diff --git a/windows/client-management/mdm/bitlocker-csp.md b/windows/client-management/mdm/bitlocker-csp.md index 5d09981ed6..82139a98a6 100644 --- a/windows/client-management/mdm/bitlocker-csp.md +++ b/windows/client-management/mdm/bitlocker-csp.md @@ -6,12 +6,16 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: lomayor -ms.date: 08/05/2019 +ms.localizationpriority: medium +ms.date: 09/27/2019 ms.reviewer: manager: dansimp --- # BitLocker CSP +> [!WARNING] +> Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. + The BitLocker configuration service provider (CSP) is used by the enterprise to manage encryption of PCs and devices. This CSP was added in Windows 10, version 1703. Starting in Windows 10, version 1809, it is also supported in Windows 10 Pro. > [!NOTE] @@ -25,7 +29,7 @@ For RequireDeviceEncryption and RequireStorageCardEncryption, the Get operation The following diagram shows the BitLocker configuration service provider in tree format. -![bitlocker csp](images/provisioning-csp-bitlocker.png) +![BitLocker csp](images/provisioning-csp-bitlocker.png) **./Device/Vendor/MSFT/BitLocker** Defines the root node for the BitLocker configuration service provider. @@ -57,7 +61,7 @@ Allows the administrator to require storage card encryption on the device. This Data type is integer. Sample value for this node to enable this policy: 1. Disabling this policy will not turn off the encryption on the storage card, but the user will no longer be prompted to turn it on. - 0 (default) – Storage cards do not need to be encrypted. -- 1 – Require Storage cards to be encrypted. +- 1 – Require storage cards to be encrypted. Disabling this policy will not turn off the encryption on the system card, but the user will no longer be prompted to turn it on. @@ -125,10 +129,10 @@ Encryptable fixed data volumes are treated similarly to OS volumes. However, fix The following list shows the supported values: -- 0 (default) – Disable. If the policy setting is not set or is set to 0, the device's enforcement status will not be checked. The policy will not enforce encryption and it will not decrypt encrypted volumes. -- 1 – Enable. The device's enforcement status will be checked. Setting this policy to 1 will trigger encryption of all drives (silently or non-silently based on [AllowWarningForOtherDiskEncryption](#allowwarningforotherdiskencryption) policy). +- 0 (default) — Disable. If the policy setting is not set or is set to 0, the device's enforcement status is not checked. The policy does not enforce encryption and it does not decrypt encrypted volumes. +- 1 – Enable. The device's enforcement status is checked. Setting this policy to 1 triggers encryption of all drives (silently or non-silently based on [AllowWarningForOtherDiskEncryption](#allowwarningforotherdiskencryption) policy). -If you want to disable this policy use the following SyncML: +If you want to disable this policy, use the following SyncML: ```xml @@ -151,7 +155,7 @@ If you want to disable this policy use the following SyncML: **EncryptionMethodByDriveType** -Allows you to set the default encrytion method for each of the different drive types: operating system drives, fixed data drives, and removable data drives. Hidden, system and recovery partitions are skipped from encryption. This setting is a direct mapping to the Bitlocker Group Policy "Choose drive encryption method and cipher strength (Windows 10 [Version 1511] and later)". +Allows you to set the default encryption method for each of the different drive types: operating system drives, fixed data drives, and removable data drives. Hidden, system, and recovery partitions are skipped from encryption. This setting is a direct mapping to the Bitlocker Group Policy "Choose drive encryption method and cipher strength (Windows 10 [Version 1511] and later)". @@ -520,7 +524,8 @@ Set "OSActiveDirectoryBackup_Name" (Save BitLocker recovery informatio Set the "OSRequireActiveDirectoryBackup_Name" (Do not enable BitLocker until recovery information is stored in AD DS for operating system drives) data field if you want to prevent users from enabling BitLocker unless the computer is connected to the domain and the backup of BitLocker recovery information to AD DS succeeds. -> [!Note]
