diff --git a/devices/surface-hub/set-up-your-surface-hub.md b/devices/surface-hub/set-up-your-surface-hub.md index 0ce8d6e7d7..95b7c2c92f 100644 --- a/devices/surface-hub/set-up-your-surface-hub.md +++ b/devices/surface-hub/set-up-your-surface-hub.md @@ -8,7 +8,7 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: surfacehub author: TrudyHa -localizationpriority: mediumh +localizationpriority: medium --- # Set up Microsoft Surface Hub diff --git a/windows/keep-secure/deploy-device-guard-enable-virtualization-based-security.md b/windows/keep-secure/deploy-device-guard-enable-virtualization-based-security.md index c0fea04744..c64e07578a 100644 --- a/windows/keep-secure/deploy-device-guard-enable-virtualization-based-security.md +++ b/windows/keep-secure/deploy-device-guard-enable-virtualization-based-security.md @@ -14,13 +14,15 @@ author: brianlic-msft - Windows 10 - Windows Server 2016 -Hardware-based security features, also called virtualization-based security or VBS, make up a large part of Device Guard security offerings. VBS reinforces the most important feature of Device Guard: configurable code integrity. There are three steps to configure hardware-based security features in Device Guard: +Hardware-based security features, also called virtualization-based security or VBS, make up a large part of Device Guard security offerings. VBS reinforces the most important feature of Device Guard: configurable code integrity. There are a few steps to configure hardware-based security features in Device Guard: -1. **Verify that hardware and firmware requirements are met**. Verify that your client computers possess the necessary hardware and firmware to run these features. A list of requirements for hardware-based security features is available in [Hardware, firmware, and software requirements for Device Guard](requirements-and-deployment-planning-guidelines-for-device-guard.md#hardware-firmware-and-software-requirements-for-device-guard). +1. **Decide whether to use the procedures in this topic, or to use the Device Guard readiness tool**. To enable VBS, you can download and use [the hardware readiness tool on the Microsoft Download Center](https://www.microsoft.com/en-us/download/details.aspx?id=53337), or follow the procedures in this topic. -2. **Enable the necessary Windows features**. There are several ways to enable the Windows features required for hardware-based security. For details, see the following section, [Windows feature requirements for virtualization-based security](#windows-feature-requirements-for-virtualization-based-security). +2. **Verify that hardware and firmware requirements are met**. Verify that your client computers possess the necessary hardware and firmware to run these features. A list of requirements for hardware-based security features is available in [Hardware, firmware, and software requirements for Device Guard](requirements-and-deployment-planning-guidelines-for-device-guard.md#hardware-firmware-and-software-requirements-for-device-guard). -3. **Enable additional features as desired**. When the necessary Windows features have been enabled, you can enable additional hardware-based security features as desired. For more information, see the following sections in this topic: +3. **Enable the necessary Windows features**. There are several ways to enable the Windows features required for hardware-based security. You can use the [Device Guard and Credential Guard hardware readiness tool](https://www.microsoft.com/en-us/download/details.aspx?id=53337), or see the following section, [Windows feature requirements for virtualization-based security](#windows-feature-requirements-for-virtualization-based-security). + +4. **Enable additional features as desired**. When the necessary Windows features have been enabled, you can enable additional hardware-based security features as desired. You can use the [Device Guard and Credential Guard hardware readiness tool](https://www.microsoft.com/en-us/download/details.aspx?id=53337), or see the following sections in this topic: - [Enable Unified Extensible Firmware Interface Secure Boot](#enable-unified-extensible-firmware-interface-secure-boot) - [Enable virtualization-based security for kernel-mode code integrity](#enable-virtualization-based-security-for-kernel-mode-code-integrity) @@ -51,7 +53,7 @@ After you enable the feature or features, you can configure any additional hardw Before you begin this process, verify that the target device meets the hardware requirements for UEFI Secure Boot that are laid out in [Hardware, firmware, and software requirements for Device Guard](requirements-and-deployment-planning-guidelines-for-device-guard.md#hardware-firmware-and-software-requirements-for-device-guard). There are two options to configure UEFI Secure Boot: manual configuration of the appropriate registry keys and Group Policy deployment. Complete the following steps to manually configure UEFI Secure Boot on a computer running Windows 10. -> **Note**  There are two platform security levels for Secure Boot: stand-alone Secure Boot and Secure Boot with DMA protection. DMA protection provides additional memory protection but will be enabled only on systems whose processors include input/output memory management units (IOMMUs). Protection against driver-based attacks is provided only on systems that have IOMMUs and that have DMA protection enabled. For more information about how IOMMUs help protect against DMA attacks, see [How Device Guard features help protect against threats](introduction-to-device-guard-virtualization-based-security-and-code-integrity-policies.md#how-device-guard-features-help-protect-against-threats). +> **Important**  Secure boot settings include **Secure Boot** and **Secure Boot with DMA**. In most situations we recommend that you simply choose **Secure Boot**. This option provides secure boot with as much protection as is supported by a given computer’s hardware. A computer with input/output memory management units (IOMMUs) will have secure boot with DMA protection. A computer without IOMMUs will simply have secure boot enabled.
In contrast, with **Secure Boot with DMA**, the setting will enable secure boot—and VBS itself—only on a computer that supports DMA, that is, a computer with IOMMUs. With this setting, any computer without IOMMUs will not have VBS (hardware-based) protection, although it can have code integrity policies enabled.
