mirror of
https://github.com/MicrosoftDocs/windows-itpro-docs.git
synced 2025-05-14 22:37:22 +00:00
Merge branch 'master' into v-mathavale-5560668-part3
This commit is contained in:
Mandi Ohlinger
GitHub
commit
20235822a2
@ -62,7 +62,7 @@ sections:
|
||||
|
||||
- question: Will Internet Explorer 11 continue to receive updates?
|
||||
answer: |
|
||||
We're committed to keeping Internet Explorer a supported, reliable, and safe browser. Internet Explorer is still a component of Windows and follows the support lifecycle of the OS on which it's installed. For details, see [Lifecycle FAQ - Internet Explorer](https://support.microsoft.com/help/17454/). While we continue to support and update Internet Explorer, the latest features and platform updates will only be available in Microsoft Edge.
|
||||
We're committed to keeping Internet Explorer a supported, reliable, and safe browser. Internet Explorer is still a component of Windows and follows the support lifecycle of the OS on which it's installed. For details, see [Lifecycle FAQ - Internet Explorer](/lifecycle/faq/internet-explorer-microsoft-edge). While we continue to support and update Internet Explorer, the latest features and platform updates will only be available in Microsoft Edge.
|
||||
|
||||
- question: How do I find out which version of Microsoft Edge I have?
|
||||
answer: |
|
||||
|
||||
@ -148,7 +148,7 @@ sections:
|
||||
- question: |
|
||||
Where to find Internet Explorer security zones registry entries
|
||||
answer: |
|
||||
Most of the Internet Zone entries can be found in [Internet Explorer security zones registry entries for advanced users](https://support.microsoft.com/help/182569/internet-explorer-security-zones-registry-entries-for-advanced-users).
|
||||
Most of the Internet Zone entries can be found in [Internet Explorer security zones registry entries for advanced users](/troubleshoot/browsers/ie-security-zones-registry-entries).
|
||||
|
||||
This article was written for Internet Explorer 6 but is still applicable to Internet Explorer 11.
|
||||
|
||||
@ -193,7 +193,7 @@ sections:
|
||||
answer: |
|
||||
Internet Explorer 11 is the last major version of Internet Explorer. Internet Explorer 11 will continue receiving security updates and technical support for the lifecycle of the version of Windows on which it is installed.
|
||||
|
||||
For more information, see [Lifecycle FAQ — Internet Explorer and Edge](https://support.microsoft.com/help/17454/lifecycle-faq-internet-explorer).
|
||||
For more information, see [Lifecycle FAQ — Internet Explorer and Edge](/lifecycle/faq/internet-explorer-microsoft-edge).
|
||||
|
||||
- question: |
|
||||
How to configure TLS (SSL) for Internet Explorer
|
||||
|
||||
@ -34,7 +34,7 @@ In this walkthrough, we'll show you how to deploy and manage a full cloud IT sol
|
||||
- Create policies and app deployment rules
|
||||
- Log in as a user and start using your Windows device
|
||||
|
||||
Go to the <a href="https://business.microsoft.com" target="_blank">Microsoft Business site</a> and select **Products** to learn more about pricing and purchasing options for your business.
|
||||
Go to [Microsoft 365 for business](https://www.microsoft.com/microsoft-365/business) to learn more about pricing and purchasing options for your business.
|
||||
|
||||
## Prerequisites
|
||||
|
||||
@ -50,16 +50,17 @@ Here's a few things to keep in mind before you get started:
|
||||
To set up a cloud infrastructure for your organization, follow the steps in this section.
|
||||
|
||||
### 1.1 Set up Office 365 for business
|
||||
See <a href="https://support.office.com/article/Set-up-Office-365-for-business-6a3a29a0-e616-4713-99d1-15eda62d04fa" target="_blank">Set up Office 365 for business</a> to learn more about the setup steps for businesses and nonprofits who have Office 365. You can watch video and learn how to:
|
||||
|
||||
See [Microsoft 365 admin center for business](/microsoft-365/admin) and [Microsoft 365 resources for nonprofits](https://www.microsoft.com/nonprofits/microsoft-365) to learn more about the setup steps for businesses and nonprofits who have Office 365. You can learn how to:
|
||||
- Plan your setup
|
||||
- Create Office 365 accounts and how to add your domain.
|
||||
- Install Office
|
||||
|
||||
To set up your Microsoft 365 for business tenant, see <a href="https://support.office.com/article/Get-started-with-Office-365-for-Business-d6466f0d-5d13-464a-adcb-00906ae87029" target="_blank">Get Started with Microsoft 365 for business</a>.
|
||||
To set up your Microsoft 365 for business tenant, see [Get Started with Microsoft 365 for business](/microsoft-365/business-video/what-is-microsoft-365).
|
||||
|
||||
If you're new at setting up Office 365, and you'd like to see how it's done, you can follow these steps to get started:
|
||||
|
||||
1. Go to the <a href="https://products.office.com/business/office-365-affiliate-program-buy-business-premium" target="_blank">Office 365</a> page in the <a href="https://business.microsoft.com" target="_blank">Microsoft Business site</a>. Select **Try now** to use the Microsoft 365 Business Standard Trial or select **Buy now** to sign up for Microsoft 365 Business Standard. In this walkthrough, we'll select **Try now**.
|
||||
1. Go to [Try or buy a Microsoft 365 for business subscription](/microsoft-365/commerce/try-or-buy-microsoft-365). In this walkthrough, we'll select **Try now**.
|
||||
|
||||
**Figure 1** - Try or buy Office 365
|
||||
|
||||
@ -68,7 +69,7 @@ If you're new at setting up Office 365, and you'd like to see how it's done, you
|
||||
2. Fill out the sign up form and provide information about you and your company.
|
||||
3. Create a user ID and password to use to sign into your account.
|
||||
|
||||
This step creates an onmicrosoft.com email address. You can use this email address to sign in to the various admin centers. Save your sign-in info so you can use it to sign into <a href="https://portal.office.com" target="_blank">https://portal.office.com</a> (the admin portal).
|
||||
This step creates an `onmicrosoft.com` email address. You can use this email address to sign in to the various admin centers. Save your sign-in info so you can use it to sign into [https://portal.office.com](https://portal.office.com) (the admin portal).
|
||||
|
||||
4. Select **Create my account** and then enter the phone number you used in step 2 to verify your identity. You'll be asked to enter your verification code.
|
||||
5. Select **You're ready to go...** which will take you to the Microsoft 365 admin center.
|
||||
@ -78,7 +79,7 @@ If you're new at setting up Office 365, and you'd like to see how it's done, you
|
||||
|
||||
**Figure 2** - Microsoft 365 admin center
|
||||
|
||||
|
||||
:::image type="content" alt-text="Opens the Microsoft 365 admin center." source="images/office365_portal.png":::
|
||||
|
||||
|
||||
6. Select the **Admin** tile to go to the admin center.
|
||||
@ -88,22 +89,22 @@ If you're new at setting up Office 365, and you'd like to see how it's done, you
|
||||
|
||||
**Figure 3** - Admin center
|
||||
|
||||
|
||||
:::image type="content" alt-text="Complete the Office 365 setup in the Microsoft 365 admin center." source="images/office365_admin_portal.png":::
|
||||
|
||||
|
||||
8. Go back to the <a href="https://portal.office.com/adminportal/home#/homepage" target="_blank">admin center</a> to add or buy a domain.
|
||||
8. Go back to the [admin center](https://portal.office.com/adminportal/home#/homepage) to add or buy a domain.
|
||||
1. Select the **Domains** option.
|
||||
|
||||
**Figure 4** - Option to add or buy a domain
|
||||
|
||||
|
||||
:::image type="content" alt-text="Add or buy a domain in admin center." source="images/office365_buy_domain.png":::
|
||||
|
||||
|
||||
2. In the **Home > Domains** page, you will see the Microsoft-provided domain, such as `fabrikamdesign.onmicrosoft.com`.
|
||||
|
||||
**Figure 5** - Microsoft-provided domain
|
||||
|
||||
|
||||
:::image type="content" alt-text="Microsoft-provided domain." source="images/office365_ms_provided_domain.png":::
|
||||
|
||||
- If you already have a domain, select **+ Add domain** to add your existing domain. If you select this option, you'll be required to verify that you own the domain. Follow the steps in the wizard to verify your domain.
|
||||
- If you don't already own a domain, select **+ Buy domain**. If you're using a trial plan, you'll be required to upgrade your trial plan in order to buy a domain. Choose the subscription plan to use for your business and provide the details to complete your order.
|
||||
@ -112,7 +113,7 @@ If you're new at setting up Office 365, and you'd like to see how it's done, you
|
||||
|
||||
**Figure 6** - Domains
|
||||
|
||||
|
||||
:::image type="content" alt-text="Verify your domains in the admin center." source="images/office365_additional_domain.png":::
|
||||
|
||||
### 1.2 Add users and assign product licenses
|
||||
Once you've set up Office and added your domain, it's time to add users so they have access to Office 365. People in your organization need an account before they can sign in and access Office 365. The easiest way to add users is to add them one at a time in the Microsoft 365 admin center.
|
||||
@ -121,55 +122,55 @@ When adding users, you can also assign admin privileges to certain users in your
|
||||
|
||||
**To add users and assign product licenses**
|
||||
|
||||
1. In the <a href="https://portal.office.com/adminportal/home#/homepage" target="_blank">admin center</a>, select **Users > Active users**.
|
||||
1. In the [admin center](https://portal.office.com/adminportal/home#/homepage), select **Users > Active users**.
|
||||
|
||||
**Figure 7** - Add users
|
||||
|
||||
|
||||
:::image type="content" alt-text="Add Office 365 users." source="images/office365_users.png":::
|
||||
|
||||
2. In the **Home > Active users** page, add users individually or in bulk.
|
||||
- To add users one at a time, select **+ Add a user**.
|
||||
|
||||
If you select this option, you'll see the **New user** screen and you can add details about the new user including their name, user name, role, and so on. You also have the opportunity to assign **Product licenses**. For detailed step-by-step info on adding a user account, see *Add a user account in the admin center* in <a href="https://support.office.com/article/Add-users-individually-or-in-bulk-to-Office-365-Admin-Help-1970f7d6-03b5-442f-b385-5880b9c256ec" target="_blank">Add users individually or in bulk to Office 365 - Admin Help</a>.
|
||||
If you select this option, you'll see the **New user** screen and you can add details about the new user including their name, user name, role, and so on. You also have the opportunity to assign **Product licenses**. For detailed step-by-step info on adding a user account, see [Add users and assign licenses at the same time](/microsoft-365/admin/add-users/add-users).
|
||||
|
||||
**Figure 8** - Add an individual user
|
||||
|
||||
|
||||
:::image type="content" alt-text="Add an individual user." source="images/office365_add_individual_user.png":::
|
||||
|
||||
- To add multiple users at once, select **More** and then choose **+ Import multiple users**. If you select this option, you'll need to create and upload a CSV file containing the list of users.
|
||||
|
||||
The **Import multiple users** screen includes a link where you can learn more about importing multiple users and also links for downloading a sample CSV file (one with headers only and another with headers and sample user information). For detailed step-by-step info on adding multiple users to Office 365, see <a href="https://support.office.com/article/Add-several-users-at-the-same-time-to-Office-365-Admin-Help-1f5767ed-e717-4f24-969c-6ea9d412ca88" target="_blank">Add several users at the same time to Office 365 - Admin Help</a>. Once you've added all the users, don't forget to assign **Product licenses** to the new users.
|
||||
The **Import multiple users** screen includes a link where you can learn more about importing multiple users and also links for downloading a sample CSV file (one with headers only and another with headers and sample user information). For detailed step-by-step info on adding multiple users to Office 365, see [Add users and assign licenses at the same time](/microsoft-365/admin/add-users/add-users). Once you've added all the users, don't forget to assign **Product licenses** to the new users.
|
||||
|
||||
**Figure 9** - Import multiple users
|
||||
|
||||
|
||||
:::image type="content" alt-text="Import multiple users." source="images/office365_import_multiple_users.png":::
|
||||
|
||||
3. Verify that all the users you added appear in the list of **Active users**. The **Status** should indicate the product licenses that were assigned to them.
|
||||
|
||||
**Figure 10** - List of active users
|
||||
|
||||
|
||||
:::image type="content" alt-text="Verify users and assigned product licenses." source="images/o365_active_users.png":::
|
||||
|
||||
### 1.3 Add Microsoft Intune
|
||||
Microsoft Intune provides mobile device management, app management, and PC management capabilities from the cloud. Using Intune, organizations can provide their employees with access to apps, data, and corporate resources from anywhere on almost any device while helping to keep corporate information secure. To learn more, see <a href="/intune/understand-explore/introduction-to-microsoft-intune" target="_blank">What is Intune?</a>
|
||||
Microsoft Intune provides mobile device management, app management, and PC management capabilities from the cloud. Using Intune, organizations can provide their employees with access to apps, data, and corporate resources from anywhere on almost any device while helping to keep corporate information secure. To learn more, see [Microsoft Intune is an MDM and MAM provider](/mem/intune/fundamentals/what-is-intune).
|
||||
|
||||
**To add Microsoft Intune to your tenant**
|
||||
|
||||
1. In the <a href="https://portal.office.com/adminportal/home#/homepage" target="_blank">admin center</a>, select **Billing > Purchase services**.
|
||||
1. In the [admin center](https://portal.office.com/adminportal/home#/homepage), select **Billing > Purchase services**.
|
||||
2. In the **Home > Purchase services** screen, search for **Microsoft Intune**. Hover over **Microsoft Intune** to see the options to start a free 30-day trial or to buy now.
|
||||
3. Confirm your order to enable access to Microsoft Intune.
|
||||
4. In the admin center, the Intune licenses will show as available and ready to be assigned to users. Select **Users > Active users** and then edit the product licenses assigned to the users to turn on **Intune A Direct**.
|
||||
|
||||
**Figure 11** - Assign Intune licenses
|
||||
|
||||
|
||||
:::image type="content" alt-text="Assign Microsoft Intune licenses to users." source="images/o365_assign_intune_license.png":::
|
||||
|
||||
5. In the admin center, confirm that **Intune** shows up in the list under **Admin centers**. If it doesn't, sign out and then sign back in and then check again.
|
||||
6. Select **Intune**. This step opens the Endpoint Manager admin center.
|
||||
|
||||
**Figure 12** - Microsoft Intune management portal
|
||||
|
||||
|
||||
:::image type="content" alt-text="Microsoft Intune management portal." source="images/intune_portal_home.png":::
|
||||
|
||||
Intune should now be added to your tenant. We'll come back to Intune later when we [Configure Microsoft Store for Business for app distribution](#17-configure-microsoft-store-for-business-for-app-distribution).
|
||||
|
||||
@ -178,7 +179,7 @@ Microsoft Azure is an open and flexible cloud platform that enables you to quick
|
||||
|
||||
**To add Azure AD to your domain**
|
||||
|
||||
1. In the <a href="https://portal.office.com/adminportal/home#/homepage" target="_blank">admin center</a>, select **Admin centers > Azure AD**.
|
||||
1. In the [admin center](https://portal.office.com/adminportal/home#/homepage), select **Admin centers > Azure AD**.
|
||||
|
||||
> [!NOTE]
|
||||
> You will need Azure AD Premium to configure automatic MDM enrollment with Intune.
