From f8220a64d2c06de5e3e0ccfc7e503a65d11f671c Mon Sep 17 00:00:00 2001 From: jdeckerMS Date: Fri, 4 Aug 2017 13:54:42 -0700 Subject: [PATCH 01/37] sync --- windows/configuration/TOC.md | 2 +- ...change-history-for-configure-windows-10.md | 6 +++ .../lock-down-windows-10-to-specific-apps.md | 46 +++++++++++++++++-- 3 files changed, 49 insertions(+), 5 deletions(-) diff --git a/windows/configuration/TOC.md b/windows/configuration/TOC.md index f4a06d5d6a..876c4c17b2 100644 --- a/windows/configuration/TOC.md +++ b/windows/configuration/TOC.md @@ -8,7 +8,7 @@ ### [Set up a shared or guest PC with Windows 10](set-up-shared-or-guest-pc.md) ### [Set up a kiosk on Windows 10 Pro, Enterprise, or Education](set-up-a-kiosk-for-windows-10-for-desktop-editions.md) ### [Guidelines for choosing an app for assigned access (kiosk mode)](guidelines-for-assigned-access-app.md) -### [Lock down Windows 10 to specific apps (AppLocker)](lock-down-windows-10-to-specific-apps.md) +### [Create a Windows 10 kiosk that runs multiple apps](lock-down-windows-10-to-specific-apps.md) ## [Configure Windows 10 Mobile devices](mobile-devices/configure-mobile.md) ### [Set up a kiosk on Windows 10 Mobile or Windows 10 Mobile Enterprise](mobile-devices/set-up-a-kiosk-for-windows-10-for-mobile-edition.md) ### [Use Windows Configuration Designer to configure Windows 10 Mobile devices](mobile-devices/provisioning-configure-mobile.md) diff --git a/windows/configuration/change-history-for-configure-windows-10.md b/windows/configuration/change-history-for-configure-windows-10.md index 9d2b98bf69..2a495b4f5a 100644 --- a/windows/configuration/change-history-for-configure-windows-10.md +++ b/windows/configuration/change-history-for-configure-windows-10.md @@ -14,6 +14,12 @@ author: jdeckerms This topic lists new and updated topics in the [Configure Windows 10](index.md) documentation for Windows 10 and Windows 10 Mobile. +## RELEASE: Windows 10, version 1709 + +The topics in this library have been updated for Windows 10, version 1709 (also known as the Fall Creators Update). The following new topics have been added: + +- [Create a Windows 10 kiosk that runs multiple apps](lock-down-windows-10-to-specific-apps.md) + ## July 2017 | New or changed topic | Description | | --- | --- | diff --git a/windows/configuration/lock-down-windows-10-to-specific-apps.md b/windows/configuration/lock-down-windows-10-to-specific-apps.md index 445d25bf22..eaf60f5ed2 100644 --- a/windows/configuration/lock-down-windows-10-to-specific-apps.md +++ b/windows/configuration/lock-down-windows-10-to-specific-apps.md @@ -1,6 +1,6 @@ --- -title: Lock down Windows 10 to specific apps (Windows 10) -description: Learn how to configure a device running Windows 10 Enterprise or Windows 10 Education so that users can only run a few specific apps. +title: Create a Windows 10 kiosk that runs multiple apps (Windows 10) +description: Learn how to configure a kiosk device running Windows 10 Enterprise or Windows 10 Education so that users can only run a few specific apps. ms.assetid: 14DDDC96-88C7-4181-8415-B371F25726C8 keywords: ["lockdown", "app restrictions", "applocker"] ms.prod: w10 @@ -11,14 +11,52 @@ author: jdeckerms ms.localizationpriority: high --- -# Lock down Windows 10 to specific apps +# Create a Windows 10 kiosk that runs multiple apps **Applies to** - Windows 10 ->For more info about the features and functionality that are supported in each edition of Windows, see [Compare Windows 10 Editions](https://www.microsoft.com/en-us/WindowsForBusiness/Compare). +A [kiosk device](set-up-a-kiosk-for-windows-10-for-desktop-editions.md) typically runs a single app, and users are prevented from accessing any features or functions on the device outside of the kiosk app. In Windows 10, version 1709, the [AssignedAccess configuration service provider (CSP)](https://docs.microsoft.com/windows/client-management/mdm/assignedaccess-csp) has been expanded to make it easy for administrators to create kiosks that run more than one app. You can configure multi-app kiosks using a provisioning package, rather than creating rules in **AppLocker**. + +>[!NOTE] +>For devices running versions of Windows 10 earlier than version 1709, you can [create AppLocker rules](#1703) to configure a multi-app kiosk. + +The benefit of a multi-app kiosk, or fixed-purpose device, is to provide an easy-to-understand experience for individuals by putting in front of them only the things they need to use, and removing from their view the things they don’t need to access. + +>[!WARNING] +>The assigned access feature is intended for corporate-owned fixed-purpose devices, like kiosks. When the multi-app assigned access configuration is applied on the device, certain policies are enforced system-wide, and will impact other users on the device. Deleting the multi-app configuration will remove the assigned access lockdown profiles associated with the users, but it cannot revert all the enforced policies (such as Start layout). A factory reset is needed to clear all the assigned access enforced policies. + +## new method (1709) + +Process: +1. [Create XML file](#create-xml-file) +2. [Add XML file to provisioning package](#add-xml) +3. [Apply provisioning package to device](#apply-ppkg) + +### Prerequisites + +- (latest version of WCD -- is Store version okay at GA?) +- kiosk device on 1709 + + +### Create XML file + + + +### Add XML file to provisioning package + + +### Apply provisioning package to device + +### mixed-reality + +*There are some Mixed Reality specific bits we wanted to include. For example, the IT Admin needs to include the Mixed Reality Portal as an allowed app if they want to include Mixed Reality apps in kiosk mode.* + + + +## old method (pre-1709) Learn how to configure a device running Windows 10 Enterprise or Windows 10 Education so that users can only run a few specific apps. The result is similar to [a kiosk device](set-up-a-device-for-anyone-to-use.md), but with multiple apps available. For example, you might set up a library computer so that users can search the catalog and browse the Internet, but can't run any other apps or change computer settings. From efd642bf57b62c025b745416e43ccae627a0e1b2 Mon Sep 17 00:00:00 2001 From: jdeckerMS Date: Mon, 7 Aug 2017 10:11:00 -0700 Subject: [PATCH 02/37] add art --- windows/configuration/images/profile-config.png | Bin 0 -> 42858 bytes 1 file changed, 0 insertions(+), 0 deletions(-) create mode 100644 windows/configuration/images/profile-config.png diff --git a/windows/configuration/images/profile-config.png b/windows/configuration/images/profile-config.png new file mode 100644 index 0000000000000000000000000000000000000000..473ad156eca9a18e94f3bd559a93019408431dfd GIT binary patch literal 42858 zcmZs?cQ{;8*EdWWQ6oefB}k(8UMC145+!<#&Jadt7)GKddhbNE=)E%%6TSCNMjO41 zHpAd`KhOPr-}}e6uj|xnon6k^Ypvf|YyZA!s=p;Aq9?+`!y{EydGiqu4}bCQe30y=#RlO9~3hTjmRY8M9FQZ}Fq*O7na3Kjkme z8=a>A-o=*=ORT)SxQD%YcJc1*+ajy~6?sEK;#8vc$-kQg4NsBbSA0x$5O#ZLgk5*k zND}lEjs9jcJJYv z5WxRDT1`{sPIf_=@`)eZ@y{Sl(jwUEh1SYA%LgaZk0yyMchY;*n)lV}ETb4cCg<)2 zlr1g4Dya5jq^MpPn|mqL)}q7J@2giO48*xNZ%Bjta64h0?R(R@ZX1Y<{F=5Gir>P+ zXBoFf>7|`?l1y$|Bh*MF~j9HKTN}1e_a(V z|8e;`j(OaN?0WAI`UL&wrk5Nf6BclZ;4fnbgeDU_=*^|I_^m8_nnJE1H_MD=i9(Hz z+zb=2Fz?0SV!Pe9iaKzz4;^{Dbj@NDyX1^mVC-grpKk8hetnzupsv$>rao5o+FsjJnu9`Xp?Bc}Y`CmLL z=l@Owm>^zA1_MIc|=i44kEncLVk2%4^b)o$?XQH`h25bXbM8FVmy z*BHRJ8a0}KK)zz{MR1LBG>vbFb_RK-SRX7!cQX~6l6C-b2M4UW=}JNlD$SWxxoIdew@3SEI%JtTrD{hCs^9%XJSfX2~2_YJ+XM?ME1o) zILkV~AGWS2?7LN@d6TUybnvC$QKa?CO@qC*zTG%|p=ELE=Lm;b<-p~62Rn9uo{XfJ zBSDyqmhVv7J-*FscWp9mN?okdJK{9W+hzFKCXi$z8@Yc7RqPeNyy*?IJss76VM16= zP4NgNB)`3XlBmO%eT5LG_g1{cn3gn^aDU%8;#6G!Rjjyv)HmgpD92np)AnuZqp2C| z2PZ~(oB8(RFzC&A0+XRO*QbDE4@jlnL4xf}pIS66FAXzLT^iri?H`5Pixz|u!0SZ1)pBWkq-gvn%N?op)n!>$k)a) zJ%p6cN!w3~w>ZiaUrqHFjby#bk+DmMZnkZsRsC-g&6xFf(QEvfKcB&Zxt4}sZ->(Q z;F$0~F}I4u3zIRhusQUv10xy-W-3izt+WL+n_SN-&*Z_kW(D2m7o{W*N8=o}sr}Lx zH&s^D(9=$D{=)J550kse>Y3g;v}bTJk4g2Y3@x1buB0W@-)IpOy-V_fY6bWKNZ2~| zddGxZeL{E)COAIb%zVUtDv#-Cw=35vW|cE7Ulu;|UFcgYP+i(&tuq-fOTEtO=wQ1V zjvS1n|M=?V{43%4>Y`DN5VerU8tJQP3g7>k$XtYx4}lmi2J*lG`uf$o-%`=R!VsTk zzW^`)1nAo3Gjs}pc&}`Pw+aMQJ;(NOP&_|OU$U}s^Ycq)qiU5XhAw>Rijf*4CUV)gM_6)GFL z9F@ECNBD&kAy#>X89N%ubjg|6(Krf&w6^-UpXBjpD@(35&5%1>`_6zUt#MUEh8=mP z6;SIu9IiqX{jbKCu9$Jes*p4(B8HiJX#N+(Ak&M$0@oU*;mOmv+^T6@$GC9=KuQ!!_F1O;RUQsNZfi2{*lWdzL|JWxK8>r?ss+)ET4J-;pg3^RPJ2{4W| zh(6UDP*d__E%^8|-rMeGPIFXyKB(PpOb@%}zq=m4o7@k&y^38d{Z5nVe?*uj)HWze zKU@^rlbKM-L0{Uy1Qkeye4_f1+uEwlo#?%bz2SiGu@dw1cRbEh6n6OPg*UHTNZl^M zMq{WJp{9eR9@r;t>;(keq{!fuZoAmm^ErK^A9Zaz@Yfb%`5(&^+LcvlW{b@imc2P2CZjVm zWmV*g5M@-&U`^5Em$Xa-$myk^vjFP|Mr@9E7rS6Xcf z)}ktSQ;t2K8NDW?d>3~$Byi8YbgHC}JjaAPOr3tmN3IrUSymJOluo$LgiKqGT6n~X zPZ65CW|>Rn`kv9S;2^@(;^kg38@Ekn|GPDfMNuxmaU`?eK>%fnUyxb+mnvhCGA{p0 zy1ddUBidJMlkrE2%z6~xMR?z=6n*6LJ2PqISpV^OkbKs z?BB(IXvUUe((!