For information about how VBS uses the hypervisor to strengthen protections provided by a code integrity policy, see [How Device Guard features help protect against threats](introduction-to-device-guard-virtualization-based-security-and-code-integrity-policies.md#how-device-guard-features-help-protect-against-threats). 1. Navigate to the **HKEY\_LOCAL\_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\DeviceGuard** registry subkey. @@ -75,7 +77,7 @@ Unfortunately, it would be time consuming to perform these steps manually on eve ![Group Policy Management, create a GPO](images/dg-fig2-createou.png) - Figure 5. Create a new OU-linked GPO + Figure 2. Create a new OU-linked GPO 2. Give the new GPO a name, for example, **Contoso Secure Boot GPO Test**, or any name you prefer. Ideally, the name will align with your existing GPO naming convention. @@ -85,15 +87,15 @@ Unfortunately, it would be time consuming to perform these steps manually on eve ![Edit the group policy for Virtualization Based Security](images/dg-fig3-enablevbs.png) - Figure 6. Enable VBS + Figure 3. Enable VBS -5. Select the **Enabled** button, and then select **Secure Boot and DMA Protection** from the **Select Platform Security Level** list. +5. Select the **Enabled** button, and then select a secure boot option, such as **Secure Boot**, from the **Select Platform Security Level** list. ![Group Policy, Turn On Virtualization Based Security](images/device-guard-gp.png) - Figure 7. Enable Secure Boot (in Windows 10, version 1607) + Figure 4. Enable Secure Boot (in Windows 10, version 1607) - > **Note**  Device Guard Secure Boot is maximized when combined with DMA protection. If your hardware contains the IOMMUs required for DMA protection, be sure to select the **Secure Boot and DMA Protection** platform security level. If your hardware does not contain IOMMUs, there are several mitigations provided by leveraging Secure Boot without DMA Protection. + > **Important**  Secure boot settings include **Secure Boot** and **Secure Boot with DMA**. In most situations we recommend that you choose **Secure Boot**. This option provides secure boot with as much protection as is supported by a given computer’s hardware. A computer with input/output memory management units (IOMMUs) will have secure boot with DMA protection. A computer without IOMMUs will simply have secure boot enabled.
In contrast, with **Secure Boot with DMA**, the setting will enable secure boot—and VBS itself—only on a computer that supports DMA, that is, a computer with IOMMUs. With this setting, any computer without IOMMUs will not have VBS (hardware-based) protection, although it can have code integrity policies enabled.
For information about how VBS uses the hypervisor to strengthen protections provided by a code integrity policy, see [How Device Guard features help protect against threats](introduction-to-device-guard-virtualization-based-security-and-code-integrity-policies.md#how-device-guard-features-help-protect-against-threats). 6. Close the Group Policy Management Editor, and then restart the Windows 10 test computer. After you configure this setting, UEFI Secure Boot will be enabled upon restart. @@ -123,13 +125,13 @@ It would be time consuming to perform these steps manually on every protected co > **Note**  We recommend that you test-enable this feature on a group of test computers before you deploy it to users' computers. If untested, there is a possibility that this feature can cause system instability and ultimately cause the client operating system to fail. -**To use Group Policy to configure VBS of KMCI:** +### Use Group Policy to configure VBS of KMCI 1. Create a new GPO: Right-click the OU to which you want to link the GPO, and then click **Create a GPO in this domain, and Link it here**. ![Group Policy Management, create a GPO](images/dg-fig5-createnewou.png) - Figure 2. Create a new OU-linked GPO + Figure 5. Create a new OU-linked GPO 2. Give the new GPO a name, for example, **Contoso VBS CI Protection GPO Test**, or any name you prefer. Ideally, the name will align with your existing GPO naming convention. @@ -139,17 +141,17 @@ It would be time consuming to perform these steps manually on every protected co ![Edit the group policy for Virtualization Based Security](images/dg-fig6-enablevbs.png) - Figure 3. Enable VBS + Figure 6. Enable VBS 5. Select the **Enabled** button, and then for **Virtualization Based Protection of Code Integrity**, select the appropriate option: - - With Windows 10, version 1607 or Windows Server 2016, choose an enabled option:
For an initial deployment or test deployment, we recommend **Enabled without UEFI lock**.
When your deployment is stable in your environment, we recommend changing to **Enabled with UEFI lock**. This option helps protect the registry from tampering, either through malware or by an unauthorized person. + - With Windows 10, version 1607 or Windows Server 2016, choose an enabled option:
For an initial deployment or test deployment, we recommend **Enabled without lock**.
