019 15:21:38 -0700 Subject: [PATCH 32/90] Added dev comment --- .../client-management/mdm/policy-csp-servicecontrolmanager.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/client-management/mdm/policy-csp-servicecontrolmanager.md b/windows/client-management/mdm/policy-csp-servicecontrolmanager.md index a2558d44fc..b879cef048 100644 --- a/windows/client-management/mdm/policy-csp-servicecontrolmanager.md +++ b/windows/client-management/mdm/policy-csp-servicecontrolmanager.md @@ -68,7 +68,7 @@ This policy setting enables process mitigation options on svchost.exe processes. If you enable this policy setting, built-in system services hosted in svchost.exe processes will have stricter security policies enabled on them. -This includes Microsoft to sign a policy requiring all binaries loaded on SVCHOST processes and a policy disallowing dynamically generated code. +This includes a policy requiring all binaries loaded in these processes to be signed by Microsoft, as well as a policy disallowing dynamically-generated code. If you disable or do not configure this policy setting, the stricter security settings will not be applied. From 53276bd754ae0d5f1f909ba551a85c4465ba20e6 Mon Sep 17 00:00:00 2001 From: MaratMussabekov <48041687+MaratMussabekov@users.noreply.github.com> Date: Mon, 20 May 2019 10:25:10 +0500 Subject: [PATCH 33/90] update windows-10-enterprise-subscription-activation.md --- .../deployment/windows-10-enterprise-subscription-activation.md | 2 ++ 1 file changed, 2 insertions(+) diff --git a/windows/deployment/windows-10-enterprise-subscription-activation.md b/windows/deployment/windows-10-enterprise-subscription-activation.md index e57c8a14cc..50cda76821 100644 --- a/windows/deployment/windows-10-enterprise-subscription-activation.md +++ b/windows/deployment/windows-10-enterprise-subscription-activation.md @@ -154,6 +154,8 @@ changepk.exe /ProductKey %ProductKey% ) +If no firmware-embedded Windows 10 activation key presents, the license will escalate to Windows 10 Enterprise using Subscription Activation directly. + ### Obtaining an Azure AD licence Enterprise Agreement/Software Assurance (EA/SA): From 5735cae0863cd1e12057dca75e78c8d0e0b73922 Mon Sep 17 00:00:00 2001 From: Jose Gabriel Ortega Castro Date: Mon, 20 May 2019 01:12:37 -0500 Subject: [PATCH 34/90] Update windows/whats-new/whats-new-windows-10-version-1803.md Co-Authored-By: Trond B. Krokli <38162891+illfated@users.noreply.github.com> --- windows/whats-new/whats-new-windows-10-version-1803.md | 1 - 1 file changed, 1 deletion(-) diff --git a/windows/whats-new/whats-new-windows-10-version-1803.md b/windows/whats-new/whats-new-windows-10-version-1803.md index 220d35e86c..a7a77b4172 100644 --- a/windows/whats-new/whats-new-windows-10-version-1803.md +++ b/windows/whats-new/whats-new-windows-10-version-1803.md @@ -233,4 +233,3 @@ Support in [Windows Defender Application Guard](#windows-defender-application-gu - [What's new in Windows 10, version 1709](https://docs.microsoft.com/windows-hardware/get-started/what-s-new-in-windows): See what’s new in Windows 10 hardware. - [Windows 10 Fall Creators Update Next Generation Security](https://www.youtube.com/watch?v=JDGMNFwyUg8): YouTube video about Windows Defender ATP in Windows 10, version 1709. - From 5f0e08d058c5b5a3c57452fc4c93bbdf5185b69d Mon Sep 17 00:00:00 2001 From: illfated Date: Mon, 20 May 2019 18:57:44 +0200 Subject: [PATCH 35/90] Remove space between indent marker and text - (keeping the current code style unchanged) --- devices/surface-hub/create-a-device-account-using-office-365.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/devices/surface-hub/create-a-device-account-using-office-365.md b/devices/surface-hub/create-a-device-account-using-office-365.md index d1fbebaa56..85be497437 100644 --- a/devices/surface-hub/create-a-device-account-using-office-365.md +++ b/devices/surface-hub/create-a-device-account-using-office-365.md @@ -218,7 +218,7 @@ In order to enable Skype for Business, your environment will need to meet the fo ## Create a device account using the Exchange Admin Center >[!NOTE] -> This method will only work if you are syncing from an on-premises Active Directory. +>This method will only work if you are syncing from an on-premises Active Directory. You can use the Exchange Admin Center to create a device account: From 2834d122b1ebb1b3688a5754f1f2e0bd9c5ec171 Mon Sep 17 00:00:00 2001 From: Jose Ortega Date: Mon, 20 May 2019 21:22:41 -0500 Subject: [PATCH 36/90] Formating the whole Article tables and links. --- .../access-control/special-identities.md | 1028 ++++------------- 1 file changed, 193 insertions(+), 835 deletions(-) diff --git a/windows/security/identity-protection/access-control/special-identities.md b/windows/security/identity-protection/access-control/special-identities.md index 16e282f16f..b29d15b901 100644 --- a/windows/security/identity-protection/access-control/special-identities.md +++ b/windows/security/identity-protection/access-control/special-identities.md @@ -34,364 +34,153 @@ Although the special identity groups can be assigned rights and permissions to r For information about security groups and group scope, see [Active Directory Security Groups](active-directory-security-groups.md). -The special identity groups are described in the following tables. +The special identity groups are described in the following tables. -- [Anonymous Logon](#bkmk-anonymouslogon) +- [Anonymous Logon](#Anonymous-Logon) -- [Authenticated User](#bkmk-authenticateduser) +- [Authenticated User](#Authenticated-Users) -- [Batch](#bkmk-batch) +- [Batch](#batch) -- [Creator Group](#bkmk-creatorgroup) +- [Creator Group](#Creator-Group) -- [Creator Owner](#bkmk-creatorowner) +- [Creator Owner](#Creator-Owner) -- [Dialup](#bkmk-dialup) +- [Dialup](#Dialup) -- [Digest Authentication](#bkmk-digestauth) +- [Digest Authentication](#Digest-Authentication) -- [Enterprise Domain Controllers](#bkmk-entdcs) +- [Enterprise Domain Controllers](#Enterprise-Domain-Controllers) -- [Everyone](#bkmk-everyone) +- [Everyone](#everyone) -- [Interactive](#bkmk-interactive) +- [Interactive](#interactive) -- [Local Service](#bkmk-localservice) +- [Local Service](#local-service) -- [LocalSystem](#bkmk-localsystem) +- [LocalSystem](#LocalSystem) -- [Network](#bkmk-network) +- [Network](#network) -- [Network Service](#bkmk-networkservice) +- [Network Service](#Network-Service) -- [NTLM Authentication](#bkmk-ntlmauth) +- [NTLM Authentication](#NTLM-Authentication) -- [Other Organization](#bkmk-otherorganization) +- [Other Organization](#Other-Organization) -- [Principal Self](#bkmk-principalself) +- [Principal Self](#Principal-Self) -- [Remote Interactive Logon](#bkmk-remoteinteractivelogon) +- [Remote Interactive Logon](#Remote-Interactive-Logon) -- [Restricted](#bkmk-restrictedcode) +- [Restricted](#Restricted) -- [SChannel Authentication](#bkmk-schannelauth) +- [SChannel Authentication](#SChannel-Authentication) -- [Service](#bkmk-service) +- [Service](#Service) -- [Terminal Server User](#bkmk-terminalserveruser) +- [Terminal Server User](#Terminal-Server-User) -- [This Organization](#bkmk-thisorg) +- [This Organization](#This-Organization) -- [Window Manager\\Window Manager Group](#bkmk-windowmanager) +- [Window Manager\\Window Manager Group](#Window-Manager\\Window-Manager-Group) -## Anonymous Logon +## Anonymous Logon Any user who accesses the system through an anonymous logon has the Anonymous Logon identity. This identity allows anonymous access to resources, such as a web page that is published on corporate servers. The Anonymous Logon group is not a member of the Everyone group by default. - ---- - - - - - - - - - - - - - - - - - - - - - - - - -
AttributeValue

Well-Known SID/RID

S-1-5-7

Object Class

Foreign Security Principal

Default Location in Active Directory

cn=WellKnown Security Principals, cn=Configuration, dc=<forestRootDomain>

Default User Rights

None

+| **Attribute** | **Value** | +| :--: | :--: | +| Well-Known SID/RID | S-1-5-7 | +|Object Class| Foreign Security Principal| +|Default Location in Active Directory |cn=WellKnown Security Principals, cn=Configuration, dc=\| +|Default User Rights|None| -  - -## Authenticated Users +## Authenticated Users Any user who accesses the system through a sign-in process has the Authenticated Users identity. This identity allows access to shared resources within the domain, such as files in a shared folder that should be accessible to all the workers in the organization. Membership is controlled by the operating system. - ---- - - - - - - - - - - - - - - - - - - - - - - - - -
AttributeValue

