diff --git a/browsers/edge/docfx.json b/browsers/edge/docfx.json index a699361d13..31eafa6401 100644 --- a/browsers/edge/docfx.json +++ b/browsers/edge/docfx.json @@ -21,6 +21,9 @@ "ms.topic": "article", "ms.author": "lizross", "ms.date": "04/05/2017", + "feedback_system": "GitHub", + "feedback_github_repo": "MicrosoftDocs/windows-itpro-docs", + "feedback_product_url": "https://support.microsoft.com/help/4021566/windows-10-send-feedback-to-microsoft-with-feedback-hub-app", "_op_documentIdPathDepotMapping": { "./": { "depot_name": "Win.microsoft-edge" diff --git a/browsers/internet-explorer/docfx.json b/browsers/internet-explorer/docfx.json index 056939a089..b7a205ddd2 100644 --- a/browsers/internet-explorer/docfx.json +++ b/browsers/internet-explorer/docfx.json @@ -22,6 +22,9 @@ "ms.technology": "internet-explorer", "ms.topic": "article", "ms.date": "04/05/2017", + "feedback_system": "GitHub", + "feedback_github_repo": "MicrosoftDocs/windows-itpro-docs", + "feedback_product_url": "https://support.microsoft.com/help/4021566/windows-10-send-feedback-to-microsoft-with-feedback-hub-app", "_op_documentIdPathDepotMapping": { "./": { "depot_name": "Win.internet-explorer" diff --git a/devices/hololens/docfx.json b/devices/hololens/docfx.json index 91c25a934c..7a67485a17 100644 --- a/devices/hololens/docfx.json +++ b/devices/hololens/docfx.json @@ -35,6 +35,9 @@ "ms.topic": "article", "ms.author": "jdecker", "ms.date": "04/05/2017", + "feedback_system": "GitHub", + "feedback_github_repo": "MicrosoftDocs/windows-itpro-docs", + "feedback_product_url": "https://support.microsoft.com/help/4021566/windows-10-send-feedback-to-microsoft-with-feedback-hub-app", "_op_documentIdPathDepotMapping": { "./": { "depot_name": "Win.itpro-hololens" diff --git a/devices/surface-hub/docfx.json b/devices/surface-hub/docfx.json index d6a3efaf96..dc151c3165 100644 --- a/devices/surface-hub/docfx.json +++ b/devices/surface-hub/docfx.json @@ -24,6 +24,9 @@ "ms.sitesec": "library", "ms.author": "jdecker", "ms.date": "05/23/2017", + "feedback_system": "GitHub", + "feedback_github_repo": "MicrosoftDocs/windows-itpro-docs", + "feedback_product_url": "https://support.microsoft.com/help/4021566/windows-10-send-feedback-to-microsoft-with-feedback-hub-app", "_op_documentIdPathDepotMapping": { "./": { "depot_name": "Win.surface-hub" diff --git a/devices/surface/docfx.json b/devices/surface/docfx.json index 502700db32..86d594455f 100644 --- a/devices/surface/docfx.json +++ b/devices/surface/docfx.json @@ -21,6 +21,9 @@ "ms.topic": "article", "ms.author": "jdecker", "ms.date": "05/09/2017", + "feedback_system": "GitHub", + "feedback_github_repo": "MicrosoftDocs/windows-itpro-docs", + "feedback_product_url": "https://support.microsoft.com/help/4021566/windows-10-send-feedback-to-microsoft-with-feedback-hub-app", "_op_documentIdPathDepotMapping": { "./": { "depot_name": "Win.surface" diff --git a/education/docfx.json b/education/docfx.json index 067964f4d7..c01be28758 100644 --- a/education/docfx.json +++ b/education/docfx.json @@ -20,11 +20,14 @@ "audience": "windows-education", "ms.topic": "article", "breadcrumb_path": "/education/breadcrumb/toc.json", - "ms.date": "05/09/2017", - "_op_documentIdPathDepotMapping": { - "./": { - "depot_name": "Win.education" - } + "ms.date": "05/09/2017", + "feedback_system": "GitHub", + "feedback_github_repo": "MicrosoftDocs/windows-itpro-docs", + "feedback_product_url": "https://support.microsoft.com/help/4021566/windows-10-send-feedback-to-microsoft-with-feedback-hub-app", + "_op_documentIdPathDepotMapping": { + "./": { + "depot_name": "Win.education" + } } }, "externalReference": [ diff --git a/education/windows/set-up-school-pcs-technical.md b/education/windows/set-up-school-pcs-technical.md index 59d779962f..c4c3cbd233 100644 --- a/education/windows/set-up-school-pcs-technical.md +++ b/education/windows/set-up-school-pcs-technical.md @@ -1,312 +1,309 @@ ---- -title: Set up School PCs app technical reference -description: Describes the changes that the Set up School PCs app makes to a PC. -keywords: shared cart, shared PC, school, set up school pcs -ms.prod: w10 -ms.mktglfcycl: plan -ms.sitesec: library -ms.pagetype: edu -ms.localizationpriority: high -author: CelesteDG -ms.author: celested -ms.date: 02/02/2018 ---- - -# Technical reference for the Set up School PCs app -**Applies to:** - -- Windows 10 - - - -The **Set up School PCs** app helps you set up new Windows 10 PCs that work great in your school by configuring shared PC mode. The latest Set up School PCs app is available for Windows 10, version 1703 (Creators Update). Set up School PCs also configures school-specific settings and policies, described in this topic. - -If your school uses Azure Active Directory (Azure AD) or Office 365, the Set up School PCs app will create a setup file that joins the PC to your Azure Active Directory tenant. You can also use the app to set up school PCs that anyone can use, with or without Internet connectivity. - -Here's a list of what you get when using the Set up School PCs app in your school. - -| Feature | No Internet | Azure AD | Office 365 | Azure AD Premium | -| --- | :---: | :---: | :---: | :---: | -| **Fast sign-in**
Each student can sign in and start using the computer in less than a minute, even on their first sign-in. | X | X | X | X | -| **Custom Start experience**
The apps students need are pinned to Start, and unnecessary apps are removed. | X | X | X | X | -| **Guest account, no sign-in required**
This option sets up computers for common use. Anyone can use the computer without an account. | X | X | X | X | -| **School policies**
Settings specific to education create a useful learning environment and the best computer performance. | X | X | X | X | -| **Azure AD Join**
The computers are joined to your Azure AD or Office 365 subscription for centralized management. | | X | X | X | -| **Single sign-on to Office 365**
By signing on with student IDs, students have fast access to Office 365 web apps or installed Office apps. | | | X | X | -| **Take a Test**
Configure the Take a Test app and use it for taking quizzes and high-stakes assessments by some providers like Smarter Balanced. | | | | X | -| **[Settings roaming](https://azure.microsoft.com/en-us/documentation/articles/active-directory-windows-enterprise-state-roaming-overview/) via Azure AD**
Student user and application settings data can be synchronized across devices for a personalized experience. | | | | X | - - -> [!NOTE] -> If your school uses Active Directory, use [Windows Configuration Designer](set-up-students-pcs-to-join-domain.md) to configure your PCs to join the domain. You can only use the Set up School PCs app to set up PCs that are connected to Azure AD. - -## Automated Azure AD join -One of the most important features in Set up School PCs is the ability to create a provisioning package that performs automated Azure AD join. With this feature, you no longer have to spend minutes going through Windows setup, manually connecting to a network, and manually joining your Azure AD domain. With the automated Azure AD join feature in Set up School School PCs, this process is reduced to zero clicks! You can skip all of the Windows setup experience and the OS automatically joins the PC to your Azure AD domain and enrolls it into MDM if you have a MDM provider activated. - -To make this as seamless as possible, in your Azure AD tenant: -- Allow your teacher and other IT staff to join devices to Azure AD so they can sucessfully request an automated Azure AD join token. - - In the Azure portal, select **Azure Active Directory**. Go to **Users and groups > Device Settings** and in **Users may join devices to Azure AD**, click **Selected** and choose the members you want to enable to join devices to Azure AD. - - **Figure 1** - Select the users you want to enable to join devices to Azure AD - - ![Select the users you want to enable to join devices to Azure AD](images/azuread_usersandgroups_devicesettings_usersmayjoin.png) - -- Consider creating a special account that uses a username and password that you provide, and which has the rights to join devices if you don't want to add all teachers and IT staff. - - When teachers or IT staff need to set up PCs, they can use this account in the Set up School PCs app. - - If you use a service to set up PCs for you, you can give them this special account so they can deliver PCs to you that are already Azure AD joined and ready to be given to a student. - -- Turn off multifactor authentication. - - In the Azure portal, select **Azure Active Directory**. Go to **Users and groups > Device Settings** and set **Require Multi-Factor Auth to join devices** to **No**. - - **Figure 2** - Turn off multi-factor authentication in Azure AD - - ![Turn off multi-factor authentication in Azure AD](images/azuread_usersandgroups_devicesettings_requiremultifactorauth.png) - -- Set the maximum number of devices a user can add to unlimited. - - In the Azure portal, select **Azure Active Directory**. Go to **Users and groups > Device Settings** and set **Maximum number of devices per user** to **Unlimited**. - - **Figure 3** - Set maximum number of devices per user to unlimited - - ![Set maximum number of devices per user to unlimited](images/azuread_usersandgroups_devicesettings_maxnumberofdevicesperuser.png) - -- Clear your Azure AD tokens from time to time. Your tenant can only have 500 automated Azure AD tokens active at any one time. - - In the Azure portal, select **Azure Active Directory**. Go to **Users and groups > All users** and look at the list of user names. User names that start with **package_** followed by a string of letters and numbers. These are the user accounts that are created automatically for the tokens and you can safely delete these. - - **Figure 4** - Delete the accounts automatically created for the Azure AD tokens - - ![Delete the accounts automatically created for the Azure AD tokens](images/azuread_usersandgroups_allusers_automaticaccounts.png) - -- Note that automated Azure AD tokens have expiration dates. Set up School PCs creates them with an expiration date of one month. You will see the specific expiration date for the package in the **Review package summary** page in Set up School PCs. - - **Figure 5** - Sample summary page showing the expiration date - - ![Sample summary page showing the expiration date](images/suspc_choosesettings_summary.png) - - - - - -## Information about Windows Update - -Shared PC mode helps ensure that computers are always up-to-date. If a PC is configured using the Set up School PCs app, shared PC mode sets the power states and Windows Update to: -* Wake nightly -* Check and install updates -* Forcibly reboot if necessary to finish applying updates - -The PC is also configured to not interrupt the user during normal daytime hours with updates or reboots. Notfications are also blocked. - -## Guidance for accounts on shared PCs - -* We recommend no local admin accounts on the PC to improve the reliability and security of the PC. -* When a PC is set up in shared PC mode with the default deletion policy, accounts will be cached automatically until disk space is low. Then, accounts will be deleted to reclaim disk space. This account management happens automatically. Both Azure AD and Active Directory domain accounts are managed in this way. Any accounts created through **Guest** or **Kiosk** will also be deleted automatically at sign out. -* On a Windows PC joined to Azure Active Directory: - * By default, the account that joined the PC to Azure AD will have an admin account on that PC. Global administrators for the Azure AD domain will also have admin accounts on the PC. - * With Azure AD Premium, you can specify which accounts have admin accounts on a PC using the **Additional administrators on Azure AD Joined devices** setting on the Azure portal. -* Local accounts that already exist on a PC won’t be deleted when turning on shared PC mode. New local accounts created through **Settings > Accounts > Other people > Add someone else to this PC** after shared PC mode is turned on won't be deleted. However, any new local accounts created by the **Guest** or **Kiosk** selection on the sign-in screen, if enabled, will automatically be deleted at sign-out. -* If admin accounts are necessary on the PC - * Ensure the PC is joined to a domain that enables accounts to be signed on as admin, or - * Create admin accounts before setting up shared PC mode, or - * Create exempt accounts before signing out. -* The account management service supports accounts that are exempt from deletion. - * An account can be marked exempt from deletion by adding the account SID to the `HKEY_LOCAL_MACHINE\SOFTARE\Microsoft\Windows\CurrentVersion\SharedPC\Exemptions\` registry key. - * To add the account SID to the registry key using PowerShell: - - ``` - $adminName = "LocalAdmin" - $adminPass = 'Pa$$word123' - iex "net user /add $adminName $adminPass" - $user = New-Object System.Security.Principal.NTAccount($adminName) - $sid = $user.Translate([System.Security.Principal.SecurityIdentifier]) - $sid = $sid.Value; - New-Item -Path "HKLM:\Software\Microsoft\Windows\CurrentVersion\SharedPC\Exemptions\$sid" -Force - ``` - -## Custom images -Shared PC mode is fully compatible with custom images that may be created by IT departments. Create a custom image and then use sysprep with the `/oobe` flag to create an image that teachers can then apply the Set up School PCs provisioning package to. [Learn more about sysprep](https://technet.microsoft.com/en-us/library/cc721940(v=ws.10).aspx). - -## Provisioning package details - -The Set up School PCs app produces a specialized provisioning package that makes use of the [SharedPC configuration service provider (CSP)](https://msdn.microsoft.com/en-us/library/windows/hardware/mt723294%28v=vs.85%29.aspx). - -### Education customizations set by local MDM policy - -- By default, saving content locally to the PC is blocked, but you can choose to enable it. This prevents data loss by forcing students to save to the cloud. -- A custom Start layout, taskbar layout, and lock screen image are set. -- Prohibits unlocking the PC to developer mode. -- Prohibits untrusted Microsoft Store apps from being installed. -- Prohibits students from removing MDM. -- Prohibits students from adding new provisioning packages. -- Prohibits student from removing existing provisioning packages (including the one set by Set up School PCs). -- Sets Windows Update to update nightly. - - -### Uninstalled apps - -- 3D Builder (Microsoft.3DBuilder_8wekyb3d8bbwe) -- Weather (Microsoft.BingWeather_8wekyb3d8bbwe) -- Tips (Microsoft.Getstarted_8wekyb3d8bbwe) -- Get Office (Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe) -- Microsoft Solitaire Collection (Microsoft.MicrosoftSolitaireCollection_8wekyb3d8bbwe) -- Paid Wi-Fi & Cellular (Microsoft.OneConnect_8wekyb3d8bbwe) -- Feedback Hub (Microsoft.WindowsFeedbackHub_8wekyb3d8bbwe) -- Xbox (Microsoft.XboxApp_8wekyb3d8bbwe) -- Mail/Calendar (microsoft.windowscommunicationsapps_8wekyb3d8bbwe) - -### Local Group Policies - -> [!IMPORTANT] -> We do not recommend setting additional policies on PCs configured with the Set up School PCs app. The shared PC mode is optimized to be fast and reliable over time with minimal to no manual maintenance required. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Policy path

Policy name

Value

Admin Templates > Control Panel > Personalization

Prevent enabling lock screen slide show

Enabled

Prevent changing lock screen and logon image

Enabled

Admin Templates > System > Power Management > Button Settings

Select the Power button action (plugged in)

Sleep

Select the Power button action (on battery)

Sleep

Select the Sleep button action (plugged in)

Sleep

Select the lid switch action (plugged in)

Sleep

Select the lid switch action (on battery)

Sleep

Admin Templates > System > Power Management > Sleep Settings

Require a password when a computer wakes (plugged in)

Enabled

Require a password when a computer wakes (on battery)

Enabled

Specify the system sleep timeout (plugged in)

5 minutes

Specify the system sleep timeout (on battery)

5 minutes

Turn off hybrid sleep (plugged in)

Enabled

Turn off hybrid sleep (on battery)

Enabled

Specify the unattended sleep timeout (plugged in)

5 minutes

Specify the unattended sleep timeout (on battery)

5 minutes

Allow standby states (S1-S3) when sleeping (plugged in)

Enabled

Allow standby states (S1-S3) when sleeping (on battery)

Enabled

Specify the system hibernate timeout (plugged in)

Enabled, 0

Specify the system hibernate timeout (on battery)

Enabled, 0

Admin Templates>System>Power Management>Video and Display Settings

Turn off the display (plugged in)

5 minutes

Turn off the display (on battery)

5 minutes

Admin Templates>System>Power Management>Energy Saver Settings

Energy Saver Battery Threshold (on battery)

70

Admin Templates>System>Logon

Show first sign-in animation

Disabled

Hide entry points for Fast User Switching

Enabled

Turn on convenience PIN sign-in

Disabled

Turn off picture password sign-in

Enabled

Turn off app notification on the lock screen

Enabled

Allow users to select when a password is required when resuming from connected standby

Disabled

Block user from showing account details on sign-in

Enabled

Admin Templates>System>User Profiles

Turn off the advertising ID

Enabled

Admin Templates>Windows Components>Biometrics

Allow the use of biometrics

Disabled

Allow users to log on using biometrics

Disabled

Allow domain users to log on using biometrics

Disabled

Admin Templates>Windows Components>Cloud Content

Do not show Windows Tips

Enabled

Turn off Microsoft consumer experiences

Enabled

Admin Templates>Windows Components>Data Collection and Preview Builds

Toggle user control over Insider builds

Disabled

Disable pre-release features or settings

Disabled

Do not show feedback notifications

Enabled

Allow Telemetry

Basic, 0

Admin Templates > Windows Components > File Explorer

Show lock in the user tile menu

Disabled

Admin Templates > Windows Components > Maintenance Scheduler

Automatic Maintenance Activation Boundary

*MaintenanceStartTime*

Automatic Maintenance Random Delay

Enabled, 2 hours

Automatic Maintenance WakeUp Policy

Enabled

Admin Templates > Windows Components > OneDrive

Prevent the usage of OneDrive for file storage

Enabled

Admin Templates > Windows Components > Windows Hello for Business

Use phone sign-in

Disabled

Use Windows Hello for Business

Disabled

Use biometrics

Disabled

Windows Settings > Security Settings > Local Policies > Security Options

Accounts: Block Microsoft accounts

**Note** Microsoft accounts can still be used in apps.

Enabled

Interactive logon: Do not display last user name

Enabled

Interactive logon: Sign-in last interactive user automatically after a system-initiated restart