When your deployment is stable in your environment, we recommend changing to **Enabled with lock**. This option helps protect the registry from tampering, either through malware or by an unauthorized person. - With earlier versions of Windows 10, or Windows Server 2016 Technical Preview 5 or earlier:
Select the **Enable Virtualization Based Protection of Code Integrity** check box. ![Group Policy, Turn On Virtualization Based Security](images/dg-fig7-enablevbsofkmci.png) - Figure 4. Enable VBS of KMCI (in Windows 10, version 1607) + Figure 7. Enable VBS of KMCI (in Windows 10, version 1607) 6. Close the Group Policy Management Editor, and then restart the Windows 10 test computer. With this setting configured, the VBS of the KMCI will take effect upon restart. @@ -258,11 +260,11 @@ Table 1. Win32\_DeviceGuard properties -Another method to determine the available and enabled Device Guard features is to run msinfo32.exe from an elevated PowerShell session. When you run this program, the Device Guard properties are displayed at the bottom of the **System Summary** section, as shown in Figure 11. +Another method to determine the available and enabled Device Guard features is to run msinfo32.exe from an elevated PowerShell session. When you run this program, the Device Guard properties are displayed at the bottom of the **System Summary** section, as shown in Figure 8. ![Device Guard properties in the System Summary](images/dg-fig11-dgproperties.png) -Figure 11. Device Guard properties in the System Summary +Figure 8. Device Guard properties in the System Summary ## Related topics diff --git a/windows/keep-secure/device-guard-deployment-guide.md b/windows/keep-secure/device-guard-deployment-guide.md index 602bfdf4e3..cf8c3bd107 100644 --- a/windows/keep-secure/device-guard-deployment-guide.md +++ b/windows/keep-secure/device-guard-deployment-guide.md @@ -15,7 +15,7 @@ author: brianlic-msft - Windows 10 - Windows Server 2016 -Device Guard is a combination of enterprise-related hardware and software security features that, when configured together, will lock a device down so that it can only run trusted applications that you define in your code integrity policies. If the app isn’t trusted it can’t run, period. With hardware that meets basic requirements, it also means that even if an attacker manages to get control of the Windows kernel, he or she will be much less likely to be able to run malicious executable code. With appropriate hardware, Device Guard can use the new virtualization-based security in Windows 10 Enterprise to isolate the Code Integrity service from the Microsoft Windows kernel itself. In this case, the Code Integrity service runs alongside the kernel in a Windows hypervisor-protected container. +Device Guard is a combination of enterprise-related hardware and software security features that, when configured together, will lock a device down so that it can only run trusted applications that you define in your code integrity policies. If the app isn’t trusted it can’t run, period. With hardware that meets basic requirements, it also means that even if an attacker manages to get control of the Windows kernel, he or she will be much less likely to be able to run malicious executable code. With appropriate hardware, Device Guard can use the new virtualization-based security in Windows 10 (available in Enterprise and Education desktop SKUs and in all Server SKUs) to isolate the Code Integrity service from the Microsoft Windows kernel itself. In this case, the Code Integrity service runs alongside the kernel in a Windows hypervisor-protected container. This guide explores the individual features in Device Guard as well as how to plan for, configure, and deploy them. It includes: diff --git a/windows/keep-secure/requirements-and-deployment-planning-guidelines-for-device-guard.md b/windows/keep-secure/requirements-and-deployment-planning-guidelines-for-device-guard.md index 7403b2750b..13b3f05f42 100644 --- a/windows/keep-secure/requirements-and-deployment-planning-guidelines-for-device-guard.md +++ b/windows/keep-secure/requirements-and-deployment-planning-guidelines-for-device-guard.md @@ -23,7 +23,9 @@ This article describes the following: - [Reviewing your applications: application signing and catalog files](#reviewing-your-applications-application-signing-and-catalog-files) - [Code integrity policy formats and signing](#code-integrity-policy-formats-and-signing) -The information in this article provides a foundation for [Planning and getting started on the Device Guard deployment process](planning-and-getting-started-on-the-device-guard-deployment-process.md). +The information in this article is intended for IT professionals, and provides a foundation for [Planning and getting started on the Device Guard deployment process](planning-and-getting-started-on-the-device-guard-deployment-process.md). + +>**Note**  If you are an OEM, see the requirements information at [PC OEM requirements for Device Guard and Credential Guard](https://msdn.microsoft.com/library/windows/hardware/mt767514(v=vs.85).aspx). ## Hardware, firmware, and software requirements for Device Guard diff --git a/windows/manage/appv-deployment-checklist.md b/windows/manage/appv-deployment-checklist.md index 2def234fd2..2da5471851 100644 --- a/windows/manage/appv-deployment-checklist.md +++ b/windows/manage/appv-deployment-checklist.md @@ -14,8 +14,8 @@ ms.prod: w10 This checklist can be used to help you during an App-V deployment. -> [!NOTE] -> This checklist outlines the recommended steps and a high-level list of items to consider when deploying App-V features. It is recommended that you copy this checklist into a spreadsheet program and customize it for your use. +>**Note**