Well-Known SID/RID

S-1-5-11

Object Class

Foreign Security Principal

Default Location in Active Directory

cn=System,cn=WellKnown Security Principals, cn=Configuration, dc=<forestRootDomain>

Default User Rights

[Access this computer from the network](/windows/device-security/security-policy-settings/access-this-computer-from-the-network): SeNetworkLogonRight

-

[Add workstations to domain](/windows/device-security/security-policy-settings/add-workstations-to-domain): SeMachineAccountPrivilege

-

[Bypass traverse checking](/windows/device-security/security-policy-settings/bypass-traverse-checking): SeChangeNotifyPrivilege

+| **Attribute** | **Value** | +| :--: | :--: | +| Well-Known SID/RID | S-1-5-11 | +|Object Class| Foreign Security Principal| +|Default Location in Active Directory |cn=System,cn=WellKnown Security Principals, cn=Configuration, dc=\| +|Default User Rights| [Access this computer from the network](/windows/device-security/security-policy-settings/access-this-computer-from-the-network): SeNetworkLogonRight
[Add workstations to domain](/windows/device-security/security-policy-settings/add-workstations-to-domain): SeMachineAccountPrivilege
[Bypass traverse checking](/windows/device-security/security-policy-settings/bypass-traverse-checking): SeChangeNotifyPrivilege| -  - -## Batch +## Batch Any user or process that accesses the system as a batch job (or through the batch queue) has the Batch identity. This identity allows batch jobs to run scheduled tasks, such as a nightly cleanup job that deletes temporary files. Membership is controlled by the operating system. - ---- - - - - - - - - - - - - - - - - - - - - - - - - -
AttributeValue

Well-Known SID/RID

S-1-5-3

Object Class

Foreign Security Principal

Default Location in Active Directory

cn=WellKnown Security Principals, cn=Configuration, dc=<forestRootDomain>

Default User Rights

None

+| **Attribute** | **Value** | +| :--: | :--: | +| Well-Known SID/RID | S-1-5-3 | +|Object Class| Foreign Security Principal| +|Default Location in Active Directory |cn=WellKnown Security Principals, cn=Configuration, dc=\| +|Default User Rights| none| -  - -## Creator Group +## Creator Group The person who created the file or the directory is a member of this special identity group. Windows Server operating systems use this identity to automatically grant access permissions to the creator of a file or directory. A placeholder security identifier (SID) is created in an inheritable access control entry (ACE). When the ACE is inherited, the system replaces this SID with the SID for the primary group of the object’s current owner. The primary group is used only by the Portable Operating System Interface for UNIX (POSIX) subsystem. - ---- - - - - - - - - - - - - - - - - - - - - - - - - -
AttributeValue

Well-Known SID/RID

S-1-3-1

Object Class

Foreign Security Principal

Default Location in Active Directory

cn=WellKnown Security Principals, cn=Configuration, dc=<forestRootDomain>

Default User Rights

None

+| **Attribute** | **Value** | +| :--: | :--: | +| Well-Known SID/RID | S-1-3-1 | +|Object Class| Foreign Security Principal| +|Default Location in Active Directory |cn=WellKnown Security Principals, cn=Configuration, dc=\| +|Default User Rights| none| -  - -## Creator Owner +## Creator Owner The person who created the file or the directory is a member of this special identity group. Windows Server operating systems use this identity to automatically grant access permissions to the creator of a file or directory. A placeholder SID is created in an inheritable ACE. When the ACE is inherited, the system replaces this SID with the SID for the object’s current owner. - ---- - - - - - - - - - - - - - - - - - - - - - - - - -
AttributeValue

Well-Known SID/RID

S-1-3-0

Object Class

Foreign Security Principal

Default Location in Active Directory

cn=WellKnown Security Principals, cn=Configuration, dc=<forestRootDomain>

Default User Rights

None

+| **Attribute** | **Value** | +| :--: | :--: | +| Well-Known SID/RID | S-1-3-0 | +|Object Class| Foreign Security Principal| +|Default Location in Active Directory |cn=WellKnown Security Principals, cn=Configuration, dc=\| +|Default User Rights| none| -  - -## Dialup +## Dialup Any user who accesses the system through a dial-up connection has the Dial-Up identity. This identity distinguishes dial-up users from other types of authenticated users. - ---- - - - - - - - - - - - - - - - - - - - - - - - - -
AttributeValue

Well-Known SID/RID

S-1-5-1

Object Class

Foreign Security Principal

Default Location in Active Directory

cn=WellKnown Security Principals, cn=Configuration, dc=<forestRootDomain>

Default User Rights

None

+| **Attribute** | **Value** | +| :--: | :--: | +| Well-Known SID/RID | S-1-5-1 | +|Object Class| Foreign Security Principal| +|Default Location in Active Directory |cn=WellKnown Security Principals, cn=Configuration, dc=\| +|Default User Rights| none|  -  - -## Digest Authentication +## Digest Authentication - ---- - - - - - - - - - - - - - - - - - - - - - - - - -
AttributeValue

Well-Known SID/RID

S-1-5-64-21

Object Class

Foreign Security Principal

Default Location in Active Directory

cn=WellKnown Security Principals, cn=Configuration, dc=<forestRootDomain>

Default User Rights

None

+| **Attribute** | **Value** | +| :--: | :--: | +| Well-Known SID/RID | S-1-5-64-21 | +|Object Class| Foreign Security Principal| +|Default Location in Active Directory |cn=WellKnown Security Principals, cn=Configuration, dc=\| +|Default User Rights| none|  -  - -## Enterprise Domain Controllers +## Enterprise Domain Controllers This group includes all domain controllers in an Active Directory forest. Domain controllers with enterprise-wide roles and responsibilities have the Enterprise Domain Controllers identity. This identity allows them to perform certain tasks in the enterprise by using transitive trusts. Membership is controlled by the operating system. - ---- - - - - - - - - - - - - - - - - - - - - - - - - -
AttributeValue

Well-Known SID/RID

S-1-5-9

Object Class

Foreign Security Principal

Default Location in Active Directory

cn=WellKnown Security Principals, cn=Configuration, dc=<forestRootDomain>

Default User Rights Assignment

[Access this computer from the network](/windows/device-security/security-policy-settings/access-this-computer-from-the-network): SeNetworkLogonRight

-

[Allow log on locally](/windows/device-security/security-policy-settings/allow-log-on-locally): SeInteractiveLogonRight

+| **Attribute** | **Value** | +| :--: | :--: | +| Well-Known SID/RID | S-1-5-9 | +|Object Class| Foreign Security Principal| +|Default Location in Active Directory |cn=WellKnown Security Principals, cn=Configuration, dc=\| +|Default User Rights| [Access this computer from the network](/windows/device-security/security-policy-settings/access-this-computer-from-the-network): SeNetworkLogonRight
[Allow log on locally](/windows/device-security/security-policy-settings/allow-log-on-locally): SeInteractiveLogonRight| -  - -## Everyone +## Everyone All interactive, network, dial-up, and authenticated users are members of the Everyone group. This special identity group gives wide access to system resources. Whenever a user logs on to the network, the user is automatically added to the Everyone group. @@ -400,615 +189,184 @@ On computers running Windows 2000 and earlier, the Everyone group included the Membership is controlled by the operating system. - ---- - - - - - - - - - - - - - - - - - - - - - - - - -
AttributeValue

Well-Known SID/RID

S-1-1-0

Object Class

Foreign Security Principal

Default Location in Active Directory

cn=WellKnown Security Principals, cn=Configuration, dc=<forestRootDomain>

Default User Rights

[Access this computer from the network](/windows/device-security/security-policy-settings/access-this-computer-from-the-network): SeNetworkLogonRight

-

[Act as part of the operating system](/windows/device-security/security-policy-settings/act-as-part-of-the-operating-system): SeTcbPrivilege

-

[Bypass traverse checking](/windows/device-security/security-policy-settings/bypass-traverse-checking): SeChangeNotifyPrivilege

+| **Attribute** | **Value** | +| :--: | :--: | +| Well-Known SID/RID | S-1-1-0 | +|Object Class| Foreign Security Principal| +|Default Location in Active Directory |cn=WellKnown Security Principals, cn=Configuration, dc=\| +|Default User Rights| [Access this computer from the network](/windows/device-security/security-policy-settings/access-this-computer-from-the-network): SeNetworkLogonRight
[Act as part of the operating system](/windows/device-security/security-policy-settings/act-as-part-of-the-operating-system): SeTcbPrivilege
[Bypass traverse checking](/windows/device-security/security-policy-settings/bypass-traverse-checking): SeChangeNotifyPrivilege| -  - -## Interactive +## Interactive Any user who is logged on to the local system has the Interactive identity. This identity allows only local users to access a resource. Whenever a user accesses a given resource on the computer to which they are currently logged on, the user is automatically added to the Interactive group. Membership is controlled by the operating system. - ---- - - - - - - - - - - - - - - - - - - - - - - - - -
AttributeValue