Disabled

Shutdown: Allow system to be shut down without having to log on

Enabled

User Account Control: Behavior of the elevation prompt for standard users

Auto deny


- -## Use the app -When you're ready to use the app, see [Use Set up School PCs app](use-set-up-school-pcs-app.md). - -## Related topics - -[Set up Windows devices for education](set-up-windows-10.md) - - - - - +--- +title: Set up School PCs app technical reference +description: Describes the changes that the Set up School PCs app makes to a PC. +keywords: shared cart, shared PC, school, set up school pcs +ms.prod: w10 +ms.mktglfcycl: plan +ms.sitesec: library +ms.pagetype: edu +ms.localizationpriority: high +author: CelesteDG +ms.author: celested +ms.date: 03/12/2018 +--- + +# Technical reference for the Set up School PCs app +**Applies to:** + +- Windows 10 + + + +The **Set up School PCs** app helps you set up new Windows 10 PCs that work great in your school by configuring shared PC mode. The latest Set up School PCs app is available for Windows 10, version 1703 (Creators Update). Set up School PCs also configures school-specific settings and policies, described in this topic. + +If your school uses Azure Active Directory (Azure AD) or Office 365, the Set up School PCs app will create a setup file that joins the PC to your Azure Active Directory tenant. You can also use the app to set up school PCs that anyone can use, with or without Internet connectivity. + +Here's a list of what you get when using the Set up School PCs app in your school. + +| Feature | No Internet | Azure AD | Office 365 | Azure AD Premium | +| --- | :---: | :---: | :---: | :---: | +| **Fast sign-in**
Each student can sign in and start using the computer in less than a minute, even on their first sign-in. | X | X | X | X | +| **Custom Start experience**
The apps students need are pinned to Start, and unnecessary apps are removed. | X | X | X | X | +| **Guest account, no sign-in required**
This option sets up computers for common use. Anyone can use the computer without an account. | X | X | X | X | +| **School policies**
Settings specific to education create a useful learning environment and the best computer performance. | X | X | X | X | +| **Azure AD Join**
The computers are joined to your Azure AD or Office 365 subscription for centralized management. | | X | X | X | +| **Single sign-on to Office 365**
By signing on with student IDs, students have fast access to Office 365 web apps or installed Office apps. | | | X | X | +| **Take a Test**
Configure the Take a Test app and use it for taking quizzes and high-stakes assessments by some providers like Smarter Balanced. | | | | X | +| **[Settings roaming](https://azure.microsoft.com/en-us/documentation/articles/active-directory-windows-enterprise-state-roaming-overview/) via Azure AD**
Student user and application settings data can be synchronized across devices for a personalized experience. | | | | X | + + +> [!NOTE] +> If your school uses Active Directory, use [Windows Configuration Designer](set-up-students-pcs-to-join-domain.md) to configure your PCs to join the domain. You can only use the Set up School PCs app to set up PCs that are connected to Azure AD. + +## Automated Azure AD join +One of the most important features in Set up School PCs is the ability to create a provisioning package that performs automated Azure AD join. With this feature, you no longer have to spend minutes going through Windows setup, manually connecting to a network, and manually joining your Azure AD domain. With the automated Azure AD join feature in Set up School School PCs, this process is reduced to zero clicks! You can skip all of the Windows setup experience and the OS automatically joins the PC to your Azure AD domain and enrolls it into MDM if you have a MDM provider activated. + +To make this as seamless as possible, in your Azure AD tenant: +- Allow your teacher and other IT staff to join devices to Azure AD so they can sucessfully request an automated Azure AD join token. + + In the Azure portal, select **Azure Active Directory**. Go to **Users and groups > Device Settings** and in **Users may join devices to Azure AD**, click **Selected** and choose the members you want to enable to join devices to Azure AD. + + **Figure 1** - Select the users you want to enable to join devices to Azure AD + + ![Select the users you want to enable to join devices to Azure AD](images/azuread_usersandgroups_devicesettings_usersmayjoin.png) + +- Consider creating a special account that uses a username and password that you provide, and which has the rights to join devices if you don't want to add all teachers and IT staff. + - When teachers or IT staff need to set up PCs, they can use this account in the Set up School PCs app. + - If you use a service to set up PCs for you, you can give them this special account so they can deliver PCs to you that are already Azure AD joined and ready to be given to a student. + +- Turn off multifactor authentication. + + In the Azure portal, select **Azure Active Directory**. Go to **Users and groups > Device Settings** and set **Require Multi-Factor Auth to join devices** to **No**. + + **Figure 2** - Turn off multi-factor authentication in Azure AD + + ![Turn off multi-factor authentication in Azure AD](images/azuread_usersandgroups_devicesettings_requiremultifactorauth.png) + +- Set the maximum number of devices a user can add to unlimited. + + In the Azure portal, select **Azure Active Directory**. Go to **Users and groups > Device Settings** and set **Maximum number of devices per user** to **Unlimited**. + + **Figure 3** - Set maximum number of devices per user to unlimited + + ![Set maximum number of devices per user to unlimited](images/azuread_usersandgroups_devicesettings_maxnumberofdevicesperuser.png) + +- Clear your Azure AD tokens from time to time. Your tenant can only have 500 automated Azure AD tokens active at any one time. + + In the Azure portal, select **Azure Active Directory**. Go to **Users and groups > All users** and look at the list of user names. User names that start with **package_** followed by a string of letters and numbers. These are the user accounts that are created automatically for the tokens and you can safely delete these. + + **Figure 4** - Delete the accounts automatically created for the Azure AD tokens + + ![Delete the accounts automatically created for the Azure AD tokens](images/azuread_usersandgroups_allusers_automaticaccounts.png) + +- Note that automated Azure AD tokens have expiration dates. Set up School PCs creates them with an expiration date of one month. You will see the specific expiration date for the package in the **Review package summary** page in Set up School PCs. + + **Figure 5** - Sample summary page showing the expiration date + + ![Sample summary page showing the expiration date](images/suspc_choosesettings_summary.png) + + + + + +## Information about Windows Update + +Shared PC mode helps ensure that computers are always up-to-date. If a PC is configured using the Set up School PCs app, shared PC mode sets the power states and Windows Update to: +* Wake nightly +* Check and install updates +* Forcibly reboot if necessary to finish applying updates + +The PC is also configured to not interrupt the user during normal daytime hours with updates or reboots. Notfications are also blocked. + +## Guidance for accounts on shared PCs + +* We recommend no local admin accounts on the PC to improve the reliability and security of the PC. +* When a PC is set up in shared PC mode with the default deletion policy, accounts will be cached automatically until disk space is low. Then, accounts will be deleted to reclaim disk space. This account management happens automatically. Both Azure AD and Active Directory domain accounts are managed in this way. Any accounts created through **Guest** or **Kiosk** will also be deleted automatically at sign out. +* On a Windows PC joined to Azure Active Directory: + * By default, the account that joined the PC to Azure AD will have an admin account on that PC. Global administrators for the Azure AD domain will also have admin accounts on the PC. + * With Azure AD Premium, you can specify which accounts have admin accounts on a PC using the **Additional administrators on Azure AD Joined devices** setting on the Azure portal. +* Local accounts that already exist on a PC won’t be deleted when turning on shared PC mode. New local accounts created through **Settings > Accounts > Other people > Add someone else to this PC** after shared PC mode is turned on won't be deleted. However, any new local accounts created by the **Guest** or **Kiosk** selection on the sign-in screen, if enabled, will automatically be deleted at sign-out. +* If admin accounts are necessary on the PC + * Ensure the PC is joined to a domain that enables accounts to be signed on as admin, or + * Create admin accounts before setting up shared PC mode, or + * Create exempt accounts before signing out. +* The account management service supports accounts that are exempt from deletion. + * An account can be marked exempt from deletion by adding the account SID to the `HKEY_LOCAL_MACHINE\SOFTARE\Microsoft\Windows\CurrentVersion\SharedPC\Exemptions\` registry key. + * To add the account SID to the registry key using PowerShell: + + ``` + $adminName = "LocalAdmin" + $adminPass = 'Pa$$word123' + iex "net user /add $adminName $adminPass" + $user = New-Object System.Security.Principal.NTAccount($adminName) + $sid = $user.Translate([System.Security.Principal.SecurityIdentifier]) + $sid = $sid.Value; + New-Item -Path "HKLM:\Software\Microsoft\Windows\CurrentVersion\SharedPC\Exemptions\$sid" -Force + ``` + +## Custom images +Shared PC mode is fully compatible with custom images that may be created by IT departments. Create a custom image and then use sysprep with the `/oobe` flag to create an image that teachers can then apply the Set up School PCs provisioning package to. [Learn more about sysprep](https://technet.microsoft.com/en-us/library/cc721940(v=ws.10).aspx). + +## Provisioning package details + +The Set up School PCs app produces a specialized provisioning package that makes use of the [SharedPC configuration service provider (CSP)](https://msdn.microsoft.com/en-us/library/windows/hardware/mt723294%28v=vs.85%29.aspx). + +### Education customizations set by local MDM policy + +- By default, saving content locally to the PC is blocked, but you can choose to enable it. This prevents data loss by forcing students to save to the cloud. +- A custom Start layout, taskbar layout, and lock screen image are set. +- Prohibits unlocking the PC to developer mode. +- Prohibits untrusted Microsoft Store apps from being installed. +- Prohibits students from removing MDM. +- Prohibits students from adding new provisioning packages. +- Prohibits student from removing existing provisioning packages (including the one set by Set up School PCs). +- Sets Windows Update to update nightly. + + +### Uninstalled apps + +- 3D Builder (Microsoft.3DBuilder_8wekyb3d8bbwe) +- Weather (Microsoft.BingWeather_8wekyb3d8bbwe) +- Tips (Microsoft.Getstarted_8wekyb3d8bbwe) +- Get Office (Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe) +- Microsoft Solitaire Collection (Microsoft.MicrosoftSolitaireCollection_8wekyb3d8bbwe) +- Paid Wi-Fi & Cellular (Microsoft.OneConnect_8wekyb3d8bbwe) +- Feedback Hub (Microsoft.WindowsFeedbackHub_8wekyb3d8bbwe) +- Xbox (Microsoft.XboxApp_8wekyb3d8bbwe) +- Mail/Calendar (microsoft.windowscommunicationsapps_8wekyb3d8bbwe) + +### Local Group Policies + +> [!IMPORTANT] +> We do not recommend setting additional policies on PCs configured with the Set up School PCs app. The shared PC mode is optimized to be fast and reliable over time with minimal to no manual maintenance required. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +

Policy path

Policy name

Value

Admin Templates > Control Panel > Personalization

Prevent enabling lock screen slide show

Enabled

Prevent changing lock screen and logon image

Enabled

Admin Templates > System > Power Management > Button Settings

Select the Power button action (plugged in)

Sleep

Select the Power button action (on battery)

Sleep

Select the Sleep button action (plugged in)

Sleep

Select the lid switch action (plugged in)

Sleep

Select the lid switch action (on battery)

Sleep

Admin Templates > System > Power Management > Sleep Settings

Require a password when a computer wakes (plugged in)

Enabled

Require a password when a computer wakes (on battery)

Enabled

Specify the system sleep timeout (plugged in)

5 minutes

Specify the system sleep timeout (on battery)

5 minutes

Turn off hybrid sleep (plugged in)

Enabled

Turn off hybrid sleep (on battery)

Enabled

Specify the unattended sleep timeout (plugged in)

5 minutes

Specify the unattended sleep timeout (on battery)

5 minutes

Allow standby states (S1-S3) when sleeping (plugged in)

Enabled

Allow standby states (S1-S3) when sleeping (on battery)

Enabled

Specify the system hibernate timeout (plugged in)

Enabled, 0

Specify the system hibernate timeout (on battery)

Enabled, 0

Admin Templates>System>Power Management>Video and Display Settings

Turn off the display (plugged in)

5 minutes

Turn off the display (on battery)

5 minutes

Admin Templates>System>Power Management>Energy Saver Settings

Energy Saver Battery Threshold (on battery)

70

Admin Templates>System>Logon

Show first sign-in animation

Disabled

Hide entry points for Fast User Switching

Enabled

Turn on convenience PIN sign-in

Disabled

Turn off picture password sign-in

Enabled

Turn off app notification on the lock screen

Enabled

Allow users to select when a password is required when resuming from connected standby

Disabled

Block user from showing account details on sign-in

Enabled

Admin Templates>System>User Profiles

Turn off the advertising ID

Enabled

Admin Templates>Windows Components>Biometrics

Allow the use of biometrics

Disabled

Allow users to log on using biometrics

Disabled

Allow domain users to log on using biometrics

Disabled

Admin Templates>Windows Components>Cloud Content

Do not show Windows Tips

Enabled

Turn off Microsoft consumer experiences

Enabled

Admin Templates>Windows Components>Data Collection and Preview Builds

Toggle user control over Insider builds

Disabled

Disable pre-release features or settings

Disabled

Do not show feedback notifications

Enabled

Allow Telemetry

Basic, 0

Admin Templates > Windows Components > File Explorer

Show lock in the user tile menu

Disabled

Admin Templates > Windows Components > Maintenance Scheduler

Automatic Maintenance Activation Boundary

*MaintenanceStartTime*

Automatic Maintenance Random Delay

Enabled, 2 hours

Automatic Maintenance WakeUp Policy

Enabled

Admin Templates > Windows Components > OneDrive

Prevent the usage of OneDrive for file storage

Enabled

Admin Templates > Windows Components > Windows Hello for Business

Use phone sign-in

Disabled

Use Windows Hello for Business

Disabled

Use biometrics

Disabled

Windows Settings > Security Settings > Local Policies > Security Options

Accounts: Block Microsoft accounts

**Note** Microsoft accounts can still be used in apps.

Enabled

Interactive logon: Do not display last user name

Enabled

Interactive logon: Sign-in last interactive user automatically after a system-initiated restart

Disabled

User Account Control: Behavior of the elevation prompt for standard users

Auto deny


+ +## Use the app +When you're ready to use the app, see [Use Set up School PCs app](use-set-up-school-pcs-app.md). + +## Related topics + +[Set up Windows devices for education](set-up-windows-10.md) + + + + + diff --git a/gdpr/docfx.json b/gdpr/docfx.json index dd5fca1462..d426f781dc 100644 --- a/gdpr/docfx.json +++ b/gdpr/docfx.json @@ -31,7 +31,10 @@ "externalReference": [], "globalMetadata": { "author": "eross-msft", - "ms.author": "lizross" + "ms.author": "lizross", + "feedback_system": "GitHub", + "feedback_github_repo": "MicrosoftDocs/windows-itpro-docs", + "feedback_product_url": "https://support.microsoft.com/help/4021566/windows-10-send-feedback-to-microsoft-with-feedback-hub-app" }, "fileMetadata": {}, "template": [], diff --git a/mdop/docfx.json b/mdop/docfx.json index a9a41d5222..a6ff6398ef 100644 --- a/mdop/docfx.json +++ b/mdop/docfx.json @@ -22,6 +22,9 @@ "ms.topic": "article", "ms.author": "jamiet", "ms.date": "04/05/2017", + "feedback_system": "GitHub", + "feedback_github_repo": "MicrosoftDocs/windows-itpro-docs", + "feedback_product_url": "https://support.microsoft.com/help/4021566/windows-10-send-feedback-to-microsoft-with-feedback-hub-app", "_op_documentIdPathDepotMapping": { "./": { "depot_name": "Win.mdop" diff --git a/smb/docfx.json b/smb/docfx.json index 866b2b152c..181bf75fda 100644 --- a/smb/docfx.json +++ b/smb/docfx.json @@ -31,6 +31,9 @@ "globalMetadata": { "uhfHeaderId": "MSDocsHeader-WindowsIT", "breadcrumb_path": "/windows/smb/breadcrumb/toc.json", + "feedback_system": "GitHub", + "feedback_github_repo": "MicrosoftDocs/windows-itpro-docs", + "feedback_product_url": "https://support.microsoft.com/help/4021566/windows-10-send-feedback-to-microsoft-with-feedback-hub-app", "_op_documentIdPathDepotMapping": { "./": { "depot_name": "TechNet.smb" diff --git a/store-for-business/docfx.json b/store-for-business/docfx.json index accb0bcea0..d739d26b28 100644 --- a/store-for-business/docfx.json +++ b/store-for-business/docfx.json @@ -37,7 +37,10 @@ "ms.technology": "windows", "ms.topic": "article", "ms.date": "05/09/2017", - "searchScope": ["Store"], + "searchScope": ["Store"], + "feedback_system": "GitHub", + "feedback_github_repo": "MicrosoftDocs/windows-itpro-docs", + "feedback_product_url": "https://support.microsoft.com/help/4021566/windows-10-send-feedback-to-microsoft-with-feedback-hub-app", "_op_documentIdPathDepotMapping": { "./": { "depot_name": "MSDN.store-for-business" diff --git a/windows/application-management/docfx.json b/windows/application-management/docfx.json index 285dcee673..7d3ae2dae2 100644 --- a/windows/application-management/docfx.json +++ b/windows/application-management/docfx.json @@ -37,6 +37,9 @@ "ms.topic": "article", "ms.author": "elizapo", "ms.date": "04/05/2017", + "feedback_system": "GitHub", + "feedback_github_repo": "MicrosoftDocs/windows-itpro-docs", + "feedback_product_url": "https://support.microsoft.com/help/4021566/windows-10-send-feedback-to-microsoft-with-feedback-hub-app", "_op_documentIdPathDepotMapping": { "./": { "depot_name": "MSDN.win-app-management" diff --git a/windows/application-management/media/cmd-type.png b/windows/application-management/media/cmd-type.png new file mode 100644 index 0000000000..a6c13e8c7c Binary files /dev/null and b/windows/application-management/media/cmd-type.png differ diff --git a/windows/application-management/per-user-services-in-windows.md b/windows/application-management/per-user-services-in-windows.md index 69b7933f18..7e6bf874fa 100644 --- a/windows/application-management/per-user-services-in-windows.md +++ b/windows/application-management/per-user-services-in-windows.md @@ -67,8 +67,6 @@ In light of these restrictions, you can use the following methods to manage per- You can manage the CDPUserSvc and OneSyncSvc per-user services with a [security template](/windows/device-security/security-policy-settings/administer-security-policy-settings#bkmk-sectmpl). See [Administer security policy settings](/windows/device-security/security-policy-settings/administer-security-policy-settings) for more information. -device-security/security-policy-settings/administer-security-policy-settings - For example: ``` @@ -113,8 +111,8 @@ If a per-user service can't be disabled using a the security template, you can d ### Managing Template Services with reg.exe -If you cannot use GPP to manage the per-user services you can edit the registry with reg.exe. -To disable the Template Services change the Startup Type for each service to 4 (disabled). +If you cannot use Group Policy Preferences to manage the per-user services, you can edit the registry with reg.exe. +To disable the Template Services, change the Startup Type for each service to 4 (disabled). For example: ```code @@ -173,4 +171,10 @@ For example, you might see the following per-user services listed in the Service - ContactData_443f50 - Sync Host_443f50 - User Data Access_443f50 -- User Data Storage_443f50 \ No newline at end of file +- User Data Storage_443f50 + +## View per-user services from the command line + +You can query the service configuration from the command line. The **Type** value indicates whether the service is a user-service template or user-service instance. + +![Use sc.exe to view service type](media/cmd-type.png) diff --git a/windows/client-management/docfx.json b/windows/client-management/docfx.json index f649a5d1af..4fc5382798 100644 --- a/windows/client-management/docfx.json +++ b/windows/client-management/docfx.json @@ -37,6 +37,9 @@ "ms.topic": "article", "ms.author": "dongill", "ms.date": "04/05/2017", + "feedback_system": "GitHub", + "feedback_github_repo": "MicrosoftDocs/windows-itpro-docs", + "feedback_product_url": "https://support.microsoft.com/help/4021566/windows-10-send-feedback-to-microsoft-with-feedback-hub-app", "_op_documentIdPathDepotMapping": { "./": { "depot_name": "MSDN.win-client-management" diff --git a/windows/client-management/mdm/configuration-service-provider-reference.md b/windows/client-management/mdm/configuration-service-provider-reference.md index 1f6269d889..3764a9326f 100644 --- a/windows/client-management/mdm/configuration-service-provider-reference.md +++ b/windows/client-management/mdm/configuration-service-provider-reference.md @@ -7,7 +7,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower -ms.date: 03/02/2018 +ms.date: 03/12/2018 --- # Configuration service provider reference @@ -2136,7 +2136,7 @@ Footnotes: -[Uefi CSP](uefi-csp.md) +[UEFI CSP](uefi-csp.md) @@ -2151,7 +2151,7 @@ Footnotes: - + @@ -2596,6 +2596,7 @@ Footnotes: - [Reporting CSP](reporting-csp.md) - [RootCATrustedCertificates CSP](rootcacertificates-csp.md) - [SurfaceHub CSP](surfacehub-csp.md) +- [UEFI CSP](uefi-csp.md) - [WindowsAdvancedThreatProtection CSP](windowsadvancedthreatprotection-csp.md) diff --git a/windows/client-management/mdm/devicestatus-csp.md b/windows/client-management/mdm/devicestatus-csp.md index df99bcf53d..25e45dfb80 100644 --- a/windows/client-management/mdm/devicestatus-csp.md +++ b/windows/client-management/mdm/devicestatus-csp.md @@ -7,7 +7,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower -ms.date: 11/01/2017 +ms.date: 03/12/2018 --- # DeviceStatus CSP @@ -132,6 +132,15 @@ Added in Windows, version 1607. String that specifies the OS edition. Supported operation is Get. +**DeviceStatus/OS/Mode** +Added in Windows, version 1803. Read only node that specifies the device mode. + +Valid values: +- 0 - the device is in standard configuration +- 1 - the device is in S mode configuration + +Supported operation is Get. + **DeviceStatus/Antivirus** Added in Windows, version 1607. Node for the antivirus query. diff --git a/windows/client-management/mdm/devicestatus-ddf.md b/windows/client-management/mdm/devicestatus-ddf.md index 08187de0a3..7e4a7a5933 100644 --- a/windows/client-management/mdm/devicestatus-ddf.md +++ b/windows/client-management/mdm/devicestatus-ddf.md @@ -7,7 +7,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower -ms.date: 12/05/2017 +ms.date: 03/12/2018 --- # DeviceStatus DDF @@ -17,7 +17,7 @@ This topic shows the OMA DM device description framework (DDF) for the **DeviceS Looking for the DDF XML files? See [CSP DDF files download](configuration-service-provider-reference.md#csp-ddf-files-download). -The XML below is for Windows 10, version 1709. +The XML below is for Windows 10, version 1803. ``` syntax @@ -469,6 +469,27 @@ The XML below is for Windows 10, version 1709. + + Mode + + + + + Not available + + + + + + + + + + + text/plain + + + Antivirus diff --git a/windows/client-management/mdm/images/provisioning-csp-devicestatus.png b/windows/client-management/mdm/images/provisioning-csp-devicestatus.png index 76c746d95f..520d58a825 100644 Binary files a/windows/client-management/mdm/images/provisioning-csp-devicestatus.png and b/windows/client-management/mdm/images/provisioning-csp-devicestatus.png differ diff --git a/windows/client-management/mdm/new-in-windows-mdm-enrollment-management.md b/windows/client-management/mdm/new-in-windows-mdm-enrollment-management.md index 62bdf664f0..375d058557 100644 --- a/windows/client-management/mdm/new-in-windows-mdm-enrollment-management.md +++ b/windows/client-management/mdm/new-in-windows-mdm-enrollment-management.md @@ -1411,6 +1411,13 @@ The DM agent for [push-button reset](https://msdn.microsoft.com/windows/hardware + + +
cross markcheck mark4cross mark check mark4 check mark4 check mark4
[DeviceStatus CSP](devicestatus-csp.md)

Added the following node in Windows 10, version 1803:

+
    +
  • OS/Mode
    • +
+
[Understanding ADMX-backed policies](understanding-admx-backed-policies.md)

Added the following videos:

    diff --git a/windows/client-management/mdm/policy-configuration-service-provider.md b/windows/client-management/mdm/policy-configuration-service-provider.md index 6f733c2214..c94b2fe9d3 100644 --- a/windows/client-management/mdm/policy-configuration-service-provider.md +++ b/windows/client-management/mdm/policy-configuration-service-provider.md @@ -498,6 +498,9 @@ The following diagram shows the Policy configuration service provider in tree fo
    Browser/PreventSmartScreenPromptOverrideForFiles
    +
    + Browser/PreventTabPreloading +
    Browser/PreventUsingLocalHostIPAddressForWebRTC
    @@ -4543,7 +4546,6 @@ The following diagram shows the Policy configuration service provider in tree fo - [Security/RequireDeviceEncryption](#security-requiredeviceencryption) - [Settings/AllowDateTime](#settings-allowdatetime) - [Settings/AllowVPN](#settings-allowvpn) -- [System/AllowFontProviders](#system-allowfontproviders) - [System/AllowLocation](#system-allowlocation) - [System/AllowTelemetry](#system-allowtelemetry) - [Update/AllowAutoUpdate](#update-allowautoupdate) diff --git a/windows/client-management/mdm/policy-csp-abovelock.md b/windows/client-management/mdm/policy-csp-abovelock.md index d0b77e50dc..16115c79c9 100644 --- a/windows/client-management/mdm/policy-csp-abovelock.md +++ b/windows/client-management/mdm/policy-csp-abovelock.md @@ -6,7 +6,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower -ms.date: 03/05/2018 +ms.date: 03/12/2018 --- # Policy CSP - AboveLock @@ -202,6 +202,7 @@ Footnote: - 1 - Added in Windows 10, version 1607. - 2 - Added in Windows 10, version 1703. - 3 - Added in Windows 10, version 1709. +- 4 - Added in Windows 10, version 1803. diff --git a/windows/client-management/mdm/policy-csp-accountpoliciesaccountlockoutpolicy.md b/windows/client-management/mdm/policy-csp-accountpoliciesaccountlockoutpolicy.md index 2d0549e77b..7cee27e382 100644 --- a/windows/client-management/mdm/policy-csp-accountpoliciesaccountlockoutpolicy.md +++ b/windows/client-management/mdm/policy-csp-accountpoliciesaccountlockoutpolicy.md @@ -6,7 +6,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower -ms.date: 01/30/2018 +ms.date: 03/12/2018 --- # Policy CSP - AccountPoliciesAccountLockoutPolicy @@ -180,6 +180,7 @@ Footnote: - 1 - Added in Windows 10, version 1607. - 2 - Added in Windows 10, version 1703. - 3 - Added in Windows 10, version 1709. +- 4 - Added in Windows 10, version 1803. diff --git a/windows/client-management/mdm/policy-csp-accounts.md b/windows/client-management/mdm/policy-csp-accounts.md index 0fb29f4870..5eb439322d 100644 --- a/windows/client-management/mdm/policy-csp-accounts.md +++ b/windows/client-management/mdm/policy-csp-accounts.md @@ -6,7 +6,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower -ms.date: 01/30/2018 +ms.date: 03/12/2018 --- # Policy CSP - Accounts @@ -244,6 +244,7 @@ Footnote: - 1 - Added in Windows 10, version 1607. - 2 - Added in Windows 10, version 1703. - 3 - Added in Windows 10, version 1709. +- 4 - Added in Windows 10, version 1803. diff --git a/windows/client-management/mdm/policy-csp-activexcontrols.md b/windows/client-management/mdm/policy-csp-activexcontrols.md index 925504ac0d..2563d21bc2 100644 --- a/windows/client-management/mdm/policy-csp-activexcontrols.md +++ b/windows/client-management/mdm/policy-csp-activexcontrols.md @@ -6,7 +6,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower -ms.date: 03/05/2018 +ms.date: 03/12/2018 --- # Policy CSP - ActiveXControls @@ -95,6 +95,7 @@ Footnote: - 1 - Added in Windows 10, version 1607. - 2 - Added in Windows 10, version 1703. - 3 - Added in Windows 10, version 1709. +- 4 - Added in Windows 10, version 1803. diff --git a/windows/client-management/mdm/policy-csp-applicationdefaults.md b/windows/client-management/mdm/policy-csp-applicationdefaults.md index dba53edc54..5aaf01d6fb 100644 --- a/windows/client-management/mdm/policy-csp-applicationdefaults.md +++ b/windows/client-management/mdm/policy-csp-applicationdefaults.md @@ -6,7 +6,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower -ms.date: 03/05/2018 +ms.date: 03/12/2018 --- # Policy CSP - ApplicationDefaults @@ -139,6 +139,7 @@ Footnote: - 1 - Added in Windows 10, version 1607. - 2 - Added in Windows 10, version 1703. - 3 - Added in Windows 10, version 1709. +- 4 - Added in Windows 10, version 1803. diff --git a/windows/client-management/mdm/policy-csp-applicationmanagement.md b/windows/client-management/mdm/policy-csp-applicationmanagement.md index 634f53cafc..47b9d1e09d 100644 --- a/windows/client-management/mdm/policy-csp-applicationmanagement.md +++ b/windows/client-management/mdm/policy-csp-applicationmanagement.md @@ -6,7 +6,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower -ms.date: 03/09/2018 +ms.date: 03/12/2018 --- # Policy CSP - ApplicationManagement @@ -722,6 +722,7 @@ Footnote: - 1 - Added in Windows 10, version 1607. - 2 - Added in Windows 10, version 1703. - 3 - Added in Windows 10, version 1709. +- 4 - Added in Windows 10, version 1803. diff --git a/windows/client-management/mdm/policy-csp-appruntime.md b/windows/client-management/mdm/policy-csp-appruntime.md index 941e26cef4..7e6fb10c8d 100644 --- a/windows/client-management/mdm/policy-csp-appruntime.md +++ b/windows/client-management/mdm/policy-csp-appruntime.md @@ -6,7 +6,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower -ms.date: 03/09/2018 +ms.date: 03/12/2018 --- # Policy CSP - AppRuntime @@ -72,6 +72,7 @@ Footnote: - 1 - Added in Windows 10, version 1607. - 2 - Added in Windows 10, version 1703. - 3 - Added in Windows 10, version 1709. +- 4 - Added in Windows 10, version 1803. diff --git a/windows/client-management/mdm/policy-csp-appvirtualization.md b/windows/client-management/mdm/policy-csp-appvirtualization.md index bbb346e93c..562a5224dc 100644 --- a/windows/client-management/mdm/policy-csp-appvirtualization.md +++ b/windows/client-management/mdm/policy-csp-appvirtualization.md @@ -6,7 +6,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower -ms.date: 03/05/2018 +ms.date: 03/12/2018 --- # Policy CSP - AppVirtualization @@ -1836,6 +1836,7 @@ Footnote: - 1 - Added in Windows 10, version 1607. - 2 - Added in Windows 10, version 1703. - 3 - Added in Windows 10, version 1709. +- 4 - Added in Windows 10, version 1803. diff --git a/windows/client-management/mdm/policy-csp-attachmentmanager.md b/windows/client-management/mdm/policy-csp-attachmentmanager.md index c80e44f614..7b97a87a4b 100644 --- a/windows/client-management/mdm/policy-csp-attachmentmanager.md +++ b/windows/client-management/mdm/policy-csp-attachmentmanager.md @@ -6,7 +6,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower -ms.date: 03/05/2018 +ms.date: 03/12/2018 --- # Policy CSP - AttachmentManager @@ -229,6 +229,7 @@ Footnote: - 1 - Added in Windows 10, version 1607. - 2 - Added in Windows 10, version 1703. - 3 - Added in Windows 10, version 1709. +- 4 - Added in Windows 10, version 1803. diff --git a/windows/client-management/mdm/policy-csp-authentication.md b/windows/client-management/mdm/policy-csp-authentication.md index 02a363e078..f83bb3905c 100644 --- a/windows/client-management/mdm/policy-csp-authentication.md +++ b/windows/client-management/mdm/policy-csp-authentication.md @@ -6,7 +6,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower -ms.date: 03/05/2018 +ms.date: 03/12/2018 --- # Policy CSP - Authentication @@ -309,6 +309,7 @@ Footnote: - 1 - Added in Windows 10, version 1607. - 2 - Added in Windows 10, version 1703. - 3 - Added in Windows 10, version 1709. +- 4 - Added in Windows 10, version 1803. diff --git a/windows/client-management/mdm/policy-csp-autoplay.md b/windows/client-management/mdm/policy-csp-autoplay.md index 2e2ecaf426..c748e76ae7 100644 --- a/windows/client-management/mdm/policy-csp-autoplay.md +++ b/windows/client-management/mdm/policy-csp-autoplay.md @@ -6,7 +6,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower -ms.date: 03/05/2018 +ms.date: 03/12/2018 --- # Policy CSP - Autoplay @@ -245,6 +245,7 @@ Footnote: - 1 - Added in Windows 10, version 1607. - 2 - Added in Windows 10, version 1703. - 3 - Added in Windows 10, version 1709. +- 4 - Added in Windows 10, version 1803. diff --git a/windows/client-management/mdm/policy-csp-bitlocker.md b/windows/client-management/mdm/policy-csp-bitlocker.md index 852a915bac..fa358dcb81 100644 --- a/windows/client-management/mdm/policy-csp-bitlocker.md +++ b/windows/client-management/mdm/policy-csp-bitlocker.md @@ -6,7 +6,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower -ms.date: 01/30/2018 +ms.date: 03/12/2018 --- # Policy CSP - Bitlocker @@ -114,6 +114,7 @@ Footnote: - 1 - Added in Windows 10, version 1607. - 2 - Added in Windows 10, version 1703. - 3 - Added in Windows 10, version 1709. +- 4 - Added in Windows 10, version 1803. diff --git a/windows/client-management/mdm/policy-csp-bluetooth.md b/windows/client-management/mdm/policy-csp-bluetooth.md index 3a6b797bf3..fb08f30dc0 100644 --- a/windows/client-management/mdm/policy-csp-bluetooth.md +++ b/windows/client-management/mdm/policy-csp-bluetooth.md @@ -6,7 +6,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower -ms.date: 01/30/2018 +ms.date: 03/12/2018 --- # Policy CSP - Bluetooth @@ -293,6 +293,7 @@ Footnote: - 1 - Added in Windows 10, version 1607. - 2 - Added in Windows 10, version 1703. - 3 - Added in Windows 10, version 1709. +- 4 - Added in Windows 10, version 1803. diff --git a/windows/client-management/mdm/policy-csp-browser.md b/windows/client-management/mdm/policy-csp-browser.md index 22fc158c08..79d91ff2dc 100644 --- a/windows/client-management/mdm/policy-csp-browser.md +++ b/windows/client-management/mdm/policy-csp-browser.md @@ -6,7 +6,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower -ms.date: 03/05/2018 +ms.date: 03/13/2018 --- # Policy CSP - Browser @@ -117,6 +117,9 @@ ms.date: 03/05/2018
    Browser/PreventSmartScreenPromptOverrideForFiles
    +
    + Browser/PreventTabPreloading +
    Browser/PreventUsingLocalHostIPAddressForWebRTC
    @@ -2150,6 +2153,58 @@ The following list shows the supported values:
    + +**Browser/PreventTabPreloading** + + + + + + + + + + + + + + + + + + + + + +
    HomeProBusinessEnterpriseEducationMobileMobile Enterprise
    cross markcheck mark4check mark4check mark4check mark4
    + + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User +> * Device + +
    + + + +Added in Windows 10, version 1803. This is only a placeholder. Do not use in production code. + + + + +The following list shows the supported values: + +- 0 (default) – Allow pre-launch and preload. +- 1 – Prevent pre-launch and preload. + + + + +
    + **Browser/PreventUsingLocalHostIPAddressForWebRTC** @@ -2616,6 +2671,7 @@ Footnote: - 1 - Added in Windows 10, version 1607. - 2 - Added in Windows 10, version 1703. - 3 - Added in Windows 10, version 1709. +- 4 - Added in Windows 10, version 1803. diff --git a/windows/client-management/mdm/policy-csp-camera.md b/windows/client-management/mdm/policy-csp-camera.md index 02a242ec12..3cbf216e52 100644 --- a/windows/client-management/mdm/policy-csp-camera.md +++ b/windows/client-management/mdm/policy-csp-camera.md @@ -6,7 +6,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower -ms.date: 03/05/2018 +ms.date: 03/12/2018 --- # Policy CSP - Camera @@ -91,6 +91,7 @@ Footnote: - 1 - Added in Windows 10, version 1607. - 2 - Added in Windows 10, version 1703. - 3 - Added in Windows 10, version 1709. +- 4 - Added in Windows 10, version 1803. diff --git a/windows/client-management/mdm/policy-csp-cellular.md b/windows/client-management/mdm/policy-csp-cellular.md index 5b9aa0d665..431c59baa4 100644 --- a/windows/client-management/mdm/policy-csp-cellular.md +++ b/windows/client-management/mdm/policy-csp-cellular.md @@ -6,7 +6,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower -ms.date: 03/05/2018 +ms.date: 03/12/2018 --- # Policy CSP - Cellular @@ -324,6 +324,7 @@ Footnote: - 1 - Added in Windows 10, version 1607. - 2 - Added in Windows 10, version 1703. - 3 - Added in Windows 10, version 1709. +- 4 - Added in Windows 10, version 1803. diff --git a/windows/client-management/mdm/policy-csp-connectivity.md b/windows/client-management/mdm/policy-csp-connectivity.md index 249cc6cac3..faf33814cc 100644 --- a/windows/client-management/mdm/policy-csp-connectivity.md +++ b/windows/client-management/mdm/policy-csp-connectivity.md @@ -6,7 +6,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower -ms.date: 03/05/2018 +ms.date: 03/12/2018 --- # Policy CSP - Connectivity @@ -898,6 +898,7 @@ Footnote: - 1 - Added in Windows 10, version 1607. - 2 - Added in Windows 10, version 1703. - 3 - Added in Windows 10, version 1709. +- 4 - Added in Windows 10, version 1803. diff --git a/windows/client-management/mdm/policy-csp-controlpolicyconflict.md b/windows/client-management/mdm/policy-csp-controlpolicyconflict.md index 229109756e..b606419501 100644 --- a/windows/client-management/mdm/policy-csp-controlpolicyconflict.md +++ b/windows/client-management/mdm/policy-csp-controlpolicyconflict.md @@ -6,7 +6,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower -ms.date: 01/30/2018 +ms.date: 03/12/2018 --- # Policy CSP - ControlPolicyConflict @@ -91,6 +91,7 @@ Footnote: - 1 - Added in Windows 10, version 1607. - 2 - Added in Windows 10, version 1703. - 3 - Added in Windows 10, version 1709. +- 4 - Added in Windows 10, version 1803. diff --git a/windows/client-management/mdm/policy-csp-credentialproviders.md b/windows/client-management/mdm/policy-csp-credentialproviders.md index 039a57e0fb..f3f12c6f73 100644 --- a/windows/client-management/mdm/policy-csp-credentialproviders.md +++ b/windows/client-management/mdm/policy-csp-credentialproviders.md @@ -6,7 +6,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower -ms.date: 03/05/2018 +ms.date: 03/12/2018 --- # Policy CSP - CredentialProviders @@ -219,6 +219,7 @@ Footnote: - 1 - Added in Windows 10, version 1607. - 2 - Added in Windows 10, version 1703. - 3 - Added in Windows 10, version 1709. +- 4 - Added in Windows 10, version 1803. diff --git a/windows/client-management/mdm/policy-csp-credentialsdelegation.md b/windows/client-management/mdm/policy-csp-credentialsdelegation.md index 1e465a7a21..e347fbd029 100644 --- a/windows/client-management/mdm/policy-csp-credentialsdelegation.md +++ b/windows/client-management/mdm/policy-csp-credentialsdelegation.md @@ -6,7 +6,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower -ms.date: 03/09/2018 +ms.date: 03/12/2018 --- # Policy CSP - CredentialsDelegation @@ -74,6 +74,7 @@ Footnote: - 1 - Added in Windows 10, version 1607. - 2 - Added in Windows 10, version 1703. - 3 - Added in Windows 10, version 1709. +- 4 - Added in Windows 10, version 1803. diff --git a/windows/client-management/mdm/policy-csp-credentialsui.md b/windows/client-management/mdm/policy-csp-credentialsui.md index ec0f9a0c5e..900ad6176a 100644 --- a/windows/client-management/mdm/policy-csp-credentialsui.md +++ b/windows/client-management/mdm/policy-csp-credentialsui.md @@ -6,7 +6,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower -ms.date: 03/05/2018 +ms.date: 03/12/2018 --- # Policy CSP - CredentialsUI @@ -163,6 +163,7 @@ Footnote: - 1 - Added in Windows 10, version 1607. - 2 - Added in Windows 10, version 1703. - 3 - Added in Windows 10, version 1709. +- 4 - Added in Windows 10, version 1803. diff --git a/windows/client-management/mdm/policy-csp-cryptography.md b/windows/client-management/mdm/policy-csp-cryptography.md index b2360eb40b..7dadd07af1 100644 --- a/windows/client-management/mdm/policy-csp-cryptography.md +++ b/windows/client-management/mdm/policy-csp-cryptography.md @@ -6,7 +6,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower -ms.date: 03/05/2018 +ms.date: 03/12/2018 --- # Policy CSP - Cryptography @@ -133,6 +133,7 @@ Footnote: - 1 - Added in Windows 10, version 1607. - 2 - Added in Windows 10, version 1703. - 3 - Added in Windows 10, version 1709. +- 4 - Added in Windows 10, version 1803. diff --git a/windows/client-management/mdm/policy-csp-dataprotection.md b/windows/client-management/mdm/policy-csp-dataprotection.md index 1563402e93..28ad8aaca3 100644 --- a/windows/client-management/mdm/policy-csp-dataprotection.md +++ b/windows/client-management/mdm/policy-csp-dataprotection.md @@ -6,7 +6,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower -ms.date: 01/30/2018 +ms.date: 03/12/2018 --- # Policy CSP - DataProtection @@ -136,6 +136,7 @@ Footnote: - 1 - Added in Windows 10, version 1607. - 2 - Added in Windows 10, version 1703. - 3 - Added in Windows 10, version 1709. +- 4 - Added in Windows 10, version 1803. diff --git a/windows/client-management/mdm/policy-csp-datausage.md b/windows/client-management/mdm/policy-csp-datausage.md index 2aa9b34cd0..89086b22bb 100644 --- a/windows/client-management/mdm/policy-csp-datausage.md +++ b/windows/client-management/mdm/policy-csp-datausage.md @@ -6,7 +6,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower -ms.date: 03/05/2018 +ms.date: 03/12/2018 --- # Policy CSP - DataUsage @@ -170,6 +170,7 @@ Footnote: - 1 - Added in Windows 10, version 1607. - 2 - Added in Windows 10, version 1703. - 3 - Added in Windows 10, version 1709. +- 4 - Added in Windows 10, version 1803. diff --git a/windows/client-management/mdm/policy-csp-defender.md b/windows/client-management/mdm/policy-csp-defender.md index 74091500ca..76c96ac41d 100644 --- a/windows/client-management/mdm/policy-csp-defender.md +++ b/windows/client-management/mdm/policy-csp-defender.md @@ -6,7 +6,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower -ms.date: 03/05/2018 +ms.date: 03/12/2018 --- # Policy CSP - Defender @@ -2318,6 +2318,7 @@ Footnote: - 1 - Added in Windows 10, version 1607. - 2 - Added in Windows 10, version 1703. - 3 - Added in Windows 10, version 1709. +- 4 - Added in Windows 10, version 1803. diff --git a/windows/client-management/mdm/policy-csp-deliveryoptimization.md b/windows/client-management/mdm/policy-csp-deliveryoptimization.md index 849fcb5d99..cf43d37c41 100644 --- a/windows/client-management/mdm/policy-csp-deliveryoptimization.md +++ b/windows/client-management/mdm/policy-csp-deliveryoptimization.md @@ -6,7 +6,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower -ms.date: 03/09/2018 +ms.date: 03/12/2018 --- # Policy CSP - DeliveryOptimization @@ -1488,6 +1488,7 @@ Footnote: - 1 - Added in Windows 10, version 1607. - 2 - Added in Windows 10, version 1703. - 3 - Added in Windows 10, version 1709. +- 4 - Added in Windows 10, version 1803. diff --git a/windows/client-management/mdm/policy-csp-desktop.md b/windows/client-management/mdm/policy-csp-desktop.md index 2957bd78f7..36afbf2a08 100644 --- a/windows/client-management/mdm/policy-csp-desktop.md +++ b/windows/client-management/mdm/policy-csp-desktop.md @@ -6,7 +6,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower -ms.date: 03/05/2018 +ms.date: 03/12/2018 --- # Policy CSP - Desktop @@ -93,6 +93,7 @@ Footnote: - 1 - Added in Windows 10, version 1607. - 2 - Added in Windows 10, version 1703. - 3 - Added in Windows 10, version 1709. +- 4 - Added in Windows 10, version 1803. diff --git a/windows/client-management/mdm/policy-csp-deviceguard.md b/windows/client-management/mdm/policy-csp-deviceguard.md index a516cc7ab4..b541578089 100644 --- a/windows/client-management/mdm/policy-csp-deviceguard.md +++ b/windows/client-management/mdm/policy-csp-deviceguard.md @@ -6,7 +6,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower -ms.date: 03/05/2018 +ms.date: 03/12/2018 --- # Policy CSP - DeviceGuard @@ -214,6 +214,7 @@ Footnote: - 1 - Added in Windows 10, version 1607. - 2 - Added in Windows 10, version 1703. - 3 - Added in Windows 10, version 1709. +- 4 - Added in Windows 10, version 1803. diff --git a/windows/client-management/mdm/policy-csp-deviceinstallation.md b/windows/client-management/mdm/policy-csp-deviceinstallation.md index c8b4f6b9d9..38941fd46b 100644 --- a/windows/client-management/mdm/policy-csp-deviceinstallation.md +++ b/windows/client-management/mdm/policy-csp-deviceinstallation.md @@ -6,7 +6,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower -ms.date: 03/05/2018 +ms.date: 03/12/2018 --- # Policy CSP - DeviceInstallation @@ -158,6 +158,7 @@ Footnote: - 1 - Added in Windows 10, version 1607. - 2 - Added in Windows 10, version 1703. - 3 - Added in Windows 10, version 1709. +- 4 - Added in Windows 10, version 1803. diff --git a/windows/client-management/mdm/policy-csp-devicelock.md b/windows/client-management/mdm/policy-csp-devicelock.md index 5663570085..1a791a7b71 100644 --- a/windows/client-management/mdm/policy-csp-devicelock.md +++ b/windows/client-management/mdm/policy-csp-devicelock.md @@ -6,7 +6,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower -ms.date: 03/09/2018 +ms.date: 03/12/2018 --- # Policy CSP - DeviceLock @@ -1192,6 +1192,7 @@ Footnote: - 1 - Added in Windows 10, version 1607. - 2 - Added in Windows 10, version 1703. - 3 - Added in Windows 10, version 1709. +- 4 - Added in Windows 10, version 1803. diff --git a/windows/client-management/mdm/policy-csp-display.md b/windows/client-management/mdm/policy-csp-display.md index 827b347c3e..0cf8a9740d 100644 --- a/windows/client-management/mdm/policy-csp-display.md +++ b/windows/client-management/mdm/policy-csp-display.md @@ -6,7 +6,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower -ms.date: 03/05/2018 +ms.date: 03/12/2018 --- # Policy CSP - Display @@ -355,6 +355,7 @@ Footnote: - 1 - Added in Windows 10, version 1607. - 2 - Added in Windows 10, version 1703. - 3 - Added in Windows 10, version 1709. +- 4 - Added in Windows 10, version 1803. diff --git a/windows/client-management/mdm/policy-csp-education.md b/windows/client-management/mdm/policy-csp-education.md index 8eab86d6e3..e1fb1b9965 100644 --- a/windows/client-management/mdm/policy-csp-education.md +++ b/windows/client-management/mdm/policy-csp-education.md @@ -6,7 +6,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower -ms.date: 03/05/2018 +ms.date: 03/12/2018 --- # Policy CSP - Education @@ -185,6 +185,7 @@ Footnote: - 1 - Added in Windows 10, version 1607. - 2 - Added in Windows 10, version 1703. - 3 - Added in Windows 10, version 1709. +- 4 - Added in Windows 10, version 1803. diff --git a/windows/client-management/mdm/policy-csp-enterprisecloudprint.md b/windows/client-management/mdm/policy-csp-enterprisecloudprint.md index 63d4b5f3b2..4b5b961ad9 100644 --- a/windows/client-management/mdm/policy-csp-enterprisecloudprint.md +++ b/windows/client-management/mdm/policy-csp-enterprisecloudprint.md @@ -6,7 +6,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower -ms.date: 01/30/2018 +ms.date: 03/12/2018 --- # Policy CSP - EnterpriseCloudPrint @@ -328,6 +328,7 @@ Footnote: - 1 - Added in Windows 10, version 1607. - 2 - Added in Windows 10, version 1703. - 3 - Added in Windows 10, version 1709. +- 4 - Added in Windows 10, version 1803. diff --git a/windows/client-management/mdm/policy-csp-errorreporting.md b/windows/client-management/mdm/policy-csp-errorreporting.md index ed18d1d8d9..d2a31d1077 100644 --- a/windows/client-management/mdm/policy-csp-errorreporting.md +++ b/windows/client-management/mdm/policy-csp-errorreporting.md @@ -6,7 +6,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower -ms.date: 03/05/2018 +ms.date: 03/12/2018 --- # Policy CSP - ErrorReporting @@ -367,6 +367,7 @@ Footnote: - 1 - Added in Windows 10, version 1607. - 2 - Added in Windows 10, version 1703. - 3 - Added in Windows 10, version 1709. +- 4 - Added in Windows 10, version 1803. diff --git a/windows/client-management/mdm/policy-csp-eventlogservice.md b/windows/client-management/mdm/policy-csp-eventlogservice.md index e0d3529cc9..835be83eb0 100644 --- a/windows/client-management/mdm/policy-csp-eventlogservice.md +++ b/windows/client-management/mdm/policy-csp-eventlogservice.md @@ -6,7 +6,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower -ms.date: 03/05/2018 +ms.date: 03/12/2018 --- # Policy CSP - EventLogService @@ -290,6 +290,7 @@ Footnote: - 1 - Added in Windows 10, version 1607. - 2 - Added in Windows 10, version 1703. - 3 - Added in Windows 10, version 1709. +- 4 - Added in Windows 10, version 1803. diff --git