mirror of
https://github.com/MicrosoftDocs/windows-itpro-docs.git
synced 2025-06-17 19:33:37 +00:00
Merge remote-tracking branch 'refs/remotes/origin/rs2' into jdrs2icd
This commit is contained in:
jdeckerMS
1049
.openpublishing.redirection.json
Normal file
1049
.openpublishing.redirection.json
Normal file
File diff suppressed because it is too large
Load Diff
@ -9,7 +9,7 @@ author: jdeckerMS
|
|||||||
localizationpriority: medium
|
localizationpriority: medium
|
||||||
---
|
---
|
||||||
|
|
||||||
# Configure HoloLens using a provisioning package
|
# Configure HoloLens using a provisioning package test
|
||||||
|
|
||||||
Windows provisioning makes it easy for IT administrators to configure end-user devices without imaging. The Windows Assessment and Deployment Kit (ADK) for Windows 10 includes the Imaging and Configuration Designer (ICD), a tool for configuring images and runtime settings which are then built into provisioning packages.
|
Windows provisioning makes it easy for IT administrators to configure end-user devices without imaging. The Windows Assessment and Deployment Kit (ADK) for Windows 10 includes the Imaging and Configuration Designer (ICD), a tool for configuring images and runtime settings which are then built into provisioning packages.
|
||||||
|
|
||||||
|
|||||||
@ -5,7 +5,7 @@ ms.prod: w10
|
|||||||
ms.mktglfcycl: deploy
|
ms.mktglfcycl: deploy
|
||||||
ms.sitesec: library
|
ms.sitesec: library
|
||||||
ms.pagetype: edu
|
ms.pagetype: edu
|
||||||
author: jdeckerMS
|
author: CelesteDG
|
||||||
---
|
---
|
||||||
|
|
||||||
# Change history for Windows 10 for Education
|
# Change history for Windows 10 for Education
|
||||||
|
|||||||
@ -5,7 +5,7 @@ keywords: school
|
|||||||
ms.prod: W10
|
ms.prod: W10
|
||||||
ms.mktglfcycl: plan
|
ms.mktglfcycl: plan
|
||||||
ms.sitesec: library
|
ms.sitesec: library
|
||||||
author: jdeckerMS
|
author: trudyha
|
||||||
---
|
---
|
||||||
|
|
||||||
# Get Minecraft: Education Edition
|
# Get Minecraft: Education Edition
|
||||||
|
|||||||
@ -5,7 +5,7 @@ keywords: ["school"]
|
|||||||
ms.prod: W10
|
ms.prod: W10
|
||||||
ms.mktglfcycl: plan
|
ms.mktglfcycl: plan
|
||||||
ms.sitesec: library
|
ms.sitesec: library
|
||||||
author: jdeckerMS
|
author: trudyha
|
||||||
---
|
---
|
||||||
|
|
||||||
# For IT administrators - get Minecraft: Education Edition
|
# For IT administrators - get Minecraft: Education Edition
|
||||||
|
|||||||
@ -6,7 +6,7 @@ ms.prod: w10
|
|||||||
ms.mktglfcycl: plan
|
ms.mktglfcycl: plan
|
||||||
ms.sitesec: library
|
ms.sitesec: library
|
||||||
ms.pagetype: edu
|
ms.pagetype: edu
|
||||||
author: jdeckerMS
|
author: CelesteDG
|
||||||
---
|
---
|
||||||
|
|
||||||
# Technical reference for the Set up School PCs app
|
# Technical reference for the Set up School PCs app
|
||||||
|
|||||||
@ -5,7 +5,7 @@ keywords: ["shared cart", "shared PC", "school"]
|
|||||||
ms.prod: W10
|
ms.prod: W10
|
||||||
ms.mktglfcycl: plan
|
ms.mktglfcycl: plan
|
||||||
ms.sitesec: library
|
ms.sitesec: library
|
||||||
author: jdeckerMS
|
author: CelesteDG
|
||||||
---
|
---
|
||||||
|
|
||||||
# Set up student PCs to join domain
|
# Set up student PCs to join domain
|
||||||
|
|||||||
@ -5,7 +5,7 @@ keywords: ["shared cart", "shared PC", "school"]
|
|||||||
ms.prod: W10
|
ms.prod: W10
|
||||||
ms.mktglfcycl: plan
|
ms.mktglfcycl: plan
|
||||||
ms.sitesec: library
|
ms.sitesec: library
|
||||||
author: jdeckerMS
|
author: CelesteDG
|
||||||
---
|
---
|
||||||
|
|
||||||
# Provision student PCs with apps
|
# Provision student PCs with apps
|
||||||
|
|||||||
@ -6,7 +6,7 @@ ms.prod: w10
|
|||||||
ms.mktglfcycl: plan
|
ms.mktglfcycl: plan
|
||||||
ms.sitesec: library
|
ms.sitesec: library
|
||||||
ms.pagetype: edu
|
ms.pagetype: edu
|
||||||
author: jdeckerMS
|
author: CelesteDG
|
||||||
---
|
---
|
||||||
|
|
||||||
# Provisioning options for Windows 10
|
# Provisioning options for Windows 10
|
||||||
|
|||||||
@ -6,7 +6,7 @@ ms.prod: w10
|
|||||||
ms.mktglfcycl: plan
|
ms.mktglfcycl: plan
|
||||||
ms.sitesec: library
|
ms.sitesec: library
|
||||||
ms.pagetype: edu
|
ms.pagetype: edu
|
||||||
author: jdeckerMS
|
author: CelesteDG
|
||||||
---
|
---
|
||||||
|
|
||||||
# Take a Test app technical reference
|
# Take a Test app technical reference
|
||||||
|
|||||||
@ -6,7 +6,7 @@ ms.prod: w10
|
|||||||
ms.mktglfcycl: plan
|
ms.mktglfcycl: plan
|
||||||
ms.sitesec: library
|
ms.sitesec: library
|
||||||
ms.pagetype: edu
|
ms.pagetype: edu
|
||||||
author: jdeckerMS
|
author: CelesteDG
|
||||||
---
|
---
|
||||||
|
|
||||||
# Set up Take a Test on multiple PCs
|
# Set up Take a Test on multiple PCs
|
||||||
|
|||||||
@ -6,7 +6,7 @@ ms.prod: w10
|
|||||||
ms.mktglfcycl: plan
|
ms.mktglfcycl: plan
|
||||||
ms.sitesec: library
|
ms.sitesec: library
|
||||||
ms.pagetype: edu
|
ms.pagetype: edu
|
||||||
author: jdeckerMS
|
author: CelesteDG
|
||||||
---
|
---
|
||||||
|
|
||||||
# Set up Take a Test on a single PC
|
# Set up Take a Test on a single PC
|
||||||
|
|||||||
@ -6,7 +6,7 @@ ms.prod: w10
|
|||||||
ms.mktglfcycl: plan
|
ms.mktglfcycl: plan
|
||||||
ms.sitesec: library
|
ms.sitesec: library
|
||||||
ms.pagetype: edu
|
ms.pagetype: edu
|
||||||
author: jdeckerMS
|
author: CelesteDG
|
||||||
---
|
---
|
||||||
|
|
||||||
# Take tests in Windows 10
|
# Take tests in Windows 10
|
||||||
|
|||||||
@ -5,7 +5,7 @@ keywords: ["school"]
|
|||||||
ms.prod: W10
|
ms.prod: W10
|
||||||
ms.mktglfcycl: plan
|
ms.mktglfcycl: plan
|
||||||
ms.sitesec: library
|
ms.sitesec: library
|
||||||
author: jdeckerMS
|
author: trudyha
|
||||||
---
|
---
|
||||||
|
|
||||||
# For teachers - get Minecraft: Education Edition
|
# For teachers - get Minecraft: Education Edition
|
||||||
|
|||||||
@ -6,7 +6,7 @@ ms.prod: w10
|
|||||||
ms.mktglfcycl: plan
|
ms.mktglfcycl: plan
|
||||||
ms.sitesec: library
|
ms.sitesec: library
|
||||||
ms.pagetype: edu
|
ms.pagetype: edu
|
||||||
author: jdeckerMS
|
author: CelesteDG
|
||||||
---
|
---
|
||||||
|
|
||||||
# Use the Set up School PCs app
|
# Use the Set up School PCs app
|
||||||
|
|||||||
@ -1,4 +0,0 @@
|
|||||||
---
|
|
||||||
title: Configure Windows 10 devices to stop data flow to Microsoft (Windows 10)
|
|
||||||
redirect_url: https://technet.microsoft.com/itpro/windows/manage/manage-connections-from-windows-operating-system-components-to-microsoft-services
|
|
||||||
---
|
|
||||||
@ -4,6 +4,7 @@ description: How to set up Cortana to help your salespeople get proactive insigh
|
|||||||
ms.prod: w10
|
ms.prod: w10
|
||||||
ms.mktglfcycl: manage
|
ms.mktglfcycl: manage
|
||||||
ms.sitesec: library
|
ms.sitesec: library
|
||||||
|
author: eross-msft
|
||||||
localizationpriority: high
|
localizationpriority: high
|
||||||
---
|
---
|
||||||
|
|
||||||
|
|||||||
@ -4,6 +4,7 @@ description: How to send feedback to Microsoft about Cortana at work.
|
|||||||
ms.prod: w10
|
ms.prod: w10
|
||||||
ms.mktglfcycl: manage
|
ms.mktglfcycl: manage
|
||||||
ms.sitesec: library
|
ms.sitesec: library
|
||||||
|
author: eross-msft
|
||||||
localizationpriority: high
|
localizationpriority: high
|
||||||
---
|
---
|
||||||
|
|
||||||
|
|||||||
@ -4,6 +4,7 @@ description: How to connect Cortana to Office 365 so your employees are notified
|
|||||||
ms.prod: w10
|
ms.prod: w10
|
||||||
ms.mktglfcycl: manage
|
ms.mktglfcycl: manage
|
||||||
ms.sitesec: library
|
ms.sitesec: library
|
||||||
|
author: eross-msft
|
||||||
localizationpriority: high
|
localizationpriority: high
|
||||||
---
|
---
|
||||||
|
|
||||||
|
|||||||
@ -4,6 +4,7 @@ description: The world’s first personal digital assistant helps users get thin
|
|||||||
ms.prod: w10
|
ms.prod: w10
|
||||||
ms.mktglfcycl: manage
|
ms.mktglfcycl: manage
|
||||||
ms.sitesec: library
|
ms.sitesec: library
|
||||||
|
author: eross-msft
|
||||||
localizationpriority: high
|
localizationpriority: high
|
||||||
---
|
---
|
||||||
|
|
||||||
|
|||||||
@ -4,6 +4,7 @@ description: The list of Group Policy and mobile device management (MDM) policy
|
|||||||
ms.prod: w10
|
ms.prod: w10
|
||||||
ms.mktglfcycl: manage
|
ms.mktglfcycl: manage
|
||||||
ms.sitesec: library
|
ms.sitesec: library
|
||||||
|
author: eross-msft
|
||||||
localizationpriority: high
|
localizationpriority: high
|
||||||
---
|
---
|
||||||
|
|
||||||
|
|||||||
@ -4,6 +4,7 @@ description: How to integrate Cortana with Power BI to help your employees get a
|
|||||||
ms.prod: w10
|
ms.prod: w10
|
||||||
ms.mktglfcycl: manage
|
ms.mktglfcycl: manage
|
||||||
ms.sitesec: library
|
ms.sitesec: library
|
||||||
|
author: eross-msft
|
||||||
localizationpriority: high
|
localizationpriority: high
|
||||||
---
|
---
|
||||||
|
|
||||||
|
|||||||
@ -4,6 +4,7 @@ description: A test scenario walking you through signing in and managing the not
|
|||||||
ms.prod: w10
|
ms.prod: w10
|
||||||
ms.mktglfcycl: manage
|
ms.mktglfcycl: manage
|
||||||
ms.sitesec: library
|
ms.sitesec: library
|
||||||
|
author: eross-msft
|
||||||
localizationpriority: high
|
localizationpriority: high
|
||||||
---
|
---
|
||||||
|
|
||||||
|
|||||||
@ -4,6 +4,7 @@ description: A test scenario about how to perform a quick search with Cortana at
|
|||||||
ms.prod: w10
|
ms.prod: w10
|
||||||
ms.mktglfcycl: manage
|
ms.mktglfcycl: manage
|
||||||
ms.sitesec: library
|
ms.sitesec: library
|
||||||
|
author: eross-msft
|
||||||
localizationpriority: high
|
localizationpriority: high
|
||||||
---
|
---
|
||||||
|
|
||||||
|
|||||||
@ -4,6 +4,7 @@ description: A test scenario about how to set a location-based reminder using Co
|
|||||||
ms.prod: w10
|
ms.prod: w10
|
||||||
ms.mktglfcycl: manage
|
ms.mktglfcycl: manage
|
||||||
ms.sitesec: library
|
ms.sitesec: library
|
||||||
|
author: eross-msft
|
||||||
localizationpriority: high
|
localizationpriority: high
|
||||||
---
|
---
|
||||||
|
|
||||||
|
|||||||
@ -4,6 +4,7 @@ description: A test scenario about how to use Cortana at work to find your upcom
|
|||||||
ms.prod: w10
|
ms.prod: w10
|
||||||
ms.mktglfcycl: manage
|
ms.mktglfcycl: manage
|
||||||
ms.sitesec: library
|
ms.sitesec: library
|
||||||
|
author: eross-msft
|
||||||
localizationpriority: high
|
localizationpriority: high
|
||||||
---
|
---
|
||||||
|
|
||||||
|
|||||||
@ -4,6 +4,7 @@ description: A test scenario about how to use Cortana at work to send email to a
|
|||||||
ms.prod: w10
|
ms.prod: w10
|
||||||
ms.mktglfcycl: manage
|
ms.mktglfcycl: manage
|
||||||
ms.sitesec: library
|
ms.sitesec: library
|
||||||
|
author: eross-msft
|
||||||
localizationpriority: high
|
localizationpriority: high
|
||||||
---
|
---
|
||||||
|
|
||||||
|
|||||||
@ -4,6 +4,7 @@ description: An optional test scenario about how to use Cortana at work with Win
|
|||||||
ms.prod: w10
|
ms.prod: w10
|
||||||
ms.mktglfcycl: manage
|
ms.mktglfcycl: manage
|
||||||
ms.sitesec: library
|
ms.sitesec: library
|
||||||
|
author: eross-msft
|
||||||
localizationpriority: high
|
localizationpriority: high
|
||||||
---
|
---
|
||||||
|
|
||||||
|
|||||||
@ -4,6 +4,7 @@ description: A list of suggested testing scenarios that you can use to test Cort
|
|||||||
ms.prod: w10
|
ms.prod: w10
|
||||||
ms.mktglfcycl: manage
|
ms.mktglfcycl: manage
|
||||||
ms.sitesec: library
|
ms.sitesec: library
|
||||||
|
author: eross-msft
|
||||||
localizationpriority: high
|
localizationpriority: high
|
||||||
---
|
---
|
||||||
|
|
||||||
|
|||||||
@ -4,6 +4,7 @@ description: How to create voice commands that use Cortana to perform voice-enab
|
|||||||
ms.prod: w10
|
ms.prod: w10
|
||||||
ms.mktglfcycl: manage
|
ms.mktglfcycl: manage
|
||||||
ms.sitesec: library
|
ms.sitesec: library
|
||||||
|
author: eross-msft
|
||||||
localizationpriority: high
|
localizationpriority: high
|
||||||
---
|
---
|
||||||
|
|
||||||
|
|||||||
@ -1,4 +0,0 @@
|
|||||||
---
|
|
||||||
title: Configure Windows 10 devices to stop data flow to Microsoft (Windows 10)
|
|
||||||
redirect_url: https://technet.microsoft.com/itpro/windows/manage/manage-connections-from-windows-operating-system-components-to-microsoft-services
|
|
||||||
---
|
|
||||||
@ -58,7 +58,7 @@ Generally, enterprises rely on Group Policy or MDM to configure and manage devic
|
|||||||
|
|
||||||
In addition, you may have unmanaged devices, or a large number of devices that you want to configure before enrolling them in management, or you want to apply custom settings that aren't available through your MDM service. The [CSP documentation](#bkmk-csp-doc) can help you understand the settings that can be configured or queried.
|
In addition, you may have unmanaged devices, or a large number of devices that you want to configure before enrolling them in management, or you want to apply custom settings that aren't available through your MDM service. The [CSP documentation](#bkmk-csp-doc) can help you understand the settings that can be configured or queried.
|
||||||
|
|
||||||
In addition, some of the topics in the [Windows 10 and Windows 10 Mobile](../index.md) library on Technet include links to applicable CSP reference topics, such as [Cortana integration in your business or enterprise](manage-cortana-in-enterprise.md) which links to the [Policy CSP](https://go.microsoft.com/fwlink/p/?LinkID=623244). In the CSP topics, you can learn about all of the available configuration settings.
|
In addition, some of the topics in the [Windows 10 and Windows 10 Mobile](../index.md) library on Technet include links to applicable CSP reference topics, such as [Cortana integration in your business or enterprise](cortana-at-work-overview.md) which links to the [Policy CSP](https://go.microsoft.com/fwlink/p/?LinkID=623244). In the CSP topics, you can learn about all of the available configuration settings.
|
||||||
|
|
||||||
### CSPs in Windows Imaging and Configuration Designer (ICD)
|
### CSPs in Windows Imaging and Configuration Designer (ICD)
|
||||||
|
|
||||||
|
|||||||
@ -1259,7 +1259,7 @@ If you're not running Windows 10, version 1607 or later, you can use the other o
|
|||||||
|
|
||||||
- **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Cloud Content** > **Turn off Microsoft consumer experiences**.
|
- **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Cloud Content** > **Turn off Microsoft consumer experiences**.
|
||||||
|
|
||||||
For more info, see [Windows Spotlight on the lock screen](../manage/windows-spotlight.md).
|
For more info, see [Windows Spotlight on the lock screen](../configure/windows-spotlight.md).
|
||||||
|
|
||||||
### <a href="" id="bkmk-windowsstore"></a>24. Windows Store
|
### <a href="" id="bkmk-windowsstore"></a>24. Windows Store
|
||||||
|
|
||||||
|
|||||||
@ -1,5 +0,0 @@
|
|||||||
---
|
|
||||||
title: Cortana integration in your business or enterprise (Windows 10)
|
|
||||||
description: The world’s first personal digital assistant helps users get things done, even at work. Cortana includes powerful configuration options specifically to optimize for unique small to medium-sized business and enterprise environments.
|
|
||||||
redirect_url: https://technet.microsoft.com/en-us/itpro/windows/manage/cortana-at-work-overview
|
|
||||||
---
|
|
||||||
@ -49,7 +49,7 @@ Windows 10, version 1607 (also known as the Anniversary Update), provides organi
|
|||||||
## Related topics
|
## Related topics
|
||||||
|
|
||||||
- [Manage Windows 10 Start layout](windows-10-start-layout-options-and-policies.md)
|
- [Manage Windows 10 Start layout](windows-10-start-layout-options-and-policies.md)
|
||||||
- [Cortana integration in your business or enterprise](manage-cortana-in-enterprise.md)
|
- [Cortana integration in your business or enterprise](cortana-at-work-overview.md)
|
||||||
- [Windows spotlight on the lock screen](../whats-new/windows-spotlight.md)
|
- [Windows spotlight on the lock screen](../whats-new/windows-spotlight.md)
|
||||||
- [Windows 10 editions for education customers](https://technet.microsoft.com/en-us/edu/windows/windows-editions-for-education-customers)
|
- [Windows 10 editions for education customers](https://technet.microsoft.com/en-us/edu/windows/windows-editions-for-education-customers)
|
||||||
|
|
||||||
|
|||||||
@ -163,6 +163,9 @@ ramdisksdidevice boot
|
|||||||
ramdisksdipath \boot\boot.sdi
|
ramdisksdipath \boot\boot.sdi
|
||||||
```
|
```
|
||||||
|
|
||||||
|
>[!TIP]
|
||||||
|
>If you start the PXE boot process, but receive the error that "The boot configuration data for your PC is missing or contains errors" then verify that \\boot directory is installed under the correct TFTP server root directory. In the example used here the name of this directory is TFTPRoot, but your TFTP server might be different.
|
||||||
|
|
||||||
## PXE boot process summary
|
## PXE boot process summary
|
||||||
|
|
||||||
The following summarizes the PXE client boot process.
|
The following summarizes the PXE client boot process.
|
||||||
|
|||||||
@ -1,123 +0,0 @@
|
|||||||
---
|
|
||||||
title: Provision PCs with common settings (Windows 10)
|
|
||||||
description: Create a provisioning package to apply common settings to a PC running Windows 10.
|
|
||||||
ms.assetid: 66D14E97-E116-4218-8924-E2A326C9367E
|
|
||||||
keywords: ["runtime provisioning", "provisioning package"]
|
|
||||||
ms.prod: W10
|
|
||||||
ms.mktglfcycl: deploy
|
|
||||||
ms.sitesec: library
|
|
||||||
author: jdeckerMS
|
|
||||||
localizationpriority: high
|
|
||||||
---
|
|
||||||
|
|
||||||
# Provision PCs with common settings for initial deployment (simple provisioning)
|
|
||||||
|
|
||||||
|
|
||||||
**Applies to**
|
|
||||||
|
|
||||||
- Windows 10
|
|
||||||
|
|
||||||
This topic explains how to create and apply a simple provisioning package that contains common enterprise settings to a device running all desktop editions of Windows 10 except Windows 10 Home.
|
|
||||||
|
|
||||||
You can apply a provisioning package on a USB drive to off-the-shelf devices during setup, making it fast and easy to configure new devices.
|
|
||||||
|
|
||||||
## Advantages
|
|
||||||
- You can configure new devices without reimaging.
|
|
||||||
|
|
||||||
- Works on both mobile and desktop devices.
|
|
||||||
|
|
||||||
- No network connectivity required.
|
|
||||||
|
|
||||||
- Simple to apply.
|
|
||||||
|
|
||||||
[Learn more about the benefits and uses of provisioning packages.](provisioning-packages.md)
|
|
||||||
|
|
||||||
## What does simple provisioning do?
|
|
||||||
|
|
||||||
In a simple provisioning package, you can configure:
|
|
||||||
|
|
||||||
- Device name
|
|
||||||
- Upgraded product edition
|
|
||||||
- Wi-Fi network
|
|
||||||
- Active Directory enrollment
|
|
||||||
- Local administrator account
|
|
||||||
|
|
||||||
Provisioning packages can include management instructions and policies, installation of specific apps, customization of network connections and policies, and more. To learn about provisioning packages that include more than the settings in a simple provisioning package, see [Provision PCs with apps and certificates](provision-pcs-with-apps-and-certificates.md).
|
|
||||||
|
|
||||||
> [!TIP]
|
|
||||||
> Use simple provisioning to create a package with the common settings, then switch to the advanced editor to add other settings, apps, policies, etc.
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
## Create the provisioning package
|
|
||||||
|
|
||||||
Use the Windows Imaging and Configuration Designer (ICD) tool included in the Windows Assessment and Deployment Kit (ADK) for Windows 10 to create a provisioning package. [Install the ADK and select **Configuration Designer**.](https://developer.microsoft.com/windows/hardware/windows-assessment-deployment-kit)
|
|
||||||
|
|
||||||
1. Open Windows ICD (by default, %windir%\Program Files (x86)\Windows Kits\10\Assessment and Deployment Kit\Imaging and Configuration Designer\x86\ICD.exe).
|
|
||||||
|
|
||||||
2. Click **Simple provisioning**.
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
3. Name your project and click **Finish**. The screens for simple provisioning will walk you through the following steps.
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
4. In the **Set up device** step, enter a unique 15-character name for the device. For help generating a unique name, you can use %SERIAL%, which includes a hardware-specific serial number, or you can use %RAND:x%, which generates random characters of x length.
|
|
||||||
|
|
||||||
5. (*Optional*) You can upgrade the following editions of Windows 10 by providing a product key for the edition to upgrade to.
|
|
||||||
- Pro to Education
|
|
||||||
- Pro to Enterprise
|
|
||||||
- Enterprise to Education
|
|
||||||
|
|
||||||
6. Click **Set up network**.
|
|
||||||
|
|
||||||
7. Toggle **On** or **Off** for wireless network connectivity. If you select **On**, enter the SSID, type, and (if required) password for the wireless network.
|
|
||||||
|
|
||||||
8. Click **Enroll into Active Directory**.
|
|
||||||
|
|
||||||
9. Toggle **Yes** or **No** for Active Directory enrollment. If you select **Yes**, enter the credentials for an account with permissions to enroll the device. (*Optional*) Enter a user name and password to create a local administrator account.
|
|
||||||
|
|
||||||
> **Warning**: If you don't create a local administrator account and the device fails to enroll in Active Directory for any reason, you will have to reimage the device and start over. As a best practice, we recommend:
|
|
||||||
- Use a least-privileged domain account to join the device to the domain.
|
|
||||||
- Create a temporary administrator account to use for debugging or reprovisioning if the device fails to enroll successfully.
|
|
||||||
- [Use Group Policy to delete the temporary administrator account](https://blogs.technet.microsoft.com/canitpro/2014/12/10/group-policy-creating-a-standard-local-admin-account/) after the device is enrolled in Active Directory.
|
|
||||||
|
|
||||||
10. Click **Finish**.
|
|
||||||
|
|
||||||
11. Review your settings in the summary. You can return to previous pages to change your selections. Then, under **Protect your package**, toggle **Yes** or **No** to encrypt the provisioning package. If you select **Yes**, enter a password. This password must be entered to apply the encrypted provisioning package.
|
|
||||||
|
|
||||||
12. Click **Create**.
|
|
||||||
|
|
||||||
> [!IMPORTANT]
|
|
||||||
> When you build a provisioning package, you may include sensitive information in the project files and in the provisioning package (.ppkg) file. Although you have the option to encrypt the .ppkg file, project files are not encrypted. You should store the project files in a secure location and delete the project files when they are no longer needed.
|
|
||||||
|
|
||||||
|
|
||||||
**Next step**: [How to apply a provisioning package](provisioning-apply-package.md)
|
|
||||||
|
|
||||||
|
|
||||||
## Learn more
|
|
||||||
|
|
||||||
- Watch the video: [Provisioning Windows 10 Devices with New Tools](https://go.microsoft.com/fwlink/p/?LinkId=615921)
|
|
||||||
|
|
||||||
- Watch the video: [Windows 10 for Mobile Devices: Provisioning Is Not Imaging](https://go.microsoft.com/fwlink/p/?LinkId=615922)
|
|
||||||
|
|
||||||
|
|
||||||
## Related topics
|
|
||||||
|
|
||||||
- [Provisioning packages for Windows 10](provisioning-packages.md)
|
|
||||||
- [How provisioning works in Windows 10](provisioning-how-it-works.md)
|
|
||||||
- [Install Windows Imaging and Configuration Designer](provisioning-install-icd.md)
|
|
||||||
- [Create a provisioning package](provisioning-create-package.md)
|
|
||||||
- [Apply a provisioning package](provisioning-apply-package.md)
|
|
||||||
- [Settings changed when you uninstall a provisioning package](provisioning-uninstall-package.md)
|
|
||||||
- [Provision PCs with apps and certificates for initial deployments (advanced provisioning)](provision-pcs-with-apps-and-certificates.md)
|
|
||||||
- [Use a script to install a desktop app in provisioning packages](provisioning-script-to-install-app.md)
|
|
||||||
- [NFC-based device provisioning](provisioning-nfc.md)
|
|
||||||
- [Windows ICD command-line interface (reference)](provisioning-command-line.md)
|
|
||||||
- [Create a provisioning package with multivariant settings](provisioning-multivariant.md)
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
@ -1,196 +0,0 @@
|
|||||||
---
|
|
||||||
title: Provision PCs with apps and certificates (Windows 10)
|
|
||||||
description: Create a provisioning package to apply settings to a PC running Windows 10.
|
|
||||||
ms.assetid: 66D14E97-E116-4218-8924-E2A326C9367E
|
|
||||||
keywords: ["runtime provisioning", "provisioning package"]
|
|
||||||
ms.prod: W10
|
|
||||||
ms.mktglfcycl: deploy
|
|
||||||
ms.sitesec: library
|
|
||||||
author: jdeckerMS
|
|
||||||
localizationpriority: high
|
|
||||||
---
|
|
||||||
|
|
||||||
# Provision PCs with apps and certificates for initial deployment (advanced provisioning)
|
|
||||||
|
|
||||||
|
|
||||||
**Applies to**
|
|
||||||
|
|
||||||
- Windows 10
|
|
||||||
|
|
||||||
|
|
||||||
This topic explains how to create and apply a provisioning package that contains apps and certificates to a device running all desktop editions of Windows 10 except Windows 10 Home. Provisioning packages can include management instructions and policies, installation of specific apps, customization of network connections and policies, and more.
|
|
||||||
|
|
||||||
You can apply a provisioning package on a USB drive to off-the-shelf devices during setup, making it fast and easy to configure new devices.
|
|
||||||
|
|
||||||
## Advantages
|
|
||||||
- You can configure new devices without reimaging.
|
|
||||||
|
|
||||||
- Works on both mobile and desktop devices.
|
|
||||||
|
|
||||||
- No network connectivity required.
|
|
||||||
|
|
||||||
- Simple to apply.
|
|
||||||
|
|
||||||
[Learn more about the benefits and uses of provisioning packages.](provisioning-packages.md)
|
|
||||||
|
|
||||||
## Create the provisioning package
|
|
||||||
|
|
||||||
Use the Windows Imaging and Configuration Designer (ICD) tool included in the Windows Assessment and Deployment Kit (ADK) for Windows 10 to create a provisioning package. [Install the ADK and select **Configuration Designer**.](https://developer.microsoft.com/windows/hardware/windows-assessment-deployment-kit)
|
|
||||||
|
|
||||||
1. Open Windows ICD (by default, %windir%\Program Files (x86)\Windows Kits\10\Assessment and Deployment Kit\Imaging and Configuration Designer\x86\ICD.exe).
|
|
||||||
|
|
||||||
2. Click **Advanced provisioning**.
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
3. Name your project and click **Next**.
|
|
||||||
|
|
||||||
3. Select **All Windows desktop editions**, click **Next**, and then click **Finish**.
|
|
||||||
|
|
||||||
|
|
||||||
### Add a desktop app to your package
|
|
||||||
|
|
||||||
1. In the **Available customizations** pane, go to **Runtime settings** > **ProvisioningCommands** > **DeviceContext** > **CommandFiles**.
|
|
||||||
|
|
||||||
2. Add all the files required for the app install, including the data files and the installer.
|
|
||||||
|
|
||||||
3. Go to **Runtime settings** > **ProvisioningCommands** > **DeviceContext** > **CommandLine** and specify the command line that needs to be executed to install the app. This is a single command line (such as a script, executable, or msi) that triggers a silent install of your CommandFiles. Note that the install must execute silently (without displaying any UI). For MSI installers use, the `msiexec /quiet` option.
|
|
||||||
|
|
||||||
> [!NOTE]
|
|
||||||
> If you are installing more than one app, then use `CommandLine` to invoke the script or batch file that orchestrates installation of the files. For more information, see [Use a script to install a desktop app in provisioning packages](provisioning-script-to-install-app.md).
|
|
||||||
|
|
||||||
|
|
||||||
### Add a universal app to your package
|
|
||||||
|
|
||||||
Universal apps that you can distribute in the provisioning package can be line-of-business (LOB) apps developed by your organization, Windows Store for Business apps that you acquire with [offline licensing](../manage/acquire-apps-windows-store-for-business.md), or third-party apps. This procedure will assume you are distributing apps from the Windows Store for Business. For other apps, obtain the necessary information (such as the package family name) from the app developer.
|
|
||||||
|
|
||||||
1. In the **Available customizations** pane, go to **Runtime settings** > **UniversalAppInstall**.
|
|
||||||
|
|
||||||
2. For **DeviceContextApp**, specify the **PackageFamilyName** for the app. In Windows Store for Business, the package family name is listed in the **Package details** section of the download page.
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
3. For **ApplicationFile**, click **Browse** to find and select the target app (either an \*.appx or \*.appxbundle).
|
|
||||||
|
|
||||||
4. For **DependencyAppxFiles**, click **Browse** to find and add any dependencies for the app. In Windows Store for Business, any dependencies for the app are listed in the **Required frameworks** section of the download page.
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
5. For **DeviceContextAppLicense**, enter the **LicenseProductID**.
|
|
||||||
|
|
||||||
- In Windows Store for Business, generate the unencoded license for the app on the app's download page, and change the extension of the license file from **.xml** to **.ms-windows-store-license**.
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
- Open the license file and search for **LicenseID=** to get the GUID, enter the GUID in the **LicenseProductID** field and click **Add**.
|
|
||||||
|
|
||||||
6. In the **Available customizations** pane, click the **LicenseProductId** that you just added.
|
|
||||||
|
|
||||||
7. For **LicenseInstall**, click **Browse**, navigate to the license file that you renamed *<file name>*.**ms-windows-store-license**, and select the license file.
|
|
||||||
|
|
||||||
[Learn more about distributing offline apps from the Windows Store for Business.](../manage/distribute-offline-apps.md)
|
|
||||||
|
|
||||||
> [!NOTE]
|
|
||||||
> Removing a provisioning package will not remove any apps installed by device context in that provisioning package.