&kZspOLD>6q(7onpyH0kDYs`II$k8Kl*kU`u0?Ct8Ye6#ZuD_v7) zvI&x8k1_O7FlTlnxz@ORzx?)+%tcsdp#KkjD6fOaXmqPonS~}QCQXlh zLbR-JzVJPh7N_=G9aUXO8Xz=a3~9Akor!Xoj|3QPFGoCTWxrHES?as+jK1J>6Ji#v z*NaXU8Z2Phr`)GGWWEQi(y2@ae-SeQTPjP9I2{e3#AeJ9j zC^F5i!1}Kz<_alI#5K?xwk;2a#>8iqf!>?#XZj8tLHMSJpJD~n2VObLGOl$`?A8U% zRKy9bhE+)TSe7^7>sF{Q#0nw>?kSkEGfA;_In=)&6Uz{A(a3DxrYdZe4XcBX#ndM1 z58Oe?slk6KN`d+w4XO{a61fw}eZ=Jc&7Jf?L(9}NMRmB(2_?Ox`ZX7;Mq`{mm6HnU znZ&gj_|4HUO6yhlxz*x!4(ip9fBt^o=YQ5EY_pllwg06u-Y>;@EQK%retmp9_V2N? z#5T=*>-FdfdvSb;E8XpywB7*Y$mgkh3om=#Gry{o@r~4*wyZa)7Xoe1&QG#vR5&NX zWZK4LX=p%*+^7L*jjVq{j&DAs4ZNVX(flSZ-Y{SzUYR(xFu$IusNBCB&CER`16RFq zx%DmP;B^h_hwZe1D)8V}-Wsivg3Dh78bFxAi)>kNzL?5Jh2TO}-iPUJ&yeoh;C^{& zWvNNMRW*6}<)bHnyU%%p8I4Aj2cOkq1B^Ss?}lLD#L2PLmDC@%Re1P$#3 z;a&58lCNHsbwi*SdxL_yXL`2@ru#Alrz!#y_@qVr#iknvIwtR3Ui@^Lmq?LlG}t)= zTGd1{8NK?{YTK-bGip9M(yCaEMeQ~=_L=V7Fq1oZY|9tqiu=Zjk%6T^Z9H?cJSi*H zddt3O3CVzN0df6Cr3u&eLb|Bi@4V&nTLyH;@6H(0y?a&i$X)zqI-T6gjU3)9#r7B; z?X8TkU1a&GO)O(X@Dko8g7Vr?a%L{eHZcy8-0p{&8gl8u-FmwAitn<%%6fHcru~ZI z!kkA9Ed8QDW)^y)mx?|l+Llv-Z>H|`*uCiqs@hKzPz5tH>k)744zYjGw9(s0NB(6eGrM|H+JNgRd?~+%GQPY)Je>Fnao*~-s z&dhyJ!XG6xgZ~n&4|ep-;^Zq8FT+)g$@t9_C)DjFx3tN#eHNiExZPZwyHu~O4{VSxSj);xP1oN?C(JNzHMm}{SBTcQxkn5r zE~i9K{YmFP9It7Fx|iOetPSVC_iUv6b(*0!U+F5G3Q5}c*B=ibv8s1MEp_vfb4b(0 zoj&Goix)QN$U&!dbVujO98u&25%1gB*y2Am`!;uv)d?Te$rOXPxiCB%@%&sqP1sx| zx5>qCLO-d?mnq3B?PHa80j6J#3(up!oPbue>NwI>@BSJi(tT){4rpWrfT#ZT23lpO z%il$HX`lYE3#l<_s!(Mzp8J(nCde_uY4YLs3=sS^;YzRkxyba38690`ei@(qf&8^P zt?Z&3ReN9a(#D4V4jOR62^rnSCal=yG&%KfZhVr{y-suZW0&h{nG|+r4RGefp|gZ; zGeqQn!AM| z6X6T=$@e}f8NxYVn!89NO`H8K2z;?V=jr^1M(-b;QJlv31uUDo#%@|1 zlIETmPoDEV^4Y+zzk_4C^VqG}u)42;G0GBF^@0+X{ZE?xkzV2tVhnnf7xP4yitKHg zkHW|1k(^^hbxTXz{zCJ=uY{t0w^~JwS>!4P;fhK!Pe(y`IVMX#WIdfEM3>BdFw)Q~ zNQzNcb+{sNi#;TU>HLdr|RQsT{ZOA73}f zh5#2Ehee;aZ%8|}Ins)fN<=c+V34)193=s(%76-(TZD<*lAFFb6sr|dN-AZucdSe5 z)}uhbW{sJafLttoyWhW2nNfP?70x|#B1)dKG+OpOw{v6vv2a-5bhmn1M}xd{zJd6T z;`OKe?|2d4+hjlTiha%OXy{AgmU<_AI{c)%Huh{qX2`wsWI{?w{qdM*K1Ijbwo`@N zN9E{rsY%frZwD-^9F_3dO<9m~OO4+~-aLyAlk0ezGCr^F!=om#L~CIby}g(g&Uc?;BUl}Smblb%yL9XzN4l#{L?}oY02|) z;V>m><@l(8L&Wu#&Acxdb9683~J;^>+;D3v_+0)KW@)Zn^M3bow!X`Elds9 z)Hj6(!=D=0<*G7GzGt(2`i%+DPxZ1|-ETzPAx|Dm`{PZqy+PEeGu&n4Y4cvPE}Few zig~8LG0U& zs@8NN9u9~0X`#*I&%6@vJzQ0ZN>F0xeK%53_l7&HTb?D?+leUUebMT8M4lk#C?_W= zLp1wkMtbH{NT;0EGo0W&;g1((f(5HpK9NjJ$%`IN!DO`h`#f*P?XjC;7m}QzMrGn@ zgKSi<%c;dSQL!n?5nua{B-)jfiGR3SjDelEVjs@qB|4z~ge8#1v~f+fmCSf_oE9ck z-~oSatFT?2w9fR$X*<;8|MEz}+fXKWP?|POOezp{|Jk)uhvD-W`!G~YI*^2YtV)pQ z_LtZ>Y3h$1;*fWU*Fk?`H&ZH%N|Fy88eeZZe9-6lH&$;`G1f-;Fc&G|h#KsxQGV7( zAR3i3-q!Pu^}52xK-$Ye(%5R-VneE&#QhM~zO`eEsrTXMFagrXMl$bGz7%y(3E@hk zKzGbmj~>6<+rXlO}7hN8C4%%9W`8SI44T zN;p74yc+~F`n3V6H8#P_5QsNX@P-0ovh}#VfvpI}M?r(Z1D!oc(E_7SY8weKW1bX; zr53f5II>CX{FnkY52vy}R~=*XewtIXcO(}#8s`c8^c?1Eo@G+X=(YFAOX4V-BY@|n z)SSrVz1O-jy#qSBs#SvJqH| z@Z2gUo;y8g7(nH5nqpb)$Iy>h**-yF*; z^%V(XWlFPU$8GyF#EYE^Ku1Fs{>SWT-Ash*XM^7y1fKnLDHo%{i+JMFXjl1LX0Q1P z{Lh3YmA1~8YQbx6{%j;qFMB-!mULgY<0586f;;4Us3i;1AMq#YVS7?BTS?YaYiEMp zNGJJ!woX*j_V=#dYs0<}-hINn+Qe>qt3A0FWw!qwJ2Y#lf}pq9-bXV{!h0bk?@KDHqt1$ zc*q-U$&A?z|84tl0nj+Zw-xS*a4VO{$h7%~KxSwCX611b-k>jUI(_igK1j9Yh-?oC zw?c}cqAfgqv3x9NN?bziUox`ixl&e|`*j7B$*Qa?pg!$Jg?m?JvDN8zBpQ}u0^gC` zVZAfD&iy1r$ykQ6FUHx+dp_*NLNhP)LDdhSL53Bw*GT8y`dNRKbZDvN!3b%{rGPBY z&>mT*o73r{$XRdC3ZOSCN2u>!vOa^T9{d=chQ35ax%cC5Tm+PR1Dma)xV<^<192+p zn((fuI=oO+4f5;J+;aJZp%Mw0NzgMq54UwLs;*_R@$s$7$wKyW$wo`x@rbNXuwy>r z=ok0rUBf08?N9a5Vs&0kW8}Xx%bJTawV2}o@5h852;x;7tu0yyhUQ%^y0B%bW`5!&1SYJ`VWxLBg-zd?-OK@7JJT(`n5`TpqxtBGecqh zkB+$CczTjk`Dy&wV1?Rgr^NFZsNuzpEYygNoM(qrD^A(tH63H8ImEUdMzE=3X!6F` zeR9&mIoJ|gNZo8IEtpSnh^V{ArontU!RmA&mAN;ei`8IWOBy&lFfH;7C(C1ww<);r z2AdQ=GHUl@-{A=*#lY!Bc12|$Pt1=O%!6{B9)Y3D4~j5X73Aj?Ol{oTv1(^}sGge^ zgD7HVW+!aRrQXajp6)!|A4(x~cCRAf17LL_@}oYV@K7wPc$DmAyf7oE;6M`Joo$eD zH0Uq=b+_lhy8FDepE;<#RtWUK9RTNv?5`Rq8qQ+9i_4Zk&)Y!g2JKf8m*7J~l;INGCe@qm`G*38p;4l}O8B;^sYLg-j&0ZO{ncIPq2J7|ggMlf z=C8E4hN#(vnrdyr1@F%_LA-u$buB(*d!&=S%;y_gXKIL5l$7~}hCh>I8l{e7p%Il5KVf)TzoD0^pBzMDTv zi{;r#t87-a>hNt5)>Ouh%JnB%T!!ps2r-KOlOAXI7$o|bmT8c8CV=dzlFHHAH!#We2tXa3cG<|R5Ug6Gc+ ztfMOavb&dQA3wRg%i%_qxy&JuwdnfnEdIhuv=PQ0pTsFeO{?oTYmn=4=`Y>CLBlvU zmJ2_YV{^b!J@K)&X?L`1H&*8K&vbh)a97X>{FdKMaAJhRL#%fpqOG2r?e zII?8q^ez+ddgJAZmL}COaH**M6ev^co;tnDepbY}Pva~B4sd2?qt|*uCM))OL#*H* zvgf2x%+rD8JegsdAEC|CtJ$IQ_&3|V0qdYKcX>^ctXz*j(&||pInuBe>A^K^lzP&L zz1>&!hwgfT<>Y-L?By!8$>*#^I71l^WNx0x%Lk72wf`o9F6z3&B2Z7+=@61b^F{ym z4Cz0GUg2t2V0~S+qV`PZa&t5`^&&)jvELNe2`baLVF5iX=(Pyc9m3Dy29J1r|E!w) zw$Z2yuKSZMowTo&#XofdKhmMeIbO;#d&!tQv8arH`CI=7NsAz9^9O+v+gR9f$wmc~ zK>}_h=fA9joys6fw5roa93|5ru8yl*5Jw1av6ivd|H;jK&Ylpc)e8)za(Oyote(B4 z_h&+7!W?1AT%keGK1sf93Hg1L6;_~aG%xTK32>D9PC_BXo4BBrcSAj}N($HdOTW<= zLS#RhRj?1+-jE(k)CkMcx)L%e-uTUms)=Zmd<9uTFi%9s@pp6vTab7$@Zr}C`7Lu|Exck| z7F(8b7>*I^XKQ4#Y8GqsY=x{Gwz)OnkmV=qMU}wU0mt3Wm^?&<(cjRD`MSSEkA^`JTfr`XC_@7XEE)W`o zs&&~~xl2&!<1n1frsedZszBd!Dr`?Hd7QQ_xqG`Xubol2YZkA8(R=T6sXG_03^~)t zP87d!gG0~K3(zTH(>AXb`tZ!20ZUF#`8TG7s2}d!1+g{e79-#Gj`T9M-6L+}@L}mS zpywuERo?tPp^mxt{PjmlzQ@zU!}k zh!z_jEp$$W3MTx6Bm18F)OlA&Xpy4lYUcGnIz`sIOg7f_Io2%-^t36Io6}!v*!OJ0 zJ_#ZUf>r`-zpx+vMn6d(LqK^GJBs2W0Ux7HmP*J36>KC4k7u6oiVw_yDzRm(PH{S+kD0Zxq`tQ?z0Zq6~ z)$-tJ3;gbQyD4~oWX+xqq2k0|)Ah1!h1JvH+i~{kM5>>42=}fK+y&{;e11QyAGqS5 z3f(UdHdVYS2k7-CD{r13_c8a=AW{SL70SJ)R|3#4ns@xe`qW|=)|S6r`VD(CCnXtY z)DIdi&WRvp@CtR|$2Dn2MP$>%Tk>hX;u^b4G8ZKK7bOy~QcrNFO9LVpl>UKuGf1`Z z5bluNhB{Rh^3*8+d@#R8#MBS-_L4*ZOm-4*L@O+=iGxeyF|9F(ar&-INdF>)ALoJ( zBf~%Nk{Ws(!w0t2sGEsSi+f2t(z>)g^`}#vbw-!E`IxST5xT6pKqN+LquH8O!$ds|K$~8`Yd`tV z`R5uOPr8@qioSV}zM8Zn-5QWCC6}EM>{wsaT>QuQpzQA(dDB~+kq9L=k_)`};M_6_(XwvFgYi8@ z{?t|97#=8Qc7?hX@|^zJW`2!pn9x>jD58p?KmOv!($Vt~>nw2;1cU0`Db!PJy%%eRcEQN%Hxr)@Jr;Y9;zYeBNa1LW6!mAF zhe(qWq1Sr5GFaJg6S@69;WBPO^S?U&0VZk(!FBJMpXKOfpzPWvAw)w@OBi}c{tyW+dS0~t`Iw2n6N8;q#F z{$BVEYFb_2g@xUGVXHS&s1*^%*!A*+zW`VLNEOaE)3SzE%QNM4c>JpVfrn^#IsE+; zx!#E?{X-Aq(Yf7%S=r2QQ8J#Fy`W-TukxE`fG$V?q?}QAnP5s~+z2dmR*x}dB`@~XE%gawyL$iUq zp7f1vNl~Tujvjw@ZuP;}=s;$%5jYI<-YBO4(s?91!2!MHk2tB!bc{LI0+0J<;bypN|&QdW8dZ8VbQ?Clj zm#cz8v_{)sF8(BKr2}pfKWU^BZpzCV;u?K%uciNxlz#;di6w&TV7$7`Z*bB!6fM=L z*lBT|Y5Dt4gPFv+9~kbP)H|lMCV38O!#DE39YC$A6~Ecqf>rn8!b`o^-zV{eipE?f&U0+d9NmOHCwvY3vS*|m&qbIv!Xe%pUGSUhfjKP4dj zqO9(LF@1e*U{Tc55=m|HrDXhuMjxfVT)-;Xa|^SS?g%A|iZ4@b)?-gV>hm>bfm4N_ z|J>t|;1qDY0L7vr!(FO}R(EGWX=9f?dhsY`5rsRyPUVdOx^D(}{4i!Rgd_H?2r7XV zU%6}NLVVVrMZJQ|?CUWhEHSZ2rQg&^ds6o*88|1z+9YA3SIh+InBdY4wNHZzTih>} znV$p02Jom)aFs^2Il4AyU8Tu8CvM{8st|#T{D&LZcDwiS8jkILV-$JT5nQP&pe1ZW z%UcU=xwM%*;$Xwd(7)c3F~$tfCIwp=K1c_Z^_XX&sUvd4xqPpNgFu+ZiAF+h$&0HxVFe$ER`KLbeL<~`!(h)1a~aj06qU~ z_U*;`>YRQX4~{`TNenXxKy|jR@guUSOsFZ_Fh_z1qeMJiyz>;PI{KVoNl2SJmV5t? z6wrc-h$su3igz3vx9aQOtfE04`W`$~RwAq9x4=QWNi{dFz0xVSp{_4ao+k5VUf1Hu zOg?f0y-CU5q(syRVh`b^VW{o-`GATQF|4GdcN{kuOlI@^`kHd#Q8E~moaE4V>Q((c zLuAPR_Op);Lz${eYX7^SXx7EW(e1Ly87ArJV+G(k?bQ)p#>I+jzfa?ty|H#{+5G&g zyVV`mJ$`N<@{Dy=5sIggRcQs+NSgOvCr-}p?cG3Ml{9182U{xUFJs@b578f}-~0^I zn6K#yCwsOa@O!#Y?}Kp;teq{2=D#bqd{e@3KZWb^3QVP2jMs_vd9}K#6&&jLgqVH) zQt^U~_*LBL{Toj3q(VNmxP&GLvDWLQIxC(CQlxf1w{@fk7bcR_PI!O zJj$(oHPHA;a^XW*W)UM$ec@-@(Tx$031U#C|D@i%=Z{Dv{q<>usPl{MlDA?~O2IGp z%DIAxR$gATXMSGF;v1SBZgg|>D~vuK>~e2itFBBI8zg&r+$(nicbp_OH-5P={L6j4 zuX;XBVrA1s*z6avH_s`ycbZy#&|$nGq_~E3ezU4@v!^m+O_?-8Oux zNKv*=Ga|d-UqX&2F?@^@_a_n(fj_T^@||wuSb2zM`a9VWgr*a zpv8g6bFx;CD^LB)ZEAS_w_l9mJe2y`U4mSQ(@RKz|8^!!OrkM4Y4R;KdMscR@&o=c z>|jFuL6)LaMVX{|{uW{Vs3hiV%f-8LKjV5_^$H_}#Gi;DX}MFBQVB_hDDay8{t6jO zUV%Gd-k%GQx?PjO#`)QM_byWz)D7SCB}#huZlEV|7u?CZmvWg;yQSMMX9W+gSMr@` zJ%5@_B-OlL_**5(4G}b>E&qX=Kthr(C9N&Xcd3pg6_sJLR)dz>&;DfT{@#Y=lQSAB z3z)f{((W5Xd7ouE896qJOYcIkg?iq9U!6^7i4}Ne1bLYG?MX-q*Pa~%W-4L}GBT7( zf58EVhI{85AF~Y--`WwVr4Ey$mrf^bz0L0Dab-Fv&5u^NOED4znLl5`?&+m)!TmpW zl@TSYOWfobF1#R~aaVaN6-s6sma%CL7K98YcKWI3@Mx5kjMO3X-NmA0Wuh3fLJkm& zft^DthvpO)p-`Mi(+hMA(bEX!uV0l}ayzSZL;Alem=l`gs@~b*k1v?jeMxdRa7)8u z=wuFfCfqJ66d9TkH9=yUD!rO#;iKT^c4YW?Ad_jD5BYO8?bFS5yJMD#$s?hxXMYUd zGc*NGtpgraZgKu#cq5;8RA(#oFhoH$=+7#D=h=yAKsb59a>?O$lF#}I7PT6YkYXjH zKFMX5GqFVVZ(<5re5Ac>^knP(VpWf>vXUfeau-DMk0C%VpoJ0Jza`1Jgpy*)v3EN z^J$$@c69|{k{3fYKV*a&+q|jxIy!OpnjyB(@h~?PNGHGXYx~6O9z2#lxtkACug_tl~0N`)UkXX{oExH_Q!3q~%Vlse z-)8KTp$C%m;x0C4f;L0diF-O~QWB+l#1w}8Zzk^VF5$o4V=F|AAQ?S+U27E<>UGoM z9QwZrsZJ{Egd^9-4v-aZR^rwiRP9J;l-X?U7gRDLAKr|Fi8oE;Zc&X&7RfB0lVs6# zLe+#{_CmZbHDjg0N|BIX-%ldF9#2?NNZF&dA(f~+CWgtEgxsUbg(Xd z>w&*O8Z&kN(2&`rFiXDE&EnFnbJ+@=p{O-WwzZ(*4@)9ui#}m?c?&7pXJ-P)9X`$> zsGAAlS`5f6Xj873Se7G&@O3Is$N?@98jA5FwP2pu%r}LBRgbf~YG6=chJY9F2xEB)iyxB z0|Ug5-c1=X0Lvyx%NUN+Z)UxD1>tu%#PXxGMRC&Kv9~ODZm^PpoCnWB~$V|^~mNADNF%wu~ zr0ijRCS_odDZ*q>U|v6RE0t0*|&x}Vj-|3!4`Ri*|{?qc8tooY!q5moN zv%4$9sQlc?g28*bOG#C!l66@&dk#+eJ$^HRA;#>Ju?`+LHdceaz?$#3BcCLel0@MG z9#eUMEY@RCT$%oJ+)|EjYWGOFesh4^wKhrxM(s7e{pPWI9XIH0y9GW=78~$mAaG?F z>#N&VD_1odH^#0ES>$v{v-mu3+5kWkZ%9^GEM{E>8}HEjc1pczD$MKbWwaO%1@Sde zG({P)Z$Ho)aeI3|wugT>Kd48Bk4?wpuVx@e!2AOqXQ0i-wMF?y_1F{^k5%>#q*v*a z;6JW443vXEc^2+H$f?