|
||||
@ -187,57 +188,57 @@ Microsoft Azure is an open and flexible cloud platform that enables you to quick
|
||||
|
||||
**Figure 13** - Access to Azure AD is not available
|
||||
|
||||
|
||||
:::image type="content" alt-text="Access to Azure AD not available." source="images/azure_ad_access_not_available.png":::
|
||||
|
||||
3. From the error message, select the country/region for your business. The region should match with the location you specified when you signed up for Office 365.
|
||||
4. Select **Azure subscription**. This step will take you to a free trial sign up screen.
|
||||
|
||||
**Figure 14** - Sign up for Microsoft Azure
|
||||
|
||||
|
||||
:::image type="content" alt-text="Sign up for Microsoft Azure." source="images/azure_ad_sign_up_screen.png":::
|
||||
|
||||
5. In the **Free trial sign up** screen, fill in the required information and then click **Sign up**.
|
||||
6. After you sign up, you should see the message that your subscription is ready. Click **Start managing my service**.
|
||||
|
||||
**Figure 15** - Start managing your Azure subscription
|
||||
|
||||
|
||||
:::image type="content" alt-text="Start managing your Azure subscription." source="images/azure_ad_successful_signup.png":::
|
||||
|
||||
This step will take you to the <a href="https://portal.azure.com" target="_blank">Microsoft Azure portal</a>.
|
||||
This step will take you to the [Microsoft Azure portal](https://portal.azure.com).
|
||||
|
||||
### 1.5 Add groups in Azure AD
|
||||
This section is the walkthrough is optional. However, we recommend that you create groups in Azure AD to manage access to corporate resources, such as apps, policies and settings, and so on. For more information, see <a href="/azure/active-directory/active-directory-manage-groups" target="_blank">Managing access to resources with Azure Active Directory groups</a>.
|
||||
This section is the walkthrough is optional. However, we recommend that you create groups in Azure AD to manage access to corporate resources, such as apps, policies and settings, and so on. For more information, see [Managing access to resources with Azure Active Directory groups](/azure/active-directory/active-directory-manage-groups.
|
||||
|
||||
To add Azure AD group(s), we will use the <a href="https://manage.windowsazure.com/" target="_blank">classic Azure portal (https://manage.windowsazure.com)</a>. See <a href="/azure/active-directory/active-directory-accessmanagement-manage-groups" target="_blank">Managing groups in Azure Active Directory</a> for more information about managing groups.
|
||||
To add Azure AD group(s), use the [Microsoft Azure portal](https://portal.azure.com). See [Managing groups in Azure Active Directory](/azure/active-directory/active-directory-accessmanagement-manage-groups) for more information about managing groups.
|
||||
|
||||
**To add groups in Azure AD**
|
||||
|
||||
1. If this is the first time you're setting up your directory, when you navigate to the **Azure Active Directory** node in the <a href="https://manage.windowsazure.com/" target="_blank">classic Azure portal</a>, you will see a screen informing you that your directory is ready for use.
|
||||
1. If this is the first time you're setting up your directory, when you navigate to the **Azure Active Directory** node, you will see a screen informing you that your directory is ready for use.
|
||||
|
||||
Afterwards, you should see a list of active directories. In the following example, **Fabrikam Design** is the active directory.
|
||||
|
||||
**Figure 16** - Azure first sign-in screen
|
||||
|
||||
|
||||
:::image type="content" alt-text="Select Azure AD." source="images/azure_portal_classic_configure_directory.png":::
|
||||
|
||||
2. Select the directory (such as Fabrikam Design) to go to the directory's home page.
|
||||
|
||||
**Figure 17** - Directory home page
|
||||
|
||||
|
||||
:::image type="content" alt-text="Directory home page." source="images/azure_portal_classic_directory_ready.png":::
|
||||
|
||||
3. From the menu options on top, select **Groups**.
|
||||
|
||||
**Figure 18** - Azure AD groups
|
||||
|
||||
|
||||
:::image type="content" alt-text="Add groups in Azure AD." source="images/azure_portal_classic_groups.png":::
|
||||
|
||||
4. Select **Add a group** (from the top) or **Add group** at the bottom.
|
||||
5. In the **Add Group** window, add a name, group type, and description for the group and click the checkmark to save your changes. The new group will appear on the groups list.
|
||||
|
||||
**Figure 19** - Newly added group in Azure AD
|
||||
|
||||
|
||||
:::image type="content" alt-text="Verify the new group appears on the list." source="images/azure_portal_classic_all_users_group.png":::
|
||||
|
||||
6. In the **Groups** tab, select the arrow next to the group (such as **All users**), add members to the group, and then save your changes.
|
||||
|
||||
@ -245,34 +246,34 @@ To add Azure AD group(s), we will use the <a href="https://manage.windowsazure.c
|
||||
|
||||
**Figure 20** - Members in the new group
|
||||
|
||||
|
||||
:::image type="content" alt-text="Members added to the new group." source="images/azure_portal_classic_members_added.png":::
|
||||
|
||||
7. Repeat steps 2-6 to add other groups. You can add groups based on their roles in your company, based on the apps that each group can use, and so on.
|
||||
|
||||
### 1.6 Configure automatic MDM enrollment with Intune
|
||||
Now that you have Azure AD Premium and have it properly configured, you can configure automatic MDM enrollment with Intune, which allows users to enroll their Windows devices into Intune management, join their devices directly to Azure AD, and get access to Office 365 resources after sign in.
|
||||
|
||||
You can read <a href="https://blogs.technet.microsoft.com/enterprisemobility/2015/08/14/windows-10-azure-ad-and-microsoft-intune-automatic-mdm-enrollment-powered-by-the-cloud/" target="_blank">this blog post</a> to learn how you can combine login, Azure AD Join, and Intune MDM enrollment into an easy step so that you can bring your devices into a managed state that complies with the policies for your organization. We will use this blog post as our guide for this part of the walkthrough.
|
||||
You can read the [Windows 10, Azure AD and Microsoft Intune blog post](https://blogs.technet.microsoft.com/enterprisemobility/2015/08/14/windows-10-azure-ad-and-microsoft-intune-automatic-mdm-enrollment-powered-by-the-cloud/) to learn how you can combine login, Azure AD Join, and Intune MDM enrollment into an easy step so that you can bring your devices into a managed state that complies with the policies for your organization. We will use this blog post as our guide for this part of the walkthrough.
|
||||
|
||||
> [!IMPORTANT]
|
||||
> We will use the classic Azure portal instead of the new portal to configure automatic MDM enrollment with Intune.
|
||||
|
||||
**To enable automatic MDM enrollment**
|
||||
|
||||
1. In the <a href="https://manage.windowsazure.com/" target="_blank">classic Azure portal</a>, click on your company's Azure Active Directory to go back to the main window. Select **Applications** from the list of directory menu options.
|
||||
1. In the Azure portal, click on your company's Azure Active Directory to go back to the main window. Select **Applications** from the list of directory menu options.
|
||||
|
||||
The list of applications for your company will appear. **Microsoft Intune** will be one of the applications on the list.
|
||||
|
||||
**Figure 21** - List of applications for your company
|
||||
|
||||
|
||||
:::image type="content" alt-text="List of applications for your company." source="images/azure_portal_classic_applications.png":::
|
||||
|
||||
2. Select **Microsoft Intune** to configure the application.
|
||||
3. In the Microsoft Intune configuration page, click **Configure** to start automatic MDM enrollment configuration with Intune.
|
||||
|
||||
**Figure 22** - Configure Microsoft Intune in Azure
|
||||
|
||||
|
||||
:::image type="content" alt-text="Configure Microsoft Intune in Azure." source="images/azure_portal_classic_configure_intune_app.png":::
|
||||
|
||||
4. In the Microsoft Intune configuration page:
|
||||
- In the **Properties** section, you should see a list of URLs for MDM discovery, MDM terms of use, and MDM compliance.
|
||||
@ -291,66 +292,66 @@ You can read <a href="https://blogs.technet.microsoft.com/enterprisemobility/201
|
||||
|
||||
**Figure 23** - Configure Microsoft Intune
|
||||
|
||||
|
||||
:::image type="content" alt-text="Configure automatic MDM enrollment with Intune." source="images/azure_portal_classic_configure_intune_mdm_enrollment.png":::
|
||||
|
||||
### 1.7 Configure Microsoft Store for Business for app distribution
|
||||
Next, you'll need to configure Microsoft Store for Business to distribute apps with a management tool such as Intune.
|
||||
|
||||
In this part of the walkthrough, we'll be working on the <a href="https://manage.microsoft.com/" target="_blank">Microsoft Intune management portal</a> and <a href="https://businessstore.microsoft.com/Store/Apps" target="_blank">Microsoft Store for Business</a>.
|
||||
In this part of the walkthrough, use the [Microsoft Endpoint Manager admin center](https://go.microsoft.com/fwlink/?linkid=2109431) and [Microsoft Store for Business](https://businessstore.microsoft.com/Store/Apps).
|
||||
|
||||
**To associate your Store account with Intune and configure synchronization**
|
||||
|
||||
1. From the <a href="https://manage.microsoft.com/" target="_blank">Microsoft Intune management portal</a>, select **Admin**.
|
||||
1. Sign in to the [Microsoft Endpoint Manager admin center](https://go.microsoft.com/fwlink/?linkid=2109431).
|
||||
2. In the **Administration** workspace, click **Mobile Device Management**. If this is the first item you're using the portal, click **manage mobile devices** in the **Mobile Device Management** window. The page will refresh and you'll have new options under **Mobile Device Management**.
|
||||
|
||||
**Figure 24** - Mobile device management
|
||||
|
||||
|
||||
:::image type="content" alt-text="Set up mobile device management in Intune." source="images/intune_admin_mdm_configure.png":::
|
||||
|
||||
3. Sign into <a href="https://businessstore.microsoft.com/Store/Apps" target="_blank">Microsoft Store for Business</a> using the same tenant account that you used to sign into Intune.
|
||||
3. Sign into [Microsoft Store for Business](https://businessstore.microsoft.com/Store/Apps) using the same tenant account that you used to sign into Intune.
|
||||
4. Accept the EULA.
|
||||
5. In the Store portal, select **Settings > Management tools** to go to the management tools page.
|
||||
6. In the **Management tools** page, find **Microsoft Intune** on the list and click **Activate** to get Intune ready to use with Microsoft Store for Business.
|
||||
|
||||
**Figure 25** - Activate Intune as the Store management tool
|
||||
|
||||
|
||||
:::image type="content" alt-text="Activate Intune from the Store portal." source="images/wsfb_management_tools_activate.png":::
|
||||
|
||||
7. Go back to the <a href="https://manage.microsoft.com/" target="_blank">Intune management portal</a>, select **Admin > Mobile Device Management**, expand **Windows**, and then choose **Store for Business**.
|
||||
7. Go back to the [Microsoft Endpoint Manager admin center](https://go.microsoft.com/fwlink/?linkid=2109431), select **Admin > Mobile Device Management**, expand **Windows**, and then choose **Store for Business**.
|
||||
8. In the **Microsoft Store for Business** page, select **Configure Sync** to sync your Store for Business volume-purchased apps with Intune.
|
||||
|
||||
**Figure 26** - Configure Store for Business sync in Intune
|
||||
|
||||
|
||||
:::image type="content" alt-text="Configure Store for Business sync in Intune." source="images/intune_admin_mdm_store_sync.png":::
|
||||
|
||||
9. In the **Configure Microsoft Store for Business app sync** dialog box, check **Enable Microsoft Store for Business sync**. In the **Language** dropdown list, choose the language in which you want apps from the Store to be displayed in the Intune console and then click **OK**.
|
||||
|
||||
**Figure 27** - Enable Microsoft Store for Business sync in Intune
|
||||
|
||||
|
||||
:::image type="content" alt-text="Enable Store for Business sync in Intune." source="images/intune_configure_store_app_sync_dialog.png":::
|
||||
|
||||
The **Microsoft Store for Business** page will refresh and it will show the details from the sync.
|
||||
|
||||
**To buy apps from the Store**
|
||||
|
||||
In your <a href="https://businessstore.microsoft.com/Store/Apps" target="_blank">Microsoft Store for Business</a> portal, you can see the list of apps that you own by going to **Manage > Inventory**. You should see the following apps in your inventory:
|
||||
In your [Microsoft Store for Business portal](https://businessstore.microsoft.com/Store/Apps), you can see the list of apps that you own by going to **Manage > Inventory**. You should see the following apps in your inventory:
|
||||
- Sway
|
||||
- OneNote
|
||||
- PowerPoint Mobile
|
||||
- Excel Mobile
|
||||
- Word Mobile
|
||||
|
||||
In the <a href="https://manage.microsoft.com/" target="_blank">Intune management portal</a>, select **Apps > Apps > Volume-Purchased Apps** and verify that you can see the same list of apps appear on Intune.
|
||||
In the [Microsoft Endpoint Manager admin center](https://go.microsoft.com/fwlink/?linkid=2109431), select **Apps > Apps > Volume-Purchased Apps** and verify that you can see the same list of apps appear on Intune.
|
||||
|
||||
In the following example, we'll show you how to buy apps through the Microsoft Store for Business and then make sure the apps appear on Intune.
|
||||
|
||||
**Example 1 - Add other apps like Reader and InstaNote**
|
||||
|
||||
1. In the <a href="https://businessstore.microsoft.com/Store/Apps" target="_blank">Microsoft Store for Business</a> portal, click **Shop**, scroll down to the **Made by Microsoft** category, and click **Show all** to see all the Microsoft apps in the list.
|
||||
1. In the [Microsoft Store for Business portal](https://businessstore.microsoft.com/Store/Apps), click **Shop**, scroll down to the **Made by Microsoft** category, and click **Show all** to see all the Microsoft apps in the list.
|
||||
|
||||
**Figure 28** - Shop for Store apps
|
||||
|
||||
|
||||
:::image type="content" alt-text="Shop for Store apps." source="images/wsfb_shop_microsoft_apps.png":::
|
||||
|
||||
2. Click to select an app, such as **Reader**. This opens the app page.
|
||||
3. In the app's Store page, click **Get the app**. You should see a dialog that confirms your order. Click **Close**. This will refresh the app's Store page.
|
||||
@ -360,7 +361,7 @@ In the following example, we'll show you how to buy apps through the Microsoft S
|
||||
|
||||
**Figure 29** - App inventory shows the purchased apps
|
||||
|
||||
|
||||
:::image type="content" alt-text="Confirm that your inventory shows purchased apps." source="images/wsfb_manage_inventory_newapps.png":::
|
||||
|
||||
> [!NOTE]
|
||||
> Sync happens automatically, but it may take up to 24 hours for your organization's private store and 12 hours for Intune to sync all your purchased apps. You can force a sync to make this process happen faster. For more info, see [To sync recently purchased apps](#forceappsync).
|
||||
@ -369,18 +370,18 @@ In the following example, we'll show you how to buy apps through the Microsoft S
|
||||
|
||||
If you need to sync your most recently purchased apps and have it appear in your catalog, you can do this by forcing a sync.
|
||||
|
||||
1. In the <a href="https://manage.microsoft.com/" target="_blank">Intune management portal</a>, select **Admin > Mobile Device Management > Windows > Store for Business**.