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
### Add a certificate to your package
|
|
||||||
|
|
||||||
1. In the **Available customizations** pane, go to **Runtime settings** > **Certificates** > **ClientCertificates**.
|
|
||||||
|
|
||||||
2. Enter a **CertificateName** and then click **Add**.
|
|
||||||
|
|
||||||
2. Enter the **CertificatePassword**.
|
|
||||||
|
|
||||||
3. For **CertificatePath**, browse and select the certificate to be used.
|
|
||||||
|
|
||||||
4. Set **ExportCertificate** to **False**.
|
|
||||||
|
|
||||||
5. For **KeyLocation**, select **Software only**.
|
|
||||||
|
|
||||||
|
|
||||||
### Add other settings to your package
|
|
||||||
|
|
||||||
For details about the settings you can customize in provisioning packages, see [Windows Provisioning settings reference]( https://go.microsoft.com/fwlink/p/?LinkId=619012).
|
|
||||||
|
|
||||||
### Build your package
|
|
||||||
|
|
||||||
1. When you are done configuring the provisioning package, on the **File** menu, click **Save**.
|
|
||||||
|
|
||||||
2. Read the warning that project files may contain sensitive information, and click **OK**.
|
|
||||||
> **Important** When you build a provisioning package, you may include sensitive information in the project files and in the provisioning package (.ppkg) file. Although you have the option to encrypt the .ppkg file, project files are not encrypted. You should store the project files in a secure location and delete the project files when they are no longer needed.
|
|
||||||
|
|
||||||
3. On the **Export** menu, click **Provisioning package**.
|
|
||||||
|
|
||||||
1. Change **Owner** to **IT Admin**, which will set the precedence of this provisioning package higher than provisioning packages applied to this device from other sources, and then select **Next.**
|
|
||||||
|
|
||||||
10. Set a value for **Package Version**.
|
|
||||||
|
|
||||||
> [!TIP]
|
|
||||||
> You can make changes to existing packages and change the version number to update previously applied packages.
|
|
||||||
|
|
||||||
11. Optional. In the **Provisioning package security** window, you can choose to encrypt the package and enable package signing.
|
|
||||||
|
|
||||||
- **Enable package encryption** - If you select this option, an auto-generated password will be shown on the screen.
|
|
||||||
|
|
||||||
- **Enable package signing** - If you select this option, you must select a valid certificate to use for signing the package. You can specify the certificate by clicking **Select...** and choosing the certificate you want to use to sign the package.
|
|
||||||
|
|
||||||
**Important**
|
|
||||||
We recommend that you include a trusted provisioning certificate in your provisioning package. When the package is applied to a device, the certificate is added to the system store and any package signed with that certificate thereafter can be applied silently.
|
|
||||||
|
|
||||||
12. Click **Next** to specify the output location where you want the provisioning package to go once it's built. By default, Windows ICD uses the project folder as the output location.<p>
|
|
||||||
Optionally, you can click **Browse** to change the default output location.
|
|
||||||
|
|
||||||
13. Click **Next**.
|
|
||||||
|
|
||||||
14. Click **Build** to start building the package. The project information is displayed in the build page and the progress bar indicates the build status.<p>
|
|
||||||
If you need to cancel the build, click **Cancel**. This cancels the current build process, closes the wizard, and takes you back to the **Customizations Page**.
|
|
||||||
|
|
||||||
15. If your build fails, an error message will show up that includes a link to the project folder. You can scan the logs to determine what caused the error. Once you fix the issue, try building the package again.<p>
|
|
||||||
If your build is successful, the name of the provisioning package, output directory, and project directory will be shown.
|
|
||||||
|
|
||||||
- If you choose, you can build the provisioning package again and pick a different path for the output package. To do this, click **Back** to change the output package name and path, and then click **Next** to start another build.
|
|
||||||
|
|
||||||
- If you are done, click **Finish** to close the wizard and go back to the **Customizations Page**.
|
|
||||||
|
|
||||||
16. Select the **output location** link to go to the location of the package. You can provide that .ppkg to others through any of the following methods:
|
|
||||||
|
|
||||||
- Shared network folder
|
|
||||||
|
|
||||||
- SharePoint site
|
|
||||||
|
|
||||||
- Removable media (USB/SD)
|
|
||||||
|
|
||||||
- Email
|
|
||||||
|
|
||||||
- USB tether (mobile only)
|
|
||||||
|
|
||||||
- NFC (mobile only)
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
**Next step**: [How to apply a provisioning package](provisioning-apply-package.md)
|
|
||||||
|
|
||||||
## Learn more
|
|
||||||
|
|
||||||
- Watch the video: [Provisioning Windows 10 Devices with New Tools](https://go.microsoft.com/fwlink/p/?LinkId=615921)
|
|
||||||
|
|
||||||
- Watch the video: [Windows 10 for Mobile Devices: Provisioning Is Not Imaging](https://go.microsoft.com/fwlink/p/?LinkId=615922)
|
|
||||||
|
|
||||||
|
|
||||||
## Related topics
|
|
||||||
|
|
||||||
- [Provisioning packages for Windows 10](provisioning-packages.md)
|
|
||||||
- [How provisioning works in Windows 10](provisioning-how-it-works.md)
|
|
||||||
- [Install Windows Imaging and Configuration Designer](provisioning-install-icd.md)
|
|
||||||
- [Create a provisioning package](provisioning-create-package.md)
|
|
||||||
- [Apply a provisioning package](provisioning-apply-package.md)
|
|
||||||
- [Settings changed when you uninstall a provisioning package](provisioning-uninstall-package.md)
|
|
||||||
- [Provision PCs with common settings for initial deployment (simple provisioning)](provision-pcs-for-initial-deployment.md)
|
|
||||||
- [Use a script to install a desktop app in provisioning packages](provisioning-script-to-install-app.md)
|
|
||||||
- [NFC-based device provisioning](provisioning-nfc.md)
|
|
||||||
- [Windows ICD command-line interface (reference)](provisioning-command-line.md)
|
|
||||||
- [Create a provisioning package with multivariant settings](provisioning-multivariant.md)
|
|
||||||
|
|
||||||
|
|
||||||
@ -1,68 +0,0 @@
|
|||||||
---
|
|
||||||
title: Windows ICD command-line interface (Windows 10)
|
|
||||||
description:
|
|
||||||
ms.prod: w10
|
|
||||||
ms.mktglfcycl: deploy
|
|
||||||
ms.sitesec: library
|
|
||||||
author: jdeckerMS
|
|
||||||
localizationpriority: high
|
|
||||||
---
|
|
||||||
|
|
||||||
# Windows ICD command-line interface (reference)
|
|
||||||
|
|
||||||
|
|
||||||
**Applies to**
|
|
||||||
|
|
||||||
- Windows 10
|
|
||||||
- Windows 10 Mobile
|
|
||||||
|
|
||||||
You can use the Windows Imaging and Configuration Designer (ICD) command-line interface (CLI) to automate the building of provisioning packages and Windows 10 for desktop editions (Home, Pro, Enterprise, and Education) and Windows 10 Mobile or Windows 10 IoT Core (IoT Core) images.
|
|
||||||
|
|
||||||
- IT pros can use the Windows ICD CLI to require less re-tooling of existing processes. You must run the Windows ICD CLI from a command window with administrator privileges.
|
|
||||||
|
|
||||||
- You must use the Windows ICD CLI and edit the customizations.xml sources to create an image and/or provisioning package with multivariant support. You need the customizations.xml file as one of the inputs to the Windows ICD CLI to build a provisioning package. For more information, see [Create a provisioning package with multivariant settings](provisioning-multivariant.md).
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
## Syntax
|
|
||||||
|
|
||||||
```
|
|
||||||
icd.exe /Build-ProvisioningPackage /CustomizationXML:<path_to_xml> /PackagePath:<path_to_ppkg>
|
|
||||||
[/StoreFile:<path_to_storefile>] [/MSPackageRoot:<path_to_mspackage_directory>] [/OEMInputXML:<path_to_xml>]
|
|
||||||
[/ProductName:<product_name>] [/Variables:<name>:<value>] [[+|-]Encrypted] [[+|-]Overwrite] [/?]
|
|
||||||
```
|
|
||||||
|
|
||||||
## Switches and arguments
|
|
||||||
|
|
||||||
| Switch | Required? | Arguments |
|
|
||||||
| --- | --- | --- |
|
|
||||||
| /CustomizationXML | No | Specifies the path to a Windows provisioning XML file that contains the customization assets and settings. For more information, see Windows provisioning answer file. |
|
|
||||||
| /PackagePath | Yes | Specifies the path and the package name where the built provisioning package will be saved. |
|
|
||||||
| /StoreFile | No</br></br></br>See Important note. | For partners using a settings store other than the default store(s) used by Windows ICD, use this parameter to specify the path to one or more comma-separated Windows settings store file. By default, if you don't specify a settings store file, the settings store that's common to all Windows editions will be loaded by Windows ICD.</br></br></br>**Important** If you use this parameter, you must not use /MSPackageRoot or /OEMInputXML. |
|
|
||||||
| /Variables | No | Specifies a semicolon separated <name> and <value> macro pair. The format for the argument must be <name>=<value>. |
|
|
||||||
| Encrypted | No | Denotes whether the provisioning package should be built with encryption. Windows ICD auto-generates the decryption password and includes this information in the output.</br></br></br>Precede with + for encryption or - for no encryption. The default is no encryption. |
|
|
||||||
| Overwrite | No | Denotes whether to overwrite an existing provisioning package.</br></br></br>Precede with + to overwrite an existing package or - if you don't want to overwrite an existing package. The default is false (don't overwrite). |
|
|
||||||
| /? | No | Lists the switches and their descriptions for the command-line tool or for certain commands. |
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
## Related topics
|
|
||||||
|
|
||||||
- [Provisioning packages for Windows 10](provisioning-packages.md)
|
|
||||||
- [How provisioning works in Windows 10](provisioning-how-it-works.md)
|
|
||||||
- [Install Windows Imaging and Configuration Designer](provisioning-install-icd.md)
|
|
||||||
- [Create a provisioning package](provisioning-create-package.md)
|
|
||||||
- [Apply a provisioning package](provisioning-apply-package.md)
|
|
||||||
- [Settings changed when you uninstall a provisioning package](provisioning-uninstall-package.md)
|
|
||||||
- [Provision PCs with common settings for initial deployment (simple provisioning)](provision-pcs-for-initial-deployment.md)
|
|
||||||
- [Provision PCs with apps and certificates for initial deployments (advanced provisioning)](provision-pcs-with-apps-and-certificates.md)
|
|
||||||
- [Use a script to install a desktop app in provisioning packages](provisioning-script-to-install-app.md)
|
|
||||||
- [NFC-based device provisioning](provisioning-nfc.md)
|
|
||||||
- [Create a provisioning package with multivariant settings](provisioning-multivariant.md)
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
@ -1,322 +0,0 @@
|
|||||||
---
|
|
||||||
title: Create a provisioning package with multivariant settings (Windows 10)
|
|
||||||
description: Create a provisioning package with multivariant settings to customize the provisioned settings.
|
|
||||||
ms.prod: w10
|
|
||||||
ms.mktglfcycl: deploy
|
|
||||||
ms.sitesec: library
|
|
||||||
author: jdeckerMS
|
|
||||||
localizationpriority: high
|
|
||||||
---
|
|
||||||
|
|
||||||
# Create a provisioning package with multivariant settings
|
|
||||||
|
|
||||||
|
|
||||||
**Applies to**
|
|
||||||
|
|
||||||
- Windows 10
|
|
||||||
- Windows 10 Mobile
|
|
||||||
|
|
||||||
Multivariant provisioning packages enable you to create a single provisioning package that can work for multiple locales.
|
|
||||||
|
|
||||||
To provision multivariant settings, you must create a provisioning package with defined **Conditions** and **Settings** that are tied to these conditions. When you install this package on a Windows 10 device, the provisioning engine applies the matching condition settings at every event and triggers provisioning.
|
|
||||||
|
|
||||||
The following events trigger provisioning on Windows 10 devices:
|
|
||||||
|
|
||||||
| Event | Windows 10 Mobile | Windows 10 for desktop editions (Home, Pro, Enterprise, and Education) |
|
|
||||||
| --- | --- | --- |
|
|
||||||
| System boot | Supported | Supported |
|
|
||||||
| Operating system update | Supported | Planned |
|
|
||||||
| Package installation during device first run experience | Supported | Supported |
|
|
||||||
| Detection of SIM presence or update | Supported | Not supported |
|
|
||||||
| Package installation at runtime | Supported | Supported |
|
|
||||||
| Roaming detected | Supported | Not supported |
|
|
||||||
|
|
||||||
## Target, TargetState, Condition, and priorities
|
|
||||||
|
|
||||||
Targets describe keying for a variant and must be described or pre-declared before being referenced by the variant.
|
|
||||||
|
|
||||||
- You can define multiple **Target** child elements for each **Id** that you need for the customization setting.
|
|
||||||
|
|
||||||
- Within a **Target** you can define multiple **TargetState** elements.
|
|
||||||
|
|
||||||
- Within a **TargetState** element you can create multiple **Condition** elements.
|
|
||||||
|
|
||||||
- A **Condition** element defines the matching type between the condition and the specified value.
|
|
||||||
|
|
||||||
The following table shows the conditions supported in Windows 10 provisioning:
|
|
||||||
|
|
||||||
>[!NOTE]
|
|
||||||
>You can use any of these supported conditions when defining your **TargetState**.
|
|
||||||
|
|
||||||
| Condition Name | Condition priority | Windows 10 Mobile | Windows 10 for desktop editions | Value type | Value description |
|
|
||||||
| --- | --- | --- | --- | --- | --- |
|
|
||||||
| MNC | P0 | Supported | N/A | Digit string | Use to target settings based on the Mobile Network Code (MNC) value. |
|
|
||||||
| MCC | P0 | Supported | N/A | Digit string | Use to target settings based on the Mobile Country Code (MCC) value. |
|
|
||||||
| SPN | P0 | Supported | N/A | String | Use to target settings based on the Service Provider Name (SPN) value. |
|
|
||||||
| PNN | P0 | Supported | N/A | String | Use to target settings based on public land mobile network (PLMN) Network Name value. |
|
|
||||||
| GID1 | P0 | Supported | N/A | Digit string | Use to target settings based on the Group Identifier (level 1) value. |
|
|
||||||
| ICCID | P0 | Supported | N/A | Digit string | Use to target settings based on the Integrated Circuit Card Identifier (ICCID) value. |
|
|
||||||
| Roaming | P0 | Supported | N/A | Boolean | Use to specify roaming. Set the value to **1** (roaming) or **0** (non-roaming). |
|
|
||||||
| UICC | P0 | Supported | N/A | Enumeration | Use to specify the UICC state. Set the value to one of the following:</br></br></br>- 0 - Empty</br>- 1 - Ready</br>- 2 - Locked |
|
|
||||||
| UICCSLOT | P0 | Supported | N/A | Digit string | Use to specify the UICC slot. Set the value one of the following:</br></br></br>- 0 - Slot 0</br>- 1 - Slot 1 |
|
|
||||||
| ProcessorType | P1 | Supported | Supported | String | Use to target settings based on the processor type. |
|
|
||||||
| ProcessorName | P1 | Supported | Supported | String | Use to target settings based on the processor name. |
|
|
||||||
| AoAc | P1 | Supported | Supported | Boolean | Set the value to 0 or 1. |
|
|
||||||
| PowerPlatformRole | P1 | Supported | Supported | Enumeration | Indicates the preferred power management profile. Set the value based on the POWER_PLATFORM_ROLE enumeration. |
|
|
||||||
| Architecture | P1 | Supported | Supported | String | Matches the PROCESSOR_ARCHITECTURE environment variable. |
|
|
||||||
| Server | P1 | Supported | Supported | Boolean | Set the value to 0 or 1. |
|
|
||||||
| Region | P1 | Supported | Supported | Enumeration | Use to target settings based on country/region. |
|
|
||||||
| Lang | P1 | Supported | Supported | Enumeration | Use to target settings based on language code. |
|
|
||||||
| ROMLANG | P1 | Supported | N/A | Digit string | Use to specify the PhoneROMLanguage that's set for DeviceTargeting. This condition is used primarily to detect variants for China. For example, you can use this condition and set the value to "0804". |
|
|
||||||
|
|
||||||
The matching types supported in Windows 10 are:
|
|
||||||
|
|
||||||
| Matching type | Syntax | Example |
|
|
||||||
| --- | --- | --- |
|
|
||||||
| Straight match | Matching type is specified as-is | <Condition Name="ProcessorName" Value="Barton" /> |
|
|
||||||
| Regex match | Matching type is prefixed by "Pattern:" | <Condition Name="ProcessorName" Value="Pattern:.*Celeron.*" /> |
|
|
||||||
| Numeric range match | Matching type is prefixed by "!Range:" | <Condition Name="MNC" Value="!Range:400, 550" /> |
|
|
||||||
|
|
||||||
|
|
||||||
- When all **Condition** elements are TRUE, **TargetState** is TRUE (**AND** logic).
|
|
||||||
|
|
||||||
- If any of the **TargetState** elements is TRUE, **Target** is TRUE (**OR** logic), and **Id** can be used for the setting customization.
|
|
||||||
|
|
||||||
|
|
||||||
You can define more than one **TargetState** within a provisioning package to apply variant settings that match device conditions. When the provisioning engine evalues each **TargetState**, more than one **TargetState** may fit current device conditions. To determine the order in which the variant settings are applied, the system assigns a priority to every **TargetState**.
|
|
||||||
|
|
||||||
A variant setting that matches a **TargetState** with a lower priority is applied before the variant that matches a **TargetState** with a higher priority. Variant settings that match more than one **TargetState** with equal priority are applied according to the order that each **TargetState** is defined in the provisioning package.
|
|
||||||
|
|
||||||
The **TargetState** priority is assigned based on the conditions priority and the priority evaluation rules are as followed:
|
|
||||||
|
|
||||||
1. **TargetState** with P0 conditions is higher than **TargetState** without P0 conditions.
|
|
||||||
|
|
||||||
|
|
||||||
2. **TargetState** with P1 conditions is higher than **TargetState** without P0 and P1 conditions.
|
|
||||||
|
|
||||||
|
|
||||||
3. If N₁>N₂>0, the **TargetState** priority with N₁ P0 conditions is higher than the **TargetState** with N₂ P1 conditions.
|
|
||||||
|
|
||||||
|
|
||||||
4. For **TargetState** without P0 conditions, if N₁>N₂>0 **TargetState** with N₁ P1 conditions is higher than the **TargetState** with N₂ P1 conditions.
|
|
||||||
|
|
||||||
|
|
||||||
5. For **TargetState** without P0 and P1 conditions, if N₁>N₂>0 **TargetState** priority with N₁ P2 conditions is higher than the **TargetState** with N₂ P2 conditions.
|
|
||||||
|
|
||||||
|
|
||||||
6. For rules 3, 4, and 5, if N₁=N₂, **TargetState** priorities are considered equal.
|
|
||||||
|
|
||||||
|
|
||||||
## Create a provisioning package with multivariant settings
|
|
||||||
|
|
||||||
Follow these steps to create a provisioning package with multivariant capabilities.
|
|
||||||
|
|
||||||
|
|
||||||
1. Build a provisioning package and configure the customizations you need to apply during certain conditions. For more information, see [Create a provisioning package](provisioning-create-package.md).
|
|
||||||
|
|
||||||
|
|
||||||
2. After you've [configured the settings](provisioning-create-package.md#configure-settings), save the project.
|
|
||||||
|
|
||||||
|
|
||||||
3. Open the project folder and copy the customizations.xml file.
|
|
||||||
|
|
||||||
4. Use an XML or text editor to open the customizations.xml file.
|
|
||||||
|
|
||||||
The customizations.xml file holds the package metadata (including the package owner and rank) and the settings that you configured when you created your provisioning package. The Customizations node contains a Common section, which contains the customization settings.
|
|
||||||
|
|
||||||
The following example shows the contents of a sample customizations.xml file.
|
|
||||||
|
|
||||||
```XML
|
|
||||||
<?xml version="1.0" encoding="utf-8"?>
|
|
||||||
<WindowsCustomizatons>
|
|
||||||
<PackageConfig xmlns="urn:schemas-Microsoft-com:Windows-ICD-Package-Config.v1.0">
|
|
||||||
<ID>{6aaa4dfa-00d7-4aaa-8adf-73c6a7e2501e}</ID>
|
|
||||||
<Name>My Provisioning Package</Name>
|
|
||||||
<Version>1.0</Version>
|
|
||||||
<OwnerType>OEM</OwnerType>
|
|
||||||
<Rank>50</Rank>
|
|
||||||
</PackageConfig>
|
|
||||||
<Settings xmlns="urn:schemas-microsoft-com:windows-provisioning">
|
|
||||||
<Customizations>
|
|
||||||
<Common>
|
|
||||||
<Policies>
|
|
||||||
<AllowBrowser>0</AllowBrowser>
|
|
||||||
<AllowCamera>0</AllowCamera>
|
|
||||||
<AllowBluetooth>0</AllowBluetooth>
|
|
||||||
</Policies>
|
|
||||||
<HotSpot>
|
|
||||||
<Enabled>0</Enabled>
|
|
||||||
</HotSpot>
|
|
||||||
</Common>
|
|
||||||
</Customizations>
|
|
||||||
</Settings>
|
|
||||||
</WindowsCustomizatons>
|
|
||||||
```
|
|
||||||
|
|
||||||
4. Edit the customizations.xml file and create a **Targets** section to describe the conditions that will handle your multivariant settings.
|
|
||||||
|
|
||||||
The following example shows the customizations.xml, which has been modified to include several conditions including **ProcessorName**, **ProcessorType**, **MCC**, and **MNC**.
|
|
||||||
|
|
||||||
```XML
|
|
||||||
<?xml version="1.0" encoding="utf-8"?>
|
|
||||||
<WindowsCustomizatons>
|
|
||||||
<PackageConfig xmlns="urn:schemas-Microsoft-com:Windows-ICD-Package-Config.v1.0">
|
|
||||||
<ID>{6aaa4dfa-00d7-4aaa-8adf-73c6a7e2501e}</ID>
|
|
||||||
<Name>My Provisioning Package</Name>
|
|
||||||
<Version>1.0</Version>
|
|
||||||
<OwnerType>OEM</OwnerType>
|
|
||||||
<Rank>50</Rank>
|
|
||||||
</PackageConfig>
|
|
||||||
<Settings xmlns="urn:schemas-microsoft-com:windows-provisioning">
|
|
||||||
<Customizations>
|
|
||||||
<Common>
|
|
||||||
<Policies>
|
|
||||||
<AllowBrowser>0</AllowBrowser>
|
|
||||||
<AllowCamera>0</AllowCamera>
|
|
||||||
<AllowBluetooth>0</AllowBluetooth>
|
|
||||||
</Policies>
|
|
||||||
<HotSpot>
|
|
||||||
<Enabled>0</Enabled>
|
|
||||||
</HotSpot>
|
|
||||||
</Common>
|
|
||||||
<Targets>
|
|
||||||
<Target Id="Unique target identifier for desktop">
|
|
||||||
<TargetState>
|
|
||||||
<Condition Name="ProcessorName" Value="Pattern:.*Celeron.*" />
|
|
||||||
<Condition Name="ProcessorType" Value="Pattern:.*(I|i)ntel.*" />
|
|
||||||
</TargetState>
|
|
||||||
<TargetState>
|
|
||||||
<Condition Name="ProcessorName" Value="Barton" />
|
|
||||||
<Condition Name="ProcessorType" Value="Athlon MP" />
|
|
||||||
</TargetState>
|
|
||||||
</Target>
|
|
||||||
<Target Id="Mobile target">
|
|
||||||
<TargetState>
|
|
||||||
<Condition Name="MCC" Value="Range:310, 320" />
|
|
||||||
<Condition Name="MNC" Value="!Range:400, 550" />
|
|
||||||
</TargetState>
|
|
||||||
</Target>
|
|
||||||
</Targets>
|
|
||||||
</Customizations>
|
|
||||||
</Settings>
|
|
||||||
</WindowsCustomizatons>
|
|
||||||
```
|
|
||||||
|
|
||||||
5. In the customizations.xml file, create a **Variant** section for the settings you need to customize. To do this:
|
|
||||||
|
|
||||||
a. Define a child **TargetRefs** element.
|
|
||||||
|
|
||||||
b. Within the **TargetRefs** element, define a **TargetRef** element. You can define multiple **TargetRef** elements for each **Id** that you need to apply to customized settings.
|
|
||||||
|
|
||||||
c. Move compliant settings from the **Common** section to the **Variant** section.
|
|
||||||
|
|
||||||
If any of the TargetRef elements matches the Target, all settings in the Variant are applied (OR logic).
|
|
||||||
|
|
||||||
>[!NOTE]
|
|
||||||
>You can define multiple Variant sections. Settings that reside in the **Common** section are applied unconditionally on every triggering event.
|
|
||||||
|
|
||||||
The following example shows the customizations.xml updated to include a **Variant** section and the moved settings that will be applied if the conditions for the variant are met.
|
|
||||||
|
|
||||||
```XML
|
|
||||||
<?xml version="1.0" encoding="utf-8"?>
|
|
||||||
<WindowsCustomizatons>
|
|
||||||
<PackageConfig xmlns="urn:schemas-Microsoft-com:Windows-ICD-Package-Config.v1.0">
|
|
||||||
<ID>{6aaa4dfa-00d7-4aaa-8adf-73c6a7e2501e}</ID>
|
|
||||||
<Name>My Provisioning Package</Name>
|
|
||||||
<Version>1.0</Version>
|
|
||||||
<OwnerType>OEM</OwnerType>
|
|
||||||
<Rank>50</Rank>
|
|
||||||
</PackageConfig>
|
|
||||||
<Settings xmlns="urn:schemas-microsoft-com:windows-provisioning">
|
|
||||||
<Customizations>
|
|
||||||
<Common>
|
|
||||||
</Common>
|
|
||||||
<Targets>
|
|
||||||
<Target Id="Unique target identifier for desktop">
|
|
||||||
<TargetState>
|
|
||||||
<Condition Name="ProcessorName" Value="Pattern:.*Celeron.*" />
|
|
||||||
<Condition Name="ProcessorType" Value="Pattern:.*(I|i)ntel.*" />
|
|
||||||
</TargetState>
|
|
||||||
<TargetState>
|
|
||||||
<Condition Name="ProcessorName" Value="Barton" />
|
|
||||||
<Condition Name="ProcessorType" Value="Athlon MP" />
|
|
||||||
</TargetState>
|
|
||||||
</Target>
|
|
||||||
<Target Id="Mobile target">
|
|
||||||
<TargetState>
|
|
||||||
<Condition Name="MCC" Value="Range:310, 320" />
|
|
||||||
<Condition Name="MNC" Value="!Range:400, 550" />
|
|
||||||
</TargetState>
|
|
||||||
</Target>
|
|
||||||
</Targets>
|
|
||||||
<Variant>
|
|
||||||
<TargetRefs>
|
|
||||||
<TargetRef Id="Unique target identifier for desktop" />
|
|
||||||
<TargetRef Id="Mobile target" />
|
|
||||||
</TargetRefs>
|
|
||||||
<Settings>
|
|
||||||
<Policies>
|
|
||||||
<AllowBrowser>1</AllowBrowser>
|
|
||||||
<AllowCamera>1</AllowCamera>
|
|
||||||
<AllowBluetooth>1</AllowBluetooth>
|
|
||||||
</Policies>
|
|
||||||
<HotSpot>
|
|
||||||
<Enabled>1</Enabled>
|
|
||||||
</HotSpot>
|
|
||||||
</Settings>
|
|
||||||
</Variant>
|
|
||||||
</Customizations>
|
|
||||||
</Settings>
|
|
||||||
</WindowsCustomizatons>
|
|
||||||
```
|
|
||||||
|
|
||||||
6. Save the updated customizations.xml file and note the path to this updated file. You will need the path as one of the values for the next step.
|
|
||||||
|
|
||||||
|
|
||||||
7. Use the [Windows ICD command-line interface](provisioning-command-line.md) to create a provisioning package using the updated customizations.xml.
|
|
||||||
|
|
||||||
For example:
|
|
||||||
|
|
||||||
```
|
|
||||||
icd.exe /Build-ProvisioningPackage /CustomizationXML:"C:\CustomProject\customizations.xml" /PackagePath:"C:\CustomProject\output.ppkg" /StoreFile:C:\Program Files (x86)\Windows Kits\10\Assessment and Deployment Kit\Imaging and Configuration Designer\x86\Microsoft-Common-Provisioning.dat"
|
|
||||||
```
|
|
||||||
|
|
||||||
|
|
||||||
In this example, the **StoreFile** corresponds to the location of the settings store that will be used to create the package for the required Windows edition.
|
|
||||||
|
|
||||||
>[!NOTE]
|
|
||||||
>The provisioning package created during this step will contain the multivariant settings. You can use this package either as a standalone package that you can apply to a Windows device or use it as the base when starting another project.
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
## Related topics
|
|
||||||
|
|
||||||
- [Provisioning packages for Windows 10](provisioning-packages.md)
|
|
||||||
- [How provisioning works in Windows 10](provisioning-how-it-works.md)
|
|
||||||
- [Install Windows Imaging and Configuration Designer](provisioning-install-icd.md)
|
|
||||||
- [Create a provisioning package](provisioning-create-package.md)
|
|
||||||
- [Apply a provisioning package](provisioning-apply-package.md)
|
|
||||||
- [Settings changed when you uninstall a provisioning package](provisioning-uninstall-package.md)
|
|
||||||
- [Provision PCs with common settings for initial deployment (simple provisioning)](provision-pcs-for-initial-deployment.md)
|
|
||||||
- [Provision PCs with apps and certificates for initial deployments (advanced provisioning)](provision-pcs-with-apps-and-certificates.md)
|
|
||||||
- [Use a script to install a desktop app in provisioning packages](provisioning-script-to-install-app.md)
|
|
||||||
- [NFC-based device provisioning](provisioning-nfc.md)
|
|
||||||
- [Windows ICD command-line interface (reference)](provisioning-command-line.md)
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
@ -1,153 +0,0 @@
|
|||||||
---
|
|
||||||
title: NFC-based device provisioning (Windows 10)
|
|
||||||
description:
|
|
||||||
ms.prod: w10
|
|
||||||
ms.mktglfcycl: deploy
|
|
||||||
ms.sitesec: library
|
|
||||||
author: jdeckerMS
|
|
||||||
localizationpriority: high
|
|
||||||
---
|
|
||||||
|
|
||||||
# NFC-based device provisioning
|
|
||||||
|
|
||||||
|
|
||||||
**Applies to**
|
|
||||||
|
|
||||||
- Windows 10 Mobile
|
|
||||||
|
|
||||||
Near field communication (NFC) enables Windows 10 Mobile Enterprise and Windows 10 Mobile devices to communicate with an NFC tag or another NFC-enabled transmitting device. Enterprises that do bulk provisioning can use NFC-based device provisioning to provide a provisioning package to the device that's being provisioned. NFC provisioning is simple and convenient and it can easily store an entire provisioning package.
|
|
||||||
|
|
||||||
The NFC provisioning option enables the administrator to provide a provisioning package during initial device setup or the out-of-box experience (OOBE) phase. Administrators can use the NFC provisioning option to transfer provisioning information to persistent storage by tapping an unprovisioned mobile device to an NFC tag or NFC-enabled device. To use NFC for pre-provisioning a device, you must either prepare your own NFC tags by storing your provisioning package to a tag as described in this section, or build the infrastructure needed to transmit a provisioning package between an NFC-enabled device and a mobile device during OOBE.
|
|
||||||
|
|
||||||
## Provisioning OOBE UI
|
|
||||||
|
|
||||||
All Windows 10 Mobile Enterprise and Windows 10 Mobile images have the NFC provisioning capability incorporated into the operating system. On devices that support NFC and are running Windows 10 Mobile Enterprise or Windows 10 Mobile, NFC-based device provisioning provides an additional mechanism to provision the device during OOBE.
|
|
||||||
|
|
||||||
On all Windows devices, device provisioning during OOBE can be triggered by 5 fast taps on the Windows hardware key, which shows the **Provision this device** screen. In the **Provision this device** screen, select **NFC** for NFC-based provisioning.