>oY7MbUr|ngfR`T`v$Cc5|w3Hqll2h=RB|ae$POuo@pWmEQ~7y+driGWbD1L2Z^rsbT3Gx> zV%kQAvB{eH$TEcZwZ(erOCBzB`+*@|Ya)&xCf**N_OwGKpE@L3 zV7y=O@q8u%QscFMOe6@Is z!&(KFXfqK#o=wYuMdO!nVUa}Ars2vJN3{)z9sszRSIlHKM~~Zi8y!{$fpEPDP}L5- z36D7y8t4hiJ+`EwCU6^FustTECRRMX6Wo)85P(2Wm325^U<>^X(ez`<>%kbJTmial zrDj2@q86QjU!Te-FRfJQFV+WGc}FHciPPt+<%BHD?E3DvOo{ew15K zP!d>ZuCyr(_U9L`ZU(r)7w-`OYF<}cXvPB9DV=D0iY)~&Rjx@_!|Tj> zuz6gIPzZB&T6`z@S>h4{1_4A*eCsUVKdQoQhC18O$79-SLe|#S1g#5g9xI!7WK!T`#@XFQZy*X*LrV2Dj<6p3qkS63>-w!8Hdw~iw!z`rP~AYmJMDZLx}Lvd;j1t0E`f^dd54Ce?$N_LDv{MhsRN_G)eruC8*5e zeXGG(66Kq**xF?FjEqka627vG|GRdj5A!8uBFHV)0}x6xj!xlR&hkRc0LEufVQSvj z`{~bV3PTQ0{*M2hdAO5Nkkxfx#ObVZBNq$+1u=@cWWg1JzUIjdFT>8go za>U1ThaxR%{`4ktUQ`4}7+>@(K{|mOQQl}9o-1`FqwWtWF4gK?5{BNOGqLw6a0~D( z`7CkZ(cI|W&$a@*J$wln!cTJPMy_xH!o5KErSP|jKzs-C;TV=qfe9QS#}AA|>_#z% zGRpzb$Gp(k5m>mU+&`E$h}IAfj{netw)r5cXOvm-(C`I`L|qE<&%Oh7bw9nLy`P${@f(xVj?}|BxKggrD8)n+6$w@CBjI_5dXw9o}Om-lk}D znovVS=P?{tS#VIr)bCIs6Fg&#%N14shQ|1#P>cBznl1;-(? z2Nn&AqF1_wPoG5}D_lHU3%S{E213jUvFDl8V5vtxT-aF888})7m#UhAC>trr{DyYj=2){X+c!Dl}-D)f0{!-~+sGY?lr(2x1oF5y1TojV>N@J@h z8+q16ZebC69CmYZocm`0#T-0xH}Qy>*H4&P6Uog5T@Jmtl`Em2^Na(LVP2hg*&aL+ zf*QL9guhcLIN|adiYJZ{Z2VnjPTUilNDzGEs|fdIB7|xDXp|se{X|dtVxp??l=wO$ zW7Nrr$)$%`U+8eW^Zw`+5ilR}!()4`+9BJ@7M$8KXZktU0-h$+zvw(R%+jaH)TtH< z>QGEeKnEQ$j&~AY2RoCplxqgi2B_T6^~*a85xHo`BAhUCpaWi+1OG0tj5~A72jZFR ztNtKO_-N&^{8ocNepf0%Zi?oQx|H4?@$@Bp+pw!*}op|9vrVv)?`zJ|RsS zib4U4n+g1%OhD-1jtN}R@wbUpQk!=tIWalZ0pX(^vKQ2_JNzoV4p6vNCdcO9!ZFHf za7Cj`mht7eQGF;&{K1{Jf}XL z<-g9M+&lxY7J@v}rMO%TIbMtA&VgcA-zBi)vNnNH8h7f*p`CsUy)y%f!FNj9h?&4x zq_V6$xfGZ3KA~Awg#W=P6R+I|xrVB=kW+Ni^vAu~;%f`46M4MSta-EiyQ0@l<_S7# zST-$mQ4x-R3)=p?6=i2ZyAn_oLckv>9NfI&?5xm;lm^H~veChWoE2$pw_csD=wnzE z%)n^6yKfmt-JO9WP0hw3qpXb~j&BewrhvtmH2)De%1JYXspufRt z{EJ~X`*WR-SeTC%_32dHS7_o7LMKw|&0pdX*&9dIrvZrKnKo{sWbS z5qo4U%bi6Bk37c$ULe#Ig(B;GZB_ho@?rN+msiDsxiI$(>g+M!f&1<>o1iW6i!|+9 zIrke8Nt=e-9}3~?s@e~^7p1A4li2k{n?4|#DdNo+@jc9b-uZ<&%=2x6U}qv%X4Y-F zU@R%Ik{tGuh&(%FDkDea*8iCI{lSk8=#z0YHjJh}Cx-ma$6#bKVCEL-(kD6jfX*X% z%mU7ZK(+CClx?6o6oftveX-IhK#zlu^Q4R%=dguQ4U|UHp#lycA4P%G_t0B8P+4rC z-P-+=g!hOSOTXRYsXK9Dgdo*`Psp=p)E5ftYAtG^Y19OSh{sF$*h6lpd0oD-xyS+D zf0f6-f;KOIvV#Lveoc{|f%jUZKwa zGxBNS#jbZ}mF_HgaVhNX zJ*CSPVk|sR;F-keft_645)7dC-4A9R?#NM#(wZXmp8W}2Fl_+y-wQX_@SEz1P+PhF zz3KqJ44LN8>%r{lVlwuaU-5=kHE2cSA82qHcqPrY?eGs}SZ~$8qpyrZTpitWbKAg! z_nD%X0X_DaEYx887du&hl<8@4ww zGBb|Dv-B4gp|&ZgsPSLkt8e(wnWq=brbn|sY;tO{5>N=yk)Bs4ZK@|S8Mb^Q?DpCE zs6O{{_MR6zeeqF4HJ{zZMj&Bn>1GMaIxQ=K9nNG0IrnFOX$ZmAZocz9N#_I#VjZ!w&(=`ClWs5_i0eBP4Jl$B>}PujFjGSNBwBl?cnz;cK)NO>u<1RVxZr+v^Y5iv9|3lYXKt=U_?cXY2MF~-95Jo_yL%K&rK)SoTyIVv`y1N9V zJBJjI8e*iS1!ial7$gP;_#gBa&-<+RajjW8t{FIU=A8T9``Xw3?2vzGRhE2FXTXb4 z7l8d%?ec-yyQX;xruLh#l;kSl!D*GmvBb(dClOWhW#fUnh z1_~zdr@^h_NvG^ceP(8!BZdPaJRID+5MdR|E*0&r4)?v6go$W=TEENpNjoB-Sn zK<{&UzM~Qw&`6}s%d2Pn3hb>v&)-|_Mvb6RsIV%zucrK3b3#dZ8dl+cRxnTCW+3k~TT;2*+G_do&I zK#5be*+aNa@5=LfF3T$#<P;Qur(Vd?OaP113g==@-H0A4>#qJc8V51DrRkXC7=Z!$9N0*H;y@!t{27 zN7aXR)56y~Vw95=>yR?~Mb6K{osKtOZ;97v7if|W)mD)|-!4k&R_SdDB(XEG z2^$u&P^D&_dYWsX;DFryMms~ahoR!N3j6BDD=(O7FeO|y0$kb>*`YWyC`{$M?11wH zD*>Dt1lq1FQ|ZaNSFK&!&g>p)-e;zib95a&FP|2h@3^DW0zW;iaFHHDWu9hSa*nw8 zIrPLw0nLmRNV;o*&`79SGaQ|u0}r7W2;@lENWTY~7A7EO3&C10K9NXKs3T|ex;jAJ zLocxoxu7uk;lh&9oubWesCBb5HVmG_u!37TkL1>(M{ToBFwc)L>u4RsXUQO84aAY? z$kAeexw zrG8tm?xm)kjqPM!*?lCu_6#d!Bb@&M`zP4Z!YMp^*o7tcEoxyZ;hiQ!{G)h67Mka82-*RtDEWF#J|_iO61|3Tho$EF}bw{nd}QbOO{*HFM2aM^|w1_n>rr0=1dU>&rdDLCk!i+UfP+^wuz&>orPD~riy zM|wL%Q|m)=0~scsBt}hyiVx5*4J8@C(O1$64>^B^n)xCjd2uVEqd>oP@ic!cmv1X) z{<+Yb!rW)B9z9LmYXYQ1k+gDLF&x9XXVmPjF7p#|;p&;naE~vV>BpaJez){AvkbGG zsau+bBfNM=O+C3;dM9m3O9;3`zGM@2k52?P@{sfk-BEv50Bc4D1Wht^$$UF z-j&F3fyd+7M_LlBk{#a%_49qGGdi5)l7|;%d!BJjtW8#<-~!Tt)PDBar>>G%Ss5E! zPU^G)+5A?yGO=KX?6sGa2E4;841$P({j>HB0i0ZhBH)!+o5F}87m2a~ml%!_=jHAc zt!w|QZN`9_@gcqW`}ZS?vbWyoNw0fR;0(Id*0Rt9qzl1GNsA7BT5ea`!3ZrNU%|_z zqd6M|T4W$}9Il{k@U%-5k5Y(t%g}a0ImW7Xk4=-s2d}`%&nA?+-u1noOe-ac)#Ngs zR*2=^ZhVM3tV*K^e>(&n|2!4T`iJB8NS6NaMaVN-%zmWGCC4r_Qz|T(ccH;-;jw)v zW$pX!-jbEa2JNCkXd#y#`Cox}YldP)-XkChNBLM1`%>8zL(quECVE@Bx0O}3dL z2#eIv`k!g$Or%!HpJce`1NyS`?IH>8z5WMwWF?Wx21~G-&K_{V=i`BK33vbYS}L(h z-l<$1UmiqEu&}~dM|^#~OXjJ)D&MrCey#qt59iWSi1$LS%Cgpd66bHG8BG+Pscsiy z2Rof}5AhFtIOq}XC+JzFxi7%n88b1M6P8dLA2rbm%h+hvXtMG`c01ReW^Yu43)8pN z3)APwUFjb!Y(H3eRMb+KC2b1fZV`5HIiyJ$av5oTG?~yROR*~(;5J{EZ85&wJL{7U z@$44%Ky8E|5cGKL;Qh4Z4Y~R#HaWj^CxvwZ4lj&I`*5R@Kc{a_V>=uoQ)lbjF}&Wg zQ())RwjjJ82LwHJs0(2QE6S-(cG4w1?X<(($tbN!mH^V51bSc07_)k-q3@N3+4%7zVwFhTpw&o0YfB>{0C^1C1|KQA9=jeJ#! zPQ~mK0axXyojCIM@KBBF4~y8EqC>j%_mt=zRIZ^($8UhkYMvP;h8pfugZO+ zT<5qAQDWco7;^2GM=#-{D<{J)BtfdJUPf5ZAaMiLxeiq3U4|ITOrvZCP*&>?f=*a- zuz7{h&4ptX3zC9+%^AlM>u8(Ctp~#BOFiR;f!$~0tL5-}jn3vDp}|S-vI(04g##?n z59vu?UrF^aFHl50D)AE4KN8j~8~YN)E&J>```&e%K-iJvm}-;GQ5S9PqX=GZh-Z&5SnuC7xbu?YN`KK|9Y=?2-nX)S3W#aEKq<_<< z-Mjz!r!aQdAB6$X7}%dNE&N4AwSOoE^t+osCwIPdNB#NFpSb_$3r~y=9)Cb&Xv5d< z>cA~LD&zK->Xq3b_Q9B6(`qQd8w%B^)MCS(;W5*deD_W`B@EjDKuTfdrdKYEZ_C5H ze9hX0yuzwjomw8|(7@Z)YM)$a-m+LfBXs9S?+&r2Z^_TDe98fiViC8Lm?uK8PfCqu zRZ8XYwn_m|Gv)RsIK!c${h1U zArI62h5?_yqB{#3`i|Fvd<+vELE|6k_Q_1?dZ^pXGa%~xm~n_nC0;08dzc6V-` zuXf)1+Bh-!?>E54HFcmr07y=g4tg&oJ;eWpxO6t~Nm$M%&doJC@MgR2TWxRAI>!h@ay~-w2Vwl@i*N`{%3PoaM(WoJ5ir2 zS8^4dyjr)R*w36LB@Ai}A1GFWNyU{X1li)_2<0B zEH5s;0Ek$e?wXKHQIAwz*9CsB>oh{dUXg4fDHX5w!)(nxA`p(iPL2gGAD+u83LSyt zxid(pT3Ms4p+bAp^L>^_%xR>Vwo~AD^|1t%=28Uxt(0Va?7pg{^#1JMgr&_J*jF&! z&7Jh-VW}Yf&qQJ!b|GU0Eb+NY!R_x_Zm7e$BB&26^*JduuXJ=Kr>cCqh%B3^QKl~t zRXZOZt}O)8HdeBd8u=F@7QdmdUMDCETz*)oZHI`lwOb|m?xmZd7Be&k#^qR%lQjSl z&Fp-Wi5y%`yTOsjg6i$;%nz_a*4S8)0D8ywXOd~!&6NR**XN74<#U9&cPV)9qR%Ai zgnsg&8Pp{nrq2(5JcKp^h%MqBMfB#Zis|YB4rHZ-6$Q8)2QRLh6_+kTgG+y^ONZa{ zTFRp{8y}G7GuS>gqwqvJ8##H|6w@ycbx$S41ZRz&I@hH>95$F>fR#HWCr8USIL|K( zN+Jqr0e}-HdTFE#zCwJA{8W3@yDzEs9-GDUl=?x(K8`crt_>#JYRMxVzP2H$i35Cv z_h_oKHP6Q9-eA=-b6j&1eOQ*F_@n7|b@WOG)|Y*JJIe_}x2*M-jvx0_GNhwwm4WXv zVR3&MW08e9n4UsSZc6|FrKv05L+YTlhb+i*(e?xz;Ss*3fp7Dk4@o+PDzU%<*sm=TSA~qFQ}-f zMyn*RxJTQAx&RK_37*3<4Cc?>2)ZT7nT&L{D;&e$r+KR_>Q8Y(C0gc5soi2a9%k)z z_&6U?s{u(MAH^;u$p!Wo=5)XU_PDW_0+ zbrovFm9VFRl6zU=oEEYTnSvIdGF=831Wtb`Ib((e$$1JEdTUfHtaKR$XHBf(AA2Oq z)U?Z?@}@UU<2$)=&Pz1;2mppws7ee%Ix1iXI_h&c6g=h5>kHRCmoN5S8zqDY zpL9`xsiObV#+#?am^Y${{zRYptI0D=Y-1U4N-P*9ft75bAnF{3)MqvD9m5lF%ycll zzzs-t)>>yVyYfV=z9Ib3U9HXy0v*`;emnZLZop~AvN)r%E=f*F9*|M>>iqRu%{2+q z6D7mP^M~URQ*P6vK2C)8Y6zleo&Rxqake(JhxW%u5 zlBthEbpOW~>MLQtkpC0FRzJVrssT#9TWSq;S>7Z+GgP|Qq-x% zLwSDNg$i;4 zeayOd$btw9yS&T2pec_(_X|l;zEbTI7MmQC6Vf%|G>FABn(JV01RVRl~3gl=Y<5qpUr*BCu~PF3RiwL zm^Wr(IaIF-r&)g*d#3d&p0duateaPP`PLns!qX+tgH$%Ej8$>VOLe2LJ@Y$zlc!Zb zPTx9tSkee;SIjhJ3U@L7AShGz>vtd>Ag$EhCedHnWGApy3~qnh$lcHy?9Er^b{*Hr zG9KN}M4q?h76?5Js7j;T7jcQVE#7y`3HVLI{&+6qcgW2R)(VBi+{7^V1RA;PArd)N zm%9{idvBj*6$An$=vgW}QBf!$aH2TXKCQt)`vRK!rPCJSOz{Rw?GmGq->=XYVmoTH z^)~0{?2NB81pHis>lU=9q!*?q3qSXF^X~Mm9(T5L?j)z>mo0GE*J+PAoFnc)EDqHz zrbOE-r9{t)EZ{~Bw&c8`M;}@uonfCctm>33!Rj(6K=0xg5~~Ev)l~zkmpMgX30>+~ zqa6{^lI7fHb@fuKEpPBp-QM1*XNiy5&O|J9p5E5*tPM-A6jo^M2YTfdmLGsNkjb*0 z&k)SIdkF+rn`K0UZ4ahUKWeG$HPgMUNJ3s=`_6x?uuuG_x1***FFW9uBV?;5wDlpL zL6z}9ix8LXo)L_u!h%}l6ccL>JGj>ki@AbC1B}ic!_+6t6;hN7i&(g!=KK?L`~N;& zY@*V!Dyh-gys~VqmdS0X)K{DVcKMi<4mVWxGMG+7q(h2WJbY61EQp0{$xZZ__v>^( zRJgcI=C4n*C)L;y9`s^IMepU)xQ0cpFZ1w6Q6`$HG}}0P^iid(2?p0bQEOm_X%2Gb z!8U7#&H+1^txHdX+tiEgqIV(1wo#?K({>Inn0VTdG^LM=qn}wvG?!j@Z+P70Mg(tt zOwumrX8D2Bt}w(>|AlZP1UBW6biNj$n){AtS23hpt%i`4ih#&LO@OMy8FE!3hoWhS zBwzJ+b_>eD>iqp>)_J%-Fa6#Mre4I_~0OTIW>oqv-+Pj${nnb?G?+N7Hkmvk|wRz#5_@&`v9ZF9xF?}|a|`qf)E+>R?o zWr~ZHe9Lk48wz_FtDlswziS@iZDjnTe!m4H(>{I6XOkF zVCm!mII6Mv9grTLasQQ3HGI!CAvE7IFK%f_4;(hAWL|Z^VF^fT)V+&px zo5$xnB7N0$8pdb)?mE`fGd_i?O4=+vHqZsfl2EHexC2;2(CuBJim_aU|K`m8*l>%H z0c%gUVVHK@?5qw!r&}nlR*R~6r{HXrB1ztI(r+wTikJlhsVEVvSTqLMgD}S;P5d%tX5Hn} zbNZ&|`RZrE2Gkr6*j>5F&fwVGY}sPqU=%KP3B}{bufn<(vU%KF?@>H8jQZz4F>+V0 zq*b-r#;lthswD@O0=sglv9;fI?16xNdTu)p4p|It(jZF7diR9(w);M_xF>Ivj0|H=u^UV;0pAijT!toK(S^@55{8=CkLpQdU^P zZcO5kaDs&adg>HCWd%GfAi}H6YH7Lg)WcLqSToDMXj=%XJ+wuB-~d3ewQ85oh|~yh zefdZL=7y2bty}ctS2%w@*KiPgFP|+U>t62))u_^XS#@?uh&n6vo?+zH5@|C-zVYOM zP~O8@w(R>G>lfI*0|L7~UOOxDB~y8a8N((QuvOEyq>={1R zRLP^dOYCdmD)ONl{vpQLt9Q)AbS2~^I@101mE*EDWV=SrUjM=*K#!#pVi5(+)=TXd zs@t@#)b6el@Gtk>|Du(y-eYgQTPdKh;;D<|5m274QFpv2}XQAdA* zYQI~WVw$fWV_~_}FqGfaM1frMZHL>Xb5q#%_gOboO&$FZJuGdVhz2LR7YuH*YdG>4 z{;lmb8<)Qz%+%AxU`|A5FEsVd3q6)^)>q7Aaci;3we`qlJ5#Xf(IBH@V#PY;#2pLj zFqFB0T@a-^QU{FwN-mzoJ})A)_}J|0#9&vfYg}Y8W5OKtNvHC~@(x0Xk1Zu-p?d&5DKB|C;CM1kq&^^<4f-kBPWxd0Ua$vunr~Q-~ z8kN#TKdErKsyQQyMBSED)mmQEn(MSy_Z}l8V_cZMyRvYbATBX-f@{$_H&2G77wz+s~AVd)D_0Ow=~o{ZqZK$uBd6Y}PS zS{7CaZzu_v-6-q<0(~yYCI9Vr4e2uQ90G@UY&9>9WRIZ`Dm&C30Oy>ut8o5tMu9%o zc^Iz)_Ws0FAA}g8kMbzXncY9nWfJM6nBAa9-I~cmQK;RHYpvkFt7{3(&H2l(`vl_T+?0x?f1#8SZE@i3Nto=1?>ZFcb z1Hv{jzl?dERxKg0?-i0!