+This checklist outlines the recommended steps and items to consider when deploying App-V features. We recommend that you copy this checklist into a spreadsheet program and customize it for your use. diff --git a/windows/manage/appv-enable-the-app-v-desktop-client.md b/windows/manage/appv-enable-the-app-v-desktop-client.md index 2a92c9d953..e10f3d842c 100644 --- a/windows/manage/appv-enable-the-app-v-desktop-client.md +++ b/windows/manage/appv-enable-the-app-v-desktop-client.md @@ -1,6 +1,6 @@ --- -title: Enable the App-V desktop client (Windows 10) -description: Enable the App-V desktop client +title: Enable the App-V in-box client (Windows 10) +description: How to enable the App-V in-box client installed with Windows 10. author: MaggiePucciEvans ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy @@ -32,7 +32,7 @@ With Windows 10, version 1607, the App-V client is installed automatically. You 3. Restart the device. -4. To verify that the App-V client is enabled on the device, enter **Get-AppvStatus** in Windows PowerShell. +4. To verify that the App-V client is enabled on the device, type `Get-AppvStatus` and press ENTER. See [Using the client management console](appv-using-the-client-management-console.md) for information about configuring the App-V client. diff --git a/windows/manage/appv-evaluating-appv.md b/windows/manage/appv-evaluating-appv.md index cdb5351de3..6ce476b57b 100644 --- a/windows/manage/appv-evaluating-appv.md +++ b/windows/manage/appv-evaluating-appv.md @@ -1,6 +1,6 @@ --- title: Evaluating App-V (Windows 10) -description: Evaluating App-V +description: Evaluating App-V for Windows 10 author: MaggiePucciEvans ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy @@ -11,8 +11,7 @@ ms.prod: w10 # Evaluating App-V - -Before you deploy pp-V into a production environment, you should evaluate it in a lab environment. You can use the information in this topic to set up App-V in a lab environment for evaluation purposes only. +Before you deploy App-V into a production environment, you should evaluate it in a lab environment. You can use the information in this topic to set up App-V in a lab environment for evaluation purposes only. ## Configure lab computers for App-V Evaluation @@ -34,7 +33,7 @@ Use the following links for information about setting up the App-V server in you - [Administering App-V Virtual Applications by Using the Management Console](appv-administering-virtual-applications-with-the-management-console.md) -### Installing the App-V Client +### Enabling the App-V Client Use the following link for more information about creating and managing virtualized packages in your lab environment. diff --git a/windows/manage/appv-for-windows.md b/windows/manage/appv-for-windows.md index d127094cb6..aae7e37db8 100644 --- a/windows/manage/appv-for-windows.md +++ b/windows/manage/appv-for-windows.md @@ -12,7 +12,7 @@ ms.prod: w10 # Application Virtualization (App-V) for Windows 10 overview -The topics in this section provides information and step-by-step procedures to help you administer App-V and its components. This information will be valuable for system administrators who manage large installations with many servers and clients and for support personnel who interact directly with the computers or the end users. +The topics in this section provide information and step-by-step procedures to help you administer App-V and its components. This information will be valuable for system administrators who manage large installations with many servers and clients and for support personnel who interact directly with the computers or the end users. [Getting Started with App-V](appv-getting-started.md) diff --git a/windows/manage/appv-getting-started.md b/windows/manage/appv-getting-started.md index 1923a4353a..68cd9233fd 100644 --- a/windows/manage/appv-getting-started.md +++ b/windows/manage/appv-getting-started.md @@ -1,6 +1,6 @@ --- title: Getting Started with App-V (Windows 10) -description: Getting Started with App-V +description: Getting Started with App-V for Windows 10 author: MaggiePucciEvans ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy @@ -30,8 +30,8 @@ To start using App-V to deliver virtual applications to users, you’ll need to | Component | What it does | Where to find it | |------------|--|------| -| App-V server components | App-V offers five server components that work together to allow you to host and publish virtual applications, generate usage reports, and manage your App-V environment. For information about the server components, see [Deploying the App-V Server](appv-deploying-the-appv-server.md).

**Note** If you're already using App-V 5.x, you don't need to re-deploy the App-V server components as they haven't changed since App-V 5.0 was released. | The App-V server components are included in the Microsoft Desktop Optimization Pack (MDOP) 2015 ISO package, which can be downloaded from:
- The [MSDN (Microsoft Developer Network) subscriptions site](https://msdn.microsoft.com/en-us/subscriptions/downloads/default.aspx#FileId=65215). You must have a MSDN subscription to download the MDOP ISO package from the MSDN subscriptions site.
- The [Volume Licensing Service Center](https://www.microsoft.com/en-us/licensing/default.aspx) if you're using [Windows 10 for Enterprise or Education](https://www.microsoft.com/en-us/WindowsForBusiness/windows-product-home).

See [Deploying the App-V Server](appv-deploying-the-appv-server.md) for more information about installing and using the server components. -| App-V client and App-V Remote Desktop Services (RDS) client | The App-V client is the component that runs virtualized applications on user devices. The client enables users to interact with icons and file names to start virtualized applications. | The App-V client is automatically installed with Windows 10.
For information about enabling the client, see [Enable the App-V desktop client](appv-enable-the-app-v-desktop-client.md). | +| App-V server components | App-V offers five server components that work together to allow you to host and publish virtual applications, generate usage reports, and manage your App-V environment. For information about the server components, see [Deploying the App-V Server](appv-deploying-the-appv-server.md).

**Note** If you're already using App-V 5.x, you don't need to re-deploy the App-V server components as they haven't changed since App-V 5.0 was released. | The App-V server components are included in the Microsoft Desktop Optimization Pack (MDOP) 2015 ISO package, which can be downloaded from:

- The [MSDN (Microsoft Developer Network) subscriptions site](https://msdn.microsoft.com/en-us/subscriptions/downloads/default.aspx#FileId=65215). You must have a MSDN subscription to download the MDOP ISO package from the MSDN subscriptions site.

- The [Volume Licensing Service Center](https://www.microsoft.com/en-us/licensing/default.aspx) if you're using [Windows 10 for Enterprise or Education](https://www.microsoft.com/en-us/WindowsForBusiness/windows-product-home).

See [Deploying the App-V Server](appv-deploying-the-appv-server.md) for more information about installing and using the server components. +| App-V client and App-V Remote Desktop Services (RDS) client | The App-V client is the component that runs virtualized applications on user devices. The client enables users to interact with icons and file names to start virtualized applications. | The App-V client is automatically installed with Windows 10, version 1607.