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
If there is an error during NFC provisioning, the device will show a message if any of the following errors occur:
|
|
||||||
|
|
||||||
- **NFC initialization error** - This can be caused by any error that occurs before data transfer has started. For example, if the NFC driver isn't enabled or there's an error communicating with the proximity API.
|
|
||||||
- **Interrupted download or incomplete package transfer** - This error can happen if the peer device is out of range or the transfer is aborted. This error can be caused whenever the device being provisioned fails to receive the provisioning package in time.
|
|
||||||
- **Incorrect package format** - This error can be caused by any protocol error that the operating system encounters during the data transfer between the devices.
|
|
||||||
- **NFC is disabled by policy** - Enterprises can use policies to disallow any NFC usage on the managed device. In this case, NFC functionality is not enabled.
|
|
||||||
|
|
||||||
## NFC tag
|
|
||||||
|
|
||||||
You can use an NFC tag for minimal provisioning and use an NFC-enabled device tag for larger provisioning packages.
|
|
||||||
|
|
||||||
The protocol used for NFC-based device provisioning is similar to the one used for NFC provisioning on Windows Embedded 8.1 Handheld, which supported both single-chunk and multi-chunk transfer when the total transfer didn't fit in one NDEP message size. In Windows 10, the provisioning stack contains the following changes:
|
|
||||||
|
|
||||||
- **Protocol namespace** - The protocol namespace has changed from Windows.WEH.PreStageProv.Chunk to Windows.ProvPlugins.Chunk.
|
|
||||||
- **Tag data type** - The tag data type has changed from UTF-8 into binary raw data.
|
|
||||||
|
|
||||||
|
|
||||||
>[!NOTE]
|
|
||||||
>The NFC tag doesn't go in the secondary device. You can transfer the NFC tag by using a provisioning package from device-to-device using the NFC radio or by re-reading the provisioning package from an NFC tag.
|
|
||||||
|
|
||||||
### NFC tag components
|
|
||||||
|
|
||||||
NFC tags are suitable for very light applications where minimal provisioning is required. The size of NFC tags that contain provisioning packages is typically 4 KB to 10 KB.
|
|
||||||
|
|
||||||
To write to an NFC tag, you will need to use an NFC Writer tool, or you can use the [ProximityDevice class API](https://msdn.microsoft.com/library/windows/apps/windows.networking.proximity.proximitydevice.aspx) to write your own custom tool to transfer your provisioning package file to your NFC tag. The tool must publish a binary message (write) a Chunk data type to your NFC tag.
|
|
||||||
|
|
||||||
The following table describes the information that is required when writing to an NFC tag.
|
|
||||||
|
|
||||||
| Required field | Description |
|
|
||||||
| --- | --- |
|
|
||||||
| **Type** | Windows.ProvPlugins.Chunk<br></br>The receiving device uses this information to understand information in the Data field. |
|
|
||||||
| **Data** | Tag data with small header in raw binary format that contains a chunk of the provisioning package to be transferred. |
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
### NFC provisioning helper
|
|
||||||
|
|
||||||
The NFC provisioning helper device must split the provisioning package raw content into multiple parts and publish these in order. Each part should follow the following format:
|
|
||||||
|
|
||||||
<table><tr><td>**Version**</br>(1 byte)</td><td>**Leading**<br>(1 byte)</td><td>**Order**</br>(1 byte)</td><td>**Total**</br>(1 byte)</td><td>**Chunk payload**</br>(N bytes)</td></tr></table>
|
|
||||||
|
|
||||||
For each part:
|
|
||||||
- **Version** should always be 0x00.
|
|
||||||
- **Leading byte** should always be 0xFF.
|
|
||||||
- **Order** represents which message chunk (out of the whole message) the part belongs to. The Order begins with zero (0).
|
|
||||||
- **Total** represents the total number of chunks to be transferred for the whole message.
|
|
||||||
- **Chunk payload** represents each of the split parts.
|
|
||||||
|
|
||||||
The NFC provisioning helper device must publish the record in a type of Windows.ProvPlugins.Chunk.
|
|
||||||
|
|
||||||
**Code example**
|
|
||||||
|
|
||||||
The following example shows how to write to an NFC tag. This example assumes that the tag is already in range of the writing device.
|
|
||||||
|
|
||||||
```
|
|
||||||
private async void WriteProvPkgToTag(IStorageFile provPkgFile)
|
|
||||||
{
|
|
||||||
var buffer = await FileIO.ReadBufferAsync(provPkgFile);
|
|
||||||
if (null == buffer)
|
|
||||||
{
|
|
||||||
return;
|
|
||||||
}
|
|
||||||
|
|
||||||
var proximityDevice = Windows.Networking.Proximity.ProximityDevice.GetDefault();
|
|
||||||
if (null == proximityDevice)
|
|
||||||
{
|
|
||||||
return;
|
|
||||||
}
|
|
||||||
|
|
||||||
var dataWriter = new DataWriter();
|
|
||||||
var header = new NfcProvHeader();
|
|
||||||
|
|
||||||
header.version = NFC_PROV_MESSAGE_CURRENT_VERSION; // Currently the supported version is 0x00.
|
|
||||||
header.leading = NFC_PROV_MESSAGE_LEADING_BYTE; // The leading byte should be always 0xFF.
|
|
||||||
header.index = 0; // Assume we only have 1 chunk.
|
|
||||||
header.total = 1; // Assume we only have 1 chunk.
|
|
||||||
|
|
||||||
// Write the header first and then the raw data of the provisioning package.
|
|
||||||
dataWriter.WriteBytes(GetBytes(header));
|
|
||||||
dataWriter.WriteBuffer(buffer);
|
|
||||||
|
|
||||||
var chunkPubId = proximityDevice.PublishBinaryMessage(
|
|
||||||
"Windows:WriteTag.ProvPlugins.Chunk",
|
|
||||||
dataWriter.DetachBuffer());
|
|
||||||
}
|
|
||||||
```
|
|
||||||
|
|
||||||
|
|
||||||
### NFC-enabled device tag components
|
|
||||||
|
|
||||||
Provisioning from an NFC-enabled source device allows for larger provisioning packages than can be transferred using an NFC tag. When provisioning from an NFC-enabled device, we recommend that the total file size not exceed 120 KB. Be aware that the larger the NFC file is, the longer it will take to transfer the provisioning file. Depending on your NFC hardware, the transfer time for a 120 KB file will vary between 2.5 seconds and 10 seconds.
|
|
||||||
|
|
||||||
To provision from an NFC-enabled source device, use [ProximityDevice class API](https://msdn.microsoft.com/library/windows/apps/windows.networking.proximity.proximitydevice.aspx) to write your own custom tool that transfers your provisioning package in chunks to your target mobile device. The tool must publish binary messages (transmit) a Header message, followed by one or more Chunk messages. The Header specifies the total amount of data that will be transferred to the target device; the Chunks must contain binary raw data formatted provisioning data, as shown in the NFC tag components section.
|
|
||||||
|
|
||||||
For detailed information and code samples on how to implement an NFC-enabled device tag, see **ConvertToNfcMessageAsync** in [this GitHub NfcProvisioner Universal Windows app example](https://github.com/Microsoft/Windows-universal-samples/blob/master/Samples/NfcProvisioner/cs/Scenario1.xaml.cs). The sample app shows you how to host the provisioning package on a master device so that you can transfer it to the receiving device.
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
## Related topics
|
|
||||||
|
|
||||||
- [Provisioning packages for Windows 10](provisioning-packages.md)
|
|
||||||
- [How provisioning works in Windows 10](provisioning-how-it-works.md)
|
|
||||||
- [Install Windows Imaging and Configuration Designer](provisioning-install-icd.md)
|
|
||||||
- [Create a provisioning package](provisioning-create-package.md)
|
|
||||||
- [Apply a provisioning package](provisioning-apply-package.md)
|
|
||||||
- [Settings changed when you uninstall a provisioning package](provisioning-uninstall-package.md)
|
|
||||||
- [Provision PCs with common settings for initial deployment (simple provisioning)](provision-pcs-for-initial-deployment.md)
|
|
||||||
- [Provision PCs with apps and certificates for initial deployments (advanced provisioning)](provision-pcs-with-apps-and-certificates.md)
|
|
||||||
- [Use a script to install a desktop app in provisioning packages](provisioning-script-to-install-app.md)
|
|
||||||
- [Windows ICD command-line interface (reference)](provisioning-command-line.md)
|
|
||||||
- [Create a provisioning package with multivariant settings](provisioning-multivariant.md)
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
@ -1,222 +0,0 @@
|
|||||||
---
|
|
||||||
title: Use a script to install a desktop app in provisioning packages (Windows 10)
|
|
||||||
description: With Windows 10, you can create provisioning packages that let you quickly and efficiently configure a device without having to install a new image.
|
|
||||||
ms.prod: w10
|
|
||||||
ms.mktglfcycl: deploy
|
|
||||||
ms.sitesec: library
|
|
||||||
author: jdeckerMS
|
|
||||||
localizationpriority: high
|
|
||||||
---
|
|
||||||
|
|
||||||
# Use a script to install a desktop app in provisioning packages
|
|
||||||
|
|
||||||
|
|
||||||
**Applies to**
|
|
||||||
|
|
||||||
- Windows 10
|
|
||||||
- Windows 10 Mobile
|
|
||||||
|
|
||||||
This walkthrough describes how to leverage the ability to include scripts in a Windows 10 provisioning package to install Win32 applications. Scripted operations other than installing apps can also be performed, however, some care is needed in order to avoid unintended behavior during script execution (see Remarks below).
|
|
||||||
|
|
||||||
>**Prerequisite**: [Windows Assessment and Deployment Kit (ADK) for Windows 10](https://developer.microsoft.com/windows/hardware/windows-assessment-deployment-kit), version 1511 or higher
|
|
||||||
|
|
||||||
>[!NOTE]
|
|
||||||
>This scenario is only supported for installing applications on Windows 10 for desktop, version 1511 or higher.
|
|
||||||
|
|
||||||
## Assemble the application assets
|
|
||||||
|
|
||||||
1. On the device where you’re authoring the package, place all of your assets in a known location. Each asset must have a unique filename, because all files will be copied to the same temp directory on the device. It’s common for many apps to have an installer called ‘install.exe’ or similar, and there may be name overlap because of that. To fix this, you can use the technique described in the next step to include a complete directory structure that is then expanded into the temp directory on the device. The most common use for this would be to include a subdirectory for each application.
|
|
||||||
|
|
||||||
2. If you need to include a directory structure of files, you will need to cab the assets for easy inclusion in the provisioning packages.
|
|
||||||
|
|
||||||
## Cab the application assets
|
|
||||||
|
|
||||||
1. Create a .DDF file as below, replacing *file1* and *file2* with the files you want to package, and adding the name of file/directory.
|
|
||||||
|
|
||||||
```
|
|
||||||
;*** MSDN Sample Source Code MakeCAB Directive file example
|
|
||||||
|
|
||||||
;
|
|
||||||
|
|
||||||
.OPTION EXPLICIT ; Generate errors on variable typos
|
|
||||||
|
|
||||||
.set DiskDirectoryTemplate=CDROM ; All cabinets go in a single directory
|
|
||||||
|
|
||||||
.Set MaxDiskFileCount=1000; Limit file count per cabinet, so that
|
|
||||||
|
|
||||||
; scanning is not too slow
|
|
||||||
|
|
||||||
.Set FolderSizeThreshold=200000 ; Aim for ~200K per folder
|
|
||||||
|
|
||||||
.Set CompressionType=MSZIP
|
|
||||||
|
|
||||||
;** All files are compressed in cabinet files
|
|
||||||
|
|
||||||
.Set Cabinet=on
|
|
||||||
|
|
||||||
.Set Compress=on
|
|
||||||
|
|
||||||
;-------------------------------------------------------------------
|
|
||||||
|
|
||||||
;** CabinetNameTemplate = name of cab
|
|
||||||
|
|
||||||
;** DiskDirectory1 = output directory where cab will be created
|
|
||||||
|
|
||||||
;-------------------------------------------------------------------
|
|
||||||
|
|
||||||
.Set CabinetNameTemplate=tt.cab
|
|
||||||
|
|
||||||
.Set DiskDirectory1=.
|
|
||||||
|
|
||||||
;-------------------------------------------------------------------
|
|
||||||
|
|
||||||
; Replace <file> with actual files you want to package
|
|
||||||
|
|
||||||
;-------------------------------------------------------------------
|
|
||||||
|
|
||||||
<file1>
|
|
||||||
|
|
||||||
<file2>
|
|
||||||
|
|
||||||
;*** <the end>
|
|
||||||
```
|
|
||||||
|
|
||||||
2. Use makecab to create the cab files.
|
|
||||||
|
|
||||||
```
|
|
||||||
Makecab -f <path to DDF file>
|
|
||||||
```
|
|
||||||
|
|
||||||
## Create the script to install the application
|
|
||||||
|
|
||||||
Create a script to perform whatever work is needed to install the application(s). The following examples are provided to help get started authoring the orchestrator script that will execute the required installers. In practice, the orchestrator script may reference many more assets than those in these examples.
|
|
||||||
|
|
||||||
>[!NOTE]
|
|
||||||
>All actions performed by the script must happen silently, showing no UI and requiring no user interaction.
|
|
||||||
>
|
|
||||||
>The scripts will be run on the device in system context.
|
|
||||||
|
|
||||||
### Debugging example
|
|
||||||
|
|
||||||
Granular logging is not built in, so the logging must be built into the script itself. Here is an example script that logs ‘Hello World’ to a logfile. When run on the device, the logfile will be available after provisioning is completed. As you will see in the following examples, it’s recommended that you log each action that your script performs.
|
|
||||||
|
|
||||||
```
|
|
||||||
set LOGFILE=%SystemDrive%\HelloWorld.log
|
|
||||||
echo Hello, World >> %LOGFILE%
|
|
||||||
```
|
|
||||||
### .exe example
|
|
||||||
|
|
||||||
This example script shows how to create a log output file on the system drive, install an app from a .exe installer, and echo the results to the log file.
|
|
||||||
|
|
||||||
```
|
|
||||||
set LOGFILE=%SystemDrive%\Fiddler_install.log
|
|
||||||
echo Installing Fiddler.exe >> %LOGFILE%
|
|
||||||
fiddler4setup.exe /S >> %LOGFILE%
|
|
||||||
echo result: %ERRORLEVEL% >> %LOGFILE%
|
|
||||||
```
|
|
||||||
|
|
||||||
### .msi example
|
|
||||||
|
|
||||||
This is the same as the previous installer, but installs the app from an MSI installer. Notice that msiexec is called with the /quiet flag in order to meet the silent requirement of scripts run from within a provisioning package.
|
|
||||||
|
|
||||||
```
|
|
||||||
set LOGFILE=%SystemDrive%\IPOverUsb_install.log
|
|
||||||
echo Installing IpOverUsbInstaller.msi >> %LOGFILE%
|
|
||||||
msiexec /i IpOverUsbInstaller.msi /quiet >> %LOGFILE%
|
|
||||||
echo result: %ERRORLEVEL% >> %LOGFILE%
|
|
||||||
```
|
|
||||||
|
|
||||||
### PowerShell example
|
|
||||||
|
|
||||||
This is an example script with logging that shows how to run a powershell script from the provisioning commands setting. Note that the PowerShell script referenced from this example must also be included in the package, and obey the same requirements as all scripts run from within the provisioning package: it must execute silently, with no user interaction.
|
|
||||||
|
|
||||||
```
|
|
||||||
set LOGFILE=%SystemDrive%\my_powershell_script.log
|
|
||||||
echo Running my_powershell_script.ps1 in system context >> %LOGFILE%
|
|
||||||
echo Executing "PsExec.exe -accepteula -i -s cmd.exe /c powershell.exe my_powershell_script.ps1" >> %LOGFILE%
|
|
||||||
PsExec.exe -accepteula -i -s cmd.exe /c powershell.exe my_powershell_script.ps1' >> %LOGFILE%
|
|
||||||
echo result: %ERRORLEVEL% >> %LOGFILE%
|
|
||||||
```
|
|
||||||
|
|
||||||
### Extract from a .CAB example
|
|
||||||
|
|
||||||
This example script shows expansion of a .cab from the provisioning commands script, as well as installation of the expanded setup.exe
|
|
||||||
|
|
||||||
```
|
|
||||||
set LOGFILE=%SystemDrive%\install_my_app.log
|
|
||||||
echo Expanding installer_assets.cab >> %LOGFILE%
|
|
||||||
expand -r installer_assets.cab -F:* . >> %LOGFILE%
|
|
||||||
echo result: %ERRORLEVEL% >> %LOGFILE%
|
|
||||||
echo Installing MyApp >> %LOGFILE%
|
|
||||||
setup.exe >> %LOGFILE%
|
|
||||||
echo result: %ERRORLEVEL% >> %LOGFILE%
|
|
||||||
```
|
|
||||||
|
|
||||||
### Calling multiple scripts in the package
|
|
||||||
|
|
||||||
You are currently allowed one CommandLine per PPKG. The batch files shown above are orchestrator scripts that manage the installation and calls any other scripts included in the PPKG. The orchestrator script is what should be invoked from the CommandLine specified in the package.
|
|
||||||
|
|
||||||
Here’s a table describing this relationship, using the PowerShell example from above:
|
|
||||||
|
|
||||||
|
|
||||||
|ICD Setting | Value | Description |
|
|
||||||
| --- | --- | --- |
|
|
||||||
| ProvisioningCommands/DeviceContext/CommandLine | cmd /c PowerShell_Example.bat | The command line needed to invoke the orchestrator script. |
|
|
||||||
| ProvisioningCommands/DeviceContext/CommandFiles | PowerShell_Example.bat | The single orchestrator script referenced by the command line that handles calling into the required installers or performing any other actions such as expanding cab files. This script must do the required logging. |
|
|
||||||
| ProvisioningCommands/DeviceContext/CommandFiles | my_powershell_script.ps1 | Other assets referenced by the orchestrator script. In this example there is only one, but there could be many assets referenced here. One common use case is using the orchestrator to call a series of install.exe or setup.exe installers to install several applications. Each of those installers must be included as an asset here. |
|
|
||||||
|
|
||||||
|
|
||||||
### Add script to provisioning package
|
|
||||||
|
|
||||||
When you have the batch file written and the referenced assets ready to include, you can add them to a provisioning package in the Window Imaging and Configuration Designer (Windows ICD).
|
|
||||||
|
|
||||||
Using ICD, specify the full details of how the script should be run in the CommandLine setting in the provisioning package. This includes flags or any other parameters that you would normally type on the command line. So for example if the package contained an app installer called install.exe and a script used to automate the install called InstallMyApp.bat, the `ProvisioningCommands/DeviceContext/CommandLine` setting should be configured to:
|
|
||||||
|
|
||||||
```
|
|
||||||
cmd /c InstallMyApp.bat
|
|
||||||
```
|
|
||||||
|
|
||||||
In ICD, this looks like:
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
You also need to add the relevant assets for that command line including the orchestrator script and any other assets it references such as installers or .cab files.
|
|
||||||
|
|
||||||
In ICD, that is done by adding files under the `ProvisioningCommands/DeviceContext/CommandFiles` setting.
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
When you are done, [build the package](provisioning-create-package.md#build-package).
|
|
||||||
|
|
||||||
|
|
||||||
### Remarks
|
|
||||||
1. No user interaction or console output is supported via ProvisioningCommands. All work needs to be silent. If your script attempts to do any of the following it will cause undefined behavior, and could put the device in an unrecoverable state if executed during setup or the Out of Box Experience:
|
|
||||||
a. Echo to console
|
|
||||||
b. Display anything on the screen
|
|
||||||
c. Prompt the user with a dialog or install wizard
|
|
||||||
2. When applied at first boot, provisioning runs early in the boot sequence and before a user context has been established; care must be taken to only include installers that can run at this time. Other installers can be provisioned via a management tool.
|
|
||||||
3. If the device is put into an unrecoverable state because of a bad script, you can reset it using [recovery options in Windows 10](https://support.microsoft.com/help/12415/windows-10-recovery-options).
|
|
||||||
4. The CommandFile assets are deployed on the device to a temporary folder unique to each package.
|
|
||||||
a. For packages added during the out of box experience, this is usually in `%WINDIR%\system32\config\systemprofile\appdata\local\Temp\ProvisioningPkgTmp\<{PackageIdGuid}>\Commands`
|
|
||||||
b. For packages added by double-clicking on an already deployed device, this will be in the temp folder for the user executing the PPKG: `%TMP%\ProvisioningPkgTmp\<{PackageIdGuid}>\Commands`
|
|
||||||
5. The command line will be executed with the directory the CommandFiles were deployed to as the working directory. This means you do not need to specific the full path to assets in the command line or from within any script.
|
|
||||||
6. The runtime provisioning component will attempt to run the scripts from the PPKG at the earliest point possible, depending on the stage when the PPKG was added. For example, if the package was added during the Out-of-Box Experience, it will be run immediately after the package is applied, while the Out-of-Box Experience is still happening. This is before the user account configuration options are presented to the user. A spinning progress dialog will appear and “please wait” will be displayed on the screen.
|
|
||||||
|
|
||||||
>[!NOTE]
|
|
||||||
>There is a timeout of 30 minutes for the provisioning process at this point. All scripts and installs need to complete within this time.
|
|
||||||
7. The scripts are executed in the background as the rest of provisioning continues to run. For packages added on existing systems using the double-click to install, there is no notification that provisioning or script execution has completed
|
|
||||||
|
|
||||||
|
|
||||||
## Related topics
|
|
||||||
|
|
||||||
- [Provisioning packages for Windows 10](provisioning-packages.md)
|
|
||||||
- [How provisioning works in Windows 10](provisioning-how-it-works.md)
|
|
||||||
- [Install Windows Imaging and Configuration Designer](provisioning-install-icd.md)
|
|
||||||
- [Create a provisioning package](provisioning-create-package.md)
|
|
||||||
- [Apply a provisioning package](provisioning-apply-package.md)
|
|
||||||
- [Settings changed when you uninstall a provisioning package](provisioning-uninstall-package.md)
|
|
||||||
- [Provision PCs with common settings for initial deployment (simple provisioning)](provision-pcs-for-initial-deployment.md)
|
|
||||||
- [Provision PCs with apps and certificates for initial deployments (advanced provisioning)](provision-pcs-with-apps-and-certificates.md)
|
|
||||||
- [NFC-based device provisioning](provisioning-nfc.md)
|
|
||||||
- [Windows ICD command-line interface (reference)](provisioning-command-line.md)
|
|
||||||
- [Create a provisioning package with multivariant settings](provisioning-multivariant.md)
|
|
||||||
@ -1,98 +0,0 @@
|
|||||||
---
|
|
||||||
title: Settings changed when you uninstall a provisioning package (Windows 10)
|
|
||||||
description: This topic lists the settings that are reverted when you uninstall a provisioning package.
|
|
||||||
ms.prod: w10
|
|
||||||
ms.mktglfcycl: deploy
|
|
||||||
ms.sitesec: library
|
|
||||||
author: jdeckerMS
|
|
||||||
localizationpriority: high
|
|
||||||
---
|
|
||||||
|
|
||||||
# Settings changed when you uninstall a provisioning package
|
|
||||||
|
|
||||||
|
|
||||||
**Applies to**
|
|
||||||
|
|
||||||
- Windows 10
|
|
||||||
- Windows 10 Mobile
|
|
||||||
|
|
||||||
When you uninstall a provisioning package, only certain settings are revertible. This topic lists the settings that are reverted when you uninstall a provisioning package.
|
|
||||||
|
|
||||||
|
|
||||||
As an administrator, you can uninstall by using the **Add or remove a package for work or school** option available under **Settings** > **Accounts** > **Access work or school**.
|
|
||||||
|
|
||||||
When a provisioning package is uninstalled, some of its settings are reverted, which means the value for the setting is changed to the next available or default value. Not all settings, however, are revertible.
|
|
||||||
|
|
||||||
Only settings in the following lists are revertible.
|
|
||||||
|
|
||||||
## Registry-based settings
|
|
||||||
|
|
||||||
The registry-based settings that are revertible when a provisioning package is uninstalled all fall under these categories, which you can find in the Graphical User Interface of the Windows Imaging and Configuration Designer (Windows ICD).
|
|
||||||
|
|
||||||
|
|
||||||
- [Wi-Fi Sense](https://msdn.microsoft.com/library/windows/hardware/mt219706.aspx)
|
|
||||||
- [CountryAndRegion](https://msdn.microsoft.com/library/windows/hardware/mt219726.aspx)
|
|
||||||
- DeviceManagement / PGList/ LogicalProxyName
|
|
||||||
- UniversalAppInstall / LaunchAppAtLogin
|
|
||||||
- [Power](https://msdn.microsoft.com/library/windows/hardware/dn953704.aspx)
|
|
||||||
- [TabletMode](https://msdn.microsoft.com/library/windows/hardware/mt297550.aspx)
|
|
||||||
- [Maps](https://msdn.microsoft.com/library/windows/hardware/mt131464.aspx)
|
|
||||||
- [Browser](https://msdn.microsoft.com/library/windows/hardware/mt573151.aspx)
|
|
||||||
- [DeviceFormFactor](https://msdn.microsoft.com/library/windows/hardware/mt243449.aspx)
|
|
||||||
- [USBErrorsOEMOverride](https://msdn.microsoft.com/library/windows/hardware/mt769908.aspx)
|
|
||||||
- [WeakCharger](https://msdn.microsoft.com/library/windows/hardware/mt346401.aspx)
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
## CSP-based settings
|
|
||||||
|
|
||||||
Here is the list of revertible settings based on configuration service providers (CSPs).
|
|
||||||
|
|
||||||
[ActiveSync CSP](https://msdn.microsoft.com/library/windows/hardware/dn920017.aspx)
|
|
||||||
[AppLocker CSP](https://msdn.microsoft.com/library/windows/hardware/dn920019.aspx)
|
|
||||||
[BrowserFavorite CSP](https://msdn.microsoft.com/library/windows/hardware/dn914758.aspx)
|
|
||||||
[CertificateStore CSP](https://msdn.microsoft.com/library/windows/hardware/dn920021.aspx)
|
|
||||||
[ClientCertificateInstall CSP](https://msdn.microsoft.com/library/windows/hardware/dn920023.aspx)
|
|
||||||
[RootCATrustedCertificates CSP](https://msdn.microsoft.com/library/windows/hardware/dn904970.aspx)
|
|
||||||
[CM_CellularEntries CSP](https://msdn.microsoft.com/library/windows/hardware/dn914761.aspx)
|
|
||||||
[CM_ProxyEntries CSP](https://msdn.microsoft.com/library/windows/hardware/dn914762.aspx)
|
|
||||||
[CMPolicy CSP](https://msdn.microsoft.com/library/windows/hardware/dn914760.aspx)
|
|
||||||
[CMPolicyEnterprise CSP](https://msdn.microsoft.com/library/windows/hardware/mt706463.aspx)
|
|
||||||
[EMAIL2 CSP](https://msdn.microsoft.com/library/windows/hardware/dn904953.aspx)
|
|
||||||
[EnterpriseAPN CSP](https://msdn.microsoft.com/library/windows/hardware/dn958617.aspx)
|
|
||||||
[EnterpriseAppManagement CSP](https://msdn.microsoft.com/library/windows/hardware/dn904955.aspx)
|
|
||||||
[EnterpriseDesktopAppManagement CSP](https://msdn.microsoft.com/library/windows/hardware/dn958620.aspx)
|
|
||||||
[EnterpriseModernAppManagement CSP](https://msdn.microsoft.com/library/windows/hardware/dn904956.aspx)
|
|
||||||
[NAP CSP](https://msdn.microsoft.com/library/windows/hardware/dn914767.aspx)
|
|
||||||
[PassportForWork CSP](https://msdn.microsoft.com/library/windows/hardware/dn987099.aspx)
|
|
||||||
[Provisioning CSP](https://msdn.microsoft.com/library/windows/hardware/mt203665.aspx)
|
|
||||||
[PROXY CSP](https://msdn.microsoft.com/library/windows/hardware/dn914770.aspx)
|
|
||||||
[SecureAssessment CSP](https://msdn.microsoft.com/library/windows/hardware/mt718628.aspx)
|
|
||||||
[VPN CSP](https://msdn.microsoft.com/library/windows/hardware/dn904978.aspx)
|
|
||||||
[VPNv2 CSP](https://msdn.microsoft.com/library/windows/hardware/dn914776.aspx)
|
|
||||||
[WiFi CSP](https://msdn.microsoft.com/library/windows/hardware/dn904981.aspx)
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
## Related topics
|
|
||||||
|
|
||||||
- [Provisioning packages for Windows 10](provisioning-packages.md)
|
|
||||||
- [How provisioning works in Windows 10](provisioning-how-it-works.md)
|
|
||||||
- [Install Windows Imaging and Configuration Designer](provisioning-install-icd.md)
|
|
||||||
- [Create a provisioning package](provisioning-create-package.md)
|
|
||||||
- [Apply a provisioning package](provisioning-apply-package.md)
|
|
||||||
- [Provision PCs with common settings for initial deployment (simple provisioning)](provision-pcs-for-initial-deployment.md)
|
|
||||||
- [Provision PCs with apps and certificates for initial deployments (advanced provisioning)](provision-pcs-with-apps-and-certificates.md)
|
|
||||||
- [Use a script to install a desktop app in provisioning packages](provisioning-script-to-install-app.md)
|
|
||||||
- [NFC-based device provisioning](provisioning-nfc.md)
|
|
||||||
- [Windows ICD command-line interface (reference)](provisioning-command-line.md)
|
|
||||||
- [Create a provisioning package with multivariant settings](provisioning-multivariant.md)
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
@ -1,125 +0,0 @@
|
|||||||
---
|
|
||||||
title: Update Windows 10 images with provisioning packages (Windows 10)
|
|
||||||
description: Use a provisioning package to apply settings, profiles, and file assets to a Windows 10 image.
|
|
||||||
ms.assetid: 3CA345D2-B60A-4860-A3BF-174713C3D3A6
|
|
||||||
keywords: provisioning, bulk deployment, image
|
|
||||||
ms.prod: w10
|
|
||||||
ms.mktglfcycl: deploy
|
|
||||||
ms.sitesec: library
|
|
||||||
ms.pagetype: mobile
|
|
||||||
author: jdeckerMS
|
|
||||||
redirect_url: https://technet.microsoft.com/itpro/windows/deploy/provisioning-packages
|
|
||||||
---
|
|
||||||
|
|
||||||
# Update Windows 10 images with provisioning packages
|
|
||||||
**Applies to**
|
|
||||||
|
|
||||||
- Windows 10
|
|
||||||
- Windows 10 Mobile
|
|
||||||
|
|
||||||
Use a provisioning package to apply settings, profiles, and file assets to a Windows 10 image.
|
|
||||||
|
|
||||||
In Windows 10, you can apply a provisioning package at any time. A provisioning package can include management instructions and policies, installation of specific apps, customization of network connections and policies, and more.
|
|
||||||
|
|
||||||
You can include provisioning packages when you build a Windows image. This way, you can create a single provisioning package that you can add to different hardware-specific images.
|
|
||||||
|
|
||||||
You can also put a provisioning package on a USB drive or SD card to apply to off-the-shelf devices. You can even send the provisioning package to someone in email.
|
|
||||||
|
|
||||||
Rather than wiping a device and applying a new system image when you need to change configuration, you can reset the device to its original state and then apply a new provisioning package.
|
|
||||||
|
|
||||||
For details about the settings you can customize in provisioning packages, see [Windows Provisioning settings reference]( https://go.microsoft.com/fwlink/p/?LinkId=619012).
|
|
||||||
|
|
||||||
## Advantages
|
|
||||||
- You can configure new devices without reimaging.
|
|
||||||
|
|
||||||
- Works on both mobile and desktop devices.
|
|
||||||
|
|
||||||
- No network connectivity required.
|
|
||||||
|
|
||||||
- Simple for people to apply.
|
|
||||||
|
|
||||||
- Ensure compliance and security before a device is enrolled in MDM.
|
|
||||||
|
|
||||||
## Create package
|
|
||||||
Use the Windows Imaging and Configuration Designer (ICD) tool included in the Windows Assessment and Deployment Kit (ADK) for Windows 10 to create a runtime provisioning package. [Install the ADK.](https://go.microsoft.com/fwlink/p/?LinkId=526740)
|
|
||||||
|
|
||||||
1. Open Windows ICD (by default, `%windir%\Program Files (x86)\Windows Kits\10\Assessment and Deployment Kit\Imaging and Configuration Designer\x86\ICD.exe`).
|
|
||||||
|
|
||||||
2. Choose **New provisioning package**.
|
|
||||||
|
|
||||||
3. Name your project, and click **Next**.
|
|
||||||
|
|
||||||
4. Choose **Common to all Windows editions** and click **Next**.
|
|
||||||
|
|
||||||
5. On **New project**, click **Finish**. The workspace for your package opens.
|
|
||||||
|
|
||||||
6. Configure settings. [Learn more about specific settings in provisioning packages.]( https://go.microsoft.com/fwlink/p/?LinkId=615916)
|
|
||||||
|
|
||||||
7. On the **File** menu, select **Save.**
|
|
||||||
|
|
||||||
8. On the **Export** menu, select **Provisioning package**.
|
|
||||||
|
|
||||||
9. Change **Owner** to **IT Admin**, which will set the precedence of this provisioning package higher than provisioning packages applied to this device from other sources, and then select **Next.**
|
|
||||||
|
|
||||||
10. Set a value for **Package Version**.
|
|
||||||
|
|
||||||
**Tip**
|
|
||||||
You can make changes to existing packages and change the version number to update previously applied packages.
|
|
||||||
|
|
||||||
11. Optional. In the **Provisioning package security** window, you can choose to encrypt the package and enable package signing.
|
|
||||||
|
|
||||||
- **Enable package encryption** - If you select this option, an auto-generated password will be shown on the screen.
|
|
||||||
|
|
||||||
- **Enable package signing** - If you select this option, you must select a valid certificate to use for signing the package. You can specify the certificate by clicking **Select...** and choosing the certificate you want to use to sign the package.