Well-Known SID/RID

S-1-5-4

Object Class

Foreign Security Principal

Default Location in Active Directory

cn=WellKnown Security Principals, cn=Configuration, dc=<forestRootDomain>

Default User Rights

None

+| **Attribute** | **Value** | +| :--: | :--: | +| Well-Known SID/RID | S-1-5-4 | +|Object Class| Foreign Security Principal| +|Default Location in Active Directory |cn=WellKnown Security Principals, cn=Configuration, dc=\| +|Default User Rights| None| -  - -## Local Service +## Local Service The Local Service account is similar to an Authenticated User account. The Local Service account has the same level of access to resources and objects as members of the Users group. This limited access helps safeguard your system if individual services or processes are compromised. Services that run as the Local Service account access network resources as a null session with anonymous credentials. The name of the account is NT AUTHORITY\\LocalService. This account does not have a password. - ---- - - - - - - - - - - - - - - - - - - - - - - - - -
AttributeValue

Well-Known SID/RID

S-1-5-19

Object Class

Foreign Security Principal

Default Location in Active Directory

cn=WellKnown Security Principals, cn=Configuration, dc=<forestRootDomain>

Default user rights

[Adjust memory quotas for a process](/windows/device-security/security-policy-settings/adjust-memory-quotas-for-a-process): SeIncreaseQuotaPrivilege

-

[Bypass traverse checking](/windows/device-security/security-policy-settings/bypass-traverse-checking): SeChangeNotifyPrivilege

-

[Change the system time](/windows/device-security/security-policy-settings/change-the-system-time): SeSystemtimePrivilege

-

[Change the time zone](/windows/device-security/security-policy-settings/change-the-time-zone): SeTimeZonePrivilege

-

[Create global objects](/windows/device-security/security-policy-settings/create-global-objects): SeCreateGlobalPrivilege

-

[Generate security audits](/windows/device-security/security-policy-settings/generate-security-audits): SeAuditPrivilege

-

[Impersonate a client after authentication](/windows/device-security/security-policy-settings/impersonate-a-client-after-authentication): SeImpersonatePrivilege

-

[Replace a process level token](/windows/device-security/security-policy-settings/replace-a-process-level-token): SeAssignPrimaryTokenPrivilege

+| **Attribute** | **Value** | +| :--: | :--: | +| Well-Known SID/RID | S-1-5-19 | +|Object Class| Foreign Security Principal| +|Default Location in Active Directory |cn=WellKnown Security Principals, cn=Configuration, dc=\| +|Default User Rights| [Adjust memory quotas for a process](/windows/device-security/security-policy-settings/adjust-memory-quotas-for-a-process): SeIncreaseQuotaPrivilege
[Bypass traverse checking](/windows/device-security/security-policy-settings/bypass-traverse-checking): SeChangeNotifyPrivilege
[Change the system time](/windows/device-security/security-policy-settings/change-the-system-time): SeSystemtimePrivilege
[Change the time zone](/windows/device-security/security-policy-settings/change-the-time-zone): SeTimeZonePrivilege
[Create global objects](/windows/device-security/security-policy-settings/create-global-objects): SeCreateGlobalPrivilege
[Generate security audits](/windows/device-security/security-policy-settings/generate-security-audits): SeAuditPrivilege
[Impersonate a client after authentication](/windows/device-security/security-policy-settings/impersonate-a-client-after-authentication): SeImpersonatePrivilege
[Replace a process level token](/windows/device-security/security-policy-settings/replace-a-process-level-token): SeAssignPrimaryTokenPrivilege
| -  - -## LocalSystem +## LocalSystem This is a service account that is used by the operating system. The LocalSystem account is a powerful account that has full access to the system and acts as the computer on the network. If a service logs on to the LocalSystem account on a domain controller, that service has access to the entire domain. Some services are configured by default to log on to the LocalSystem account. Do not change the default service setting. The name of the account is LocalSystem. This account does not have a password. - ---- - - - - - - - - - - - - - - - - - - - - - - - - -
AttributeValue

Well-Known SID/RID

S-1-5-18

Object Class

Foreign Security Principal

Default Location in Active Directory

cn=WellKnown Security Principals, cn=Configuration, dc=<forestRootDomain>

Default User Rights

None

-  - -## Network +| **Attribute** | **Value** | +| :--: | :--: | +| Well-Known SID/RID | S-1-5-18 | +|Object Class| Foreign Security Principal| +|Default Location in Active Directory |cn=WellKnown Security Principals, cn=Configuration, dc=\| +|Default User Rights|None| +## Network This group implicitly includes all users who are logged on through a network connection. Any user who accesses the system through a network has the Network identity. This identity allows only remote users to access a resource. Whenever a user accesses a given resource over the network, the user is automatically added to the Network group. Membership is controlled by the operating system. - ---- - - - - - - - - - - - - - - - - - - - - - - - - -
AttributeValue

Well-Known SID/RID

S-1-5-2

Object Class

Foreign Security Principal

Default Location in Active Directory

cn=WellKnown Security Principals, cn=Configuration, dc=<forestRootDomain>

Default User Rights

None

+| **Attribute** | **Value** | +| :--: | :--: | +| Well-Known SID/RID | S-1-5-2 | +|Object Class| Foreign Security Principal| +|Default Location in Active Directory |cn=WellKnown Security Principals, cn=Configuration, dc=\| +|Default User Rights|None| -  - -## Network Service +## Network Service The Network Service account is similar to an Authenticated User account. The Network Service account has the same level of access to resources and objects as members of the Users group. This limited access helps safeguard your system if individual services or processes are compromised. Services that run as the Network Service account access network resources by using the credentials of the computer account. The name of the account is NT AUTHORITY\\NetworkService. This account does not have a password. - ---- - - - - - - - - - - - - - - - - - - - - - - - - -
AttributeValue

Well-Known SID/RID

S-1-5-20

Object Class

Foreign Security Principal

Default Location in Active Directory

cn=WellKnown Security Principals, cn=Configuration, dc=<forestRootDomain>

Default User Rights

[Adjust memory quotas for a process](/windows/device-security/security-policy-settings/adjust-memory-quotas-for-a-process): SeIncreaseQuotaPrivilege

-

[Bypass traverse checking](/windows/device-security/security-policy-settings/bypass-traverse-checking): SeChangeNotifyPrivilege

-

[Create global objects](/windows/device-security/security-policy-settings/create-global-objects): SeCreateGlobalPrivilege

-

[Generate security audits](/windows/device-security/security-policy-settings/generate-security-audits): SeAuditPrivilege

-

[Impersonate a client after authentication](/windows/device-security/security-policy-settings/impersonate-a-client-after-authentication): SeImpersonatePrivilege

-

[Restore files and directories](/windows/device-security/security-policy-settings/restore-files-and-directories): SeRestorePrivilege

-

[Replace a process level token](/windows/device-security/security-policy-settings/replace-a-process-level-token): SeAssignPrimaryTokenPrivilege

+| **Attribute** | **Value** | +| :--: | :--: | +| Well-Known SID/RID | S-1-5-20 | +|Object Class| Foreign Security Principal| +|Default Location in Active Directory |cn=WellKnown Security Principals, cn=Configuration, dc=\| +|Default User Rights| [Adjust memory quotas for a process](/windows/device-security/security-policy-settings/adjust-memory-quotas-for-a-process): SeIncreaseQuotaPrivilege
[Bypass traverse checking](/windows/device-security/security-policy-settings/bypass-traverse-checking): SeChangeNotifyPrivilege
[Create global objects](/windows/device-security/security-policy-settings/create-global-objects): SeCreateGlobalPrivilege
[Generate security audits](/windows/device-security/security-policy-settings/generate-security-audits): SeAuditPrivilege
[Impersonate a client after authentication](/windows/device-security/security-policy-settings/impersonate-a-client-after-authentication): SeImpersonatePrivilege
[Restore files and directories](/windows/device-security/security-policy-settings/restore-files-and-directories): SeRestorePrivilege
[Replace a process level token](/windows/device-security/security-policy-settings/replace-a-process-level-token): SeAssignPrimaryTokenPrivilege
| -  - -## NTLM Authentication +## NTLM Authentication - ---- - - - - - - - - - - - - - - - - - - - - - - - - -
AttributeValue