a/windows/client-management/mdm/policy-csp-experience.md b/windows/client-management/mdm/policy-csp-experience.md index b741cd983e..3f96460055 100644 --- a/windows/client-management/mdm/policy-csp-experience.md +++ b/windows/client-management/mdm/policy-csp-experience.md @@ -6,7 +6,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower -ms.date: 03/05/2018 +ms.date: 03/12/2018 --- # Policy CSP - Experience @@ -1304,6 +1304,7 @@ Footnote: - 1 - Added in Windows 10, version 1607. - 2 - Added in Windows 10, version 1703. - 3 - Added in Windows 10, version 1709. +- 4 - Added in Windows 10, version 1803. diff --git a/windows/client-management/mdm/policy-csp-exploitguard.md b/windows/client-management/mdm/policy-csp-exploitguard.md index ca51c9a7a7..bdf443d549 100644 --- a/windows/client-management/mdm/policy-csp-exploitguard.md +++ b/windows/client-management/mdm/policy-csp-exploitguard.md @@ -6,7 +6,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower -ms.date: 03/05/2018 +ms.date: 03/12/2018 --- # Policy CSP - ExploitGuard @@ -112,6 +112,7 @@ Footnote: - 1 - Added in Windows 10, version 1607. - 2 - Added in Windows 10, version 1703. - 3 - Added in Windows 10, version 1709. +- 4 - Added in Windows 10, version 1803. diff --git a/windows/client-management/mdm/policy-csp-fileexplorer.md b/windows/client-management/mdm/policy-csp-fileexplorer.md index 13c169e91b..9216df0e67 100644 --- a/windows/client-management/mdm/policy-csp-fileexplorer.md +++ b/windows/client-management/mdm/policy-csp-fileexplorer.md @@ -6,7 +6,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower -ms.date: 03/09/2018 +ms.date: 03/12/2018 --- # Policy CSP - FileExplorer @@ -106,6 +106,7 @@ Footnote: - 1 - Added in Windows 10, version 1607. - 2 - Added in Windows 10, version 1703. - 3 - Added in Windows 10, version 1709. +- 4 - Added in Windows 10, version 1803. diff --git a/windows/client-management/mdm/policy-csp-games.md b/windows/client-management/mdm/policy-csp-games.md index 2a651204e1..d14fd92fed 100644 --- a/windows/client-management/mdm/policy-csp-games.md +++ b/windows/client-management/mdm/policy-csp-games.md @@ -6,7 +6,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower -ms.date: 01/30/2018 +ms.date: 03/12/2018 --- # Policy CSP - Games @@ -81,6 +81,7 @@ Footnote: - 1 - Added in Windows 10, version 1607. - 2 - Added in Windows 10, version 1703. - 3 - Added in Windows 10, version 1709. +- 4 - Added in Windows 10, version 1803. diff --git a/windows/client-management/mdm/policy-csp-handwriting.md b/windows/client-management/mdm/policy-csp-handwriting.md index 438387b1b6..bdbcb764ae 100644 --- a/windows/client-management/mdm/policy-csp-handwriting.md +++ b/windows/client-management/mdm/policy-csp-handwriting.md @@ -6,7 +6,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower -ms.date: 03/05/2018 +ms.date: 03/12/2018 --- # Policy CSP - Handwriting @@ -95,6 +95,7 @@ Footnote: - 1 - Added in Windows 10, version 1607. - 2 - Added in Windows 10, version 1703. - 3 - Added in Windows 10, version 1709. +- 4 - Added in Windows 10, version 1803. diff --git a/windows/client-management/mdm/policy-csp-internetexplorer.md b/windows/client-management/mdm/policy-csp-internetexplorer.md index ff5dd18eae..304792e860 100644 --- a/windows/client-management/mdm/policy-csp-internetexplorer.md +++ b/windows/client-management/mdm/policy-csp-internetexplorer.md @@ -6,7 +6,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower -ms.date: 03/09/2018 +ms.date: 03/12/2018 --- # Policy CSP - InternetExplorer @@ -16786,6 +16786,7 @@ Footnote: - 1 - Added in Windows 10, version 1607. - 2 - Added in Windows 10, version 1703. - 3 - Added in Windows 10, version 1709. +- 4 - Added in Windows 10, version 1803. diff --git a/windows/client-management/mdm/policy-csp-kerberos.md b/windows/client-management/mdm/policy-csp-kerberos.md index 6831acebc5..974db5f350 100644 --- a/windows/client-management/mdm/policy-csp-kerberos.md +++ b/windows/client-management/mdm/policy-csp-kerberos.md @@ -6,7 +6,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower -ms.date: 03/05/2018 +ms.date: 03/12/2018 --- # Policy CSP - Kerberos @@ -360,6 +360,7 @@ Footnote: - 1 - Added in Windows 10, version 1607. - 2 - Added in Windows 10, version 1703. - 3 - Added in Windows 10, version 1709. +- 4 - Added in Windows 10, version 1803. diff --git a/windows/client-management/mdm/policy-csp-kioskbrowser.md b/windows/client-management/mdm/policy-csp-kioskbrowser.md index 933c3fa2e8..27f995e4d9 100644 --- a/windows/client-management/mdm/policy-csp-kioskbrowser.md +++ b/windows/client-management/mdm/policy-csp-kioskbrowser.md @@ -6,7 +6,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower -ms.date: 01/30/2018 +ms.date: 03/12/2018 --- # Policy CSP - KioskBrowser @@ -314,6 +314,7 @@ Footnote: - 1 - Added in Windows 10, version 1607. - 2 - Added in Windows 10, version 1703. - 3 - Added in Windows 10, version 1709. +- 4 - Added in Windows 10, version 1803. diff --git a/windows/client-management/mdm/policy-csp-licensing.md b/windows/client-management/mdm/policy-csp-licensing.md index 0e063d9b5f..eae5cdc5d7 100644 --- a/windows/client-management/mdm/policy-csp-licensing.md +++ b/windows/client-management/mdm/policy-csp-licensing.md @@ -6,7 +6,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower -ms.date: 03/05/2018 +ms.date: 03/12/2018 --- # Policy CSP - Licensing @@ -150,6 +150,7 @@ Footnote: - 1 - Added in Windows 10, version 1607. - 2 - Added in Windows 10, version 1703. - 3 - Added in Windows 10, version 1709. +- 4 - Added in Windows 10, version 1803. diff --git a/windows/client-management/mdm/policy-csp-localpoliciessecurityoptions.md b/windows/client-management/mdm/policy-csp-localpoliciessecurityoptions.md index 1ffde8a086..27c960d639 100644 --- a/windows/client-management/mdm/policy-csp-localpoliciessecurityoptions.md +++ b/windows/client-management/mdm/policy-csp-localpoliciessecurityoptions.md @@ -6,7 +6,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower -ms.date: 03/05/2018 +ms.date: 03/12/2018 --- # Policy CSP - LocalPoliciesSecurityOptions @@ -3529,6 +3529,7 @@ Footnote: - 1 - Added in Windows 10, version 1607. - 2 - Added in Windows 10, version 1703. - 3 - Added in Windows 10, version 1709. +- 4 - Added in Windows 10, version 1803. diff --git a/windows/client-management/mdm/policy-csp-location.md b/windows/client-management/mdm/policy-csp-location.md index 18e7a7fd97..8117114323 100644 --- a/windows/client-management/mdm/policy-csp-location.md +++ b/windows/client-management/mdm/policy-csp-location.md @@ -6,7 +6,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower -ms.date: 03/05/2018 +ms.date: 03/12/2018 --- # Policy CSP - Location @@ -99,6 +99,7 @@ Footnote: - 1 - Added in Windows 10, version 1607. - 2 - Added in Windows 10, version 1703. - 3 - Added in Windows 10, version 1709. +- 4 - Added in Windows 10, version 1803. diff --git a/windows/client-management/mdm/policy-csp-lockdown.md b/windows/client-management/mdm/policy-csp-lockdown.md index be9c02f1d7..228d2f75ec 100644 --- a/windows/client-management/mdm/policy-csp-lockdown.md +++ b/windows/client-management/mdm/policy-csp-lockdown.md @@ -6,7 +6,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower -ms.date: 03/05/2018 +ms.date: 03/12/2018 --- # Policy CSP - LockDown @@ -91,6 +91,7 @@ Footnote: - 1 - Added in Windows 10, version 1607. - 2 - Added in Windows 10, version 1703. - 3 - Added in Windows 10, version 1709. +- 4 - Added in Windows 10, version 1803. diff --git a/windows/client-management/mdm/policy-csp-maps.md b/windows/client-management/mdm/policy-csp-maps.md index d60af40683..8b44913146 100644 --- a/windows/client-management/mdm/policy-csp-maps.md +++ b/windows/client-management/mdm/policy-csp-maps.md @@ -6,7 +6,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower -ms.date: 03/05/2018 +ms.date: 03/12/2018 --- # Policy CSP - Maps @@ -148,6 +148,7 @@ Footnote: - 1 - Added in Windows 10, version 1607. - 2 - Added in Windows 10, version 1703. - 3 - Added in Windows 10, version 1709. +- 4 - Added in Windows 10, version 1803. diff --git a/windows/client-management/mdm/policy-csp-messaging.md b/windows/client-management/mdm/policy-csp-messaging.md index 2ad6d83fe0..f1862d266d 100644 --- a/windows/client-management/mdm/policy-csp-messaging.md +++ b/windows/client-management/mdm/policy-csp-messaging.md @@ -6,7 +6,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower -ms.date: 03/05/2018 +ms.date: 03/12/2018 --- # Policy CSP - Messaging @@ -201,6 +201,7 @@ Footnote: - 1 - Added in Windows 10, version 1607. - 2 - Added in Windows 10, version 1703. - 3 - Added in Windows 10, version 1709. +- 4 - Added in Windows 10, version 1803. diff --git a/windows/client-management/mdm/policy-csp-mssecurityguide.md b/windows/client-management/mdm/policy-csp-mssecurityguide.md index 8dc3535360..8759b6d49a 100644 --- a/windows/client-management/mdm/policy-csp-mssecurityguide.md +++ b/windows/client-management/mdm/policy-csp-mssecurityguide.md @@ -6,7 +6,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower -ms.date: 03/09/2018 +ms.date: 03/12/2018 --- # Policy CSP - MSSecurityGuide @@ -240,6 +240,7 @@ Footnote: - 1 - Added in Windows 10, version 1607. - 2 - Added in Windows 10, version 1703. - 3 - Added in Windows 10, version 1709. +- 4 - Added in Windows 10, version 1803. diff --git a/windows/client-management/mdm/policy-csp-msslegacy.md b/windows/client-management/mdm/policy-csp-msslegacy.md index 68078ca276..54107559ca 100644 --- a/windows/client-management/mdm/policy-csp-msslegacy.md +++ b/windows/client-management/mdm/policy-csp-msslegacy.md @@ -6,7 +6,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower -ms.date: 03/09/2018 +ms.date: 03/12/2018 --- # Policy CSP - MSSLegacy @@ -170,6 +170,7 @@ Footnote: - 1 - Added in Windows 10, version 1607. - 2 - Added in Windows 10, version 1703. - 3 - Added in Windows 10, version 1709. +- 4 - Added in Windows 10, version 1803. diff --git a/windows/client-management/mdm/policy-csp-networkisolation.md b/windows/client-management/mdm/policy-csp-networkisolation.md index 70db29303b..d5d98f64b1 100644 --- a/windows/client-management/mdm/policy-csp-networkisolation.md +++ b/windows/client-management/mdm/policy-csp-networkisolation.md @@ -6,7 +6,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower -ms.date: 03/05/2018 +ms.date: 03/12/2018 --- # Policy CSP - NetworkIsolation @@ -480,6 +480,7 @@ Footnote: - 1 - Added in Windows 10, version 1607. - 2 - Added in Windows 10, version 1703. - 3 - Added in Windows 10, version 1709. +- 4 - Added in Windows 10, version 1803. diff --git a/windows/client-management/mdm/policy-csp-notifications.md b/windows/client-management/mdm/policy-csp-notifications.md index b4363ef967..8dddbe0d18 100644 --- a/windows/client-management/mdm/policy-csp-notifications.md +++ b/windows/client-management/mdm/policy-csp-notifications.md @@ -6,7 +6,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower -ms.date: 03/05/2018 +ms.date: 03/12/2018 --- # Policy CSP - Notifications @@ -93,6 +93,7 @@ Footnote: - 1 - Added in Windows 10, version 1607. - 2 - Added in Windows 10, version 1703. - 3 - Added in Windows 10, version 1709. +- 4 - Added in Windows 10, version 1803. diff --git a/windows/client-management/mdm/policy-csp-power.md b/windows/client-management/mdm/policy-csp-power.md index 89d381dddf..5bee576aca 100644 --- a/windows/client-management/mdm/policy-csp-power.md +++ b/windows/client-management/mdm/policy-csp-power.md @@ -6,7 +6,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower -ms.date: 03/09/2018 +ms.date: 03/12/2018 --- # Policy CSP - Power @@ -667,6 +667,7 @@ Footnote: - 1 - Added in Windows 10, version 1607. - 2 - Added in Windows 10, version 1703. - 3 - Added in Windows 10, version 1709. +- 4 - Added in Windows 10, version 1803. diff --git a/windows/client-management/mdm/policy-csp-printers.md b/windows/client-management/mdm/policy-csp-printers.md index fd0939f604..be94af174b 100644 --- a/windows/client-management/mdm/policy-csp-printers.md +++ b/windows/client-management/mdm/policy-csp-printers.md @@ -6,7 +6,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower -ms.date: 03/05/2018 +ms.date: 03/12/2018 --- # Policy CSP - Printers @@ -251,6 +251,7 @@ Footnote: - 1 - Added in Windows 10, version 1607. - 2 - Added in Windows 10, version 1703. - 3 - Added in Windows 10, version 1709. +- 4 - Added in Windows 10, version 1803. diff --git a/windows/client-management/mdm/policy-csp-privacy.md b/windows/client-management/mdm/policy-csp-privacy.md index 3595219241..c084709cd0 100644 --- a/windows/client-management/mdm/policy-csp-privacy.md +++ b/windows/client-management/mdm/policy-csp-privacy.md @@ -6,7 +6,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower -ms.date: 03/05/2018 +ms.date: 03/12/2018 --- # Policy CSP - Privacy @@ -4485,6 +4485,7 @@ Footnote: - 1 - Added in Windows 10, version 1607. - 2 - Added in Windows 10, version 1703. - 3 - Added in Windows 10, version 1709. +- 4 - Added in Windows 10, version 1803. diff --git a/windows/client-management/mdm/policy-csp-remoteassistance.md b/windows/client-management/mdm/policy-csp-remoteassistance.md index a26dd4c251..01e2f7e4b7 100644 --- a/windows/client-management/mdm/policy-csp-remoteassistance.md +++ b/windows/client-management/mdm/policy-csp-remoteassistance.md @@ -6,7 +6,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower -ms.date: 03/05/2018 +ms.date: 03/12/2018 --- # Policy CSP - RemoteAssistance @@ -339,6 +339,7 @@ Footnote: - 1 - Added in Windows 10, version 1607. - 2 - Added in Windows 10, version 1703. - 3 - Added in Windows 10, version 1709. +- 4 - Added in Windows 10, version 1803. diff --git a/windows/client-management/mdm/policy-csp-remotedesktopservices.md b/windows/client-management/mdm/policy-csp-remotedesktopservices.md index 3af7f7ca34..0e4be98697 100644 --- a/windows/client-management/mdm/policy-csp-remotedesktopservices.md +++ b/windows/client-management/mdm/policy-csp-remotedesktopservices.md @@ -6,7 +6,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower -ms.date: 03/05/2018 +ms.date: 03/12/2018 --- # Policy CSP - RemoteDesktopServices @@ -450,6 +450,7 @@ Footnote: - 1 - Added in Windows 10, version 1607. - 2 - Added in Windows 10, version 1703. - 3 - Added in Windows 10, version 1709. +- 4 - Added in Windows 10, version 1803. diff --git a/windows/client-management/mdm/policy-csp-remotemanagement.md b/windows/client-management/mdm/policy-csp-remotemanagement.md index 67d82bb4f9..96324dc5cc 100644 --- a/windows/client-management/mdm/policy-csp-remotemanagement.md +++ b/windows/client-management/mdm/policy-csp-remotemanagement.md @@ -6,7 +6,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower -ms.date: 03/05/2018 +ms.date: 03/12/2018 --- # Policy CSP - RemoteManagement @@ -1032,6 +1032,7 @@ Footnote: - 1 - Added in Windows 10, version 1607. - 2 - Added in Windows 10, version 1703. - 3 - Added in Windows 10, version 1709. +- 4 - Added in Windows 10, version 1803. diff --git a/windows/client-management/mdm/policy-csp-remoteprocedurecall.md b/windows/client-management/mdm/policy-csp-remoteprocedurecall.md index 41fb1d8539..295bf5c56e 100644 --- a/windows/client-management/mdm/policy-csp-remoteprocedurecall.md +++ b/windows/client-management/mdm/policy-csp-remoteprocedurecall.md @@ -6,7 +6,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower -ms.date: 03/05/2018 +ms.date: 03/12/2018 --- # Policy CSP - RemoteProcedureCall @@ -174,6 +174,7 @@ Footnote: - 1 - Added in Windows 10, version 1607. - 2 - Added in Windows 10, version 1703. - 3 - Added in Windows 10, version 1709. +- 4 - Added in Windows 10, version 1803. diff --git a/windows/client-management/mdm/policy-csp-remoteshell.md b/windows/client-management/mdm/policy-csp-remoteshell.md index 20a0ac4151..cbb9717f73 100644 --- a/windows/client-management/mdm/policy-csp-remoteshell.md +++ b/windows/client-management/mdm/policy-csp-remoteshell.md @@ -6,7 +6,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower -ms.date: 03/05/2018 +ms.date: 03/12/2018 --- # Policy CSP - RemoteShell @@ -487,6 +487,7 @@ Footnote: - 1 - Added in Windows 10, version 1607. - 2 - Added in Windows 10, version 1703. - 3 - Added in Windows 10, version 1709. +- 4 - Added in Windows 10, version 1803. diff --git a/windows/client-management/mdm/policy-csp-search.md b/windows/client-management/mdm/policy-csp-search.md index 85b59673d8..dfdf82afa1 100644 --- a/windows/client-management/mdm/policy-csp-search.md +++ b/windows/client-management/mdm/policy-csp-search.md @@ -6,7 +6,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower -ms.date: 03/05/2018 +ms.date: 03/12/2018 --- # Policy CSP - Search @@ -858,6 +858,7 @@ Footnote: - 1 - Added in Windows 10, version 1607. - 2 - Added in Windows 10, version 1703. - 3 - Added in Windows 10, version 1709. +- 4 - Added in Windows 10, version 1803. diff --git a/windows/client-management/mdm/policy-csp-security.md b/windows/client-management/mdm/policy-csp-security.md index 9d95aab726..b03abc2582 100644 --- a/windows/client-management/mdm/policy-csp-security.md +++ b/windows/client-management/mdm/policy-csp-security.md @@ -6,7 +6,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower -ms.date: 03/05/2018 +ms.date: 03/12/2018 --- # Policy CSP - Security @@ -662,6 +662,7 @@ Footnote: - 1 - Added in Windows 10, version 1607. - 2 - Added in Windows 10, version 1703. - 3 - Added in Windows 10, version 1709. +- 4 - Added in Windows 10, version 1803. diff --git a/windows/client-management/mdm/policy-csp-settings.md b/windows/client-management/mdm/policy-csp-settings.md index 5031440194..5773e32200 100644 --- a/windows/client-management/mdm/policy-csp-settings.md +++ b/windows/client-management/mdm/policy-csp-settings.md @@ -6,7 +6,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower -ms.date: 03/05/2018 +ms.date: 03/12/2018 --- # Policy CSP - Settings @@ -847,6 +847,7 @@ Footnote: - 1 - Added in Windows 10, version 1607. - 2 - Added in Windows 10, version 1703. - 3 - Added in Windows 10, version 1709. +- 4 - Added in Windows 10, version 1803. diff --git a/windows/client-management/mdm/policy-csp-smartscreen.md b/windows/client-management/mdm/policy-csp-smartscreen.md index be4301165b..3eea69f19b 100644 --- a/windows/client-management/mdm/policy-csp-smartscreen.md +++ b/windows/client-management/mdm/policy-csp-smartscreen.md @@ -6,7 +6,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower -ms.date: 03/05/2018 +ms.date: 03/12/2018 --- # Policy CSP - SmartScreen @@ -212,6 +212,7 @@ Footnote: - 1 - Added in Windows 10, version 1607. - 2 - Added in Windows 10, version 1703. - 3 - Added in Windows 10, version 1709. +- 4 - Added in Windows 10, version 1803. diff --git a/windows/client-management/mdm/policy-csp-speech.md b/windows/client-management/mdm/policy-csp-speech.md index 9a691d7670..33cdd64750 100644 --- a/windows/client-management/mdm/policy-csp-speech.md +++ b/windows/client-management/mdm/policy-csp-speech.md @@ -6,7 +6,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower -ms.date: 03/05/2018 +ms.date: 03/12/2018 --- # Policy CSP - Speech @@ -89,6 +89,7 @@ Footnote: - 1 - Added in Windows 10, version 1607. - 2 - Added in Windows 10, version 1703. - 3 - Added in Windows 10, version 1709. +- 4 - Added in Windows 10, version 1803. diff --git a/windows/client-management/mdm/policy-csp-start.md b/windows/client-management/mdm/policy-csp-start.md index 50809d5486..d9d149dd3a 100644 --- a/windows/client-management/mdm/policy-csp-start.md +++ b/windows/client-management/mdm/policy-csp-start.md @@ -6,7 +6,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower -ms.date: 03/05/2018 +ms.date: 03/12/2018 --- # Policy CSP - Start @@ -1763,6 +1763,7 @@ Footnote: - 1 - Added in Windows 10, version 1607. - 2 - Added in Windows 10, version 1703. - 3 - Added in Windows 10, version 1709. +- 4 - Added in Windows 10, version 1803. diff --git a/windows/client-management/mdm/policy-csp-storage.md b/windows/client-management/mdm/policy-csp-storage.md index 536aac2ce2..b27f3af35b 100644 --- a/windows/client-management/mdm/policy-csp-storage.md +++ b/windows/client-management/mdm/policy-csp-storage.md @@ -6,7 +6,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower -ms.date: 03/05/2018 +ms.date: 03/12/2018 --- # Policy CSP - Storage @@ -158,6 +158,7 @@ Footnote: - 1 - Added in Windows 10, version 1607. - 2 - Added in Windows 10, version 1703. - 3 - Added in Windows 10, version 1709. +- 4 - Added in Windows 10, version 1803. diff --git a/windows/client-management/mdm/policy-csp-system.md b/windows/client-management/mdm/policy-csp-system.md index d943b9d855..6c6ed3c4c9 100644 --- a/windows/client-management/mdm/policy-csp-system.md +++ b/windows/client-management/mdm/policy-csp-system.md @@ -6,7 +6,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower -ms.date: 03/05/2018 +ms.date: 03/12/2018 --- # Policy CSP - System @@ -1052,6 +1052,7 @@ Footnote: - 1 - Added in Windows 10, version 1607. - 2 - Added in Windows 10, version 1703. - 3 - Added in Windows 10, version 1709. +- 4 - Added in Windows 10, version 1803. diff --git a/windows/client-management/mdm/policy-csp-systemservices.md b/windows/client-management/mdm/policy-csp-systemservices.md index ffdb12f42a..9dd4ebd067 100644 --- a/windows/client-management/mdm/policy-csp-systemservices.md +++ b/windows/client-management/mdm/policy-csp-systemservices.md @@ -6,7 +6,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower -ms.date: 03/05/2018 +ms.date: 03/12/2018 --- # Policy CSP - SystemServices @@ -342,6 +342,7 @@ Footnote: - 1 - Added in Windows 10, version 1607. - 2 - Added in Windows 10, version 1703. - 3 - Added in Windows 10, version 1709. +- 4 - Added in Windows 10, version 1803. diff --git a/windows/client-management/mdm/policy-csp-taskscheduler.md b/windows/client-management/mdm/policy-csp-taskscheduler.md index 88a19a26c4..7fee0be3b0 100644 --- a/windows/client-management/mdm/policy-csp-taskscheduler.md +++ b/windows/client-management/mdm/policy-csp-taskscheduler.md @@ -6,7 +6,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower -ms.date: 01/30/2018 +ms.date: 03/12/2018 --- # Policy CSP - TaskScheduler @@ -76,6 +76,7 @@ Footnote: - 1 - Added in Windows 10, version 1607. - 2 - Added in Windows 10, version 1703. - 3 - Added in Windows 10, version 1709. +- 4 - Added in Windows 10, version 1803. diff --git a/windows/client-management/mdm/policy-csp-textinput.md b/windows/client-management/mdm/policy-csp-textinput.md index b5cb108686..6b2f4389e8 100644 --- a/windows/client-management/mdm/policy-csp-textinput.md +++ b/windows/client-management/mdm/policy-csp-textinput.md @@ -6,7 +6,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower -ms.date: 03/05/2018 +ms.date: 03/12/2018 --- # Policy CSP - TextInput @@ -1306,6 +1306,7 @@ Footnote: - 1 - Added in Windows 10, version 1607. - 2 - Added in Windows 10, version 1703. - 3 - Added in Windows 10, version 1709. +- 4 - Added in Windows 10, version 1803. diff --git a/windows/client-management/mdm/policy-csp-timelanguagesettings.md b/windows/client-management/mdm/policy-csp-timelanguagesettings.md index c926c03e45..731fc2ae63 100644 --- a/windows/client-management/mdm/policy-csp-timelanguagesettings.md +++ b/windows/client-management/mdm/policy-csp-timelanguagesettings.md @@ -6,7 +6,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower -ms.date: 01/30/2018 +ms.date: 03/12/2018 --- # Policy CSP - TimeLanguageSettings @@ -63,14 +63,14 @@ ms.date: 01/30/2018 -Allows for the configuration of the default clock setting to be the 24 hour format. Selecting 'Set 24 hour Clock' enables this setting. Selecting 'Locale default setting' uses the default clock as prescribed by the current locale setting. +Allows for the configuration of the default clock setting to be the 24 hour format. If set to 0 (zero), the device uses the default clock as prescribed by the current locale setting. The following list shows the supported values: -- 0 – Locale default setting. -- 1 (default) – Set 24 hour clock. +- 0 (default) – Current locale setting. +- 1 – Set 24 hour clock. @@ -81,6 +81,7 @@ Footnote: - 1 - Added in Windows 10, version 1607. - 2 - Added in Windows 10, version 1703. - 3 - Added in Windows 10, version 1709. +- 4 - Added in Windows 10, version 1803. diff --git a/windows/client-management/mdm/policy-csp-update.md b/windows/client-management/mdm/policy-csp-update.md index 7a92fffc6a..70198e988d 100644 --- a/windows/client-management/mdm/policy-csp-update.md +++ b/windows/client-management/mdm/policy-csp-update.md @@ -6,7 +6,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower -ms.date: 03/05/2018 +ms.date: 03/12/2018 --- # Policy CSP - Update @@ -3064,6 +3064,7 @@ Footnote: - 1 - Added in Windows 10, version 1607. - 2 - Added in Windows 10, version 1703. - 3 - Added in Windows 10, version 1709. +- 4 - Added in Windows 10, version 1803. diff --git a/windows/client-management/mdm/policy-csp-userrights.md b/windows/client-management/mdm/policy-csp-userrights.md index 6e52bc893b..3584468818 100644 --- a/windows/client-management/mdm/policy-csp-userrights.md +++ b/windows/client-management/mdm/policy-csp-userrights.md @@ -6,7 +6,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower -ms.date: 03/05/2018 +ms.date: 03/12/2018 --- # Policy CSP - UserRights @@ -1542,6 +1542,7 @@ Footnote: - 1 - Added in Windows 10, version 1607. - 2 - Added in Windows 10, version 1703. - 3 - Added in Windows 10, version 1709. +- 4 - Added in Windows 10, version 1803. diff --git a/windows/client-management/mdm/policy-csp-wifi.md b/windows/client-management/mdm/policy-csp-wifi.md index f4e3dbae88..358dc3fc01 100644 --- a/windows/client-management/mdm/policy-csp-wifi.md +++ b/windows/client-management/mdm/policy-csp-wifi.md @@ -6,7 +6,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower -ms.date: 03/05/2018 +ms.date: 03/12/2018 --- # Policy CSP - Wifi @@ -386,6 +386,7 @@ Footnote: - 1 - Added in Windows 10, version 1607. - 2 - Added in Windows 10, version 1703. - 3 - Added in Windows 10, version 1709. +- 4 - Added in Windows 10, version 1803. diff --git a/windows/client-management/mdm/policy-csp-windowsconnectionmanager.md b/windows/client-management/mdm/policy-csp-windowsconnectionmanager.md index 87aa32bfbb..c5ac238f1d 100644 --- a/windows/client-management/mdm/policy-csp-windowsconnectionmanager.md +++ b/windows/client-management/mdm/policy-csp-windowsconnectionmanager.md @@ -6,7 +6,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower -ms.date: 03/09/2018 +ms.date: 03/12/2018 --- # Policy CSP - WindowsConnectionManager @@ -80,6 +80,7 @@ Footnote: - 1 - Added in Windows 10, version 1607. - 2 - Added in Windows 10, version 1703. - 3 - Added in Windows 10, version 1709. +- 4 - Added in Windows 10, version 1803. diff --git a/windows/client-management/mdm/policy-csp-windowsdefendersecuritycenter.md b/windows/client-management/mdm/policy-csp-windowsdefendersecuritycenter.md index 8329d11f77..c94d1e9dd5 100644 --- a/windows/client-management/mdm/policy-csp-windowsdefendersecuritycenter.md +++ b/windows/client-management/mdm/policy-csp-windowsdefendersecuritycenter.md @@ -6,7 +6,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower -ms.date: 03/05/2018 +ms.date: 03/12/2018 --- # Policy CSP - WindowsDefenderSecurityCenter @@ -1196,6 +1196,7 @@ Footnote: - 1 - Added in Windows 10, version 1607. - 2 - Added in Windows 10, version 1703. - 3 - Added in Windows 10, version 1709. +- 4 - Added in Windows 10, version 1803. diff --git a/windows/client-management/mdm/policy-csp-windowsinkworkspace.md b/windows/client-management/mdm/policy-csp-windowsinkworkspace.md index 3549c95e06..27f04f2813 100644 --- a/windows/client-management/mdm/policy-csp-windowsinkworkspace.md +++ b/windows/client-management/mdm/policy-csp-windowsinkworkspace.md @@ -6,7 +6,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower -ms.date: 03/05/2018 +ms.date: 03/12/2018 --- # Policy CSP - WindowsInkWorkspace @@ -152,6 +152,7 @@ Footnote: - 1 - Added in Windows 10, version 1607. - 2 - Added in Windows 10, version 1703. - 3 - Added in Windows 10, version 1709. +- 4 - Added in Windows 10, version 1803. diff --git a/windows/client-management/mdm/policy-csp-windowslogon.md b/windows/client-management/mdm/policy-csp-windowslogon.md index 3847749f8f..16e39d3e9c 100644 --- a/windows/client-management/mdm/policy-csp-windowslogon.md +++ b/windows/client-management/mdm/policy-csp-windowslogon.md @@ -6,7 +6,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower -ms.date: 03/09/2018 +ms.date: 03/12/2018 --- # Policy CSP - WindowsLogon @@ -310,6 +310,7 @@ Footnote: - 1 - Added in Windows 10, version 1607. - 2 - Added in Windows 10, version 1703. - 3 - Added in Windows 10, version 1709. +- 4 - Added in Windows 10, version 1803. diff --git a/windows/client-management/mdm/policy-csp-windowspowershell.md b/windows/client-management/mdm/policy-csp-windowspowershell.md index 4ed6d00d53..ee96a4746f 100644 --- a/windows/client-management/mdm/policy-csp-windowspowershell.md +++ b/windows/client-management/mdm/policy-csp-windowspowershell.md @@ -6,7 +6,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower -ms.date: 03/09/2018 +ms.date: 03/12/2018 --- # Policy CSP - WindowsPowerShell @@ -77,6 +77,7 @@ Footnote: - 1 - Added in Windows 10, version 1607. - 2 - Added in Windows 10, version 1703. - 3 - Added in Windows 10, version 1709. +- 4 - Added in Windows 10, version 1803. diff --git a/windows/client-management/mdm/policy-csp-wirelessdisplay.md b/windows/client-management/mdm/policy-csp-wirelessdisplay.md index 9e122a3f3f..cafb7be12e 100644 --- a/windows/client-management/mdm/policy-csp-wirelessdisplay.md +++ b/windows/client-management/mdm/policy-csp-wirelessdisplay.md @@ -6,7 +6,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower -ms.date: 03/05/2018 +ms.date: 03/12/2018 --- # Policy CSP - WirelessDisplay @@ -453,6 +453,7 @@ Footnote: - 1 - Added in Windows 10, version 1607. - 2 - Added in Windows 10, version 1703. - 3 - Added in Windows 10, version 1709. +- 4 - Added in Windows 10, version 1803. diff --git a/windows/client-management/mdm/policy-ddf-file.md b/windows/client-management/mdm/policy-ddf-file.md index 406db3df06..0b6035ae0a 100644 --- a/windows/client-management/mdm/policy-ddf-file.md +++ b/windows/client-management/mdm/policy-ddf-file.md @@ -7,7 +7,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower -ms.date: 02/26/2018 +ms.date: 03/12/2018 --- # Policy DDF file @@ -95,6 +95,30 @@ The XML below is the DDF for Windows 10, version 1803. + + MSIAlwaysInstallWithElevatedPrivileges + + + + + + + + + + + + + + + + + + + text/plain + + + RequirePrivateStoreOnly @@ -7848,6 +7872,30 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on + + EnableEndSessionButton + + + + + + + + Enable/disable kiosk browser's end session button. + + + + + + + + + + + text/plain + + + EnableHomeButton @@ -7966,6 +8014,30 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on + + DisallowTileNotification + + + + + + + + + + + + + + + + + + + text/plain + + + Printers @@ -8284,6 +8356,34 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on + + MSIAlwaysInstallWithElevatedPrivileges + + + + + 0 + + + + + + + + + + + + text/plain + + + phone + MSI.admx + MSI~AT~WindowsComponents~MSI + AlwaysInstallElevated + HighestValueMostSecure + + RequirePrivateStoreOnly @@ -8307,7 +8407,7 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on WindowsStore.admx WindowsStore~AT~WindowsComponents~WindowsStore - RequirePrivateStoreOnly_1 + RequirePrivateStoreOnly HighestValueMostSecure @@ -15167,7 +15267,7 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on phone inetres.admx inetres~AT~WindowsComponents~InternetExplorer~SecurityFeatures~IESF_CategoryProtectionFromZoneElevation - IESF_PolicyAllProcesses_9 + IESF_PolicyExplorerProcesses_9 LastWrite @@ -15221,7 +15321,7 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on phone inetres.admx inetres~AT~WindowsComponents~InternetExplorer~SecurityFeatures~IESF_CategoryRestrictActiveXInstall - IESF_PolicyAllProcesses_11 + IESF_PolicyExplorerProcesses_11 LastWrite @@ -16382,7 +16482,7 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on phone inetres.admx inetres~AT~WindowsComponents~InternetExplorer~SecurityFeatures~IESF_CategoryRestrictFileDownload - IESF_PolicyAllProcesses_12 + IESF_PolicyExplorerProcesses_12 LastWrite @@ -16409,7 +16509,7 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on phone inetres.admx inetres~AT~WindowsComponents~InternetExplorer~SecurityFeatures~IESF_CategoryScriptedWindowSecurityRestrictions - IESF_PolicyAllProcesses_8 + IESF_PolicyExplorerProcesses_8 LastWrite @@ -16910,6 +17010,31 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on LastWrite + + EnableEndSessionButton + + + + + 0 + Enable/disable kiosk browser's end session button. + + + + + + + + + + + text/plain + + + phone + LastWrite + + EnableHomeButton @@ -17032,6 +17157,33 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on LowestValueMostSecure + + DisallowTileNotification + + + + + 0 + + + + + + + + + + + + text/plain + + + WPN.admx + WPN~AT~StartMenu~NotificationsCategory + NoTileNotification + LowestValueMostSecure + + Printers @@ -18024,6 +18176,78 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on + + MSIAllowUserControlOverInstall + + + + + + + + + + + + + + + + + + + text/plain + + + + + MSIAlwaysInstallWithElevatedPrivileges + + + + + + + + + + + + + + + + + + + text/plain + + + + + RequirePrivateStoreOnly + + + + + + + + + + + + + + + + + + + text/plain + + + RestrictAppDataToSystemVolume @@ -30441,6 +30665,30 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor + + EnableEndSessionButton + + + + + + + + Enable/disable kiosk browser's end session button. + + + + + + + + + + + text/plain + + + EnableHomeButton @@ -30514,6 +30762,52 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor + + LanmanWorkstation + + + + + + + + + + + + + + + + + + + + + EnableInsecureGuestLogons + + + + + + + + + + + + + + + + + + + text/plain + + + + Licensing @@ -30994,38 +31288,6 @@ Note: Domain controllers are also domain members and establish secure channels w - - DomainMember_DigitallySignSecureChannelDataWhenPossible - - - - - - - - Domain member: Digitally sign secure channel data (when possible) - -This security setting determines whether a domain member attempts to negotiate signing for all secure channel traffic that it initiates. - -When a computer joins a domain, a computer account is created. After that, when the system starts, it uses the computer account password to create a secure channel with a domain controller for its domain. This secure channel is used to perform operations such as NTLM pass through authentication, LSA SID/name Lookup etc. - -This setting determines whether or not the domain member attempts to negotiate signing for all secure channel traffic that it initiates. If enabled, the domain member will request signing of all secure channel traffic. If the Domain Controller supports signing of all secure channel traffic, then all secure channel traffic will be signed which ensures that it cannot be tampered with in transit. - -Default: Enabled. - - - - - - - - - - - text/plain - - - DomainMember_DisableMachineAccountPasswordChanges @@ -31059,81 +31321,6 @@ This setting should not be used in an attempt to support dual-boot scenarios tha - - DomainMember_MaximumMachineAccountPasswordAge - - - - - - - - Domain member: Maximum machine account password age - -This security setting determines how often a domain member will attempt to change its computer account password. - -Default: 30 days. - -Important - -This setting applies to Windows 2000 computers, but it is not available through the Security Configuration Manager tools on these computers. - - - - - - - - - - - text/plain - - - - - DomainMember_RequireStrongSessionKey - - - - - - - - Domain member: Require strong (Windows 2000 or later) session key - -This security setting determines whether 128-bit key strength is required for encrypted secure channel data. - -When a computer joins a domain, a computer account is created. After that, when the system starts, it uses the computer account password to create a secure channel with a domain controller within the domain. This secure channel is used to perform operations such as NTLM pass-through authentication, LSA SID/name Lookup, and so on. - -Depending on what version of Windows is running on the domain controller that the domain member is communicating with and the settings of the parameters: - -Domain member: Digitally encrypt or sign secure channel data (always) -Domain member: Digitally encrypt secure channel data (when possible) -Some or all of the information that is transmitted over the secure channel will be encrypted. This policy setting determines whether or not 128-bit key strength is required for the secure channel information that is encrypted. - -If this setting is enabled, then the secure channel will not be established unless 128-bit encryption can be performed. If this setting is disabled, then the key strength is negotiated with the domain controller. - -Default: Enabled. - -Important - -In order to take advantage of this policy on member workstations and servers, all domain controllers that constitute the member's domain must be running Windows 2000 or later. -In order to take advantage of this policy on domain controllers, all domain controllers in the same domain as well as all trusted domains must run Windows 2000 or later. - - - - - - - - - - - text/plain - - - InteractiveLogon_DisplayUserInformationWhenTheSessionIsLocked @@ -31385,52 +31572,6 @@ On Windows Vista and above: For this setting to work, the Smart Card Removal Pol - - MicrosoftNetworkClient_DigitallySignCommunicationsAlways - - - - - - - - Microsoft network client: Digitally sign communications (always) - -This security setting determines whether packet signing is required by the SMB client component. - -The server message block (SMB) protocol provides the basis for Microsoft file and print sharing and many other networking operations, such as remote Windows administration. To prevent man-in-the-middle attacks that modify SMB packets in transit, the SMB protocol supports the digital signing of SMB packets. This policy setting determines whether SMB packet signing must be negotiated before further communication with an SMB server is permitted. - -If this setting is enabled, the Microsoft network client will not communicate with a Microsoft network server unless that server agrees to perform SMB packet signing. If this policy is disabled, SMB packet signing is negotiated between the client and server. - -Default: Disabled. - -Important - -For this policy to take effect on computers running Windows 2000, client-side packet signing must also be enabled. To enable client-side SMB packet signing, set Microsoft network client: Digitally sign communications (if server agrees). - -Notes - -All Windows operating systems support both a client-side SMB component and a server-side SMB component. On Windows 2000 and later operating systems, enabling or requiring packet signing for client and server-side SMB components is controlled by the following four policy settings: -Microsoft network client: Digitally sign communications (always) - Controls whether or not the client-side SMB component requires packet signing. -Microsoft network client: Digitally sign communications (if server agrees) - Controls whether or not the client-side SMB component has packet signing enabled. -Microsoft network server: Digitally sign communications (always) - Controls whether or not the server-side SMB component requires packet signing. -Microsoft network server: Digitally sign communications (if client agrees) - Controls whether or not the server-side SMB component has packet signing enabled. -SMB packet signing can significantly degrade SMB performance, depending on dialect version, OS version, file sizes, processor offloading capabilities, and application IO behaviors. -For more information, reference: https://go.microsoft.com/fwlink/?LinkID=787136. - - - - - - - - - - - text/plain - - - MicrosoftNetworkClient_DigitallySignCommunicationsIfServerAgrees @@ -31880,7 +32021,7 @@ Windows Vista, Windows Server 2008, Windows 7, and Windows Server 2008 R2: Send - NetworkSecurity_MinimumSessionSecurityForNTLMSSPBasedClients + NetworkSecurity_MinimumSessionSecurityForNTLMSSPBasedServers @@ -31888,12 +32029,12 @@ Windows Vista, Windows Server 2008, Windows 7, and Windows Server 2008 R2: Send - Network security: Minimum session security for NTLM SSP based (including secure RPC) clients + Network security: Minimum session security for NTLM SSP based (including secure RPC) servers -This security setting allows a client to require the negotiation of 128-bit encryption and/or NTLMv2 session security. These values are dependent on the LAN Manager Authentication Level security setting value. The options are: +This security setting allows a server to require the negotiation of 128-bit encryption and/or NTLMv2 session security. These values are dependent on the LAN Manager Authentication Level security setting value. The options are: -Require NTLMv2 session security: The connection will fail if NTLMv2 protocol is not negotiated. -Require 128-bit encryption: The connection will fail if strong encryption (128-bit) is not negotiated. +Require NTLMv2 session security: The connection will fail if message integrity is not negotiated. +Require 128-bit encryption. The connection will fail if strong encryption (128-bit) is not negotiated. Default: @@ -31915,7 +32056,7 @@ Windows 7 and Windows Server 2008 R2: Require 128-bit encryption - NetworkSecurity_MinimumSessionSecurityForNTLMSSPBasedServers + NetworkSecurity_RestrictNTLM_AddRemoteServerExceptionsForNTLMAuthentication @@ -31923,18 +32064,123 @@ Windows 7 and Windows Server 2008 R2: Require 128-bit encryption - Network security: Minimum session security for NTLM SSP based (including secure RPC) servers + Network security: Restrict NTLM: Add remote server exceptions for NTLM authentication -This security setting allows a server to require the negotiation of 128-bit encryption and/or NTLMv2 session security. These values are dependent on the LAN Manager Authentication Level security setting value. The options are: +This policy setting allows you to create an exception list of remote servers to which clients are allowed to use NTLM authentication if the "Network Security: Restrict NTLM: Outgoing NTLM traffic to remote servers" policy setting is configured. -Require NTLMv2 session security: The connection will fail if message integrity is not negotiated. -Require 128-bit encryption. The connection will fail if strong encryption (128-bit) is not negotiated. +If you configure this policy setting, you can define a list of remote servers to which clients are allowed to use NTLM authentication. -Default: +If you do not configure this policy setting, no exceptions will be applied. -Windows XP, Windows Vista, Windows 2000 Server, Windows Server 2003, and Windows Server 2008: No requirements. +The naming format for servers on this exception list is the fully qualified domain name (FQDN) or NetBIOS server name used by the application, listed one per line. To ensure exceptions the name used by all applications needs to be in the list, and to ensure an exception is accurate, the server name should be listed in both naming formats . A single asterisk (*) can be used anywhere in the string as a wildcard character. + + + + + + + + + + + text/plain + + + + + NetworkSecurity_RestrictNTLM_AuditIncomingNTLMTraffic + + + + + + + + Network security: Restrict NTLM: Audit Incoming NTLM Traffic -Windows 7 and Windows Server 2008 R2: Require 128-bit encryption +This policy setting allows you to audit incoming NTLM traffic. + +If you select "Disable", or do not configure this policy setting, the server will not log events for incoming NTLM traffic. + +If you select "Enable auditing for domain accounts", the server will log events for NTLM pass-through authentication requests that would be blocked when the "Network Security: Restrict NTLM: Incoming NTLM traffic" policy setting is set to the "Deny all domain accounts" option. + +If you select "Enable auditing for all accounts", the server will log events for all NTLM authentication requests that would be blocked when the "Network Security: Restrict NTLM: Incoming NTLM traffic" policy setting is set to the "Deny all accounts" option. + +This policy is supported on at least Windows 7 or Windows Server 2008 R2. + +Note: Audit events are recorded on this computer in the "Operational" Log located under the Applications and Services Log/Microsoft/Windows/NTLM. + + + + + + + + + + + text/plain + + + + + NetworkSecurity_RestrictNTLM_IncomingNTLMTraffic + + + + + + + + Network security: Restrict NTLM: Incoming NTLM traffic + +This policy setting allows you to deny or allow incoming NTLM traffic. + +If you select "Allow all" or do not configure this policy setting, the server will allow all NTLM authentication requests. + +If you select "Deny all domain accounts," the server will deny NTLM authentication requests for domain logon and display an NTLM blocked error, but allow local account logon. + +If you select "Deny all accounts," the server will deny NTLM authentication requests from incoming traffic and display an NTLM blocked error. + +This policy is supported on at least Windows 7 or Windows Server 2008 R2. + +Note: Block events are recorded on this computer in the "Operational" Log located under the Applications and Services Log/Microsoft/Windows/NTLM. + + + + + + + + + + + text/plain + + + + + NetworkSecurity_RestrictNTLM_OutgoingNTLMTrafficToRemoteServers + + + + + + + + Network security: Restrict NTLM: Outgoing NTLM traffic to remote servers + +This policy setting allows you to deny or audit outgoing NTLM traffic from this Windows 7 or this Windows Server 2008 R2 computer to any Windows remote server. + +If you select "Allow all" or do not configure this policy setting, the client computer can authenticate identities to a remote server by using NTLM authentication. + +If you select "Audit all," the client computer logs an event for each NTLM authentication request to a remote server. This allows you to identify those servers receiving NTLM authentication requests from the client computer. + +If you select "Deny all," the client computer cannot authenticate identities to a remote server by using NTLM authentication. You can use the "Network security: Restrict NTLM: Add remote server exceptions for NTLM authentication" policy setting to define a list of remote servers to which clients are allowed to use NTLM authentication. + +This policy is supported on at least Windows 7 or Windows Server 2008 R2. + +Note: Audit and block events are recorded on this computer in the "Operational" Log located under the Applications and Services Log/Microsoft/Windows/NTLM. @@ -32721,6 +32967,30 @@ The options are: + + TurnOnWindowsDefenderProtectionAgainstPotentiallyUnwantedApplications + + + + + + + + + + + + + + + + + + + text/plain + + + WDigestAuthentication @@ -43215,6 +43485,89 @@ Because of these factors, users do not usually need this user right. Warning: If LowestValueMostSecure + + MSIAllowUserControlOverInstall + + + + + 0 + + + + + + + + + + + + text/plain + + + phone + MSI.admx + MSI~AT~WindowsComponents~MSI + EnableUserControl + HighestValueMostSecure + + + + MSIAlwaysInstallWithElevatedPrivileges + + + + + 0 + + + + + + + + + + + + text/plain + + + phone + MSI.admx + MSI~AT~WindowsComponents~MSI + AlwaysInstallElevated + HighestValueMostSecure + + + + RequirePrivateStoreOnly + + + + + 0 + + + + + + + + + + + + text/plain + + + WindowsStore.admx + WindowsStore~AT~WindowsComponents~WindowsStore + RequirePrivateStoreOnly + HighestValueMostSecure + + RestrictAppDataToSystemVolume @@ -55097,7 +55450,7 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor phone inetres.admx inetres~AT~WindowsComponents~InternetExplorer~SecurityFeatures~IESF_CategoryProtectionFromZoneElevation - IESF_PolicyAllProcesses_9 + IESF_PolicyExplorerProcesses_9 LastWrite @@ -55151,7 +55504,7 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor phone inetres.admx inetres~AT~WindowsComponents~InternetExplorer~SecurityFeatures~IESF_CategoryRestrictActiveXInstall - IESF_PolicyAllProcesses_11 + IESF_PolicyExplorerProcesses_11 LastWrite @@ -56312,7 +56665,7 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor phone inetres.admx inetres~AT~WindowsComponents~InternetExplorer~SecurityFeatures~IESF_CategoryRestrictFileDownload - IESF_PolicyAllProcesses_12 + IESF_PolicyExplorerProcesses_12 LastWrite @@ -56339,7 +56692,7 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor phone inetres.admx inetres~AT~WindowsComponents~InternetExplorer~SecurityFeatures~IESF_CategoryScriptedWindowSecurityRestrictions - IESF_PolicyAllProcesses_8 + IESF_PolicyExplorerProcesses_8 LastWrite @@ -57022,6 +57375,31 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor LastWrite + + EnableEndSessionButton + + + + + 0 + Enable/disable kiosk browser's end session button. + + + + + + + + + + + text/plain + + + phone + LastWrite + + EnableHomeButton @@ -57098,6 +57476,53 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor + + LanmanWorkstation + + + + + + + + + + + + + + + + + + + EnableInsecureGuestLogons + + + + + 0 + + + + + + + + + + + + text/plain + + + LanmanWorkstation.admx + LanmanWorkstation~AT~Network~Cat_LanmanWorkstation + Pol_EnableInsecureGuestLogons + LowestValueMostSecure + + + Licensing @@ -57614,41 +58039,6 @@ Note: Domain controllers are also domain members and establish secure channels w LastWrite - - DomainMember_DigitallySignSecureChannelDataWhenPossible - - - - - 1 - Domain member: Digitally sign secure channel data (when possible) - -This security setting determines whether a domain member attempts to negotiate signing for all secure channel traffic that it initiates. - -When a computer joins a domain, a computer account is created. After that, when the system starts, it uses the computer account password to create a secure channel with a domain controller for its domain. This secure channel is used to perform operations such as NTLM pass through authentication, LSA SID/name Lookup etc. - -This setting determines whether or not the domain member attempts to negotiate signing for all secure channel traffic that it initiates. If enabled, the domain member will request signing of all secure channel traffic. If the Domain Controller supports signing of all secure channel traffic, then all secure channel traffic will be signed which ensures that it cannot be tampered with in transit. - -Default: Enabled. - - - - - - - - - - - text/plain - - - phone - Windows Settings~Security Settings~Local Policies~Security Options - Domain member: Digitally sign secure channel data (when possible) - LastWrite - - DomainMember_DisableMachineAccountPasswordChanges @@ -57685,87 +58075,6 @@ This setting should not be used in an attempt to support dual-boot scenarios tha LastWrite - - DomainMember_MaximumMachineAccountPasswordAge - - - - - 30 - Domain member: Maximum machine account password age - -This security setting determines how often a domain member will attempt to change its computer account password. - -Default: 30 days. - -Important - -This setting applies to Windows 2000 computers, but it is not available through the Security Configuration Manager tools on these computers. - - - - - - - - - - - text/plain - - - phone - Windows Settings~Security Settings~Local Policies~Security Options - Domain member: Maximum machine account password age - LowestValueMostSecure - - - - DomainMember_RequireStrongSessionKey - - - - - 1 - Domain member: Require strong (Windows 2000 or later) session key - -This security setting determines whether 128-bit key strength is required for encrypted secure channel data. - -When a computer joins a domain, a computer account is created. After that, when the system starts, it uses the computer account password to create a secure channel with a domain controller within the domain. This secure channel is used to perform operations such as NTLM pass-through authentication, LSA SID/name Lookup, and so on. - -Depending on what version of Windows is running on the domain controller that the domain member is communicating with and the settings of the parameters: - -Domain member: Digitally encrypt or sign secure channel data (always) -Domain member: Digitally encrypt secure channel data (when possible) -Some or all of the information that is transmitted over the secure channel will be encrypted. This policy setting determines whether or not 128-bit key strength is required for the secure channel information that is encrypted. - -If this setting is enabled, then the secure channel will not be established unless 128-bit encryption can be performed. If this setting is disabled, then the key strength is negotiated with the domain controller. - -Default: Enabled. - -Important - -In order to take advantage of this policy on member workstations and servers, all domain controllers that constitute the member's domain must be running Windows 2000 or later. -In order to take advantage of this policy on domain controllers, all domain controllers in the same domain as well as all trusted domains must run Windows 2000 or later. - - - - - - - - - - - text/plain - - - phone - Windows Settings~Security Settings~Local Policies~Security Options - Domain member: Require strong (Windows 2000 or later) session key - LastWrite - - InteractiveLogon_DisplayUserInformationWhenTheSessionIsLocked @@ -58039,55 +58348,6 @@ On Windows Vista and above: For this setting to work, the Smart Card Removal Pol LastWrite - - MicrosoftNetworkClient_DigitallySignCommunicationsAlways - - - - - 0 - Microsoft network client: Digitally sign communications (always) - -This security setting determines whether packet signing is required by the SMB client component. - -The server message block (SMB) protocol provides the basis for Microsoft file and print sharing and many other networking operations, such as remote Windows administration. To prevent man-in-the-middle attacks that modify SMB packets in transit, the SMB protocol supports the digital signing of SMB packets. This policy setting determines whether SMB packet signing must be negotiated before further communication with an SMB server is permitted. - -If this setting is enabled, the Microsoft network client will not communicate with a Microsoft network server unless that server agrees to perform SMB packet signing. If this policy is disabled, SMB packet signing is negotiated between the client and server. - -Default: Disabled. - -Important - -For this policy to take effect on computers running Windows 2000, client-side packet signing must also be enabled. To enable client-side SMB packet signing, set Microsoft network client: Digitally sign communications (if server agrees). - -Notes - -All Windows operating systems support both a client-side SMB component and a server-side SMB component. On Windows 2000 and later operating systems, enabling or requiring packet signing for client and server-side SMB components is controlled by the following four policy settings: -Microsoft network client: Digitally sign communications (always) - Controls whether or not the client-side SMB component requires packet signing. -Microsoft network client: Digitally sign communications (if server agrees) - Controls whether or not the client-side SMB component has packet signing enabled. -Microsoft network server: Digitally sign communications (always) - Controls whether or not the server-side SMB component requires packet signing. -Microsoft network server: Digitally sign communications (if client agrees) - Controls whether or not the server-side SMB component has packet signing enabled. -SMB packet signing can significantly degrade SMB performance, depending on dialect version, OS version, file sizes, processor offloading capabilities, and application IO behaviors. -For more information, reference: https://go.microsoft.com/fwlink/?LinkID=787136. - - - - - - - - - - - text/plain - - - phone - Windows Settings~Security Settings~Local Policies~Security Options - Microsoft network client: Digitally sign communications (always) - LastWrite - - MicrosoftNetworkClient_DigitallySignCommunicationsIfServerAgrees @@ -58571,44 +58831,6 @@ Windows Vista, Windows Server 2008, Windows 7, and Windows Server 2008 R2: Send HighestValueMostSecure - - NetworkSecurity_MinimumSessionSecurityForNTLMSSPBasedClients - - - - - 0 - Network security: Minimum session security for NTLM SSP based (including secure RPC) clients - -This security setting allows a client to require the negotiation of 128-bit encryption and/or NTLMv2 session security. These values are dependent on the LAN Manager Authentication Level security setting value. The options are: - -Require NTLMv2 session security: The connection will fail if NTLMv2 protocol is not negotiated. -Require 128-bit encryption: The connection will fail if strong encryption (128-bit) is not negotiated. - -Default: - -Windows XP, Windows Vista, Windows 2000 Server, Windows Server 2003, and Windows Server 2008: No requirements. - -Windows 7 and Windows Server 2008 R2: Require 128-bit encryption - - - - - - - - - - - text/plain - - - phone - Windows Settings~Security Settings~Local Policies~Security Options - Network security: Minimum session security for NTLM SSP based (including secure RPC) clients - HighestValueMostSecure - - NetworkSecurity_MinimumSessionSecurityForNTLMSSPBasedServers @@ -58647,6 +58869,157 @@ Windows 7 and Windows Server 2008 R2: Require 128-bit encryption HighestValueMostSecure + + NetworkSecurity_RestrictNTLM_AddRemoteServerExceptionsForNTLMAuthentication + + + + + + Network security: Restrict NTLM: Add remote server exceptions for NTLM authentication + +This policy setting allows you to create an exception list of remote servers to which clients are allowed to use NTLM authentication if the "Network Security: Restrict NTLM: Outgoing NTLM traffic to remote servers" policy setting is configured. + +If you configure this policy setting, you can define a list of remote servers to which clients are allowed to use NTLM authentication. + +If you do not configure this policy setting, no exceptions will be applied. + +The naming format for servers on this exception list is the fully qualified domain name (FQDN) or NetBIOS server name used by the application, listed one per line. To ensure exceptions the name used by all applications needs to be in the list, and to ensure an exception is accurate, the server name should be listed in both naming formats . A single asterisk (*) can be used anywhere in the string as a wildcard character. + + + + + + + + + + + text/plain + + phone + Windows Settings~Security Settings~Local Policies~Security Options + Network security: Restrict NTLM: Add remote server exceptions for NTLM authentication + LastWrite + + + + NetworkSecurity_RestrictNTLM_AuditIncomingNTLMTraffic + + + + + 0 + Network security: Restrict NTLM: Audit Incoming NTLM Traffic + +This policy setting allows you to audit incoming NTLM traffic. + +If you select "Disable", or do not configure this policy setting, the server will not log events for incoming NTLM traffic. + +If you select "Enable auditing for domain accounts", the server will log events for NTLM pass-through authentication requests that would be blocked when the "Network Security: Restrict NTLM: Incoming NTLM traffic" policy setting is set to the "Deny all domain accounts" option. + +If you select "Enable auditing for all accounts", the server will log events for all NTLM authentication requests that would be blocked when the "Network Security: Restrict NTLM: Incoming NTLM traffic" policy setting is set to the "Deny all accounts" option. + +This policy is supported on at least Windows 7 or Windows Server 2008 R2. + +Note: Audit events are recorded on this computer in the "Operational" Log located under the Applications and Services Log/Microsoft/Windows/NTLM. + + + + + + + + + + + text/plain + + + phone + Windows Settings~Security Settings~Local Policies~Security Options + Network security: Restrict NTLM: Audit Incoming NTLM Traffic + HighestValueMostSecure + + + + NetworkSecurity_RestrictNTLM_IncomingNTLMTraffic + + + + + 0 + Network security: Restrict NTLM: Incoming NTLM traffic + +This policy setting allows you to deny or allow incoming NTLM traffic. + +If you select "Allow all" or do not configure this policy setting, the server will allow all NTLM authentication requests. + +If you select "Deny all domain accounts," the server will deny NTLM authentication requests for domain logon and display an NTLM blocked error, but allow local account logon. + +If you select "Deny all accounts," the server will deny NTLM authentication requests from incoming traffic and display an NTLM blocked error. + +This policy is supported on at least Windows 7 or Windows Server 2008 R2. + +Note: Block events are recorded on this computer in the "Operational" Log located under the Applications and Services Log/Microsoft/Windows/NTLM. + + + + + + + + + + + text/plain + + + phone + Windows Settings~Security Settings~Local Policies~Security Options + Network security: Restrict NTLM: Incoming NTLM traffic + HighestValueMostSecure + + + + NetworkSecurity_RestrictNTLM_OutgoingNTLMTrafficToRemoteServers + + + + + 0 + Network security: Restrict NTLM: Outgoing NTLM traffic to remote servers + +This policy setting allows you to deny or audit outgoing NTLM traffic from this Windows 7 or this Windows Server 2008 R2 computer to any Windows remote server. + +If you select "Allow all" or do not configure this policy setting, the client computer can authenticate identities to a remote server by using NTLM authentication. + +If you select "Audit all," the client computer logs an event for each NTLM authentication request to a remote server. This allows you to identify those servers receiving NTLM authentication requests from the client computer. + +If you select "Deny all," the client computer cannot authenticate identities to a remote server by using NTLM authentication. You can use the "Network security: Restrict NTLM: Add remote server exceptions for NTLM authentication" policy setting to define a list of remote servers to which clients are allowed to use NTLM authentication. + +This policy is supported on at least Windows 7 or Windows Server 2008 R2. + +Note: Audit and block events are recorded on this computer in the "Operational" Log located under the Applications and Services Log/Microsoft/Windows/NTLM. + + + + + + + + + + + text/plain + + + phone + Windows Settings~Security Settings~Local Policies~Security Options + Network security: Restrict NTLM: Outgoing NTLM traffic to remote servers + HighestValueMostSecure + + Shutdown_AllowSystemToBeShutDownWithoutHavingToLogOn @@ -59472,6 +59845,33 @@ The options are: LastWrite + + TurnOnWindowsDefenderProtectionAgainstPotentiallyUnwantedApplications + + + + + + + + + + + + + + + + + text/plain + + phone + SecGuide.admx + SecGuide~AT~Cat_SecGuide + Pol_SecGuide_0101_WDPUA + LastWrite + + WDigestAuthentication diff --git a/windows/configuration/basic-level-windows-diagnostic-events-and-fields-1703.md b/windows/configuration/basic-level-windows-diagnostic-events-and-fields-1703.md index d6c2534f87..819b8ca97a 100644 --- a/windows/configuration/basic-level-windows-diagnostic-events-and-fields-1703.md +++ b/windows/configuration/basic-level-windows-diagnostic-events-and-fields-1703.md @@ -9,7 +9,7 @@ ms.pagetype: security ms.localizationpriority: high author: eross-msft ms.author: lizross -ms.date: 04/05/2017 +ms.date: 03/13/2018 --- @@ -832,13 +832,17 @@ This event represents the basic metadata about a file on the system. The file m The following fields are available: - **AppraiserVersion** The version of the Appraiser file generating the events. +- **AvDisplayName** The version of the Appraiser file generating the events. +- **AvProductState** If the app is an anti-virus app, this is its display name. +- **BinaryType** A binary type. Example: UNINITIALIZED, ZERO_BYTE, DATA_ONLY, DOS_MODULE, NE16_MODULE, PE32_UNKNOWN, PE32_I386, PE32_ARM, PE64_UNKNOWN, PE64_AMD64, PE64_ARM64, PE64_IA64, PE32_CLR_32, PE32_CLR_IL, PE32_CLR_IL_PREFER32, PE64_CLR_64 - **BinFileVersion** An attempt to clean up FileVersion at the client that tries to place the version into 4 octets. - **BinProductVersion** An attempt to clean up ProductVersion at the client that tries to place the version into 4 octets. -- **BinaryType** A binary type. Example: UNINITIALIZED, ZERO_BYTE, DATA_ONLY, DOS_MODULE, NE16_MODULE, PE32_UNKNOWN, PE32_I386, PE32_ARM, PE64_UNKNOWN, PE64_AMD64, PE64_ARM64, PE64_IA64, PE32_CLR_32, PE32_CLR_IL, PE32_CLR_IL_PREFER32, PE64_CLR_64 - **BoeProgramId** If there is no entry in Add/Remove Programs, this is the ProgramID that is generated from the file metadata. - **CompanyName** The company name of the vendor who developed this file. - **FileId** A hash that uniquely identifies a file. - **FileVersion** The File version field from the file metadata under Properties -> Details. +- **HasUpgradeExe** Represents state of antivirus program with respect to whether it's turned on and the signatures are up-to-date. +- **IsAv** A binary type. Example: UNINITIALIZED, ZERO_BYTE, DATA_ONLY, DOS_MODULE, NE16_MODULE, PE32_UNKNOWN, PE32_I386, PE32_ARM, PE64_UNKNOWN, PE64_AMD64, PE64_ARM64, PE64_IA64, PE32_CLR_32, PE32_CLR_IL, PE32_CLR_IL_PREFER32, PE64_CLR_64 - **LinkDate** The date and time that this file was linked on. - **LowerCaseLongPath** The full file path to the file that was inventoried on the device. - **Name** The name of the file that was inventoried. @@ -847,6 +851,24 @@ The following fields are available: - **ProgramId** A hash of the Name, Version, Publisher, and Language of an application used to identify it. - **Size** The size of the file (in hexadecimal bytes). +### Microsoft.Windows.Inventory.Core.InventoryApplicationDriverAdd + +This event represents the drivers that an application installs. + +The following fields are available: + +- **InventoryVersion** The version of the inventory component +- **Programids** The unique program identifier the driver is associated with. + + +## Microsoft.Windows.Inventory.Core.InventoryApplicationDriverStartSync + +This event indicates that a new set of InventoryApplicationDriverStartAdd events will be sent. + +The following fields are available: + +- **InventoryVersion** The version of the inventory component. + ### Microsoft.Windows.Appraiser.General.InventoryApplicationFileRemove @@ -1628,15 +1650,19 @@ This event sends data about the processor (architecture, speed, number of cores, The following fields are available: -- **ProcessorCores** Retrieves the number of cores in the processor. -- **ProcessorPhysicalCores** Number of physical cores in the processor. +- **KvaShadow** Microcode info of the processor. +- **MMSettingOverride** Microcode setting of the processor. +- **MMSettingOverrideMask** Microcode setting override of the processor. - **ProcessorArchitecture** Retrieves the processor architecture of the installed operating system. The complete list of values can be found in DimProcessorArchitecture. - **ProcessorClockSpeed** Retrieves the clock speed of the processor in MHz. +- **ProcessorCores** Retrieves the number of cores in the processor. +- **ProcessorIdentifier** The processor identifier of a manufacturer. - **ProcessorManufacturer** Retrieves the name of the processor's manufacturer. - **ProcessorModel** Retrieves the name of the processor model. -- **SocketCount** Number of physical CPU sockets of the machine. -- **ProcessorIdentifier** The processor identifier of a manufacturer. +- **ProcessorPhysicalCores** Number of physical cores in the processor. - **ProcessorUpdateRevision** The microcode version. +- **SocketCount** Number of physical CPU sockets of the machine. +- **SpeculationControl** Clock speed of the processor in MHz. ### Census.Speech diff --git a/windows/configuration/basic-level-windows-diagnostic-events-and-fields.md b/windows/configuration/basic-level-windows-diagnostic-events-and-fields.md index eac9fde18a..e8411d0b05 100644 --- a/windows/configuration/basic-level-windows-diagnostic-events-and-fields.md +++ b/windows/configuration/basic-level-windows-diagnostic-events-and-fields.md @@ -9,7 +9,7 @@ ms.pagetype: security localizationpriority: high author: eross-msft ms.author: lizross -ms.date: 02/12/2018 +ms.date: 03/13/2018 --- @@ -21,7 +21,7 @@ ms.date: 02/12/2018 - Windows 10, version 1709 -The Basic level gathers a limited set of information that is critical for understanding the device and its configuration including: basic device information, quality-related information, app compatibility, and Windows Store. When the level is set to Basic, it also includes the Security level information. +The Basic level gathers a limited set of information that is critical for understanding the device and its configuration including: basic device information, quality-related information, app compatibility, and Microsoft Store. When the level is set to Basic, it also includes the Security level information. The Basic level helps to identify problems that can occur on a particular device hardware or software configuration. For example, it can help determine if crashes are more frequent on devices with a specific amount of memory or that are running a particular driver version. This helps Microsoft fix operating system or app problems. @@ -30,9 +30,9 @@ Use this article to learn about diagnostic events, grouped by event area, and th You can learn more about Windows functional and diagnostic data through these articles: -- [Windows 10, version 1703 basic diagnostic events and fields](basic-level-windows-diagnostic-events-and-fields-1703.md) -- [Manage connections from Windows operating system components to Microsoft services](manage-connections-from-windows-operating-system-components-to-microsoft-services.md) -- [Configure Windows diagnostic data in your organization](configure-windows-diagnostic-data-in-your-organization.md) +- [Windows 10, version 1703 basic diagnostic events and fields](https://docs.microsoft.com/windows/configuration/basic-level-windows-diagnostic-events-and-fields-1703) +- [Manage connections from Windows operating system components to Microsoft services](https://docs.microsoft.com/windows/configuration/manage-connections-from-windows-operating-system-components-to-microsoft-services) +- [Configure Windows diagnostic data in your organization](https://docs.microsoft.com/windows/configuration/configure-windows-diagnostic-data-in-your-organization) @@ -317,6 +317,8 @@ This event represents the basic metadata about a file on the system. The file m The following fields are available: - **AppraiserVersion** The version of the Appraiser file generating the events. +- **AvDisplayName** The version of the Appraiser file generating the events. +- **AvProductState** If the app is an anti-virus app, this is its display name. - **BinaryType** A binary type. Example: UNINITIALIZED, ZERO_BYTE, DATA_ONLY, DOS_MODULE, NE16_MODULE, PE32_UNKNOWN, PE32_I386, PE32_ARM, PE64_UNKNOWN, PE64_AMD64, PE64_ARM64, PE64_IA64, PE32_CLR_32, PE32_CLR_IL, PE32_CLR_IL_PREFER32, PE64_CLR_64 - **BinFileVersion** An attempt to clean up FileVersion at the client that tries to place the version into 4 octets. - **BinProductVersion** An attempt to clean up ProductVersion at the client that tries to place the version into 4 octets. @@ -324,6 +326,8 @@ The following fields are available: - **CompanyName** The company name of the vendor who developed this file. - **FileId** A hash that uniquely identifies a file. - **FileVersion** The File version field from the file metadata under Properties -> Details. +- **HasUpgradeExe** Represents state of antivirus program with respect to whether it's turned on and the signatures are up-to-date. +- **IsAv** A binary type. Example: UNINITIALIZED, ZERO_BYTE, DATA_ONLY, DOS_MODULE, NE16_MODULE, PE32_UNKNOWN, PE32_I386, PE32_ARM, PE64_UNKNOWN, PE64_AMD64, PE64_ARM64, PE64_IA64, PE32_CLR_32, PE32_CLR_IL, PE32_CLR_IL_PREFER32, PE64_CLR_64 - **LinkDate** The date and time that this file was linked on. - **LowerCaseLongPath** The full file path to the file that was inventoried on the device. - **Name** The name of the file that was inventoried. @@ -332,6 +336,23 @@ The following fields are available: - **ProgramId** A hash of the Name, Version, Publisher, and Language of an application used to identify it. - **Size** The size of the file (in hexadecimal bytes). +### Microsoft.Windows.Inventory.Core.InventoryApplicationDriverAdd + +This event represents the drivers that an application installs. + +The following fields are available: + +- **InventoryVersion** The version of the inventory component +- **Programids** The unique program identifier the driver is associated with. + + +## Microsoft.Windows.Inventory.Core.InventoryApplicationDriverStartSync + +This event indicates that a new set of InventoryApplicationDriverStartAdd events will be sent. + +The following fields are available: + +- **InventoryVersion** The version of the inventory component. ### Microsoft.Windows.Appraiser.General.DecisionApplicationFileAdd @@ -1593,6 +1614,9 @@ This event sends data about the processor (architecture, speed, number of cores, The following fields are available: +- **KvaShadow** Microcode info of the processor. +- **MMSettingOverride** Microcode setting of the processor. +- **MMSettingOverrideMask** Microcode setting override of the processor. - **ProcessorArchitecture** Retrieves the processor architecture of the installed operating system. The complete list of values can be found in DimProcessorArchitecture. - **ProcessorClockSpeed** Retrieves the clock speed of the processor in MHz. - **ProcessorCores** Retrieves the number of cores in the processor. @@ -1602,6 +1626,7 @@ The following fields are available: - **ProcessorPhysicalCores** Number of physical cores in the processor. - **ProcessorUpdateRevision** The microcode version. - **SocketCount** Number of physical CPU sockets of the machine. +- **SpeculationControl** Clock speed of the processor in MHz. ### Census.Security @@ -1698,7 +1723,7 @@ The following fields are available: - **AppraiserGatedStatus** Indicates whether a device has been gated for upgrading. - **AppStoreAutoUpdate** Retrieves the Appstore settings for auto upgrade. (Enable/Disabled). - **AppStoreAutoUpdateMDM** Retrieves the App Auto Update value for MDM: 0 - Disallowed. 