|
|
||||||
|
|
||||||
**Important**
|
|
||||||
We recommend that you include a trusted provisioning certificate in your provisioning package. When the package is applied to a device, the certificate is added to the system store and any package signed with that certificate thereafter can be applied silently.
|
|
||||||
|
|
||||||
12. Click **Next** to specify the output location where you want the provisioning package to go once it's built. By default, Windows ICD uses the project folder as the output location.<p>
|
|
||||||
Optionally, you can click **Browse** to change the default output location.
|
|
||||||
|
|
||||||
13. Click **Next**.
|
|
||||||
|
|
||||||
14. Click **Build** to start building the package. The project information is displayed in the build page and the progress bar indicates the build status.<p>
|
|
||||||
If you need to cancel the build, click **Cancel**. This cancels the current build process, closes the wizard, and takes you back to the **Customizations Page**.
|
|
||||||
|
|
||||||
15. If your build fails, an error message will show up that includes a link to the project folder. You can scan the logs to determine what caused the error. Once you fix the issue, try building the package again.<p>
|
|
||||||
If your build is successful, the name of the provisioning package, output directory, and project directory will be shown.
|
|
||||||
|
|
||||||
- If you choose, you can build the provisioning package again and pick a different path for the output package. To do this, click **Back** to change the output package name and path, and then click **Next** to start another build.
|
|
||||||
|
|
||||||
- If you are done, click **Finish** to close the wizard and go back to the **Customizations Page**.
|
|
||||||
|
|
||||||
16. Select the **output location** link to go to the location of the package. You can provide that .ppkg to others through any of the following methods:
|
|
||||||
|
|
||||||
- Shared network folder
|
|
||||||
|
|
||||||
- SharePoint site
|
|
||||||
|
|
||||||
- Removable media (USB/SD)
|
|
||||||
|
|
||||||
- Email
|
|
||||||
|
|
||||||
- USB tether (mobile only)
|
|
||||||
|
|
||||||
- NFC (mobile only)
|
|
||||||
|
|
||||||
## Add package to image
|
|
||||||
**To add a provisioning package to Windows 10 for desktop editions (Home, Pro, Enterprise, and Education)**
|
|
||||||
|
|
||||||
- Follow the steps in the "To build an image for Windows 10 for desktop editions" section in [Use the Windows ICD command-line interface]( https://go.microsoft.com/fwlink/p/?LinkId=617371).
|
|
||||||
|
|
||||||
**To add a provisioning package to a Windows 10 Mobile image**
|
|
||||||
|
|
||||||
- Follow the steps in the "To build an image for Windows 10 Mobile or Windows 10 IoT Core (IoT Core)" section in [Use the Windows ICD command-line interface]( https://go.microsoft.com/fwlink/p/?LinkId=617371).<p>
|
|
||||||
The provisioning package is placed in the FFU image and is flashed or sector written to the device. During device setup time, the provisioning engine starts and consumes the packages.
|
|
||||||
|
|
||||||
## Learn more
|
|
||||||
- [Build and apply a provisioning package]( https://go.microsoft.com/fwlink/p/?LinkId=629651)
|
|
||||||
|
|
||||||
- [Provisioning Windows 10 Devices with New Tools](https://go.microsoft.com/fwlink/p/?LinkId=615921)
|
|
||||||
|
|
||||||
- [Windows 10 for Mobile Devices: Provisioning Is Not Imaging](https://go.microsoft.com/fwlink/p/?LinkId=615922)
|
|
||||||
|
|
||||||
## Related topics
|
|
||||||
- [Configure devices without MDM](../manage/configure-devices-without-mdm.md)
|
|
||||||
@ -1,4 +0,0 @@
|
|||||||
---
|
|
||||||
title: Upgrade Analytics - Identify important apps (Windows 10)
|
|
||||||
redirect_url: upgrade-analytics-identify-apps
|
|
||||||
---
|
|
||||||
@ -1,5 +0,0 @@
|
|||||||
---
|
|
||||||
title: Upgrade Analytics release notes (Windows 10)
|
|
||||||
description: Provides tips and limitations about Upgrade Analytics.
|
|
||||||
redirect_url: https://technet.microsoft.com/itpro/windows/deploy/upgrade-analytics-requirements#important-information-about-this-release
|
|
||||||
---
|
|
||||||
@ -1,7 +0,0 @@
|
|||||||
---
|
|
||||||
title: Review site discovery
|
|
||||||
redirect_url: upgrade-analytics-additional-insights
|
|
||||||
---
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
@ -163,8 +163,8 @@ Topics and procedures in this guide are summarized in the following table. An es
|
|||||||
adsiedit.msc
|
adsiedit.msc
|
||||||
```
|
```
|
||||||
|
|
||||||
6. Right-click **ADSI Edit**, click **Connect to**, select **Default** under **Computer** and then click **OK**.
|
6. Right-click **ADSI Edit**, click **Connect to**, select **Default (Domain or server that you logged in to)** under **Computer** and then click **OK**.
|
||||||
7. Expand **Default naming context**>**DC=contoso,DC=com**, right-click **CN=System**, point to **New**, and then click **Object**.
|
7. Expand **Default naming context**>**DC=contoso,DC=com**, and then in the console tree right-click **CN=System**, point to **New**, and then click **Object**.
|
||||||
8. Click **container** and then click **Next**.
|
8. Click **container** and then click **Next**.
|
||||||
9. Next to **Value**, type **System Management**, click **Next**, and then click **Finish**.
|
9. Next to **Value**, type **System Management**, click **Next**, and then click **Finish**.
|
||||||
10. Right-click **CN=system Management** and then click **Properties**.
|
10. Right-click **CN=system Management** and then click **Properties**.
|
||||||
@ -194,7 +194,7 @@ Topics and procedures in this guide are summarized in the following table. An es
|
|||||||
- **Settings Summary**: Review settings and click **Next**.
|
- **Settings Summary**: Review settings and click **Next**.
|
||||||
- **Prerequisite Check**: No failures should be listed. Ignore any warnings and click **Begin Install**.
|
- **Prerequisite Check**: No failures should be listed. Ignore any warnings and click **Begin Install**.
|
||||||
|
|
||||||
>There should be at most three warnings present: WSUS on site server, configuration for SQL Server memory usage, and SQL Server process memory allocation. These warnings can safely be ignored.
|
>There should be at most three warnings present: WSUS on site server, configuration for SQL Server memory usage, and SQL Server process memory allocation. These warnings can safely be ignored in this test environment.
|
||||||
|
|
||||||
Depending on the speed of the Hyper-V host and resources allocated to SRV1, installation can require approximately one hour. Click **Close** when installation is complete.
|
Depending on the speed of the Hyper-V host and resources allocated to SRV1, installation can require approximately one hour. Click **Close** when installation is complete.
|
||||||
|
|
||||||
@ -207,7 +207,7 @@ Topics and procedures in this guide are summarized in the following table. An es
|
|||||||
|
|
||||||
## Download MDOP and install DaRT
|
## Download MDOP and install DaRT
|
||||||
|
|
||||||
1. Download the [Microsoft Desktop Optimization Pack 2015](https://msdn.microsoft.com/en-us/subscriptions/downloads/#ProductFamilyId=597) to the Hyper-V host using an MSDN subscription. Download the .ISO file (mu_microsoft_desktop_optimization_pack_2015_x86_x64_dvd_5975282.iso) to the C:\VHD directory on the Hyper-V host.
|
1. Download the [Microsoft Desktop Optimization Pack 2015](https://msdn.microsoft.com/en-us/subscriptions/downloads/#ProductFamilyId=597) to the Hyper-V host using an MSDN subscription. Download the .ISO file (mu_microsoft_desktop_optimization_pack_2015_x86_x64_dvd_5975282.iso, 2.79 GB) to the C:\VHD directory on the Hyper-V host.
|
||||||
|
|
||||||
2. Type the following command at an elevated Windows PowerShell prompt on the Hyper-V host to mount the MDOP file on SRV1:
|
2. Type the following command at an elevated Windows PowerShell prompt on the Hyper-V host to mount the MDOP file on SRV1:
|
||||||
|
|
||||||
@ -292,19 +292,19 @@ This section contains several procedures to support Zero Touch installation with
|
|||||||
2. In the System Center Configuration Manager console, in the **Administration** workspace, click **Distribution Points**.
|
2. In the System Center Configuration Manager console, in the **Administration** workspace, click **Distribution Points**.
|
||||||
3. In the display pane, right-click **SRV1.CONTOSO.COM** and then click **Properties**.
|
3. In the display pane, right-click **SRV1.CONTOSO.COM** and then click **Properties**.
|
||||||
4. On the PXE tab, select the following settings:
|
4. On the PXE tab, select the following settings:
|
||||||
- Enable PXE support for clients. Click **Yes** in the popup that appears.
|
- **Enable PXE support for clients**. Click **Yes** in the popup that appears.
|
||||||
- Allow this distribution point to respond to incoming PXE requests
|
- **Allow this distribution point to respond to incoming PXE requests**
|
||||||
- Enable unknown computer support. Click **OK** in the popup that appears.
|
- **Enable unknown computer support**. Click **OK** in the popup that appears.
|
||||||
- Require a password when computers use PXE
|
- **Require a password when computers use PXE**
|
||||||
- Password and Confirm password: pass@word1
|
- **Password** and **Confirm password**: pass@word1
|
||||||
- Respond to PXE requests on specific network interfaces: Click the yellow starburst and then enter the MAC address determined in the first step of this procedure.
|
- **Respond to PXE requests on specific network interfaces**: Click the yellow starburst and then enter the MAC address determined in the first step of this procedure.
|
||||||
|
|
||||||
See the following example:
|
See the following example:
|
||||||
|
|
||||||
<img src="images/sccm-pxe.png" alt="Config Mgr PXE"/>
|
<img src="images/sccm-pxe.png" alt="Config Mgr PXE"/>
|
||||||
|
|
||||||
5. Click **OK**.
|
5. Click **OK**.
|
||||||
6. Type the following command at an elevated Windows PowerShell prompt on SRV1, and verify that the files displayed are present:
|
6. Wait for a minute, then type the following command at an elevated Windows PowerShell prompt on SRV1, and verify that the files displayed are present:
|
||||||
|
|
||||||
```
|
```
|
||||||
cmd /c dir /b C:\RemoteInstall\SMSBoot\x64
|
cmd /c dir /b C:\RemoteInstall\SMSBoot\x64
|
||||||
@ -340,7 +340,7 @@ This section contains several procedures to support Zero Touch installation with
|
|||||||
>You can open C:\Sources\OSD\Branding\contoso.bmp in MSPaint.exe if desired to customize this image.
|
>You can open C:\Sources\OSD\Branding\contoso.bmp in MSPaint.exe if desired to customize this image.
|
||||||
|
|
||||||
|
|
||||||
## Create a boot image for Configuration Manager
|
### Create a boot image for Configuration Manager
|
||||||
|
|
||||||
1. In the Configuration Manager console, in the **Software Library** workspace, expand **Operating Systems**, right-click **Boot Images**, and then click **Create Boot Image using MDT**.
|
1. In the Configuration Manager console, in the **Software Library** workspace, expand **Operating Systems**, right-click **Boot Images**, and then click **Create Boot Image using MDT**.
|
||||||
2. On the Package Source page, under **Package source folder to be created (UNC Path):**, type **\\\SRV1\Sources$\OSD\Boot\Zero Touch WinPE x64**, and then click **Next**.
|
2. On the Package Source page, under **Package source folder to be created (UNC Path):**, type **\\\SRV1\Sources$\OSD\Boot\Zero Touch WinPE x64**, and then click **Next**.
|
||||||
@ -357,13 +357,15 @@ This section contains several procedures to support Zero Touch installation with
|
|||||||
```
|
```
|
||||||
Invoke-Item 'C:\Program Files\Microsoft Configuration Manager\tools\cmtrace.exe'
|
Invoke-Item 'C:\Program Files\Microsoft Configuration Manager\tools\cmtrace.exe'
|
||||||
```
|
```
|
||||||
>In the trace tool, click **Tools** on the menu and choose **Find**. Search for "**STATMSG: ID=2301**". For example:
|
|
||||||
|
In the trace tool, click **Tools** on the menu and choose **Find**. Search for "**STATMSG: ID=2301**". For example:
|
||||||
|
|
||||||
```
|
```
|
||||||
STATMSG: ID=2301 SEV=I LEV=M SOURCE="SMS Server" COMP="SMS_DISTRIBUTION_MANAGER" SYS=SRV1.CONTOSO.COM SITE=PS1 PID=2476 TID=4636 GMTDATE=Wed Sep 14 22:11:09.363 2016 ISTR0="Configuration Manager Client Upgrade Package" ISTR1="PS100003" ISTR2="" ISTR3="" ISTR4="" ISTR5="" ISTR6="" ISTR7="" ISTR8="" ISTR9="" NUMATTRS=1 AID0=400 AVAL0="PS100003" SMS_DISTRIBUTION_MANAGER 9/14/2016 3:11:09 PM 4636 (0x121C)
|
STATMSG: ID=2301 SEV=I LEV=M SOURCE="SMS Server" COMP="SMS_DISTRIBUTION_MANAGER" SYS=SRV1.CONTOSO.COM SITE=PS1 PID=2476 TID=4636 GMTDATE=Wed Sep 14 22:11:09.363 2016 ISTR0="Configuration Manager Client Upgrade Package" ISTR1="PS100003" ISTR2="" ISTR3="" ISTR4="" ISTR5="" ISTR6="" ISTR7="" ISTR8="" ISTR9="" NUMATTRS=1 AID0=400 AVAL0="PS100003" SMS_DISTRIBUTION_MANAGER 9/14/2016 3:11:09 PM 4636 (0x121C)
|
||||||
```
|
```
|
||||||
11. You can also review status by clicking the **Zero Touch WinPE x64** image, and then clicking **Content Status** under **Related Objects** in the bottom right-hand corner of the console, or by entering **\Monitoring\Overview\Distribution Status\Content Status** on the location bar in the console. Doublt-click **Zero Touch WinPE x64** under **Content Status** in the console tree and verify that a status of **Successfully distributed content** is displayed on the **Success** tab.
|
|
||||||
12. In the **Software Library** workspace, double-click **Zero Touch WinPE x64** and then click the **Data Source** tab.
|
11. You can also review status by clicking the **Zero Touch WinPE x64** image, and then clicking **Content Status** under **Related Objects** in the bottom right-hand corner of the console, or by entering **\Monitoring\Overview\Distribution Status\Content Status** on the location bar in the console. Double-click **Zero Touch WinPE x64** under **Content Status** in the console tree and verify that a status of **Successfully distributed content** is displayed on the **Success** tab.
|
||||||
|
12. Next, in the **Software Library** workspace, double-click **Zero Touch WinPE x64** and then click the **Data Source** tab.
|
||||||
13. Select the **Deploy this boot image from the PXE-enabled distribution point** checkbox, and click **OK**.
|
13. Select the **Deploy this boot image from the PXE-enabled distribution point** checkbox, and click **OK**.
|
||||||
14. Review the distmgr.log file again for "**STATMSG: ID=2301**" and verify that there are three folders under **C:\RemoteInstall\SMSImages** with boot images. See the following example:
|
14. Review the distmgr.log file again for "**STATMSG: ID=2301**" and verify that there are three folders under **C:\RemoteInstall\SMSImages** with boot images. See the following example:
|
||||||
|
|
||||||
@ -380,7 +382,7 @@ This section contains several procedures to support Zero Touch installation with
|
|||||||
|
|
||||||
>The first two images (*.wim files) are default boot images. The third is the new boot image with DaRT.
|
>The first two images (*.wim files) are default boot images. The third is the new boot image with DaRT.
|
||||||
|
|
||||||
## Create a Windows 10 reference image
|
### Create a Windows 10 reference image
|
||||||
|
|
||||||
If you have already completed steps in [Deploy Windows 10 in a test lab using Microsoft Deployment Toolkit](windows-10-poc-mdt.md) then you have already created a Windows 10 reference image. In this case, skip to the next procedure in this guide: [Add a Windows 10 operating system image](#add-a-windows-10-operating-system-image). If you have not yet created a Windows 10 reference image, complete the steps in this section.
|
If you have already completed steps in [Deploy Windows 10 in a test lab using Microsoft Deployment Toolkit](windows-10-poc-mdt.md) then you have already created a Windows 10 reference image. In this case, skip to the next procedure in this guide: [Add a Windows 10 operating system image](#add-a-windows-10-operating-system-image). If you have not yet created a Windows 10 reference image, complete the steps in this section.
|
||||||
|
|
||||||
@ -534,7 +536,7 @@ If you have already completed steps in [Deploy Windows 10 in a test lab using Mi
|
|||||||
|
|
||||||
This step requires from 30 minutes to 2 hours, depending on the speed of the Hyper-V host and your network's download speed. After some time, you will have a Windows 10 Enterprise x64 image that is fully patched and has run through Sysprep. The image is located in the C:\MDTBuildLab\Captures folder on SRV1. The file name is **REFW10X64-001.wim**.
|
This step requires from 30 minutes to 2 hours, depending on the speed of the Hyper-V host and your network's download speed. After some time, you will have a Windows 10 Enterprise x64 image that is fully patched and has run through Sysprep. The image is located in the C:\MDTBuildLab\Captures folder on SRV1. The file name is **REFW10X64-001.wim**.
|
||||||
|
|
||||||
## Add a Windows 10 operating system image
|
### Add a Windows 10 operating system image
|
||||||
|
|
||||||
1. Type the following commands at an elevated Windows PowerShell prompt on SRV1:
|
1. Type the following commands at an elevated Windows PowerShell prompt on SRV1:
|
||||||
|
|
||||||
@ -553,11 +555,11 @@ If you have already completed steps in [Deploy Windows 10 in a test lab using Mi
|
|||||||
|
|
||||||
6. In the Distribute Content Wizard, click **Next**, click **Add**, click **Distribution Point**, add the **SRV1.CONTOSO.COM** distribution point, click **OK**, click **Next** twice and then click **Close**.
|
6. In the Distribute Content Wizard, click **Next**, click **Add**, click **Distribution Point**, add the **SRV1.CONTOSO.COM** distribution point, click **OK**, click **Next** twice and then click **Close**.
|
||||||
|
|
||||||
7. Enter **\Monitoring\Overview\Distribution Status\Content Status** on the location bar, click **Windows 10 Enterprise x64**, and monitor the status of content distribution until it is successful and no longer in progress. Refresh the view with the F5 key or by right-clicking **Windows 10 Enterprise x64** and clicking **Refresh**. Processing of the image on the site server can take several minutes.
|
7. Enter **\Monitoring\Overview\Distribution Status\Content Status** on the location bar (be sure there is no space at the end of the location or you will get an error), click **Windows 10 Enterprise x64**, and monitor the status of content distribution until it is successful and no longer in progress. Refresh the view with the F5 key or by right-clicking **Windows 10 Enterprise x64** and clicking **Refresh**. Processing of the image on the site server can take several minutes.
|
||||||
|
|
||||||
>If content distribution is not successful, verify that sufficient disk space is available.
|
>If content distribution is not successful, verify that sufficient disk space is available.
|
||||||
|
|
||||||
## Create a task sequence
|
### Create a task sequence
|
||||||
|
|
||||||
>Complete this section slowly. There are a large number of similar settings from which to choose.
|
>Complete this section slowly. There are a large number of similar settings from which to choose.
|
||||||
|
|
||||||
@ -567,37 +569,37 @@ If you have already completed steps in [Deploy Windows 10 in a test lab using Mi
|
|||||||
|
|
||||||
3. On the General page, type **Windows 10 Enterprise x64** under **Task sequence name:** and then click **Next**.
|
3. On the General page, type **Windows 10 Enterprise x64** under **Task sequence name:** and then click **Next**.
|
||||||
|
|
||||||
4. On the Details page, enter the following settings:<BR>
|
4. On the Details page, enter the following settings:
|
||||||
- Join a domain: contoso.com<BR>
|
- Join a domain: **contoso.com**
|
||||||
- Account: click **Set**<BR>
|
- Account: click **Set**
|
||||||
- User name: contoso\CM_JD<BR>
|
- User name: **contoso\CM_JD**
|
||||||
- Password: pass@word1<BR>
|
- Password: **pass@word1**
|
||||||
- Confirm password: pass@word1<BR>
|
- Confirm password: **pass@word1**
|
||||||
- Click **OK**<BR>
|
- Click **OK**
|
||||||
- Windows Settings<BR>
|
- Windows Settings
|
||||||
- User name: Contoso<BR>
|
- User name: **Contoso**
|
||||||
- Organization name: Contoso<BR>
|
- Organization name: **Contoso**
|
||||||
- Product key: \<blank\><BR>
|
- Product key: \<blank\>
|
||||||
- Administrator Account: Enable the account and specify the local administrator password<BR>
|
- Administrator Account: **Enable the account and specify the local administrator password**
|
||||||
- Password: pass@word1<BR>
|
- Password: **pass@word1**
|
||||||
- Confirm password: pass@word1<BR>
|
- Confirm password: **pass@word1**
|
||||||
- Click Next<BR>
|
- Click **Next**
|
||||||
|
|
||||||
5. On the Capture Settings page, accept the default settings and click **Next**.
|
5. On the Capture Settings page, accept the default settings and click **Next**.
|
||||||
|
|
||||||
6. On the Boot Image page, browse and select the **Zero Touch WinPE x64** boot image package and then click **Next**.
|
6. On the Boot Image page, browse and select the **Zero Touch WinPE x64** boot image package, click **OK**, and then click **Next**.
|
||||||
|
|
||||||
7. On the MDT Package page, select **Create a new Microsoft Deployment Toolkit Files package**, under **Package source folder to be created (UNC Path):**, type **\\\SRV1\Sources$\OSD\MDT\MDT 2013**, and then click **Next**.
|
7. On the MDT Package page, select **Create a new Microsoft Deployment Toolkit Files package**, under **Package source folder to be created (UNC Path):**, type **\\\SRV1\Sources$\OSD\MDT\MDT** (MDT is repeated here, not a typo), and then click **Next**.
|
||||||
|
|
||||||
8. On the MDT Details page, next to **Name:** type **MDT 2013** and then click **Next**.
|
8. On the MDT Details page, next to **Name:** type **MDT** and then click **Next**.
|
||||||
|
|
||||||
9. On the OS Image page, browse and select the **Windows 10 Enterprise x64** package, and then click **Next**.
|
9. On the OS Image page, browse and select the **Windows 10 Enterprise x64** package, click **OK**, and then click **Next**.
|
||||||
|
|
||||||
10. On the Deployment Method page, accept the default settings for **Zero Touch Installation** and click **Next**.
|
10. On the Deployment Method page, accept the default settings for **Zero Touch Installation** and click **Next**.
|
||||||
|
|
||||||
11. On the Client Package page, browse and select the **Microsoft Corporation Configuration Manager Client package** and then click **Next**.
|
11. On the Client Package page, browse and select the **Microsoft Corporation Configuration Manager Client package**, click **OK**, and then click **Next**.
|
||||||
|
|
||||||
12. On the USMT Package page, browse and select the **Microsoft Corporation User State Migration Tool for Windows 8 10.0.14393.0** package, and then click **Next**.
|
12. On the USMT Package page, browse and select the **Microsoft Corporation User State Migration Tool for Windows 10.0.14393.0** package, click **OK**, and then click **Next**.
|
||||||
|
|
||||||
13. On the Settings Package page, select **Create a new settings package**, and under **Package source folder to be created (UNC Path):**, type **\\\SRV1\Sources$\OSD\Settings\Windows 10 x64 Settings**, and then click **Next**.
|
13. On the Settings Package page, select **Create a new settings package**, and under **Package source folder to be created (UNC Path):**, type **\\\SRV1\Sources$\OSD\Settings\Windows 10 x64 Settings**, and then click **Next**.
|
||||||
|
|
||||||
@ -640,7 +642,7 @@ If you have already completed steps in [Deploy Windows 10 in a test lab using Mi
|
|||||||
- Click **OK**<BR>.
|
- Click **OK**<BR>.
|
||||||
|
|
||||||
|
|
||||||
## Finalize the operating system configuration
|
### Finalize the operating system configuration
|
||||||
|
|
||||||
>If you completed all procedures in [Deploy Windows 10 in a test lab using Microsoft Deployment Toolkit](windows-10-poc-mdt.md) then the MDT deployment share is already present on SRV1. In this case, skip the first four steps below and begin with step 5 to edit CustomSettings.ini.
|
>If you completed all procedures in [Deploy Windows 10 in a test lab using Microsoft Deployment Toolkit](windows-10-poc-mdt.md) then the MDT deployment share is already present on SRV1. In this case, skip the first four steps below and begin with step 5 to edit CustomSettings.ini.
|
||||||
|
|
||||||
@ -670,7 +672,7 @@ If you have already completed steps in [Deploy Windows 10 in a test lab using Mi
|
|||||||
[Settings]
|
[Settings]
|
||||||
Priority=Default
|
Priority=Default
|
||||||
Properties=OSDMigrateConfigFiles,OSDMigrateMode
|
Properties=OSDMigrateConfigFiles,OSDMigrateMode
|
||||||
|
|
||||||
[Default]
|
[Default]
|
||||||
DoCapture=NO
|
DoCapture=NO
|
||||||
ComputerBackupLocation=NONE
|
ComputerBackupLocation=NONE
|
||||||
@ -681,6 +683,14 @@ If you have already completed steps in [Deploy Windows 10 in a test lab using Mi
|
|||||||
EventService=http://SRV1:9800
|
EventService=http://SRV1:9800
|
||||||
ApplyGPOPack=NO
|
ApplyGPOPack=NO
|
||||||
```
|
```
|
||||||
|
|
||||||
|
>As noted previously, if you wish to migrate accounts other than those in the Contoso domain, then change the OSDMigrateAdditionalCaptureOptions option. For example, the following option will capture settings from all user accounts:
|
||||||
|
|
||||||
|
```
|
||||||
|
OSDMigrateAdditionalCaptureOptions=/all
|
||||||
|
```
|
||||||
|
|
||||||
|
|
||||||
7. Return to the Configuration Manager console, and in the Software Library workspace, expand **Application Management**, click **Packages**, right-click **Windows 10 x64 Settings**, and then click **Update Distribution Points**. Click **OK** in the popup that appears.
|
7. Return to the Configuration Manager console, and in the Software Library workspace, expand **Application Management**, click **Packages**, right-click **Windows 10 x64 Settings**, and then click **Update Distribution Points**. Click **OK** in the popup that appears.
|
||||||
|
|
||||||
8. In the Software Library workspace, expand **Operating Systems**, click **Task Sequences**, right-click **Windows 10 Enterprise x64**, and then click **Distribute Content**.
|
8. In the Software Library workspace, expand **Operating Systems**, click **Task Sequences**, right-click **Windows 10 Enterprise x64**, and then click **Distribute Content**.
|
||||||
@ -705,6 +715,8 @@ If you have already completed steps in [Deploy Windows 10 in a test lab using Mi
|
|||||||
|
|
||||||
## Deploy Windows 10 using PXE and Configuration Manager
|
## Deploy Windows 10 using PXE and Configuration Manager
|
||||||
|
|
||||||
|
In this first deployment scenario, we will deploy Windows 10 using PXE. This scenario creates a new computer that does not have any migrated users or settings.
|
||||||
|
|
||||||
1. Type the following commands at an elevated Windows PowerShell prompt on the Hyper-V host:
|
1. Type the following commands at an elevated Windows PowerShell prompt on the Hyper-V host:
|
||||||
|
|
||||||
```
|
```
|
||||||
@ -718,7 +730,7 @@ If you have already completed steps in [Deploy Windows 10 in a test lab using Mi
|
|||||||
|
|
||||||
3. In the Task Sequence Wizard, provide the password: **pass@word1**, and then click **Next**.
|
3. In the Task Sequence Wizard, provide the password: **pass@word1**, and then click **Next**.
|
||||||
|
|
||||||
4. Before you click Next in the Task Sequence Wizard, press the **F8** key. A command prompt will open.
|
4. Before you click **Next** in the Task Sequence Wizard, press the **F8** key. A command prompt will open.
|
||||||
|
|
||||||
5. At the command prompt, type **explorer.exe** and review the Windows PE file structure.
|
5. At the command prompt, type **explorer.exe** and review the Windows PE file structure.
|
||||||
|
|
||||||
@ -745,6 +757,7 @@ If you have already completed steps in [Deploy Windows 10 in a test lab using Mi
|
|||||||
- Join the computer to the contoso.com domain
|
- Join the computer to the contoso.com domain
|
||||||
- Install any applications that were specified in the reference image
|
- Install any applications that were specified in the reference image
|
||||||
|
|
||||||
|
|
||||||
12. When Windows 10 installation has completed, sign in to PC4 using the **contoso\administrator** account.
|
12. When Windows 10 installation has completed, sign in to PC4 using the **contoso\administrator** account.
|
||||||
|
|
||||||
13. Right-click **Start**, click **Run**, type **control appwiz.cpl**, press ENTER, click Turn Windows features on or off, and verify that **.NET Framework 3.5 (includes .NET 2.0 and 3.0)** is installed. This is a feature included in the reference image.
|
13. Right-click **Start**, click **Run**, type **control appwiz.cpl**, press ENTER, click Turn Windows features on or off, and verify that **.NET Framework 3.5 (includes .NET 2.0 and 3.0)** is installed. This is a feature included in the reference image.
|
||||||
@ -927,7 +940,7 @@ vmconnect localhost PC1
|
|||||||
- Task sequence comments: **USMT backup only**
|
- Task sequence comments: **USMT backup only**
|
||||||
|
|
||||||
4. Click **Next**, and on the Boot Image page, browse and select the **Zero Touch WinPE x64** boot image package. Click **OK** and then click **Next** to continue.
|
4. Click **Next**, and on the Boot Image page, browse and select the **Zero Touch WinPE x64** boot image package. Click **OK** and then click **Next** to continue.
|
||||||
5. On the MDT Package page, browse and select the **MDT 2013** package. Click **OK** and then click **Next** to continue.
|
5. On the MDT Package page, browse and select the **MDT** package. Click **OK** and then click **Next** to continue.
|
||||||
6. On the USMT Package page, browse and select the **Microsoft Corporation User State Migration Tool for Windows** package. Click **OK** and then click **Next** to continue.
|
6. On the USMT Package page, browse and select the **Microsoft Corporation User State Migration Tool for Windows** package. Click **OK** and then click **Next** to continue.
|
||||||
7. On the Settings Package page, browse and select the **Windows 10 x64 Settings** package. Click **OK** and then click **Next** to continue.
|
7. On the Settings Package page, browse and select the **Windows 10 x64 Settings** package. Click **OK** and then click **Next** to continue.
|
||||||
8. On the Summary page, review the details and then click **Next**.
|
8. On the Summary page, review the details and then click **Next**.
|
||||||
|
|||||||
@ -1,5 +0,0 @@
|
|||||||
---
|
|
||||||
title: AD DS schema extensions to support TPM backup
|
|
||||||
redirect_url: https://technet.microsoft.com/library/jj635854.aspx
|
|
||||||
---
|
|
||||||
|
|
||||||
@ -1,7 +0,0 @@
|
|||||||
---
|
|
||||||
redirect_url: https://technet.microsoft.com/itpro/windows/keep-secure/configure-endpoints-windows-defender-advanced-threat-protection
|
|
||||||
---
|
|
||||||
|
|
||||||
# Additional Windows Defender ATP configuration settings
|
|
||||||
|
|
||||||
This page has been redirected to [Configure endpoints](https://technet.microsoft.com/itpro/windows/keep-secure/configure-endpoints-windows-defender-advanced-threat-protection)
|
|
||||||
@ -6,6 +6,7 @@ ms.prod: w10
|
|||||||
ms.mktglfcycl: explore
|
ms.mktglfcycl: explore
|
||||||
ms.pagetype: security
|
ms.pagetype: security
|
||||||
ms.sitesec: library
|
ms.sitesec: library
|
||||||
|
author: eross-msft
|
||||||
localizationpriority: high
|
localizationpriority: high
|
||||||
---
|
---
|
||||||
|
|
||||||
|
|||||||
@ -115,7 +115,11 @@ Windows 10 uses Trusted Boot on any hardware platform: It requires neither UEFI
|
|||||||
|
|
||||||
Because UEFI-based Secure Boot has protected the bootloader and Trusted Boot has protected the Windows kernel or other Windows startup components, the next opportunity for malware to start is by infecting a non-Microsoft boot-related driver. Traditional antimalware apps don’t start until after the boot-related drivers have been loaded, giving a rootkit disguised as a driver the opportunity to work.
|
Because UEFI-based Secure Boot has protected the bootloader and Trusted Boot has protected the Windows kernel or other Windows startup components, the next opportunity for malware to start is by infecting a non-Microsoft boot-related driver. Traditional antimalware apps don’t start until after the boot-related drivers have been loaded, giving a rootkit disguised as a driver the opportunity to work.
|
||||||
|
|
||||||
The purpose of ELAM is to load an antimalware driver before drivers that are flagged as boot-start can be executed. This approach provides the ability for an antimalware driver to register as a trusted boot-critical driver. It is launched during the Trusted Boot process, and with that, Windows ensures that it is loaded before any other non-Microsoft software.