|
||||
1. In the [Microsoft Endpoint Manager admin center](https://go.microsoft.com/fwlink/?linkid=2109431), select **Admin > Mobile Device Management > Windows > Store for Business**.
|
||||
2. In the **Microsoft Store for Business** page, click **Sync now** to force a sync.
|
||||
|
||||
**Figure 30** - Force a sync in Intune
|
||||
|
||||
|
||||
:::image type="content" alt-text="Force a sync in Intune." source="images/intune_admin_mdm_forcesync.png":::
|
||||
|
||||
**To view purchased apps**
|
||||
- In the <a href="https://manage.microsoft.com/" target="_blank">Intune management portal</a>, select **Apps > Apps** and then choose **Volume-Purchased Apps** to see the list of available apps. Verify that the apps you purchased were imported correctly.
|
||||
- In the [Microsoft Endpoint Manager admin center](https://go.microsoft.com/fwlink/?linkid=2109431), select **Apps > Apps** and then choose **Volume-Purchased Apps** to see the list of available apps. Verify that the apps you purchased were imported correctly.
|
||||
|
||||
**To add more apps**
|
||||
- If you have other apps that you want to deploy or manage, you must add it to Microsoft Intune. To deploy Win32 apps and Web links, see <a href="/intune/deploy-use/add-apps-for-mobile-devices-in-microsoft-intune" target="_blank">Add apps for enrolled devices to Intune</a> for more info on how to do this.
|
||||
- If you have other apps that you want to deploy or manage, you must add it to Microsoft Intune. To deploy Win32 apps and Web links, see [Add apps to Microsoft Intune](/mem/intune/apps/apps-add) for more info on how to do this.
|
||||
|
||||
## 2. Set up devices
|
||||
|
||||
@ -395,7 +396,7 @@ To set up new Windows devices, go through the Windows initial device setup or fi
|
||||
|
||||
**Figure 31** - First screen in Windows device setup
|
||||
|
||||
|
||||
:::image type="content" alt-text="First screen in Windows device setup." source="images/win10_hithere.png":::
|
||||
|
||||
> [!NOTE]
|
||||
> During setup, if you don't have a Wi-Fi network configured, make sure you connect the device to the Internet through a wired/Ethernet connection.
|
||||
@ -405,13 +406,13 @@ To set up new Windows devices, go through the Windows initial device setup or fi
|
||||
|
||||
**Figure 32** - Choose how you'll connect your Windows device
|
||||
|
||||
|
||||
:::image type="content" alt-text="Choose how you'll connect the Windows device." source="images/win10_choosehowtoconnect.png":::
|
||||
|
||||
4. In the **Let's get you signed in** screen, sign in using a user account you added in section [1.2 Add users and assign product licenses](#12-add-users-and-assign-product-licenses). We suggest signing in as one of the global administrators. Later, sign in on another device using one of the non-admin accounts.
|
||||
|
||||
**Figure 33** - Sign in using one of the accounts you added
|
||||
|
||||
|
||||
:::image type="content" alt-text="Sign in using one of the accounts you added." source="images/win10_signin_admin_account.png":::
|
||||
|
||||
5. If this is the first time you're signing in, you will be asked to update your password. Update the password and continue with sign-in and setup.
|
||||
|
||||
@ -425,16 +426,16 @@ Verify that the device is set up correctly and boots without any issues.
|
||||
2. Confirm that the Store and built-in apps are working.
|
||||
|
||||
### 2.3 Verify the device is Azure AD joined
|
||||
In the <a href="https://manage.microsoft.com/" target="_blank">Intune management portal</a>, verify that the device is joined to Azure AD and shows up as being managed in Microsoft Intune.
|
||||
In the [Microsoft Endpoint Manager admin center](https://go.microsoft.com/fwlink/?linkid=2109431), verify that the device is joined to Azure AD and shows up as being managed in Microsoft Intune.
|
||||
|
||||
**To verify if the device is joined to Azure AD**
|
||||
1. Check the device name on your PC. On your Windows PC, select **Settings > System > About** and then check **PC name**.
|
||||
|
||||
**Figure 34** - Check the PC name on your device
|
||||
|
||||
|
||||
:::image type="content" alt-text="Check the PC name on your device." source="images/win10_settings_pcname.png":::
|
||||
|
||||
2. Log in to the <a href="https://manage.microsoft.com/" target="_blank">Intune management portal</a>.
|
||||
2. Sign in to the [Microsoft Endpoint Manager admin center](https://go.microsoft.com/fwlink/?linkid=2109431).
|
||||
3. Select **Groups** and then go to **Devices**.
|
||||
4. In the **All Devices** page, look at the list of devices and select the entry that matches the name of your PC.
|
||||
- Check that the device name appears in the list. Select the device and it will also show the current logged-in user in the **General Information** section.
|
||||
@ -443,7 +444,7 @@ In the <a href="https://manage.microsoft.com/" target="_blank">Intune management
|
||||
|
||||
**Figure 35** - Check that the device appears in Intune
|
||||
|
||||
|
||||
:::image type="content" alt-text="Check that the device appears in Intune." source="images/intune_groups_devices_list.png":::
|
||||
|
||||
## 3. Manage device settings and features
|
||||
You can use Microsoft Intune admin settings and policies to manage features on your organization's mobile devices and computers. For more info, see [Manage settings and features on your devices with Microsoft Intune policies](/intune/deploy-use/manage-settings-and-features-on-your-devices-with-microsoft-intune-policies).
|
||||
@ -454,7 +455,7 @@ In this section, we'll show you how to reconfigure app deployment settings and a
|
||||
In some cases, if an app is missing from the device, you need to reconfigure the deployment settings for the app and set the app to require installation as soon as possible.
|
||||
|
||||
**To reconfigure app deployment settings**
|
||||
1. In the <a href="https://manage.microsoft.com/" target="_blank">Intune management portal</a>, select **Apps** and go to **Apps > Volume-Purchased Apps**.
|
||||
1. In the [Microsoft Endpoint Manager admin center](https://go.microsoft.com/fwlink/?linkid=2109431), select **Apps** and go to **Apps > Volume-Purchased Apps**.
|
||||
2. Select the app, right-click, then select **Manage Deployment...**.
|
||||
3. Select the group(s) whose apps will be managed, and then click **Add** to add the group.
|
||||
4. Click **Next** at the bottom of the app deployment settings window or select **Deployment Action** on the left column to check the deployment settings for the app.
|
||||
@ -462,7 +463,7 @@ In some cases, if an app is missing from the device, you need to reconfigure the
|
||||
|
||||
**Figure 36** - Reconfigure an app's deployment setting in Intune
|
||||
|
||||
|
||||
:::image type="content" alt-text="Reconfigure app deployment settings in Intune." source="images/intune_apps_deploymentaction.png":::
|
||||
|
||||
6. Click **Finish**.
|
||||
7. Repeat steps 2-6 for other apps that you want to deploy to the device(s) as soon as possible.
|
||||
@ -472,12 +473,12 @@ In some cases, if an app is missing from the device, you need to reconfigure the
|
||||
|
||||
**Figure 37** - Confirm that additional apps were deployed to the device
|
||||
|
||||
|
||||
:::image type="content" alt-text="Confirm that additional apps were deployed to the device." source="images/win10_deploy_apps_immediately.png":::
|
||||
|
||||
### 3.2 Configure other settings in Intune
|
||||
|
||||
**To disable the camera**
|
||||
1. In the <a href="https://manage.microsoft.com/" target="_blank">Intune management portal</a>, select **Policy > Configuration Policies**.
|
||||
1. In the [Microsoft Endpoint Manager admin center](https://go.microsoft.com/fwlink/?linkid=2109431), select **Devices > Configuration Policies**.
|
||||
2. In the **Policies** window, click **Add** to create a new policy.
|
||||
3. On the **Create a New Policy** page, click **Windows** to expand the group, select **General Configuration (Windows 10 Desktop and Mobile and later)**, choose **Create and Deploy a Custom Policy**, and then click **Create Policy**.
|
||||
4. On the **Create Policy** page, select **Device Capabilities**.
|
||||
@ -488,7 +489,7 @@ In some cases, if an app is missing from the device, you need to reconfigure the
|
||||
|
||||
**Figure 38** - Add a configuration policy
|
||||
|
||||
|
||||
:::image type="content" alt-text="Add a configuration policy." source="images/intune_policy_disablecamera.png":::
|
||||
|
||||
7. Click **Save Policy**. A confirmation window will pop up.
|
||||
8. On the **Deploy Policy** confirmation window, select **Yes** to deploy the policy now.
|
||||
@ -497,16 +498,16 @@ In some cases, if an app is missing from the device, you need to reconfigure the
|
||||
|
||||
**Figure 39** - The new policy should appear in the **Policies** list.
|
||||
|
||||
|
||||
:::image type="content" alt-text="New policy appears on the list." source="images/intune_policies_newpolicy_deployed.png":::
|
||||
|
||||
**To turn off Windows Hello and PINs during device setup**
|
||||
1. In the <a href="https://manage.microsoft.com/" target="_blank">Intune management portal</a>, select **Admin**.
|
||||
1. Go to the [Microsoft Endpoint Manager admin center](https://go.microsoft.com/fwlink/?linkid=2109431).
|
||||
2. Go to **Mobile Device Management > Windows > Windows Hello for Business**.
|
||||
3. In the **Windows Hello for Business** page, select **Disable Windows Hello for Business on enrolled devices**.
|
||||
|
||||
**Figure 40** - Policy to disable Windows Hello for Business
|
||||
|
||||
|
||||
:::image type="content" alt-text="Disable Windows Hello for Business." source="images/intune_policy_disable_windowshello.png":::
|
||||
|
||||
4. Click **Save**.
|
||||
|
||||
@ -533,49 +534,49 @@ For other devices, such as those personally-owned by employees who need to conne
|
||||
|
||||
**Figure 41** - Add an Azure AD account to the device
|
||||
|
||||
|
||||
:::image type="content" alt-text="Add an Azure AD account to the device." source="images/win10_add_new_user_join_aad.png":::
|
||||
|
||||
4. In the **Let's get you signed in** window, enter the work credentials for the account and then click **Sign in** to authenticate the user.
|
||||
|
||||
**Figure 42** - Enter the account details
|
||||
|
||||
|
||||
:::image type="content" alt-text="Enter the account details." source="images/win10_add_new_user_account_aadwork.png":::
|
||||
|
||||
5. You will be asked to update the password so enter a new password.
|
||||
6. Verify the details to make sure you're connecting to the right organization and then click **Join**.
|
||||
|
||||
**Figure 43** - Make sure this is your organization
|
||||
|
||||
|
||||
:::image type="content" alt-text="Make sure this is your organization." source="images/win10_confirm_organization_details.png":::
|
||||
|
||||
7. You will see a confirmation window that says the device is now connected to your organization. Click **Done**.
|
||||
|
||||
**Figure 44** - Confirmation that the device is now connected
|
||||
|
||||
|
||||
:::image type="content" alt-text="Confirmation that the device is now connected." source="images/win10_confirm_device_connected_to_org.png":::
|
||||
|
||||
8. The **Connect to work or school** window will refresh and will now include an entry that shows you're connected to your organization's Azure AD. This means the device is now registered in Azure AD and enrolled in MDM and the account should have access to the organization's resources.
|
||||
|
||||
**Figure 45** - Device is now enrolled in Azure AD
|
||||
|
||||
|
||||
:::image type="content" alt-text="Device is enrolled in Azure AD." source="images/win10_device_enrolled_in_aad.png":::
|
||||
|
||||
9. You can confirm that the new device and user are showing up as Intune-managed by going to the <a href="https://manage.microsoft.com/" target="_blank">Intune management portal</a> and following the steps in [2.3 Verify the device is Azure AD joined](#23-verify-the-device-is-azure-ad-joined). It may take several minutes before the new device shows up so check again later.
|
||||
9. You can confirm that the new device and user are showing up as Intune-managed by going to the [Microsoft Endpoint Manager admin center](https://go.microsoft.com/fwlink/?linkid=2109431) and following the steps in [2.3 Verify the device is Azure AD joined](#23-verify-the-device-is-azure-ad-joined). It may take several minutes before the new device shows up so check again later.
|
||||
|
||||
### 4.2 Add a new user
|
||||
You can add new users to your tenant simply by adding them to the Microsoft 365 groups. Adding new users to Microsoft 365 groups automatically adds them to the corresponding groups in Microsoft Intune.
|
||||
|
||||
See [Add users to Office 365](/microsoft-365/admin/add-users/add-users) to learn more. Once you're done adding new users, go to the <a href="https://manage.microsoft.com/" target="_blank">Intune management portal</a> and verify that the same users were added to the Intune groups as well.
|
||||
See [Add users to Office 365](/microsoft-365/admin/add-users/add-users) to learn more. Once you're done adding new users, go to the [Microsoft Endpoint Manager admin center](https://go.microsoft.com/fwlink/?linkid=2109431) and verify that the same users were added to the Intune groups as well.
|
||||
|
||||
## Get more info
|
||||
|
||||
### For IT admins
|
||||
To learn more about the services and tools mentioned in this walkthrough, and learn what other tasks you can do, follow these links:
|
||||
- <a href="https://support.office.com/article/Set-up-Office-365-for-business-6a3a29a0-e616-4713-99d1-15eda62d04fa" target="_blank">Set up Office 365 for business</a>
|
||||
- Common admin tasks in Office 365 including email and OneDrive in <a href="https://support.office.com/article/Common-management-tasks-for-Office-365-46c667f7-5073-47b9-a75f-05a60cf77d91" target="_blank">Manage Office 365</a>
|
||||
- More info about managing devices, apps, data, troubleshooting, and more in <a href="/intune/" target="_blank">Intune documentation</a>
|
||||
- [Set up Office 365 for business](/microsoft-365/admin/setup)
|
||||
- Common admin tasks in Office 365 including email and OneDrive in [Manage Office 365](/microsoft-365/admin/)
|
||||
- More info about managing devices, apps, data, troubleshooting, and more in the [/mem/intune/](/mem/intune/)
|
||||
- Learn more about Windows client in the [Windows client documentation for IT Pros](/windows/resources/).
|
||||
- Info about distributing apps to your employees, managing apps, managing settings, and more in <a href="/microsoft-store/" target="_blank">Microsoft Store for Business</a>
|
||||
- Info about distributing apps to your employees, managing apps, managing settings, and more in [Microsoft Store for Business](/microsoft-store/)
|
||||
|
||||
### For information workers
|
||||
Whether it's in the classroom, getting the most out of your devices, or learning some of the cool things you can do, we've got teachers covered. Follow these links for more info:
|
||||
|
||||
@ -44,5 +44,5 @@ If you created a new Azure AD directory when you signed up for Store for Busines
|
||||
You can use the [Office 365 admin dashboard](https://portal.office.com/adminportal) or [Azure management portal](https://go.microsoft.com/fwlink/p/?LinkId=691086) to add user accounts to your Azure AD directory. If you'll be using Azure management portal, you'll need an active subscription to [Azure management portal](https://go.microsoft.com/fwlink/p/?LinkId=708617).