-lN4OYN2qN38$jD`8#93+q}-=ZBmA!3OTCUk~}eWTl-`m zo@;;q84AA05yf(YySv2dY1XOiJ+Uz^sN|agc<-=Rdy3~_qh93S%$+sDT zGvd2UO_Pw498E9ONJ|n_IEI=C*OW@R*SimBUS1+d-kI*AiHY4FowsY%}!kHnSh zvNw82Y-h2WV%sS>iFzZ*G13NQI*3 zHy@-X=Yxw!jko232LX_!X9tu2D@!Mf#B{t~vpRJ>)r??x&eFN<+)2=)lEfy~CdP!( z2x^O8L-o{u=#?nHe}W``vi^=)KE(Jg$DvbNTjo2p=VDCl!SqrdTw~n>1kNonPyJ8QuOXo1HO$BG>-;u^4pm^9;#J&hC@)zLu{j;e~%L zMzX%fkS!u<2oC0%k1{qK)NER106eFxKe`VK0rVNgxe!n>?hCrbW3DQ$GPeK)7s&G} z+{$V%zc2&^+tfPIM;~~2V&`Fk(g;TWiZMOTF92C6_KOnh<8s1~haULTmUANS{^(id!0Xh<83nu=O)>9_QS2*dyL19UO~sQha0&5tAV(NSXx>far?Yi zHWxJjqHYW5BL~pPgMc9V(%>8bTSKRY7M8S0lq#0yR@dWPNF~L0+5W!u&04>FG;hGd z7~8k<#Da!9f3$&nbjyhnsE6fSxK{0lQPjLCR&o}i{tPC{OIOVVh*vF(a{5qd{^z@) z&1vlBo@wpvAEqd1`Z?O>$s+eZ)(>hTB)PW>19`afFT$B8)pFEJG~t=QAC>o%D_ zYm_5MU}Ly=`}5!{gaF`{o5Rj{0Mp{Y{j8zCzvua45J$(2*(wwk!tL*{Lg~E*c=19x z@&CJ)-Xwk}kH6O?0)N^4J(*oy4|e;%k5e)5yDo!%eN#(>glgPe0j>9#JDCw4D3rnW z)*!*<3oon{y8J^~{fJh+(?N@cjQJl5a~C?g?t3`k!8MeD$o8dl0%P0F%}d-@WN$Va z1C8(;R|VoR?0Fu4-wP)6q}K#|fU$wx`uZT*fYnj*1&aR7Wj(?9Y4Ar9xdvFQj(&X@4ls@IMvkaL714AS7pJ$M*XB>e`-o1@q-TOiDoD0GnKXnOD z;Vu;TpW2ozSMH8)x(9N%=sk={>=gICr2dab`&c(_!Pwp%E7#W76pL)J z5>5YkYQX&n6%RZj)%m|bC?3}k^>KC zp!Bgn$)Du4-|yFFcUJ21Zl+)WHJC;Zw5o(WD^wlodaY{O*;F2|;!`m8_D^}{k^g>i z1$4J((eA>^4$L0>4d-ohKi|KK5n!1eB+~hFMMeIE-ejIG_#|>U`|9)`P}juA_?Stac*fPu{!7Tro#Wy`vIG7N?1kLHy`B>rUbd{qVI9q|26re zy{BlDr{3Lalz8x9Tbb|O?1H?$yH)S8Z>N5iJ{LF1R-$wYXG`}l+7m%-T~T}tpzZ|* zd4Idw>}#|qH_)I7Rj5p&`-Y*FLo)Vg~^h$xX41P*|L8m}*GhYSR^*juf@@!{cRQniCWgm2p*3tYu(WE)6qfHh! zIBW6#$b{uK^eqV7tPVc0A(x<#Eu`juFb6@A`?@QZ8q?B{2`;+?nW{Us20+W9&`ZPX{K-CZs z`*!Dj%f*?tA8>8MFGxp{mOIR{G4NyT0rq9rSYR9t7FyyzOmyvce z*2aXRt1HQ%O*9oVpjJx&1~qsbF@7!J>IK-P>Sax0Ne8+&^rC5~P~YHWg;63&ie=%k zOGsAfC)_9)9sFh=11@=PpOBQ891vYdVynD%gnPO>0n1aOPR47F-9IwqZmX|gLYAHo zv&p(gQ)D@#hudkAwnOPqgqe$2E9PR>uGUqh&RtOmahBEt53S0g!;Y?+#=N@zWVI6N zGV46S*|9JxL+5{oBwi=71{1J%l8p^{AKhj`JI>lUR z?Gd{;r@l9lIN~dN5%EG?oSCV%S_~d@bAnj$9R7QPqF6PXX%T*Q(|e@jM1Fr(mX5)G zl!>*Osa&v1?T1d;lz`pf1XF03v{qw@c!%SZvez1WPO`&NweHe&XfPo4jHCpJ)+&*d zp#U&?_;0+n}aHV{>c5MJg`(JYxr!LW#f8gm=qN>;sYdB}6o5~@Ku zG~|C)&~~j5k@=R5c?{QgoZT@zJ{e{S=a5r)dta<5&4vABQ~W z>7H2%-ZHTs(u?u9j8@kmw_(EQ+PQg^_}(w=LG&b1-uWb?H6)ue@B--M*v1Lp7S0H8&< zy-|u-H+-`6PH7pNTh;~uRF?1XnPAd_G)zsAV&Oz8Ft%XHsG^B&?xBY7eC6i0n(vw< z%yJ+yYuDkrFi^?I1Tja`NU0*}gwQ35b)a~q&#VOO_K!)8C zwAn?D{cwhw(chP1EZ@%7>_tJ7Y)P&vj^*^cS@X=Q{p7vwv*yC?C!L`n`E{9Btb0`U zao9bEn6I_3`pZkFwB#w>>jwd8Iq7(Qo-@iPJYgH zt-H+Ngbj*dV3-7uWc#F3J}jj5;WP4{b9s*&f#~SI*{9e+V6Y{JUiN-t61x%5*L732 zyT=DYh)I%(kN+5_!5`5>b#T!SUALPzwjKP6vwx#XA71XITy?y)y4Eik0C36^Ev9)& zjy2;;C~v)hhKZFh74vFTeU7-Fb3R>Y)~>VUa&C$~5_*^nYIm>1Y_1BRQak{je1?E7 zfZP`f-dNGd?p*O&gF{cLndnM~3d`%ivwk?Aq9jP%Z}*M{Ry7Ex8Zmg|m==6|6~@?r z+5s?S9;KZB6oEK&{V&&p;0hGWH$(`x$B2uIrjeUlx^Yo9{dbp)ik z8%@Xd?)mMA0g7Ay%^)(Crw~a=)3|E&NdPmA`nf^CmMq{$!k<#ar4fO$Y0$j!k_u=3 zrJ05(>{V7%e+jE}a3#*se-%O5qAH~{tJDGVy?QQSJFZyqY!&C6z`!N9ZEw=4QbW#X zeraqa5zV58s+#!hjqb&U>c~^?cc{NIw=7g2c$m~hfU5%1_vrq|3r4Pz$)Z`eKQ4V< z;!-q(4vlsvVYxVsP7{?C^|*3PUCZi&O-%q6+u(< zx%Kp&zgsrkFIAI>GC=&s&+Jgqip$KM#(HeY0r4I}8eN_E@Rn8FpP&R!UNrdg5;Ms(x>MWJc6@7@h3w~~N)e<$C8JyEs77Pz8immIq_z4o^fOi=?ke~R2c z&aC$!?gPz6N!m_D12g)9V)~`hm2KskNgMCInp!TQGGDC<$+lSZx4CMwL>!u*icA5S z)m+U)Xv@kjq4~6QFjJ3t6q%XV$377c+oZDM_fi&MJ2EnvNjWN7 z6$#a1V-S5xn{9}$Z@1?R%}SC?M12LJ*CTC}8ZZONAc=cbN;|HIWD@jG15$wi0BpwP z+{Eq&V15xx;5oy1&(`i^S`aeSL_TEkN1dd1gCu{P@{sx!F>M zTcE06!g+ZDXdPk!`p;)XJ9;68shGvi00~~88hhFH&v8sB-@tspMI>hH z>X^x(OxN>_0exj-KIj!189&&=tm}8Wf3N^|BEed@386F?Is<-+2e)2hnSJBH16_+6 zP2adx5*B~pTr49!%`<%0TFg*-to1P!<)qg%FRo0vN)ngM*3+s5k716i2R$~@R8chg z;QqHk+n0xWy#V%&vB~DlpxwMg*Z+coPvITx?9xKs)#tXB6=td|WpJkIc*afJC`3IO z3J^_m+vhk*XF|^1(bM?MaO|e@&w~e3W=-YJ$N;BPZ9aOH@^;q@9c!2>X6b{c8WRxl zr_q{(stxR;O&2njW{Of*9ymB(S=mje?3W#Q#H`E(`@lM&$w-oQ2$G7wy?1a~a3Phk*5Xah` z)6EZAlj)?LueR@@5sN#S7hDgECt9>u6OF=x(`S|^&s$7Q>X^h&pdQd;1zY!I-o3l6 z__uIhDIurQ68ejUb{l%%TJX40#Kzr?FE75wC)}X5NFu~>X$d<-F!4?sRKHAww~~^*&9OwjB+~(>!^;v;bRRH`?Glxa*!jTivm@8pMae9+wzifjRaRX$y&qZ)4SLkt9b*38 zr`8Yy#2pa7P5fk&d$Um~eZv=UO=;Jd7oR`4+BTGB8Gzh5_^IT`5;m+QZB!hyq)&DG zAJ>>P&@d+J)N5SMU{4RBSnVn`Mn9GTgM0?nY}Y##M+-n=PHJ=aZ5^yrGDvNc*$vv? z0oJWTRjU{NS8sX{;~KDW`R}HD2D=2F)n)8Ag5eG*=jk_ZGm%?4s~7WPl-ya#z;b#~ ze^cpj-kH!r{CXe;46EWH2esmqoxrOQHDmv(kdWp$543IL5>V6J*vSNW{5tcbPx7rr z^pDQWjb0H+f2LW9w4Z&@xt*$O9EIg&MtYyh;wa90h=HitVbHy(S?05E5k;^Zm8Y>= zyN;}Y5^)RV`p5$rU_6J=g1g89?VYUSktn-bbDxYgu9#hu->6)M+c;VLseOZT*z7Z- zqviLY#e|M3g5FI>w;HW4|6w6B`M|_Xu0YZ8m2kpnSEj?Qix=IUB!lP)(1JtvfVK}; zU;@Ut*+&)4`?Im<8KDr5YWhFbc4Fv0sQbrxU;)SFV~#)R6QBho{@yzJIy7S-*t6&1 z^P2g4MnJ=B%C6p8W0eS!pKN@52~#qOyBxl8bq^^D+rKedlPfs+I96SJGaBvItFBaH z?L4k@G%@><88VZ&=@MsK?vQY;VkUF9lwpdxR-11a3nVzk*Bszu7MayP6Fx_|!Mh&C<;Z;HoZl7~8f3s-PsTWA2KEKEL+FRewmoNr z8?~U^PggCLioUkJL#mtABwx1AQDqC(jx*}5){C2duMpHhdb^jkt%fQxz5WEzTw z7k(@+xm7714jncr$G?1Wzt*@cAQgiOi;?O>N6l7l@@YwB)CHCs6sDqJMcti- ztJ~|tp=AvlN%2!Q*{u6{hx5!lJCE#awiHPdeG>BT0qYE4xV@)J{%t+P&R$t6@% ztVEhTQ{xKn9t7N;zreI$N6hqiM9Q%N-eqp0sF}U{%1=nHjrW?d=3dxAxP_}eE&D?~ zB`s9T8^jRHg^WC&|rr*EeTk+A@?Q|r)- ziLiD@xOM19qc~GsRfT_lpcR#7vah#?(F^73R6Rn!xdDq-?o&A{uY*Vw%Unshd30ss z#QMXO1dEwLqlAzFPW%mEHj)4{P>&~33j5&5Q2$|x-bIo@nu!&^=e}AW%L+CwAGcuP zR(>CT`wH#e0~IaJQ3H5LFN)ys%)`u*kra>Tf_OND%}%NBA+w9~+knHk{DydWXIush zPnVkZsGIo9hf@Q6$h9}}nDkxdM(&|w1#}+E>!3ACqDRn<3zRDil^5*m^U^>{HviC; zcot?f;g!x?Dm_FQv1yrmiK9f(B&mi*cA#})haG^1T%cUvd{$s!<&>g(`f0iWaCC|d zZ6oTjwii~o9E7~Sltsv{)HkXa9IhP2q6SO-EE82o7`$*_Rp7m*(^ri$n3TwJIUWrs zgu)j!lL``&zPl4O=w$XHdL&Y`L$isYS7WOR-K#?=MwtPEqV{~1Z0$8-WN>Iq;%W9P zC17+)rp|BA-QPx)cIWdwl#}s=zUFVVA9?s##O zo&E7P3!k5)e+pNhmie4j8kc{n1!D7Q@?a)f)rag99FiEVYy6}u@L2F2!qE@~11+C^ zIR!iSo{vB(JgmhIj0jD`ppXsrVZ=k+vHHVxd=wQX~|SO{ejvO5_)zmmm5f}q{4I~8~eiVs=$G1rc70W=9wz@J7+?6 zWv;cE0RLW6hCk3)ujyZ&)@-x#XOl-|OP~FeI07<-LF~~?mQY#hRf$?fhS8Yh z*@pQ!U9G~0uM%M&8Mt+89bIaTu&44ZFm3=fC&uM=r(j?z*UQt8>tMB}WwO^#;@VAxJaANhs;$kQ z4x^6nX~1~%2MdQ<1>H}#fNl*|(A7|#eB2MNuWvA;%;v57d3KgC>cBpK5%4e$Ln;C5 zd>*vm4T+tl`p^{nIK!S3N+zyO)~DM-$;O-+-|&og{?-}xw4g?DKm(QDT21=MnN=6! zb&onr2MlNYgmV-#%2i`%QX0#p>Mm?GU+zzJcTBdo_xAc-rxj;H=y8Bg#)VLMM<@ znEil-yANiihq(H7I*)M9F8p{&UlM$R1_~4}*t1rkw8tUNorNWG$#&N6SA!9cdCctR zf*GHvd~l7=&1)+r{N5w&`>h{~jJ!_-k<$WQunRWl6vE!l5Yi=^t&pIuylVYCB0jq! z?{#SDv?JmP9ee-1kk?` zb=!eeO^eD!`&WS*3d!v4o*|h9R)KdqRf&&oIK|PB0>XhWrMV^d0qTs%D>5{V-7`#w z5$jv<>*ocPi#_^$u)d*wzE2nq+a8zxB1bNkyW!nu0EamF^vXZ)B%X316WMRT-%EuI z_&u3tFFFwbWy6cnw~8Y%R=;zO(@TqIV8z0Q1rolGxFgzTT+u#UVGA3U6j5Nc4KNfm zr0ydi9m!B!TUVF`Njgvlv2Z)xaE)Szy2_`%3)K`tn#LIsP2$Z9_>Ft>Zc>wEWal6hdx_tL@8-8m`U z^+fn>ZHF6ZcxA%-nhNFKv%&yY57DBS%0ve%K(ZMQBhu6UO^g26;Mwc*Fo|$u64G)F zljIWslTwRnN2ltRai6Skdd%&qGY1@YlSg0oWAmNuNr*$T>^;;Q%lO)G%_L1Ga+3EV z9R>U{8CZFem=ZdkNl#sjpsWI*ocYRaLL@Aok4)y=v-oYAp9*>vM=FgZ2D zbyNP8kVtb-F(||0glyzJHNl*A<8TbDGx=uNoQu!WnfJhs0@+46mjO+!;n>Hj`y}>c z{*`O>UR2-i;4$reW@Sa5YGFsYip37o*L@32Fbh#l98ANGcI{d|n^d1ULbm#i_E9mZ z6YM>=6h{$H1yxhb3&P`){9kbUJScHwasFcTriPY|bXsU1FN=6)*$ZLY)bDs1%?r8Q zsz3q8+jxUZizpeLM$W^fSx8O+OD>F52~VPfQAcd^rGY2Ju$6=)G=p-1m1FiktQ!w8 za)YPoGF-oCEgRB~CD*1>(qoFLT%gIpTo?oG0RB2TS{|BCBX)bz23zYc8g$QJCIfelS|AtERs`h0n@{vb4IfPi&z zMX*O)yko*lyfZ{?pz`*L-ZO8TxjCYysZp@t4>r?4I{(nE+|I<|r)&{jmh4xhRC)`} zt}iA8K>RN8n0>$!c*>T}yc}@M;Z_RMJuh@G@urq3~+6~n1G zc7^(O@6>nUw-G9iRCa0!rI;pID{UTAk(^*bkl>LesI*j|UM{4g-Ch^=`SPQxw)a5F zVvF)}-bfZ<29;>^05*l$eC3l@kKiP{@#C!is=ZD#b@L6jm9F_>ePZaPlH`RKfZ(h{ zV(a$VW9d7ESJxXlxM_nW`e49K!G8R_Q?~+6Qjt?=Uy5KSD4!XHYkM>v&K^lXDYN z!e2<0yH-{@-@elpF7^xBNj?Ak+U58OU)9L@htATek$M;;H1ft(4kagRg8_3`S+9LP zgH*mH*;_7!?!-Oz%@H3RGJOPKm-i{fOP}eM`mLgN5PPIgnYrjA9V4InyPr}(kcV=W zzu*#|JT9pIP#b#;SC3>1e~YMu=xP3Zo7XpP=jg)NVd#P)EaJOFE;VQy^4YYk(BXwz zur13Ni*62MNi^q^rjd4>StvlLYdqE#RcIs$N@5+_e81}ai2IHjVRfEmWzKprT&nTy zB=42j5S(+bOPP83v_IG$RJ9z_FS_>7V`&>;ZvZ{<(@^3VTh)jS%BKg4})N#tpPRkY^26JlmxNgnYrX=%r!8m3UOY`os=WdZ8M zhVg!fa$#&eMINt9QDox+#ot-zgZhp|l@R_1TRK&#YyR|Iq6;9Kp3`95uVxg(S8HuU z)JZL+k%(b?7n5oY$TqFrQmPd>mwGsn`8k*dvBW932T_-+n@b7?nj0 zNSeSxGvn!(H${{CFBzPTa)l51WQT+=Ot+rbI7Y;QqLn{w%{V**;WSK4nQfDPPIYWI ze&HWbM3w8ORhY~@71^x#WdNA=Rx-W9#&=#&!w5?efEydpA%9ZzGP?E4mL(`;a)~3g z+Qj@l=cTQzEtq3cGA8+r%(Ju)Rdj{A14RdR${GST^k6`%%)SCdVeMi+{HDXs`O8;> zCl>x^8_q)>OY!K!JU^wbo)H4p`22PG#K#S4(Q)5A7T)I-XGdZHn3IH^g{iazLlY;{EdaXIWWJJtLvpz%vQWgqOs+JZzmW4^Bt zHHoy3P>rnfGVs$sbyRv@*5uZF83@elJRsIzGop6yUFY@EWko0H%w@6+ytl~6t1HX- zNsFs`Po1tVD;#U7%Evi^GNko#i`Bm4!KrqN9*lgJe0nYoPvF<3;V0Sg{%>`K#P+`4 zrmr;57NQ(D^!JZHO2iQc@GtY?Ybp}3EYi>qm%4z0$nNvk!a$?(G{3_YuinPNU@n89 zGajuf@O2dz^pE0?z!G9)=H$2jh*Ca}i3z7j?7hx$z6Yjyqp?P9(yx^pQUcmbEN!*z zPi)nwoD>l3AS<7I90NQJmYPr8-+6Y`X6uSnYIOa1pEsk4NvsB3A4=TUEV)v*eEGp? z3YnXUonq&aWxvg3_u&Mgw~@}3D`2^{T$)(pc=@A=fG0z=eWf!FMmxnO;N+flk!bQi z#y-YzVSN;rHNW%UqCr+?-ERR!GR9pZT_&u~<0_V=pDY@pjZ(M{E`90TngGbE<5!(? zyudT{$8)~Ql|G&EY2xw;vQ_%=YNZ2*dM|)o#0)#xFJAoF= zk8mN<+~wX7WcY~v&tbLKh>5^vi$Pw9)s^{7!ij(JX0P&B{3eMP3Kdq4oYkl!?4}Ck z;ErC#7#cORG*#5+tkb4?DM<=C*&LCqqSgo?nmLg_5yGPz@mqej*NwIF|2jMKXei(R z|Gy(qwl;eR*@+O!Rz{Rvl6{RdvTs8MshCodJ$oXu@5@+5*|O6}mS#*7gOFi_!QgvM z-tYJK_xpZ7fBeqxKF2xEF$XjEeP8!=y{^ae@q#f!