> If the "OSRequireActiveDirectoryBackup_Name" (Do not enable BitLocker until recovery information is stored in AD DS for operating system drives) data field is set, a recovery password is automatically generated. +> [!Note] +> If the "OSRequireActiveDirectoryBackup_Name" (Do not enable BitLocker until recovery information is stored in AD DS for operating system drives) data field is set, a recovery password is automatically generated. If you enable this setting, you can control the methods available to users to recover data from BitLocker-protected operating system drives. @@ -532,26 +537,18 @@ Sample value for this node to enable this policy is: ``` -The possible values for 'xx' are: -
    -
  • true = Explicitly allow
    • -
  • false = Policy not set
    • -
  • -
+The possible values for 'xx' are: +- true = Explicitly allow +- false = Policy not set -The possible values for 'yy' are: -
    -
  • 2 = Allowed
    • -
  • 1 = Required
    • -
  • 0 = Disallowed
    • -
+The possible values for 'yy' are: +- 2 = Allowed +- 1 = Required +- 0 = Disallowed -The possible values for 'zz' are: -
    -
  • 2 = Store recovery passwords only
    • -
  • 1 = Store recovery passwords and key packages
    • -
  • -
+The possible values for 'zz' are: +- 2 = Store recovery passwords only +- 1 = Store recovery passwords and key packages Disabling the policy will let the system choose the default behaviors. If you want to disable this policy use the following SyncML: @@ -896,6 +893,161 @@ If you want to disable this policy use the following SyncML: ``` + +**ConfigureRecoveryPasswordRotation** +This setting initiates a client-driven recovery password refresh after an OS drive recovery (either by using bootmgr or WinRE) and recovery password unlock on a Fixed data drive. This setting will refresh the specific recovery password that was used, and other unused passwords on the volume will remain unchanged. If the initialization of the refresh fails, the device will retry the refresh during the next reboot. When password refresh is initiated, the client will generate a new recovery password. The client will use the existing API in Azure AD to upload the new recovery key and retry on failure. After the recovery password has been successfully backed up to Azure AD, the recovery key that was used locally will be removed. This setting refreshes only the used key and retains other unused keys. +
Home
+ + + + + + + + + + + + + + + + + + +
HomeProBusinessEnterpriseEducationMobileMobile Enterprise
cross markcheck markcheck markcheck markcheck markcross markcross mark
+Value type is int. Supported operations are Add, Delete, Get, and Replace. + +Supported values are: +- 0 – Refresh off (default) +- 1 – Refresh on for Azure AD-joined devices +- 2 – Refresh on for both Azure AD-joined and hybrid-joined devices + +**RotateRecoveryPasswords** +This setting refreshes all recovery passwords for OS and fixed drives (removable drives are not included so they can be shared between users). All recovery passwords for all drives will be refreshed and only one password per volume is retained. In case of errors, an error code will be returned so that server can take appropriate action to remediate. + +The client will generate a new recovery password. The client will use the existing API in Azure AD to upload the new recovery key and retry on failure. + +Policy type is Execute. When “Execute Policy” is pushed, the client sets the status as Pending and initiates an asynchronous rotation operation. After refresh is complete, pass or fail status is updated. The client will not retry, but if needed, the server can re-issue the execute request. + +Server can call Get on the RotateRecoveryPasswordsRotationStatus node to query the status of the refresh. + +Recovery password refresh will only occur for devices that are joined to Azure AD or joined to both Azure AD and on-premises (hybrid Azure AD-joined) that run a Windows 10 edition with the BitLocker CSP (Pro/Enterprise). Devices cannot refresh recovery passwords if they are only registered in Azure AD (also known as workplace-joined) or signed in with a Microsoft account. + +Each server-side recovery key rotation is represented by a request ID. The server can query the following nodes to make sure it reads status/result for same rotation request. +- RotateRecoveryPasswordsRequestID: Returns request ID of last request processed. +- RotateRecoveryPasswordsRotationStatus: Returns status of last request processed. + + + + + + + + + + + + + + + + + + + +