For information about enabling the client, see [Enable the App-V desktop client](appv-enable-the-app-v-desktop-client.md). | | App-V sequencer | Use the App-V sequencer to convert Win32 applications into virtual packages for deployment to user devices. Devices must be running the App-V client to allow users to interact with virtual applications. | Installed with the [Windows Assessment and Deployment kit (ADK) for Windows 10, version 1607](https://developer.microsoft.com/en-us/windows/hardware/windows-assessment-deployment-kit). | For more information about these components, see [High Level Architecture for App-V](appv-high-level-architecture.md). diff --git a/windows/manage/appv-install-the-management-and-reporting-databases-on-separate-computers.md b/windows/manage/appv-install-the-management-and-reporting-databases-on-separate-computers.md index f9978a7b46..9558f87d73 100644 --- a/windows/manage/appv-install-the-management-and-reporting-databases-on-separate-computers.md +++ b/windows/manage/appv-install-the-management-and-reporting-databases-on-separate-computers.md @@ -1,6 +1,6 @@ --- title: How to Install the Management and Reporting Databases on Separate Computers from the Management and Reporting Services (Windows 10) -description: How to Install the Management and Reporting Databases on Separate Computers from the Management and Reporting Services +description: How to install the Management and Reporting Databases on Separate Computers from the Management and Reporting Services author: MaggiePucciEvans ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy @@ -14,7 +14,7 @@ ms.prod: w10 Use the following procedure to install the database server and management server on different computers. The computer you plan to install the database server on must be running a supported version of Microsoft SQL or the installation will fail. -**Note**   +>**Note**   After you complete the deployment, the **Microsoft SQL Server name**, **instance name** and **database name** will be required by the administrator installing the service to be able to connect to these databases.   @@ -39,7 +39,7 @@ After you complete the deployment, the **Microsoft SQL Server name**, **instance 7. On the next **Create New Management Server Database** page, select **Use a remote computer**, and type the remote machine account using the following format: **Domain\\MachineAccount**. - **Note**   + >**Note**   If you plan to deploy the management server on the same computer you must select **Use this local computer**.   diff --git a/windows/manage/appv-install-the-management-server-on-a-standalone-computer.md b/windows/manage/appv-install-the-management-server-on-a-standalone-computer.md index de8e7c0416..433492faf0 100644 --- a/windows/manage/appv-install-the-management-server-on-a-standalone-computer.md +++ b/windows/manage/appv-install-the-management-server-on-a-standalone-computer.md @@ -28,7 +28,7 @@ Use the following procedure to install the management server on a standalone com 6. On the **Configure Existing Management Database** page, select **Use a remote SQL Server**, and type the machine name of the computer running Microsoft SQL SQL, for example **SqlServerMachine**. - **Note**   + >**Note**   If the Microsoft SQL Server is deployed on the same server, select **Use local SQL Server**.   @@ -45,7 +45,7 @@ Use the following procedure to install the management server on a standalone com 9. To confirm that the setup has completed successfully, open a web browser, and type the following URL: http://managementserver:portnumber/Console. If the installation was successful, you should see the **Management Console** appear without any error messages or warnings being displayed. - **Have a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). +**Have a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). ## Related topics diff --git a/windows/manage/appv-install-the-publishing-server-on-a-remote-computer.md b/windows/manage/appv-install-the-publishing-server-on-a-remote-computer.md index f9f66a2120..64a5da1508 100644 --- a/windows/manage/appv-install-the-publishing-server-on-a-remote-computer.md +++ b/windows/manage/appv-install-the-publishing-server-on-a-remote-computer.md @@ -1,6 +1,6 @@ --- title: How to Install the Publishing Server on a Remote Computer (Windows 10) -description: How to Install the Publishing Server on a Remote Computer +description: How to Install the App-V Publishing Server on a Remote Computer author: MaggiePucciEvans ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy @@ -44,7 +44,7 @@ Use the following procedure to install the publishing server on a separate compu 3. Type the name of this server and a description (if required) and click **Add**. -9. To verify if the publishing server is running correctly, you should import a package to the management server, entitle the package to an AD group, and publish the package. Using an internet browser, open the following URL: **http://publishingserver:pubport**. If the server is running correctly information similar to the following will be displayed: +9. To verify that the publishing server is running correctly, you should import a package to the management server, entitle the package to an AD group, and publish the package. Using an internet browser, open the following URL: **http://publishingserver:pubport**. If the server is running correctly information similar to the following will be displayed: `` @@ -62,7 +62,7 @@ Use the following procedure to install the publishing server on a separate compu `` - **Have a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). +**Have a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). ## Related topics diff --git a/windows/manage/appv-install-the-reporting-server-on-a-standalone-computer.md b/windows/manage/appv-install-the-reporting-server-on-a-standalone-computer.md index 5fbc775cc8..92d0971f36 100644 --- a/windows/manage/appv-install-the-reporting-server-on-a-standalone-computer.md +++ b/windows/manage/appv-install-the-reporting-server-on-a-standalone-computer.md @@ -1,6 +1,6 @@ --- title: How to install the Reporting Server on a Standalone Computer and Connect it to the Database (Windows 10) -description: How to install the Reporting Server on a Standalone Computer and Connect it to the Database +description: How to install the App-V Reporting Server on a Standalone Computer and Connect it to the Database author: MaggiePucciEvans ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy @@ -50,7 +50,7 @@ Before performing the following procedure you should read and understand [About 8. Click **Install**. - **Have a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). +**Have a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). ## Related topics diff --git