@dvZfyXvY^r)Z&uyT?YFdKL!Di)ZOSpLU&fPzxFqvz^NtnhHQRwm&_w-YcmG+2Fd?`$MGMz0}>g{jrhS zK&ggZ&rNKLVANd}O2`Qr{7D(ecq|mbogr5+XrN=jV@W{8D^!-nMtyImBrH)>({ff2a2? zv*5z#GWD8wBN(JkUwyXeKaJ?92z!eAPIJfVgu6 zZ$P*K%=iRnzl2&bZe|=)YK&#CAg_VO2+2dXvbO4eQ~og5_o?M{yFVk=eLuB%@T-D5Mul3oRGJY3}z(Ii24Dk63P3 z{&h)e9tsa~Bp(UsYK`RYJwv*hrh1kOrG_90V-c%|7~8{W{Z4H&6XY)sMXl_{sB=;& zx%@*6?Z8Q<#5wxiAt6F2@%dbh;TgQ&dMAkfuF1dN`b#M)Vg`y*?f=BO7@;PV-eZ0} z^+LTPxn*mpi(^oye6s6u9N4c-=^HDvU0|QF-I_l#fgYd5ki{!xOPt9csA*h5jl2o@ zX3ec#2QeFUY(o6Apu@si_zt3!o)L_N1AfXG_jJmTi_D zJPsux@H}l~CdZ5qm?vTFD+!K|z$XjJndHH<{t3WqNoK2{MRcYn>rgjLalj#`KE5Sz zB)(vaB+IXn*pn4EFvGZYR$A4MhxA}An};9Lp-*?Ay#F_=b^2=-Cj*8iqu03`YyCO; z0&OcV_#3}*Y*Ax5)Iwq4AH&xYvus}fMm)%c)Ayb_rdZf7v~e2zBp=Wq)bO*zY`YLR z8Nwl{c;fL{`f=VoHvbUAC=Z5gW=F+I`8{wY&AtK*UYjx`uLtPa7^dZ)_|W`06M9ic zr3RU_w;6Q+4IQJ?8mH1rq$xlmlHT%F~&UVuw~R*|VyX&<^8 zxqPT~1e2a#vl8*St%5pERJ#U6l6KYn!fx4hB;;=o%yFd&^cd|Jq^-}2{^a|e!XL$& z`N)I;*H)>*fQ`rtH-5Tfd}O(0i++oIgIda-zNG&ch2`)^fAJ`uspim6fQXLXeZSjY zh=X@$T6FOF{8+xdRaF3oOt-(ZJWsDo79E z;IDVocu~me5VDe9wQRM3^DY5hb)FgNLmCTr_|Sw%ur>&dqTA}>k5a6O z?W(^|j@vUzTZ>dFOo!C(@Z$uI)Y6Ri#>&=sB9^$DG;+TYeWb9 zj)M2#s2W~~b?%Kd*-F9}<2s_8DoPPK(k35F7PR;psz}i!4Y$oL6K0FAWO@DkWM|v9 z?(6IDa>!IqhGk;h3>7`&76q)Ab4pc^HC4>3yIrD8=r(f4$EKyQusR#=Y#2=!>quhc zUBFEEc6SKK<&@2dd(+--fV;njlvrYCJLxcSU16tA!#VN<|Bl@{%pzI`Y`t2q#&==S z9YIj&k$wY|0(1MZYzRPsj|bl5d*$!dicE(KXzp)hFy+de!%lh~k791C_~`I`Gg&l{ zsKyEQ{Jz3G7le1p`F!$Wl3OqXiXc!)}a7K&7w(DupBs&=M6osEFuL6&!LZ& z5dXDP6|o$kfjrcAI_S(EfONzW+F_9ia73tYSXMq*)1PYlJtRQGEz{(stY@8 zjV^#$e;^-ACr|D^PdqwIQ#+>skkbDLe3Xii{?D%mxsm@Tq52ODO66Bk_s-4;L(k4| zm3kjQ(vAgZf1$9!UoGBrBirT_z`opMEx;Hj_Xdrc{s4XeHT@f>Ht{=ysSlB|p}A4K zp}-df{F>T~mDJaUs~q?-z;r-~stzHSw|joZfRnMSb-){+ks`8uC59s!Ir7YQjE@$G z&%kvb01&L^V~^{Aq$x`&ZzdW&B@AZ}s%H6${T2KMzZpa2Ua3pIgES^t2IEhpxb>8^ z(`Y_UXJ<{P30Xd{Jj4;9^Cg32f@W^mwz0?t@*^X2SX%f!s#roJo1A+0eX&G}kO*rM z*e()2wOEvw*D(J1+hsEPc-3^H2A(=xZtDEItl!%KXLG!GzTZN;X{fFCA;TCV)2!`7 z)&Zj)J_AD5-K`0ZXsL zxjtljUQ3>w{?zwrC`*Excao@slBhLmQ1UYaW`NVFDs^3!ajEJiG`lxO_Ewt|+PKZ~ zywqIY0)n*%=)acY1McEj1DwL3n8_Lu$0PVr@^!aUt7Xe(=@*LLv zs1{%eRksW?)b!OUk9y?%{NMR2Gs?Y4nA04o*{75(pM<@lqOhVv8vK?rpntb*Sui}e zWNNbL*lp(!(*l*Res@BftbZ;$;v;JCCezU9fSuU#ok6X6psdBE{LcV^()#kQR$$N`I%kvaOojv@izQd#oReid*qdKLqi6<;> zN{ydxY-03h;@uR|_mFzaFdbLKi$ZC?)-mEev(0O6KiOT>-&uk1jh5ZoNCBqSJ2c@Q zPJs6CDg>?m(i0Z&Q=W8^pGf4e4(O{WI=Km21?c$hF{`(zzCg*4a=6s~0Nn?7S!Kv3 z{!vZTqa)bk>OAOs0vpomjM-`5np`Hk-H>GRDyh`GKX5IpOT|+=Q=i+eu(!?(Sa*;$ z#fsb}rc$+T6D+2EzDvVE=+QGkT5Xk1y0*yuu15J=;@c103MJ_HlT^T1=)Uq7loq#j zLh#f0(bj7vS2m-oY^Ocl7JYs6OHBJL1KdMImzyaKpSWGSgBqe3=j9WNt4eQ`>fSg+ z;k}U8A@0KRMQQ)9EsM`KrY0f@I=6aX=MW}SCF7#2oRprtlroH1B*tc{jlLVgREF8T z#;-{QdS(6Y@cYOLr3JV4f6l!nySv39l8LWOXPL&LP^yq${2)hq+2hr7EG(d!`I=V@ z{gA>$%PR8@U$y|6cYs$8xT%_#fxRF)_Y=4mqZ)F?B>A!Pvk(()DNRk}6v{gtv%aJ# zE+dYv>60)^JlEwc?!P<0c{n`%TVrN?X#3G=Kwq(@09YrH3b^JLjP^bHV0zSni6?|3H4G4bLjPLN#d_ zOSVn1T(WX!2szK{QYPI^GZ)f$?-6G6nPQn#fi)2pYL{b|5YzO08uG?bJlY(c}zOxR{E|C%)#h%V$1m zL#uK;j=`BmKrpxW(-!vHZ8sPrFHe5&V@H!cO#t5(D%&5wp+G-8`*o@B1z` z>*(`JfcSV+M)0urC9NdhuM5Vtw}Zp5NAD1XWL^u7dXCCERwC;3K)UZsv94j3nP`fw zg7u)X!xPi!X@r?_nR>3(l2SL6aa6r*m839#ky8{Z=r)YNfWwJ>}e}#6nH!KvOPU zvm=rMnmNAHR-qA_^FqP%ty)awcsZi-s&~RdoW2LouG;*euKo_4zHDISV0uC{=a!$j z+?;Qt9=hyLWiD^``91k&xT8Dn8P|uQ0|5#a; z{TFCy2~x0pQJoC{Hnq5NbSXtTN`2zEpzBkchysFHiiQ9%L%`?u4%f1qyyvy;vP(5ckjU(|iq24oY7%4Wl@qHL!q_h_T`b>bKKw;W%T^cHXbz~I#)A4i zl00YB(-;2x31z8lbWm5(g<~Ej8t=hO5$lxj_(;t{<(ZuJB;i^n?elb%+EdIz^q_D~n)pjwgEFF=tH>27*| z#agM%d)Z#uNP5w&#IS7u)&7>*0Oy$ zCE+>S2{np!LrYbWjh~qv_m@C=)t6s1cb)f{(AXq)H@MN243^*9;)(Xkf81xr zuWufr3cMAAt~ME+dUkCSj4{_utqb7z-gl%V0E>Z#s(*1{>SO&trxjCEJX;y!VofOR zwSg6x2H2`%ZIFS1{26R%Z&|na7j3hwTsN*N7Xeex@y+vvu=X0Mr!@XFbycMWIRm@r z%@^xrp;cwFSuJ#>jte_he_K(G7)O-`Wl76$r{XNz4;a|Q&R`BRVFW2n`N&cd=Yd4N|40zZYp17c& zJsfO!$jieGHe`XYNNreSNbg&j$kq-Z&j>7Yy?YjaG4eX&G-E;4a;fQ+2asF! zsew(6G#a4!v$Nivri5>;2$&K5L&l1jXQQ7(g;Itj7H%dnO00ba6O{qW!gAFIH8y+O zw1iz({WuNOv;$CcT^{3Vpln>6>{;oZLUg{BZH-|_&42kmQKt1Cm?)Lf_Y?xMwc4#V zd?Q+zG@@euocsGiEUXqjo_hQk)kMSo?~L;xdbdGQ$JA)6<`Jd~@W{E`W{EznWOsL< z*trvD^I%Ok_$HeS!V*4b<~M^aF!Hx{7=Qa%PP4};xNK^2R_gYwQf!*l;_R@2fNMl; zp?KkBTC?M6C!|#@(*#SQ^VLMf~4?v<>*l;a0U2yt1%2wjPx=u9<*{(An6 zb#_mCVwO+FAsNd33$iG^hy{dMcN%T^5r>T9vWzU zAdE>+mkDwbeiTc63Ji26RauU6 z9H)Z#XOzR9R-fB%2|}#-?d1qz`6i`f0Bst-J!?2I`9+vY!hdR=eKt^)i!9X%tGiIw zV#+MkYVMrx{8O2HD)%Ix->W`9#&)@h($4E(zBu!6^&;t`d_hAyH%qEDdEY&Xj^|L;(9rRyf1 z=Khfq{9#AXi-j7_dz>^>?cs;-cMNwLY45A=OAkk0LA__6s^&?<_PU^>q%SZRg`&a+ zeCr=Z2V-!cS2}V#6wxg#lP--5A2@>~0joClLTYKPMS{!19k`c0`R5ttNa;dBnOc)DiE)xTV|{en}sZn#P^2C476N0V+sP`7%@%au zFykWNDvWGiAc+#<*i>u~k&p{PUi==M_FjZzoYIK_75{sP!Xg+;a%N!hN2p6Ao>1KP zTrp#jGXXu~`fFo~-8%bK!T$OW;5jp`NBv%d0_dVBAZ{tVf+18Ie4T5D%1%`UM15MJGI zSNo|k*tBG#6#J7$&nkrbc?BVli-D)#xi}3}49Zu7S-|&cL5uNhKY|E%=-R)aUGOJ` zm`lX$3UxXAE)+kZh#mH8GL=Kvz4>x!Dvnkm+0!lXYpuBTk2|gB5f1u1W{+(YY_>D87|y=JuQs!EN}*%+v%yaAd@W7 z!6HBQC0adLH-NeQLlO>oK27N~-e3EXTBVN-pKfHUDn(*jtcf37yElo6dW>=Y*$3;E zX?dpoe=0ULQiGJ0Awn{-S$M54r3%yxuD(!fWgSa9MBT;$EkQt0fezK85`9Q%xB;T1 zF{P#>AP0}GtJ%Vb&*}XYkpN&g50GoYDokT!;(wmdiJMm}~U2 zx8pq zO=~V}+KlbIQvYH4w`>?T9>mRCpZ9F*=+6bKBul7IVR}KQri)9}j_xZ7EiV&amtD|qb5aa9iK?oc=8nMxHR=N=33O}#JOi@Pvc zi+|^6f!1tPb(#Fr9q*9}Ns6=Pk7R`#+m*O3`j(3*P~fi7+(lGH?v0Q|t>Vo%=)QnN#pU-SnN=%lw_~*NOx~FJhTkWX4ZeroPWj44MiBnBY zJ$5*h`ycl4&%E&IxEDT&<{RvF!rlPbJQ5z0PT6A2ldgc_=Z{5)z*FJn4{z#{a(48pEo&?|3=ClLLKhoxhiT+h{ty z-v;a%P1B-si%&~yt&J)40@dw%U)zFXL76t|<043(y+9C>vy{M2f%aS;kSTTj=bs!_ z&rLI)Xau_-2RTJ;xk#!>hAVJL9a9nE9N=aJIXW=^&$zuqldX;B?tSIiUj1R2Jqk3K z(#VVSgzQ5-cSu8ia$z8=l!|Pth=+gQ9f96qX)Ma1vw^b}>XF~to2BvxYJa|4`b}2< zILe5`(jV%X!KeL=tHJ4i4U&<++Of6QOdZ=9+M-0=Ee0|_U#Y^=Q8V2q`Jc45|CW8g zsokx_8PkO9^qSZ3PtZyWe|6B232r#O`Fn`|n8oiTTXK?CJUhyW`$dXKD^+O5_;((B z$1v&mL1D0>^zpHQj~*ZgUjg!kiatzUs~ z#a~B*ZcwszX%yg5<^1Pf*&I=iJe#G!2EzN__dTr%h73Pe;D(pdjLik)Ki%pB?o+w@ z{z)rHG;+EK^GqxC#65cTkD%*Hr0V{+*oHey6XiYT4$)dz7u2WTM^g22X4%yS`2~?f zEo*AvnX;DRI?Zi6qCFy%!oGJgY@R=jNFjp_H^E4HelMARjTq&vJA0u|H!}J*<$_T? zV>}uIttmsGdzs8{+NBi4oG3I=TGI5!zV;etGX>KMh2Q&-g}q@aGjm^8Ex?tOSNNw) zeZshMs{}K$$m47piuk7VjD*ecFS_8mAfkb<%Y6q4+szO59eZ0^7QFJ@sV0^9gW)O; z;uRGX0aMa3Sv;yseyzqN(BunzY)4mHltsE*UNeH|b zM0VHEwkVylVwKX?%A;1BEr#qQlHH+qYpY)Pg4NJe`TaBGtBB)Sdqd6DIMfp!LyN^2 zR{dGq=`~xY%RF61dTX*qAtWyE%OO(?zgD&rnl-64wo3koRv=zbr&O<(D`6StXXmAd zP&~U`Zd-ebncE(A$w{~LMVa&v`2`qZPQ77yi-8 Date: Mon, 7 Aug 2017 12:53:59 -0700 Subject: [PATCH 03/37] sync --- windows/configuration/images/sample-start.png | Bin 0 -> 94324 bytes .../lock-down-windows-10-to-specific-apps.md | 154 ++++++++++++++++++ 2 files changed, 154 insertions(+) create mode 100644 windows/configuration/images/sample-start.png diff --git a/windows/configuration/images/sample-start.png b/windows/configuration/images/sample-start.png new file mode 100644 index 0000000000000000000000000000000000000000..8ef9cc928c9559ee98d7e7801bdda01bcdf68049 GIT binary patch literal 94324 zcmXtfV~{9K&-U83ZQHhOn`dp?-m|uC+h=XtwvBJ^=dJI@)YNoWPfd4{E4h+Pgo2zn zEEE<{$^uG&Gw*WZ+0N|%sQbbV2UGLHd)Zf(Hfeu0zJ&Jcggi8A5p9xC6l&@|NUDI4zW_u40wGLa|IK^)W78p_B}+Ofr0WWh_o43Ti-5 zptEnXe8>`nqdI+!nD2RUIU6rvEPj~}hm3Zdb9`wHv?8a3{5e)}&SR$b;9PUa0G}mn zqaLvKfP&*vsny=NxNGxQAzRe-+QoMBIg5b*nqZ8TSWv1~ftI076zO6FDc~`>shZjv zot3Ind(yyerR z3;v79OS5kZ!=nD@(f&}fybZtoFdQiF_clgtw#f< zVxbZ8A`Rb=8m4unL=rAD(t(fHkzUNLNak55-!a#bj>%N-*6N&6{(qsYpsc2q5RrK4B^eA|zl+dv z+B54gk|Ibm6F>zacrz!K294zO%Vks~JY7u>;d;a8vv!B*`h@&rDmFcvV&2dtvI_1B z*WuO_bh)dA&|JVs(e-GZDP)!IvkkIQj!A;b^V`lnEG^`s;%L`h|Fj5i6uq;puIWiwV_U`vHQO8D`flVd* zwYgk`5!;b9%fY$bHGq4S{gg~=mdHyVKu(r#rt=j!0MXzpke5O#;eXs+d4$edZE1W; zCpo{4XOeme*#M~v4=NR`AR=ukOldjC)`j^*J6j54@)D+hwMWy!KUVP`OM~*e$IPax zA3*tqpa!d!t8QkXdC60OJjT5d1H0($a-W?aO5OrR0QmJ`ca{Nyi>~sorH7NLGPskFLX%cW!=C7&h*(E$t55Oi zu@HLuE$VW;31Q#9(9@|s(PCjo#?bVUB~vksR1&9~4N+l@&Sd5QmoF4~upAN!YGCo2 zF_n_*d?uXIKI63O*7lVSMaZw}E?TmDRJZWLFW*=&SQ-?E;GP$G*!(!+)}cAB$Y>|~ z6$?|0{l)5l;bCK;$JI)x_)8fOd7%Lji5{ChLU1>G9#B1dTk&-zd3Mr>h_dAwY@jt8 z2i=Qzo}7S~m+o&!!8@H9Db|0!wiJio@bJ3CC}>Cx*Q$j~(5Dm#J7INs?)4qJOZ=!T zsHdw>DKWzkeGps}JS!KdBwNW;!K<5?kVX$oM4_0`t|`MT#V_E0mUpaHo6CZ;x;iMt z`q4@kEfzE(^RX9PwwBQB!nh>BeGyy3aFUj{7)mUZ@2j0DR$WJ-|1|DIg(0Z;I^}=n z2vV*|K`m;jIFRr+#J_SoB=ROWfV!={4+hFl?|dQ^-LHjgs6HHaXujxM9lEwx2Aova zFo`2Pj1zF7H4crDdul*j;nBRykyhCfQ}B-I1|qW6Q3n@h-o%-+m0hf9R^JE=>PADs z$h0`ECYGzT065EE;YP`;DxL9EP1dCbLW(y$4+R?`T$4VXYVSc-!9+a5LN!o|^72VG zyE~zv!3j(DSsfHr>6KO6GVtC`+sx4!<~DJoYP!0kR{alCrK}vUn>22Tad)wGvHm+N zBk(-CcC-Txg$L;B@H4V9_QN3Rrw(exx*D?K+eN41)(l2ZSDUsAx$G$U(3}ZYDpivA zSpWoci8rO6v^Obf@HDMyreb=-ea|K3KQj>>Au%J2bMgbSz94N3+v# zJ}R#)E3+~*h+LPU?6$|9&=fjUoRLgL)dkN~5-6hRuB2M28xBB$7wczwP-Z%lxR!}2 z^}mI=|7d)o5FZKEnJyK)_sgX3UCQ55@mpnFC=M+3;eF z+0DjT<(HvUXE@LX*pFEdrA62WQ2BMa?LjQnIS<~=>HSm(VUDyzDD=pvS9GQC2D;sh zAQ96LI#*HRXM?hDqgnF}1j|=qILk2T*Gi z?7e37n_|0Q)e1q*@1R1uGJ-9kMs6`*{hjl*6@B_-A7Ef(!LVOEV#aKstiv z({LpqtGzYAnLaJu&4md!>)qa0cm4BtD)=C*Qu*xxJ*1|F!=?5WW#%q80N8y7yv$ht z9Y*JUpjUv}<(wE_2)EM_RPSZI_wGzXk7#nY{#2tI$8c{{7RH*rY7oBXb;tc*=5_!