Well-Known SID/RID

S-1-5-64-10

Object Class

Foreign Security Principal

Default Location in Active Directory

cn=WellKnown Security Principals, cn=Configuration, dc=<forestRootDomain>

Default User Rights

None

+| **Attribute** | **Value** | +| :--: | :--: | +| Well-Known SID/RID | S-1-5-64-10 | +|Object Class| Foreign Security Principal| +|Default Location in Active Directory |cn=WellKnown Security Principals, cn=Configuration, dc=\| +|Default User Rights| None| -  - -## Other Organization +## Other Organization This group implicitly includes all users who are logged on to the system through a dial-up connection. Membership is controlled by the operating system. - ---- - - - - - - - - - - - - - - - - - - - - - - - - -
AttributeValue

Well-Known SID/RID

S-1-5-1000

Object Class

Foreign Security Principal

Default Location in Active Directory

cn=WellKnown Security Principals, cn=Configuration, dc=<forestRootDomain>

Default User Rights

None

+| **Attribute** | **Value** | +| :--: | :--: | +| Well-Known SID/RID | S-1-5-1000 | +|Object Class| Foreign Security Principal| +|Default Location in Active Directory |cn=WellKnown Security Principals, cn=Configuration, dc=\| +|Default User Rights| None | -  - -## Principal Self +## Principal Self This identify is a placeholder in an ACE on a user, group, or computer object in Active Directory. When you grant permissions to Principal Self, you grant them to the security principal that is represented by the object. During an access check, the operating system replaces the SID for Principal Self with the SID for the security principal that is represented by the object. - ---- - - - - - - - - - - - - - - - - - - - - - - - - -
AttributeValue

Well-Known SID/RID

S-1-5-10

Object Class

Foreign Security Principal

Default Location in Active Directory

cn=WellKnown Security Principals, cn=Configuration, dc=<forestRootDomain>

Default User Rights

None

+| **Attribute** | **Value** | +| :--: | :--: | +| Well-Known SID/RID | S-1-5-10 | +|Object Class| Foreign Security Principal| +|Default Location in Active Directory |cn=WellKnown Security Principals, cn=Configuration, dc=\| +|Default User Rights| None | -  - -## Remote Interactive Logon +## Remote Interactive Logon This identity represents all users who are currently logged on to a computer by using a Remote Desktop connection. This group is a subset of the Interactive group. Access tokens that contain the Remote Interactive Logon SID also contain the Interactive SID. - ---- - - - - - - - - - - - - - - - - - - - - - - - - -
AttributeValue

Well-Known SID/RID

S-1-5-14

Object Class

Foreign Security Principal

Default Location in Active Directory

cn=WellKnown Security Principals, cn=Configuration, dc=<forestRootDomain>

Default User Rights

None

+| **Attribute** | **Value** | +| :--: | :--: | +| Well-Known SID/RID | S-1-5-14| +|Object Class| Foreign Security Principal| +|Default Location in Active Directory |cn=WellKnown Security Principals, cn=Configuration, dc=\| +|Default User Rights| None | -  - -## Restricted +## Restricted Users and computers with restricted capabilities have the Restricted identity. This identity group is used by a process that is running in a restricted security context, such as running an application with the RunAs service. When code runs at the Restricted security level, the Restricted SID is added to the user’s access token. - ---- - - - - - - - - - - - - - - - - - - - - - - - - -
AttributeValue

Well-Known SID/RID

S-1-5-12

Object Class

Foreign Security Principal

Default Location in Active Directory

cn=WellKnown Security Principals, cn=Configuration, dc=<forestRootDomain>

Default User Rights

None

+| **Attribute** | **Value** | +| :--: | :--: | +| Well-Known SID/RID | S-1-5-12 | +|Object Class| Foreign Security Principal| +|Default Location in Active Directory |cn=WellKnown Security Principals, cn=Configuration, dc=\| +|Default User Rights| None | -  - -## SChannel Authentication +## SChannel Authentication - ---- - - - - - - - - - - - - - - - - - - - - - - - - -
AttributeValue

Well-Known SID/RID

S-1-5-64-14

Object Class

Foreign Security Principal

Default Location in Active Directory

cn=WellKnown Security Principals, cn=Configuration, dc=<forestRootDomain>

Default User Rights

None

+| **Attribute** | **Value** | +| :--: | :--: | +| Well-Known SID/RID | S-1-5-64-14 | +|Object Class| Foreign Security Principal| +|Default Location in Active Directory |cn=WellKnown Security Principals, cn=Configuration, dc=\| +|Default User Rights| None | -  - -## Service +## Service Any service that accesses the system has the Service identity. This identity group includes all security principals that are signed in as a service. This identity grants access to processes that are being run by Windows Server services. Membership is controlled by the operating system. - ---- - - - - - - - - - - - - - - - - - - - - - - - - -
AttributeValue

Well-Known SID/RID

S-1-5-6

Object Class

Foreign Security Principal

Default Location in Active Directory

cn=WellKnown Security Principals, cn=Configuration, dc=<forestRootDomain>

Default User Rights

[Create global objects](/windows/device-security/security-policy-settings/create-global-objects): SeCreateGlobalPrivilege

-

[Impersonate a client after authentication](/windows/device-security/security-policy-settings/impersonate-a-client-after-authentication): SeImpersonatePrivilege

-  +| **Attribute** | **Value** | +| :--: | :--: | +| Well-Known SID/RID | S-1-5-6 | +|Object Class| Foreign Security Principal| +|Default Location in Active Directory |cn=WellKnown Security Principals, cn=Configuration, dc=\| +|Default User Rights| [Create global objects](/windows/device-security/security-policy-settings/create-global-objects): SeCreateGlobalPrivilege
[Impersonate a client after authentication](/windows/device-security/security-policy-settings/impersonate-a-client-after-authentication): SeImpersonatePrivilege
| -## Terminal Server User +## Terminal Server User Any user accessing the system through Terminal Services has the Terminal Server User identity. This identity allows users to access Terminal Server applications and to perform other necessary tasks with Terminal Server services. Membership is controlled by the operating system. - ---- - - - - - - - - - - - - - - - - - - - - - - - - -
AttributeValue

Well-Known SID/RID

S-1-5-13

Object Class

Foreign Security Principal

Default Location in Active Directory

cn=WellKnown Security Principals, cn=Configuration, dc=<forestRootDomain>

Default User Rights

None

+| **Attribute** | **Value** | +| :--: | :--: | +| Well-Known SID/RID | S-1-5-13 | +|Object Class| Foreign Security Principal| +|Default Location in Active Directory |cn=WellKnown Security Principals, cn=Configuration, dc=\| +|Default User Rights| None | -  - -## This Organization +## This Organization - ---- - - - - - - - - - - - - - - - - - - - - - - - - -
AttributeValue

Well-Known SID/RID

S-1-5-15

Object Class

Foreign Security Principal

Default Location in Active Directory

cn=WellKnown Security Principals, cn=Configuration, dc=<forestRootDomain>

Default User Rights

None

+| **Attribute** | **Value** | +| :--: | :--: | +| Well-Known SID/RID | S-1-5-15 | +|Object Class| Foreign Security Principal| +|Default Location in Active Directory |cn=WellKnown Security Principals, cn=Configuration, dc=\| +|Default User Rights| None | -  +## Window Manager\\Window Manager Group -## Window Manager\\Window Manager Group - - - ---- - - - - - - - - - - - - - - - - - - - - - - - - -
AttributeValue

Well-Known SID/RID

Object Class

Default Location in Active Directory

cn=WellKnown Security Principals, cn=Configuration, dc=<forestRootDomain>

Default User Rights

[Bypass traverse checking](/windows/device-security/security-policy-settings/bypass-traverse-checking): SeChangeNotifyPrivilege

-

[Increase a process working set](/windows/device-security/security-policy-settings/increase-a-process-working-set): SeIncreaseWorkingSetPrivilege