a/windows/manage/appv-load-the-powershell-cmdlets-and-get-cmdlet-help.md b/windows/manage/appv-load-the-powershell-cmdlets-and-get-cmdlet-help.md index 110f5d08a1..dca76e75eb 100644 --- a/windows/manage/appv-load-the-powershell-cmdlets-and-get-cmdlet-help.md +++ b/windows/manage/appv-load-the-powershell-cmdlets-and-get-cmdlet-help.md @@ -1,6 +1,6 @@ --- title: How to Load the PowerShell Cmdlets and Get Cmdlet Help (Windows 10) -description: How to Load the PowerShell Cmdlets and Get Cmdlet Help +description: How to Load the App-V PowerShell Cmdlets and Get Cmdlet Help author: MaggiePucciEvans ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy diff --git a/windows/manage/appv-maintaining-appv.md b/windows/manage/appv-maintaining-appv.md index 487547914c..525a693300 100644 --- a/windows/manage/appv-maintaining-appv.md +++ b/windows/manage/appv-maintaining-appv.md @@ -25,7 +25,7 @@ The App-V server connects to the App-V database. Therefore you can install the m Independent software vendors (ISV) who want to determine if an application is running virtualized with App-V should open a named object called **AppVVirtual-<PID>** in the default namespace. For example, Windows API **GetCurrentProcessId()** can be used to obtain the current process's ID, for example 4052, and then if a named Event object called **AppVVirtual-4052** can be successfully opened using **OpenEvent()** in the default namespace for read access, then the application is virtual. If the **OpenEvent()** call fails, the application is not virtual. -Additionally, ISV’s who want to explicitly virtualize or not virtualize calls on specific API’s with App-V and above, can use the **VirtualizeCurrentThread()** and **CurrentThreadIsVirtualized()** functions implemented in the AppEntSubsystems32.dll module. These provide a way of hinting at a downstream component that the call should or should not be virtualized. +Additionally, ISV’s who want to explicitly virtualize or not virtualize calls on specific API’s with App-V 5.1 and later, can use the **VirtualizeCurrentThread()** and **CurrentThreadIsVirtualized()** functions implemented in the AppEntSubsystems32.dll module. These provide a way of hinting at a downstream component that the call should or should not be virtualized. ## Have a suggestion for App-V? diff --git a/windows/manage/appv-migrating-to-appv-from-a-previous-version.md b/windows/manage/appv-migrating-to-appv-from-a-previous-version.md index c6ff02b2cb..a0df7a5306 100644 --- a/windows/manage/appv-migrating-to-appv-from-a-previous-version.md +++ b/windows/manage/appv-migrating-to-appv-from-a-previous-version.md @@ -1,6 +1,6 @@ --- title: Migrating to App-V from a Previous Version (Windows 10) -description: Migrating to App-V from a Previous Version +description: Migrating to App-V for Windows 10 from a previous version author: MaggiePucciEvans ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy @@ -9,17 +9,14 @@ ms.prod: w10 --- -# Migrating to App-V from a Previous Version +# Migrating to App-V from previous versions +Applies to: Windows 10, version 1607 -With Microsoft Application Virtualization (App-V), you can migrate your existing App-V 4.6 or App-V 5.0 infrastructure to the more flexible, integrated, and easier to manage App-V infrastructure. -However, you cannot migrate directly from App-V 4.x to App-V for Windows 10—you must migrate to App-V 5.0 first. For more information on migrating from App-V 4.x to App-V 5.0, see [Migrating to App-V server from a Previous Version](https://technet.microsoft.com/en-us/itpro/mdop/appv-v5/migrating-to-app-v-51-from-a-previous-version) - -**Note**   -Packages for App-V for Windows 10 are exactly the same as packages for App-V 5.0. There has been no change in the package format between the versions and therefore, there is no need to convert App-V 5.0 packages to App-V for Window 10 packages. - -For information about the differences between earlier versions of App-V, see the **Differences between App-4.6 and App-V 5.0 section** of [About App-V 5.0](https://technet.microsoft.com/en-us/itpro/mdop/appv-v5/about-app-v-50). +When you upgrade your existing App-V environment to App-V for Windows 10, version 1607, you'll experience more flexibility, integratation, and ease of management. You can upgrade from any App-V 5.x release, however, you cannot upgrade directly from App-V 4.x to App-V for Windows 10; you must upgrade to App-V 5.x first. For more information about upgrading to App-V for Windows 10, see [Upgrading to App-V for Windows 10 from an existing installation](appv-upgrading-to-app-v-for-windows-10-from-an-existing-installation.md) +>**Note**   +THe package format for App-V packages created with App-V 5.x has not changed in App-V for Windows 10. As a result, you don't need to convert packages. ## Improvements to the App-V Package Converter diff --git a/windows/manage/appv-move-the-appv-server-to-another-computer.md b/windows/manage/appv-move-the-appv-server-to-another-computer.md index 243e056c65..0a7e9d26c6 100644 --- a/windows/manage/appv-move-the-appv-server-to-another-computer.md +++ b/windows/manage/appv-move-the-appv-server-to-another-computer.md @@ -9,7 +9,7 @@ ms.prod: w10 --- -# How to Move the App-V Server to Another Computer +# How to move the App-V server to another computer Use the following information to create a new management server console in your environment. @@ -17,7 +17,7 @@ Use the following information to create a new management server console in your ## To create a new management server console -The following list displays the steps necessary to create a new management server console: +Follow these steps to create a new management server console: 1. Install the management server on a computer in your environment. For more information about installing the management server see [Deploying the App-V server](appv-deploying-the-appv-server.md). diff --git a/windows/manage/appv-planning-to-deploy-appv.md b/windows/manage/appv-planning-to-deploy-appv.md index bc891dc8ee..997ba3e4e0 100644 --- a/windows/manage/appv-planning-to-deploy-appv.md +++ b/windows/manage/appv-planning-to-deploy-appv.md @@ -9,13 +9,15 @@ ms.prod: w10 --- -# Planning to Deploy App-V +# Planning to Deploy App-V for Windows 0 -You should consider a number of different deployment configurations and prerequisites before you create your deployment plan for App-V. This section includes information that can help you gather the information that you must have to formulate a deployment plan that best meets your business requirements. +Applies to: Windows 10, version 1607 + +There are a number of different deployment configurations and requirements to consider before you deploy App-V for Windows 10. Review this topic for information about what you'll need to