1 - Allowed. 2 - Not configured. Default: [2] Not configured -- **AppStoreAutoUpdatePolicy** Retrieves the Windows Store App Auto Update group policy setting +- **AppStoreAutoUpdatePolicy** Retrieves the Microsoft Store App Auto Update group policy setting - **DelayUpgrade** Retrieves the Windows upgrade flag for delaying upgrades. - **OSAssessmentFeatureOutOfDate** How many days has it been since a the last feature update was released but the device did not install it? - **OSAssessmentForFeatureUpdate** Is the device is on the latest feature update? @@ -2170,7 +2195,7 @@ The following fields are available: - **Publisher** The Publisher of the application. Location pulled from depends on the 'Source' field. - **RootDirPath** The path to the root directory where the program was installed. - **Source** How the program was installed (ARP, MSI, Appx, etc...) -- **StoreAppType** A sub-classification for the type of Windows Store app, such as UWP or Win8StoreApp. +- **StoreAppType** A sub-classification for the type of Microsoft Store app, such as UWP or Win8StoreApp. - **Type** "One of (""Application"", ""Hotfix"", ""BOE"", ""Service"", ""Unknown""). Application indicates Win32 or Appx app, Hotfix indicates app updates (KBs), BOE indicates it's an app with no ARP or MSI entry, Service indicates that it is a service. Application and BOE are the ones most likely seen." - **Version** The version number of the program. @@ -2354,7 +2379,7 @@ The following fields are available: - **enumerator** The bus that enumerated the device - **HWID** A JSON array that provides the value and order of the HWID tree for the device. - **Inf** The INF file name. -- **installState** The device installation state. One of these values: https://msdn.microsoft.com/en-us/library/windows/hardware/ff543130.aspx +- **installState** The device installation state. One of these values: https://msdn.microsoft.com/library/windows/hardware/ff543130.aspx - **InventoryVersion** The version of the inventory file generating the events. - **lowerClassFilters** Lower filter class drivers IDs installed for the device. - **lowerFilters** Lower filter drivers IDs installed for the device @@ -2506,21 +2531,21 @@ There are no fields in this event. This event provides data on the installed Office-related Internet Explorer features. -- **OIeFeatureAddon** For more information, see the Office-related [Internet Feature Control Keys](https://msdn.microsoft.com/en-us/library/ee330720.aspx). -- **OIeMachineLockdown** For more information, see the Office-related [Internet Feature Control Keys](https://msdn.microsoft.com/en-us/library/ee330720.aspx). -- **OIeMimeHandling** For more information, see the Office-related [Internet Feature Control Keys](https://msdn.microsoft.com/en-us/library/ee330720.aspx). -- **OIeMimeSniffing** For more information, see the Office-related [Internet Feature Control Keys](https://msdn.microsoft.com/en-us/library/ee330720.aspx). -- **OIeNoAxInstall** For more information, see the Office-related [Internet Feature Control Keys](https://msdn.microsoft.com/en-us/library/ee330720.aspx). -- **OIeNoDownload** For more information, see the Office-related [Internet Feature Control Keys](https://msdn.microsoft.com/en-us/library/ee330720.aspx). -- **OIeObjectCaching** For more information, see the Office-related [Internet Feature Control Keys](https://msdn.microsoft.com/en-us/library/ee330720.aspx). -- **OIePasswordDisable** For more information, see the Office-related [Internet Feature Control Keys](https://msdn.microsoft.com/en-us/library/ee330720.aspx). -- **OIeSafeBind** For more information, see the Office-related [Internet Feature Control Keys](https://msdn.microsoft.com/en-us/library/ee330720.aspx). -- **OIeSecurityBand** For more information, see the Office-related [Internet Feature Control Keys](https://msdn.microsoft.com/en-us/library/ee330720.aspx). -- **OIeUncSaveCheck** For more information, see the Office-related [Internet Feature Control Keys](https://msdn.microsoft.com/en-us/library/ee330720.aspx). -- **OIeValidateUrl** For more information, see the Office-related [Internet Feature Control Keys](https://msdn.microsoft.com/en-us/library/ee330720.aspx). -- **OIeWebOcPopup** For more information, see the Office-related [Internet Feature Control Keys](https://msdn.microsoft.com/en-us/library/ee330720.aspx). -- **OIeWinRestrict** For more information, see the Office-related [Internet Feature Control Keys](https://msdn.microsoft.com/en-us/library/ee330720.aspx). -- **OIeZoneElevate** For more information, see the Office-related [Internet Feature Control Keys](https://msdn.microsoft.com/en-us/library/ee330720.aspx). +- **OIeFeatureAddon** For more information, see the Office-related [Internet Feature Control Keys](https://msdn.microsoft.com/library/ee330720.aspx). +- **OIeMachineLockdown** For more information, see the Office-related [Internet Feature Control Keys](https://msdn.microsoft.com/library/ee330720.aspx). +- **OIeMimeHandling** For more information, see the Office-related [Internet Feature Control Keys](https://msdn.microsoft.com/library/ee330720.aspx). +- **OIeMimeSniffing** For more information, see the Office-related [Internet Feature Control Keys](https://msdn.microsoft.com/library/ee330720.aspx). +- **OIeNoAxInstall** For more information, see the Office-related [Internet Feature Control Keys](https://msdn.microsoft.com/library/ee330720.aspx). +- **OIeNoDownload** For more information, see the Office-related [Internet Feature Control Keys](https://msdn.microsoft.com/library/ee330720.aspx). +- **OIeObjectCaching** For more information, see the Office-related [Internet Feature Control Keys](https://msdn.microsoft.com/library/ee330720.aspx). +- **OIePasswordDisable** For more information, see the Office-related [Internet Feature Control Keys](https://msdn.microsoft.com/library/ee330720.aspx). +- **OIeSafeBind** For more information, see the Office-related [Internet Feature Control Keys](https://msdn.microsoft.com/library/ee330720.aspx). +- **OIeSecurityBand** For more information, see the Office-related [Internet Feature Control Keys](https://msdn.microsoft.com/library/ee330720.aspx). +- **OIeUncSaveCheck** For more information, see the Office-related [Internet Feature Control Keys](https://msdn.microsoft.com/library/ee330720.aspx). +- **OIeValidateUrl** For more information, see the Office-related [Internet Feature Control Keys](https://msdn.microsoft.com/library/ee330720.aspx). +- **OIeWebOcPopup** For more information, see the Office-related [Internet Feature Control Keys](https://msdn.microsoft.com/library/ee330720.aspx). +- **OIeWinRestrict** For more information, see the Office-related [Internet Feature Control Keys](https://msdn.microsoft.com/library/ee330720.aspx). +- **OIeZoneElevate** For more information, see the Office-related [Internet Feature Control Keys](https://msdn.microsoft.com/library/ee330720.aspx). ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeIESettingsStartSync @@ -2811,7 +2836,7 @@ The following fields are available: ### SoftwareUpdateClientTelemetry.UpdateDetected -This event sends data about an AppX app that has been updated from the Windows Store, including what app needs an update and what version/architecture is required, in order to understand and address problems with apps getting required updates. +This event sends data about an AppX app that has been updated from the Microsoft Store, including what app needs an update and what version/architecture is required, in order to understand and address problems with apps getting required updates. The following fields are available: @@ -2821,7 +2846,7 @@ The following fields are available: - **RelatedCV** The previous Correlation Vector that was used before swapping with a new one - **WUDeviceID** The unique device ID controlled by the software distribution client - **IntentPFNs** Intended application-set metadata for atomic update scenarios. -- **ServiceGuid** An ID which represents which service the software distribution client is connecting to (Windows Update, Windows Store, etc.) +- **ServiceGuid** An ID which represents which service the software distribution client is connecting to (Windows Update, Microsoft Store, etc.) ### SoftwareUpdateClientTelemetry.SLSDiscovery @@ -2834,7 +2859,7 @@ The following fields are available: - **HResult** Indicates the result code of the event (success, cancellation, failure code HResult) - **IsBackground** Indicates whether the SLS discovery event took place in the foreground or background - **NextExpirationTime** Indicates when the SLS cab expires -- **ServiceID** An ID which represents which service the software distribution client is connecting to (Windows Update, Windows Store, etc.) +- **ServiceID** An ID which represents which service the software distribution client is connecting to (Windows Update, Microsoft Store, etc.) - **SusClientId** The unique device ID controlled by the software distribution client - **UrlPath** Path to the SLS cab that was downloaded - **WUAVersion** The version number of the software distribution client @@ -2860,7 +2885,7 @@ The following fields are available: - **EventType** "Possible values are ""Child"", ""Bundle"", or ""Driver""." - **HandlerType** Indicates the kind of content (app, driver, windows patch, etc.) - **RevisionNumber** Unique revision number of Update -- **ServerId** Identifier for the service to which the software distribution client is connecting, such as Windows Update and Windows Store. +- **ServerId** Identifier for the service to which the software distribution client is connecting, such as Windows Update and Microsoft Store. - **SystemBIOSMajorRelease** Major version of the BIOS. - **SystemBIOSMinorRelease** Minor version of the BIOS. - **UpdateId** Unique Update ID @@ -2905,7 +2930,7 @@ The following fields are available: - **MetadataSignature** A base64-encoded string of the signature associated with the update metadata (specified by revision ID). - **RevisionId** The revision ID for a specific piece of content. - **RevisionNumber** The revision number for a specific piece of content. -- **ServiceGuid** Identifies the service to which the software distribution client is connected, Example: Windows Update or Windows Store +- **ServiceGuid** Identifies the service to which the software distribution client is connected, Example: Windows Update or Microsoft Store - **SHA256OfLeafCertPublicKey** A base64 encoding of the hash of the Base64CertData in the FragmentSigning data of the leaf certificate. - **SHA256OfTimestampToken** A base64-encoded string of hash of the timestamp token blob. - **SignatureAlgorithm** The hash algorithm for the metadata signature. @@ -2986,7 +3011,7 @@ The following fields are available: - **RelatedCV** The previous Correlation Vector that was used before swapping with a new one - **RepeatFailFlag** Indicates whether this specific piece of content had previously failed to download. - **RevisionNumber** Identifies the revision number of this specific piece of content. -- **ServiceGuid** An ID which represents which service the software distribution client is installing content for (Windows Update, Windows Store, etc.). +- **ServiceGuid** An ID which represents which service the software distribution client is installing content for (Windows Update, Microsoft Store, etc.). - **Setup360Phase** If the download is for an operating system upgrade, this datapoint indicates which phase of the upgrade is underway. - **ShippingMobileOperator** The mobile operator that a device shipped on. - **StatusCode** Indicates the result of a Download event (success, cancellation, failure code HResult). @@ -3054,7 +3079,7 @@ The following fields are available: - **RelatedCV** The previous Correlation Vector that was used before swapping with a new one - **ScanDurationInSeconds** The number of seconds a scan took - **ScanEnqueueTime** The number of seconds it took to initialize a scan -- **ServiceGuid** An ID which represents which service the software distribution client is checking for content (Windows Update, Windows Store, etc.). +- **ServiceGuid** An ID which represents which service the software distribution client is checking for content (Windows Update, Microsoft Store, etc.). - **ServiceUrl** The environment URL a device is configured to scan with - **ShippingMobileOperator** The mobile operator that a device shipped on. - **StatusCode** Indicates the result of a CheckForUpdates event (success, cancellation, failure code HResult). @@ -3152,7 +3177,7 @@ The following fields are available: - **RepeatFailFlag** Indicates whether this specific piece of content had previously failed to install. - **RepeatSuccessInstallFlag** Indicates whether this specific piece of content had previously installed successful, for example if another user had already installed it. - **RevisionNumber** The revision number of this specific piece of content. -- **ServiceGuid** An ID which represents which service the software distribution client is installing content for (Windows Update, Windows Store, etc.). +- **ServiceGuid** An ID which represents which service the software distribution client is installing content for (Windows Update, Microsoft Store, etc.). - **Setup360Phase** If the install is for an operating system upgrade, indicates which phase of the upgrade is underway. - **ShippingMobileOperator** The mobile operator that a device shipped on. - **StatusCode** Indicates the result of an installation event (success, cancellation, failure code HResult). @@ -3187,7 +3212,7 @@ The following fields are available: - **PowerState** Indicates the power state of the device at the time of heartbeart (DC, AC, Battery Saver, or Connected Standby) - **RelatedCV** "The previous correlation vector that was used by the client, before swapping with a new one " - **ResumeCount** Number of times this active download has resumed from a suspended state -- **ServiceID** "Identifier for the service to which the software distribution client is connecting (Windows Update, Windows Store, etc) " +- **ServiceID** "Identifier for the service to which the software distribution client is connecting (Windows Update, Microsoft Store, etc) " - **SuspendCount** Number of times this active download has entered a suspended state - **SuspendReason** Last reason for why this active download entered a suspended state - **CallerApplicationName** Name provided by the caller who initiated API calls into the software distribution client @@ -3195,7 +3220,7 @@ The following fields are available: - **EventType** "Possible values are ""Child"", ""Bundle"", or ""Driver""" - **FlightId** The unique identifier for each flight - **RevisionNumber** Identifies the revision number of this specific piece of content -- **ServiceGuid** Identifier for the service to which the software distribution client is connecting (Windows Update, Windows Store, etc) +- **ServiceGuid** Identifier for the service to which the software distribution client is connecting (Windows Update, Microsoft Store, etc) - **UpdateId** "Identifier associated with the specific piece of content " - **WUDeviceID** "Unique device id controlled by the software distribution client " @@ -3710,7 +3735,7 @@ The following fields are available: - **ReportId** WER Report Id associated with this bug check (used for finding the corresponding report archive in Watson). -## Windows Store events +## Microsoft Store events ### Microsoft.Windows.StoreAgent.Telemetry.AbortedInstallation diff --git a/windows/configuration/change-history-for-configure-windows-10.md b/windows/configuration/change-history-for-configure-windows-10.md index 144f6425e6..02dee783c1 100644 --- a/windows/configuration/change-history-for-configure-windows-10.md +++ b/windows/configuration/change-history-for-configure-windows-10.md @@ -8,18 +8,24 @@ ms.sitesec: library ms.pagetype: security ms.localizationpriority: high author: jdeckerms -ms.date: 02/12/2018 +ms.date: 03/13/2018 --- # Change history for Configure Windows 10 This topic lists new and updated topics in the [Configure Windows 10](index.md) documentation for Windows 10 and Windows 10 Mobile. +## March 2018 + +New or changed topic | Description +--- | --- +[Windows 10, version 1709 basic diagnostic events and fields](basic-level-windows-diagnostic-events-and-fields.md) and [Windows 10, version 1703 basic level Windows diagnostic events and fields](basic-level-windows-diagnostic-events-and-fields-1703.md) | Added events and fields that were added in the March update. + ## February 2018 New or changed topic | Description --- | --- -[Windows 10, version 1709 basic diagnostic events and fields](basic-level-windows-diagnostic-events-and-fields.md) | Added events and fields that were added in the February update. +[Windows 10, version 1709 basic diagnostic events and fields](basic-level-windows-diagnostic-events-and-fields.md) and [Windows 10, version 1703 basic level Windows diagnostic events and fields](basic-level-windows-diagnostic-events-and-fields-1703.md) | Added events and fields that were added in the February update. [Create a Windows 10 kiosk that runs multiple apps](lock-down-windows-10-to-specific-apps.md) | Added steps for configuring a kiosk in Microsoft Intune. [Customize Windows 10 Start and taskbar with mobile device management (MDM)](customize-windows-10-start-screens-by-using-mobile-device-management.md) | Updated the instructions for applying a customized Start layout using Microsoft Intune. diff --git a/windows/configuration/docfx.json b/windows/configuration/docfx.json index e5720e332c..abe019f76c 100644 --- a/windows/configuration/docfx.json +++ b/windows/configuration/docfx.json @@ -37,6 +37,9 @@ "ms.topic": "article", "ms.author": "jdecker", "ms.date": "04/05/2017", + "feedback_system": "GitHub", + "feedback_github_repo": "MicrosoftDocs/windows-itpro-docs", + "feedback_product_url": "https://support.microsoft.com/help/4021566/windows-10-send-feedback-to-microsoft-with-feedback-hub-app", "_op_documentIdPathDepotMapping": { "./": { "depot_name": "MSDN.win-configuration" diff --git a/windows/configuration/windows-diagnostic-data.md b/windows/configuration/windows-diagnostic-data.md index e3c5fb9fa4..20b60ae7b9 100644 --- a/windows/configuration/windows-diagnostic-data.md +++ b/windows/configuration/windows-diagnostic-data.md @@ -8,7 +8,7 @@ ms.sitesec: library ms.localizationpriority: high author: brianlic-msft ms.author: brianlic -ms.date: 01/30/2018 +ms.date: 03/13/2018 --- # Windows 10, version 1709 diagnostic data for the Full level @@ -16,7 +16,7 @@ ms.date: 01/30/2018 Applies to: - Windows 10, version 1709 -Microsoft uses Windows diagnostic data to keep Windows secure and up-to-date, troubleshoot problems, and make product improvements. For users who have turned on "Tailored experiences", it can also be used to offer you personalized tips, ads, and recommendations to enhance Microsoft products and services for your needs. This article describes all types of diagnostic data collected by Windows at the Full level (inclusive of data collected at Basic), with comprehensive examples of data we collect per each type. For additional, detailed technical descriptions of Basic data items, see [Windows 10, version 1709 Basic level diagnostic events and fields](basic-level-windows-diagnostic-events-and-fields.md). +Microsoft uses Windows diagnostic data to keep Windows secure and up-to-date, troubleshoot problems, and make product improvements. For users who have turned on "Tailored experiences", it can also be used to offer you personalized tips, ads, and recommendations to enhance Microsoft products and services for your needs. This article describes all types of diagnostic data collected by Windows at the Full level (inclusive of data collected at Basic), with comprehensive examples of data we collect per each type. For additional, detailed technical descriptions of Basic data items, see [Windows 10, version 1709 Basic level diagnostic events and fields](https://docs.microsoft.com/windows/configuration/basic-level-windows-diagnostic-events-and-fields). In addition, this article provides references to equivalent definitions for the data types and examples from [ISO/IEC 19944:2017 Information technology -- Cloud computing -- Cloud services and devices: Data flow, data categories and data use](https://www.iso.org/standard/66674.html). Each data type also has a Data Use statement, for diagnostics and for Tailored experiences on the device, using the terms as defined by the standard. These Data Use statements define the purposes for which Microsoft processes each type of Windows diagnostic data, using a uniform set of definitions referenced at the end of this document and based on the ISO standard. Reference to the ISO standard provides additional clarity about the information collected, and allows easy comparison with other services or guidance that also references the standard. @@ -129,7 +129,7 @@ This type of data includes details about the health of the device, operating sys **For Diagnostics:**