HomeProBusinessEnterpriseEducationMobileMobile Enterprise
cross markcheck markcheck markcheck markcheck markcross markcross mark
+Value type is string. Supported operation is Execute. Request ID is expected as a parameter. + +**Status** +Interior node. Supported operation is Get. + +**Status/DeviceEncryptionStatus** +This node reports compliance state of device encryption on the system. + + + + + + + + + + + + + + + + + + + + +
HomeProBusinessEnterpriseEducationMobileMobile Enterprise
cross markcheck markcheck markcheck markcheck markcross markcross mark
+ +Supported values: +- 0 - Indicates that the device is compliant. +- Any other value represents a non-compliant device. + +Value type is int. Supported operation is Get. + +**Status/RotateRecoveryPasswordsStatus** +This node reports the status of RotateRecoveryPasswords request. + +Status code can be one of the following: + +- 2 – Not started +- 1 - Pending +- 0 - Pass +- Any other code - Failure HRESULT + + + + + + + + + + + + + + + + + + + +
HomeProBusinessEnterpriseEducationMobileMobile Enterprise
cross markcheck markcheck markcheck markcheck markcross markcross mark
+Value type is int. Supported operation is Get. + +**Status/RotateRecoveryPasswordsRequestID** +This node reports the RequestID corresponding to RotateRecoveryPasswordsStatus. +This node needs to be queried in synchronization with RotateRecoveryPasswordsStatus to ensure the status is correctly matched to the request ID. + + + + + + + + + + + + + + + + + + + +
HomeProBusinessEnterpriseEducationMobileMobile Enterprise
cross markcheck markcheck markcheck markcheck markcross markcross mark
+Value type is string. Supported operation is Get. + ### SyncML example The following example is provided to show proper format and should not be taken as a recommendation. @@ -1058,4 +1210,4 @@ The following example is provided to show proper format and should not be taken -``` +``` \ No newline at end of file diff --git a/windows/client-management/mdm/bitlocker-ddf-file.md b/windows/client-management/mdm/bitlocker-ddf-file.md index 1fed0144fa..19421997ba 100644 --- a/windows/client-management/mdm/bitlocker-ddf-file.md +++ b/windows/client-management/mdm/bitlocker-ddf-file.md @@ -6,7 +6,8 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: lomayor -ms.date: 06/29/2018 +ms.localizationpriority: medium +ms.date: 09/30/2019 ms.reviewer: manager: dansimp --- @@ -20,7 +21,7 @@ This topic shows the OMA DM device description framework (DDF) for the **BitLock Looking for the DDF XML files? See [CSP DDF files download](configuration-service-provider-reference.md#csp-ddf-files-download). -The XML below is the current version Windows 10, version 1809. +The XML below is the current version for this CSP. ```xml @@ -46,7 +47,7 @@ The XML below is the current version Windows 10, version 1809. - com.microsoft/3.0/MDM/BitLocker + com.microsoft/5.0/MDM/BitLocker @@ -736,6 +737,206 @@ The XML below is the current version Windows 10, version 1809. + + + ConfigureRecoveryPasswordRotation + + + + + + + + Allows Admin to configure Numeric Recovery Password Rotation upon use for OS and fixed drives on AAD and Hybrid domain joined devices. + When not configured, Rotation is turned on by default for AAD only and off on Hybrid. The Policy will be effective only when + Active Directory back up for recovery password is configured to required. + For OS drive: Turn on "Do not enable Bitlocker until recovery information is stored to AD DS for operating system drives" + For Fixed drives: Turn on "Do not enable Bitlocker until recovery information is stored to AD DS for fixed data drives" + + Supported Values: 0 - Numeric Recovery Passwords rotation OFF. + 1 - Numeric Recovery Passwords Rotation upon use ON for AAD joined devices. Default value + 2 - Numeric Recovery Passwords Rotation upon use ON for both AAD and Hybrid devices + + If you want to disable this policy use the following SyncML: + + + 112 + + + ./Device/Vendor/MSFT/BitLocker/ConfigureRecoveryPasswordRotation + + + int + + 0 + + + + + + + + + + + + + + text/plain + + + + + + + + + + + RotateRecoveryPasswords + + + + + Allows admin to push one-time rotation of all numeric recovery passwords for OS and Fixed Data drives on an Azure Active Directory or hybrid-joined device. + This policy is Execute type and rotates all numeric passwords when issued from MDM tools. + +The policy only comes into effect when Active Directory backup for a recovery password is configured to "required." + * For OS drives, enable "Do not enable BitLocker until recovery information is stored to Active Directory Domain Services for operating system drives." + *For fixed drives, enable "Do not enable BitLocker until recovery information is stored to Active Directory Domain Services for fixed data drives." + + Client returns status DM_S_ACCEPTED_FOR_PROCESSING to indicate the rotation has started. Server can query status with the following status nodes: + +* status\RotateRecoveryPasswordsStatus + * status\RotateRecoveryPasswordsRequestID + + + +Supported Values: String form of request ID. Example format of request ID is GUID. Server can choose the format as needed according to the management tools.\ + + + 113 + + + ./Device/Vendor/MSFT/BitLocker/RotateRecoveryPasswords + + + chr + + <RequestID/> + + + + + + + + + + + + + + text/plain + + + + + + Status + + + + + + + + + + + + + + + + + + + DeviceEncryptionStatus + + + + + This node reports compliance state of device encryption on the system. + Value '0' means the device is compliant. Any other value represents a non-compliant device. + + + + + + + + + + + + text/plain + + + + + + RotateRecoveryPasswordsStatus + + + + + This Node reports the status of RotateRecoveryPasswords request. + Status code can be one of the following: + NotStarted(2), Pending (1), Pass (0), Other error codes in case of failure + + + + + + + + + + + + + text/plain + + + + + + RotateRecoveryPasswordsRequestID + + + + + This Node reports the RequestID corresponding to RotateRecoveryPasswordsStatus. + This node needs to be queried in synchronization with RotateRecoveryPasswordsStatus + To ensure the status is correctly matched to the request ID. + + + + + + + + + + + + + text/plain + + + + ``` diff --git a/windows/client-management/mdm/images/provisioning-csp-bitlocker.png b/windows/client-management/mdm/images/provisioning-csp-bitlocker.png index d3d33ff9f6..63ccb6fc89 100644 Binary files a/windows/client-management/mdm/images/provisioning-csp-bitlocker.png and b/windows/client-management/mdm/images/provisioning-csp-bitlocker.png differ diff --git a/windows/client-management/mdm/new-in-windows-mdm-enrollment-management.md b/windows/client-management/mdm/new-in-windows-mdm-enrollment-management.md index 669c192776..43377d2ca0 100644 --- a/windows/client-management/mdm/new-in-windows-mdm-enrollment-management.md +++ b/windows/client-management/mdm/new-in-windows-mdm-enrollment-management.md @@ -24,6 +24,7 @@ This topic provides information about what's new and breaking changes in Windows For details about Microsoft mobile device management protocols for Windows 10 see [\[MS-MDM\]: Mobile Device Management Protocol](https://go.microsoft.com/fwlink/p/?LinkId=619346) and [\[MS-MDE2\]: Mobile Device Enrollment Protocol Version 2]( http://go.microsoft.com/fwlink/p/?LinkId=619347). - **What’s new in MDM for Windows 10 versions** + - [What’s new in MDM for Windows 10, version 1909](#whats-new-in-mdm-for-windows-10-version-1909) - [What’s new in MDM for Windows 10, version 1903](#whats-new-in-mdm-for-windows-10-version-1903) - [What’s new in MDM for Windows 10, version 1809](#whats-new-in-mdm-for-windows-10-version-1809) - [What’s new in MDM for Windows 10, version 1803](#whats-new-in-mdm-for-windows-10-version-1803) @@ -57,6 +58,7 @@ For details about Microsoft mobile device management protocols for Windows 10 s - [What is dmwappushsvc?](#what-is-dmwappushsvc) - **Change history in MDM documentation** + - [October 2019](#october-2019) - [September 2019](#september-2019) - [August 2019](#august-2019) - [July 2019](#july-2019) @@ -82,6 +84,27 @@ For details about Microsoft mobile device management protocols for Windows 10 s - [September 2017](#september-2017) - [August 2017](#august-2017) +## What’s new in MDM for Windows 10, version 1909 + ++++ + + + + + + + + + + + +