& z|Bt2nxoBKpVeYr%Wv?H8X8H;oN#MRMmP}an_T4focT}p8-N{muD7rW=g;pw@`b&q@ z=N>y~t~t6n?+?`m1T9KWFYj2~`a|@7mU!FaqR^Ss*Hm8SIj|u3b#VZxkcyCn{uy`B zzVu@7S`PdeW7m1JUx57QOD{9LGrnFmo9-Eer`gD==eSyuMmlv0?cg_XSlz|4cKy@m zL!IM4rez1n6}<^efWaI6dYp-OPluB$xAYws>=jKEuj{n{H+2sY`tu5{k-6egD6pu*+I+@z++2#6^BSv!^l zQ`C zgPG-a{_q?uLt-2=`g*wDt8Z!*KpJ8uD%=mp%3uLxd@KM*{qOIAw>@F;I zo=ZJxc##Pmd)BCre7`@16>=>YiTRjJWy9;C>w0?Gi)`yY<}eEY|ZE#QK1^ zTWzc6qXx_?4{Bk`N+SUjztRpoWn<3@IMwiI+Ew7uUK>Up8*e7$EjPCn8o zW>z*^gPcsise3;SxY--NZB!FeEKi^I&G+$7S2L%kE6{HigPcKgKlcY`#O^;3B_yT0 z=(^^}C5Aj*ubY6F3g2P?)`T5=VVid5UPs+7O6P>L zQm5`UobWU|eit>P+l(wK0)c1{SoklZ%Qr*i2W&@xeNuqq5t9);<3-*RFekuesH+=5 zY*`l%)ySPLt3^V1=+aO?rl{vm%5+ZBs{Dz{4qX%AYUvE)a>aG|V_N)%80SlI-Erf# zSl@ck%YWy~mg-tGPkFvde~>Qk3+Qqg)Al*BSa0Xfy?tA;V)(&{zMnY4gM!X`A$o%rJ89mlDt3{)ooWAr$AP=gHQw;o$lb20rFUZEY{0g+Ab+((80w?a%_=kH+DB zQI47USHKplwrC z^@`P1RWvwl?M5ScMmvXT$&v4x<+It#`xo50H31v56s-xFC7JAkP(a!2XTVvzq9E5x z^K;DP3B-8qu#$c~9=m}LngpCs)k#Hc_c2#i!%@Hc{)1i!xz3}+vRfKgiwJJ#MAsjU zMzDjRK~&rgS=`K`*snFaa$|f|P91B{=J}l1^HqD%k?%C*DY+KnP>(^{`T8#bvZ$76 zxzC%U+>wwt9|k=8V^Eneu&Q<+1Y$7)%r#o5F z>8YeWuk5jQrvmeA+4^dAUCz7>yQp${>(9hfy&&Ez)mSKb^;ETpC#P*XQi)!THw&Vs z+X&?`7Wl-t$6JD$&!d^U+?y{i0>5}r*_7l{0cq(dxA`u|BGL*>;vjl7X^R^R@l}*+ zpfN*HKm6fD%fxJ=fqT0POU|J+OkHrQyY-zd-KT}#DrjP(ZzysB|B}4n1K7YU1UdhV zgvn#aXccF<9hD3RV-4~<5s<-lw_~Qi^9wY?G?W>|XNriY3Pn>O)N!zed#A(DgY?X5 z9QTF7&eOR_)FtHQ;O&3CZgzE1VHqN z#F#D$yY3h3rsE1+mg8_p-~H1cVP)0^vwViGCBdojtL7IEr0(Y$j!SNSSP|Ff4|cxB z&;q~=5aCMVmh-bl<{u^}8%GfW!b)~c`>rLhq+j(Hq3T0+`>FLz?Am^;?_1Dk|WY8&_NRNK+5osg#!^I6(X; z7W(#*LoRsDS-IHo5QZwxJbI=<=%$>(h z-psnNv^MA%<-wI=6Xf{f(^>!0XXt&pEt_K#q6?PTp$uZ4iire#gg}?vP^EI{V@Wa=2Qtc=Fm1FW5 z)I#N?BcL1nk7+QW8nW(6bBp3uvuRLF!9K+-wEQ9K99hfs&W@jwi#!VSXv^k>g_!ON z8A+dd!T5NoY-Q!1G_f3kuKiHxf@P3c-2UHD?qJlOm)pE`q163AJ&(Bir?#<2@zH?*d%TJJ>J?ahnj9hD$L#r695 zdSnjXsClQF_S=tgI851?UD}Fxm|l$}7XDyhapayK^SV>_dpa+cSJF{ddB}lpbLCD| zu>WS!<|p@9u~uyXB@<>d>Qu8uua@onl&8*#o$YR^!y13YOkdOHQDchMXr!m*k4p?z zDW&j^bq2s~T42h5-ndL=d7tCH#>5SM+H7%YH1=p@x7kQ4a!)geNNIZOGT-5KAG6*G zt?c>o$Y>lu(#-;4`eUjy>#Agha(Y(F^P6I#QP5TiL;BE{aMvAocQp-by1&dj(R#hQ z=ui0TnTEjjapY|GQl_&R(5^Mx>0;?oYs_n|ptpHGD|148&z@_UDgAmOV_MO`zrRxd zC->?Km6t=x2dfay#)T`zR&3b45@x{({i(RcbumZWGRKhD8d?H4wvjNq|3C#%ruX@Q@ZNb**d{(ImAmo;9(>8-9WD=c+dAgJH?T6e{=t0 z=#{zEv+?!F=W`vO*#v+Um_<6APuam8xzFP$P}%sVW5M3)3*_JTwq%viQVK~5q~p?Qc)FXu zyp(CmUkRr1Ob@d&^!d7wo?_Q6WQLIH9vwpNkPRV~HINMAG&JxtiAs|WBE z!Yg>r7w_Q}N>id!!pEL1l^0dP%=$8uxPlIH&MqLuMoOwFa7?*T(b{{+f+LW11h?xg zxMVgB(q)z%z6|sRB&M;So*VtXyV5>!38Cc?o2kaI-gL9NoGwkhi)Q(H>`M551M9rK z#wR|xMaAaA4rzSb2~ld^yB_ulP8$BU*EHYFu%h$~U!CRIG^W>dOkznT5o5A~=H1^3 zFF*Uhl?s>=ATB8Pb2%ZxjC`Bau;+@%b-mXqN|K1)Ee}~H$ju1=<9eYyMcS4NTh?3! zd8V{qgiXt^YthEkb(f8;wzH&r*}uJHPO(Slow|!3NMsUF(6!Ek>BSaPpq8xnFx?Ee zfzEUE005>?=p4B4dSRtGb+~9}KY)pud`(?glxVou0+(PJ(6l=WJ6)+-*D0>+>@0Q< zx2{J7H&AiExfF?bZ6;ckmQc{SX~CWrDG98}EUwN^F1^~Y{!dBO#l4OjEQh6eeH1A#W+@CM z{(+8X_Uh~g+B(S_kjK(!Qgx3c8^Shva%2=YzLQNcQz&$N=yB8^X9^e7u!n(-m9QTo zfujLFw*8$i=8lXH)|P}k^9AzI>$0F7FZ|prOz;T1B7t0@jScYz-sg3`=}CBzbb*~v zScgwl^~zEjK_xYwEtt{BydOn~&KhcV-lw#@Q*A)63d;7%$p;Y-N9tGO5$oB#FwQqa z{dR2F4mKOj*7-S|S`P925d(9o_Ag7m`(rA%VO!CYps}PfX9ynwN~X(U86%)!5`T&1 zL?Co8Cd>?^)V6mQ3$8{if#^>pB(-BgzOP; zxj=cBA@D;h;ZAn7p=jWeu zzLGyMB<6>^KiQmt{!CZmpT#IMPhT<7h+D{S@x~G~WF?}A*)NCPAf3_Yo9DJ&b$xE$ zTaqp0IZ7kblB(sLnYPpAhX#(zt1AxPR0q01L}@O{$U0{vpdbh9dd4sSD?>`+vimw! z9CzUYy<|`pV#Z!1nS&9bdVH_jMp62r?p79xO=2WnWIsT%q#WxiL6jBODk{?L(D^Qv z9aQqKWw2QqvIZW%?t&|ef-u$ecu+5&#Cfy7QCJLGZ#`d6j{D?jZ8qd;v(KcO5kq7L zMnq=iK@UYL9D3iO+iOP5zZI6v*VD@gN!$(H(pqFz*LfNj-)p=7i@j2+^9s8_0Zo6i zR4em9Ef<{c|M1ErfIji_%WLvv~wlYk4W?N9JaM^sj*-CMO5^d)pNv1sBp7wcX&^C>N{46 zk}847os7*~*qUWh<^A^1qH&vgrc*p}REtJOhZ@1Zt(E5Yt;jyx?X*!g`T4vc1X4&z zb`V4wu2kDUHXU==@!rah2H89`K-#-aBH-#9xSutuv#&5>&3faBJeBK)o)h5e@-@x- zyNkrUA`f-!La*nO(Ezh|G${dvSU;H!17Mcm+_c4k9iK~s^485ZmGM=1h4W{J{j>!t zQ1wP<9c)$B*kUCHWx)t_Jq=qfk}C0Xfta``Siko7sCnso#=#JJJccc+z;WY5Y%l{8 zTe^!iRsR&bV`x2Wy~Hc!w_4?XCdZ>%FaA%tZ1oc}B{Uz8+R$=rsVg^?V@N!~J(*HG zWNQf0_(Nv+OsCw2B zi!9sxxWka=`Qk__tS0a}PA>&b#ca{*y`wgP|psR?`h+@R4ecC*>LFlb|N$;k)@|f&$W?+hPgt#X< zT+ICj#I#Sfc4`DEkYB0uS7}RO24i!VngUK2pRbO<8spJ0cJ-fAH;;@Z)S8Y%{rwzk zLZ@cQ{xxo*6Svx#+YRw79$_0n)g8Qo*R5&DB!$8dzzJr2KpY=NUf^*UTbC)MK`xCS+QTOH-(j}Z=aJSz55 zWtAem`t>->b=go`tKX#J!k9Yhed%DGOrCABTtt>c21Tex*nEBys}(g}b>QY3WYoB_ z*|jFSn24xQv3inSOm;!@Q4d_Y1{*L$;#jw=VJ(_Oh=r-4byBcxO& zwKjUy+nwzn?G`fMwM;}iA}QblYUUmyU{>6H=k_8#A&VWIoB>~}SLj9fkXDtX3#B0J z)h_xY!W-WJwUBbD%rQbH*4Q&JZ+xA)#_F53zN3}*Ww?a2GsQs}r?jtV8qo zowwj#yymAph)6zfvo}*L>#1b=k#-$jj@PNp?vb;Mz=7-=KJ&9m*;kahd&QmzO!vkL zb;RWmdV;NYmx2WH}ZoJ%aV$>`YaPy&lzix& zT(%Q4GRtJ`2W#)%=2XyiS(F=Qm-@2Mw z-nJWUzW#*H@p&At&;^K1MH#p+cvu1sLqybBgUNwQn8Ic5emq)7(S@j}dhkf`pGgguU(O zE0j|FNu&vgcZ{YE^Scf_ftZS%GEZ1e#G~zxVdDZXp0eC?*SuwQ=M?C?>jB!4C{@;E zMC2{7hXm{mhs|6U$|6jEPkkd*Wz^}R#K!FJCP^2Et8!%kQ{nnaI|UQT1#FW|o9iX7 zQ6;+H=NpIc&xj0KzJw&zeIUO9SKxgrDQein%DN9X!=!oJ$cnhoQF5fCsB6|+cHNkf zM{|iO1NoM*HEg!tuUJwT?meeXOPt>(9N84!D<$m%l;kTutK&Y1SN{GYi^)nE z5U5Mm_EX=%&N7Z93L|G`L+eyO@;Dp7yi%fxOs~Lr-VbyC8+O{AsoT`cr&Jw2$2=^_yv58 z^r}^)`0kNP@DR;azGE}jJoCS3(_>BO`LJ)#J8F#wu^+@Kp{?f;Mj@^ib6Weoi?v}Z zFiC!^LPtw0u#}ncE0akt;dgOml*7hR=7@`~rzYf!-*DkFOAs45|TEwLVK{ zebhZrMWH-{0F8mv<}17M&N#JiOPGIwTY+;&n`9Vy?c) ztn!+h=S!=C&K@Ij^G<)u+e<-QGvmqu>b{i!g|%>H4>( zN9Sz!Q5~2Gbd?lJKPDzIUYQos8mih ziVA|5V%x8Y0|hoH%u<~tWcMA}nd6@Tto1^=ANR)RMSH*jO;UgQ@RUe~=fS1a2)})i zIUb<*>jHytoaHG>Grycmpc@bp8s(|RQ6=0`mssw;Mo%M%yyhh{etr5U73yWHb)Q$* zWs8jRnBWiAaek*WnUJ zW2u^5y(|W(qR4+=l7vJRgc-_cILoA(6o>})(4?y}N)%P5wQP@8 z5K|ykFVzg2s`fIo*Q^(=x?E=?Uk-`L8d_`!ZQ$?vZQ$3I<6C))9%ya7%B0i|XZ`|2 zMg2+_r-Yp1_lzEA{R?Ue6fFiQ&=+Q|?4ik22lDwF%7FP9?R{Nb>>f|qrK8^# zgD#O!65%C-gGHz**01N5<&yy0f_`1P)7*1>PqA?&9T6jnmu&iTVxA2x-Xh$PC@wy1 zUE6Jkuzq_T)ZSTBGZab()<-^ z36NJb7>x@~j5J^hTUH>leqAwwx@CvkZ=~Y?$w68UUR{E6s&Aw(m=c~BUPe(>VT}JM zLsp4z>_koK*;0)!-=vCSRmwOfl{CX>W$eR1lQsa(v9{Y0_nw1X8wCbJ`l~nO6h&vj zT0o4jpON!{yZFRZD7d55_t=_|MWNKRdO*YW?iy0MJ;8AL#=>eR{}@m#CX=djA; z@-w0;P5*1o1NjTWs8YV^zo2~#Ok2q$*RXUB+b+pJ?^iu>Sw>$|kAP`lExcc%^4`-` z#HStMb|J#{?O(un!$T}4M(Pn}0_fyGI2WuUNhf$YUZxfOL&ACqK{edVE?p#as40og zlb^-_0D)M71l(wG%jj5AxaTR-i>5wfk1=dThv2zO2Sk##2(?~RwaFiMPYAdc3W8eS z5!E(`9Ip@g`v!!P3zDfL)S7{4=oZ_p{Gxs8iP=H^HYS$Ats!;XQL3WoKCCjYw{2*<8W9OD?82qV^O zF$CvTv_h?tSW9*8VJ@m4G1-%v84wLZu%DjwH_Z4?m|(G)A>cdkSRMMJu1GX_AROs? zWSBYsf07JWN7qVWzsTcjgHQ5??{~pcDxxz?_!j9eCIiWU$53KPZ!!h~L;>$iTDc+! z#y@LYpfT$XEF}3C(QxUYTB`g}Q3X5(KTl*t>*xVIbf)RF`aeS`xJQYx5scH+XbTwV zE?1^z4s6QPGtM#(WD2mR0FIpLCRCEAs#O8gFe$SG_wi2X<5OC``1fAWuyF#zw}?g{ zfIJ)i*Bn3NB!E`HSVDPeT&X%%veAxIg;<|A^e7b|3QF~_iP9HnnqS%O68K{M)82q< z=Zf-wHX@qWoWi3bD&3M1_}o~Of5(Uci;lk>riv*ftw8#VIUIrrS@2K@yRX680uKAK zZ2zNtO$s*-ReXJkAt>4kvcHF%i+~O3RYl_dpUBMmZI#sGAXCnOK_Czet_i7-N+V;G zsK8ASVd2KWAQ*Tb&ok3}`s9BPtW^Z}SM4zc-ji|32O@ z8-tF^J=WPx3wI1_Oox|IKE#V?@Nh1(zM&33ykzTqGw{cnW9DXE#}#>VHJ zv~NCGZ--Wl66edMq^1ic%ugRU^8cg=m;#n%%ZE2z7oKKckr^I}2p5JBX+g0EP^NFP z>;_A^tvTY~L<1O~^(fxp{(YZ$mvxPOJ9{dtp@wC|Ti@gSY%D2YIrn5y2niwO4={qw z!hur$1r1HWhJXv67C%`CWox*%U!6<_2Ed6N3+_l{Z{T(6xvP(_J)m#16SwjQyAOFK zb}x|CBdfU~dO#*Gb@GjUFUp!fZslJO*dcS1{$=RMGor02tA%Np<=i=(i#!Nz_sye@OdOK7 z`Uul*mw99T8TsI^x9&$YGnd2zwEd=gQpd5l0iX7G-*5J_JMO5j1-x_j8!@>iB$3k}F8k=ts4ec9~A z#@)Jl{mkyWX)tHtShkapriuz@pmwxixBurw4Qz7axjSYD+HjB)L<+Ssc{$F1ZDl`H zbWegbi!8Z60sl!#w~8^)m&1#Jk0)g14paWsc{ldBaNGPFe9P&+PVmq5v#4;Z{tuLp zq~r5Qj10X$NH6Y0kdkJ$86uaiM|q^vcmr=O%1J`OmXi)5QrXzqPQ);0q4G2~ByY6+ zb3CesE~{8ZA?er%@}w$mkK3;Waza~Zbe>{JrfHaX)JbO|ITB+6oiT^fh$DMgf-1-) z!-P~_#PyK@4xU_52F`FP)T!=={3pV0b0^5Fwa!+WGRjDiAdsm8|Mf^b4YMWpnzhgP zCox^q3M2&8z;3^cXneJ&AR3yjW!E8-+u{0LZRh~9DG3b0Mmvh-qCi8!*nlOfTNqTw zVTYl|%NmXTtR1gb$Cox#Y#5PLlZOLq*pDTE-FNq*I_gG0&Qt z>0|<90xgo@5#yM>;$eyA1s>$!;Rx-oCvkkE+0TcNx?>Qssg`JJBIx>q%f*%xIn)k6 z*rI{8=8U)J7$8U&0%U+SV3QSW?;m}B@}0aw3L=YhS?7Q`;W_SpHHh@uFU@vvAioh> zn%#_K?bTV=^9ue4^PQpN#v5Dh@(Y72@?dp!ApqR&d}v3%0TACyik!~pFeqNXVrC20cvc;q0(2 zu$M2%6_&=SYF-DWSqUAMRt_d!I;)#6TAim3SvZ|$OcJbcjYw*bLQ8x9c~~w~G=BPo zF>QMH)*UNd1*}{J?Ux6nPjbwUA^w3zt?wuVe*45AnjIfQvUHPf{_>il8V3B>zcTdR zTeH6XmTooFmFI4#`YRK0@OFDMtNDpcjxjNZiz{}6TRV8o?H8lM87b2eo!|^<{wzM5 zjyHV$0l(X;6gT*xR6A@?mi@MDXwa?K9Imh?ZoFMV!hG4yi}63D2IY?1-mTvWpG6x$ z!VmAV!7@p+?T+;p5^^DU`sc}*V3v8{>7Z!Oq^>?0fZPmSY#geK^u0IW z3uERqiar4mHaObggDZDr&yYT-(Gv`0{>FJ+t^o6pbA4}kC{21OteMd`YvHG52Ob+u zjyQi&omecO@Fzqlxqe6@a=cq*xIu2$CeE_IG^ZU9USlV8&l$=sW;1X@thRAy*&4GG zGal!SxKUsL(Q-thArBP&P*EtM=(cZLmxF~PoOm!y;aW@H&10Mh`7f2qH5a>BLe3JD zR1wPmwivS7-Tf@4S=ETa3jPAJM(T|+~!}p52ZG$HkW~UUF}8#eu$*ffX(vKe;gCHsEFDx zg-t|^$WZ5dU)6oSoYwsZSslo-WJ8;Y_pUDOZ9YK5hI-1;ddwlS7zUMIyuD`|A;;Ma z+_#rKBIt|=?g$El79}ArY<3G%JS~_uduES7a(uhr5J$3v+U^BKY7}*Vgq+ljJrI`K z%VB(+4kj)xPXq}WPCa&wj<1WwqK}SBRvLh)b`NR$v(A<0W>fWi8G{59XAGVIPtrho zgmUyGYBbv1zUYSXb>aNQ(9e>ZX^q2G1TRR%9T+MErQHpT=#vYiWVa=_9^c54Ub6Mev)SP+%kItGh2Lt zzOdzlV?j#Hf9P*-57}>T=je^4&GGI`FC?