|
||||
|
||||
For more information, see:
|
||||
- [Add user accounts using Office 365 admin dashboard](https://support.office.com/en-us/article/add-users-individually-or-in-bulk-to-office-365-admin-help-1970f7d6-03b5-442f-b385-5880b9c256ec)
|
||||
- [Add user accounts using Office 365 admin dashboard](/microsoft-365/admin/add-users)
|
||||
- [Add user accounts using Azure management portal](/azure/active-directory/fundamentals/add-users-azure-active-directory)
|
||||
@ -56,7 +56,7 @@ The private store for your organization is a page in Microsoft Store app that co
|
||||
|
||||
## Troubleshooting Microsoft Store for Business integration with Microsoft Endpoint Configuration Manager
|
||||
|
||||
If you encounter any problems when integrating Microsoft Store for Business with Configuration Manager, use the [troubleshooting guide](https://support.microsoft.com/help/4010214/understand-and-troubleshoot-microsoft-store-for-business-integration-w).
|
||||
If you encounter any problems when integrating Microsoft Store for Business with Configuration Manager, use the [troubleshooting guide](/troubleshoot/mem/configmgr/troubleshoot-microsoft-store-for-business-integration).
|
||||
|
||||
## Still having trouble?
|
||||
|
||||
|
||||
@ -63,7 +63,7 @@ The computer on which you are installing the Office Deployment Tool must have th
|
||||
|
||||
| Prerequisite | Description |
|
||||
|----------------------|--------------------|
|
||||
| Prerequisite software | .Net Framework 4 |
|
||||
| Prerequisite software | .NET Framework 4 |
|
||||
| Supported operating systems | 64-bit version of Windows 10/11<br>64-bit version of Windows 8 or 8.1<br>64-bit version of Windows 7 |
|
||||
|
||||
>[!NOTE]
|
||||
@ -120,7 +120,7 @@ The XML file included in the Office Deployment Tool specifies the product detail
|
||||
|--------------|----------------------------|----------------|
|
||||
| Add element | Specifies which products and languages the package will include. | N/A |
|
||||
| **OfficeClientEdition** (attribute of **Add** element) | Specifies whether Office 2016 32-bit or 64-bit edition will be used. **OfficeClientEdition** must be set to a valid value for the operation to succeed. | `OfficeClientEdition="32"`<br>`OfficeClientEdition="64"` |
|
||||
| Product element | Specifies the application. Project 2016 and Visio 2016 must be specified here as added products to include them in the applications.<br>For more information about Product IDs, see [Product IDs that are supported by the Office Deployment Tool for Click-to-Run](https://support.microsoft.com/kb/2842297). | `Product ID ="O365ProPlusRetail"`<br>`Product ID ="VisioProRetail"`<br>`Product ID ="ProjectProRetail"` |
|
||||
| Product element | Specifies the application. Project 2016 and Visio 2016 must be specified here as added products to include them in the applications.<br>For more information about Product IDs, see [Product IDs that are supported by the Office Deployment Tool for Click-to-Run](/office365/troubleshoot/installation). | `Product ID ="O365ProPlusRetail"`<br>`Product ID ="VisioProRetail"`<br>`Product ID ="ProjectProRetail"` |
|
||||
| Language element | Specifies which language the applications support. | `Language ID="en-us"` |
|
||||
| Version (attribute of **Add** element) | Optional. Specifies which build the package will use.<br>Defaults to latest advertised build (as defined in v32.CAB at the Office source). | `16.1.2.3` |
|
||||
| SourcePath (attribute of **Add** element) | Specifies the location the applications will be saved to. | `Sourcepath = "\\Server\Office2016"` |
|
||||
|
||||
@ -231,7 +231,7 @@ If Windows cannot load the system registry hive into memory, you must restore th
|
||||
If the problem persists, you may want to restore the system state backup to an alternative location, and then retrieve the registry hives to be replaced.
|
||||
|
||||
> [!NOTE]
|
||||
> Starting in Windows 10, version 1803, Windows no longer automatically backs up the system registry to the RegBack folder.This change is by design, and is intended to help reduce the overall disk footprint size of Windows. To recover a system with a corrupt registry hive, Microsoft recommends that you use a system restore point. For more details, check [this article](https://support.microsoft.com/en-us/help/4509719/the-system-registry-is-no-longer-backed-up-to-the-regback-folder-start).
|
||||
> Starting in Windows 10, version 1803, Windows no longer automatically backs up the system registry to the RegBack folder.This change is by design, and is intended to help reduce the overall disk footprint size of Windows. To recover a system with a corrupt registry hive, Microsoft recommends that you use a system restore point. For more details, check [this article](/troubleshoot/windows-client/deployment/system-registry-no-backed-up-regback-folder)
|
||||
|
||||
## Kernel Phase
|
||||
|
||||
@ -414,4 +414,4 @@ If the dump file shows an error that is related to a driver (for example, window
|
||||
5. Copy all the hives from the Regback folder, paste them in the Config folder, and then try to start the computer in Normal mode.
|
||||
|
||||
> [!NOTE]
|
||||
> Starting in Windows 10, version 1803, Windows no longer automatically backs up the system registry to the RegBack folder.This change is by design, and is intended to help reduce the overall disk footprint size of Windows. To recover a system with a corrupt registry hive, Microsoft recommends that you use a system restore point. For more details, check [this article](https://support.microsoft.com/en-us/help/4509719/the-system-registry-is-no-longer-backed-up-to-the-regback-folder-start).
|
||||
> Starting in Windows 10, version 1803, Windows no longer automatically backs up the system registry to the RegBack folder.This change is by design, and is intended to help reduce the overall disk footprint size of Windows. To recover a system with a corrupt registry hive, Microsoft recommends that you use a system restore point. For more details, check [this article](/troubleshoot/windows-client/deployment/system-registry-no-backed-up-regback-folder).
|
||||
|
||||
@ -37,9 +37,8 @@ It is important to understand the different Wi-Fi components involved, their exp
|
||||
The intention of this troubleshooter is to show how to find a starting point in the verbosity of wireless_dbg ETW and home in on the responsible components that are causing the connection problem.
|
||||
|
||||
### Known Issues and fixes
|
||||
** **
|
||||
|
||||
| **OS version** | **Fixed in** |
|
||||
| OS version | Fixed in |
|
||||
| --- | --- |
|
||||
| **Windows 10, version 1803** | [KB4284848](https://support.microsoft.com/help/4284848) |
|
||||
| **Windows 10, version 1709** | [KB4284822](https://support.microsoft.com/help/4284822) |
|
||||
@ -54,13 +53,13 @@ Make sure that you install the latest Windows updates, cumulative updates, and r
|
||||
- [Windows 10 version 1511](https://support.microsoft.com/help/4000824)
|
||||
- [Windows 8.1 and Windows Server 2012 R2](https://support.microsoft.com/help/4009470)
|
||||
- [Windows Server 2012](https://support.microsoft.com/help/4009471)
|
||||
- [Windows 7 SP1 and Windows Server 2008 R2 SP1](https://support.microsoft.com/help/40009469)
|
||||
- [Windows 7 SP1 and Windows Server 2008 R2 SP1](https://support.microsoft.com/help/4009469)
|
||||
|
||||
## Data Collection
|
||||
|
||||
1. Network Capture with ETW. Enter the following at an elevated command prompt:
|
||||
|
||||
```cmd
|
||||
```console
|
||||
netsh trace start wireless_dbg capture=yes overwrite=yes maxsize=4096 tracefile=c:\tmp\wireless.etl
|
||||
```
|
||||
2. Reproduce the issue.
|
||||
@ -70,12 +69,12 @@ Make sure that you install the latest Windows updates, cumulative updates, and r
|
||||
- If intermittent connection drops trigger stop command on a script (ping or test network constantly until fail, then netsh trace stop).
|
||||
3. Stop the trace by entering the following command:
|
||||
|
||||
```cmd
|
||||
```console
|
||||
netsh trace stop
|
||||
```
|
||||
4. To convert the output file to text format:
|
||||
|
||||
```cmd
|
||||
```console
|
||||
netsh trace convert c:\tmp\wireless.etl
|
||||
```
|
||||
|
||||
@ -105,39 +104,39 @@ The wifi connection state machine has the following states:
|
||||
|
||||
Standard wifi connections tend to transition between states such as:
|
||||
|
||||
**Connecting**
|
||||
- Connecting
|
||||
|
||||
Reset --> Ihv_Configuring --> Configuring --> Associating --> Authenticating --> Connected
|
||||
Reset --> Ihv_Configuring --> Configuring --> Associating --> Authenticating --> Connected
|
||||
|
||||
**Disconnecting**
|
||||
- Disconnecting
|
||||
|
||||
Connected --> Roaming --> Wait_For_Disconnected --> Disconnected --> Reset
|
||||
Connected --> Roaming --> Wait_For_Disconnected --> Disconnected --> Reset
|
||||
|
||||
>Filtering the ETW trace with the [TextAnalysisTool](https://github.com/TextAnalysisTool/Releases) (TAT) is an easy first step to determine where a failed connection setup is breaking down. A useful [wifi filter file](#wifi-filter-file) is included at the bottom of this article.
|
||||
Filtering the ETW trace with the [TextAnalysisTool](https://github.com/TextAnalysisTool/Releases) (TAT) is an easy first step to determine where a failed connection setup is breaking down. A useful [wifi filter file](#wifi-filter-file) is included at the bottom of this article.
|
||||
|
||||
Use the **FSM transition** trace filter to see the connection state machine. You can see [an example](#textanalysistool-example) of this filter applied in the TAT at the bottom of this page.
|
||||
|
||||
The following is an example of a good connection setup:
|
||||
|
||||
<pre>
|
||||
```console
|
||||
44676 [2]0F24.1020::2018-09-17 10:22:14.658 [Microsoft-Windows-WLAN-AutoConfig]FSM Transition from State: Disconnected to State: Reset
|
||||
45473 [1]0F24.1020::2018-09-17 10:22:14.667 [Microsoft-Windows-WLAN-AutoConfig]FSM Transition from State: Reset to State: Ihv_Configuring
|
||||
45597 [3]0F24.1020::2018-09-17 10:22:14.708 [Microsoft-Windows-WLAN-AutoConfig]FSM Transition from State: Ihv_Configuring to State: Configuring
|
||||
46085 [2]0F24.17E0::2018-09-17 10:22:14.710 [Microsoft-Windows-WLAN-AutoConfig]FSM Transition from State: Configuring to State: Associating
|
||||
47393 [1]0F24.1020::2018-09-17 10:22:14.879 [Microsoft-Windows-WLAN-AutoConfig]FSM Transition from State: Associating to State: Authenticating
|
||||
49465 [2]0F24.17E0::2018-09-17 10:22:14.990 [Microsoft-Windows-WLAN-AutoConfig]FSM Transition from State: Authenticating to State: Connected
|
||||
</pre>
|
||||
```
|
||||
|
||||
The following is an example of a failed connection setup:
|
||||
|
||||
<pre>
|
||||
```console
|
||||
44676 [2]0F24.1020::2018-09-17 10:22:14.658 [Microsoft-Windows-WLAN-AutoConfig]FSM Transition from State: Disconnected to State: Reset
|
||||
45473 [1]0F24.1020::2018-09-17 10:22:14.667 [Microsoft-Windows-WLAN-AutoConfig]FSM Transition from State: Reset to State: Ihv_Configuring
|
||||
45597 [3]0F24.1020::2018-09-17 10:22:14.708 [Microsoft-Windows-WLAN-AutoConfig]FSM Transition from State: Ihv_Configuring to State: Configuring
|
||||
46085 [2]0F24.17E0::2018-09-17 10:22:14.710 [Microsoft-Windows-WLAN-AutoConfig]FSM Transition from State: Configuring to State: Associating
|
||||
47393 [1]0F24.1020::2018-09-17 10:22:14.879 [Microsoft-Windows-WLAN-AutoConfig]FSM Transition from State: Associating to State: Authenticating
|
||||
49465 [2]0F24.17E0::2018-09-17 10:22:14.990 [Microsoft-Windows-WLAN-AutoConfig]FSM Transition from State: Authenticating to State: Roaming
|
||||
</pre>
|
||||
```
|
||||
|
||||
By identifying the state at which the connection fails, one can focus more specifically in the trace on logs just prior to the last known good state.
|
||||
|
||||
@ -155,7 +154,7 @@ Enable the **FSM transition, SecMgr Transition,** and **AuthMgr Transition** fil
|
||||
|
||||
Continuing with the example above, the combined filters look like this:
|
||||
|
||||
<pre>
|
||||
```console
|
||||
[2] 0C34.2FF0::08/28/17-13:24:28.693 [Microsoft-Windows-WLAN-AutoConfig]FSM Transition from State:
|
||||
Reset to State: Ihv_Configuring
|
||||
[2] 0C34.2FF0::08/28/17-13:24:28.693 [Microsoft-Windows-WLAN-AutoConfig]FSM Transition from State:
|
||||
@ -173,7 +172,7 @@ Associating to State: Authenticating
|
||||
[2] 0C34.2FF0::08/28/17-13:24:29.7512788 [Microsoft-Windows-WLAN-AutoConfig]Port[13] Peer 8A:15:14:B6:25:10 SecMgr Transition DEACTIVATE (11) --> INACTIVE (1)
|
||||
[2] 0C34.2FF0::08/28/17-13:24:29.7513404 [Microsoft-Windows-WLAN-AutoConfig]FSM Transition from State:
|
||||
Authenticating to State: Roaming
|
||||
</pre>
|
||||
```
|
||||
|
||||
> [!NOTE]
|
||||
> In the next to last line the SecMgr transition is suddenly deactivating:<br>
|
||||
@ -182,7 +181,7 @@ Authenticating to State: Roaming
|
||||
|
||||
Enabling the **Microsoft-Windows-WLAN-AutoConfig** filter will show more detail leading to the DEACTIVATE transition:
|
||||
|
||||
<pre>
|
||||
```console
|
||||
[3] 0C34.2FE8::08/28/17-13:24:28.902 [Microsoft-Windows-WLAN-AutoConfig]FSM Transition from State:
|
||||
Associating to State: Authenticating
|
||||
[1] 0C34.275C::08/28/17-13:24:28.960 [Microsoft-Windows-WLAN-AutoConfig]Port[13] Peer 8A:15:14:B6:25:10 SecMgr Transition START AUTH (3) --> WAIT FOR AUTH SUCCESS (4)
|
||||
@ -196,7 +195,7 @@ Associating to State: Authenticating
|
||||
[2] 0C34.2FF0::08/28/17-13:24:29.7512788 [Microsoft-Windows-WLAN-AutoConfig]Port[13] Peer 8A:15:14:B6:25:10 SecMgr Transition DEACTIVATE (11) --> INACTIVE (1)
|
||||
[2] 0C34.2FF0::08/28/17-13:24:29.7513404 [Microsoft-Windows-WLAN-AutoConfig]FSM Transition from State:
|
||||
Authenticating to State: Roaming
|
||||
</pre>
|
||||
```
|
||||
|
||||
The trail backwards reveals a **Port Down** notification:
|
||||
|
||||
@ -208,7 +207,7 @@ Below, the MSM is the native wifi stack. These are Windows native wifi drivers w
|
||||
|
||||
Enable trace filter for **[Microsoft-Windows-NWifi]:**
|
||||
|
||||
<pre>
|
||||
```console
|
||||
[3] 0C34.2FE8::08/28/17-13:24:28.902 [Microsoft-Windows-WLAN-AutoConfig]FSM Transition from State:
|
||||
Associating to State: Authenticating
|
||||
[1] 0C34.275C::08/28/17-13:24:28.960 [Microsoft-Windows-WLAN-AutoConfig]Port[13] Peer 8A:15:14:B6:25:10 SecMgr Transition START AUTH (3) --> WAIT FOR AUTH SUCCESS (4)
|
||||
@ -222,12 +221,14 @@ Associating to State: Authenticating
|
||||
[2] 0C34.2FF0::08/28/17-13:24:29.751 [Microsoft-Windows-WLAN-AutoConfig]Port[13] Peer 8A:15:14:B6:25:10 SecMgr Transition WAIT FOR AUTH SUCCESS (7) --> DEACTIVATE (11)
|
||||
[2] 0C34.2FF0::08/28/17-13:24:29.7512788 [Microsoft-Windows-WLAN-AutoConfig]Port[13] Peer 8A:15:14:B6:25:10 SecMgr Transition DEACTIVATE (11) --> INACTIVE (1)
|
||||
[2] 0C34.2FF0::08/28/17-13:24:29.7513404 [Microsoft-Windows-WLAN-AutoConfig]FSM Transition from State:
|
||||
Authenticating to State: Roaming</pre>
|
||||
Authenticating to State: Roaming
|
||||
```
|
||||
|
||||
In the trace above, we see the line:
|
||||
|
||||
<pre>
|
||||
[0]0000.0000::08/28/17-13:24:29.127 [Microsoft-Windows-NWiFi]DisAssoc: 0x8A1514B62510 Reason: 0x4</pre>
|
||||
```console
|
||||
[0]0000.0000::08/28/17-13:24:29.127 [Microsoft-Windows-NWiFi]DisAssoc: 0x8A1514B62510 Reason: 0x4
|
||||
```
|
||||
|
||||
This is followed by **PHY_STATE_CHANGE** and **PORT_DOWN** events due to a disassociate coming from the Access Point (AP), as an indication to deny the connection. This could be due to invalid credentials, connection parameters, loss of signal/roaming, and various other reasons for aborting a connection. The action here would be to examine the reason for the disassociate sent from the indicated AP MAC (8A:15:14:B6:25:10). This would be done by examining internal logging/tracing from the AP.