|
Early Launch Antimalware (ELAM) is designed to enable the antimalware solution to start before all non-Microsoft drivers and apps. ELAM checks the integrity of non-Microsoft drivers to determine whether the drivers are trustworthy. Because Windows needs to start as fast as possible, ELAM cannot be a complicated process of checking the driver files against known malware signatures. Instead, ELAM has the simple task of examining every boot driver and determining whether it is on the list of trusted drivers. If malware modifies a boot-related driver, ELAM will detect the change, and Windows will prevent the driver from starting, thus blocking driver-based rootkits. ELAM also allows the registered antimalware provider to scan drivers that are loaded after the boot process is complete.
|
||||||
|
|
||||||
|
Windows Defender in Windows 10 supports ELAM, as do Microsoft System Center 2012 Endpoint Protection and non-Microsoft antimalware apps.
|
||||||
|
|
||||||
|
To do this, ELAM loads an antimalware driver before drivers that are flagged as boot-start can be executed. This approach provides the ability for an antimalware driver to register as a trusted boot-critical driver. It is launched during the Trusted Boot process, and with that, Windows ensures that it is loaded before any other non-Microsoft software.
|
||||||
|
|
||||||
With this solution in place, boot drivers are initialized based on the classification that the ELAM driver returns according to an initialization policy. IT pros have the ability to change this policy through Group Policy.
|
With this solution in place, boot drivers are initialized based on the classification that the ELAM driver returns according to an initialization policy. IT pros have the ability to change this policy through Group Policy.
|
||||||
ELAM classifies drivers as follows:
|
ELAM classifies drivers as follows:
|
||||||
|
|||||||
@ -45,14 +45,14 @@ You can use System Center Configuration Manager’s existing functionality to cr
|
|||||||
|
|
||||||
2. Extract the contents of the .zip file to a shared, read-only location that can be accessed by the network administrators who will deploy the package. You should have a file named *WindowsDefenderATPOnboardingScript.cmd*.
|
2. Extract the contents of the .zip file to a shared, read-only location that can be accessed by the network administrators who will deploy the package. You should have a file named *WindowsDefenderATPOnboardingScript.cmd*.
|
||||||
|
|
||||||
3. Import the configuration package by following the steps in the [How to Create Packages and Programs in Configuration Manager](https://technet.microsoft.com/library/gg682112.aspx#BKMK_Import) topic.
|
3. Onboard your devices using SCCM by following the steps in the [Onboard devices to Windows Defender ATP](https://docs.microsoft.com/en-us/sccm/protect/deploy-use/windows-defender-advanced-threat-protection#onboard-devices-for-windows-defender-atp) topic.
|
||||||
|
|
||||||
4. Deploy the package by following the steps in the [How to Deploy Packages and Programs in Configuration Manager](https://technet.microsoft.com/library/gg682178.aspx) topic.
|
4. Deploy the package by following the steps in the [How to Deploy Packages and Programs in Configuration Manager](https://technet.microsoft.com/library/gg682178.aspx) topic.
|
||||||
|
|
||||||
a. Choose a predefined device collection to deploy the package to.
|
a. Choose a predefined device collection to deploy the package to.
|
||||||
|
|
||||||
> [!NOTE]
|
> [!NOTE]
|
||||||
> Onboarding couldn't be completed during Out-Of-Box Experience (OOBE). Make sure users pass OOBE after running Windows installation or upgrading.
|
> Windows Defender ATP doesn't support onboarding during the [Out-Of-Box Experience (OOBE)](https://answers.microsoft.com/en-us/windows/wiki/windows_10/how-to-complete-the-windows-10-out-of-box/47e3f943-f000-45e3-8c5c-9d85a1a0cf87) phase. Make sure users complete OOBE after running Windows installation or upgrading.
|
||||||
|
|
||||||
|
|
||||||
### Configure sample collection settings
|
### Configure sample collection settings
|
||||||
|
|||||||
@ -6,6 +6,7 @@ ms.prod: w10
|
|||||||
ms.mktglfcycl: explore
|
ms.mktglfcycl: explore
|
||||||
ms.sitesec: library
|
ms.sitesec: library
|
||||||
ms.pagetype: security
|
ms.pagetype: security
|
||||||
|
author: eross-msft
|
||||||
localizationpriority: high
|
localizationpriority: high
|
||||||
---
|
---
|
||||||
|
|
||||||
|
|||||||
@ -1,5 +0,0 @@
|
|||||||
---
|
|
||||||
title: Create an enterprise data protection (EDP) policy using Microsoft Intune (Windows 10)
|
|
||||||
description: Microsoft Intune helps you create and deploy your enterprise data protection (EDP) policy, including letting you choose your protected apps, your EDP-protection level, and how to find enterprise data on the network.
|
|
||||||
redirect_url: https://technet.microsoft.com/itpro/windows/keep-secure/create-wip-policy-using-intune
|
|
||||||
---
|
|
||||||
@ -1,5 +0,0 @@
|
|||||||
---
|
|
||||||
title: Create and deploy an enterprise data protection (EDP) policy using System Center Configuration Manager (Windows 10)
|
|
||||||
description: Configuration Manager (version 1606 or later) helps you create and deploy your enterprise data protection (EDP) policy, including letting you choose your protected apps, your EDP-protection level, and how to find enterprise data on the network.
|
|
||||||
redirect_url: https://technet.microsoft.com/itpro/windows/keep-secure/create-wip-policy-using-sccm
|
|
||||||
---
|
|
||||||
@ -1,5 +0,0 @@
|
|||||||
---
|
|
||||||
title: Create and deploy a VPN policy for enterprise data protection (EDP) using Microsoft Intune (Windows 10)
|
|
||||||
description: After you've created and deployed your enterprise data protection (EDP) policy, you can use Microsoft Intune to create and deploy your Virtual Private Network (VPN) policy, linking it to your EDP policy.
|
|
||||||
redirect_url: https://technet.microsoft.com/itpro/windows/keep-secure/create-vpn-and-wip-policy-using-intune
|
|
||||||
---
|
|
||||||
@ -1,5 +0,0 @@
|
|||||||
---
|
|
||||||
title: Create a Device Guard code integrity policy based on a reference device (Windows 10)
|
|
||||||
redirect_url: https://technet.microsoft.com/en-us/itpro/windows/keep-secure/device-guard-deployment-guide
|
|
||||||
---
|
|
||||||
|
|
||||||
@ -178,11 +178,11 @@ You can do this by using either the Control Panel or the Deployment Image Servic
|
|||||||
|
|
||||||
1. Open an elevated command prompt.
|
1. Open an elevated command prompt.
|
||||||
2. Add the Hyper-V Hypervisor by running the following command:
|
2. Add the Hyper-V Hypervisor by running the following command:
|
||||||
``` syntax
|
```
|
||||||
dism /image:<WIM file name> /Enable-Feature /FeatureName:Microsoft-Hyper-V-Hypervisor /all
|
dism /image:<WIM file name> /Enable-Feature /FeatureName:Microsoft-Hyper-V-Hypervisor /all
|
||||||
```
|
```
|
||||||
3. Add the Isolated User Mode feature by running the following command:
|
3. Add the Isolated User Mode feature by running the following command:
|
||||||
``` syntax
|
```
|
||||||
dism /image:<WIM file name> /Enable-Feature /FeatureName:IsolatedUserMode
|
dism /image:<WIM file name> /Enable-Feature /FeatureName:IsolatedUserMode
|
||||||
```
|
```
|
||||||
|
|
||||||
|
|||||||
@ -14,7 +14,7 @@ author: brianlic-msft
|
|||||||
- Windows 10
|
- Windows 10
|
||||||
- Windows Server 2016
|
- Windows Server 2016
|
||||||
|
|
||||||
Code integrity policies maintain the standards by which a computer running Windows 10 determines whether an application is trustworthy and can be run. For an overview of code integrity, see:
|
Code integrity policies provide control over a computer running Windows 10 by specifying whether a driver or application is trusted and can be run. For an overview of code integrity, see:
|
||||||
- [How Device Guard features help protect against threats](introduction-to-device-guard-virtualization-based-security-and-code-integrity-policies.md#how-device-guard-features-help-protect-against-threats) in "Introduction to Device Guard: virtualization-based security and code integrity policies."
|
- [How Device Guard features help protect against threats](introduction-to-device-guard-virtualization-based-security-and-code-integrity-policies.md#how-device-guard-features-help-protect-against-threats) in "Introduction to Device Guard: virtualization-based security and code integrity policies."
|
||||||
- [Code integrity policy formats and signing](requirements-and-deployment-planning-guidelines-for-device-guard.md#code-integrity-policy-formats-and-signing) in "Requirements and deployment planning guidelines for Device Guard."
|
- [Code integrity policy formats and signing](requirements-and-deployment-planning-guidelines-for-device-guard.md#code-integrity-policy-formats-and-signing) in "Requirements and deployment planning guidelines for Device Guard."
|
||||||
|
|
||||||
@ -23,7 +23,7 @@ If you already understand the basics of code integrity policy and want procedure
|
|||||||
This topic includes the following sections:
|
This topic includes the following sections:
|
||||||
|
|
||||||
- [Overview of the process of creating code integrity policies](#overview-of-the-process-of-creating-code-integrity-policies): Helps familiarize you with the process described in this and related topics.
|
- [Overview of the process of creating code integrity policies](#overview-of-the-process-of-creating-code-integrity-policies): Helps familiarize you with the process described in this and related topics.
|
||||||
- [Code integrity policy rules](#code-integrity-policy-rules): Describes one key element you specify in a policy, the *policy rules*, which control options such as audit mode or whether UMCI is enabled in a code integrity policy.
|
- [Code integrity policy rules](#code-integrity-policy-rules): Describes one key element you specify in a policy, the *policy rules*, which control options such as audit mode or whether user mode code integrity (UMCI) is enabled in a code integrity policy.
|
||||||
- [Code integrity file rule levels](#code-integrity-file-rule-levels): Describes the other key element you specify in a policy, the *file rules* (or *file rule levels*), which specify the level at which applications will be identified and trusted.
|
- [Code integrity file rule levels](#code-integrity-file-rule-levels): Describes the other key element you specify in a policy, the *file rules* (or *file rule levels*), which specify the level at which applications will be identified and trusted.
|
||||||
- [Example of file rule levels in use](#example-of-file-rule-levels-in-use): Gives an example of how file rule levels can be applied.
|
- [Example of file rule levels in use](#example-of-file-rule-levels-in-use): Gives an example of how file rule levels can be applied.
|
||||||
|
|
||||||
@ -31,7 +31,7 @@ This topic includes the following sections:
|
|||||||
|
|
||||||
A common system imaging practice in today’s IT organization is to establish a “golden” image as a reference for what an ideal system should look like, and then use that image to clone additional company assets. Code integrity policies follow a similar methodology, that begins with the establishment of a golden computer. As with imaging, you can have multiple golden computers based on model, department, application set, and so on. Although the thought process around the creation of code integrity policies is similar to imaging, these policies should be maintained independently. Assess the necessity of additional code integrity policies based on what should be allowed to be installed and run and for whom. For more details on doing this assessment, see the planning steps in [Planning and getting started on the Device Guard deployment process](planning-and-getting-started-on-the-device-guard-deployment-process.md).
|
A common system imaging practice in today’s IT organization is to establish a “golden” image as a reference for what an ideal system should look like, and then use that image to clone additional company assets. Code integrity policies follow a similar methodology, that begins with the establishment of a golden computer. As with imaging, you can have multiple golden computers based on model, department, application set, and so on. Although the thought process around the creation of code integrity policies is similar to imaging, these policies should be maintained independently. Assess the necessity of additional code integrity policies based on what should be allowed to be installed and run and for whom. For more details on doing this assessment, see the planning steps in [Planning and getting started on the Device Guard deployment process](planning-and-getting-started-on-the-device-guard-deployment-process.md).
|
||||||
|
|
||||||
> **Note** Each computer can have only **one** code integrity policy at a time. Whichever way you deploy this policy, it is renamed to SIPolicy.p7b and copied to C:\\Windows\\System32\\CodeIntegrity. Keep this in mind when you create your code integrity policies.
|
> **Note** Each computer can have only **one** code integrity policy at a time. Whichever way you deploy this policy, it is renamed to SIPolicy.p7b and copied to **C:\\Windows\\System32\\CodeIntegrity** and, for UEFI computers, **<EFI System Partition>\\Microsoft\\Boot**. Keep this in mind when you create your code integrity policies.
|
||||||
|
|
||||||
Optionally, code integrity policies can align with your software catalog as well as any IT department–approved applications. One straightforward method to implement code integrity policies is to use existing images to create one master code integrity policy. You do so by creating a code integrity policy from each image, and then by merging the policies. This way, what is installed on all of those images will be allowed to run, if the applications are installed on a computer based on a different image. Alternatively, you may choose to create a base applications policy and add policies based on the computer’s role or department. Organizations have a choice of how their policies are created, merged or serviced, and managed.
|
Optionally, code integrity policies can align with your software catalog as well as any IT department–approved applications. One straightforward method to implement code integrity policies is to use existing images to create one master code integrity policy. You do so by creating a code integrity policy from each image, and then by merging the policies. This way, what is installed on all of those images will be allowed to run, if the applications are installed on a computer based on a different image. Alternatively, you may choose to create a base applications policy and add policies based on the computer’s role or department. Organizations have a choice of how their policies are created, merged or serviced, and managed.
|
||||||
|
|
||||||
@ -43,10 +43,12 @@ Code integrity policies include *policy rules*, which control options such as au
|
|||||||
|
|
||||||
To modify the policy rule options of an existing code integrity policy, use the [Set-RuleOption](https://technet.microsoft.com/library/mt634483.aspx) Windows PowerShell cmdlet. Note the following examples of how to use this cmdlet to add and remove a rule option on an existing code integrity policy:
|
To modify the policy rule options of an existing code integrity policy, use the [Set-RuleOption](https://technet.microsoft.com/library/mt634483.aspx) Windows PowerShell cmdlet. Note the following examples of how to use this cmdlet to add and remove a rule option on an existing code integrity policy:
|
||||||
|
|
||||||
- To enable UMCI, add rule option 0 to an existing policy by running the following command:
|
- To ensure that UMCI is enabled for a code integrity policy that was created with the `-UserPEs` (user mode) option, add rule option 0 to an existing policy by running the following command:
|
||||||
|
|
||||||
` Set-RuleOption -FilePath <Path to policy> -Option 0`
|
` Set-RuleOption -FilePath <Path to policy> -Option 0`
|
||||||
|
|
||||||
|
Note that a policy that was created without the `-UserPEs` option is empty of user mode executables, that is, applications. If you enable UMCI (Option 0) for such a policy and then attempt to run an application, Device Guard will see that the application is not on its list (which is empty of applications), and respond. In audit mode, the response is logging an event, and in enforced mode, the response is blocking the application. To create a policy that includes user mode executables (applications), when you run `New-CIPolicy`, include the `-UserPEs` option.
|
||||||
|
|
||||||
- To disable UMCI on an existing code integrity policy, delete rule option 0 by running the following command:
|
- To disable UMCI on an existing code integrity policy, delete rule option 0 by running the following command:
|
||||||
|
|
||||||
` Set-RuleOption -FilePath <Path to policy> -Option 0 -Delete`
|
` Set-RuleOption -FilePath <Path to policy> -Option 0 -Delete`
|
||||||
|
|||||||
@ -38,11 +38,11 @@ To create a code integrity policy, copy each of the following commands into an e
|
|||||||
|
|
||||||
> **Notes**
|
> **Notes**
|
||||||
|
|
||||||
> - By specifying the *–UserPEs* parameter, rule option **0 Enabled:UMCI** is automatically added to the code integrity policy. If you do not specify this parameter, to enable UMCI, use [Set-RuleOption](https://technet.microsoft.com/library/mt634483.aspx) as shown in the following command:<br>**Set-RuleOption -FilePath $InitialCIPolicy -Option 0**
|
> - When you specify the **-UserPEs** parameter (to include user mode executables in the scan), rule option **0 Enabled:UMCI** is automatically added to the code integrity policy. In contrast, if you do not specify **-UserPEs**, the policy will be empty of user mode executables and will only have rules for kernel mode binaries like drivers, in other words, the whitelist will not include applications. If you create such a policy and later add rule option **0 Enabled:UMCI**, all attempts to start applications will cause a response from Device Guard. In audit mode, the response is logging an event, and in enforced mode, the response is blocking the application.
|
||||||
|
|
||||||
|
> - You can add the **-Fallback** parameter to catch any applications not discovered using the primary file rule level specified by the **-Level** parameter. For more information about file rule level options, see [Code integrity file rule levels](deploy-code-integrity-policies-policy-rules-and-file-rules.md#code-integrity-file-rule-levels) in “Deploy code integrity policies: policy rules and file rules.”
|
||||||
|
|
||||||
> - You can add the *–Fallback* parameter to catch any applications not discovered using the primary file rule level specified by the *–Level* parameter. For more information about file rule level options, see [Code integrity file rule levels](deploy-code-integrity-policies-policy-rules-and-file-rules.md#code-integrity-file-rule-levels) in “Deploy code integrity policies: policy rules and file rules.”
|
> - To specify that the code integrity policy scan only a specific drive, include the **-ScanPath** parameter followed by a path. Without this parameter, the entire system is scanned.
|
||||||
|
|
||||||
> - To specify that the code integrity policy scan only a specific drive, include the *–ScanPath* parameter followed by a path. Without this parameter, the entire system is scanned.
|
|
||||||
|
|
||||||
> - The preceding example includes `3> CIPolicylog.txt`, which redirects warning messages to a text file, **CIPolicylog.txt**.
|
> - The preceding example includes `3> CIPolicylog.txt`, which redirects warning messages to a text file, **CIPolicylog.txt**.
|
||||||
|
|
||||||
|
|||||||
@ -1,5 +0,0 @@
|
|||||||
---
|
|
||||||
title: Deploy your enterprise data protection (EDP) policy using Microsoft Intune (Windows 10)
|
|
||||||
description: After you’ve created your enterprise data protection (EDP) policy, you'll need to deploy it to your organization's enrolled devices.
|
|
||||||
redirect_url: https://technet.microsoft.com/itpro/windows/keep-secure/deploy-wip-policy-using-intune
|
|
||||||
---
|
|
||||||
@ -1,4 +0,0 @@
|
|||||||
---
|
|
||||||
title: Device Guard certification and compliance (Windows 10)
|
|
||||||
redirect_url: https://technet.microsoft.com/en-us/itpro/windows/keep-secure/device-guard-deployment-guide
|
|
||||||
---
|
|
||||||
@ -1,19 +0,0 @@
|
|||||||
---
|
|
||||||
title: Enable phone sign-in to PC or VPN (Windows 10)
|
|
||||||
description: You can set policies to allow your users to sign in to a PC or VPN using their Windows 10 phone.
|
|
||||||
keywords: ["identity", "PIN", "biometric", "Hello"]
|
|
||||||
ms.prod: W10
|
|
||||||
ms.mktglfcycl: deploy
|
|
||||||
ms.sitesec: library
|
|
||||||
author: jdeckerMS
|
|
||||||
redirect_url: https://technet.microsoft.com/en-us/itpro/windows/keep-secure/hello-enable-phone-signin
|
|
||||||
---
|
|
||||||
|
|
||||||
# Enable phone sign-in to PC or VPN
|
|
||||||
|
|
||||||
|
|
||||||
**Applies to**
|
|
||||||
|
|
||||||
- Windows 10
|
|
||||||
- Windows 10 Mobile
|
|
||||||
|
|
||||||
@ -1,5 +0,0 @@
|
|||||||
---
|
|
||||||
title: List of enlightened Microsoft apps for use with enterprise data protection (EDP) (Windows 10)
|
|
||||||
description: Learn the difference between enlightened and unenlightened apps, and then review the list of enlightened apps provided by Microsoft along with the text you will need to use to add them to your Protected Apps list.
|
|
||||||
redirect_url: https://technet.microsoft.com/itpro/windows/keep-secure/enlightened-microsoft-apps-and-wip
|
|
||||||
---
|
|
||||||
@ -1,4 +0,0 @@
|
|||||||
---
|
|
||||||
title: Get apps to run on Device Guard-protected devices (Windows 10)
|
|
||||||
redirect_url: https://technet.microsoft.com/en-us/itpro/windows/keep-secure/device-guard-deployment-guide
|
|
||||||
---
|
|
||||||
@ -1,5 +0,0 @@
|
|||||||
---
|
|
||||||
title: General guidance and best practices for enterprise data protection (EDP) (Windows 10)
|
|
||||||
description: This section includes info about the enlightened Microsoft apps, including how to add them to your Protected Apps list in Microsoft Intune. It also includes some testing scenarios that we recommend running through with enterprise data protection (EDP).
|
|
||||||
redirect_url: https://technet.microsoft.com/itpro/windows/keep-secure/guidance-and-best-practices-wip
|
|
||||||
---
|
|
||||||
@ -1,19 +0,0 @@
|
|||||||
---
|
|
||||||
title: Implement Windows Hello in your organization (Windows 10)
|
|
||||||
description: You can create a Group Policy or mobile device management (MDM) policy that will implement Windows Hello for Business on devices running Windows 10.
|
|
||||||
ms.assetid: 47B55221-24BE-482D-BD31-C78B22AC06D8
|
|
||||||
keywords: identity, PIN, biometric, Hello
|
|
||||||
ms.prod: w10
|
|
||||||
ms.mktglfcycl: deploy
|
|
||||||
ms.sitesec: library
|
|
||||||
ms.pagetype: security
|
|
||||||
author: jdeckerMS
|
|
||||||
redirect_url: https://technet.microsoft.com/en-us/itpro/windows/keep-secure/hello-manage-in-organization
|
|
||||||
---
|
|
||||||
|
|
||||||
# Implement Windows Hello for Business in your organization
|
|
||||||
|
|
||||||
**Applies to**
|
|
||||||
- Windows 10
|
|
||||||
- Windows 10 Mobile
|
|
||||||
|
|
||||||
@ -1,18 +0,0 @@
|
|||||||
---
|
|
||||||
title: Manage identity verification using Windows Hello for Business (Windows 10)
|
|
||||||
description: In Windows 10, Windows Hello for Business replaces passwords with strong two-factor authentication on PCs and mobile devices. This authentication consists of a new type of user credential that is tied to a device and a biometric or PIN.
|
|
||||||
ms.assetid: 5BF09642-8CF5-4FBC-AC9A-5CA51E19387E
|
|
||||||
keywords: identity, PIN, biometric, Hello, passport
|
|
||||||
ms.prod: w10
|
|
||||||
ms.mktglfcycl: deploy
|
|
||||||
ms.sitesec: library
|
|
||||||
ms.pagetype: security, mobile
|
|
||||||
author: jdeckerMS
|
|
||||||
redirect_url: https://technet.microsoft.com/en-us/itpro/windows/keep-secure/hello-identity-verification
|
|
||||||
---
|
|
||||||
# Manage identity verification using Windows Hello for Business
|
|
||||||
|
|
||||||
**Applies to**
|
|
||||||
- Windows 10
|
|
||||||
- Windows 10 Mobile
|
|
||||||
|
|
||||||
@ -6,6 +6,7 @@ ms.prod: w10
|
|||||||
ms.mktglfcycl: explore
|
ms.mktglfcycl: explore
|
||||||
ms.sitesec: library
|
ms.sitesec: library
|
||||||
ms.pagetype: security
|
ms.pagetype: security
|
||||||
|
author: eross-msft
|
||||||
localizationpriority: high
|
localizationpriority: high
|
||||||
---
|
---
|
||||||
|
|
||||||
|
|||||||
@ -1,13 +0,0 @@
|
|||||||
---
|
|
||||||
title: Windows Hello and password changes (Windows 10)
|
|
||||||
description: When you change your password on a device, you may need to sign in with a password on other devices to reset Hello.
|
|
||||||
ms.assetid: 83005FE4-8899-47A6-BEA9-C17CCA0B6B55
|
|
||||||
ms.prod: w10
|
|
||||||
ms.mktglfcycl: deploy
|
|
||||||
ms.sitesec: library
|
|
||||||
ms.pagetype: security
|
|
||||||
author: jdeckerMS
|
|
||||||
redirect_url: https://technet.microsoft.com/en-us/itpro/windows/keep-secure/hello-and-password-changes
|
|
||||||
---
|
|
||||||
# Windows Hello and password changes
|
|
||||||
|
|
||||||
@ -1,15 +0,0 @@
|
|||||||
---
|
|
||||||
title: Windows Hello errors during PIN creation (Windows 10)
|
|
||||||
description: When you set up Windows Hello in Windows 10, you may get an error during the Create a work PIN step.
|
|
||||||
ms.assetid: DFEFE22C-4FEF-4FD9-BFC4-9B419C339502
|
|
||||||
keywords: PIN, error, create a work PIN
|
|
||||||
ms.prod: w10
|
|
||||||
ms.mktglfcycl: deploy
|
|
||||||
ms.sitesec: library
|
|
||||||
ms.pagetype: security
|
|
||||||
author: jdeckerMS
|
|
||||||
redirect_url: https://technet.microsoft.com/en-us/itpro/windows/keep-secure/hello-errors-during-pin-creation
|
|
||||||
---
|
|
||||||
|
|
||||||
# Windows Hello errors during PIN creation
|
|
||||||
|
|
||||||
@ -1,18 +0,0 @@
|
|||||||
---
|
|
||||||
title: Microsoft Passport guide (Windows 10)
|
|
||||||
description: This guide describes the new Windows Hello and Microsoft Passport technologies that are part of the Windows 10 operating system.
|
|
||||||
ms.assetid: 11EA7826-DA6B-4E5C-99FB-142CC6BD9E84
|
|
||||||
keywords: security, credential, password, authentication
|
|
||||||
ms.prod: w10
|
|
||||||
ms.mktglfcycl: plan
|
|
||||||
ms.sitesec: library
|
|
||||||
ms.pagetype: security
|
|
||||||
author: challum
|
|
||||||
redirect_url: https://technet.microsoft.com/en-us/itpro/windows/keep-secure/hello-identity-verification
|
|
||||||
---
|
|
||||||
|
|
||||||
# Microsoft Passport guide
|
|
||||||
|
|
||||||
**Applies to**
|
|
||||||
- Windows 10
|
|
||||||
|
|
||||||
@ -1,7 +0,0 @@
|
|||||||
---
|
|
||||||
redirect_url: https://technet.microsoft.com/itpro/windows/keep-secure/configure-endpoints-windows-defender-advanced-threat-protection
|
|
||||||
---
|
|
||||||
|
|
||||||
# Monitor the Windows Defender Advanced Threat Protection onboarding
|
|
||||||
|
|
||||||
This page has been redirected to [Configure endpoints](https://technet.microsoft.com/itpro/windows/keep-secure/configure-endpoints-windows-defender-advanced-threat-protection)
|
|
||||||
@ -1,5 +0,0 @@
|
|||||||
---
|
|
||||||
title: Create an enterprise data protection (EDP) policy (Windows 10)
|
|
||||||
description: Microsoft Intune and System Center Configuration Manager Technical Preview version 1605 or later helps you create and deploy your enterprise data protection (EDP) policy, including letting you choose your protected apps, your EDP-protection level, and how to find enterprise data on the network.
|
|
||||||
redirect_url: https://technet.microsoft.com/itpro/windows/keep-secure/overview-create-wip-policy
|
|
||||||
---
|
|
||||||
@ -1,15 +0,0 @@
|
|||||||
---
|
|
||||||
title: Event ID 300 - Windows Hello successfully created (Windows 10)
|
|
||||||
description: This event is created when a Windows Hello for Business is successfully created and registered with Azure Active Directory (Azure AD).
|
|
||||||
ms.assetid: 0DD59E75-1C5F-4CC6-BB0E-71C83884FF04
|
|
||||||
keywords: ngc
|
|
||||||
ms.prod: w10
|
|
||||||
ms.mktglfcycl: deploy
|
|
||||||
ms.sitesec: library
|
|
||||||
ms.pagetype: security
|
|
||||||
author: jdeckerMS
|
|
||||||
redirect_url: https://technet.microsoft.com/en-us/itpro/windows/keep-secure/hello-event-300
|
|
||||||
---
|
|
||||||
|
|
||||||
# Event ID 300 - Windows Hello successfully created
|
|
||||||
|
|
||||||
@ -1,17 +0,0 @@
|
|||||||
---
|
|
||||||
title: Prepare people to use Windows Hello (Windows 10)
|
|
||||||
description: When you set a policy to require Windows Hello for Business in the workplace, you will want to prepare people in your organization.
|
|
||||||
ms.assetid: 5270B416-CE31-4DD9-862D-6C22A2AE508B
|
|
||||||
keywords: identity, PIN, biometric, Hello
|
|
||||||
ms.prod: w10
|
|
||||||
ms.mktglfcycl: deploy
|
|
||||||
ms.sitesec: library
|
|
||||||
ms.pagetype: security
|
|
||||||
author: jdeckerMS
|
|
||||||
redirect_url: https://technet.microsoft.com/en-us/itpro/windows/keep-secure/hello-prepare-people-to-use
|
|
||||||
---
|
|
||||||
|
|
||||||
# Prepare people to use Windows Hello
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
@ -1,5 +0,0 @@
|
|||||||
---
|
|
||||||
title: Protect your enterprise data using enterprise data protection (EDP) (Windows 10)
|
|
||||||
description: With the increase of employee-owned devices in the enterprise, there’s also an increasing risk of accidental data leak through apps and services, like email, social media, and the public cloud, which are outside of the enterprise’s control.
|
|
||||||
redirect_url: https://technet.microsoft.com/itpro/windows/keep-secure/protect-enterprise-data-using-wip
|
|
||||||
---
|
|
||||||
@ -6,6 +6,7 @@ ms.prod: w10
|
|||||||
ms.mktglfcycl: explore
|
ms.mktglfcycl: explore
|
||||||
ms.sitesec: library
|
ms.sitesec: library
|
||||||
ms.pagetype: security
|
ms.pagetype: security
|
||||||
|
author: eross-msft
|
||||||
localizationpriority: high
|
localizationpriority: high
|
||||||
---
|
---
|
||||||
|
|
||||||
|
|||||||
@ -1,5 +0,0 @@
|
|||||||
---
|
|
||||||
title: Testing scenarios for enterprise data protection (EDP) (Windows 10)
|
|
||||||
description: We've come up with a list of suggested testing scenarios that you can use to test enterprise data protection (EDP) in your company.
|
|
||||||
redirect_url: https://technet.microsoft.com/itpro/windows/keep-secure/testing-scenarios-for-wip
|
|
||||||
---
|
|
||||||
@ -6,6 +6,7 @@ ms.prod: w10
|
|||||||
ms.mktglfcycl: explore
|
ms.mktglfcycl: explore
|
||||||
ms.sitesec: library
|
ms.sitesec: library
|
||||||
ms.pagetype: security
|
ms.pagetype: security
|
||||||
|
author: eross-msft
|
||||||
localizationpriority: high
|
localizationpriority: high
|
||||||
---
|
---
|
||||||
|
|
||||||
|
|||||||
@ -1,15 +0,0 @@
|
|||||||
---
|
|
||||||
title: Why a PIN is better than a password (Windows 10)
|
|
||||||
description: Windows Hello in Windows 10 enables users to sign in to their device using a PIN. How is a PIN different from (and better than) a password .
|
|
||||||
ms.assetid: A6FC0520-01E6-4E90-B53D-6C4C4E780212
|
|
||||||
keywords: pin, security, password, hello
|
|
||||||
ms.prod: w10
|
|
||||||
ms.mktglfcycl: deploy
|
|
||||||
ms.sitesec: library
|
|
||||||
ms.pagetype: security
|
|
||||||
author: jdeckerMS
|
|
||||||
redirect_url: https://technet.microsoft.com/en-us/itpro/windows/keep-secure/hello-why-pin-is-better-than-password
|
|
||||||
---
|
|
||||||
|
|
||||||
# Why a PIN is better than a password
|
|
||||||
|
|
||||||
@ -1,14 +0,0 @@
|
|||||||
---
|
|
||||||
title: Windows Hello biometrics in the enterprise (Windows 10)
|
|
||||||
description: Windows Hello is the biometric authentication feature that helps strengthen authentication and helps to guard against potential spoofing through fingerprint matching and facial recognition.
|
|
||||||
ms.assetid: d3f27d94-2226-4547-86c0-65c84d6df8Bc
|
|
||||||
keywords: Windows Hello, enterprise biometrics
|
|
||||||
ms.prod: w10
|
|
||||||
ms.mktglfcycl: explore
|
|
||||||
ms.sitesec: library
|
|
||||||
ms.pagetype: security
|
|
||||||
author: jdeckerMS
|
|
||||||
redirect_url: https://technet.microsoft.com/en-us/itpro/windows/keep-secure/hello-biometrics-in-enterprise
|
|
||||||
---
|
|
||||||
|
|
||||||
# Windows Hello biometrics in the enterprise
|
|
||||||
@ -6,6 +6,7 @@ ms.prod: w10
|
|||||||
ms.mktglfcycl: explore
|
ms.mktglfcycl: explore
|
||||||
ms.sitesec: library
|
ms.sitesec: library
|
||||||
ms.pagetype: security
|
ms.pagetype: security
|
||||||
|
author: eross-msft
|
||||||
localizationpriority: high
|
localizationpriority: high
|
||||||
---
|
---
|
||||||
|
|
||||||
|
|||||||
@ -1,5 +0,0 @@
|
|||||||
---
|
|
||||||
title: Windows Information Protection overview (Windows 10)
|
|
||||||
description: Conceptual info about Windows Information Protection (WIP), formerly known as Windows Information Protection (WIP).