+| **Attribute** | **Value** | +| :--: | :--: | +| Well-Known SID/RID | | +|Object Class| | +|Default Location in Active Directory |cn=WellKnown Security Principals, cn=Configuration, dc=\| +|Default User Rights| [Bypass traverse checking](/windows/device-security/security-policy-settings/bypass-traverse-checking): SeChangeNotifyPrivilege
[Increase a process working set](/windows/device-security/security-policy-settings/increase-a-process-working-set): SeIncreaseWorkingSetPrivilege
| ## See also From be0035723c331177d8da1b6c830b7620ed83208d Mon Sep 17 00:00:00 2001 From: zhouyuZY <50821229+zhouyuZY@users.noreply.github.com> Date: Tue, 21 May 2019 13:13:48 +0800 Subject: [PATCH 37/90] Update set-up-enterprise-mode-portal.md In step 1, after the 6th point, the note is not in correct format. --- .../ie11-deploy-guide/set-up-enterprise-mode-portal.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/browsers/internet-explorer/ie11-deploy-guide/set-up-enterprise-mode-portal.md b/browsers/internet-explorer/ie11-deploy-guide/set-up-enterprise-mode-portal.md index c6c5cf099e..83ca5233e3 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/set-up-enterprise-mode-portal.md +++ b/browsers/internet-explorer/ie11-deploy-guide/set-up-enterprise-mode-portal.md @@ -45,8 +45,8 @@ You must download the deployment folder (**EMIEWebPortal/**), which includes all 6. Go back up a directory, open the solution file **EMIEWebPortal.sln** in Visual Studio, open **Web.config** from **EMIEWebPortal/** folder, and replace MSIT-LOB-COMPAT with your server name hosting your database, replace LOBMerged with your database name, and build the entire solution. - >[!Note] - >Step 3 of this topic provides the steps to create your database. + >[!Note] + >Step 3 of this topic provides the steps to create your database. 7. Copy the contents of the **EMIEWebPortal/** folder to a dedicated folder on your file system. For example, _D:\EMIEWebApp_. In a later step, you'll designate this folder as your website in the IIS Manager. From f5bbb87a938ba6457203617e5b806e8a5addf8ae Mon Sep 17 00:00:00 2001 From: Wolfgang Sauer <43094787+WolfgangSauer@users.noreply.github.com> Date: Tue, 21 May 2019 10:53:28 +0200 Subject: [PATCH 38/90] Update live-response.md corrected typo --- .../threat-protection/microsoft-defender-atp/live-response.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/live-response.md b/windows/security/threat-protection/microsoft-defender-atp/live-response.md index aaab0a442a..5500639c55 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/live-response.md +++ b/windows/security/threat-protection/microsoft-defender-atp/live-response.md @@ -107,7 +107,7 @@ help | Provides help information for live response commands. persistence | Shows all known persistence methods on the machine. processes | Shows all processes running on the machine. registry | Shows registry values. -sheduledtasks| Shows all scheduled tasks on the machine. +scheduledtasks| Shows all scheduled tasks on the machine. services | Shows all services on the machine. trace | Sets the terminal's logging mode to debug. From b3fcab0d4c650ad9a6d6b470978781e8c6255204 Mon Sep 17 00:00:00 2001 From: MaratMussabekov <48041687+MaratMussabekov@users.noreply.github.com> Date: Tue, 21 May 2019 14:46:06 +0500 Subject: [PATCH 39/90] update windows-10-enterprise-subscription-activation.md --- .../deployment/windows-10-enterprise-subscription-activation.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/deployment/windows-10-enterprise-subscription-activation.md b/windows/deployment/windows-10-enterprise-subscription-activation.md index 50cda76821..0e718cbc92 100644 --- a/windows/deployment/windows-10-enterprise-subscription-activation.md +++ b/windows/deployment/windows-10-enterprise-subscription-activation.md @@ -154,7 +154,7 @@ changepk.exe /ProductKey %ProductKey% ) -If no firmware-embedded Windows 10 activation key presents, the license will escalate to Windows 10 Enterprise using Subscription Activation directly. +If a firmware-embedded Windows 10 activation key is not present, the license will escalate to Windows 10 Enterprise using Subscription Activation directly. ### Obtaining an Azure AD licence From 7dfcc6a36bd5bb7fc75dbb5b325e06c27ff543a2 Mon Sep 17 00:00:00 2001 From: Jose Gabriel Ortega Castro Date: Tue, 21 May 2019 10:41:17 -0500 Subject: [PATCH 40/90] : by . Co-Authored-By: JohanFreelancer9 <48568725+JohanFreelancer9@users.noreply.github.com> --- .../identity-protection/access-control/special-identities.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/security/identity-protection/access-control/special-identities.md b/windows/security/identity-protection/access-control/special-identities.md index b29d15b901..670f831be0 100644 --- a/windows/security/identity-protection/access-control/special-identities.md +++ b/windows/security/identity-protection/access-control/special-identities.md @@ -34,7 +34,7 @@ Although the special identity groups can be assigned rights and permissions to r For information about security groups and group scope, see [Active Directory Security Groups](active-directory-security-groups.md). -The special identity groups are described in the following tables. +The special identity groups are described in the following tables: - [Anonymous Logon](#Anonymous-Logon) @@ -374,4 +374,4 @@ Any user accessing the system through Terminal Services has the Terminal Server - [Security Principals](security-principals.md) -- [Access Control Overview](access-control.md) \ No newline at end of file +- [Access Control Overview](access-control.md) From 795220705d4d0e27b6c6b997641677f60e295c33 Mon Sep 17 00:00:00 2001 From: Jose Ortega Date: Tue, 21 May 2019 12:23:12 -0500 Subject: [PATCH 41/90] Removing caps from links --- .../access-control/special-identities.md | 38 +++++++++---------- 1 file changed, 19 insertions(+), 19 deletions(-) diff --git a/windows/security/identity-protection/access-control/special-identities.md b/windows/security/identity-protection/access-control/special-identities.md index b29d15b901..f30d62a674 100644 --- a/windows/security/identity-protection/access-control/special-identities.md +++ b/windows/security/identity-protection/access-control/special-identities.md @@ -36,21 +36,21 @@ For information about security groups and group scope, see [Active Directory Sec The special identity groups are described in the following tables. -- [Anonymous Logon](#Anonymous-Logon) +- [Anonymous Logon](#anonymous-logon) -- [Authenticated User](#Authenticated-Users) +- [Authenticated User](#authenticated-users) - [Batch](#batch) -- [Creator Group](#Creator-Group) +- [Creator Group](#creator-group) -- [Creator Owner](#Creator-Owner) +- [Creator Owner](#creator-owner) -- [Dialup](#Dialup) +- [Dialup](#dialup) -- [Digest Authentication](#Digest-Authentication) +- [Digest Authentication](#digest-authentication) -- [Enterprise Domain Controllers](#Enterprise-Domain-Controllers) +- [Enterprise Domain Controllers](#enterprise-domain-controllers) - [Everyone](#everyone) @@ -58,31 +58,31 @@ The special identity groups are