|
||||
|
||||
@ -238,7 +239,7 @@ This is followed by **PHY_STATE_CHANGE** and **PORT_DOWN** events due to a disas
|
||||
|
||||
## Example ETW capture
|
||||
|
||||
<pre>
|
||||
```console
|
||||
C:\tmp>netsh trace start wireless_dbg capture=yes overwrite=yes maxsize=4096 tracefile=c:\tmp\wireless.etl
|
||||
|
||||
Trace configuration:
|
||||
@ -279,7 +280,7 @@ C:\tmp>dir
|
||||
01/09/2019 02:59 PM 2,786,540 wireless.txt
|
||||
3 File(s) 10,395,004 bytes
|
||||
2 Dir(s) 46,648,332,288 bytes free
|
||||
</pre>
|
||||
```
|
||||
|
||||
## Wifi filter file
|
||||
|
||||
|
||||
@ -73,7 +73,7 @@ Ensure [Remote Credential Guard](/windows/access-protection/remote-credential-gu
|
||||
> When you connect to the remote PC, enter your account name in this format: AzureAD\yourloginid@domain.com.
|
||||
|
||||
> [!NOTE]
|
||||
> If you cannot connect using Remote Desktop Connection 6.0, you must turn off the new features of RDP 6.0 and revert back to RDP 5.0 by making a few changes in the RDP file. See the details in this [support article](https://support.microsoft.com/help/941641/remote-desktop-connection-6-0-prompts-you-for-credentials-before-you-e).
|
||||
> If you cannot connect using Remote Desktop Connection 6.0, you must turn off the new features of RDP 6.0 and revert back to RDP 5.0 by making a few changes in the RDP file. See the details in this [support article](/troubleshoot/windows-server/remote/remote-desktop-connection-6-prompts-credentials).
|
||||
|
||||
## Supported configurations
|
||||
|
||||
|
||||
@ -32,7 +32,7 @@ In Windows 10, version 1607, the following Group Policy settings apply only to W
|
||||
| **Do not show Windows Tips** | Computer Configuration > Administrative Templates > Windows Components > Cloud Content | For more info, see [Windows spotlight on the lock screen](/windows/configuration/windows-spotlight) |
|
||||
| **Force a specific default lock screen image** | Computer Configuration > Administrative Templates > Control Panel > Personalization | For more info, see [Windows spotlight on the lock screen](/windows/configuration/windows-spotlight) |
|
||||
| **Start layout** | User Configuration\Administrative Templates\Start Menu and Taskbar | In Windows 10, version 1703, this policy setting can be applied to Windows 10 Pro. For more info, see [Manage Windows 10 Start layout options and policies](/windows/configuration/windows-10-start-layout-options-and-policies) |
|
||||
| **Turn off the Store application** | Computer Configuration > Administrative Templates > Windows Components > Store > Turn off the Store application<br><br>User Configuration > Administrative Templates > Windows Components > Store > Turn off the Store application | For more info, see [Knowledge Base article# 3135657](https://support.microsoft.com/kb/3135657). |
|
||||
| **Turn off the Store application** | Computer Configuration > Administrative Templates > Windows Components > Store > Turn off the Store application<br><br>User Configuration > Administrative Templates > Windows Components > Store > Turn off the Store application | For more info, see [Knowledge Base article# 3135657](/troubleshoot/windows-client/group-policy/cannot-disable-microsoft-store). |
|
||||
| **Only display the private store within the Microsoft Store app** | Computer Configuration > Administrative Templates > Windows Components > Store > Only display the private store within the Microsoft Store app<br><br>User Configuration > Administrative Templates > Windows Components > Store > Only display the private store within the Microsoft Store app | For more info, see [Manage access to private store](/microsoft-store/manage-access-to-private-store) |
|
||||
| **Don't search the web or display web results** | Computer Configuration\Administrative Templates\Windows Components\Search\Don't search the web or display web results | For more info, see [Cortana integration in your enterprise](/windows/configuration/cortana-at-work/cortana-at-work-overview) |
|
||||
|
||||
|
||||
@ -26,7 +26,7 @@ To make use of the Settings App group policies on Windows server 2016, install f
|
||||
>[!Note]
|
||||
>Each server that you want to manage access to the Settings App must be patched.
|
||||
|
||||
If your company uses one or the PolicyDefinitions folder of the Domain Controllers used for Group Policy management, to centrally manage the new policies, copy the ControlPanel.admx and ControlPanel.adml file to [Central Store](https://support.microsoft.com/help/3087759/how-to-create-and-manage-the-central-store-for-group-policy-administra).
|
||||
If your company uses one or the PolicyDefinitions folder of the Domain Controllers used for Group Policy management, to centrally manage the new policies, copy the ControlPanel.admx and ControlPanel.adml file to [Central Store](/troubleshoot/windows-client/group-policy/create-and-manage-central-store).
|
||||
|
||||
This policy is available for both User and Computer depending on the version of the OS. Windows Server 2016 with KB 4457127 applied will have both User and Computer policy. Windows 10, version 1703, added Computer policy for the Settings app. Windows 10, version 1809, added User policy for the Settings app.
|
||||
|
||||
|
||||
@ -42,7 +42,7 @@ The name of the folder in which you store the mandatory profile must use the cor
|
||||
| Windows 10, versions 1507 and 1511 | N/A | v5 |
|
||||
| Windows 10, versions 1607, 1703, 1709, 1803, 1809, 1903 and 1909 | Windows Server 2016 and Windows Server 2019 | v6 |
|
||||
|
||||
For more information, see [Deploy Roaming User Profiles, Appendix B](/windows-server/storage/folder-redirection/deploy-roaming-user-profiles#appendix-b-profile-version-reference-information) and [Roaming user profiles versioning in Windows 10 and Windows Server Technical Preview](https://support.microsoft.com/kb/3056198).
|
||||
For more information, see [Deploy Roaming User Profiles, Appendix B](/windows-server/storage/folder-redirection/deploy-roaming-user-profiles#appendix-b-profile-version-reference-information) and [Roaming user profiles versioning in Windows 10 and Windows Server Technical Preview](/troubleshoot/windows-server/user-profiles-and-logon/roaming-user-profiles-versioning).
|
||||
|
||||
## Mandatory user profile
|
||||
|
||||
|
||||
@ -49,9 +49,10 @@ For this policy to work, you must verify that the MDM service provider allows th
|
||||
## Verify auto-enrollment requirements and settings
|
||||
To ensure that the auto-enrollment feature is working as expected, you must verify that various requirements and settings are configured correctly.
|
||||
The following steps demonstrate required settings using the Intune service:
|
||||
|
||||
1. Verify that the user who is going to enroll the device has a valid Intune license.
|
||||
|
||||
|
||||
:::image type="content" alt-text="Intune license verification." source="images/auto-enrollment-intune-license-verification.png" lightbox="images/auto-enrollment-intune-license-verification.png":::
|
||||
|
||||
2. Verify that auto-enrollment is activated for those users who are going to enroll the devices into Intune. For additional details, see [Azure AD and Microsoft Intune: Automatic MDM enrollment in the new Portal](./azure-ad-and-microsoft-intune-automatic-mdm-enrollment-in-the-new-portal.md).
|
||||
|
||||
@ -83,7 +84,7 @@ The following steps demonstrate required settings using the Intune service:
|
||||
|
||||
6. Some tenants might have both **Microsoft Intune** and **Microsoft Intune Enrollment** under **Mobility**. Make sure that your auto-enrollment settings are configured under **Microsoft Intune** instead of **Microsoft Intune Enrollment**.
|
||||
|
||||
|
||||
:::image type="content" alt-text="Mobility setting MDM intune." source="images/auto-enrollment-microsoft-intune-setting.png" lightbox="images/auto-enrollment-microsoft-intune-setting.png":::
|
||||
|
||||
7. Verify that the *Enable Automatic MDM enrollment using default Azure AD credentials* group policy (**Local Group Policy Editor > Computer Configuration > Policies > Administrative Templates > Windows Components > MDM**) is properly deployed to all devices which should be enrolled into Intune.
|
||||
You may contact your domain administrators to verify if the group policy has been deployed successfully.
|
||||
@ -92,7 +93,7 @@ You may contact your domain administrators to verify if the group policy has bee
|
||||
|
||||
9. Verify that Microsoft Intune should allow enrollment of Windows devices.
|
||||
|
||||
|
||||
:::image type="content" alt-text="Enrollment of Windows devices." source="images/auto-enrollment-enrollment-of-windows-devices.png" lightbox="images/auto-enrollment-enrollment-of-windows-devices.png":::
|
||||
|
||||
## Configure the auto-enrollment Group Policy for a single PC
|
||||
|
||||
@ -113,12 +114,11 @@ Requirements:
|
||||
|
||||
3. In **Local Computer Policy**, click **Administrative Templates** > **Windows Components** > **MDM**.
|
||||
|
||||
> [!div class="mx-imgBorder"]
|
||||
> 
|
||||
:::image type="content" alt-text="MDM policies." source="images/autoenrollment-mdm-policies.png" lightbox="images/autoenrollment-mdm-policies.png":::
|
||||
|
||||
4. Double-click **Enable automatic MDM enrollment using default Azure AD credentials** (previously called **Auto MDM Enrollment with AAD Token** in Windows 10, version 1709). For ADMX files in Windows 10, version 1903 and later, select **User Credential** as the Selected Credential Type to use.
|
||||
|
||||
|
||||
:::image type="content" alt-text="MDM autoenrollment policy." source="images/autoenrollment-policy.png" lightbox="images/autoenrollment-policy.png":::
|
||||
|
||||
5. Click **Enable**, and select **User Credential** from the dropdown **Select Credential Type to Use**, then click **OK**.
|
||||
|
||||
@ -159,7 +159,7 @@ Requirements:
|
||||
|
||||
3. In **Task Scheduler Library**, open **Microsoft > Windows** , then click **EnterpriseMgmt**.
|
||||
|
||||
|
||||
:::image type="content" alt-text="Auto-enrollment scheduled task." source="images/autoenrollment-scheduled-task.png" lightbox="images/autoenrollment-scheduled-task.png":::
|
||||
|
||||
To see the result of the task, move the scroll bar to the right to see the **Last Run Result**. Note that **0x80180026** is a failure message (MENROLL\_E_DEVICE\_MANAGEMENT_BLOCKED). You can see the logs in the **History** tab.
|
||||
|
||||
@ -222,7 +222,7 @@ Requirements:
|
||||
|
||||
5. Copy PolicyDefinitions folder to **\\SYSVOL\contoso.com\policies\PolicyDefinitions**.
|
||||
|
||||
If this folder does not exist, then be aware that you will be switching to a [central policy store](https://support.microsoft.com/help/3087759/how-to-create-and-manage-the-central-store-for-group-policy-administra) for your entire domain.
|
||||
If this folder does not exist, then be aware that you will be switching to a [central policy store](/troubleshoot/windows-client/group-policy/create-and-manage-central-store) for your entire domain.
|
||||
|
||||
6. Wait for the SYSVOL DFSR replication to be completed for the policy to be available.
|
||||
|
||||
@ -249,21 +249,21 @@ To collect Event Viewer logs:
|
||||
|
||||
3. Search for event ID 75, which represents a successful auto-enrollment. Here is an example screenshot that shows the auto-enrollment completed successfully:
|
||||
|
||||
|
||||
:::image type="content" alt-text="Event ID 75." source="images/auto-enrollment-troubleshooting-event-id-75.png" lightbox="images/auto-enrollment-troubleshooting-event-id-75.png":::
|
||||
|
||||
If you cannot find event ID 75 in the logs, it indicates that the auto-enrollment failed. This can happen because of the following reasons:
|
||||
|
||||
- The enrollment failed with error. In this case, search for event ID 76, which represents failed auto-enrollment. Here is an example screenshot that shows that the auto-enrollment failed:
|
||||
|
||||
|
||||
:::image type="content" alt-text="Event ID 76." source="images/auto-enrollment-troubleshooting-event-id-76.png" lightbox="images/auto-enrollment-troubleshooting-event-id-76.png":::
|
||||
|
||||
To troubleshoot, check the error code that appears in the event. See [Troubleshooting Windows device enrollment problems in Microsoft Intune](https://support.microsoft.com/en-ph/help/4469913/troubleshooting-windows-device-enrollment-problems-in-microsoft-intune) for more information.
|
||||
To troubleshoot, check the error code that appears in the event. See [Troubleshooting Windows device enrollment problems in Microsoft Intune](/troubleshoot/mem/intune/troubleshoot-windows-enrollment-errors) for more information.
|
||||
|
||||
- The auto-enrollment did not trigger at all. In this case, you will not find either event ID 75 or event ID 76. To know the reason, you must understand the internal mechanisms happening on the device as described in the following section.