|
|
||||||
redirect_url: https://technet.microsoft.com/itpro/windows/keep-secure/protect-enterprise-data-using-wip
|
|
||||||
---
|
|
||||||
@ -1,12 +0,0 @@
|
|||||||
---
|
|
||||||
title: App inventory management for Windows Store for Business (Windows 10)
|
|
||||||
description: You can manage all apps that you've acquired on your Inventory page.
|
|
||||||
ms.assetid: 44211937-801B-4B85-8810-9CA055CDB1B2
|
|
||||||
redirect_url: https://technet.microsoft.com/itpro/windows/manage/app-inventory-management-windows-store-for-business
|
|
||||||
ms.prod: w10
|
|
||||||
ms.mktglfcycl: manage
|
|
||||||
ms.sitesec: library
|
|
||||||
ms.pagetype: store
|
|
||||||
author: TrudyHa
|
|
||||||
---
|
|
||||||
|
|
||||||
@ -1,165 +0,0 @@
|
|||||||
---
|
|
||||||
title: Application development for Windows as a service (Windows 10)
|
|
||||||
description: Microsoft recommends that our ISV partners decouple their app release and support from specific Windows builds.
|
|
||||||
ms.assetid: 28E0D103-B0EE-4B14-8680-6F30BD373ACF
|
|
||||||
ms.prod: w10
|
|
||||||
ms.mktglfcycl: manage
|
|
||||||
ms.sitesec: library
|
|
||||||
ms.pagetype: security, servicing
|
|
||||||
author: jdeckerMS
|
|
||||||
redirect_url: https://msdn.microsoft.com/windows/uwp/get-started/application-development-for-windows-as-a-service
|
|
||||||
---
|
|
||||||
|
|
||||||
# Application development for Windows as a service
|
|
||||||
|
|
||||||
**Applies to**
|
|
||||||
- Windows 10
|
|
||||||
- Windows 10 Mobile
|
|
||||||
- Windows 10 IoT Core
|
|
||||||
|
|
||||||
In today’s environment, where user expectations frequently are set by device-centric experiences, complete product cycles need to be measured in months, not years. Additionally, new releases must be made available on a continual basis, and must be deployable with minimal impact on users. Microsoft designed Windows 10 to meet these requirements by implementing a new approach to innovation, development, and delivery called [Windows as a service (WaaS)](introduction-to-windows-10-servicing.md). The key to enabling significantly shorter product cycles while maintaining high quality levels is an innovative community-centric approach to testing that Microsoft has implemented for Windows 10. The community, known as Windows Insiders, is comprised of millions of users around the world. When Windows Insiders opt in to the community, they test many builds over the course of a product cycle and provide feedback to Microsoft through an iterative methodology called flighting.
|
|
||||||
|
|
||||||
Builds distributed as flights provide the Windows engineering team with significant data regarding how well builds are performing in actual use. Flighting with Windows Insiders also enables Microsoft to test builds in much more diverse hardware, application, and networking environments than in the past, and to identify issues far more quickly. As a result, Microsoft believes that community-focused flighting will enable both a faster pace of innovation delivery and better public release quality than ever.
|
|
||||||
|
|
||||||
## Windows 10 release types and cadences
|
|
||||||
|
|
||||||
Although Microsoft releases flight builds to Windows Insiders, Microsoft will publish two types of Windows 10 releases broadly to the public on an ongoing basis:
|
|
||||||
|
|
||||||
**Feature updates** install the latest new features, experiences, and capabilities on devices that are already running Windows 10. Because feature updates contain an entire copy of Windows, they are also what customers use to install Windows 10 on existing devices running Windows 7 or Windows 8.1, and on new devices where no operating system is installed. Microsoft expects to publish an average of one to two new feature updates per year.
|
|
||||||
|
|
||||||
**Quality updates** deliver security issue resolutions and other important bug fixes. Quality updates will be provided to improve each feature currently in support, on a cadence of one or more times per month. Microsoft will continue publishing quality updates on Update Tuesday (sometimes referred to as Patch Tuesday). Additionally, Microsoft may publish additional quality updates for Windows 10 outside the Update Tuesday process when required to address customer needs.
|
|
||||||
|
|
||||||
During Windows 10 development, Microsoft streamlined the Windows product engineering and release cycle so that we can deliver the features, experiences, and functionality customers want, more quickly than ever. We also created new ways to deliver and install feature updates and quality updates that simplify deployments and on-going management, broaden the base of employees who can be kept current with the latest Windows capabilities and experiences, and lower total cost of ownership. Hence we have implemented new servicing options – referred to as Current Branch (CB), Current Branch for Business (CBB), and Long-Term Servicing Branch (LTSB) – that provide pragmatic solutions to keep more devices more current in enterprise environments than was previously possible.
|
|
||||||
|
|
||||||
The following table shows describes the various servicing branches and their key attributes.
|
|
||||||
|
|
||||||
| Servicing option | Availability of new feature upgrades for installation | Minimum length of servicing lifetime | Key benefits | Supported editions |
|
|
||||||
|-----------------------------------|-----------------------------------------------------------|--------------------------------------|-------------------------------------------------------------------------------------------|--------------------------------------------------------------------------------------------|
|
|
||||||
| Current Branch (CB) | Immediately after first published by Microsoft | Approximately 4 months | Makes new features available to users as soon as possible | Home, Pro, Education, Enterprise, Mobile, IoT Core, Windows 10 IoT Core Pro (IoT Core Pro) |
|
|
||||||
| Current Branch for Business (CBB) | Approximately 4 months after first published by Microsoft | Approximately 8 months | Provides additional time to test new feature upgrades before deployment | Pro, Education, Enterprise, Mobile Enterprise, IoT Core Pro |
|
|
||||||
| Long-Term Servicing Branch (LTSB) | Immediately after published by Microsoft | 10 Years | Enables long-term deployment of selected Windows 10 releases in low-change configurations | Enterprise LTSB |
|
|
||||||
|
|
||||||
For more information, see [Windows 10 servicing options for updates and upgrades](introduction-to-windows-10-servicing.md).
|
|
||||||
|
|
||||||
## Supporting apps in Windows as a service
|
|
||||||
|
|
||||||
The traditional approach for supporting apps has been to release a new app version in response to a Windows release. This assumes that there are breaking changes in the underlying OS that could potentially cause a regression with the application. This model involves a dedicated development and validation cycle that requires our ISV partners to align with the Windows release cadence.
|
|
||||||
|
|
||||||
In the Windows as a service model, Microsoft is making a commitment to maintaining the compatibility of the underlying OS. This means Microsoft will make a concerted effort to ensure that there are no breaking changes that impact the app ecosystem negatively. In this scenario, when there is a release of a Windows build, most apps (those with no kernel dependencies) will continue to work.
|
|
||||||
|
|
||||||
In view of this change, Microsoft recommends that our ISV partners decouple their app release and support from specific Windows builds. Our mutual customers are better served by an application lifecycle approach. This means when an application version is released it will be supported for a certain period of time irrespective of however many Windows builds are released in the interim. The ISV makes a commitment to provide support for that specific version of the app as long as it is supported in the lifecycle. Microsoft follows a similar lifecycle approach for Windows that can be referenced [here](https://go.microsoft.com/fwlink/?LinkID=780549).
|
|
||||||
|
|
||||||
This approach will reduce the burden of maintaining an app schedule that aligns with Windows releases. ISV partners should be free to release features or updates at their own cadence. We feel that our partners can keep their customer base updated with the latest app updates independent of a Windows release. In addition, our customers do not have to seek an explicit support statement whenever a Windows build is released. Here is an example of a support statement that covers how an app may be supported across different versions of the OS:
|
|
||||||
|
|
||||||
| Example of an application lifecycle support statement |
|
|
||||||
|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
|
|
||||||
| Contoso is a software development company and is the owner of the popular Mojave app which has a major share in the enterprise space. Contoso releases its next major release Mojave 14.0 and declares mainstream support for a period of three years from the release date. During mainstream support all updates and support are complimentary for the licensed product. Contoso also declares an additional two years of extended support where customers can purchase updates and support for a grace period. Beyond the extended support end date this product version is no longer supported. During the period of mainstream support Contoso will support Mojave 14.0 on all released builds of Windows. Contoso will also release updates to Mojave as necessary and independent of the Windows product releases. |
|
|
||||||
|
|
||||||
In the following sections, you will find additional information about the steps Microsoft takes to maintain the compatibility of the underlying OS. You will also find guidance on steps you can take to help maintain the compatibility of the combined OS and app ecosystem. There is a section on how to leverage Windows flighting builds to detect app regressions before a Windows build is released. Lastly, we describe how we use an instrumentation and telemetry-driven approach to increase the quality of Windows builds. We recommend ISVs adopt a similar approach with their app portfolio.
|
|
||||||
|
|
||||||
## Key changes since Windows 7 to ensure app compatibility
|
|
||||||
|
|
||||||
We understand that compatibility matters to developers. ISVs and developers want to ensure their apps will run as expected on all supported versions of the Windows OS. Consumers and businesses have a key investment here—they want to ensure that the apps they have paid for will continue to work. We know that compatibility is the primary criteria for purchase decisions. Apps that are well written based on best practices will lead to much less code churn when
|
|
||||||
a new Windows version is released and will reduce fragmentation—these apps have a reduced engineering investment to maintain, and a faster time to market.
|
|
||||||
|
|
||||||
In the Windows 7 timeframe, compatibility was very much a reactive approach. In Windows 8, we started looking at this differently, working within Windows to ensure that compatibility was by design rather than an afterthought.
|
|
||||||
Windows 10 is the most compatible-by-design version of the OS to date. Here are some key ways we accomplished this:
|
|
||||||
- **App telemetry**: This helps us understand app popularity in the Windows ecosystem to inform compatibility testing.
|
|
||||||
- **ISV partnerships**: Work directly with external partners to provide them with data and help fix issues that our users experience.
|
|
||||||
- **Design reviews, upstream detection**: Partner with feature teams to reduce the number of breaking changes in Windows. Compatibility review is a gate that our feature teams must pass.
|
|
||||||
- **Communication**: Tighter control over API changes and improved communication.
|
|
||||||
- **Flighting and feedback loop**: Windows insiders receive flighted builds that help improve our ability to find compatibility issues before a final build is released to customers. This feedback process not only exposes bugs, but ensures we are shipping features our users want.
|
|
||||||
|
|
||||||
## Best practices for app compatibility
|
|
||||||
|
|
||||||
Microsoft uses diagnostic and usage data to identify and troubleshoot problems, improve our products and services, and provide our users with personalized experiences. The usage data we collect also extends to the apps that PCs in the Windows ecosystem are running. Based on what our customers use, we build our list to test these apps, devices, and drivers against new versions of the Windows OS. Windows 10 has been the most compatible version of Windows to-date, with over 90% compatibility against thousands of popular apps. The Windows Compatibility team commonly reaches out to our ISV partners to provide feedback if issues are discovered, so that we can partner together on solutions. Ideally, we’d like our common customers to be able to update Windows seamlessly and without losing functionality in either their OS or the apps they depend on for their productivity or entertainment.
|
|
||||||
|
|
||||||
The following sections contain some best practices Microsoft recommends so you can ensure your apps are compatible with Windows 10.
|
|
||||||
|
|
||||||
### Windows version check
|
|
||||||
|
|
||||||
The OS version has been incremented with Windows 10. This means that the internal version number has been changed to 10.0. As in the past, we go to great lengths to maintain application and device compatibility after an OS version change. For most app categories (without any kernel dependencies), the change will not negatively impact app functionality, and existing apps will continue to work fine on Windows 10.
|
|
||||||
|
|
||||||
The manifestation of this change is app-specific. This means any app that specifically checks for the OS version will get a higher version number, which can lead to one or more of the following situations:
|
|
||||||
- App installers might not be able to install the app, and apps might not be able to start.
|
|
||||||
- Apps might become unstable or crash.
|
|
||||||
- Apps might generate error messages, but continue to function properly.
|
|
||||||
|
|
||||||
Some apps perform a version check and simply pass a warning to users. However, there are apps that are bound very tightly to a version check (in the drivers, or in kernel mode to avoid detection). In these cases, the app will fail if an incorrect version is found. Rather than a version check, we recommend one of the following approaches:
|
|
||||||
- If the app is dependent on specific API functionality, ensure you target the correct API version.
|
|
||||||
- Ensure you detect the change via APISet or another public API, and do not use the version as a proxy for some feature or fix. If there are breaking changes and a proper check is not exposed, then that is a bug.
|
|
||||||
- Ensure the app does NOT check for version in odd ways, such as via the registry, file versions, offsets, kernel mode, drivers, or other means. If the app absolutely needs to check the version, use the GetVersion APIs, which should return the major, minor, and build number.
|
|
||||||
- If you are using the [GetVersion](https://go.microsoft.com/fwlink/?LinkID=780555) API, remember that the behavior of this API has changed since Windows 8.1.
|
|
||||||
|
|
||||||
If you own apps such as antimalware or firewall apps, you should work through your usual feedback channels and via the Windows Insider program.
|
|
||||||
|
|
||||||
### Undocumented APIs
|
|
||||||
|
|
||||||
Your apps should not call undocumented Windows APIs, or take dependency on specific Windows file exports or registry keys. This can lead to broken functionality, data loss, and potential security issues. If there is functionality your app requires that is not available, this is an opportunity to provide feedback through your usual feedback channels and via the Windows Insider program.
|
|
||||||
|
|
||||||
### Develop Universal Windows Platform (UWP) and Centennial apps
|
|
||||||
|
|
||||||
We encourage all Win32 app ISVs to develop [Universal Windows Platform (UWP)](https://go.microsoft.com/fwlink/?LinkID=780560) and, specifically, [Centennial](https://go.microsoft.com/fwlink/?LinkID=780562) apps moving forward. There are great benefits to developing these app packages rather than using traditional Win32 installers. UWP apps are also supported in the [Windows Store](https://go.microsoft.com/fwlink/?LinkID=780563), so it’s easier for you to update your users to a consistent version automatically, lowering your support costs.
|
|
||||||
|
|
||||||
If your Win32 app types do not work with the Centennial model, we highly recommend that you use the right installer and ensure this is fully tested. An installer is your user or customer’s first experience with your app, so ensure that this works well. All too often, this doesn’t work well or it hasn’t been fully tested for all scenarios. The [Windows App Certification Kit](https://go.microsoft.com/fwlink/?LinkID=780565) can help you test the install and uninstall of your Win32 app and help you identify use of undocumented APIs, as well as other basic performance-related best-practice issues, before your users do.
|
|
||||||
|
|
||||||
**Best practices:**
|
|
||||||
- Use installers that work for both 32-bit and 64-bit versions of Windows.
|
|
||||||
- Design your installers to run on multiple scenarios (user or machine level).
|
|
||||||
- Keep all Windows redistributables in the original packaging – if you repackage these, it’s possible that this will break the installer.
|
|
||||||
- Schedule development time for your installers—these are often overlooked as a deliverable during the software development lifecycle.
|
|
||||||
|
|
||||||
## Optimized test strategies and flighting
|
|
||||||
|
|
||||||
Windows OS flighting refers to the interim builds available to Windows Insiders before a final build is released to the general population. The more Insiders that flight these interim builds, the more feedback we receive on the build quality, compatibility, etc., and this helps improve quality of the final builds. You can participate in this flighting program to ensure that your apps work as expected on iterative builds of the OS. We also encourage you to provide feedback on how these flighted builds are working for you, issues you run into, and so on.
|
|
||||||
|
|
||||||
If your app is in the Store, you can flight your app via the Store, which means that your app will be available for our Windows Insider population to install. Users can install your app and you can receive preliminary feedback on your app before you release it to the general population. The follow sections outline the steps for testing your apps against Windows flighted builds.
|
|
||||||
|
|
||||||
### Step 1: Become a Windows Insider and participate in flighting
|
|
||||||
As a [Windows Insider,](https://go.microsoft.com/fwlink/p/?LinkId=521639) you can help shape the future of Windows—your feedback will help us improve features and functionality in the platform. This is a vibrant community where you can connect with other enthusiasts, join forums, trade advice, and learn about upcoming Insider-only events.
|
|
||||||
|
|
||||||
Since you’ll have access to preview builds of Windows 10, Windows 10 Mobile, and the latest Windows SDK and Emulator, you’ll have all the tools at your disposal to develop great apps and explore what's new in the Universal Windows Platform and the Windows Store.
|
|
||||||
|
|
||||||
This is also a great opportunity to build great hardware, with preview builds of the hardware development kits so you can develop universal drivers for Windows. The IoT Core Insider Preview is also available on supported IoT development boards, so you can build amazing connected solutions using the Universal Windows Platform.
|
|
||||||
|
|
||||||
Before you become a Windows Insider, please note that participation is intended for users who:
|
|
||||||
- Want to try out software that’s still in development.
|
|
||||||
- Want to share feedback about the software and the platform.
|
|
||||||
- Don’t mind lots of updates or a UI design that might change significantly over time.
|
|
||||||
- Really know their way around a PC and feel comfortable troubleshooting problems, backing up data, formatting a hard drive, installing an operating system from scratch, or restoring an old one if necessary.
|
|
||||||
- Know what an ISO file is and how to use it.
|
|
||||||
- Aren't installing it on their everyday computer or device.
|
|
||||||
|
|
||||||
### Step 2: Test your scenarios
|
|
||||||
|
|
||||||
Once you have updated to a flighted build, the following are some sample test cases to help you get started on testing and gathering feedback. For most of these tests, ensure you cover both x86 and AMD64 systems.
|
|
||||||
**Clean install test:** On a clean install of Windows 10, ensure your app is fully functional. If your app fails this test and the upgrade test, then it’s likely that the issue is caused by underlying OS changes or bugs in the app.
|
|
||||||
If after investigation, the former is the case, be sure to use the Windows Insider program to provide feedback and partner on solutions.
|
|
||||||
|
|
||||||
**Upgrade Test:** Check that your app works after upgrading from a down-level version of Windows (i.e. Windows 7 or Windows 8.1) to Windows 10. Your app shouldn’t cause roll backs during upgrade, and should continue to work as expected after upgrade—this is crucial to achieve a seamless upgrade experience.
|
|
||||||
|
|
||||||
**Reinstall Test:** Ensure that app functionality can be restored by reinstalling your app after you upgrade the PC to Windows 10 from a down-level OS. If your app didn’t pass the upgrade test and you have not been able to narrow down the cause of these issues, it’s possible that a reinstall can restore lost functionality. A passing reinstall test indicates that parts of the app may not have been migrated to Windows 10.
|
|
||||||
|
|
||||||
**OS\\Device Features Test:** Ensure that your app works as expected if your app relies on specific functionality in the OS. Common areas for testing include the following, often against a selection of the commonly used PC models to ensure coverage:
|
|
||||||
- Audio
|
|
||||||
- USB device functionality (keyboard, mouse, memory stick, external hard disk, and so on)
|
|
||||||
- Bluetooth
|
|
||||||
- Graphics\\display (multi-monitor, projection, screen rotation, and so on)
|
|
||||||
- Touch screen (orientation, on-screen keyboard, pen, gestures, and so on)
|
|
||||||
- Touchpad (left\\right buttons, tap, scroll, and so on)
|
|
||||||
- Pen (single\\double tap, press, hold, eraser, and so on)
|
|
||||||
- Print\\Scan
|
|
||||||
- Sensors (accelerometer, fusion, and so on)
|
|
||||||
- Camera
|
|
||||||
|
|
||||||
### Step 3: Provide feedback
|
|
||||||
|
|
||||||
Let us know how your app is performing against flighted builds. As you discover issues with your app during testing, please log bugs via the partner portal if you have access, or through your Microsoft representative. We encourage this information so that we can build a quality experience for our users together.
|
|
||||||
|
|
||||||
### Step 4: Register on Windows 10
|
|
||||||
The [Ready for Windows 10](https://go.microsoft.com/fwlink/?LinkID=780580) website is a directory of software that supports Windows 10. It’s intended for IT administrators at companies and organizations worldwide that are considering Windows 10 for their deployments. IT administrators can check the site to see whether software deployed in their enterprise is supported in Windows 10.
|
|
||||||
|
|
||||||
## Related topics
|
|
||||||
[Windows 10 servicing options for updates and upgrades](introduction-to-windows-10-servicing.md)
|
|
||||||
|
|
||||||
|
|
||||||
@ -1,4 +0,0 @@
|
|||||||
---
|
|
||||||
title: Accessibility for App-V (Windows 10)
|
|
||||||
redirect_url: https://technet.microsoft.com/itpro/windows/manage/appv-getting-started
|
|
||||||
---
|
|
||||||
@ -1,4 +0,0 @@
|
|||||||
---
|
|
||||||
title: How to access the client management console (Windows 10)
|
|
||||||
redirect_url: https://technet.microsoft.com/itpro/windows/manage/appv-using-the-client-management-console
|
|
||||||
---
|
|
||||||
@ -1,4 +0,0 @@
|
|||||||
---
|
|
||||||
title: How to Install the App-V Client for Shared Content Store Mode (Windows 10)
|
|
||||||
redirect_url: https://technet.microsoft.com/itpro/windows/manage/appv-deploying-the-appv-sequencer-and-client
|
|
||||||
---
|
|
||||||
@ -1,4 +0,0 @@
|
|||||||
---
|
|
||||||
title: How to Modify App-V Client Configuration Using the ADMX Template and Group Policy (Windows 10)
|
|
||||||
redirect_url: https://technet.microsoft.com/itpro/windows/manage/appv-deploying-the-appv-sequencer-and-client
|
|
||||||
---
|
|
||||||
@ -1,4 +0,0 @@
|
|||||||
---
|
|
||||||
title: Planning for Migrating from a Previous Version of App-V (Windows 10)
|
|
||||||
redirect_url: https://technet.microsoft.com/itpro/windows/manage/appv-migrating-to-appv-from-a-previous-version
|
|
||||||
---
|
|
||||||
@ -22,6 +22,7 @@ The topics in this library have been updated for Windows 10, version 1703 (also
|
|||||||
|
|
||||||
| New or changed topic | Description |
|
| New or changed topic | Description |
|
||||||
| --- | --- |
|
| --- | --- |
|
||||||
|
| [Windows Libraries](windows-libraries.md) | New |
|
||||||
| [Monitor Windows Updates with Update Compliance](update-compliance-monitor.md) | New |
|
| [Monitor Windows Updates with Update Compliance](update-compliance-monitor.md) | New |
|
||||||
| [Get started with Update Compliance](update-compliance-get-started.md) | New |
|
| [Get started with Update Compliance](update-compliance-get-started.md) | New |
|
||||||
| [Use Update Compliance to monitor Windows Updates](update-compliance-using.md) | New |
|
| [Use Update Compliance to monitor Windows Updates](update-compliance-using.md) | New |
|
||||||
@ -33,7 +34,7 @@ The topics in this library have been updated for Windows 10, version 1703 (also
|
|||||||
|
|
||||||
| New or changed topic | Description |
|
| New or changed topic | Description |
|
||||||
| --- | --- |
|
| --- | --- |
|
||||||
| [Cortana integration in your business or enterprise](cortana-at-work-overview.md) | New |
|
|[Cortana at work topics](../configure/cortana-at-work-overview.md)]|New |
|
||||||
| [Start layout XML for desktop editions of Windows 10](start-layout-xml-desktop.md) | New (previously published in Hardware Dev Center on MSDN) |
|
| [Start layout XML for desktop editions of Windows 10](start-layout-xml-desktop.md) | New (previously published in Hardware Dev Center on MSDN) |
|
||||||
| [Start layout XML for mobile editions of Windows 10](start-layout-xml-mobile.md) | New (previously published in Hardware Dev Center on MSDN) |
|
| [Start layout XML for mobile editions of Windows 10](start-layout-xml-mobile.md) | New (previously published in Hardware Dev Center on MSDN) |
|
||||||
| [Quick guide to Windows as a service](waas-quick-start.md) | Added video that explains how Windows as a service works. |
|
| [Quick guide to Windows as a service](waas-quick-start.md) | Added video that explains how Windows as a service works. |
|
||||||
@ -60,7 +61,7 @@ The topics in this library have been updated for Windows 10, version 1703 (also
|
|||||||
| --- | --- |
|
| --- | --- |
|
||||||
| [Manage device restarts after updates](waas-restart.md) | New |
|
| [Manage device restarts after updates](waas-restart.md) | New |
|
||||||
| [Manage Windows 10 in your organization - transitioning to modern management](manage-windows-10-in-your-organization-modern-management.md) | New |
|
| [Manage Windows 10 in your organization - transitioning to modern management](manage-windows-10-in-your-organization-modern-management.md) | New |
|
||||||
| [Cortana integration in your business or enterprise](manage-cortana-in-enterprise.md) |Added an important note about Cortana and Office 365 integration. |
|
| [Cortana integration in your business or enterprise](../configure/cortana-at-work-overview.md) |Added an important note about Cortana and Office 365 integration. |
|
||||||
| [Customize Windows 10 Start and taskbar with Group Policy](customize-windows-10-start-screens-by-using-group-policy.md) | Fixed the explanation for Start behavior when the .xml file containing the layout is not available when the user signs in. |
|
| [Customize Windows 10 Start and taskbar with Group Policy](customize-windows-10-start-screens-by-using-group-policy.md) | Fixed the explanation for Start behavior when the .xml file containing the layout is not available when the user signs in. |
|
||||||
| [Manage connections from Windows operating system components to Microsoft services](manage-connections-from-windows-operating-system-components-to-microsoft-services.md) | Added link to the Windows Restricted Traffic Limited Functionality Baseline. Added Teredo Group Policy. |
|
| [Manage connections from Windows operating system components to Microsoft services](manage-connections-from-windows-operating-system-components-to-microsoft-services.md) | Added link to the Windows Restricted Traffic Limited Functionality Baseline. Added Teredo Group Policy. |
|
||||||
| [Manage updates for Windows 10 Mobile Enterprise and Windows 10 IoT Mobile](waas-mobile-updates.md) | Added Current Branch for Business (CBB) support for Windows 10 IoT Mobile. |
|
| [Manage updates for Windows 10 Mobile Enterprise and Windows 10 IoT Mobile](waas-mobile-updates.md) | Added Current Branch for Business (CBB) support for Windows 10 IoT Mobile. |
|
||||||
@ -71,7 +72,7 @@ The topics in this library have been updated for Windows 10, version 1703 (also
|
|||||||
| New or changed topic | Description |
|
| New or changed topic | Description |
|
||||||
| --- | --- |
|
| --- | --- |
|
||||||
| [Update Windows 10 in the enterprise](waas-update-windows-10.md), replaces **Windows 10 servicing options** | New |
|
| [Update Windows 10 in the enterprise](waas-update-windows-10.md), replaces **Windows 10 servicing options** | New |
|
||||||
| [Lockdown features from Windows Embedded 8.1 Industry](lockdown-features-windows-10.md) | Added Group Policy setting to replace Gesture Filter |
|
| [Lockdown features from Windows Embedded 8.1 Industry](../configure/lockdown-features-windows-10.md) | Added Group Policy setting to replace Gesture Filter |
|
||||||
| [Manage connections from Windows operating system components to Microsoft services](manage-connections-from-windows-operating-system-components-to-microsoft-services.md) | Added content for Windows Server 2016 |
|
| [Manage connections from Windows operating system components to Microsoft services](manage-connections-from-windows-operating-system-components-to-microsoft-services.md) | Added content for Windows Server 2016 |
|
||||||
| [Set up a kiosk on Windows 10 Pro, Enterprise, or Education](set-up-a-kiosk-for-windows-10-for-desktop-editions.md) | Updated the script for setting a custom shell using Shell Launcher. |
|
| [Set up a kiosk on Windows 10 Pro, Enterprise, or Education](set-up-a-kiosk-for-windows-10-for-desktop-editions.md) | Updated the script for setting a custom shell using Shell Launcher. |
|
||||||
|
|
||||||
@ -138,7 +139,7 @@ The topics in this library have been updated for Windows 10, version 1607 (also
|
|||||||
| ---|---|
|
| ---|---|
|
||||||
| [Application development for Windows as a service](application-development-for-windows-as-a-service.md) | New |
|
| [Application development for Windows as a service](application-development-for-windows-as-a-service.md) | New |
|
||||||
| [Join Windows 10 Mobile to Azure Active Directory](join-windows-10-mobile-to-azure-active-directory.md) | New |
|
| [Join Windows 10 Mobile to Azure Active Directory](join-windows-10-mobile-to-azure-active-directory.md) | New |
|
||||||
| [Cortana integration in your business or enterprise](manage-cortana-in-enterprise.md) | Updated to include the new Preview feature, Cortana and Microsoft Dynamics CRM integration. |
|
| [Cortana integration in your business or enterprise](../configure/cortana-at-work-overview.md) | Updated to include the new Preview feature, Cortana and Microsoft Dynamics CRM integration. |
|
||||||
|
|
||||||
## February 2016
|
## February 2016
|
||||||
|
|
||||||
@ -156,7 +157,7 @@ The topics in this library have been updated for Windows 10, version 1607 (also
|
|||||||
|
|
||||||
| New or changed topic | Description |
|
| New or changed topic | Description |
|
||||||
| ---|---|
|
| ---|---|
|
||||||
| [Cortana integration in your business or enterprise](manage-cortana-in-enterprise.md) | New |
|
| [Cortana integration in your business or enterprise](../configure/cortana-at-work-overview.md) | New |
|
||||||
| [Manage Wi-Fi Sense in your company](manage-wifi-sense-in-enterprise.md) | New |
|
| [Manage Wi-Fi Sense in your company](manage-wifi-sense-in-enterprise.md) | New |
|
||||||
| [Customize Windows 10 Start with mobile device management (MDM)](customize-windows-10-start-screens-by-using-mobile-device-management.md) | New |
|
| [Customize Windows 10 Start with mobile device management (MDM)](customize-windows-10-start-screens-by-using-mobile-device-management.md) | New |
|
||||||
|
|
||||||
@ -189,4 +190,4 @@ The topics in this library have been updated for Windows 10, version 1607 (also
|
|||||||
|
|
||||||
[Change history for Keep Windows 10 secure](../keep-secure/change-history-for-keep-windows-10-secure.md)
|
[Change history for Keep Windows 10 secure](../keep-secure/change-history-for-keep-windows-10-secure.md)
|
||||||
|
|
||||||
|
|
||||||
|
|||||||
@ -1,172 +0,0 @@
|
|||||||
---
|
|
||||||
title: Changes to Group Policy settings for Windows 10 Start menu (Windows 10)
|
|
||||||
description: Windows 10 has a brand new Start experience.
|
|
||||||
ms.assetid: 612FB68A-3832-451F-AA97-E73791FEAA9F
|
|
||||||
keywords: ["group policy", "start menu", "start screen"]
|
|
||||||
ms.prod: w10
|
|
||||||
ms.mktglfcycl: manage
|
|
||||||
ms.sitesec: library
|
|
||||||
author: jdeckerMS
|
|
||||||
localizationpriority: high
|
|
||||||
---
|
|
||||||
|
|
||||||
# Changes to Group Policy settings for Windows 10 Start
|
|
||||||
|
|
||||||
|
|
||||||
**Applies to**
|
|
||||||
|
|
||||||
- Windows 10
|
|
||||||
|
|
||||||
Windows 10 has a brand new Start experience. As a result, there are changes to the Group Policy settings that you can use to manage Start. Some policy settings are new or changed, and some old Start policy settings still apply. Other Start policy settings no longer apply and are deprecated.
|
|
||||||
|
|
||||||
## Start policy settings supported for Windows 10 Pro, Windows 10 Enterprise, and Windows 10 Education
|
|
||||||
|
|
||||||
|
|
||||||
These policy settings are available in **Administrative Templates\\Start Menu and Taskbar** under **User Configuration**.