formulate a deployment plan that best meets your business requirements. ## App-V supported configurations -Describes the minimum hardware and operating system requirements for each App-V components. For information about software prerequisites that you must install before you install App-V, see [App-V Prerequisites](appv-prerequisites.md). +Describes the minimum hardware and operating system requirements for each App-V components. For information about software that you must install before you install App-V, see [App-V Prerequisites](appv-prerequisites.md). [App-V Supported Configurations](appv-supported-configurations.md) diff --git a/windows/manage/appv-prerequisites.md b/windows/manage/appv-prerequisites.md index 19ca1f59f3..5ba350c779 100644 --- a/windows/manage/appv-prerequisites.md +++ b/windows/manage/appv-prerequisites.md @@ -9,12 +9,13 @@ ms.prod: w10 --- -# App-V Prerequisites +# App-V for Windows 10 Prerequisites +Applies to: Windows 10, version 1607 -Before installing App-V, ensure that you have installed all of the following required prerequisite software. +Before installing App-V for Windows 10, ensure that you have installed all of the following required prerequisite software. -For a list of supported operating systems and hardware requirements for the App-V Server, Sequencer, and Client, see [App-V Supported Configurations](appv-supported-configurations.md). +For a list of supported operating systems and hardware requirements for the App-V server, sequencer, and client, see [App-V Supported Configurations](appv-supported-configurations.md). ## Summary of software preinstalled on each operating system diff --git a/windows/manage/appv-release-notes-for-appv-for-windows.md b/windows/manage/appv-release-notes-for-appv-for-windows.md index c60f1dd5b5..ef3c356c57 100644 --- a/windows/manage/appv-release-notes-for-appv-for-windows.md +++ b/windows/manage/appv-release-notes-for-appv-for-windows.md @@ -13,15 +13,15 @@ ms.prod: w10 Applies to: Windows 10, version 1607 -The following is a known issue in Microsoft Application Virtualization (App-V) in Windows 10, version 1607: +The following is a known issue in Application Virtualization (App-V) for Windows 10, version 1607: -**MSI packages generated by the App-V sequencer (version 5.1 and earlier) fail to install on computers with the in-box App-V client** +**Windows Installer packages (.msi files) generated by the App-V sequencer (version 5.1 and earlier) fail to install on computers with the in-box App-V client** -When MSI packages are generated by an older sequencer (App-V versions 5.1 and earlier), they include a check to ensure the App-V client is installed before allowing the MSI package to install. Now that the App-V client is installed automatically when you upgrade user devices to Windows 10, version 1607, the pre-requisite check fails and causes the MSI to fail. +MSI packages that were generated using an App-V sequencer from previous versions of App-V (App-V versions 5.1 and earlier) include a check to validate that the App-V client is installed on client devices before allowing the MSI package to install. Now that the App-V client is installed automatically when you upgrade user devices to Windows 10, version 1607, the pre-requisite check fails and causes the MSI to fail. **Workaround**: -1. Install the latest App-V sequencer, which is part of the Windows Assessment and Deployment Kit (ADK) for Windows 10, version 1607. See [Download the Windows ADK](https://developer.microsoft.com/windows/hardware/windows-assessment-deployment-kit). For more information, see [Install the App-V Sequencer](appv-install-the-sequencer.md). +1. Install the latest App-V sequencer, which you can get from the Windows Assessment and Deployment Kit (ADK) for Windows 10, version 1607. See [Download the Windows ADK](https://developer.microsoft.com/windows/hardware/windows-assessment-deployment-kit). For more information, see [Install the App-V Sequencer](appv-install-the-sequencer.md). 2. Ensure that you have installed the **MSI Tools** included in the Windows 10 SDK, available as follows: @@ -48,4 +48,4 @@ Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-micros ## Related topics -[About App-V](appv-about-appv.md) +[What's new in App-V for Windows 10](appv-about-appv.md) diff --git a/windows/manage/appv-reporting.md b/windows/manage/appv-reporting.md index b76c62fad9..bd794779e4 100644 --- a/windows/manage/appv-reporting.md +++ b/windows/manage/appv-reporting.md @@ -12,9 +12,9 @@ ms.prod: w10 # About App-V Reporting -Microsoft Application Virtualization (App-V) includes a built-in reporting feature that helps you collect information about computers running the App-V client as well as information about virtual application package usage. You can use this information to generate reports from a centralized database. +Application Virtualization (App-V) includes a built-in reporting feature that helps you collect information about computers running the App-V client as well as information about virtual application package usage. You can use this information to generate reports from a centralized database. -## App-V Reporting Overview +## App-V Reporting Overview The following list displays the end–to-end high-level workflow for reporting in App-V. @@ -33,7 +33,7 @@ The following list displays the end–to-end high-level workflow for reporting i 3. If you are not using an electronic software distribution system such as Configuration Manager to view reports then you can define reports in SQL Server Reporting Service. Download predefined appvshort Reports from the Download Center at . - **Note**   + >**Note**   If you are using the Configuration Manager integration with App-V, most reports are generated from Configuration Manager rather than from App-V.   @@ -52,14 +52,14 @@ The following list displays the end–to-end high-level workflow for reporting i 6. When the App-V client receives the success notification, it empties the data cache to conserve space. - **Note**   - By default the cache is cleared after the server confirms receipt of data. You can manually configure the client to save the data cache. + >**Note**   + By default, the cache is cleared after the server confirms receipt of data. You can manually configure the client to save the data cache.   