|
||||
|
||||
The auto-enrollment process is triggered by a task (**Microsoft > Windows > EnterpriseMgmt**) within the task-scheduler. This task appears if the *Enable automatic MDM enrollment using default Azure AD credentials* group policy (**Computer Configuration > Policies > Administrative Templates > Windows Components > MDM**) is successfully deployed to the target machine as shown in the following screenshot:
|
||||
|
||||
|
||||
:::image type="content" alt-text="Task scheduler." source="images/auto-enrollment-task-scheduler.png" lightbox="images/auto-enrollment-task-scheduler.png":::
|
||||
|
||||
> [!Note]
|
||||
> This task isn't visible to standard users - run Scheduled Tasks with administrative credentials to find the task.
|
||||
@ -272,24 +272,24 @@ To collect Event Viewer logs:
|
||||
**Applications and Services Logs > Microsoft > Windows > Task Scheduler > Operational**.
|
||||
Look for an entry where the task scheduler created by enrollment client for automatically enrolling in MDM from AAD is triggered by event ID 107.
|
||||
|
||||
|
||||
:::image type="content" alt-text="Event ID 107." source="images/auto-enrollment-event-id-107.png" lightbox="images/auto-enrollment-event-id-107.png":::
|
||||
|
||||
When the task is completed, a new event ID 102 is logged.
|
||||
|
||||
|
||||
:::image type="content" alt-text="Event ID 102." source="images/auto-enrollment-event-id-102.png" lightbox="images/auto-enrollment-event-id-102.png":::
|
||||
|
||||
Note that the task scheduler log displays event ID 102 (task completed) regardless of the auto-enrollment success or failure. This means that the task scheduler log is only useful to confirm if the auto-enrollment task is triggered or not. It does not indicate the success or failure of auto-enrollment.
|
||||
|
||||
If you cannot see from the log that task Schedule created by enrollment client for automatically enrolling in MDM from AAD is initiated, there is possibly issue with the group policy. Immediately run the command `gpupdate /force` in command prompt to get the GPO applied. If this still does not help, further troubleshooting on the Active Directory is required.
|
||||
One frequently seen error is related to some outdated enrollment entries in the registry on the target client device (**HKLM > Software > Microsoft > Enrollments**). If a device has been enrolled (can be any MDM solution and not only Intune), some enrollment information added into the registry is seen:
|
||||
|
||||
|
||||
:::image type="content" alt-text="Outdated enrollment entries." source="images/auto-enrollment-outdated-enrollment-entries.png" lightbox="images/auto-enrollment-outdated-enrollment-entries.png":::
|
||||
|
||||
By default, these entries are removed when the device is un-enrolled, but occasionally the registry key remains even after un-enrollment. In this case, `gpupdate /force` fails to initiate the auto-enrollment task and error code 2149056522 is displayed in the **Applications and Services Logs > Microsoft > Windows > Task Scheduler > Operational** event log file under event ID 7016.
|
||||
|
||||
A resolution to this issue is to remove the registry key manually. If you do not know which registry key to remove, go for the key which displays most entries as the screenshot above. All other keys will display fewer entries as shown in the following screenshot:
|
||||
|
||||
|
||||
:::image type="content" alt-text="Manually deleted entries." source="images/auto-enrollment-activation-verification-less-entries.png" lightbox="images/auto-enrollment-activation-verification-less-entries.png":::
|
||||
|
||||
### Related topics
|
||||
|
||||
@ -298,7 +298,7 @@ To collect Event Viewer logs:
|
||||
- [Link a Group Policy Object](/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/cc732979(v=ws.11))
|
||||
- [Filter Using Security Groups](/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/cc752992(v=ws.11))
|
||||
- [Enforce a Group Policy Object Link](/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/cc753909(v=ws.11))
|
||||
- [Group Policy Central Store](https://support.microsoft.com/help/3087759/how-to-create-and-manage-the-central-store-for-group-policy-administra)
|
||||
- [Group Policy Central Store](/troubleshoot/windows-client/group-policy/create-and-manage-central-store)
|
||||
- [Getting started with Cloud Native Windows Endpoints](/mem/cloud-native-windows-endpoints)
|
||||
- [A Framework for Windows endpoint management transformation](https://techcommunity.microsoft.com/t5/windows-it-pro-blog/a-framework-for-windows-endpoint-management-transformation/ba-p/2460684)
|
||||
- [Success with remote Windows Autopilot and Hybrid Azure Active Director join](https://techcommunity.microsoft.com/t5/intune-customer-success/success-with-remote-windows-autopilot-and-hybrid-azure-active/ba-p/2749353)
|
||||
|
||||
@ -241,7 +241,7 @@ The data type is integer. Supported operation is Get.
|
||||
<p>Added in Windows 10, version 1703. Node for the Skype for Business settings.
|
||||
|
||||
<a href="" id="inboxapps-skypeforbusiness-domainname"></a>**InBoxApps/SkypeForBusiness/DomainName**
|
||||
<p>Added in Windows 10, version 1703. Specifies the domain of the Skype for Business account when you are using Active Directory. For more information, see <a href="https://support.office.com/en-us/article/Set-up-Skype-for-Business-Online-40296968-e779-4259-980b-c2de1c044c6e?ui=en-US&rs=en-US&ad=US#bkmk_users" data-raw-source="[Set up Skype for Business Online](https://support.office.com/en-us/article/Set-up-Skype-for-Business-Online-40296968-e779-4259-980b-c2de1c044c6e?ui=en-US&rs=en-US&ad=US#bkmk_users)">Set up Skype for Business Online</a>.
|
||||
<p>Added in Windows 10, version 1703. Specifies the domain of the Skype for Business account when you are using Active Directory. For more information, see <a href="/SkypeForBusiness/set-up-skype-for-business-online" data-raw-source="[Set up Skype for Business Online](/SkypeForBusiness/set-up-skype-for-business-online)">Set up Skype for Business Online</a>.
|
||||
|
||||
<p>The data type is string. Supported operation is Get and Replace.
|
||||
|
||||
|
||||
@ -85,7 +85,7 @@ To troubleshoot Stop error messages, follow these general steps:
|
||||
>
|
||||
>To do this, see [How to perform a clean boot in Windows](https://support.microsoft.com/help/929135).
|
||||
>
|
||||
>You can disable a driver by following the steps in [How to temporarily deactivate the kernel mode filter driver in Windows](https://support.microsoft.com/help/816071).
|
||||
>You can disable a driver by following the steps in [How to temporarily deactivate the kernel mode filter driver in Windows](/troubleshoot/windows-server/performance/deactivate-kernel-mode-filter-driver).
|
||||
>
|
||||
>You may also want to consider the option of rolling back changes or reverting to the last-known working state. For more information, see [Roll Back a Device Driver to a Previous Version](/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/cc732648(v=ws.11)).
|
||||
|
||||
@ -129,9 +129,9 @@ More information on how to use Dumpchk.exe to check your dump files:
|
||||
|
||||
### Pagefile Settings
|
||||
|
||||
- [Introduction of page file in Long-Term Servicing Channel and Semi-Annual Channel of Windows](https://support.microsoft.com/help/4133658)
|
||||
- [How to determine the appropriate page file size for 64-bit versions of Windows](https://support.microsoft.com/help/2860880)
|
||||
- [How to generate a kernel or a complete memory dump file in Windows Server 2008 and Windows Server 2008 R2](https://support.microsoft.com/help/969028)
|
||||
- [Introduction of page file in Long-Term Servicing Channel and Semi-Annual Channel of Windows](/windows/client-management/introduction-page-file)
|
||||
- [How to determine the appropriate page file size for 64-bit versions of Windows](/windows/client-management/determine-appropriate-page-file-size)
|
||||
- [How to generate a kernel or a complete memory dump file in Windows Server 2008 and Windows Server 2008 R2](/windows/client-management/generate-kernel-or-complete-crash-dump)
|
||||
|
||||
### Memory dump analysis
|
||||
|
||||
@ -169,13 +169,13 @@ You can use the tools such as Windows Software Development KIT (SDK) and Symbols
|
||||
|
||||
6. Click on **Open Crash Dump**, and then open the memory.dmp file that you copied. See the example below.
|
||||
|
||||
|
||||
:::image type="content" alt-text="WinDbg img." source="images/windbg.png" lightbox="images/windbg.png":::
|
||||
|
||||
7. There should be a link that says **!analyze -v** under **Bugcheck Analysis**. Click that link. This will enter the command !analyze -v in the prompt at the bottom of the page.
|
||||
|
||||
8. A detailed bugcheck analysis will appear. See the example below.
|
||||
|
||||
|
||||
:::image type="content" alt-text="Bugcheck analysis." source="images/bugcheck-analysis.png" lightbox="images/bugcheck-analysis.png":::
|
||||
|
||||
9. Scroll down to the section where it says **STACK_TEXT**. There will be rows of numbers with each row followed by a colon and some text. That text should tell you what DLL is causing the crash and if applicable what service is crashing the DLL.
|
||||
|
||||
|
||||
@ -38,7 +38,7 @@ Before getting in to troubleshooting the <em>*RPC server unavailable</em>- error
|
||||
|
||||
Client A wants to execute some functions or wants to make use of a service running on the remote server, will first establish the connection with the Remote Server by doing a three-way handshake.
|
||||
|
||||
|
||||
:::image type="content" alt-text="Diagram illustrating connection to remote server." source="images/rpc-flow.png" lightbox="images/rpc-flow.png":::
|
||||
|
||||
RPC ports can be given from a specific range as well.
|
||||
### Configure RPC dynamic port allocation
|
||||
@ -47,7 +47,7 @@ Remote Procedure Call (RPC) dynamic port allocation is used by server applicatio
|
||||
|
||||
Customers using firewalls may want to control which ports RPC is using so that their firewall router can be configured to forward only these Transmission Control Protocol (UDP and TCP) ports. Many RPC servers in Windows let you specify the server port in custom configuration items such as registry entries. When you can specify a dedicated server port, you know what traffic flows between the hosts across the firewall, and you can define what traffic is allowed in a more directed manner.
|
||||
|
||||
As a server port, please choose a port outside of the range you may want to specify below. You can find a comprehensive list of server ports that are used in Windows and major Microsoft products in the article [Service overview and network port requirements for Windows](https://support.microsoft.com/help/832017).
|
||||
As a server port, please choose a port outside of the range you may want to specify below. You can find a comprehensive list of server ports that are used in Windows and major Microsoft products in the article [Service overview and network port requirements for Windows](/troubleshoot/windows-server/networking/service-overview-and-network-port-requirements).
|
||||
The article also lists the RPC servers and which RPC servers can be configured to use custom server ports beyond the facilities the RPC runtime offers.
|
||||
|
||||
Some firewalls also allow for UUID filtering where it learns from a RPC Endpoint Mapper request for a RPC interface UUID. The response has the server port number, and a subsequent RPC Bind on this port is then allowed to pass.
|
||||
@ -110,13 +110,13 @@ If you would like to do a deep dive as to how it works, see [RPC over IT/Pro](ht
|
||||
|
||||
The best thing to always troubleshoot RPC issues before even getting in to traces is by making use of tools like **PortQry**. You can quickly determine if you are able to make a connection by running the command:
|
||||
|
||||
```cmd
|
||||
```console
|
||||
Portqry.exe -n <ServerIP> -e 135
|
||||
```
|
||||
|
||||
This would give you a lot of output to look for, but you should be looking for <em>*ip_tcp</em>- and the port number in the brackets, which tells whether you were successfully able to get a dynamic port from EPM and also make a connection to it. If the above fails, you can typically start collecting simultaneous network traces. Something like this from the output of “PortQry”:
|
||||
|
||||
```cmd
|
||||
```console
|
||||
Portqry.exe -n 169.254.0.2 -e 135
|
||||
```
|
||||
Partial output below:
|
||||
@ -141,17 +141,20 @@ The one in bold is the ephemeral port number that you made a connection to succe
|
||||
You can run the commands below to leverage Windows inbuilt netsh captures, to collect a simultaneous trace. Remember to execute the below on an “Admin CMD”, it requires elevation.
|
||||
|
||||
- On the client
|
||||
```cmd
|
||||
|
||||
```console
|
||||
Netsh trace start scenario=netconnection capture=yes tracefile=c:\client_nettrace.etl maxsize=512 overwrite=yes report=yes
|
||||
```
|
||||
|
||||
- On the Server
|
||||
```cmd
|
||||
|
||||
```console
|
||||
Netsh trace start scenario=netconnection capture=yes tracefile=c:\server_nettrace.etl maxsize=512 overwrite=yes report=yes
|
||||
```
|
||||
|
||||
Now try to reproduce your issue from the client machine and as soon as you feel the issue has been reproduced, go ahead and stop the traces using the command
|
||||
```cmd
|
||||
|
||||
```console
|
||||
Netsh trace stop
|
||||
```
|
||||
|
||||
@ -163,13 +166,13 @@ Open the traces in [Microsoft Network Monitor 3.4](troubleshoot-tcpip-netmon.md)
|
||||
|
||||
- Now check if you are getting a response from the server. If you get a response, note the dynamic port number that you have been allocated to use.
|
||||
|
||||
|
||||
:::image type="content" alt-text="Screenshot of Network Monitor with dynamic port highlighted." source="images/tcp-ts-23.png" lightbox="images/tcp-ts-23.png":::
|
||||
|
||||
- Check if we are connecting successfully to this Dynamic port successfully.
|
||||
|
||||
- The filter should be something like this: `tcp.port==<dynamic-port-allocated>` and `ipv4.address==<server-ip>`
|
||||
|
||||
|
||||
:::image type="content" alt-text="Screenshot of Network Monitor with filter applied." source="images/tcp-ts-24.png" lightbox="images/tcp-ts-24.png":::
|
||||
|
||||
This should help you verify the connectivity and isolate if any network issues are seen.
|
||||
|
||||
@ -178,7 +181,7 @@ This should help you verify the connectivity and isolate if any network issues a
|
||||
|
||||
The most common reason why we would see the RPC server unavailable is when the dynamic port that the client tries to connect is not reachable. The client side trace would then show TCP SYN retransmits for the dynamic port.
|
||||
|
||||
|
||||
:::image type="content" alt-text="Screenshot of Network Monitor with TCP SYN retransmits." source="images/tcp-ts-25.png" lightbox="images/tcp-ts-25.png":::
|
||||
|
||||
The port cannot be reachable due to one of the following reasons:
|
||||
|
||||
|
||||
@ -133,7 +133,7 @@ If the computer is no longer frozen and now is running in a good state, use the
|
||||
To allow the operating system to generate a memory dump file at an NMI interruption, set the value of the [NMICrashDump](/previous-versions/windows/it-pro/windows-server-2003/cc783271(v=ws.10)) registry entry to `1` (REG_DWORD). Then, restart the computer to apply this change.
|
||||
|
||||
> [!NOTE]
|
||||
> This is applicable only for Windows 7, Windows Server 2008 R2, and earlier versions of Windows. For Windows 8 Windows Server 2012, and later versions of Windows, the NMICrashDump registry key is no longer required, and an NMI interruption will result in [a Stop error that follows a memory dump data collection](https://support.microsoft.com/help/2750146).
|
||||
> This is applicable only for Windows 7, Windows Server 2008 R2, and earlier versions of Windows. For Windows 8 Windows Server 2012, and later versions of Windows, the NMICrashDump registry key is no longer required, and an NMI interruption will result in [a Stop error that follows a memory dump data collection](/troubleshoot/windows-client/performance/nmi-hardware-failure-error).