described in the following tables. - [Local Service](#local-service) -- [LocalSystem](#LocalSystem) +- [LocalSystem](#localsystem) - [Network](#network) -- [Network Service](#Network-Service) +- [Network Service](#network-service) -- [NTLM Authentication](#NTLM-Authentication) +- [NTLM Authentication](#ntlm-authentication) -- [Other Organization](#Other-Organization) +- [Other Organization](#other-organization) -- [Principal Self](#Principal-Self) +- [Principal Self](#principal-self) -- [Remote Interactive Logon](#Remote-Interactive-Logon) +- [Remote Interactive Logon](#remote-interactive-logon) -- [Restricted](#Restricted) +- [Restricted](#restricted) -- [SChannel Authentication](#SChannel-Authentication) +- [SChannel Authentication](#schannel-authentication) -- [Service](#Service) +- [Service](#service) -- [Terminal Server User](#Terminal-Server-User) +- [Terminal Server User](#terminal-server-user) -- [This Organization](#This-Organization) +- [This Organization](#this-organization) -- [Window Manager\\Window Manager Group](#Window-Manager\\Window-Manager-Group) +- [Window Manager\\Window Manager Group](#window-manager\\window-manager-group) ## Anonymous Logon From 75772364e18b8bd4aac658cd8eb362969fc9d8fc Mon Sep 17 00:00:00 2001 From: Jose Ortega Date: Tue, 21 May 2019 14:10:24 -0500 Subject: [PATCH 42/90] Added a link into the Referenced Topics with the information required to a spreadsheed #884 --- windows/client-management/new-policies-for-windows-10.md | 1 + 1 file changed, 1 insertion(+) diff --git a/windows/client-management/new-policies-for-windows-10.md b/windows/client-management/new-policies-for-windows-10.md index 7d77e94d7d..6efbed9a1f 100644 --- a/windows/client-management/new-policies-for-windows-10.md +++ b/windows/client-management/new-policies-for-windows-10.md @@ -254,6 +254,7 @@ No new [Exchange ActiveSync policies](https://go.microsoft.com/fwlink/p/?LinkId= ## Related topics +[Group Policy Settings Reference Spreadsheet Windows 1803](https://www.microsoft.com/download/details.aspx?id=56946) [Manage corporate devices](manage-corporate-devices.md) From 902ff53be3847152f6390f113b8200173b84c0e9 Mon Sep 17 00:00:00 2001 From: CTroessaert <43269447+CTroessaert@users.noreply.github.com> Date: Tue, 21 May 2019 22:17:43 +0200 Subject: [PATCH 43/90] remove typo for Hello for Business --- windows/whats-new/whats-new-windows-10-version-1903.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/whats-new/whats-new-windows-10-version-1903.md b/windows/whats-new/whats-new-windows-10-version-1903.md index 071529cc49..64477e8511 100644 --- a/windows/whats-new/whats-new-windows-10-version-1903.md +++ b/windows/whats-new/whats-new-windows-10-version-1903.md @@ -120,7 +120,7 @@ The draft release of the [security configuration baseline settings](https://blog - [Windows Hello FIDO2 certification](https://fidoalliance.org/microsoft-achieves-fido2-certification-for-windows-hello/): Windows Hello is now a FIDO2 Certified authenticator and enables password-less login for websites supporting FIDO2 authentication, such as Microsoft account and Azure AD. - [Streamlined Windows Hello PIN reset experience](https://docs.microsoft.com/en-us/windows/security/identity-protection/hello-for-business/hello-videos#windows-hello-for-business-forgotten-pin-user-experience): Microsoft account users have a revamped Windows Hello PIN reset experience with the same look and feel as signing in on the web. -- Sign-in with [Password-less](https://docs.microsoft.com/windows/security/identity-protection/hello-for-business/passwordless-strategy) Microsoft accounts: Sign in to Windows 10 with a phone number account. Then use Windows Hello for an even easier sign-in experience! i +- Sign-in with [Password-less](https://docs.microsoft.com/windows/security/identity-protection/hello-for-business/passwordless-strategy) Microsoft accounts: Sign in to Windows 10 with a phone number account. Then use Windows Hello for an even easier sign-in experience! - [Remote Desktop with Biometrics](https://docs.microsoft.com/windows/security/identity-protection/hello-for-business/hello-features#remote-desktop-with-biometrics): Azure Active Directory and Active Directory users using Windows Hello for Business can use biometrics to authenticate to a remote desktop session. ### Security management From b5eb147c3edab34af088a94ea374233e6ce375e4 Mon Sep 17 00:00:00 2001 From: Rick Munck <33725928+jmunck@users.noreply.github.com> Date: Wed, 22 May 2019 08:06:55 -0700 Subject: [PATCH 44/90] Update security-compliance-toolkit-10.md Updated page to include 1903 release --- .../threat-protection/security-compliance-toolkit-10.md | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/windows/security/threat-protection/security-compliance-toolkit-10.md b/windows/security/threat-protection/security-compliance-toolkit-10.md index fe229e350d..faa63ea948 100644 --- a/windows/security/threat-protection/security-compliance-toolkit-10.md +++ b/windows/security/threat-protection/security-compliance-toolkit-10.md @@ -26,6 +26,7 @@ The SCT enables administrators to effectively manage their enterprise’s Group The Security Compliance Toolkit consists of: - Windows 10 security baselines + - Windows 10 Version 1903 (May 2019 Update) - Windows 10 Version 1809 (October 2018 Update) - Windows 10 Version 1803 (April 2018 Update) - Windows 10 Version 1709 (Fall Creators Update) @@ -69,4 +70,4 @@ LGPO.exe can import and apply settings from Registry Policy (Registry.pol) files It can export local policy to a GPO backup. It can export the contents of a Registry Policy file to the “LGPO text” format that can then be edited, and can build a Registry Policy file from an LGPO text file. -Documentation for the LGPO tool can be found on the [Microsoft Security Guidance blog](https://blogs.technet.microsoft.com/secguide/2016/01/21/lgpo-exe-local-group-policy-object-utility-v1-0/) or by [downloading the tool](https://www.microsoft.com/download/details.aspx?id=55319). \ No newline at end of file +Documentation for the LGPO tool can be found on the [Microsoft Security Guidance blog](https://blogs.technet.microsoft.com/secguide/2016/01/21/lgpo-exe-local-group-policy-object-utility-v1-0/) or by [downloading the tool](https://www.microsoft.com/download/details.aspx?id=55319). From 39c663b33f6a18e42d55ea3029f171e64103c9a9 Mon Sep 17 00:00:00 2001 From: Jose Gabriel Ortega Castro Date: Wed, 22 May 2019 10:45:18 -0500 Subject: [PATCH 45/90] Update windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services.md Co-Authored-By: Joyce Y. <47188252+mypil@users.noreply.github.com> --- ...windows-operating-system-components-to-microsoft-services.