|
|
||||||
|
|
||||||
<table>
|
|
||||||
|
|
||||||
<thead>
|
|
||||||
<tr class="header">
|
|
||||||
<th align="left">Policy</th>
|
|
||||||
<th align="left">Notes</th>
|
|
||||||
</tr>
|
|
||||||
</thead>
|
|
||||||
<tbody>
|
|
||||||
<tr class="odd">
|
|
||||||
<td align="left">Clear history of recently opened documents on exit</td>
|
|
||||||
<td align="left">Documents that the user opens are tracked during the session. When the user signs off, the history of opened documents is deleted.</td>
|
|
||||||
</tr>
|
|
||||||
<tr class="even">
|
|
||||||
<td align="left">Do not allow pinning items in Jump Lists</td>
|
|
||||||
<td align="left">Jump Lists are lists of recently opened items, such as files, folders, or websites, organized by the program that you use to open them. This policy prevents users from pinning items to any Jump List.</td>
|
|
||||||
</tr>
|
|
||||||
<tr class="odd">
|
|
||||||
<td align="left">Do not display or track items in Jump Lists from remote locations</td>
|
|
||||||
<td align="left">When this policy is applied, only items local on the computer are shown in Jump Lists.</td>
|
|
||||||
</tr>
|
|
||||||
<tr class="even">
|
|
||||||
<td align="left">Do not keep history of recently opened documents</td>
|
|
||||||
<td align="left">Documents that the user opens are not tracked during the session.</td>
|
|
||||||
</tr>
|
|
||||||
<tr class="odd">
|
|
||||||
<td align="left">Prevent changes to Taskbar and Start Menu Settings</td>
|
|
||||||
<td align="left">In Windows 10, this disables all of the settings in <strong>Settings</strong> > <strong>Personalization</strong> > <strong>Start</strong> as well as the options in dialog available via right-click Taskbar > <strong>Properties</strong></td>
|
|
||||||
</tr>
|
|
||||||
<tr class="even">
|
|
||||||
<td align="left">Prevent users from customizing their Start Screen</td>
|
|
||||||
<td align="left"><p>Use this policy in conjunction with [CopyProfile](https://go.microsoft.com/fwlink/p/?LinkId=623229) or other methods for configuring the layout of Start to prevent users from changing it</p></td>
|
|
||||||
</tr>
|
|
||||||
<tr class="odd">
|
|
||||||
<td align="left">Prevent users from uninstalling applications from Start</td>
|
|
||||||
<td align="left">In Windows 10, this removes the uninstall button in the context menu. It does not prevent users from uninstalling the app through other entry points (e.g. PowerShell)</td>
|
|
||||||
</tr>
|
|
||||||
<tr class="even">
|
|
||||||
<td align="left">Remove All Programs list from the Start menu</td>
|
|
||||||
<td align="left">In Windows 10, this removes the <strong>All apps</strong> button.</td>
|
|
||||||
</tr>
|
|
||||||
<tr class="odd">
|
|
||||||
<td align="left">Remove and prevent access to the Shut Down, Restart, Sleep, and Hibernate commands</td>
|
|
||||||
<td align="left">This removes the Shut Down, Restart, Sleep, and Hibernate commands from the Start Menu, Start Menu power button, CTRL+ALT+DEL screen, and Alt+F4 Shut Down Windows menu.</td>
|
|
||||||
</tr>
|
|
||||||
<tr class="even">
|
|
||||||
<td align="left">Remove common program groups from Start Menu</td>
|
|
||||||
<td align="left">As in earlier versions of Windows, this removes apps specified in the All Users profile from Start</td>
|
|
||||||
</tr>
|
|
||||||
<tr class="odd">
|
|
||||||
<td align="left">Remove frequent programs list from the Start Menu</td>
|
|
||||||
<td align="left">In Windows 10, this removes the top left <strong>Most used</strong> group of apps.</td>
|
|
||||||
</tr>
|
|
||||||
<tr class="even">
|
|
||||||
<td align="left">Remove Logoff on the Start Menu</td>
|
|
||||||
<td align="left"><strong>Logoff</strong> has been changed to <strong>Sign Out</strong> in the user interface, however the functionality is the same.</td>
|
|
||||||
</tr>
|
|
||||||
<tr class="odd">
|
|
||||||
<td align="left">Remove pinned programs list from the Start Menu</td>
|
|
||||||
<td align="left">In Windows 10, this removes the bottom left group of apps (by default, only File Explorer and Settings are pinned).</td>
|
|
||||||
</tr>
|
|
||||||
<tr class="even">
|
|
||||||
<td align="left">Show "Run as different user" command on Start</td>
|
|
||||||
<td align="left">This enables the <strong>Run as different user</strong> option in the right-click menu for apps.</td>
|
|
||||||
</tr>
|
|
||||||
<tr class="odd">
|
|
||||||
<td align="left">Start Layout</td>
|
|
||||||
<td align="left"><p>This applies a specific Start layout, and it also prevents users from changing the layout. This policy can be configured in <strong>User Configuration</strong> or <strong>Computer Configuration</strong>.</p>
|
|
||||||
<div class="alert">
|
|
||||||
<strong>Note</strong>
|
|
||||||
<p>Start Layout policy setting applies only to Windows 10 Enterprise and Windows 10 Education.</p>
|
|
||||||
</div>
|
|
||||||
<div>
|
|
||||||
|
|
||||||
</div></td>
|
|
||||||
</tr>
|
|
||||||
<tr class="even">
|
|
||||||
<td align="left">Force Start to be either full screen size or menu size</td>
|
|
||||||
<td align="left">This applies a specific size for Start.</td>
|
|
||||||
</tr>
|
|
||||||
</tbody>
|
|
||||||
</table>
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
## <a href="" id="deprecated-group-policy-settings-for-start-"></a>Deprecated Group Policy settings for Start
|
|
||||||
|
|
||||||
|
|
||||||
The Start policy settings listed below do not work on Windows 10. Most of them were deprecated in Windows 8 however a few more were deprecated in Windows 10. Deprecation in this case means that the policy setting will not work on Windows 10. The “Supported on” text for a policy setting will not list Windows 10. The policy settings are still in the Group Policy Management Console and can be used on the operating systems that they apply to.
|
|
||||||
|
|
||||||
| Policy | When deprecated |
|
|
||||||
|----------------------------------------------------------------------------------|-----------------|
|
|
||||||
| Go to the desktop instead of Start when signing in | Windows 10 |
|
|
||||||
| List desktop apps first in the Apps view | Windows 10 |
|
|
||||||
| Pin Apps to Start when installed (User or Computer) | Windows 10 |
|
|
||||||
| Remove Default Programs link from the Start menu. | Windows 10 |
|
|
||||||
| Remove Documents icon from Start Menu | Windows 10 |
|
|
||||||
| Remove programs on Settings menu | Windows 10 |
|
|
||||||
| Remove Run menu from Start Menu | Windows 10 |
|
|
||||||
| Remove the "Undock PC" button from the Start Menu | Windows 10 |
|
|
||||||
| Search just apps from the Apps view | Windows 10 |
|
|
||||||
| Show Start on the display the user is using when they press the Windows logo key | Windows 10 |
|
|
||||||
| Show the Apps view automatically when the user goes to Start | Windows 10 |
|
|
||||||
| Add the Run command to the Start Menu | Windows 8 |
|
|
||||||
| Change Start Menu power button | Windows 8 |
|
|
||||||
| Gray unavailable Windows Installer programs Start Menu shortcuts | Windows 8 |
|
|
||||||
| Remove Downloads link from Start Menu | Windows 8 |
|
|
||||||
| Remove Favorites menu from Start Menu | Windows 8 |
|
|
||||||
| Remove Games link from Start Menu | Windows 8 |
|
|
||||||
| Remove Help menu from Start Menu | Windows 8 |
|
|
||||||
| Remove Homegroup link from Start Menu | Windows 8 |
|
|
||||||
| Remove Music icon from Start Menu | Windows 8 |
|
|
||||||
| Remove Network icon from Start Menu | Windows 8 |
|
|
||||||
| Remove Pictures icon from Start Menu | Windows 8 |
|
|
||||||
| Remove Recent Items menu from Start Menu | Windows 8 |
|
|
||||||
| Remove Recorded TV link from Start Menu | Windows 8 |
|
|
||||||
| Remove user folder link from Start Menu | Windows 8 |
|
|
||||||
| Remove Videos link from Start Menu | Windows 8 |
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
## Related topics
|
|
||||||
|
|
||||||
|
|
||||||
[Manage corporate devices](manage-corporate-devices.md)
|
|
||||||
|
|
||||||
[New policies for Windows 10](new-policies-for-windows-10.md)
|
|
||||||
|
|
||||||
[Manage Windows 10 Start layout options](windows-10-start-layout-options-and-policies.md)
|
|
||||||
|
|
||||||
[Customize and export Start layout](customize-and-export-start-layout.md)
|
|
||||||
|
|
||||||
[Customize Windows 10 Start screens with Group Policy](customize-windows-10-start-screens-by-using-group-policy.md)
|
|
||||||
|
|
||||||
[Customize Windows 10 Start screens with mobile device management (MDM)](customize-windows-10-start-screens-by-using-mobile-device-management.md)
|
|
||||||
|
|
||||||
[Customize Windows 10 Start screens with ICD and provisioning packages](customize-windows-10-start-screens-by-using-provisioning-packages-and-icd.md)
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
@ -1,203 +0,0 @@
|
|||||||
---
|
|
||||||
title: Configure devices without MDM (Windows 10)
|
|
||||||
description: Create a runtime provisioning package to apply settings, profiles, and file assets to a device running Windows 10.
|
|
||||||
ms.assetid: 66D14E97-E116-4218-8924-E2A326C9367E
|
|
||||||
keywords: runtime provisioning, provisioning package
|
|
||||||
ms.prod: w10
|
|
||||||
ms.mktglfcycl: manage
|
|
||||||
ms.sitesec: library
|
|
||||||
ms.pagetype: mobile, devices
|
|
||||||
author: jdeckerMS
|
|
||||||
localizationpriority: medium
|
|
||||||
---
|
|
||||||
|
|
||||||
# Configure devices without MDM
|
|
||||||
|
|
||||||
|
|
||||||
**Applies to**
|
|
||||||
|
|
||||||
- Windows 10
|
|
||||||
- Windows 10 Mobile
|
|
||||||
|
|
||||||
Create a runtime provisioning package to apply settings, profiles, and file assets to a device running Windows 10 Pro, Windows 10 Enterprise, Windows 10 Education, Windows 10 Mobile, or Windows 10 Mobile Enterprise.
|
|
||||||
|
|
||||||
Sometimes mobile device management (MDM) isn't available to you for setting up a device because the device isn't connected to your network, or because an employee is remote and needs a fast replacement for a work device. You might not use MDM in your organization at all, but would like an easy way to place a standard configuration on multiple devices.
|
|
||||||
|
|
||||||
Rather than wiping a device and applying a new system image, in Windows 10 you can apply a provisioning package at any time. A provisioning package can include management instructions and policies, installation of specific apps, customization of network connections and policies, and more.
|
|
||||||
|
|
||||||
You can provide provisioning packages on a network shared folder that employees can access to configure their devices. Or you can put a provisioning package on a USB flash drive or SD card to hand out.
|
|
||||||
|
|
||||||
Provisioning packages are simple for employees to install. And when they remove a provisioning package, policies that the package applied to their device are removed.
|
|
||||||
|
|
||||||
## Advantages
|
|
||||||
|
|
||||||
|
|
||||||
- You can configure new devices without re-imaging.
|
|
||||||
|
|
||||||
- Works on both mobile and desktop devices.
|
|
||||||
|
|
||||||
- No network connectivity required.
|
|
||||||
|
|
||||||
- Simple for people to apply.
|
|
||||||
|
|
||||||
- Ensures compliance and security before a device is enrolled in MDM.
|
|
||||||
|
|
||||||
## Typical use cases
|
|
||||||
|
|
||||||
|
|
||||||
- **Set up a new off-the-shelf device for an employee**
|
|
||||||
|
|
||||||
Package might include edition upgrade, device name, company root certificate, Wi-Fi profile, domain join with service account, or company application.
|
|
||||||
|
|
||||||
- **Configure an off-the-shelf mobile device to be used as a point of sale or inventory terminal**
|
|
||||||
|
|
||||||
Package might include edition upgrade, device name, company root certificate, Wi-Fi profile, security policies, company application, or assigned access (also known as [kiosk mode](set-up-a-device-for-anyone-to-use.md).
|
|
||||||
|
|
||||||
- **Help employees set up personally-owned devices to use for work**
|
|
||||||
|
|
||||||
Package might include company root certificate, Wi-Fi profiles, security policies, or company application.
|
|
||||||
|
|
||||||
> [!NOTE]
|
|
||||||
> Test to make sure that removing the provisioning package from a personal device removes everything that the package installed. Some settings are not reverted when a provisioning package is removed from the device.
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
- **Repurpose devices by returning the device to a specific state between users**
|
|
||||||
|
|
||||||
Package might include computer name, company root certificate, Wi-Fi profile, or company application.
|
|
||||||
|
|
||||||
> [!NOTE]
|
|
||||||
> To return the **Start** menu to a specific state, you must reset the device. When you reset the device, you can apply the provisioning package during the first-run experience.
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
For details about the settings you can customize in provisioning packages, see [Windows Provisioning settings reference]( https://go.microsoft.com/fwlink/p/?LinkId=619012).
|
|
||||||
|
|
||||||
## Create a provisioning package
|
|
||||||
|
|
||||||
Use the Windows Imaging and Configuration Designer (ICD) tool included in the Windows Assessment and Deployment Kit (ADK) for Windows 10 to create a runtime provisioning package. [Install the ADK.](https://developer.microsoft.com/windows/hardware/windows-assessment-deployment-kit)
|
|
||||||
|
|
||||||
When you run Windows ICD, you have several options for creating your package.
|
|
||||||
|
|
||||||
.
|
|
||||||
|
|
||||||
- Choose **Simple provisioning** to define a desired configuration in Windows ICD and then apply that configuration on target devices. The simple provisioning wizard makes the entire process quick and easy by guiding an IT administrator through common configuration settings in a step-by-step manner.
|
|
||||||
- Choose **Provision school devices** to quickly create provisioning packages that configure settings and policies tailored for students. Learn more about using Windows ICD to provision student PCs (link tb added).
|
|
||||||
- Choose **Advanced provisioning** to create provisioning packages in the advanced settings editor and include classic (Win32) and Universal Windows Platform (UWP) apps for deployment on end-user devices.
|
|
||||||
|
|
||||||
> [!IMPORTANT]
|
|
||||||
> When you build a provisioning package, you may include sensitive information in the project files and in the provisioning package (.ppkg) file. Although you have the option to encrypt the .ppkg file, project files are not encrypted. You should store the project files in a secure location and delete the project files when they are no longer needed.
|
|
||||||
|
|
||||||
### Using Simple provisioning
|
|
||||||
|
|
||||||
1. Open Windows ICD (by default, `%windir%\\Program Files (x86)\\Windows Kits\\10\\Assessment and Deployment Kit\\Imaging and Configuration Designer\\x86\\ICD.exe`).
|
|
||||||
2. Click **Simple provisioning**.
|
|
||||||
2. Name your project and click **Finish**.
|
|
||||||
3. In the **Set up device** step, enter a unique 15-character name for the device. For help generating a unique name, you can use %SERIAL%, which includes a hardware-specific serial number, or you can use %RAND:x%, which generates random characters of x length.
|
|
||||||
4. (Optional) You can upgrade the following editions of Windows 10 by providing a product key for the edition to upgrade to.
|
|
||||||
- Home to Education
|
|
||||||
- Pro to Education
|
|
||||||
- Pro to Enterprise
|
|
||||||
- Enterprise to Education
|
|
||||||
- Mobile to Mobile Enterprise
|
|
||||||
5. Click **Set up network**.
|
|
||||||
6. Toggle **On** or **Off** for wireless network connectivity. If you select **On**, enter the SSID, type, and (if required) password for the wireless network.
|
|
||||||
7. Click **Enroll into Active Directory**.
|
|
||||||
8. Toggle **Yes** or **No** for Active Directory enrollment. If you select **Yes**, enter the credentials for an account with permissions to enroll the device. (Optional) Enter a user name and password to create a local administrator account.
|
|
||||||
|
|
||||||
> [!WARNING]
|
|
||||||
> If you don't create a local administrator account and the device fails to enroll in Active Directory for any reason, you will have to reimage the device and start over. As a best practice, we recommend:
|
|
||||||
>
|
|
||||||
>- Use a least-privileged domain account to join the device to the domain.
|
|
||||||
>- Create a temporary administrator account to use for debugging or reprovisioning if the device fails to enroll successfully.
|
|
||||||
>- [Use Group Policy to delete the temporary administrator account](https://blogs.technet.microsoft.com/canitpro/2014/12/10/group-policy-creating-a-standard-local-admin-account/) after the device is enrolled in Active Directory.
|
|
||||||
|
|
||||||
9. Click **Finish**.
|
|
||||||
10. Review your settings in the summary. You can return to previous pages to change your selections. Then, under **Protect your package**, toggle **Yes** or **No** to encrypt the provisioning package. If you select **Yes**, enter a password. This password must be entered to apply the encrypted provisioning package.
|
|
||||||
11. Click **Create**.
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
### Using Advanced provisioning
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
1. Open Windows ICD (by default, %windir%\\Program Files (x86)\\Windows Kits\\10\\Assessment and Deployment Kit\\Imaging and Configuration Designer\\x86\\ICD.exe).
|
|
||||||
2. Click **Advanced provisioning**.
|
|
||||||
3. Choose **New provisioning package**.
|
|
||||||
3. Name your project, and click **Next**.
|
|
||||||
4. Choose **All Windows editions**, **All Windows desktop editions**, or **All Windows mobile editions**, depending on the devices you intend to provision, and click **Next**.
|
|
||||||
5. On **New project**, click **Finish**. The workspace for your package opens.
|
|
||||||
6. Configure settings. [Learn more about specific settings in provisioning packages.]( https://go.microsoft.com/fwlink/p/?LinkId=615916)
|
|
||||||
7. On the **File** menu, select **Save.**
|
|
||||||
8. On the **Export** menu, select **Provisioning package**.
|
|
||||||
9. Change **Owner** to **IT Admin**, which will set the precedence of this provisioning package higher than provisioning packages applied to this device from other sources, and then select **Next.**
|
|
||||||
10. Set a value for **Package Version**.
|
|
||||||
> [!TIP]
|
|
||||||
> You can make changes to existing packages and change the version number to update previously applied packages.
|
|
||||||
|
|
||||||
11. Optional. In the **Provisioning package security** window, you can choose to encrypt the package and enable package signing.
|
|
||||||
- **Enable package encryption** - If you select this option, an auto-generated password will be shown on the screen.
|
|
||||||
- **Enable package signing** - If you select this option, you must select a valid certificate to use for signing the package. You can specify the certificate by clicking **Select...** and choosing the certificate you want to use to sign the package.
|
|
||||||
> [!IMPORTANT]
|
|
||||||
> We recommend that you include a trusted provisioning certificate in your provisioning package. When the package is applied to a device, the certificate is added to the system store and any package signed with that certificate thereafter can be applied silently.
|
|
||||||
|
|
||||||
12. Click **Next** to specify the output location where you want the provisioning package to go once it's built. By default, Windows ICD uses the project folder as the output location.
|
|
||||||
Optionally, you can click **Browse** to change the default output location.
|
|
||||||
13. Click **Next**.
|
|
||||||
14. Click **Build** to start building the package. The project information is displayed in the build page and the progress bar indicates the build status.
|
|
||||||
If you need to cancel the build, click **Cancel**. This cancels the current build process, closes the wizard, and takes you back to the **Customizations Page**.
|
|
||||||
15. If your build fails, an error message will show up that includes a link to the project folder. You can scan the logs to determine what caused the error. Once you fix the issue, try building the package again.
|
|
||||||
If your build is successful, the name of the provisioning package, output directory, and project directory will be shown.
|
|
||||||
- If you choose, you can build the provisioning package again and pick a different path for the output package. To do this, click **Back** to change the output package name and path, and then click **Next** to start another build.
|
|
||||||
- If you are done, click **Finish** to close the wizard and go back to the **Customizations Page**.
|
|
||||||
16. Select the **output location** link to go to the location of the package. You can provide that .ppkg to others through any of the following methods:
|
|
||||||
- Shared network folder
|
|
||||||
- SharePoint site
|
|
||||||
- Removable media (USB/SD)
|
|
||||||
- Email
|
|
||||||
- USB tether (mobile only)
|
|
||||||
|
|
||||||
Learn more: [Build and apply a provisioning package](https://go.microsoft.com/fwlink/p/?LinkID=629651)
|
|
||||||
|
|
||||||
## Apply package
|
|
||||||
|
|
||||||
|
|
||||||
On a desktop computer, the employee goes to **Settings** > **Accounts** > **Work access** > **Add or remove a management package** > **Add a package**, and selects the package to install. The user can also add a provisioning package simply by double-clicking the .ppkg file in local storage, on removable media, or at a URL.
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
On a mobile device, the employee goes to **Settings** > **Accounts** > **Provisioning.** > **Add a package**, and selects the package on removable media to install.
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
## Manage a package
|
|
||||||
|
|
||||||
|
|
||||||
- Users can view details or delete package (if policy allows deletion); only user-installed packages are listed.
|
|
||||||
|
|
||||||
- Deleting a package removes settings, profiles, certificates, and apps it contains.
|
|
||||||
|
|
||||||
- Use policies to disable manual deletion of packages, installation of unsigned packages, or the installation of any additional packages.
|
|
||||||
|
|
||||||
- Update content by installing a new package with same name and new version number.
|
|
||||||
|
|
||||||
- Optionally, keep packages when you reset a mobile device. When you reset a desktop, runtime packages are removed.
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
## Learn more
|
|
||||||
|
|
||||||
|
|
||||||
- [Provisioning Windows 10 Devices with New Tools](https://go.microsoft.com/fwlink/p/?LinkId=615921)
|
|
||||||
|
|
||||||
- [Windows 10 for Mobile Devices: Provisioning Is Not Imaging](https://go.microsoft.com/fwlink/p/?LinkId=615922)
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
@ -1,4 +0,0 @@
|
|||||||
---
|
|
||||||
title: Configure Windows 10 devices to stop data flow to Microsoft (Windows 10)
|
|
||||||
redirect_url: https://technet.microsoft.com/itpro/windows/manage/manage-connections-from-windows-operating-system-components-to-microsoft-services
|
|
||||||
---
|
|
||||||
@ -1,406 +0,0 @@
|
|||||||
---
|
|
||||||
description: Use this article to make informed decisions about how you can configure telemetry in your organization.
|
|
||||||
title: Configure Windows telemetry in your organization (Windows 10)
|
|
||||||
keywords: privacy
|
|
||||||
ms.prod: w10
|
|
||||||
ms.mktglfcycl: manage
|
|
||||||
ms.sitesec: library
|
|
||||||
ms.pagetype: security
|
|
||||||
localizationpriority: high
|
|
||||||
author: brianlic-msft
|
|
||||||
---
|
|
||||||
|
|
||||||
# Configure Windows telemetry in your organization
|
|
||||||
|
|
||||||
**Applies to**
|
|
||||||
|
|
||||||
- Windows 10
|
|
||||||
- Windows 10 Mobile
|
|
||||||
- Windows Server 2016
|
|
||||||
|
|
||||||
At Microsoft, we use Windows telemetry to inform our decisions and focus our efforts in providing the most robust, most valuable platform for your business and the people who count on Windows to enable them to be as productive as possible. Telemetry gives users a voice in the operating system’s development. This guide describes the importance of Windows telemetry and how we protect that data. Additionally, it differentiates between telemetry and functional data. It also describes the telemetry levels that Windows supports. Of course, you can choose how much telemetry is shared with Microsoft, and this guide demonstrates how.
|
|
||||||
|
|
||||||
To frame a discussion about telemetry, it is important to understand Microsoft’s privacy principles. We earn customer trust every day by focusing on six key privacy principles as described at [privacy.microsoft.com](https://privacy.microsoft.com/). These principles guided the implementation of the Windows telemetry system in the following ways:
|
|
||||||
|
|
||||||
- **Control.** We offer customers control of the telemetry they share with us by providing easy-to-use management tools.
|
|
||||||
- **Transparency.** We provide information about the telemetry that Windows and Windows Server collects so our customers can make informed decisions.
|
|
||||||
- **Security.** We encrypt telemetry in transit from your device and protect that data at our secure data centers.
|
|
||||||
- **Strong legal protections.** We respect customers’ local privacy laws and fight for legal protection of their privacy as a fundamental human right.
|
|
||||||
- **No content-based targeting.** We take steps to avoid and minimize the collection of customer content, such as the content of files, chats, or emails, through the Windows telemetry system. Customer content inadvertently collected is kept confidential and not used for user targeting.
|
|
||||||
- **Benefits to you.** We collect Windows telemetry to help provide you with an up-to-date, more secure, reliable and performant product, and to improve Windows for all of our customers.
|
|
||||||
|
|
||||||
This article applies to Windows and Windows Server telemetry only. Other Microsoft or third-party apps, such as System Center Configuration Manager, System Center Endpoint Protection, or System Center Data Protection Manager, might send data to their cloud services in ways that are inconsistent with this guide. Their publishers are responsible for notifying users of their privacy policies, telemetry controls, and so on. This article describes the types of telemetry we may gather, the ways you might manage it in your organization, and some examples of how telemetry can provide you with valuable insights into your enterprise deployments. Microsoft uses the data to quickly identify and address issues affecting its customers.
|
|
||||||
|
|
||||||
Use this article to make informed decisions about how you might configure telemetry in your organization. Telemetry is a term that means different things to different people and organizations. For the purpose of this article, we discuss telemetry as system data that is uploaded by the Connected User Experience and Telemetry component. The telemetry data is used to help keep Windows devices secure by identifying malware trends and other threats and to help Microsoft improve the quality of Windows and Microsoft services.
|
|
||||||
|
|
||||||
We are always striving to improve our documentation and welcome your feedback. You can provide feedback by contacting telmhelp@microsoft.com.
|
|
||||||
|
|
||||||
## Overview
|
|
||||||
|
|
||||||
In previous versions of Windows and Windows Server, Microsoft used telemetry to check for updated or new Windows Defender signatures, check whether Windows Update installations were successful, gather reliability information through the Reliability Analysis Component (RAC), and gather reliability information through the Windows Customer Experience Improvement Program (CEIP) on Windows. In Windows 10 and Windows Server 2016, you can control telemetry streams by using the Privacy option in Settings, Group Policy, or MDM.
|
|
||||||
|
|
||||||
For Windows 10, we invite IT pros to join the [Windows Insider Program](http://insider.windows.com) to give us feedback on what we can do to make Windows work better for your organization.
|
|
||||||
|
|
||||||
## Understanding Windows telemetry
|
|
||||||
|
|
||||||
Windows as a Service is a fundamental change in how Microsoft plans, builds, and delivers the operating system. Historically, we released a major Windows version every few years. The effort required to deploy large and infrequent Windows versions was substantial. That effort included updating the infrastructure to support the upgrade. Windows as a Service accelerates the cadence to provide rich updates more frequently, and these updates require substantially less effort to roll out than earlier versions of Windows. Since it provides more value to organizations in a shorter timeframe, delivering Windows as a Service is a top priority for us.
|
|
||||||
|
|
||||||
The release cadence of Windows may be fast, so feedback is critical to its success. We rely on telemetry at each stage of the process to inform our decisions and prioritize our efforts.
|
|
||||||
|
|
||||||
### What is Windows telemetry?
|
|
||||||
Windows telemetry is vital technical data from Windows devices about the device and how Windows and related software are performing. It's used in the following ways:
|
|
||||||
|
|
||||||
- Keep Windows up to date
|
|
||||||
- Keep Windows secure, reliable, and performant
|
|
||||||
- Improve Windows – through the aggregate analysis of the use of Windows
|
|
||||||
- Personalize Windows engagement surfaces
|
|
||||||
|
|
||||||
Here are some specific examples of Windows telemetry data:
|
|
||||||
|
|
||||||
- Type of hardware being used
|
|
||||||
- Applications installed and usage details
|
|
||||||
- Reliability information on device drivers
|
|
||||||
|
|
||||||
### What is NOT telemetry?
|
|
||||||
|
|
||||||
Telemetry can sometimes be confused with functional data. Some Windows components and apps connect to Microsoft services directly, but the data they exchange is not telemetry. For example, exchanging a user’s location for local weather or news is not an example of telemetry—it is functional data that the app or service requires to satisfy the user’s request.
|
|
||||||
|
|
||||||
There are subtle differences between telemetry and functional data. Windows collects and sends telemetry in the background automatically. You can control how much information is gathered by setting the telemetry level. Microsoft tries to avoid collecting personal information wherever possible (for example, if a crash dump is collected and a document was in memory at the time of the crash). On the other hand, functional data can contain personal information. However, a user action, such as requesting news or asking Cortana a question, usually triggers collection and transmission of functional data.
|
|
||||||
|
|
||||||
If you’re an IT pro that wants to manage Windows functional data sent from your organization to Microsoft, see [Manage connections from Windows operating system components to Microsoft services](https://technet.microsoft.com/itpro/windows/manage/manage-connections-from-windows-operating-system-components-to-microsoft-services).
|
|
||||||
|
|
||||||
The following are specific examples of functional data:
|
|
||||||
|
|
||||||
- Current location for weather
|
|
||||||
- Bing searches
|
|
||||||
- Wallpaper and desktop settings synced across multiple devices
|
|
||||||
|
|
||||||
### Telemetry gives users a voice
|
|
||||||
|
|
||||||
Windows and Windows Server telemetry gives every user a voice in the operating system’s development and ongoing improvement. It helps us understand how Windows 10 and Windows Server 2016 behaves in the real world, focus on user priorities, and make informed decisions that benefit them. For our enterprise customers, representation in the dataset on which we will make future design decisions is a real benefit. The following sections offer real examples of these benefits.
|
|
||||||
|
|
||||||
### Drive higher app and driver quality
|
|
||||||
|
|
||||||
Our ability to collect telemetry that drives improvements to Windows and Windows Server helps raise the bar for app and device driver quality. Telemetry helps us to quickly identify and fix critical reliability and security issues with apps and device drivers on given configurations. For example, we can identify an app that hangs on devices using a specific version of a video driver, allowing us to work with the app and device driver vendor to quickly fix the issue. The result is less downtime and reduced costs and increased productivity associated with troubleshooting these issues.
|
|
||||||
|
|
||||||
A real-world example of how Windows telemetry helps us quickly identify and fix issues is a particular version of a video driver that was crashing on some devices running Windows 10, causing the device to reboot. We detected the problem in our telemetry, and immediately contacted the third-party developer who builds the video driver. Working with the developer, we provided an updated driver to Windows Insiders within 24 hours. Based on telemetry from the Windows Insiders’ devices, we were able to validate the new version of the video driver, and rolled it out to the broad public as an update the next day. Telemetry helped us find, fix, and resolve this problem in just 48 hours, providing a better user experience and reducing costly support calls.
|
|
||||||
|
|
||||||
### Improve end-user productivity
|
|
||||||
|
|
||||||
Windows telemetry also helps Microsoft better understand how customers use (or do not use) the operating system’s features and related services. The insights we gain from this data helps us prioritize our engineering effort to directly impact our customers’ experiences. Examples are:
|
|
||||||
|
|
||||||
- **Start menu.** How do people change the Start menu layout? Do they pin other apps to it? Are there any apps that they frequently unpin? We use this dataset to adjust the default Start menu layout to better reflect people’s expectations when they turn on their device for the first time.
|
|
||||||
- **Cortana.** We use telemetry to monitor the scalability of our cloud service, improving search performance.
|
|
||||||
- **Application switching.** Research and observations from earlier Windows versions showed that people rarely used Alt+Tab to switch between applications. After discussing this with some users, we learned they loved the feature, saying that it would be highly productive, but they did not know about it previously. Based on this, we created the Task View button in Windows 10 to make this feature more discoverable. Later telemetry showed significantly higher usage of this feature.
|
|
||||||
|
|
||||||
**These examples show how the use of telemetry data enables Microsoft to build or enhance features which can help organizations increase employee productivity while lowering help desk calls.**
|
|
||||||
|
|
||||||
|
|
||||||
### Insights into your own organization
|
|
||||||
|
|
||||||
Sharing information with Microsoft helps make Windows and other products better, but it can also help make your internal processes and user experiences better, as well. Microsoft is in the process of developing a set of analytics customized for your internal use. The first of these, called [Windows 10 Upgrade Analytics](../deploy/manage-windows-upgrades-with-upgrade-analytics.md).
|
|
||||||
|
|
||||||
#### Windows 10 Upgrade Analytics
|
|
||||||
|
|
||||||
Upgrading to new operating system versions has traditionally been a challenging, complex, and slow process for many enterprises. Discovering applications and drivers and then testing them for potential compatibility issues have been among the biggest pain points.
|
|
||||||
|
|
||||||
To better help customers through this difficult process, Microsoft developed Upgrade Analytics to give enterprises the tools to plan and manage the upgrade process end to end and allowing them to adopt new Windows releases more quickly and on an ongoing basis.
|
|
||||||
|
|
||||||
With Windows telemetry enabled, Microsoft collects computer, application, and driver compatibility-related information for analysis. We then identify compatibility issues that can block your upgrade and suggest fixes when they are known to Microsoft.
|
|
||||||
|
|
||||||
Use Upgrade Analytics to get:
|
|
||||||
|
|
||||||
- A visual workflow that guides you from pilot to production
|
|
||||||
- Detailed computer, driver, and application inventory
|
|
||||||
- Powerful computer level search and drill-downs
|
|
||||||
- Guidance and insights into application and driver compatibility issues with suggested fixes
|
|
||||||
- Data driven application rationalization tools
|
|
||||||
- Application usage information, allowing targeted validation; workflow to track validation progress and decisions
|
|
||||||
- Data export to commonly used software deployment tools
|
|
||||||
|
|
||||||
The Upgrade Analytics workflow steps you through the discovery and rationalization process until you have a list of computers that are ready to be upgraded.
|
|
||||||
|
|
||||||
## How is telemetry data handled by Microsoft?
|
|
||||||
|
|
||||||
### Data collection
|
|
||||||
|
|
||||||
Windows 10 and Windows Server 2016 includes the Connected User Experience and Telemetry component, which uses Event Tracing for Windows (ETW) tracelogging technology that gathers and stores telemetry events and data. The operating system and some Microsoft management solutions, such as System Center, use the same logging technology.
|
|
||||||
|
|
||||||
1. Operating system features and some management applications are instrumented to publish events and data. Examples of management applications include Virtual Machine Manager (VMM), Server Manager, and Storage Spaces.
|
|
||||||
2. Events are gathered using public operating system event logging and tracing APIs.
|
|
||||||
3. You can configure the telemetry level by using an MDM policy, Group Policy, or registry settings.
|
|
||||||
4. The Connected User Experience and Telemetry component transmits the telemetry data.
|
|
||||||
|
|
||||||
Info collected at the Enhanced and Full levels of telemetry is typically gathered at a fractional sampling rate, which can be as low as 1% of devices reporting data at those levels.
|
|
||||||
|
|
||||||
### Data transmission
|
|
||||||
|
|
||||||
All telemetry data is encrypted using SSL and uses certificate pinning during transfer from the device to the Microsoft Data Management Service. With Windows 10, data is uploaded on a schedule that is sensitive to event priority, battery use, and network cost. Real-time events, such as Windows Defender Advanced Threat Protection, are always sent immediately. Normal events are not uploaded on metered networks, unless you are on a metered server connection. On a free network, normal events can be uploaded every 4 hours if on battery, or every 15 minutes if on A/C power. Diagnostic and crash data are only uploaded on A/C power and free networks.
|
|
||||||
|
|
||||||
### Endpoints
|
|
||||||
|
|
||||||
The Microsoft Data Management Service routes data back to our secure cloud storage. Only Microsoft personnel with a valid business justification are permitted access.
|
|
||||||
|
|
||||||
The following table defines the endpoints for telemetry services:
|
|
||||||
|
|
||||||
| Service | Endpoint |
|
|
||||||
| - | - |
|
|
||||||
| Connected User Experience and Telemetry component | v10.vortex-win.data.microsoft.com<br />settings-win.data.microsoft.com |
|
|
||||||
| [Windows Error Reporting](http://msdn.microsoft.com/library/windows/desktop/bb513641.aspx) | watson.telemetry.microsoft.com |
|
|
||||||
| [Online Crash Analysis](http://msdn.microsoft.com/library/windows/desktop/ee416349.aspx) | oca.telemetry.microsoft.com |
|
|
||||||
| OneDrive app for Windows 10 | vortex.data.microsoft.com/collect/v1 |
|
|
||||||
|
|
||||||
### Data use and access
|
|
||||||
|
|
||||||
The principle of least privileged access guides access to telemetry data. Microsoft does not share personal data of our customers with third parties, except at the customer’s discretion or for the limited purposes described in the [Privacy Statement](https://privacy.microsoft.com/privacystatement). Microsoft may share business reports with OEMs and third party partners that include aggregated and anonymized telemetry information. Data-sharing decisions are made by an internal team including privacy, legal, and data management.
|
|
||||||
|
|
||||||
### Retention
|
|
||||||
|
|
||||||
Microsoft believes in and practices information minimization. We strive to gather only the info we need, and store it for as long as it’s needed to provide a service or for analysis. Much of the info about how Windows and apps are functioning is deleted within 30 days. Other info may be retained longer, such as error reporting data or Windows Store purchase history.
|
|
||||||
|
|
||||||
## Telemetry levels
|
|
||||||
|
|
||||||
|
|
||||||
This section explains the different telemetry levels in Windows 10, Windows Server 2016, and System Center. These levels are available on all desktop and mobile editions of Windows 10, with the exception of the **Security** level which is limited to Windows 10 Enterprise, Windows 10 Education, Windows 10 Mobile Enterprise, Windows 10 IoT Core (IoT Core), and Windows Server 2016.
|
|
||||||
|
|
||||||
The telemetry data is categorized into four levels:
|
|
||||||
|
|
||||||
- **Security**. Information that’s required to help keep Windows, Windows Server, and System Center secure, including data about the Connected User Experience and Telemetry component settings, the Malicious Software Removal Tool, and Windows Defender.
|
|
||||||
|
|
||||||
- **Basic**. Basic device info, including: quality-related data, app compatibility, app usage data, and data from the **Security** level.
|
|
||||||
|
|
||||||
- **Enhanced**. Additional insights, including: how Windows, Windows Server, System Center, and apps are used, how they perform, advanced reliability data, and data from both the **Basic** and the **Security** levels.
|
|
||||||
|
|
||||||
- **Full**. All data necessary to identify and help to fix problems, plus data from the **Security**, **Basic**, and **Enhanced** levels.
|
|
||||||
|
|
||||||
The levels are cumulative and are illustrated in the following diagram. Also, these levels apply to all editions of Windows Server 2016.