|
||||
|
||||
4. When the computer exhibits the problem, hold down the right **Ctrl** key, and press the **Scroll Lock** key two times to generate a memory dump file.
|
||||
|
||||
@ -158,17 +158,17 @@ Learn how to use Dumpchk.exe to check your dump files:
|
||||
|
||||
You can use Windows Performance Monitor to examine how programs that you run affect your computer's performance, both in real time and by collecting log data for later analysis. To create performance counter and event trace log collections on local and remote systems, run the following commands in a command prompt as administrator:
|
||||
|
||||
```cmd
|
||||
```console
|
||||
Logman create counter LOGNAME_Long -u DOMAIN\USERNAME * -f bincirc -v mmddhhmm -max 500 -c "\\COMPUTERNAME\LogicalDisk(*)\*" "\\COMPUTERNAME\Memory\*" "\\COMPUTERNAME\Network Interface(*)\*" "\\COMPUTERNAME\Paging File(*)\*" "\\COMPUTERNAME\PhysicalDisk(*)\*" "\\COMPUTERNAME\Process(*)\*" "\\COMPUTERNAME\Redirector\*" "\\COMPUTERNAME\Server\*" "\\COMPUTERNAME\System\*" "\\COMPUTERNAME\Terminal Services\*" "\\COMPUTERNAME\Processor(*)\*" "\\COMPUTERNAME\Cache\*" -si 00:05:00
|
||||
```
|
||||
|
||||
```cmd
|
||||
```console
|
||||
Logman create counter LOGNAME_Short -u DOMAIN\USERNAME * -f bincirc -v mmddhhmm -max 500 -c "\\COMPUTERNAME\LogicalDisk(*)\*" "\\COMPUTERNAME\Memory\*" "\\COMPUTERNAME\Network Interface(*)\*" "\\COMPUTERNAME\Paging File(*)\*" "\\COMPUTERNAME\PhysicalDisk(*)\*" "\\COMPUTERNAME\Process(*)\*" "\\COMPUTERNAME\Redirector\*" "\\COMPUTERNAME\Server\*" "\\COMPUTERNAME\System\*" "\\COMPUTERNAME\Terminal Services\*" "\\COMPUTERNAME\Processor(*)\*" "\\COMPUTERNAME\Cache\*" -si 00:00:10
|
||||
```
|
||||
|
||||
Then, you can start or stop the log by running the following commands:
|
||||
|
||||
```cmd
|
||||
```console
|
||||
logman start LOGNAME_Long / LOGNAME_Short
|
||||
logman stop LOGNAME_Long / LOGNAME_Short
|
||||
```
|
||||
@ -283,6 +283,6 @@ The memory dump process occurs by pressing the RIGHT CTRL + SCROLL LOCK + SCROLL
|
||||
|
||||
On Windows Server 2008, you may not have enough free disk space to generate a complete memory dump file on the system volume. There's a [hotfix](https://support.microsoft.com/help/957517) that allows for the data collection even though there isn't sufficient space on the system drive to store the memory dump file.
|
||||
|
||||
Additionally, on Windows Server 2008 Service Pack (SP2), there's a second option if the system drive doesn't have sufficient space. Namely, you can use the DedicatedDumpFile registry entry. To learn how to use the registry entry, see [New behavior in Windows Vista and Windows Server 2008](https://support.microsoft.com/help/969028).
|
||||
Additionally, on Windows Server 2008 Service Pack (SP2), there's a second option if the system drive doesn't have sufficient space. Namely, you can use the DedicatedDumpFile registry entry. To learn how to use the registry entry, see [New behavior in Windows Vista and Windows Server 2008](/windows/client-management/generate-kernel-or-complete-crash-dump).
|
||||
|
||||
For more information, see [How to use the DedicatedDumpFile registry value to overcome space limitations on the system drive](https://blogs.msdn.com/b/ntdebugging/archive/2010/04/02/how-to-use-the-dedicateddumpfile-registry-value-to-overcome-space-limitations-on-the-system-drive-when-capturing-a-system-memory-dump.aspx).
|
||||
@ -20,7 +20,7 @@ Your employees can use Cortana to help manage their day and be more productive b
|
||||
|
||||
**See also:**
|
||||
|
||||
[Known issues for Windows Desktop Search and Cortana in Windows 10](https://support.microsoft.com/help/3206883/known-issues-for-windows-desktop-search-and-cortana-in-windows-10).
|
||||
[Known issues for Windows Desktop Search and Cortana in Windows 10](/troubleshoot/windows-client/shell-experience/windows-desktop-search-and-cortana-issues).
|
||||
|
||||
### Before you begin
|
||||
There are a few things to be aware of before you start using Cortana in Windows 10, versions 1909 and earlier.
|
||||
|
||||
@ -205,7 +205,7 @@ Clear-AssignedAccess
|
||||
|
||||
|
||||
>[!IMPORTANT]
|
||||
>When Exchange Active Sync (EAS) password restrictions are active on the device, the autologon feature does not work. This behavior is by design. For more informations, see [How to turn on automatic logon in Windows](https://support.microsoft.com/help/324737/how-to-turn-on-automatic-logon-in-windows).
|
||||
>When Exchange Active Sync (EAS) password restrictions are active on the device, the autologon feature does not work. This behavior is by design. For more informations, see [How to turn on automatic logon in Windows](/troubleshoot/windows-server/user-profiles-and-logon/turn-on-automatic-logon).
|
||||
|
||||
When you use the **Provision kiosk devices** wizard in Windows Configuration Designer, you can configure the kiosk to run either a Universal Windows app or a Windows desktop application.
|
||||
|
||||
|
||||
@ -353,7 +353,7 @@ Starting with Windows 10 version 1809, you can configure the display name that w
|
||||
On domain-joined devices, local user accounts aren't shown on the sign-in screen by default. To show the **AutoLogonAccount** on the sign-in screen, enable the following Group Policy setting: **Computer Configuration > Administrative Templates > System > Logon > Enumerate local users on domain-joined computers**. (The corresponding MDM policy setting is [WindowsLogon/EnumerateLocalUsersOnDomainJoinedComputers in the Policy CSP](/windows/client-management/mdm/policy-csp-windowslogon#windowslogon-enumeratelocalusersondomainjoinedcomputers).)
|
||||
|
||||
>[!IMPORTANT]
|
||||
>When Exchange Active Sync (EAS) password restrictions are active on the device, the autologon feature does not work. This behavior is by design. For more informations, see [How to turn on automatic logon in Windows](https://support.microsoft.com/help/324737/how-to-turn-on-automatic-logon-in-windows).
|
||||
>When Exchange Active Sync (EAS) password restrictions are active on the device, the autologon feature does not work. This behavior is by design. For more informations, see [How to turn on automatic logon in Windows](/troubleshoot/windows-server/user-profiles-and-logon/turn-on-automatic-logon).
|
||||
|
||||
##### Config for individual accounts
|
||||
|
||||
|
||||
@ -43,7 +43,7 @@ When troubleshooting basic Start issues (and for the most part, all other Window
|
||||
- `get-AppXPackage -Name Microsoft.Windows.ShellExperienceHost`
|
||||
- `get-AppXPackage -Name Microsoft.Windows.Cortana`
|
||||
|
||||
|
||||
:::image type="content" alt-text="Example of output from cmdlets." source="images/start-ts-1.png" lightbox="images/start-ts-1.png":::
|
||||
|
||||
Failure messages will appear if they aren't installed
|
||||
|
||||
@ -189,7 +189,7 @@ Events for both PDC and Background Tasks Infrastructure Service will be recorded
|
||||
|
||||
### Symptom: Application tiles like Alarm, Calculator, and Edge are missing from Start menu and the Settings app fails to open on Windows 10, version 1709 when a local user profile is deleted
|
||||
|
||||
|
||||
:::image type="content" alt-text="Screenshots that show download icons on app tiles and missing app tiles." source="images/start-ts-2.png" lightbox="images/start-ts-2.png":::
|
||||
|
||||
**Cause**: This issue is known. The first-time sign-in experience is not detected and does not trigger the install of some apps.
|
||||
|
||||
@ -280,7 +280,7 @@ Additionally, users may see blank tiles if sign-in was attempted without network
|
||||
|
||||
### Symptom: Start Menu issues with Tile Data Layer corruption
|
||||
|
||||
**Cause**: Windows 10, version 1507 through the release of version 1607 uses a database for the Tile image information. This is called the Tile Data Layer database. (The feature was deprecated in [Windows 10 1703](https://support.microsoft.com/help/4014193/features-that-are-removed-or-deprecated-in-windows-10-creators-update).)
|
||||
**Cause**: Windows 10, version 1507 through the release of version 1607 uses a database for the Tile image information. This is called the Tile Data Layer database. (The feature was deprecated in [Windows 10 1703](/windows/deployment/planning/windows-10-removed-features).)
|
||||
|
||||
**Resolution** There are steps you can take to fix the icons, first is to confirm that is the issue that needs to be addressed.
|
||||
|
||||
@ -293,9 +293,9 @@ Additionally, users may see blank tiles if sign-in was attempted without network
|
||||
>[!Note]
|
||||
>Corruption recovery removes any manual pins from Start. Apps should still be visible, but you’ll need to re-pin any secondary tiles and/or pin app tiles to the main Start view. Aps that you have installed that are completely missing from “all apps” is unexpected, however. That implies the re-registration didn’t work.
|
||||
|
||||
- Open a command prompt, and run the following command:
|
||||
Open a command prompt, and run the following command:
|
||||
|
||||
```
|
||||
```console
|
||||
C:\Windows\System32\tdlrecover.exe -reregister -resetlayout -resetcache
|
||||
```
|
||||
|
||||
|
||||
@ -83,7 +83,7 @@ For more information on the rules available via AppLocker on the different suppo
|
||||
Applies to: Windows 10 Enterprise, Windows 10 Education
|
||||
|
||||
> [!Note]
|
||||
> Not supported on Windows 10 Pro, starting with version 1511. For more info, see [Knowledge Base article #3135657](https://support.microsoft.com/kb/3135657).
|
||||
> Not supported on Windows 10 Pro, starting with version 1511. For more info, see [Knowledge Base article #3135657](/troubleshoot/windows-client/group-policy/cannot-disable-microsoft-store).
|
||||
|
||||
You can also use Group Policy to manage access to Microsoft Store.
|
||||
|
||||
|
||||
@ -22,7 +22,7 @@ Before you deploy User Experience Virtualization (UE-V), review this topic for i
|
||||
|
||||
## Plan your UE-V deployment
|
||||
|
||||
With UE-V, you can synchronize user-defined application and operating system settings across all the devices that a user works from. Use UE-V to synchronize settings for Windows applications and custom applications, such as third-party and line of business applications.
|
||||
With UE-V, you can synchronize user-defined application and operating system settings across all the devices that a user works from. Use UE-V to synchronize settings for Windows applications and custom applications, such as third-party and line-of-business applications.
|
||||
|
||||
Whether you want to synchronize settings for only default Windows applications or for both Windows and custom applications, you’ll need to first deploy the features required to use UE-V.
|
||||
|
||||
@ -44,7 +44,7 @@ If you want to use UE-V to synchronize user-defined settings for custom applicat
|
||||
|
||||
The workflow diagram below illustrates a typical UE-V deployment and the decisions you need to be prepared to make.
|
||||
|
||||
|
||||
:::image type="content" alt-text="UE-V deployment preparation." source="images/uev-deployment-preparation.png":::
|
||||
|
||||
<!-- PRESERVING ^ORIGINAL IMAGE CODING JUST IN CASE
|
||||
<img src="media/image1.png" width="446" height="362" />
|
||||
@ -92,7 +92,7 @@ For downloadable UE-V templates, see:
|
||||
|
||||
When you enable the UE-V service on user devices, it registers a default group of settings location templates that capture settings values for these common Microsoft applications.
|
||||
|
||||
| **Application category** | **Description** |
|
||||
| Application category | Description |
|
||||
|-----------------------------|-------------------|
|
||||
| Microsoft Office 2016 applications<br>[Download a list of all settings synced](https://gallery.technet.microsoft.com/Authored-Office-2016-32-0dc05cd8) | Microsoft Access 2016<br>Microsoft Lync 2016<br>Microsoft Excel 2016<br>Microsoft OneNote 2016<br>Microsoft Outlook 2016<br>Microsoft PowerPoint 2016<br>Microsoft Project 2016<br>Microsoft Publisher 2016<br>Microsoft SharePoint Designer 2013 (not updated for 2016)<br>Microsoft Visio 2016<br>Microsoft Word 2016<br>Microsoft Office Upload Manager<br>Microsoft Infopath has been removed (deprecated) from the Office 2016 suite |
|
||||
| Microsoft Office 2013 applications<br>[Download a list of all settings synced](https://www.microsoft.com/download/details.aspx?id=46367) | Microsoft Word 2013<br>Microsoft Excel 2013<br>Microsoft Outlook 2013<br>Microsoft Access 2013<br>Microsoft Project 2013<br>Microsoft PowerPoint 2013<br>Microsoft Publisher 2013<br>Microsoft Visio 2013<br>Microsoft InfoPath 2013<br>Microsoft Lync 2013<br>Microsoft OneNote 2013<br>Microsoft SharePoint Designer 2013<br>Microsoft Office 2013 Upload Center<br>Microsoft OneDrive for Business 2013
|
||||
@ -100,27 +100,27 @@ When you enable the UE-V service on user devices, it registers a default group o
|
||||
| Browser options: Internet Explorer 11 and 10 | Synchronize favorites, home page, tabs, and toolbars.<br>**Note**<br>UE-V does not roam settings for Internet Explorer cookies. |
|
||||
| Windows accessories | Microsoft NotePad, WordPad |
|
||||
|
||||
**Notes**
|
||||
An Outlook profile must be created for any device on which a user wants to sync their Outlook signature. If the profile is not already created, the user can create one and then restart Outlook on that device to enable signature synchronization.
|
||||
|
||||
UE-V does not synchronize settings between the Microsoft Calculator in Windows 10 and the Microsoft Calculator in previous operating systems.
|
||||
> [!NOTE]
|
||||
> - An Outlook profile must be created for any device on which a user wants to sync their Outlook signature. If the profile is not already created, the user can create one and then restart Outlook on that device to enable signature synchronization.
|
||||
>
|
||||
> - UE-V does not synchronize settings between the Microsoft Calculator in Windows 10 and the Microsoft Calculator in previous operating systems.
|
||||
|
||||
### Windows settings synchronized by default
|
||||
|
||||
UE-V includes settings location templates that capture settings values for these Windows settings.
|
||||
|
||||
| **Windows settings** | **Description** | **Apply on** | **Export on** | **Default state** |
|
||||
| Windows settings | Description | Apply on | Export on | Default state |
|
||||
|----------------------|-----------------|--------------|---------------|-------------------|
|
||||
| Desktop background | Currently active desktop background or wallpaper | Log on, unlock, remote connect, Scheduled Task events | Log off, lock, remote disconnect, or scheduled task interval | Enabled |
|
||||
| Ease of Access | Accessibility and input settings, Microsoft Magnifier, Narrator, and on-Screen Keyboard | Log on only | Log off or scheduled task interval | Enabled |
|
||||
| Desktop settings | Start menu and Taskbar settings, folder options, default desktop icons, additional clocks, and region and language settings | Log on only | Log off or scheduled task | Enabled |
|
||||
|
||||
>**Important**
|
||||
UE-V roams taskbar settings between Windows 10 devices. However, UE-V does not synchronize taskbar settings between Windows 10 devices and devices running previous operating systems versions.