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services.md b/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services.md index 69de4938f5..3cca011117 100644 --- a/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services.md +++ b/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services.md @@ -769,7 +769,7 @@ To remove the News app: -or- >[!IMPORTANT] -> If you have any issues with these commands, restart the PC and try the scripts again. +> If you have any issues with these commands, restart the system and try the scripts again. > - Remove the app for new user accounts. From an elevated command prompt, run the following Windows PowerShell command: **Get-AppxProvisionedPackage -Online | Where-Object {$\_.PackageName -Like "Microsoft.BingNews"} | ForEach-Object { Remove-AppxProvisionedPackage -Online -PackageName $\_.PackageName}** From fc8f2edd22104dbe844ed6158b8548357bdbd96d Mon Sep 17 00:00:00 2001 From: illfated Date: Wed, 22 May 2019 22:00:33 +0200 Subject: [PATCH 46/90] Windows Hello For Business overview: URL correction Description: Under the "Learn more" section: - The link to "Implementing Windows Hello for Business at Microsoft" no longer points to the correct Showcase page, but goes to the main Showcase page (Showcase portal) instead. Proposed change: insert the correct link to the (en-us only) working page. Unfortunately, there is no localization for this page yet. Closes #3728 --- .../identity-protection/hello-for-business/hello-overview.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/identity-protection/hello-for-business/hello-overview.md b/windows/security/identity-protection/hello-for-business/hello-overview.md index 58614660a4..bca87f02c5 100644 --- a/windows/security/identity-protection/hello-for-business/hello-overview.md +++ b/windows/security/identity-protection/hello-for-business/hello-overview.md @@ -97,7 +97,7 @@ Windows Hello for Business can use either keys (hardware or software) or certifi ## Learn more -[Implementing Windows Hello for Business at Microsoft](https://www.microsoft.com/itshowcase/Article/Content/830/Implementing-Windows-Hello-for-Business-at-Microsoft) +[Implementing Windows Hello for Business at Microsoft](https://www.microsoft.com/en-us/itshowcase/implementing-windows-hello-for-business-at-microsoft) [Introduction to Windows Hello](https://go.microsoft.com/fwlink/p/?LinkId=786649), video presentation on Microsoft Virtual Academy From 793ff13d99c1ff6ba80410495690483e7c6f4607 Mon Sep 17 00:00:00 2001 From: ImranHabib <47118050+joinimran@users.noreply.github.com> Date: Thu, 23 May 2019 01:31:01 +0500 Subject: [PATCH 47/90] Link was not working The link was pointing to the wrong doc and that doc was also not available. I have updated it to point to the correct doc for Azure AD Connect. Problem: https://github.com/MicrosoftDocs/windows-itpro-docs/issues/2405 --- .../hello-for-business/hello-hybrid-key-trust-prereqs.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust-prereqs.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust-prereqs.md index dd447eb2b1..dc00790f7f 100644 --- a/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust-prereqs.md +++ b/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust-prereqs.md @@ -85,7 +85,7 @@ Organizations using older directory synchronization technology, such as DirSync
## Federation with Azure ## -You can deploy Windows Hello for Business key trust in non-federated and federated environments. For non-federated environments, key trust deployments work in environments that have deployed [Password Synchronization with Azure AD Connect](https://docs.microsoft.com/azure/active-directory/connect/active-directory-aadconnectsync-implement-password-synchronization) and [Azure Active Directory Pass-through-Authentication](https://docs.microsoft.com/azure/active-directory/connect/active-directory-aadconnect-pass-through-authentication). For federated environments, you can deploy Windows Hello for Business key trust using Active Directory Federation Services (AD FS) beginning with Windows Server 2012 R2. +You can deploy Windows Hello for Business key trust in non-federated and federated environments. For non-federated environments, key trust deployments work in environments that have deployed [Password Synchronization with Azure AD Connect](https://docs.microsoft.com/en-us/azure/active-directory/hybrid/whatis-phs) and [Azure Active Directory Pass-through-Authentication](https://docs.microsoft.com/azure/active-directory/connect/active-directory-aadconnect-pass-through-authentication). For federated environments, you can deploy Windows Hello for Business key trust using Active Directory Federation Services (AD FS) beginning with Windows Server 2012 R2. ### Section Review ### > [!div class="checklist"] From 38a53c1ecf3b81a8b61801e92de75586f2de5898 Mon Sep 17 00:00:00 2001 From: MatthewMWR Date: Wed, 22 May 2019 13:52:23 -0700 Subject: [PATCH 48/90] Fix AllowTelemetry precedence info --- .../update/windows-analytics-FAQ-troubleshooting.md | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/windows/deployment/update/windows-analytics-FAQ-troubleshooting.md b/windows/deployment/update/windows-analytics-FAQ-troubleshooting.md index 9942044960..e2e21a62bc 100644 --- a/windows/deployment/update/windows-analytics-FAQ-troubleshooting.md +++ b/windows/deployment/update/windows-analytics-FAQ-troubleshooting.md @@ -84,11 +84,13 @@ If you have devices that appear in other solutions, but not Device Health (the D 1. Using the Azure portal, remove the Device Health (appears as DeviceHealthProd on some pages) solution from your Log Analytics workspace. After completing this, add the Device Health solution to you workspace again. 2. Confirm that the devices are running Windows 10. 3. Verify that the Commercial ID is present in the device's registry. For details see [https://gpsearch.azurewebsites.net/#13551](https://gpsearch.azurewebsites.net/#13551). -4. Confirm that devices have opted in to provide diagnostic data by checking in the registry that **AllowTelemetry** is set to 2 (Enhanced) or 3 (Full) in **HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\DataCollection** (or **HKLM\Software\Policies\Microsoft\Windows\DataCollection**, which takes precedence if set). +4. Confirm that devices are opted in to send diagnostic data by checking in the registry that **AllowTelemetry** is set to either 2 (Enhanced) or 3 (Full). + - **AllowTelemetry** under **HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\DataCollection** is the location set by Group Policy or MDM + - **AllowTelemetry** under **HKLM\Software\Policies\Microsoft\Windows\DataCollection** is the location set by local tools such as the Settings app. + - By convention the Group Policy location would take precedence if both are set. Starting with Windows 10, version 1803, the default precedence is modified to enable a device user to lower the diagnostic data level from that set by IT. For organizations which have no requirement to allow the user to override IT, the conventional (IT wins) behavior can be re-enabled using **DisableTelemetryOptInSettingsUx**. This policy can be set via Group Policy as **Computer Configuration\Administrative Templates\Windows Components\Data Collection and Preview Builds\Configure telemetry opt-in setting user interface**. 