New or updated topicDescription
BitLocker CSP
Added the following new nodes in Windows 10, version 1909:

+ConfigureRecoveryPasswordRotation, RotateRecoveryPasswords, RotateRecoveryPasswordsStatus, RotateRecoveryPasswordsRequestID. +
+ ## What’s new in MDM for Windows 10, version 1903 @@ -1906,6 +1929,17 @@ What data is handled by dmwappushsvc? | It is a component handling the internal How do I turn if off? | The service can be stopped from the "Services" console on the device (Start > Run > services.msc). However, since this is a component part of the OS and required for the proper functioning of the device, we strongly recommend not to do this. | ## Change history in MDM documentation +### October 2019 + +|New or updated topic | Description| +|--- | ---| +|[BitLocker CSP](bitlocker-csp.md)|Added the following new nodes:
ConfigureRecoveryPasswordRotation, RotateRecoveryPasswords, RotateRecoveryPasswordsStatus, RotateRecoveryPasswordsRequestID| + +### October 2019 + +|New or updated topic | Description| +|--- | ---| +|[Policy CSP - Update](policy-csp-update.md)|Added the following new policy:
Update/TargetReleaseVersion| ### September 2019 diff --git a/windows/client-management/mdm/policy-configuration-service-provider.md b/windows/client-management/mdm/policy-configuration-service-provider.md index a3263e6af0..b030093ff9 100644 --- a/windows/client-management/mdm/policy-configuration-service-provider.md +++ b/windows/client-management/mdm/policy-configuration-service-provider.md @@ -3788,6 +3788,9 @@ The following diagram shows the Policy configuration service provider in tree fo
Update/SetEDURestart
+
+ Update/TargetReleaseVersion +
Update/UpdateNotificationLevel
diff --git a/windows/client-management/mdm/policy-csp-update.md b/windows/client-management/mdm/policy-csp-update.md index 6458e458b5..3eada3bc25 100644 --- a/windows/client-management/mdm/policy-csp-update.md +++ b/windows/client-management/mdm/policy-csp-update.md @@ -6,14 +6,16 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: manikadhiman -ms.date: 09/27/2019 +ms.localizationpriority: medium +ms.date: 10/04/2019 ms.reviewer: manager: dansimp --- # Policy CSP - Update - +> [!WARNING] +> Some information relates to prereleased products, which may be substantially modified before they are commercially released. Microsoft makes no warranties, expressed or implied, concerning the information provided here. > [!NOTE] > If the MSA service is disabled, Windows Update will no longer offer feature updates to devices running Windows 10 1709 or higher. See [Feature updates are not being offered while other updates are](https://docs.microsoft.com/windows/deployment/update/windows-update-troubleshooting#feature-updates-are-not-being-offered-while-other-updates-are). @@ -195,6 +197,9 @@ manager: dansimp
Update/SetEDURestart
+
+ Update/TargetReleaseVersion +
Update/UpdateNotificationLevel
@@ -4575,6 +4580,82 @@ The following list shows the supported values:
+ +**Update/TargetReleaseVersion** + + +
+ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Windows EditionSupported?
Homecross mark
Procheck mark7
Businesscheck mark7
Enterprisecheck mark7
Educationcheck mark7
Mobile
Mobile Enterprise
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +Enables IT administrators to specify which version they would like their device(s) to move to and/or stay on until they reach end of service or reconfigure the policy. For details about different Windows 10 versions, see [Windows 10 release information](https://docs.microsoft.com/windows/release-information/). + + +ADMX Info: +- GP English name: *Select the target Feature Update version* +- GP name: *TargetReleaseVersion* +- GP element: *TargetReleaseVersionId* +- GP path: *Windows Components/Windows Update/Windows Update for Business* +- GP ADMX file name: *WindowsUpdate.admx* + + + +Value type is a string containing Windows 10 version number. For example, 1809, 1903. + + + + + + + + + +
+ **Update/UpdateNotificationLevel** @@ -4846,6 +4927,6 @@ Footnotes: - 4 - Added in Windows 10, version 1803. - 5 - Added in Windows 10, version 1809. - 6 - Added in Windows 10, version 1903. - +- 7 - Added in the next major release of Windows 10.