|
||||
> [!IMPORTANT]
|
||||
> UE-V roams taskbar settings between Windows 10 devices. However, UE-V does not synchronize taskbar settings between Windows 10 devices and devices running previous operating systems versions.
|
||||
|
||||
| **Settings group** | **Category** | **Capture** | **Apply** |
|
||||
| Settings group | Category | Capture | Apply |
|
||||
|--------------------------|----------------|----------------|--------------|
|
||||
| **Application Settings** | Windows applications | Close appllication<br>Windows application settings change event | Start the UE-V App Monitor at startup<br>Open app<br>Windows application settings change event<br>Arrival of a settings package |
|
||||
| **Application Settings** | Windows applications | Close application<br>Windows application settings change event | Start the UE-V App Monitor at startup<br>Open app<br>Windows application settings change event<br>Arrival of a settings package |
|
||||
| | Desktop applications | Application closes | Application opens and closes |
|
||||
| **Desktop settings** | Desktop background | Lock or log off | Log on, unlock, remote connect, notification of new package arrival, or scheduled task runs |
|
||||
| | Ease of Access (Common – Accessibility, Narrator, Magnifier, On-Screen-Keyboard) | Lock or Log off | Log on |
|
||||
@ -133,8 +133,8 @@ For Windows applications, the application developer specifies which user setting
|
||||
|
||||
To display a list of Windows applications that can synchronize settings with their package family name, enabled status, and enabled source, open a Windows PowerShell window, type Get-UevAppxPackage, and press ENTER.
|
||||
|
||||
>**Note**
|
||||
Starting in Windows 10, version 1607, you can configure UE-V to not synchronize Windows applications settings if the device is configured to use Enterprise State Roaming.
|
||||
> [!NOTE]
|
||||
> Starting in Windows 10, version 1607, you can configure UE-V to not synchronize Windows applications settings if the device is configured to use Enterprise State Roaming.
|
||||
|
||||
### UE-V-support for roaming printers
|
||||
|
||||
@ -148,8 +148,8 @@ Printer roaming in UE-V requires one of these scenarios:
|
||||
|
||||
- The printer driver can be imported from Windows Update.
|
||||
|
||||
>**Note**
|
||||
The UE-V printer roaming feature does not roam printer settings or preferences, such as printing double-sided.
|
||||
> [!NOTE]
|
||||
> The UE-V printer roaming feature does not roam printer settings or preferences, such as printing double-sided.
|
||||
|
||||
### Determine whether you need settings synchronized for other applications
|
||||
|
||||
@ -169,7 +169,7 @@ In general, you can synchronize settings that meet the following criteria:
|
||||
|
||||
If you’ve decided that you need to synchronize settings for custom applications, use this checklist to determine which applications you’ll include.
|
||||
|
||||
| | **Description** |
|
||||
| | Description |
|
||||
|-------|--------------------------|
|
||||
|  | Does this application contain settings that the user can customize? |
|
||||
|  | Is it important for the user that these settings are synchronized? |
|
||||
@ -201,8 +201,8 @@ You should also consider these things when you are preparing to deploy UE-V:
|
||||
|
||||
Many enterprise applications, including Microsoft Outlook, Lync, and Skype for Business prompt users for their domain credentials when they log in. Users have the option of saving their credentials to disk to prevent having to enter them every time they open these applications. Enabling roaming credentials synchronization lets users save their credentials on one computer and avoid re-entering them on every computer they use in their environment. Users can synchronize some domain credentials with UE-V.
|
||||
|
||||
**Important**
|
||||
Credentials synchronization is disabled by default. You must explicitly enable credentials synchronization after you enable the UE-V service to implement this feature.
|
||||
> [!IMPORTANT]
|
||||
> Credentials synchronization is disabled by default. You must explicitly enable credentials synchronization after you enable the UE-V service to implement this feature.
|
||||
|
||||
UE-V can synchronize enterprise credentials, but does not roam credentials intended only for use on the local device.
|
||||
|
||||
@ -210,20 +210,24 @@ Credentials are synchronous settings, meaning that they are applied to users' pr
|
||||
|
||||
Credentials synchronization is managed by its own settings location template, which is disabled by default. You can enable or disable this template through the same methods used for other templates. The template identifier for this feature is RoamingCredentialSettings.
|
||||
|
||||
>**Important**
|
||||
If you are using Active Directory Credential Roaming in your environment, we recommend that you do not enable the UE-V credential roaming template. Instead, use PowerShell or Group Policy to enable credentials synchronization. Note that credentials are encrypted during synchronization.
|
||||
> [!IMPORTANT]
|
||||
> If you are using Active Directory Credential Roaming in your environment, we recommend that you do not enable the UE-V credential roaming template. Instead, use PowerShell or Group Policy to enable credentials synchronization. Note that credentials are encrypted during synchronization.
|
||||
|
||||
[PowerShell](uev-administering-uev-with-windows-powershell-and-wmi.md)**:** Enter this PowerShell cmdlet to enable credential synchronization:
|
||||
|
||||
`Enable-UevTemplate RoamingCredentialSettings`
|
||||
```powershell
|
||||
Enable-UevTemplate RoamingCredentialSettings
|
||||
|
||||
`Copy`
|
||||
Copy
|
||||
```
|
||||
|
||||
Use this PowerShell cmdlet to disable credential synchronization:
|
||||
|
||||
`Disable-UevTemplate RoamingCredentialSettings`
|
||||
```powershell
|
||||
Disable-UevTemplate RoamingCredentialSettings
|
||||
|
||||
`Copy`
|
||||
Copy
|
||||
```
|
||||
|
||||
<!-- WATCH THE MDOP ADMX templates LINK IN THE NEXT PARAGRAPH. IS IT CURRENT? -->
|
||||
|
||||
@ -311,7 +315,7 @@ The UE-V settings storage location and settings template catalog support storing
|
||||
|
||||
- [Information about roaming profiles from the Directory Services team](https://blogs.technet.microsoft.com/askds/tag/roaming-profiles/)
|
||||
|
||||
- [Information about Microsoft support policy for a DFS-R and DFS-N deployment scenario](https://support.microsoft.com/kb/2533009)
|
||||
- [Information about Microsoft support policy for a DFS-R and DFS-N deployment scenario](/troubleshoot/windows-server/networking/support-policy-for-dfsr-dfsn-deployment)
|
||||
|
||||
In addition, because SYSVOL uses DFSR for replication, SYSVOL cannot be used for UE-V data file replication.
|
||||
|
||||
@ -329,16 +333,16 @@ Computers that run the UE-V service must use a time server to maintain a consist
|
||||
|
||||
Before you proceed, ensure that your environment meets these requirements for using UE-V.
|
||||
|
||||
| **Operating system** | **Edition** | **Service pack** | **System architecture** | **Windows PowerShell** | **Microsoft .NET Framework** |
|
||||
| Operating system | Edition | Service pack | System architecture | Windows PowerShell | Microsoft .NET Framework |
|
||||
|--------------------------|---------------|------------------|-------------------------|--------------------------|--------------------------------|
|
||||
| Windows 10, version 1607 | Windows 10 for Enterprise | NA | 32-bit or 64-bit | Windows PowerShell 3.0 or higher | .NET Framework 4.5 or higher |
|
||||
| Windows 8 and Windows 8.1 | Enterprise or Pro | None | 32-bit or 64-bit | Windows PowerShell 3.0 or higher | .NET Framework 4.5 or higher |
|
||||
| Windows Server 2012 and Windows Server 2012 R2 | Standard or Datacenter | None | 64-bit | Windows PowerShell 3.0 or higher | .NET Framework 4.5 or higher |
|
||||
|
||||
**Note**
|
||||
- Windows Server 2012 operating systems come with .NET Framework 4.5 installed. The Windows 10 operating system comes with .NET Framework 4.6 installed.
|
||||
|
||||
- The “Delete Roaming Cache” policy for mandatory profiles is not supported with UE-V and should not be used.
|
||||
> [!NOTE]
|
||||
> - Windows Server 2012 operating systems come with .NET Framework 4.5 installed. The Windows 10 operating system comes with .NET Framework 4.6 installed.
|
||||
>
|
||||
> - The “Delete Roaming Cache” policy for mandatory profiles is not supported with UE-V and should not be used.
|
||||
|
||||
There are no special random access memory (RAM) requirements specific to UE-V.
|
||||
|
||||
@ -368,19 +372,19 @@ Enable this configuration using one of these methods:
|
||||
|
||||
Restart the device to allow the settings to synchronize.
|
||||
|
||||
- >**Note**
|
||||
These methods do not work for pooled virtual desktop infrastructure (VDI) environments.
|
||||
> [!NOTE]
|
||||
> These methods do not work for pooled virtual desktop infrastructure (VDI) environments.
|
||||
|
||||
|
||||
>**Note**
|
||||
If you set *SyncMethod = None*, any settings changes are saved directly to the server. If the network connection to the settings storage path is not found, then the settings changes are cached on the device and are synchronized the next time that the sync provider runs. If the settings storage path is not found and the user profile is removed from a pooled VDI environment on log off, settings changes are lost and the user must reapply the change when the computer is reconnected to the settings storage path.
|
||||
> [!NOTE]
|
||||
> If you set *SyncMethod = None*, any settings changes are saved directly to the server. If the network connection to the settings storage path is not found, then the settings changes are cached on the device and are synchronized the next time that the sync provider runs. If the settings storage path is not found and the user profile is removed from a pooled VDI environment on log off, settings changes are lost and the user must reapply the change when the computer is reconnected to the settings storage path.
|
||||
|
||||
**Synchronization for external sync engines** The *SyncMethod=External* parameter specifies that if UE-V settings are written to a local folder on the user device, then any external sync engine (such as OneDrive for Business, Work Folders, Sharepoint, or Dropbox) can be used to apply these settings to the different devices that users access.
|
||||
|
||||
**Support for shared VDI sessions** UE-V supports VDI sessions that are shared among end users. You can register and configure a special VDI template, which ensures that UE-V keeps all of its functionality intact for non-persistent VDI sessions.
|
||||
|
||||
>**Note**
|
||||
If you do not enable VDI mode for non-persistent VDI sessions, certain features do not work, such as [back-up/restore and last known good (LKG)](uev-manage-administrative-backup-and-restore.md).
|
||||
> [!NOTE]
|
||||
> If you do not enable VDI mode for non-persistent VDI sessions, certain features do not work, such as [back-up/restore and last known good (LKG)](uev-manage-administrative-backup-and-restore.md).
|
||||
|
||||
The VDI template is provided with UE-V and is typically available here after installation: C:\ProgramData\Microsoft\UEV\InboxTemplates
|
||||
|
||||
|
||||
@ -107,12 +107,12 @@ This section contains hotfixes and KB articles for UE-V.
|
||||
|------------|---------|--------|
|
||||
| 3018608 | UE-V - TemplateConsole.exe crashes when UE-V WMI classes are missing | [support.microsoft.com/kb/3018608](https://support.microsoft.com/kb/3018608) |
|
||||
| 2903501 | UE-V: User Experience Virtualization (UE-V) compatibility with user profiles | [support.microsoft.com/kb/2903501](https://support.microsoft.com/kb/2903501) |
|
||||
| 2770042 | UE-V Registry Settings | [support.microsoft.com/kb/2770042](https://support.microsoft.com/kb/2770042) |
|
||||
| 2770042 | UE-V Registry Settings | [support.microsoft.com/kb/2770042](/troubleshoot/windows-client/ue-v/ue-v-registry-settings) |
|
||||
| 2847017 | Internet Explorer settings replicated by UE-V | [support.microsoft.com/kb/2847017](https://support.microsoft.com/kb/2847017) |
|
||||
| 2769631 | How to repair a corrupted UE-V install | [support.microsoft.com/kb/2769631](https://support.microsoft.com/kb/2769631) |
|
||||
| 2850989 | Migrating MAPI profiles with Microsoft UE-V is not supported | [support.microsoft.com/kb/2850989](https://support.microsoft.com/kb/2850989) |
|
||||
| 2769586 | UE-V roams empty folders and registry keys | [support.microsoft.com/kb/2769586](https://support.microsoft.com/kb/2769586) |
|
||||
| 2782997 | How To Enable Debug Logging in Microsoft User Experience Virtualization (UE-V) | [support.microsoft.com/kb/2782997](https://support.microsoft.com/kb/2782997) |
|
||||
| 2782997 | How To Enable Debug Logging in Microsoft User Experience Virtualization (UE-V) | [support.microsoft.com/kb/2782997](/troubleshoot/windows-client/ue-v/enable-debug-logging) |
|
||||
| 2769570 | UE-V does not update the theme on RDS or VDI sessions | [support.microsoft.com/kb/2769570](https://support.microsoft.com/kb/2769570) |
|
||||
| 2850582 | How To Use Microsoft User Experience Virtualization With App-V Applications | [support.microsoft.com/kb/2850582](https://support.microsoft.com/kb/2850582) |
|
||||
| 3041879 | Current file versions for Microsoft User Experience Virtualization | [support.microsoft.com/kb/3041879](https://support.microsoft.com/kb/3041879) |
|
||||
|
||||
@ -61,7 +61,7 @@ The following features and functionalities have been removed from the installed
|
||||
|Reader app | Functionality to be integrated into Microsoft Edge. | 1709 |
|
||||
|Reading List | Functionality to be integrated into Microsoft Edge. | 1709 |
|
||||
|Screen saver functionality in Themes | This functionality is disabled in Themes, and classified as **Removed** in this table. Screen saver functionality in Group Policies, Control Panel, and Sysprep continues to be functional. Lock screen features and policies are preferred. | 1709 |
|
||||
|Syskey.exe | Removing this nonsecure security feature. We recommend that users use BitLocker instead. For more information, see [4025993 Syskey.exe utility is no longer supported in Windows 10 RS3 and Windows Server 2016 RS3](https://support.microsoft.com/help/4025993/syskey-exe-utility-is-no-longer-supported-in-windows-10-rs3-and-window). | 1709 |
|
||||
|Syskey.exe | Removing this nonsecure security feature. We recommend that users use BitLocker instead. For more information, see [4025993 Syskey.exe utility is no longer supported in Windows 10 RS3 and Windows Server 2016 RS3](/troubleshoot/windows-server/identity/syskey-exe-utility-is-no-longer-supported). | 1709 |
|
||||
|TCP Offload Engine | Removing this legacy code. This functionality was previously transitioned to the Stack TCP Engine. For more information, see [Why Are We Deprecating Network Performance Features?](https://blogs.technet.microsoft.com/askpfeplat/2017/06/13/why-are-we-deprecating-network-performance-features-kb4014193)| 1709 |
|
||||
|Tile Data Layer |To be replaced by the Tile Store.| 1709 |
|
||||
|Resilient File System (ReFS) (added: August 17, 2017)| Creation ability will be available in the following editions only: Windows 10 Enterprise and Windows 10 Pro for Workstations. Creation ability will be removed from all other editions. All other editions will have Read and Write ability. | 1709 |
|
||||
|
||||
Loading…
x
Reference in New Issue
Block a user