    [Pseudonymized](#pseudo) Product and Service Performance data from Windows 10 is used by Microsoft to [provide](#provide) and [improve](#improve) Windows 10 and related Microsoft product and services. For example: -- Data about the reliability of content that appears in the [Windows Spotlight](https://docs.microsoft.com/en-us/windows/configuration/windows-spotlight) (rotating lock screen images) is used for Windows Spotlight reliability investigations. +- Data about the reliability of content that appears in the [Windows Spotlight](https://docs.microsoft.com/windows/configuration/windows-spotlight) (rotating lock screen images) is used for Windows Spotlight reliability investigations. - Timing data about how quickly Cortana responds to voice commands is used to improve Cortana listening peformance. diff --git a/windows/deployment/docfx.json b/windows/deployment/docfx.json index 353f473c8c..e722db5465 100644 --- a/windows/deployment/docfx.json +++ b/windows/deployment/docfx.json @@ -38,6 +38,9 @@ "ms.topic": "article", "ms.author": "greglin", "ms.date": "04/05/2017", + "feedback_system": "GitHub", + "feedback_github_repo": "MicrosoftDocs/windows-itpro-docs", + "feedback_product_url": "https://support.microsoft.com/help/4021566/windows-10-send-feedback-to-microsoft-with-feedback-hub-app", "_op_documentIdPathDepotMapping": { "./": { "depot_name": "MSDN.win-development" diff --git a/windows/hub/docfx.json b/windows/hub/docfx.json index e33995957d..781df2941e 100644 --- a/windows/hub/docfx.json +++ b/windows/hub/docfx.json @@ -39,6 +39,9 @@ "ms.topic": "article", "ms.author": "brianlic", "ms.date": "04/05/2017", + "feedback_system": "GitHub", + "feedback_github_repo": "MicrosoftDocs/windows-itpro-docs", + "feedback_product_url": "https://support.microsoft.com/help/4021566/windows-10-send-feedback-to-microsoft-with-feedback-hub-app", "_op_documentIdPathDepotMapping": { "./": { "depot_name": "MSDN.windows-hub" diff --git a/windows/security/docfx.json b/windows/security/docfx.json index 18fe87fb57..394ca15239 100644 --- a/windows/security/docfx.json +++ b/windows/security/docfx.json @@ -36,6 +36,9 @@ "breadcrumb_path": "/windows/windows-10/breadcrumb/toc.json", "ms.technology": "windows", "ms.topic": "article", + "feedback_system": "GitHub", + "feedback_github_repo": "MicrosoftDocs/windows-itpro-docs", + "feedback_product_url": "https://support.microsoft.com/help/4021566/windows-10-send-feedback-to-microsoft-with-feedback-hub-app", "ms.author": "justinha" }, "fileMetadata": {}, diff --git a/windows/security/threat-protection/TOC.md b/windows/security/threat-protection/TOC.md index e0c3ba2050..d5c63e1673 100644 --- a/windows/security/threat-protection/TOC.md +++ b/windows/security/threat-protection/TOC.md @@ -39,7 +39,7 @@ ### [Understand the Windows Defender ATP portal](windows-defender-atp\use-windows-defender-advanced-threat-protection.md) #### [Portal overview](windows-defender-atp\portal-overview-windows-defender-advanced-threat-protection.md) #### [View the Security operations dashboard](windows-defender-atp\dashboard-windows-defender-advanced-threat-protection.md) -#### [View the Security analytics dashboard](windows-defender-atp\security-analytics-dashboard-windows-defender-advanced-threat-protection.md) +#### [View the Secure score dashboard](windows-defender-atp\security-analytics-dashboard-windows-defender-advanced-threat-protection.md) #### [View the Threat analytics dashboard](windows-defender-atp\threat-analytics-windows-defender-advanced-threat-protection.md) ###Investigate and remediate threats diff --git a/windows/security/threat-protection/windows-defender-antivirus/detect-block-potentially-unwanted-apps-windows-defender-antivirus.md b/windows/security/threat-protection/windows-defender-antivirus/detect-block-potentially-unwanted-apps-windows-defender-antivirus.md index b30883b882..9f225964af 100644 --- a/windows/security/threat-protection/windows-defender-antivirus/detect-block-potentially-unwanted-apps-windows-defender-antivirus.md +++ b/windows/security/threat-protection/windows-defender-antivirus/detect-block-potentially-unwanted-apps-windows-defender-antivirus.md @@ -50,7 +50,7 @@ PUAs are blocked when a user attempts to download or install the detected file, - The file is being scanned from the browser - The file is in a folder with "**downloads**" in the path - The file is in a folder with "**temp**" in the path -- The file is on the user's Dekstop +- The file is on the user's Desktop - The file does not meet one of these conditions and is not under *%programfiles%*, *%appdata%*, or *%windows%* The file is placed in the quarantine section so it won't run. diff --git a/windows/security/threat-protection/windows-defender-atp/alerts-queue-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/alerts-queue-windows-defender-advanced-threat-protection.md index fea04741f7..489d6db5d4 100644 --- a/windows/security/threat-protection/windows-defender-atp/alerts-queue-windows-defender-advanced-threat-protection.md +++ b/windows/security/threat-protection/windows-defender-atp/alerts-queue-windows-defender-advanced-threat-protection.md @@ -10,7 +10,7 @@ ms.pagetype: security ms.author: macapara author: mjcaparas ms.localizationpriority: high -ms.date: 11/09/2017 +ms.date: 03/12/2018 --- # View and organize the Windows Defender Advanced Threat Protection Alerts queue @@ -135,7 +135,7 @@ Select multiple alerts (Ctrl or Shift select) and manage or edit alerts together ## Related topics - [View the Windows Defender Advanced Threat Protection Security operations dashboard](dashboard-windows-defender-advanced-threat-protection.md) -- [View the Windows Defender Advanced Threat Protection Security analytics dashboard](security-analytics-dashboard-windows-defender-advanced-threat-protection.md) +- [View the Windows Defender Advanced Threat Protection Secure score dashboard](security-analytics-dashboard-windows-defender-advanced-threat-protection.md) - [Investigate Windows Defender Advanced Threat Protection alerts](investigate-alerts-windows-defender-advanced-threat-protection.md) - [Investigate a file associated with a Windows Defender ATP alert](investigate-files-windows-defender-advanced-threat-protection.md) - [Investigate an IP address associated with a Windows Defender ATP alert](investigate-ip-windows-defender-advanced-threat-protection.md) diff --git a/windows/security/threat-protection/windows-defender-atp/enable-security-analytics-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/enable-security-analytics-windows-defender-advanced-threat-protection.md index 2ff55bdc25..fc7325015e 100644 --- a/windows/security/threat-protection/windows-defender-atp/enable-security-analytics-windows-defender-advanced-threat-protection.md +++ b/windows/security/threat-protection/windows-defender-atp/enable-security-analytics-windows-defender-advanced-threat-protection.md @@ -1,7 +1,7 @@ --- -title: Enable Security Analytics in Windows Defender ATP -description: Set the baselines for calculating the score of Windows Defender security controls on the Security Analytics dashboard. -keywords: enable security analytics, baseline, calculation, analytics, score, security analytics dashboard, dashboard +title: Enable Secure score security controls in Windows Defender ATP +description: Set the baselines for calculating the score of Windows Defender security controls on the Secure score dashboard. +keywords: secure score, baseline, calculation, score, secure score dashboard, dashboard, windows defender antivirus, av, exploit guard, application guard, smartscreen search.product: eADQiWindows 10XVcnh ms.prod: w10 ms.mktglfcycl: deploy @@ -10,10 +10,10 @@ ms.pagetype: security ms.author: macapara author: mjcaparas ms.localizationpriority: high -ms.date: 10/16/2017 +ms.date: 03/12/2018 --- -# Enable Security Analytics security controls +# Enable Secure score security controls **Applies to:** @@ -25,21 +25,21 @@ ms.date: 10/16/2017 -Set the baselines for calculating the score of Windows Defender security controls on the Security Analytics dashboard. If you use third-party solutions, consider excluding the corresponding controls from the calculations. +Set the baselines for calculating the score of Windows Defender security controls on the Secure score dashboard. If you use third-party solutions, consider excluding the corresponding controls from the calculations. >[!NOTE] >Changes might take up to a few hours to reflect on the dashboard. -1. In the navigation pane, select **Preferences setup** > **Security Analytics**. +1. In the navigation pane, select **Preferences setup** > **Secure score**. - ![Image of Security Analytics controls from Preferences setup menu](images/atp-enable-security-analytics.png) + ![Image of Secure score controls from Preferences setup menu](images/atp-enable-security-analytics.png) 2. Select the security control, then toggle the setting between **On** and **Off**. 3. Click **Save preferences**. ## Related topics -- [View the Security Analytics dashboard](security-analytics-dashboard-windows-defender-advanced-threat-protection.md) +- [View the Secure score dashboard](security-analytics-dashboard-windows-defender-advanced-threat-protection.md) - [Update general settings in Windows Defender ATP](general-settings-windows-defender-advanced-threat-protection.md) - [Turn on advanced features in Windows Defender ATP](advanced-features-windows-defender-advanced-threat-protection.md) - [Turn on the preview experience in Windows Defender ATP](preview-settings-windows-defender-advanced-threat-protection.md) diff --git a/windows/security/threat-protection/windows-defender-atp/machines-view-overview-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/machines-view-overview-windows-defender-advanced-threat-protection.md index 4c24bf012f..b25f671461 100644 --- a/windows/security/threat-protection/windows-defender-atp/machines-view-overview-windows-defender-advanced-threat-protection.md +++ b/windows/security/threat-protection/windows-defender-atp/machines-view-overview-windows-defender-advanced-threat-protection.md @@ -10,7 +10,7 @@ ms.pagetype: security ms.author: macapara author: mjcaparas ms.localizationpriority: high -ms.date: 10/23/2017 +ms.date: 03/12/2018 --- # View and organize the Windows Defender ATP Machines list @@ -80,7 +80,7 @@ Filter the list to view specific machines that are well configured or require at - **Well configured** - Machines have the Windows Defender security controls well configured. - **Requires attention** - Machines where improvements can be made to increase the overall security posture of your organization. -For more information, see [View the Security Analytics dashboard](security-analytics-dashboard-windows-defender-advanced-threat-protection.md). +For more information, see [View the Secure score dashboard](security-analytics-dashboard-windows-defender-advanced-threat-protection.md). **Malware category alerts**
    Filter the list to view specific machines grouped together by the following malware categories: diff --git a/windows/security/threat-protection/windows-defender-atp/portal-overview-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/portal-overview-windows-defender-advanced-threat-protection.md index adef15a6bb..14d4fc1ac4 100644 --- a/windows/security/threat-protection/windows-defender-atp/portal-overview-windows-defender-advanced-threat-protection.md +++ b/windows/security/threat-protection/windows-defender-atp/portal-overview-windows-defender-advanced-threat-protection.md @@ -10,7 +10,7 @@ ms.pagetype: security ms.author: macapara author: DulceMV ms.localizationpriority: high -ms.date: 10/19/2017 +ms.date: 03/12/2018 --- # Windows Defender Advanced Threat Protection portal overview @@ -51,11 +51,11 @@ You can navigate through the portal using the menu options available in all sect Area | Description :---|:--- (1) Navigation pane | Use the navigation pane to move between the **Dashboards**, **Alerts queue**, **Machines list**, **Service health**, **Preferences setup**, and **Endpoint management**. -**Dashboards** | Enables you to view the Security operations or the Security analytics dashboard. -**Alerts queue** | Enables you to view separate queues of new, in progress, resolved alerts, alerts assigned to you, and suppression rules. +**Dashboards** | Allows you to access the Security operations or the Secure score dashboard. +**Alerts queue** | Allows you to view separate queues: new, in progress, resolved alerts, alerts assigned to you, and suppression rules. **Machines list** | Displays the list of machines that are onboarded to Windows Defender ATP, some information about them, and the corresponding number of alerts. **Service health** | Provides information on the current status of the Window Defender ATP service. You'll be able to verify that the service health is healthy or if there are current issues. -**Preferences setup** | Shows the settings you selected during onboarding and lets you update your industry preferences and retention policy period. You can also set other configuration settings such as email notifications, activate the preview experience, enable or turn off advanced features, SIEM integration, threat intel API, build Power BI reports, and set baselines for the Security analytics dashboard. +**Preferences setup** | Shows the settings you selected during onboarding and lets you update your industry preferences and retention policy period. You can also set other configuration settings such as email notifications, activate the preview experience, enable or turn off advanced features, SIEM integration, threat intel API, build Power BI reports, and set baselines for the Secure score dashboard. **Endpoint management** | Provides access to endpoints such as clients and servers. Allows you to download the onboarding configuration package for endpoints. It also provides access to endpoint offboarding. **Community center** | Access the Community center to learn, collaborate, and share experiences about the product. (2) Main portal| Main area where you will see the different views such as the Dashboards, Alerts queue, and Machines list. diff --git a/windows/security/threat-protection/windows-defender-atp/security-analytics-dashboard-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/security-analytics-dashboard-windows-defender-advanced-threat-protection.md index a7f177c650..6ea27c4f75 100644 --- a/windows/security/threat-protection/windows-defender-atp/security-analytics-dashboard-windows-defender-advanced-threat-protection.md +++ b/windows/security/threat-protection/windows-defender-atp/security-analytics-dashboard-windows-defender-advanced-threat-protection.md @@ -1,7 +1,7 @@ --- -title: View the Security Analytics dashboard in Windows Defender ATP -description: Use the Security Analytics dashboard to assess and improve the security state of your organization by analyzing various security control tiles. -keywords: security analytics, dashboard, security recommendations, security control state, security score, score improvement, organizational security score, security coverage, security control, improvement opportunities, edr, antivirus, av, os security updates +title: View the Secure score dashboard in Windows Defender ATP +description: Use the Secure score dashboard to assess and improve the security state of your organization by analyzing various security control tiles. +keywords: secure score, dashboard, security recommendations, security control state, security score, score improvement, organizational security score, security coverage, security control, improvement opportunities, edr, antivirus, av, os security updates search.product: eADQiWindows 10XVcnh ms.prod: w10 ms.mktglfcycl: deploy @@ -9,10 +9,10 @@ ms.sitesec: library ms.pagetype: security author: mjcaparas localizationpriority: high -ms.date: 11/17/2017 +ms.date: 03/12/2018 --- -# View the Windows Defender Advanced Threat Protection Security analytics dashboard +# View the Windows Defender Advanced Threat Protection Secure score dashboard **Applies to:** @@ -27,18 +27,18 @@ ms.date: 11/17/2017 >Want to experience Windows Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-sadashboard-abovefoldlink) -The Security Analytics dashboard expands your visibility into the overall security posture of your organization. From this dashboard, you'll be able to quickly assess the security posture of your organization, see machines that require attention, as well as recommendations for actions to further reduce the attack surface in your organization - all in one place. From there you can take action based on the recommended configuration baselines. +The Secure score dashboard expands your visibility into the overall security posture of your organization. From this dashboard, you'll be able to quickly assess the security posture of your organization, see machines that require attention, as well as recommendations for actions to further reduce the attack surface in your organization - all in one place. From there you can take action based on the recommended configuration baselines. >[!IMPORTANT] > This feature is available for machines on Windows 10, version 1703 or later. -The **Security analytics dashboard** displays a snapshot of: +The **Secure score dashboard** displays a snapshot of: - Organizational security score - Security coverage - Improvement opportunities - Security score over time -![Security analytics dashboard](images/atp-dashboard-security-analytics-full.png) +![Secure score dashboard](images/atp-dashboard-security-analytics-full.png) ## Organizational security score The organization security score is reflective of the average score of all the Windows Defender security controls that are configured according to the recommended baseline. You can improve this score by taking the steps in configuring each of the security controls in the optimal settings. @@ -52,7 +52,7 @@ The denominator is reflective of the organizational score potential and calculat In the example image, the total points from the **Improvement opportunities** tile add up to 321 points for the six pillars from the **Security coverage** tile. -You can set the baselines for calculating the score of Windows Defender security controls on the Security Analytics dashboard through the **Preferences settings**. For more information, see [Enable Security Analytics security controls](enable-security-analytics-windows-defender-advanced-threat-protection.md). +You can set the baselines for calculating the score of Windows Defender security controls on the Secure score dashboard through the **Preferences settings**. For more information, see [Enable Secure score security controls](enable-security-analytics-windows-defender-advanced-threat-protection.md). ## Security coverage The security coverage tile shows a bar graph where each bar represents a Windows Defender security control. Each bar reflects the number of machines that are well configured and those that require **any kind of attention** for each security control. Hovering on top of the individual bars will show exact numbers for each category. Machines that are green are well configured, while machines that are orange require some level of attention. @@ -241,7 +241,7 @@ For more information, see [Windows Defender SmartScreen](../windows-defender-sma >Want to experience Windows Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-sadashboard-belowfoldlink) ## Related topics -- [Enable Security Analytics security controls](enable-security-analytics-windows-defender-advanced-threat-protection.md) +- [Enable Secure score security controls](enable-security-analytics-windows-defender-advanced-threat-protection.md) - [View the Security operations dashboard](dashboard-windows-defender-advanced-threat-protection.md) - [View and organize the Windows Defender Advanced Threat Protection Alerts queue ](alerts-queue-windows-defender-advanced-threat-protection.md) - [Investigate Windows Defender Advanced Threat Protection alerts](investigate-alerts-windows-defender-advanced-threat-protection.md) diff --git a/windows/security/threat-protection/windows-defender-atp/use-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/use-windows-defender-advanced-threat-protection.md index 75aed7ba70..9ec694fdde 100644 --- a/windows/security/threat-protection/windows-defender-atp/use-windows-defender-advanced-threat-protection.md +++ b/windows/security/threat-protection/windows-defender-atp/use-windows-defender-advanced-threat-protection.md @@ -10,7 +10,7 @@ ms.pagetype: security ms.author: macapara author: mjcaparas ms.localizationpriority: high -ms.date: 02/13/2018 +ms.date: 03/12/2018 --- # Use the Windows Defender Advanced Threat Protection portal @@ -31,7 +31,7 @@ You can use the Windows Defender ATP portal to carry out an end-to-end security Use the **Security operations** dashboard to gain insight on the various alerts on machines and users in your network. -Use the **Security analytics** dashboard to expand your visibility on the overall security posture of your organization. You'll see machines that require attention and recommendations that can help you reduce the attack surface in your organization. +Use the **Secure score** dashboard to expand your visibility on the overall security posture of your organization. You'll see machines that require attention and recommendations that can help you reduce the attack surface in your organization. ### In this section @@ -40,6 +40,6 @@ Topic | Description :---|:--- [Portal overview](portal-overview-windows-defender-advanced-threat-protection.md) | Understand the portal layout and area descriptions. [View the Windows Defender Advanced Threat Protection Security operations dashboard](dashboard-windows-defender-advanced-threat-protection.md) | The Windows Defender ATP **Security operations dashboard** provides a snapshot of your network. You can view aggregates of alerts, the overall status of the service of the endpoints on your network, investigate machines, files, and URLs, and see snapshots of threats seen on machines. -[View the Windows Defender Advanced Threat Protection Security analytics dashboard](security-analytics-dashboard-windows-defender-advanced-threat-protection.md) | The **Security Analytics dashboard** expands your visibility into the overall security posture of your organization. From this dashboard, you'll be able to quickly assess the security posture of your organization, see machines that require attention, as well as recommendations for actions to further reduce the attack surface in your organization - all in one place. +[View the Windows Defender Advanced Threat Protection Secure score dashboard](security-analytics-dashboard-windows-defender-advanced-threat-protection.md) | The **Secure score dashboard** expands your visibility into the overall security posture of your organization. From this dashboard, you'll be able to quickly assess the security posture of your organization, see machines that require attention, as well as recommendations for actions to further reduce the attack surface in your organization - all in one place. diff --git a/windows/security/threat-protection/windows-defender-atp/windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/windows-defender-advanced-threat-protection.md index 42fe8383b5..a82528a68f 100644 --- a/windows/security/threat-protection/windows-defender-atp/windows-defender-advanced-threat-protection.md +++ b/windows/security/threat-protection/windows-defender-atp/windows-defender-advanced-threat-protection.md @@ -1,7 +1,7 @@ --- title: Windows Defender Advanced Threat Protection - Windows Defender description: Windows Defender Advanced Threat Protection is an enterprise security service that helps detect and respond to possible cybersecurity threats related to advanced persistent threats. -keywords: introduction to Windows Defender Advanced Threat Protection, introduction to Windows Defender ATP, cybersecurity, advanced persistent threat, enterprise security, endpoint behavioral sensor, cloud security, analytics, threat intelligence +keywords: introduction to Windows Defender Advanced Threat Protection, introduction to Windows Defender ATP, cybersecurity, advanced persistent threat, enterprise security, endpoint behavioral sensor, cloud security, score, threat intelligence search.product: eADQiWindows 10XVcnh ms.prod: w10 ms.mktglfcycl: deploy @@ -10,7 +10,7 @@ ms.pagetype: security ms.author: macapara author: mjcaparas ms.localizationpriority: high -ms.date: 11/13/2017 +ms.date: 03/12/2018 --- # Windows Defender Advanced Threat Protection diff --git a/windows/whats-new/docfx.json b/windows/whats-new/docfx.json index 1bbc64ff9e..34346b0e9c 100644 --- a/windows/whats-new/docfx.json +++ b/windows/whats-new/docfx.json @@ -37,6 +37,9 @@ "ms.topic": "article", "ms.author": "trudyha", "ms.date": "04/05/2017", + "feedback_system": "GitHub", + "feedback_github_repo": "MicrosoftDocs/windows-itpro-docs", + "feedback_product_url": "https://support.microsoft.com/help/4021566/windows-10-send-feedback-to-microsoft-with-feedback-hub-app", "_op_documentIdPathDepotMapping": { "./": { "depot_name": "MSDN.win-whats-new"