If the App-V client device does not receive a success notification from the server, it retains data in the cache and tries to resend data at the next configured interval. Clients continue to collect data and add it to the cache. -### App-V reporting server frequently asked questions +### App-V reporting server frequently asked questions The following table displays answers to common questions about App-V reporting @@ -124,10 +124,10 @@ The following table displays answers to common questions about App-V reporting   -## App-V Client Reporting +## App-V Client Reporting -To use App-V reporting you must install and configure the App-V client. After the client has been installed, use the **Set-AppVClientConfiguration** PowerShell cmdlet or the **ADMX Template** to configure reporting. The reporting feature cmdlets are available by using the following link and are prefaced by **Reporting**. For a complete list of client configuration settings see [About Client Configuration Settings](appv-client-configuration-settings.md). The following section provides examples of App-V client reporting configuration using PowerShell. +To use App-V reporting you must enable and configure the App-V client. After the client has been installed, use the **Set-AppVClientConfiguration** PowerShell cmdlet or the **ADMX Template** to configure reporting. The reporting feature cmdlets are available by using the following link and are prefaced by **Reporting**. For a complete list of client configuration settings see [About Client Configuration Settings](appv-client-configuration-settings.md). The following section provides examples of App-V client reporting configuration using PowerShell. ### Configuring App-V Client reporting using PowerShell diff --git a/windows/manage/appv-supported-configurations.md b/windows/manage/appv-supported-configurations.md index b93d27a77c..3849c350d8 100644 --- a/windows/manage/appv-supported-configurations.md +++ b/windows/manage/appv-supported-configurations.md @@ -11,12 +11,13 @@ ms.prod: w10 # App-V Supported Configurations +Applies to: Windows 10, version 1607 -This topic specifies the requirements to install and run App-V in your environment. +This topic specifies the requirements to install and run App-V in your Windows 10 environment. ## App-V Server system requirements -This section lists the operating system and hardware requirements for all of the App-V Server components. +This section lists the operating system and hardware requirements for all of the App-V server components. ### Unsupported App-V server scenarios diff --git a/windows/manage/appv-upgrading-to-app-v-for-windows-10-from-an-existing-installation.md b/windows/manage/appv-upgrading-to-app-v-for-windows-10-from-an-existing-installation.md index c93a7f9be1..3ae22a7bee 100644 --- a/windows/manage/appv-upgrading-to-app-v-for-windows-10-from-an-existing-installation.md +++ b/windows/manage/appv-upgrading-to-app-v-for-windows-10-from-an-existing-installation.md @@ -10,6 +10,8 @@ ms.prod: w10 # Upgrading to App-V for Windows 10 from an existing installation +Applies to: Windows 10, version 1607 + If you’re already using App-V and you’re planning to upgrade user devices to Windows 10, you need to make only the following few adjustments to your existing environment to start using App-V for Windows 10. 1. [Upgrade user devices to Windows 10](#upgrade-user-devices-to-windows-10). Performing an in-place upgrade automatically installs the App-V client and migrates users’ App-V applications and settings. diff --git a/windows/manage/manage-corporate-devices.md b/windows/manage/manage-corporate-devices.md index f291375dbb..aca3fb1ea1 100644 --- a/windows/manage/manage-corporate-devices.md +++ b/windows/manage/manage-corporate-devices.md @@ -34,7 +34,7 @@ Your employees using devices that are owned by the organization can connect to A You can join a device running Windows 10 to an on-premises Active Directory domain after the first-run experience (sometimes called out-of-box experience or OOBE). You can add devices running Windows 10 to your existing Active Directory infrastructure and manage them just as you've always been used to managing PCs running Windows. -Desktop devices running Windows 10 that are joined to an Active Directory domain can be managed using Group Policy and System Center 2012 R2 Configuration Manager. The following table shows the management support for Windows 10 in Configuration Manager. +Desktop devices running Windows 10 that are joined to an Active Directory domain can be managed using Group Policy and System Center Configuration Manager (current branch). The following table shows the management support for Windows 10 in Configuration Manager.
@@ -49,7 +49,7 @@ Desktop devices running Windows 10 that are joined to an Active Directory domai - + diff --git a/windows/whats-new/change-history-for-what-s-new-in-windows-10.md b/windows/whats-new/change-history-for-what-s-new-in-windows-10.md index 750a878d7d..a38cbf4702 100644 --- a/windows/whats-new/change-history-for-what-s-new-in-windows-10.md +++ b/windows/whats-new/change-history-for-what-s-new-in-windows-10.md @@ -6,6 +6,7 @@ ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library author: TrudyHa +redirect_url: https://technet.microsoft.com/en-us/itpro/windows/whats-new/index --- # Change history for What's new in Windows 10 diff --git a/windows/whats-new/device-guard-overview.md b/windows/whats-new/device-guard-overview.md index 4009a8845d..926ad68867 100644 --- a/windows/whats-new/device-guard-overview.md +++ b/windows/whats-new/device-guard-overview.md @@ -8,7 +8,7 @@ ms.prod: w10 ms.mktglfcycl: explore ms.sitesec: library author: brianlic-msft -redirect_url: https://technet.microsoft.com/itpro/windows/keep-secure/whats-new-windows-10-version-1507-and-1511 +redirect_url: https://technet.microsoft.com/itpro/windows/whats-new/whats-new-windows-10-version-1507-and-1511 --- # Device Guard overview diff --git a/windows/whats-new/whats-new-windows-10-version-1607.md b/windows/whats-new/whats-new-windows-10-version-1607.md index 5d509f5ee2..fa89197f86 100644 --- a/windows/whats-new/whats-new-windows-10-version-1607.md +++ b/windows/whats-new/whats-new-windows-10-version-1607.md @@ -50,6 +50,14 @@ The Upgrade Analytics workflow steps you through the discovery and rationalizati [Learn more about planning and managing Windows upgrades with Windows Upgrade Analytics.](../deploy/manage-windows-upgrades-with-upgrade-analytics.md) +## Windows updates + +Windows 10, version 1607, provides administrators with increased control over updates by changing the update deferral increment from weeks to days. Other changes: + +- Quality Updates can be deferred up to 30 days and paused for 35 days +- Feature Updates can be deferred up to 180 days and paused for 60 days +- Update deferrals can be applied to both Current Branch (CB) and Current Branch for Business (CBB) + ## Security ### Credential Guard and Device Guard

[Microsoft System Center Configuration Manager 2016](http://go.microsoft.com/fwlink/p/?LinkId=613622)

[System Center Configuration Manager (current branch) ](https://technet.microsoft.com/en-us/library/mt346023.aspx)

Client deployment, upgrade, and management with new and existing features