&}IsAm#)x=Uq(K6>1VjHXfNhmdC>m~e0 z(Pn8F)ZQ=!tfj&S?Vdzh}VDGgXu`w+%#OX5c)=weLRViKH@B(wPq(}y@dXoCwd z=+PN7VCVRPyt#rB5?ESZnvA#ZO(~9`B$7Ft$kQcfb^Wn4kf{&)FNj_{M{GrC5(E;C zs%Xn3%3vc#!7ioo`mTjvj6LoYEh5|sC5V*h%x342MBTRrf1A{)M6`)V)x5JiQ zQf|Rdb|=ZwK47y$umXDaD=%Oau@{xXwl_7g2MECX0`6d*OB*m`POfx>>rv+CP)r^` zFJ;XbnfRpc2QWPdql5y0&D#A<(t`-4FeYLS3aYIcdH7<3go7ZMH*Eb>1|2ypB>G`qxwQE4yLKgWexph zpv1HrRl7V%J(5xe%a*Wn?nQC@{SgUBcuK!vF{5{0xB<~lepfrSx-4y}e~`Ut_h3c~ zI=Y@-n)7JzbvbI~AR1NC`wjGhIyU9dP|H-|T|7g@ZcHLJfpommwNHmZP6wBJPEe!s zZiF_y7%vIEREo3_!l*y52{quFP7*VyP&3*TP>+K2FbZ^IU($^751VK#Zn+}{sNMtV zw3n!!gwa3<&^-yu$+O#>JjfN~^lfwEh^Dt1IOkJF#5hTxVx7C3Hr}tGIuJUq;KNP- zhTClhzUs0Qe&XASa-sD{=HON7Ek&_XcOcls5F$|)qD0u|D0)OyNQ{MO&+>XB$Kwno z=yp1^9q6E_XGO`BhwH>%OInS;;Y|G2hWy*YZ0-~)w0Yh^^5iDO-ul3TC~l6ztI&_Q zUY0ADG*caCpb!l3_Q2AMfvUqrh+n_-ZGoPalibhVuH5g1KLYNEzCRUxR(q-%fa==G zqbKy+v$bLX+fY+T!PzV1|BjvIT}sAq7VOqaZ&gajoX-04$iB#NObl>F3;T;Xz03>|HjZ&1k+v+TnHYcPjX0(QXx!8)zj5-A)gQ%; zK8G2%yJx-ZIG`uehVn0*FF-yv)g?D^r4|RgOu$s1<{$xky}q~?w(X0Ir1l+-srQFf zXfTYy(EtOukTVe`amW#o8y>Hpy`~2-Ro@Bw8Qx3*D(sPsW1b{pO$SN)`3vD7ND^l? zbKon^hdk^K1IjWHneEwxEQ;pB#?s%WueI42-x`{9QPxDUzLme`fuYdlCJ6YK+0)?K zAKxWUuf&!b@-Pf^Lx zrpS?}@GchQ#!f7*l1gt;-6A15W5gjkpvm=CC9EgTMceXWYb(GqKN3#|{4bVI1)DgH=<oln+-NWeH3 zxwO+Nxqgzo&w~T(^&p$7P3%}2z(#Ruc0^L50q5|Z1kEGb8m%YfRhbB`=Gygc2Y=U&CM1shaV9!xm4*`r4>;0Ft~DO_)x`}?nhMG0dA-%d zD3}YerQ3u-A?%s$affeoO)Qwma>IHT3+LTPK`G5mzt7jWFxn z7kmHq9LY9(LTSFJChotmNK-&~)S{+;1i3XV=CPy*ou0`Ns>-QPr^Gu)V-r#m{iVwz zo;0t{G2tDX&6+{%7&{r~s+CPt63aLwNeDM^vcn#3@W45Y_L<2ye5WN$#t|bat;Vy- z2c@P!?rT}cj9Z6N;mZ|ns)VnW?}f>v^Pm~0>D*I+`e!uCC**zBeo<%XMV|B1hsN{V zBo{sJ(}U9AkZ>`lx*62J^>VP?6NRYP9`ZzVuOS8{IKw{BF`e%r79|jo&FO!xD7E4IL$t9P=$M%rbMV!rVShw47|A;#Inkj#!5i zpw6wNv&ja832ldB;0TmxbBNkh<^(BdkADHV29b#oF)5E6Mtrz$pK`zPex94HZ$tFA z!}k6_N;0K|{ka}C&)JSs*PD%$NE?y|PdoEH>emM<^s0AqXNCLIk#yk84rvCNV1ZG& zF4Xq?u6?^PXhSh1p-=(qhM3Q1fDE}^27Uej{+!|PYbA10-d7>ij0}3iao0JojrS+D zvAdk+@}DW=`+^zL%sf6@jbg)KZ=ff$7sn6Bsk05-N_*YViLL zsz6o0|8qhfCI`u5TTds>Ska5t7zY{-Jf$)R+tG34i&3OT2GHIWM?_x_Eid&0ISUMy z)96?V@kAV>tc>gbv=dkS;#Pd~_eXHWp5?f6yxl&ws`IVmxeP{fMU0btB(;K7iXt?A z7=1(6WBf=4ceZRpcExs#7m|oF+`i5>9N2L`ZrY#1UaVkqZ`5EH3D!^8nLKH(ySNS* zAV7c<27R1Kef*ir@xH5uJ(Hu*XSJ6G+{iET;2Xr8vG|04MM5GaXHK2c(t}?FU28o$ z&r@KkAO%-$a_2;lxf4H}{ZfJQ!ZiN+F5sKjC-A?&jAGZGJT|np;rx}oc*w>C+PXUs z?rcXk)`CP!8#-D-XyuHzR1RaPkip(`8tGyVkKVi<_YEGwfuV5>C39$x7E!Q|w3U%g z9YT9+E84;&Ck1bdXQ`FNVu9uO^&1Z12RGb>Z(sd;T=k1v@Wp$gxF@^~q5ghccxn&A zF}+TlrW8@scTIA9E|Dmbpe!4?8EvBnu=~CPxc$u6qYw_0oJ6s4Wd}+Fhw)2>`|IRd zpuL;*z0?X_={ef5YP(BgXeCavRJN-E1PE}r7A{%LlJP>hNCtZslcY zS-lx+`x02)5y!3_cj5cj+=1^6tN}Xv*^ZaeV9t!&Az2Cgr=3G-ZIYl^p?MOtqW}R; zD7^lWUD!EX#E9NcT#AtX(UNcVN5nj-vIYs^h{L2s5YK+5@CUCj{ZbFktqt%s(g;)8 zEhb#LU705M5DDR>-_GDOzboU8eH=h`jpKQ}A-whcwRpi9oA97z9av66vb?o$hWU#97}B=XL=$DPncJ)pUo_l>U;qL1UTXFst0yr*T{sWhou84 z(*$Q#Q3(e|NldFCP9bSz0~6g{!S03*T?IgrNabKaUa$p-jSZAX&z>$yNA^->$>@f7*>T zZ~6|t{_Fc}AZ;(@u&h0fR@O^_od#%5*LxKQpIv8H%iPBhRVr_C7bDwvoQL5ky-OF{LL?7c+zKg;qhNMfH!=77ryzs zL)dpPjgMY?2p_p)1#a)Th;_s~mUES|Tq^rkk7fWr`q_*ysD%9rUVT{MSF_>711F?13 z6I+YH__DE(L<*Q$-}Z%ttGFfpkxQ#BC51u%IvXIjGOL2mbs=-PlW1@jS#fTi z9m`o;Qms9}sgI?TiC_6WzQFw0ISS^7QdSx3>_emCSxi_P8wYm%zS0)roxp|%u}QE# zmLgP!wZgVu&SvrZ>>0SB<>53tj@pj;kod&Vear{zLj6n=2=a{(mYuGi(HzuaR-6L7 z_)|c7^0yNL1UTWKfo*^t=NoUP;vzv=wgq_32P%W+V!)eWv~w1k;9xqRKR&Fn**v3d&J68jb{69d> z_iLKR1Ik)5(Nzh*yd zF+xJMrd1IABB~IU<`dzFRmh5FXGXwC1at;P_92R$N0HFK-g*$+TSFoZW!mXCXtb(i zB*>e!=_6x0yC8RQ3GZXPwlWR6*Y{gQc67i|ag}JN<#-c?Dbc;cqniK$PDa=na<+eU z1NBjLW3zD3WJxBCL`45MoKPJfkit{tP_z%N*BJGa_qhflJN+KFRVc+2CM7_C6BbTE zc`FlBtu%;eggEG%J1Q;_5|mYPO2N8B z^9VZ4+(V>7ge0emk#Y>9hl=dXHEnq0)@69|S<7+hIm>EfIUapVKh9g%hBdu0PSU7A zt98n-0-_S&goFr(L}xVA&Uw-Ac8IXJtsDOq3A;swaPTT6=%gMRnL8*9H$hXFT8ftV z-x$*UgovEz!o-xA)|gLp=-R&7qH`@25gCc>0%f}hP?@XkkT?cdcvyed4f{-9@%!VlKaHFBrE%-tG_9$`wO?*JvSAU;`6ZcQI{Pzx%G+pzmZz34kY`T=vIU!w&zb2p(XBmBKfyca&x*_Qq2AEf9J8)EQ z@qCmzv)g-%=VdJa%!Mw zu?@d@?Kb@2&sXE^kL|^C&Thj6>ta~ZF%>xxLg;P{8TyK^5tuA`(JOzC1>^^s(o$|6;r4I0vyk9 zZCD@5qZSi+5TDR>I;e};E)m1fwrGeXC#1J+d=e%x(E(SjKH8f&&YTjH(4YE~e(%Q) z;(DU6MS7}4!!L@w4rFdyQ(pK{rYFp2`!Tlw3k$0ZPXa6&+%PDTa-6;~eSAR*N-G$- z61J{t#lJjt4SxNa4S3PHzUAsBpl*}a8Iu{{wB<2e@v^n}((~8h(IhRlucz}aK_{F! z`~yyaMS{vcP7%w{3QCh-%ak{1x(V7&4m8>RXt zkQ4Sf{f3ag{W!5VifCtV73rDju_Q4piz~pwLG3~19t??#4kP;&32I|LAtfX}kSXFX zFI<6Ny?Pz~?lC>~$%Lt}V>plhx^@JAarq#g@`ZzV%%>0G5ueiESvRg!G zsl>?)AWb(x+s%;eH-d$$_MlG9H0jLD1W}u5qm|l^UudR}yy*i~{&ZQ>3fkA=fb|t% zNg+5SJ6{lKD3sAjLhzAGm*d6fd7tTSfIsce;$y!X#y4*p!-2tKWjjdgT=q$ALXZ06 z$cW9rI9O_RCQ-tR&g;izjN_pj66kN8poy#a!@dmu{OgDDr@iCsiwegA4KNk#kmerX zr|+#S?{{wip73`-mSq@V{$b_sKP0O*%YogRZ<>R=cUEL7$gRensyo;A8P04V?~S0Y zXA^)LG~3mRBu?F{fyW$&pISd&VTWW70M~q$eLN0yt_lvxE+p)bEcwKapR%87oKz>O zjA8XhvH-^hk%w#vYnCPOg=ep6OioBH{`aO7Uhw4uc*w_h;=g}>2nU9;tR#|>1Qk^a z!_jB8CHnNX_Ql<^eTJKE5_HS>zI5FoJoVE%ap5O-<3D~qgu~-UwPcFC^267S;Nc(J zi9hWg3CPKez_QZ$ApL+_>oS&occp#Z|yB)72q|5^WK2AesrBSBbg~ zyP%0QsOw7VS8lt;i9G14Hq(q)1OWn^j8JFN5AjGUohl$Ga}6n(TnVRb=)fQUVjG@* z24{G6aOHhDJob}&@uDy7#8+=Pg0y~=t&OC^e({r)W3L7~&DQ|Vod!_t8->caW!E^~ z{G9`M@W*!HT~`j_`h6KZ;q&|OhHvddF2guPZUS;LGic1nb3n|KJciYI0xS;HZdDoD zo}swMrr>wz*hQ0YUZpLy661)8#04dCqM4xH{?WFM2`zLkMcX(!lxx4=k7>~VH*`T_sv$p_~!7|k^-DXBeJjZ}^ibiu#R{>@Y zYp1&UL{-r=XH@%d_pUR9ID?3Y;!|JpCqmC=rf|(cMf3@K^OWFYjKX_u%i0Q#3#=B- ze}F}SsxiRAL*;IZC+as^{pW;`hO_9Y0UDxMMo(7)|Nev(SY2mV=k9?5p7fc6`2HUU zsH0d3nvIE6%=Lh$@I*%999TnSqH)Gm`x>(&C3(6jQCZrLqy@dRE;RV)XZDNiL8YV1 zj{z16EPt&=*jq6i+@0urikhs(`spB@XS<%WY~$=E70AEpU*tnX!-;$LAZL!RxW48@ z?a8))Xjhx3YQAV6VBw)UlLW=T@NjBX=Px}82+CYRukRKk`0k4~;9(mzOPYuu-JQbY zKfMQ6-+82RHg7(NNi7t<#ZeQFDN0^*VVt_E8((?JCOqS;{>rLapcp4ZWm3@Bd3l}h zItx$-EOV`5*^dBn@OBd62+zy31VvR=B`CAR1ahMQ6>+V2kTXX@^f190JHHP0+7=M? zgou|ugYVCm%mOSNT(zoxRP@29xOh<4Qhj*+HK>ZYfPJYogbzPw6&|%kGpULA=pT}J z@+Wp+=iwwLS*(G@9ON{}D!n8luYS~W{Q7n4@%%Fr_?IViV|5>UXz&%w`p~kYz5pB) z&jN!5ZbVzZPgAGgG}Dz-XL6?j=vZKNPhw%;%b2Pm(9V9B$0JboNq(kZKQd_P;mcL^mC-QIo+`CQ%S({dsClMJ)zIuJV ztnDEup8Eg`2W@eOSyxeSn=R0RO9BBwIaZX)=<9C7J09JSR;`ZsaA3HISA1t528MHN z_!I3G6zXjHm1E8hEme#|Qp^sjKH3r6EQbILcztSRoD{=%9ouln^1w1QLm5JqPC6#Ob->KD>B`C5)hPQ1sm#R59q{$ z*Lh13K0NYM2XOn&bcLKO*2;-G5c^$wTNEFB)&~6S_I(v(57~p0cWgk$L3|6Nl!;oWUtr21JsAwv5D?| z;!w}b;0$%}Yla_Y^M_S-WTJt}lv_t)s{ZQqdD%%3JF!3hh^7GB$QHJx3s38;v=x>| zOFW84ZR==EQZ!KJ=BQmUzBqN+!?v`eEx~d)k#vM@w^4^r^|C;{KCU|UyQiB|SG3?+ z=k+uuDXP2a^ufspHB)g!6`SrU0YNzysDtY4$&;6P21oI)R}bOdUBi`+t<4oVY1DBV zLGDSQ&fL&}pS)}n{_0`V|NhT|)?~e9>wRMw-#IbHHoQM9sgk7^a^;K1cijpK8jhdPU`gW z%{sTIvuVEa>S>K&OCKkJDj$`bD^FcXPTqCtDxA8KaV_M^*OCXz#`+68h~7L^KcY+| zC~^~^Iap&0;f+sRH)+`Vh~u>vkQi!9NOh~acCUu(m#F1l{$->#rM7W0L2vBXIUp)_o9R+Y zA}!v%t}?eD?sK9yX6UBOwyff^GV?_Dwc@wakN?>>O9VdK+cmuPs>C4Yen_cSAxkP- z3%3DmOIRYsESVk!wvAuyOyk>swiZYgk!PD2apXj8#s%r=iidA#!xOi6SK5xu_}}c+ z#?+={rrE06nz`{BrfYjLLu?N;^q0BrStqZ4NbgaCH&y#M=^*CLKBJ#|FcM$sauukY^c0j= zb6}&~u(}m*dDz6Su@z|k{%ek4aB!T;(d*k;ldI;pl>xo9lab(SZFOG51g^;V`z4MK#EL+#tHkOy-7o{C464>Dz9JUt}KyX zqL87Gz3V$AF?FB@eN3c8(b}%5>x&9Q7V@Wfc@fvq`ID;9omP9QBU^Lz*+x?Hq3e{qn1D;5O`tZA+ydER(JRP^P4c*0dvUzO>Ui;8qTy|~(|M|Ri*s`h}KYP_C zw!1C(=AUmfKSTd~I&Ne;Q(GJVm(!VCPP!hk9Dn%BO*r(9Q}Cb9-e?5+voF|){qHyx zKYiIoEN_chyFQ_y?5Nu8*QZq{jp6U(Ke=}dm%nNwuK7QktS=|n7GHniGFF|E~*bor8m0D zv0vp3FfF7I*sw0y)`@l9l_GRFFj~S7?iM-W!%SCCOwlmlWXSfFKlL1)8QF;6zIGF? z`-_eE<*QfWy4P;R)l@Ryd&x#T?}1d%C2B@nNv2~i@83LN%e_Coa~$XV z{T=wpT{&F1u?63I=|(*3%Lj1YJMO?~AGi-cdD%Mr<#!Ka-!SmlcifIMSF|8fj^oU? z-iq+w-HvxYZY3VNsSA(U5X0j?yC2W}z`g9l6WiU1j1UP#OLqqn-MvV3QTlrkqqLBu zMElnux}4W#D-r5l3G}W2I+p`ooH(?1Q|IxTpwerhh|Fju#J)Sie&ZMWV44%(v&f5H zF?apTFH)Q~L#AjJZAzAYje+PYGY{2U-AF`WBpRV~mHXzfvOS8Ie{(Nh@_=q^=}RC* zlCo-jJKplhPISNZ4xIV6+pu%6fTx|_&HjG~|MlB6{_1nP@X@EOB$+AU*Y~IKtkVs#@iJ2Lpk$FIZ(zqk{BI*`Th_hj(Avs@8QQOCVaO+{b;d@7L+o3FW4Ce9PC#=T7u>y{yipa7}BuHc) z{fYZ=&WG>CQ_g6|`>!~R+YaY&@uzm-j@|mP%M-37j~yx!PmXH2DmiIfIRQMdh+>H_ zF51dLyar#oIf>yxHoR$A_#~)PGoR@kC0jz8C73RUIg1S=9Sw8B)ruHNNR(tG(L?F&LulDD5|&j!pM<1kSwGOT zjKXVo56KIOeLG1+3q@NwA|xR#BZ@4jOj+)>@}l-HGY8qpj|hlJg?giiJjJ$}+;$Sp zR481UZp7w zOv?ZKc0b<3S< zdN@_a&b=9=IGAb=x{ZXRQ(BEZO@l>GYZ(82%>aJ;>a}?E8J)Q0U1#H8e|Z>(NJKPF zKH{N$xcOijFFdCOk3GK|AO7=A*v-L4_4wpdI`Myhybs&@+Oc_kr?tbA0wf9L4BKaR zoC9!%*EGsmmPxjZd|Kp%T+oxOj(xD`3)-sD>{NZRmF>8z9f__^wDhk;>+0OWT z@|6g$kgP&@C1o|Ge-#Oihz!e@?$PP3z{Dxq>e1G!^&4JeBqUM+jKVaj3G2i!T3Hd< zsXEdUwulKqEBn13rB(M$pd}WfRPy$oUmd}#FKDxN^@qFD7$CX$+h=dYB@gVz6HjZy zzy4wr!?`@3a#|EyR>tx9KOVw6E?R@LS0!-HDh|YKpFOQny!-*Zc+>-W@bRbi;5)aE zU~7K@g?t*9Z0*GQ?l|r}lEbr4@5Y-hU5Qsds0R;T+j3%ZV-ZVZ4U+m9^!M?6u4JTR zbw>>6uW8|U&_Xg;As`|o;vn6ej6_N1B&w$vuLEOYyyhXjXlZ8~I$8Q~Q(&Jid*UI2 zw&m~i?kja-GX`})UaZ4WJR|6H)9viM=RBPnK&Q`7QgFud;PowdJsX+MRyq9ao-DpV zB2eLZDzGM?o}Lfkv~`{M=_}TtmkfJ0c+A!o97+Sfzdu!}Ge?kgWwl*(UkbNtCNDc< z@4k3gzdh{eRVZQuZdq^0gc-EO+Hn_ZxgyyE59IWkagA*KTcey06 z?@yJst3s6?(l;y06m7w9kU)uzSR(x;rLXfO(sR;Xy3(o6-s$Xw&TPmyOyUsIDolje zM1m4WD4syLwF{9p_J!7Vlwu?)tt1s3$Pr`5Zl&ngh}H46*CE29{-I|b53!An=aEV0al@gEtrLY3(7;D@h)O^)lf5Z2$s`w#uwuQ4eE4rF#=x>t}t>BOQvUtG1-^cuT z?c!vFI?Lcr;Cp{pQCxkSfTz8iZD8VxlffM-76EkdoB8jx0-!2UvAXs`+e5l=IP2RyoO{5m=r9 zJg{*+W}_{WR56??;QGB}a%z+_K`D&CeQf_RlM_L@<+ra{&l~NB*HoD5wqE^OV*u_O z{apz4tpK`L0-fEJt)sRM)+Z%OiBQ6xNLed;jo@!Xg4%*3uv)cqZN{|` zwI#J1HyHZc9o<}YZ_-xj&`NvfM_1>@g{?UKW+&pn+Dw*e%U`ILsb}ZKB4 zB+KU%%`8JFZxB#FtUa>(WK6vjk?lOvJWA<1lkfk(>FZ(fDt9h3w@tt9##QN&1M zV(lG>b+#ea-Hlj}u5BbPlrBzs+Id~5!