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
### Security level
|
|
||||||
|
|
||||||
The Security level gathers only the telemetry info that is required to keep Windows devices, Windows Server, and guests protected with the latest security updates. This level is only available on Windows Server 2016, Windows 10 Enterprise, Windows 10 Education, Windows 10 Mobile Enterprise, and Windos IoT Core editions.
|
|
||||||
|
|
||||||
> [!NOTE]
|
|
||||||
> If your organization relies on Windows Update for updates, you shouldn’t use the **Security** level. Because no Windows Update information is gathered at this level, important information about update failures is not sent. Microsoft uses this information to fix the causes of those failures and improve the quality of our updates.
|
|
||||||
|
|
||||||
Windows Server Update Services (WSUS) and System Center Configuration Manager functionality is not affected at this level, nor is telemetry data about Windows Server features or System Center gathered.
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
The data gathered at this level includes:
|
|
||||||
|
|
||||||
- **Connected User Experience and Telemetry component settings**. If general telemetry data has been gathered and is queued, it is sent to Microsoft. Along with this telemetry, the Connected User Experience and Telemetry component may download a configuration settings file from Microsoft’s servers. This file is used to configure the Connected User Experience and Telemetry component itself. The data gathered by the client for this request includes OS information, device id (used to identify what specific device is requesting settings) and device class (for example, whether the device is server or desktop).
|
|
||||||
|
|
||||||
- **Malicious Software Removal Tool (MSRT)** The MSRT infection report contains information, including device info and IP address.
|
|
||||||
|
|
||||||
> [!NOTE]
|
|
||||||
> You can turn off the MSRT infection report. No MSRT information is included if MSRT is not used. If Windows Update is turned off, MSRT will not be offered to users. For more info, see Microsoft KB article [891716](http://support.microsoft.com/kb/891716).
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
- **Windows Defender/Endpoint Protection**. Windows Defender and System Center Endpoint Protection requires some information to function, including: anti-malware signatures, diagnostic information, User Account Control settings, Unified Extensible Firmware Interface (UEFI) settings, and IP address.
|
|
||||||
|
|
||||||
> [!NOTE]
|
|
||||||
> This reporting can be turned off and no information is included if a customer is using third party antimalware software, or if Windows Defender is turned off. For more info, see [Windows Defender](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-defender).
|
|
||||||
|
|
||||||
Microsoft recommends that Windows Update, Windows Defender, and MSRT remain enabled unless the enterprise uses alternative solutions such as Windows Server Update Services, System Center Configuration Manager, or a third party antimalware solution. Windows Update, Windows Defender, and MSRT provide core Windows functionality such as driver and OS updates, including security updates.
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
For servers with default telemetry settings and no Internet connectivity, you should set the telemetry level to **Security**. This stops data gathering for events that would not be uploaded due to the lack of Internet connectivity.
|
|
||||||
|
|
||||||
No user content, such as user files or communications, is gathered at the **Security** telemetry level, and we take steps to avoid gathering any information that directly identifies a company or user, such as name, email address, or account ID. However, in rare circumstances, MSRT information may unintentionally contain personal information. For instance, some malware may create entries in a computer’s registry that include information such as a username, causing it to be gathered. MSRT reporting is optional and can be turned off at any time.
|
|
||||||
|
|
||||||
### Basic level
|
|
||||||
|
|
||||||
The Basic level gathers a limited set of data that’s critical for understanding the device and its configuration. This level also includes the **Security** level data. This level helps to identify problems that can occur on a particular hardware or software configuration. For example, it can help determine if crashes are more frequent on devices with a specific amount of memory or that are running a particular driver version. The Connected User Experience and Telemetry component does not gather telemetry data about System Center, but it can transmit telemetry for other non-Windows applications if they have user consent.
|
|
||||||
|
|
||||||
The data gathered at this level includes:
|
|
||||||
|
|
||||||
- **Basic device data**. Helps provide an understanding about the types of Windows devices and the configurations and types of native and virtualized Windows Server 2016 in the ecosystem. Examples include:
|
|
||||||
|
|
||||||
- Device attributes, such as camera resolution and display type
|
|
||||||
|
|
||||||
- Internet Explorer version
|
|
||||||
|
|
||||||
- Battery attributes, such as capacity and type
|
|
||||||
|
|
||||||
- Networking attributes, such as number of network adapters, speed of network adapters, mobile operator network, and IMEI number
|
|
||||||
|
|
||||||
- Processor and memory attributes, such as number of cores, architecture, speed, memory size, and firmware
|
|
||||||
|
|
||||||
- Virtualization attribute, such as Second Level Address Translation (SLAT) support and guest operating system
|
|
||||||
|
|
||||||
- Operating system attributes, such as Windows edition and virtualization state
|
|
||||||
|
|
||||||
- Storage attributes, such as number of drives, type, and size
|
|
||||||
|
|
||||||
- **Connected User Experience and Telemetry component quality metrics**. Helps provide an understanding about how the Connected User Experience and Telemetry component is functioning, including % of uploaded events, dropped events, and the last upload time.
|
|
||||||
|
|
||||||
- **Quality-related information**. Helps Microsoft develop a basic understanding of how a device and its operating system are performing. Some examples are the device characteristics of a Connected Standby device, the number of crashes or hangs, and application state change details, such as how much processor time and memory were used, and the total uptime for an app.
|
|
||||||
|
|
||||||
- **Compatibility data**. Helps provide an understanding about which apps are installed on a device or virtual machine and identifies potential compatibility problems.
|
|
||||||
|
|
||||||
- **General app data and app data for Internet Explorer add-ons**. Includes a list of apps that are installed on a native or virtualized instance of the OS and whether these apps function correctly after an upgrade. This app data includes the app name, publisher, version, and basic details about which files have been blocked from usage.
|
|
||||||
|
|
||||||
- **App usage data**. Includes how an app is used, including how long an app is used, when the app has focus, and when the app is started
|
|
||||||
|
|
||||||
- **Internet Explorer add-ons**. Includes a list of Internet Explorer add-ons that are installed on a device and whether these apps will work after an upgrade.
|
|
||||||
|
|
||||||
- **System data**. Helps provide an understanding about whether a device meets the minimum requirements to upgrade to the next version of the operating system. System information includes the amount of memory, as well as information about the processor and BIOS.
|
|
||||||
|
|
||||||
- **Accessory device data**. Includes a list of accessory devices, such as printers or external storage devices, that are connected to Windows PCs and whether these devices will function after upgrading to a new version of the operating system.
|
|
||||||
|
|
||||||
- **Driver data**. Includes specific driver usage that’s meant to help figure out whether apps and devices will function after upgrading to a new version of the operating system. This can help to determine blocking issues and then help Microsoft and our partners apply fixes and improvements.
|
|
||||||
|
|
||||||
- **Windows Store**. Provides information about how the Windows Store performs, including app downloads, installations, and updates. It also includes Windows Store launches, page views, suspend and resumes, and obtaining licenses.
|
|
||||||
|
|
||||||
### Enhanced level
|
|
||||||
|
|
||||||
The Enhanced level gathers data about how Windows and apps are used and how they perform. This level also includes data from both the **Basic** and **Security** levels. This level helps to improve the user experience with the operating system and apps. Data from this level can be abstracted into patterns and trends that can help Microsoft determine future improvements.
|
|
||||||
|
|
||||||
This is the default level for Windows 10 Enterprise and Windows 10 Education editions, and the minimum level needed to quickly identify and address Windows, Windows Server, and System Center quality issues.
|
|
||||||
|
|
||||||
The data gathered at this level includes:
|
|
||||||
|
|
||||||
- **Operating system events**. Helps to gain insights into different areas of the operating system, including networking, Hyper-V, Cortana, storage, file system, and other components.
|
|
||||||
|
|
||||||
- **Operating system app events**. A set of events resulting from Microsoft applications and management tools that were downloaded from the Store or pre-installed with Windows or Windows Server, including Server Manager, Photos, Mail, and Microsoft Edge.
|
|
||||||
|
|
||||||
- **Device-specific events**. Contains data about events that are specific to certain devices, such as Surface Hub and Microsoft HoloLens. For example, Microsoft HoloLens sends Holographic Processing Unit (HPU)-related events.
|
|
||||||
|
|
||||||
- **Some crash dump types**. All crash dump types, except for heap dumps and full dumps.
|
|
||||||
|
|
||||||
If the Connected User Experience and Telemetry component detects a problem on Windows 10 that requires gathering more detailed instrumentation, the Connected User Experience and Telemetry component at the **Enhanced** telemetry level will only gather data about the events associated with the specific issue.
|
|
||||||
|
|
||||||
### Full level
|
|
||||||
|
|
||||||
The Full level gathers data necessary to identify and to help fix problems, following the approval process described below. This level also includes data from the **Basic**, **Enhanced**, and **Security** levels.
|
|
||||||
|
|
||||||
Additionally, at this level, devices opted in to the [Windows Insider Program](http://insider.windows.com) will send events, such as reliability and app responsiveness. that can show Microsoft how pre-release binaries and features are performing. These events help us make decisions on which builds are flighted. All devices in the [Windows Insider Program](http://insider.windows.com) are automatically set to this level.
|
|
||||||
|
|
||||||
If a device experiences problems that are difficult to identify or repeat using Microsoft’s internal testing, additional data becomes necessary. This data can include any user content that might have triggered the problem and is gathered from a small sample of devices that have both opted into the **Full** telemetry level and have exhibited the problem.
|
|
||||||
|
|
||||||
However, before more data is gathered, Microsoft’s privacy governance team, including privacy and other subject matter experts, must approve the diagnostics request made by a Microsoft engineer. If the request is approved, Microsoft engineers can use the following capabilities to get the information:
|
|
||||||
|
|
||||||
- Ability to run a limited, pre-approved list of Microsoft certified diagnostic tools, such as msinfo32.exe, powercfg.exe, and dxdiag.exe.
|
|
||||||
|
|
||||||
- Ability to get registry keys.
|
|
||||||
|
|
||||||
- All crash dump types, including heap dumps and full dumps.
|
|
||||||
|
|
||||||
## Enterprise management
|
|
||||||
|
|
||||||
Sharing telemetry data with Microsoft provides many benefits to enterprises, so we do not recommend turning it off. For most enterprise customers, simply adjusting the telemetry level and managing specific components is the best option.
|
|
||||||
|
|
||||||
Customers can set the telemetry level in both the user interface and with existing management tools. Users can change the telemetry level in the **Diagnostic and usage data** setting. In the Settings app, it is in **Privacy\Feedback & diagnostics**. They can choose between Basic, Enhanced, and Full. The Security level is not available.
|
|
||||||
|
|
||||||
IT pros can use various methods, including Group Policy and Mobile Device Management (MDM), to choose a telemetry level. If you’re using Windows 10 Enterprise, Windows 10 Education, or Windows Server 2016, the Security telemetry level is available when managing the policy. Setting the telemetry level through policy overrides users’ choices. The remainder of this section describes how to do that.
|
|
||||||
|
|
||||||
|
|
||||||
### Manage your telemetry settings
|
|
||||||
|
|
||||||
We do not recommend that you turn off telemetry in your organization as valuable functionality may be impacted, but we recognize that in some scenarios this may be required. Use the steps in this section to do so for Windows, Windows Server, and System Center.
|
|
||||||
|
|
||||||
> [!IMPORTANT]
|
|
||||||
> These telemetry levels only apply to Windows, Windows Server, and System Center components and apps that use the Connected User Experience and Telemetry component. Non-Windows components, such as Microsoft Office or other 3rd-party apps, may communicate with their cloud services outside of these telemetry levels. You should work with your app vendors to understand their telemetry policy, and how you can to opt in or opt out. For more information on how Microsoft Office uses telemetry, see [Overview of Office Telemetry](http://technet.microsoft.com/library/jj863580.aspx).
|
|
||||||
|
|
||||||
You can turn on or turn off System Center telemetry gathering. The default is on and the data gathered at this level represents what is gathered by default when System Center telemetry is turned on. However, setting the operating system telemetry level to **Basic** will turn off System Center telemetry, even if the System Center telemetry switch is turned on.
|
|
||||||
|
|
||||||
The lowest telemetry setting level supported through management policies is **Security**. The lowest telemetry setting supported through the Settings UI is **Basic**. The default telemetry setting for Windows Server 2016 is **Enhanced**.
|
|
||||||
|
|
||||||
### Configure the operating system telemetry level
|
|
||||||
|
|
||||||
You can configure your operating system telemetry settings using the management tools you’re already using, such as Group Policy, MDM, or Windows Provisioning. You can also manually change your settings using Registry Editor. Setting your telemetry levels through a management policy overrides any device level settings.
|
|
||||||
|
|
||||||
Use the appropriate value in the table below when you configure the management policy.
|
|
||||||
|
|
||||||
| Level | Data gathered | Value |
|
|
||||||
| - | - | - |
|
|
||||||
| Security | Security data only. | **0** |
|
|
||||||
| Basic | Security data, and basic system and quality data. | **1** |
|
|
||||||
| Enhanced | Security data, basic system and quality data, and enhanced insights and advanced reliability data. | **2** |
|
|
||||||
| Full | Security data, basic system and quality data, enhanced insights and advanced reliability data, and full diagnostics data. | **3** |
|
|
||||||
|
|
||||||
|
|
||||||
### Use Group Policy to set the telemetry level
|
|
||||||
|
|
||||||
Use a Group Policy object to set your organization’s telemetry level.
|
|
||||||
|
|
||||||
1. From the Group Policy Management Console, go to **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Data Collection and Preview Builds**.
|
|
||||||
|
|
||||||
2. Double-click **Allow Telemetry**.
|
|
||||||
|
|
||||||
3. In the **Options** box, select the level that you want to configure, and then click **OK**.
|
|
||||||
|
|
||||||
### Use MDM to set the telemetry level
|
|
||||||
|
|
||||||
Use the [Policy Configuration Service Provider (CSP)](http://msdn.microsoft.com/library/windows/hardware/dn904962.aspx) to apply the System/AllowTelemetry MDM policy.
|
|
||||||
|
|
||||||
### Use Registry Editor to set the telemetry level
|
|
||||||
|
|
||||||
Use Registry Editor to manually set the registry level on each device in your organization, or write a script to edit the registry. If a management policy already exists, such as Group Policy or MDM, it will override this registry setting.
|
|
||||||
|
|
||||||
1. Open Registry Editor, and go to **HKEY\_LOCAL\_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\DataCollection**.
|
|
||||||
|
|
||||||
2. Right-click **DataCollection**, click New, and then click **DWORD (32-bit) Value**.
|
|
||||||
|
|
||||||
3. Type **AllowTelemetry**, and then press ENTER.
|
|
||||||
|
|
||||||
4. Double-click **AllowTelemetry**, set the desired value from the table above, and then click **OK.**
|
|
||||||
|
|
||||||
5. Click **File** > **Export**, and then save the file as a .reg file, such as **C:\\AllowTelemetry.reg**. You can run this file from a script on each device in your organization.
|
|
||||||
|
|
||||||
### Configure System Center 2016 telemetry
|
|
||||||
|
|
||||||
For System Center 2016 Technical Preview, you can turn off System Center telemetry by following these steps:
|
|
||||||
|
|
||||||
- Turn off telemetry by using the System Center UI Console settings workspace.
|
|
||||||
|
|
||||||
- For information about turning off telemetry for Service Management Automation and Service Provider Foundation, see [How to disable telemetry for Service Management Automation and Service Provider Foundation](https://support.microsoft.com/kb/3096505).
|
|
||||||
|
|
||||||
### Additional telemetry controls
|
|
||||||
|
|
||||||
There are a few more settings that you can turn off that may send telemetry information:
|
|
||||||
|
|
||||||
- To turn off Windows Update telemetry, you have two choices. Either turn off Windows Update, or set your devices to be managed by an on premises update server, such as [Windows Server Update Services (WSUS)](http://technet.microsoft.com/library/hh852345.aspx) or [System Center Configuration Manager](http://www.microsoft.com/server-cloud/products/system-center-2012-r2-configuration-manager/).
|
|
||||||
|
|
||||||
- Turn off **Windows Defender Cloud-based Protection** and **Automatic sample submission** in **Settings** > **Update & security** > **Windows Defender**.
|
|
||||||
|
|
||||||
- Manage the Malicious Software Removal Tool in your organization. For more info, see Microsoft KB article [891716](http://support.microsoft.com/kb/891716).
|
|
||||||
|
|
||||||
- Turn off **Linguistic Data Collection** in **Settings** > **Privacy**. At telemetry levels **Enhanced** and **Full**, Microsoft uses Linguistic Data Collection info to improve language model features such as autocomplete, spellcheck, suggestions, input pattern recognition, and dictionary.
|
|
||||||
|
|
||||||
> [!NOTE]
|
|
||||||
> Microsoft does not intend to gather sensitive information, such as credit card numbers, usernames and passwords, email addresses, or other similarly sensitive information for Linguistic Data Collection. We guard against such events by using technologies to identify and remove sensitive information before linguistic data is sent from the user's device. If we determine that sensitive information has been inadvertently received, we delete the information.
|
|
||||||
|
|
||||||
## Additional resources
|
|
||||||
|
|
||||||
FAQs
|
|
||||||
|
|
||||||
- [Cortana, Search, and privacy](https://privacy.microsoft.com/windows-10-cortana-and-privacy)
|
|
||||||
- [Windows 10 feedback, diagnostics, and privacy](https://privacy.microsoft.com/windows-10-feedback-diagnostics-and-privacy)
|
|
||||||
- [Windows 10 camera and privacy](https://privacy.microsoft.com/windows-10-camera-and-privacy)
|
|
||||||
- [Windows 10 location service and privacy](https://privacy.microsoft.com/windows-10-location-and-privacy)
|
|
||||||
- [Microsoft Edge and privacy](https://privacy.microsoft.com/windows-10-microsoft-edge-and-privacy)
|
|
||||||
- [Windows 10 speech, inking, typing, and privacy](https://privacy.microsoft.com/windows-10-speech-inking-typing-and-privacy-faq)
|
|
||||||
- [Windows Hello and privacy](https://privacy.microsoft.com/windows-10-windows-hello-and-privacy)
|
|
||||||
- [Wi-Fi Sense](https://privacy.microsoft.com/windows-10-about-wifi-sense)
|
|
||||||
- [Windows Update Delivery Optimization](https://privacy.microsoft.com/windows-10-windows-update-delivery-optimization)
|
|
||||||
|
|
||||||
Blogs
|
|
||||||
|
|
||||||
- [Privacy and Windows 10](https://blogs.windows.com/windowsexperience/2015/09/28/privacy-and-windows-10)
|
|
||||||
|
|
||||||
Privacy Statement
|
|
||||||
|
|
||||||
- [Microsoft Privacy Statement](https://privacy.microsoft.com/privacystatement)
|
|
||||||
|
|
||||||
TechNet
|
|
||||||
|
|
||||||
- [Manage connections from Windows operating system components to Microsoft services](manage-connections-from-windows-operating-system-components-to-microsoft-services.md)
|
|
||||||
|
|
||||||
Web Pages
|
|
||||||
|
|
||||||
- [Privacy at Microsoft](http://privacy.microsoft.com)
|
|
||||||
@ -1,62 +0,0 @@
|
|||||||
---
|
|
||||||
title: Set up and test Cortana with Microsoft Dynamics CRM (Preview feature) in your organization (Windows 10)
|
|
||||||
description: How to set up Cortana to help your salespeople get proactive insights on important CRM activities, including sales leads, accounts, and opportunities; presenting the most relevant info at any given time.
|
|
||||||
ms.prod: w10
|
|
||||||
ms.mktglfcycl: manage
|
|
||||||
ms.sitesec: library
|
|
||||||
localizationpriority: high
|
|
||||||
---
|
|
||||||
|
|
||||||
# Set up and test Cortana with Microsoft Dynamics CRM (Preview feature) in your organization
|
|
||||||
**Applies to:**
|
|
||||||
|
|
||||||
- Windows 10, Windows Insider Program
|
|
||||||
- Windows 10 Mobile, Windows Insider Program
|
|
||||||
|
|
||||||
>[!IMPORTANT]
|
|
||||||
>Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.
|
|
||||||
|
|
||||||
Cortana integration is a Preview feature that's available for your test or dev environment, starting with the CRM Online 2016 Update. If you decide to use this Preview feature, you'll need to turn in on and accept the license terms. After that, your salespeople will get proactive insights from Cortana on important CRM activities, including sales leads, accounts, and opportunities; presenting the most relevant info at any given time. This can even include getting company-specific news that surfaces when the person is meeting with a representative from another company.
|
|
||||||
|
|
||||||
>[!NOTE]
|
|
||||||
>For more info about Dynamics CRM integration, how to turn on Cortana, and how to provide feedback, see [Preview feature: Set up Cortana integration](http://go.microsoft.com/fwlink/p/?LinkId=746819).
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
## Turn on Cortana with Dynamics CRM in your organization
|
|
||||||
You must be a CRM administrator to turn on and use Preview features. For more info about what Preview features are and how to use them, see [What are Preview features and how do I enable them](http://go.microsoft.com/fwlink/p/?LinkId=746817)?
|
|
||||||
|
|
||||||
**To turn on Cortana with Dynamics CRM**
|
|
||||||
|
|
||||||
1. Go to **Settings**, and then click **Administration**.
|
|
||||||
|
|
||||||
2. Choose **System Settings**, and then click the **Previews** tab.
|
|
||||||
|
|
||||||
3. Read the license terms, and if you agree, select the **I’ve read and agree to the license terms** check box.
|
|
||||||
|
|
||||||
4. For each preview feature you want to enable, click **Yes**.
|
|
||||||
|
|
||||||
## Turn on Cortana with Dynamics CRM on your employees’ devices
|
|
||||||
You must tell your employees to turn on Cortana, before they’ll be able to use it with Dynamics CRM.
|
|
||||||
|
|
||||||
**To turn on local Cortana with Dynamics CRM**
|
|
||||||
|
|
||||||
1. Click on the **Cortana** search box in the taskbar, and then click the **Notebook** icon.
|
|
||||||
|
|
||||||
2. Click on **Connected Services**, click **Dynamics CRM**, and then click **Connect**.
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
The employee can also disconnect by clicking **Disconnect** from the **Dynamics CRM** screen.
|
|
||||||
|
|
||||||
## Turn off Cortana with Dynamics CRM
|
|
||||||
Cortana can only access data in Dynamics CRM when it’s turned on. If you don’t want Cortana to access your corporate data, you can turn it off.
|
|
||||||
|
|
||||||
**To turn off Cortana with Dynamics CRM**
|
|
||||||
1. Go to **Settings**, and then click **Administration**.
|
|
||||||
|
|
||||||
2. Choose **System Settings**, and then click the **Previews** tab.
|
|
||||||
|
|
||||||
3. Click **No** for **Cortana**.
|
|
||||||
|
|
||||||
All Dynamics CRM functionality related to Cortana is turned off in your organization.
|
|
||||||
@ -1,24 +0,0 @@
|
|||||||
---
|
|
||||||
title: Send feedback about Cortana at work back to Microsoft (Windows 10)
|
|
||||||
description: How to send feedback to Microsoft about Cortana at work.
|
|
||||||
ms.prod: w10
|
|
||||||
ms.mktglfcycl: manage
|
|
||||||
ms.sitesec: library
|
|
||||||
localizationpriority: high
|
|
||||||
---
|
|
||||||
|
|
||||||
# Send feedback about Cortana at work back to Microsoft
|
|
||||||
**Applies to:**
|
|
||||||
|
|
||||||
- Windows 10, Windows Insider Program
|
|
||||||
- Windows 10 Mobile, Windows Insider Program
|
|
||||||
|
|
||||||
>[!IMPORTANT]
|
|
||||||
>Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.
|
|
||||||
|
|
||||||
We ask that you report bugs and issues. To provide feedback, you can click the **Feedback** icon in the Cortana window. When you send this form to Microsoft it also includes troubleshooting info, in case you run into problems.
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
If you don't want to use the feedback tool in Cortana, you can add feedback through the general Windows Insider Preview feedback app. For info about the Insider Preview feedback app, see [How to use Windows Insider Preview – Updates and feedback](http://windows.microsoft.com/en-us/windows/preview-updates-feedback-pc).
|
|
||||||
|
|
||||||
@ -1,72 +0,0 @@
|
|||||||
---
|
|
||||||
title: Set up and test Cortana with Office 365 in your organization (Windows 10)
|
|
||||||
description: How to connect Cortana to Office 365 so your employees are notified about regular meetings, unusual events, such as meetings over lunch or during a typical commute time, and about early meetings, even setting an alarm so the employee isn’t late.
|
|
||||||
ms.prod: w10
|
|
||||||
ms.mktglfcycl: manage
|
|
||||||
ms.sitesec: library
|
|
||||||
localizationpriority: high
|
|
||||||
---
|
|
||||||
|
|
||||||
# Set up and test Cortana with Office 365 in your organization
|
|
||||||
**Applies to:**
|
|
||||||
|
|
||||||
- Windows 10, Windows Insider Program
|
|
||||||
- Windows 10 Mobile, Windows Insider Program
|
|
||||||
|
|
||||||
>[!IMPORTANT]
|
|
||||||
>Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.
|
|
||||||
|
|
||||||
Cortana in Windows 10 is already great at letting your employees quickly see what the day is going to look like, do meeting prep work like researching people in LinkedIn or getting documents ready, see where and when their meetings are going to be, get a sense of travel times to and from work, and even get updates from a calendar for upcoming trips.
|
|
||||||
|
|
||||||
But Cortana works even harder when she connects to Office 365, helping employees to be notified about unusual events, such as meetings over lunch or during a typical commute time, and about early meetings, even setting an alarm so the employee isn’t late.
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
We’re continuing to add more and more capabilities to Cortana so she can become even more helpful with your productivity-related tasks, such as emailing, scheduling, and other tasks that are important to help you be successful.
|
|
||||||
|
|
||||||
>[!NOTE]
|
|
||||||
>For a quick review of the frequently asked questions about Cortana and Office 365 integration, see the blog post, [An early look at Cortana integration with Office 365](http://go.microsoft.com/fwlink/p/?LinkId=717379).
|
|
||||||
|
|
||||||
## Before you begin
|
|
||||||
There are a few things to be aware of before you start using Cortana with Office 365 in your organization.
|
|
||||||
|
|
||||||
- **Software requirements.** O365 integration with Cortana is available in all countries/regions where Cortana is supported for consumers today. This includes the United States, United Kingdom, Canada, France, Italy, Germany, Spain, China, Japan, India, and Australia. As Cortana comes to more countries, it will also become available to organizations.
|
|
||||||
|
|
||||||
- **Azure Active Directory (Azure AD) account.** Before your employees can use Cortana in your org, they must be logged in using their Azure AD account through Cortana’s notebook. They must also authorize Cortana to access Office 365 on their behalf.
|
|
||||||
|
|
||||||
- **Office 365 Trust Center.** Cortana isn't a service covered by the Office 365 Trust Center. [Learn more about how Cortana treats your data](http://go.microsoft.com/fwlink/p/?LinkId=536419).
|
|
||||||
|
|
||||||
- **Troubleshooting tips.** If you run into issues, check out these [troubleshooting tips](http://go.microsoft.com/fwlink/p/?LinkId=620763).
|
|
||||||
|
|
||||||
## Turn on Cortana with Office 365 on employees’ devices
|
|
||||||
You must tell your employees to turn on Cortana before they’ll be able to use it with Office 365.
|
|
||||||
|
|
||||||
**To turn on local Cortana with Office 365**
|
|
||||||
|
|
||||||
1. Click on the **Cortana** search box in the taskbar, and then click the **Notebook** icon.
|
|
||||||
|
|
||||||
2. Click on **Connected Services**, click **Office 365**, and then click **Connect**.
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
The employee can also disconnect by clicking **Disconnect** from the **Office 365** screen.
|
|
||||||
|
|
||||||
## Turn off Cortana with Office 365
|
|
||||||
Cortana can only access data in your Office 365 org when it’s turned on. If you don’t want Cortana to access your corporate data, you can turn it off in the Office 365 admin center.
|
|
||||||
|
|
||||||
**To turn off Cortana with Office 365**
|
|
||||||
1. [Sign in to Office 365](http://www.office.com/signin) using your Azure AD account.
|
|
||||||
|
|
||||||
2. Go to the [Office 365 admin center](https://support.office.com/en-us/article/Office-365-admin-center-58537702-d421-4d02-8141-e128e3703547).
|
|
||||||
|
|
||||||
3. Expand **Service Settings**, and select **Cortana**.
|
|
||||||
|
|
||||||
4. Click **Cortana** to toggle Cortana off.
|
|
||||||
|
|
||||||
All Office 365 functionality related to Cortana is turned off in your organization and your employees are unable to use her at work.
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
Some files were not shown because too many files have changed in this diff Show More
Reference in New Issue
Block a user