5. Verify that devices can reach the endpoints specified in [Enrolling devices in Windows Analytics](windows-analytics-get-started.md). Also check settings for SSL inspection and proxy authentication; see [Configuring endpoint access with SSL inspection](https://docs.microsoft.com/windows/deployment/update/windows-analytics-get-started#configuring-endpoint-access-with-ssl-inspection) for more information. -6. Add the Device Health solution back to your Log Analytics workspace. -7. Wait 48 hours for activity to appear in the reports. -8. If you need additional troubleshooting, contact Microsoft Support. +6. Wait 48 hours for activity to appear in the reports. +7. If you need additional troubleshooting, contact Microsoft Support. ### Device crashes not appearing in Device Health Device Reliability From 9d7c8b2a10ec71d6f3d1a2707048dd45f088cb84 Mon Sep 17 00:00:00 2001 From: Max Velitchko Date: Wed, 22 May 2019 16:16:36 -0700 Subject: [PATCH 49/90] Microsoft Defender for macOS: move JAMF based uninstallation to the JAMF article --- .../images/MDATP_26_Uninstall.png | Bin 22356 -> 30951 bytes ...soft-defender-atp-mac-install-with-jamf.md | 31 +++++++++++++++- .../microsoft-defender-atp-mac-resources.md | 33 ++---------------- 3 files changed, 32 insertions(+), 32 deletions(-) diff --git a/windows/security/threat-protection/windows-defender-antivirus/images/MDATP_26_Uninstall.png b/windows/security/threat-protection/windows-defender-antivirus/images/MDATP_26_Uninstall.png index aa0d5c7caf671bb8d1ece4ad8a56c34427c5e530..6463593a6c9735f7ae3b2f49316860c634253eda 100644 GIT binary patch literal 30951 zcmcG$WmH|s*7v({x8SZp65O5OkPsvgEI2^|1b26L5+K2y1PJc#5IneBaCd^<+TG_l zeeO8pz2kj8+}-qUSbOcYR?VuKbJqO-s>75OWie1mP$3WqhP<5A8wdoJ0Rn+>Lq-Hg zq=dtJ!G92qUdc*99-;qaHWws-BPh0VS`H8hD=qY27}q>8XK)b7QU0|w(mDbGAr`~j zN6kZUh}cnD(^1mq<3|%~M~I}oiJ_y(dn%U?j^Uy2pFWmi&-%gyt+|vz$*e595%9(0EfHQ0>NR;R2_J& z%bc8f1g%SlBR${c(#-L(0WWEd)bWkr@r})Bs_Y_vM}dg=*FrI?w(@XQ@yIdLA(5ZV z7s?$uBM}b-^rsK@CA}ONdJ3e(e}ys%jrk)t660hMkg?cE&7Ke}xOrjH4ONf#kI!#) z&(B9^SJdEVGrqX|!@
wmlZQt*~Pa>DX)E<#b3t;Ow%OjE)A;>5?x5l{9f$?<5( zG_?rR>DLG4dJ)c_mWqa+_IT%lI}W-@a|z_G4rkQomu@f+?GnUV=G0L6opQov78`F{ zB8U838W!rc?=z;Lt=Zp;Eu}w>e-J*I>@L$nxAl0x&-Oh?J)of;l}!JOdgXOpg|u)5rhx|=4~1APx1LSp}dhjm1` zc;s5y9;C)s<*kK?XlA)Stn)6Hc6GV>J0jL<6R8~&#qf}}9acg`?rI=G37=A;i;9WPsfI7?zh_PsC4ksAWs&Pf>oGzCBQ%2*84R5j zpBd3g{SvDF;7DkaJ|J)h&yY=M| zYzwZe??3Ph8r@?PvBNx)l!EBO%nxjh7V}{p1w3#_O+pq;yJiBBBVR{$y`!WMSGDA$ zi}I~k9cTA=xf|N@Tf)ketn{P*^mAG!!@vYIyWAO;rdu!%#%zVj?t^*_)`Nkc9u@v}Fo;Cysik*-)X z!arRf8`k0$b%!?e5Onpeh9aX8tGqkAy+3yKI=;oPCXy#FV+9WxH6Nkuos9soUCgCp zPWkKyZ83O!@L*-;J^W<+>P6m(XP9bjh0|-Ul0xT#C<9xjG$I@pqr4f1_J(^coPDAQ zW2*!U+j*&WPV;m z29kLW7j2SFCDMq7O-$|@M{fx*?P zMVIvaNnT2R`;mri@hM$JPmjU!7%sSJdjQ`^+c`>D-@HD|?2)X(dt}t`y;w5BXxm0& zirEm_yo+REQA~Lb!(BUeVn;hiHcbz;<^Y z8XQt8UDJojL0Yp+Gx}<9weMu!Cp+~y4atQ`sLv6RmD+T6J~yM`wRj&CG?p16UMi{T zKnj5|O)$Ksw2lhJj=)KA`D|b&j{kMO!LXLdu$qVp;>uTw952(wclb4`UiH_CZ9NXT zskFEqxlS{MujM-3)gXu zY@(sIIxHr^a)j{cT5Qv>rNS@DSbzm~SWdNqTSAI#isq5lCwZv+7GoKZM04)kTqLD#+B`ENt(c z>BPa=7gwOnt{WK&Ilz92C&ub7&8%O9Nu3o<=^lMFu^FX)R@^Gbnc{f-=YH3nzB^DH z4*|rc!Q|x7-G-WoqnAg{Sq0Nkfyv6?!P*YuICwdp;Pc$KmUT)f$c4r5o7v@0TEw#V zM0Y;DFgHI8+&`mzdN{7X&szz@FyC-o8--L>aLk_xA;+A~bmAj++|A2$Xx{YfeUvyj zl(_vhxg|dS&H8=5%(|l)RzqrYp8|2f_lBvnAA1`{yu_K~^4rdrk*>tR=EoC03%()N z0|<~iyG{zLIXm=45$mcd7g|0cVi0NLr4$BUDtnw&^h6WedlZ|(84c^K5hsxam0{z4 z)%F+bB}ky4R;T5)V(RiUt}c5Qg5ZV!plq!UYk{!d_VIvOJ1fAH z{5iqD`iQ)1HD1uX`bh&>v&A$&L;-`Q0)F_&YiI@a9~Tux#JlWM#VU!0h}JZeA-Es8_kZ3)hZ}tTKl{GS!_C2(POV@ceIA)zh4A`B)B+GQX0 z1@6pxQeA~Pb-XAvSrBs>WIAYX+3l<%wd)j!Na0etZTpW%DUAGOFS9CY9;b`vX>+PO z-8Sj={M3J~G=#~!x^5_hX0xx&Gbzsn13vdDM9J8_t#tRWTkOYtfjyyLMA*4?)j7K->JWdHQ+G=D#JGd%1H2pwj<>YH zS&N=)b3jBo$EtcVx?te^P;y#=Kj`wl{!qyUc2AYR!rf$qN@H z%6KCQyW4mx=3(-Xo6TXIkDWWw)>Snw73|bTBmI3+L0aXNnW#coZzX?)#(H@J>l&#$ zqjJYXbHnQlJ{MZSh45%=LQd7*m77`OP|Vtn$-Q<<(#w?|H{94KgwZjVpK|h7x#QP5 zS-%&UcHg16?sd|-x_ID7NGc!;IGi$lH}ANF`y7g1**3c_<8F`Fu}^#J9}$KrtKfM3 z^oSurJfgHDH4K`Dj6BrkwQ3$e?~{w_Iqm;48cMUP=)BV1Y8}vB98%dE)o7CpJI>BZ z9O~~IAYDE4RvDvKBY4rG3#2cjAD-s+gscw@-NOk;t0*I}XLyk%jtq3%u*k;x{N}&& zM$ncI0C^E-vHs*ZJzcs0j`qYmEf|Bf8KOJOJr%X7YKel$Os5y6UG;zWioBiSmX!-( zBL?44im%fn>kIiwd2?=(x@OM97Vn>KXkjs{-wq8cPhrVC`e zrV0vDMhc8gdRmK{Ag%pGVG~?50vGYE6=T`MZzKJcW+8@Q7O%G|u2(y9cs65_gI~pd zNarL{Q9pa(z|4`x=;An1gbL+(D)a5w*2(uXBYs_LBFDLiL;FN8?~6+fgtlc~iniY; zqZe2dJ=#7m(|ov8CGRyESpTFIEU%{x+%y`MTG-H*=Z*g?xEdtk=)Xjvl9c zW&Ycf${5KN&CqQA;w8o(RzA=$DV4h1>C~g^jM7EJ7SlpLTqAU zf{cM7t)sJ$InB$QI4&K+G^qWHw|ML|wZ&UeT(fKjh5AC;L)SeVSX zH~KB*)$M&@VWIE%4w=0!(y6O3BNLM!V|d@-V4!-DNd)m)orf?*Bq<+eJYD;aV|H;d z`iBo6z`Zsw!Lrw|(Mp7&ySv-dOg%=bQw6&NY9**j{CA8e$9)LtGpK+kC@zLD8P2_4Jp!MORwC;`1 zgPaN;KN;rv`8kNx;BJ_LKT1kUTrX$M?C!4Zyc4;N^%*dkyXLlUv8zOPe3`_8VRBD ztnmqXiw&PVv>CDcl!U2vK1%;?jqv&`<8e?476(Vyqg&p}ikV&^*>`PiEmMCjJUg=t zqz&{6zMZQtjE#*)_Y~8G!x|a{6_VLu5Cg=$bmHj(0|VQvYl|M~mC_^4(%lf*nvP*l zPfw3)Tkk(AE1^U1@bKE+bN*%6t}xtkr@g668af&p*!ueVnMyM(3row8h4h*l-u;FL*f=(~J7QlF@s={+w zbRq;pQCUq5@4NwgR<~%a@RfTf+XHWNI4#2Cupa5C=?qgbl^^HaQ$vGL^x@ig@GB46 zmoHy5%M4&J$@sC=@KF4H-Oe`KH|(=AGY$H#1l-RVU%q-(?zr(NW)whx3BE`^)*0l>jWG`~$$kFVEbjJw0}{~E8FnnaF&de@=f5^dvaIl(B_EQi&p#UmO40b;h6YZ_jg zrQ(*Uy$hp(L>6%oAy5p1PSbRcLxE!bRtlFTH-?szD4Vt&$2A7AKVjNb{S}eZ`aa~P zEjQ1s8xMGe@6X4tK_^58AYrYAh}}^O3JHxgz7D}8@0f0VaN_3UTaS~aXircQ4I3R* z7C!01ovHdTj!z0FDJ2E3)6?h#p`xaS`S$G_BQtYXs(=F(GVJ%FBE!mAY<&D6`2>2y z@%-23Ha4<4I%H&+NIwS#;?mMEiY5h%uSmE|(ZPHe9UX;eB~r^j5vIVZv0e-h!(}k) z2t`}nAVSpjm3uCyF4=MHsFm2pP_?E$>DLipGji?j8}Ji*a-Zn z-K>i{7_aIj+If0CU%AXM9R_^Ub#!u3Y zJdvJ0eJUp}?>D|93@U-}yw(e$2xtU_w{fAN=4w}|fx*Ev&!3~^<>lE5rp1~N z%SMxlo0`%y6QDu;!1&I@D~{K%Ul*2?bbn$}mGR_L(9lQ{Jfu@rW7evW5^>vg6a=k3 zPlYocA0Lm)$e`qQHktmR3$g7+>=;fH;xqS*QY?T*15eRq1dpfj@$vrQh>$W(=CWC< zU0!5=kVORi`t|05Q!%rbiI?}%e~%Cc$B#)hzisQRebu(@=t?r44!m?G1fSsGM15V8 zDw;II5KynvRPdiA?-AvHDi z^{=Fsz$j8aqyG4((3yL3*m#s(QgV>3cjPE|^6M3w;lte@%_?&osJ}_lbN?`!rVehG z)4~tqd$QgO2LZ!uY-R>IrZ?czC%lWKTVO+FZS8R2^Y91>u^NJ|jV7n3b82b`n3$Nr zLMkmSZKm0SZ*6^jY+)f1%&MYCFdA{l$wjsg$;7c^Q&J+J?sBn_@Wo^D=Z+4E!4y8W zLYH-mN~>AUCg6x%59_zENl3!Mv!L)TdvZO135n?zqUy^$;JO~gS7tfQTC7!xh=fG} z9Y;S}AKX39$7JuiuyMxlU1rS)A|fI>>+IH*-@NgUj>gQ*&4tIO1dj$LNAFmUtctpN zu+UMH!;G}=z(z-kO-mSuagV`V)dz?#=)+Hmi4ut$XNo`6m6d(Z&mAv(3i9)5fDaLJ z-fzp6jwo~5Q_n3Z(6^=9p9EpUc;{E1W`iRWm{Ln_TjY0tMtpjj+|FX-;y8X=y1Tn8 zgR3+iwUExv&hD;*IMhb&vfx*{?46Q9LPOKg;I3G#{yhJ6N-*d>BQXC0Hrc|$!zEl@ z`Imeiy{c+!_0L(lV1S>3IuU448kNMN78TVaM@~skj~+_l%K`p=v^7o0#b_*BI^b{^ z1wE4G*)s`X7F0B}a@*AoL##k@{u z8~+ubd>`J0r+odYtg9?UI@oNw?C?ezWZmVu1 z@m-nQnW^yEAQyDDLp%ksop&d`ZQXgWf`~n>>p~8mB7}@6<^ zH=vVxgUv_$?OS}Pl|UMx4+0d_;ceL~!;PPn>bL5#blu$Cl$i_=$i)Y4Z*OOMzJ84{ zH#Y}PMys5S>`!1Y1|F~Q`}a3o7#JAhXPF?u(`C~5jnxBh%>>+ZKsc5-_5@6kmX_95 zQ&8QHADEASG9HP~XJ*Qc?Uuc+RyR{@)Q<#F&;y<7bu^n?Puz}fzVKKQ7#SObAg>M$ zA%ba&EbIheazVe@4ic`oPoKDp)3ZxGH=b)&Ti~~x=dpd;`?GlDO-K;&)Lf!r`_}8J`@8TjEH9CJobS~O?-;BFZ)g~Jw%qhyRAMajTL zbaTFsQ3m1qy;kt773Q-;V9k{acSClfAG_`C|D&0hcS#+>{+EvOzsjHgmSg@-xBr%7 z{#I%JPQ(9FY5rDk{#I%J^YoiLxuJr&k-LH?*JAJwVjz5snY{)>A$<8L1pH((0-xdC zs*eGmK5kL1{7ESy(P0C`6Nf>LUNY$0La2lPzy=toDsX;;H=d#wJ`vf-Q8Ktyqc5mC z|2hNu<|5$ms|}T2IoG^eJ2bnHfH|A-JDLif^nJmY`NU6IZ1~M&<7ffsTm7qH`D{js zM3d@QCMyYWXi1fg`opZ+|MRiHCabI>s$-U`Fa@$dw&QC??8`r%qdSfe5IiRrX8+?f z9)>WZ$Hgx9X3;__Vt#&JTXJMy_aSqGX@$(`pucVfeLH;Pu+}!f2gi1B{g)?a49`~Q zgKN}OzG^l$_{SD9o|{eE#xx?hAa}ZN)KjZgDt6ID`ns za0?}1L$kkI1x{?F5m1Sz1K~(35v=m4<=>2c6!mVU)GO7{4P_p