|AON{Ml!B;Scwdgw+nZCmUGR6UMlODE|Nz za55cn(h15@ZufwTwuRd!l zBn-&De?rlj1d*1q0%rnT*djSHVt+w_LV{v$Gx9@sI;4@UxG7}wlr;HI86|~p!IUW> z6e3Yd7=>5|3i>cuTRS4{U1;g*L0nr5wi>hmAW1pt$%zB2tttT)6xPMre=2i;QKXZ@ zNT-wR#j=q!i(s&#vJ0VYB0s@Enu574ow4I=qMa_{{H9xZu6_;B&t@i0|Dn zfG2+V9z6YXdoaxS8ev0!6r1}v8*7%JNI~=ej?u~F=M?wJ<^UDwP^P`j!I|!y2oNkQNP%JLbkG74poFd|qqM5c% zL|PbxZ8_zNDATMg-ebb&VwzDY{UkEQ95M_$r!UOf_gSKoMc;6lAZ(9KNj<+3#nY_N z{d7_{?s_7(4WwSUlcZkyjzt)zwF^RZs{`?~if5*2^t+z}saKvR)0DZ|!33e1dj(zx z&hdM*>>Qvj|1ruvp)I2G8l@W{Lxdr=L+6`Z4!U|-QB!Xsk(xk z1|xYSKX?w>Sa0=k$3Ov(`S?y8($RK2P`ZSRKDh@s?i!Rz z=P|!u?_NYjew%5sA{UB7ex*Paj>Rj>8Yp;kN6VZ)RisYl6%&L1-Z`}!y0bSYc(1pXlr$BAj2$d3GIa1+>Q=$Ha*}~aWi>rM$gMwI z7kxEtdQf>1B8hc^m;e`+uGRQ`ux&r~=iz<4(t+x>XDjbX995V8GMN@ijBBUV+jY;G zFifSz4qmgas|l=ut7~0V-nuHd2F|PYewcq(FM1GL_Mk_rF5YPMP+8}_hL|#mM1ua> zTB7J;_s|%%jPn*9vq`bc?>Lmkkx`L+TC(gyxlug)>~#n;oZEH}U`#8Qp;i{15*4>E ztXJYvS$l2X&Rg+WeNg%|$@2HNA34D)5)@T{3c#N^S{l^a&71~B2Dt1L5|sZA2uck> z`41A5H_w=$aK`lEbFI?r;mbEB@xrfoVfq_-zKB!ScH+)AZuAT$Vw42tNuNJ}-`veQ zYW5Xj5|kHTupD1_UO-SLz)w(Gx>yzLD04X4H|%|P2!Z(lvSXx`KzX%Hz5*3y~6859`yEx-TK@K_A0V>Z((S_(!DC3 zkUM|YbuTmX&p+;22@)A%SoWx(cq0x|jn}17S9`0-Jy$L^4#-#m$jp+U2N^0Lkpf;d zTh=%yE2|@lpte#?k09db<$jr>3wu(*9EG{9xk{8?KV14O zAC=pqhJ?LEBq4OjTV>@BgH~}8u{iroEYXT~Hon1@vicRP!xGf~C> z3CfS|PvNHBDP-~;2xrrXjO@Z|pYuR;vaNjg#+}$x>_morw^(XHR@DDa!b&tk{w@Os_?>?Y*){5fZ3uh!S>Li6V3J7FB{nEPJhdv4AXDw$Ww$L zV3x2ggSimaPgz?O65ZEvBZVSG=f3gLP~^WR40~<)Sj3xQ>%KZtOd)b>uK`aZQvUYV z3`P3H%&Ej`-DrEn(!l}4^bTjVCbf-P&z|T~=AfkkR3dLm-c-<_XF`YaFUX&hNuVPU zCmY1n(O7>WiPA$T)u9_3t!#aR)1GfCG1-H5Gl5J-@8#}i$M$GZ`4p|pCUukrSGBh=Ro zbW{2{BI!r%x=GBtcyB))&_TsSvrdN9PSIy-wc;SLttrOCOXZs|tkVed5YJo6nhdlst~TDc@?Ia?Yh}DGv~S^Hm*608*B*vLaqi8Y;p!Um z!gEr6roDc(IN`r4O*$-0QTp^oiSlGy5T58O!T#`^XvI)hy`i8tdNkvd=()PJK{2-q zgKn&RboIiPxrTqiX{6YP0(~NPX2-BBy)ImqjlPVVplFLU!un&mg!vrq=tNZK zomj73eO>5X-ifaM4kUWJ5Ne4aLjt0+;3MND>^+>uo&MFeek|{4!}4WaY)%OsvqHGDh)`UFrNAruj^+e9 zFBxW=S0A$TWt3v&8p3jK1%-7|7wR)=T)Gk4Tdpmhj|3|ywOc&DN#d`+H^UW_(LDCQ z=Nzo+^qy-lk}2acpV*0;bjsen?k6Qy3gc@p+l1$yq1v5{K{lkv{?8uVvS*A9!SgpA zvPHb`ATVze+pApr8=q?j&5CWx}P=Z z*_5mII4$Vj7&ptTSyc0+gfcFFf_1BbBFlEX>pG@`%2tVy0@h%mekLyyAWsU^TS;=k z`O8lCb@QZxreat6{r+mJ#@Pw7v#?#f@?QhLdzX%SX>jgj?(DPzYK|%XaLkR&nE;nQ z^Fv2^cK*em{OMO1(g~_p^X>~*?wnueUy!|PgQ{9>t7uDr7Ezj;cm63ANRFhRY<8sj zk%j)~S?*OfE;4~}yR?W53vw9mPTJ&A?@p zP#I`u?{v059>H@~F{g!li_Af{a&KiR1HWgbix;IskiFafGk0odYSV;^N8!2P{Xtm* zEU}e~;QZ)n>1TMVAKgoDIsdZPJ@Xm0x7sSt;>Pl2a{`fbP6o8a6A2Y)7P4-(GNKif z5H`1@aN6>2tZ0uzBmXrAa`^4eaU`?tJts&=6zY5`+@sdZ>%^4%dp@1ly&%r2Io(N zy9SCRD7&zKn2b~nq#2|Oc>Uwo;X_aA^$aTbho24LAAb-KlXLRxZkKk%FX;eA^reEV`M35X_4QpgjUxZ+nwk?3BQ92jfUHHp{=&b|60 z@Aar=->3_@AQhEurOKg4j2gl3M`^DIzjwKF1{2)VtgK8>65?o~*|zNDzg{=@hhym>d&d*11V9hknxP-*V8OYOdvoI;Ly9i8;-@&=-WDN$ z!i2h~omQ!|x+Q|pYbXe_NhuCuc5x6{^0kqBdr~ z8ALOAR~lU~&aqgdedN!xuri{5^D8r#K|ygVT$y`RfaR~Q#pxLOA_a6M3OI%7KYdw; zeSvtGu70^Mh3oH6A(`t$B%d~d@~Wpl0G-7QuDt6o2I6hxJ0vLVrLoE;Nl}wfUi^7GSwR+jI5n{#mbZlvYnBW+P*HsD z4^t0x=d4NK$UmQsk3D|_{_)b)xa;j_PDxILTMp*2e~5~qS)!!I&&IpHb8`CcI>J^n z!)%?<(3XRiAl>Vzb0+M(CxYmF&YTO|ApckNINP+er`~*#QdKuJa|g9~8AvPZs*y>{ z_I#F=>k@@DROV?urvmsUSi-r7=Axb~_MCplVf*FohR z@AYYR31`jaToUO_3Mo#s^sC4z=0D9ybJUNCwld;vCB$3X(b`67??7vJ8``ur(A$P^ zR|~?_H=!1a2$RRPOti{i`C`J#tP9)XlRl%wC~?+(JM9@h+Ucg9W*tnMCQA`Case4BWcu`)yS6nnXxnxWBedi4Q_yHE{-qHSWOSHxvPKVVoj-SI!=P)e`wv^#Ck z^p${fPcBBC7lS`v~3$KM#aMI5ayltc_Id~RurAwg1+;Gn5- zI>Z4vl&AlE7NH_1cEvG-IUvVb#_9VuvRbZ=MpG7EF9OBk=fQe-RaFAeE`rt z7RYCvJJDGZ5hI>mrZt6KNQuEh=>bYqLmiyl~^8V zZz6{b+w?vYZgs?4SN{gtInYu|7c5h&cRkyc=}W|{IWzot9*CsTEX~4?LkWv1Z2*n)X=KWdx@|MGFV>75Q zD!#6^D7Gw9FFuOlObNFgVn+z-KEP6f+M{Vg4FbH_;7QQ{EIu#^awG?)O=VEgrp}*4 z_f8Cogo@h+bNZ3FKd!1f53;i`<(3YNq&V@#+X%9DPU?j(OQl6yGIo_29V$*cOv`xe z9070Tw^juCQP_g+W$vEM9SyazQsRuLDjYZqo@nbKq?t6OC}Cvs=dvhK{1U;w#+&0n zmS=HD3Mi8F6nHJBN@K2sU;^u%V6DwlG$c1gz%$>W&ty>WFf37plA_+fw2TKf?ht!|{Kd zI(&%bMsh+z5{-@{LP8L=?Wj?Nb+{LF$MzK=8HzBSky3$tAcsYqiy}-b+Ak@{0md*~ebdZD?5z%S|b*vrM6%%3MMHrW@5;AVBf~eitPb>Ju z&evFl)4fkjFRQSbL90-aE{3fwt0J!@KC4c}dWs?(G}BRmO5@>$_qNi)z>E;l-d2%Z z2dfYb?;C^Fk1SiY=S$4CDqrqs!Apq$NLA@Bf-J`rojI}Qp{gy1QMR-Y%#x)k6enSc z(0zrtZ6KL1V1(^NVp$9@Ly(~S_I_3LQE03Dq3hHTT<>fGV!E*~zIwwTzIY=W z=rLkHdCtY3IzT<5*5WmW>7ZE|ThaFJR&48?*c^6_GH+*^tF~r}p7NXLaBKXD`D!+xxI>Qx`U@ZAVvk zoRho+;v^~&tSnAI3EtoMxD#?^-fZ5xK7-;WaUV4e-8uO;3^&t}H5)z)gb6^l9hz;#p^^u^+|1T{DK??P5o=1AsFK??i$Ww0^n!F8$Ie zJ5y^9aO%Zu|C+T1n0KiBvm^++Zsep(Gd!9(WoN`$3eJNboqa{eRz$kX;2dzIvsDP* zo0#QM$bHpJHxj2g3G+)w&Ps6z)p!VJXZHN#W{)zE|7rsLo;)~z66egp1>+nj{Vsf6 z6}D!@HoKJ*rdej1h$zh#o#$3(7<4{Cb{ZfoF6B{X)I&6$kT-g%KI>j^>6=Qb{&b^& zB-D{+uefOL!qGMWpWW_3k?Bfnxt|89ToFlmwMNjv^2{=gw-05pKUrk`#1R(x$|mvfGgkAy zfE`Cj%EGOzTGeeCIjyGHEADDrieLSh&uRwMhQ%~#t4!sj*}hhomN}29D%cuXlTcfX zhj7U@vFVBU`b`5&o0Pd{5Fo%(fZC(Fn5|Z74}agwq8 zNL|XG$f+F3%)2NaS=EbA_U49vY<*k~CB85kq3V|+=gzAi&W%KqNX27uQEb&ieVC$W zmoF1@MDCQS(;r7@J*i!!{{SP0#m2yX0&;-PEX@aQc)c-ZO=Y)KTcx}}I-#@9-cQ5Z~N z_wE7Qcke;$xMvscx_>|J-!qDxhXyf_%99`!tq3F05Td+^8Ie$XRA$viXsLYoNrj$O zCJy!km>fssMS=+H>F6kZ%=qm%*xzR1S!#Ko0eZ6Id{g4wt7DS z&QO7>4R~=XJjErElX`y5OztS=#{PI>iJ~+>t(A+%T^)4q#KA^UFL6@-em6>sZfw;> zx4bvugITeBG&KhdvQ+ulAbfiXVf@M^LyF=@I{cC^#~u)d4GSx|25>sHIm~ zFLs!haoaY9B#r{xM1iAcf$^p}CS~$vq_Rbf7eW{(8A+1O3}q4+CJ7o!6>%tCz(AIy zC6~dzWDa{XCG4W^92_ZNe2DqWN6?apShkO3!npU~e&{90Jk!^j=s|a98&>x8W7CR$ zY+KfjQ&)CjU4J{)cO|f*EryP05s4_nh=!1oNG@D`5Mnv_kG1X~s z^z7oW5eB0{YnXN&NhdkxDz6X}Bj6)Ui?|D7TZKXlYUe<+OmHEEtTS z=tFJSvn^`S^4g*v zYR2q`deptH=APoE_^+^dnbOkGSGynGOwL% zZz6Mw!V&ysD+ijOsxIWtM1zT!R<~6ocr)h8@BVoA?stf^%&+jA(8#1}CVQ5@ZD-Je zUd`U6$+@+>%B_ec4Z=|-HHs1k%RD7VB9krV?X~A*AwmL^$FLo`EMp{F##p9^!DOD~ zC6DBI7W+ptNVJBrtRqH!Tf`ssjN)KEhW)t`_NBrYpx<$J_i6s$peRZ#O9d z=F2kZ6P+Vc{n=#ED?^nBWaSjGKzYuN~>^%Bp!U$YNRt+>>W&DEZj!kT1MJdMMN~&2CQ!?U>j5@ipy&o zRj7^1zLH4Bdb(USh6XX!hTap`?>8*pc9MUn%|o$_7zxUqZ`z8@eJaqS_=lg3;UBNq zQ>pY>4es=(N|*N-S-HrERb~Zt;9WmGuUU&;hnr0ts#kWv2XE`c@BU(qXIMdsabNVw z{kZO4k{^rvB!>1ykL(04*Oz2D6X@RrJoDW^hJ$8+`G;ow`cT_7ALX=^lcR~+)z>Y& z8@*B*(&0f)k^Kh;g{oU0Y|QpssJ)X2sed%W1TJ6ePU)kW4v;!KB|*kDNk8h9H?o`1 z)nuvk`#o`FFi`@ko+sQ^;l=<#dC}^s9Y*vVJG+UhtAa`4(LnC~tHOGfm?o(mBbE%7Y1UWmh}iS$gEAHf}zX7(`1sa;XtKd|f*( z-r9}d-=D#iJI7ICUk^n~_AL(`hlq0wY+>1#>0U|EaWtK4iI5nzMZzQ>9Li}%o>O_V zn8CMD+^&^Wb)IFGqi#)-DCt)oq{mYnQgekOa+v}~vuTS@{8uT?v8=;%qb!%K+-YjR zOXUiIf!o)W1^IA`1}bZ{fBB*4tsb{Rqx9(NVC{jC=qCwmg@un*`w+T92`rC?u_m6x znSF7bLZ-DVAHuh9AHjYywrny>uPo%uVf@t#&gWci4Ac^+%FKTMg6e z=@y?#P=%y8G|_XFr}R&3^UZDX*dWM2#Psy3?_dSRDzlW% z{l7eDO@7wlpC}MH*A~wm-XU47pqw78pez_v{@UW%{Rfu6+M=|YuTARK#Jf?yvDv+# z87Xy^8{MjIJrQgG^BbzwYgXyaEbTy{1_t&yxswwGDQ6N(lM_J-n6Ni#6bAjfl?e4& z=S--2l|98)RXj1&^ zK+8v%)>-sN^EhpFH}2dwg1spYn`}n~+xiQUl+c~Fk;p1Cyid_jvJkc{_9N*m4yN)r zFq*=yp%nIwrLcc2hdrZtnip_58^Tbsh+&eGJlnG7JBhY1+S?-N?+9aUZwTvpBiP&< z$A%Sc*i2cwEQRJ2+UMo@|H@w;k6x~_btBv#7+A4LNoehd2!FwG(?qD15Wce*ml+fQA$1n-i z9sBY~X3A89agwMEB83zla_$=BQ)S#eTt+(7!rIk==L9*4!e=xryEvmSasr@|700dA z2NNN&*Py*Rv~*Q|3we6D#t~p55)pj=_lI!*kV^U}){$lY{o}eTg{{UtTR3H9WTi%` zN^BMoi!GIK**V>K)aHqA?x=PA_iqQuKc$>KqW}RG6Y4_N#nd3Fj4KaQK<@l91t#e> zzrV@=Rhi|97%*O?MMh3@PDqO1uN>&=24g~Q8ztR&Q+gzpXZo`PwX$$HL2Enkz}4+IcV!#SSsB9_D`MEvQ^Km&Jo>^J^pddXlk+W}#92nsd>#?|#tI8b zKRzi^V=GH6Kihg?x!9XulFFmLWs(l(kc;G)w-E9qfckDlk^K zw|?%Rf{1+tw~BC_VbLzEuMO*&!lYD1ZgrKpp~T0g4#_fRQNLgXWg=8Atc<&dOL*aV z9Wtnx6X&jO!FVx>Ywt+HJ~J%0O9D(wp@hEfc6{aetI*qCZ4HJm{xOaB{_Ietv4{wr z>WykN?k1B&jW%N-4tQi^rq{A$FL;?^@AJ7f8k zv93zeq;TZWb6_9Ps@$5fq#k5$?s#LbX-XKs4XUzKT3i5fsPKiFJgN-jL@=lPqruwF zG02aN;1q=|dwOu`leG)hg)tjgxHaO!u7*!XMjB{PD}p{8=f0Y1{#g#ngMEgdSF3AY zb(mIpRGdyMPrR|Xc`rBiQ9D%>@8w2*Ij(iZ(>Q%yAMV&YhC>BT+U!GWawpFki4zt7 zLbYsV&+=0`#9$&KHen9t5r(P{kkNg-okead;$yv1ACDY#vE_>xq#uiYV((KP27N8byC=3@dt~ln7S$MX{NZ9#8W3px^%c-X!l7b7_+7cxwKoaGt~_$`Ff4i!&(k zMh=-_m79H8m)D5Oo@Uy|GLodL(xGzIbF**p*sPs_1_Wg?ST=Vb$>G!$9XOk8){n<; zZ^g}n1vdIrr3@FFq*!C(m7Qq!+qPp(w|d%9WY{(y_@R54PBxrbZB3nk2nfpJ!V#4F zNl-MKwSFWE4H^|CR)x%^V5Q%xkm1CBISJl4V~~Hr`YQW@#p43iUcMgrY%8Odkjh2L z@E#|^JW$wPq@?w%M+L1eR?m;~;p-u;+QD0r2-}XJ z*h+`|dtP)ETrg(t8QNPj49CnUB7quwV-ajy)sB1i7jRglz_vnE=gJt{ovzmQG{~y& zGhMb##9IYsXPRW?O?Ff>m4l-bhm`Dyf=i^oP2Jij^EN1 z!**>U^(U}xSpr*oquAI%Qqx|-iqSUtNnbE>Ne|G0GMs<>Pn6SCqF6ld;vnE+>It0@#)ad7v{ldY~W0F}AL>$z9H z6sE3D1S2>arD!0+W@iaxUa_vaQyA`APn;iJCkQPig3@R1X<^$gN~6pvax1udU6o!x zykLxT2+p0tE9cSOTEr=B^9GFDiJ|XB98t@1S?q2J#qc?KpcmXCEU6%g`$0(R^^mIyflIf z&f9>|u`CV^Wszmtpuaz27rDiZfTl@wFGP#Htl!{23OcDWwI5;?&+_xfTEM)RlPgd9~+G zfFInE!KeRlgn6Mmkj5iU;RjS0|J7 zoDBWp$b*Dt&V4mbpG<%p%CAO0`Qx+oOFk-{3VwQRTya;09yGh>VCKgJH+7(-IH{&v z5AvuqYVxUc%IxT6fQU!SOn)j)eLsVNSKW9b zYh4w8E#yw-{m(Q?!w9$8LEhnL8wN;d_7?Nlqg9t=3U`mEaL4dC zZaXrD8;&IL$AKJfIg-ZBN3yv4PzLuN&fqZbkBk80BV`oGVA@EI+DTB?kc4b$kKx>| z2+myAiU+P}$C)cTaLVfCSk={mHfA-WpC(XY*~>Gkha#(mWyGvTdEXi?qq~qsqL4ug zMXy$Ovff(grHxrkXiJEMC!+jnTq-bsb_PlJ6rCNi^3mUB&!DKlwIma)piG9!hm~{t z-Ib-SOSY*29)*6i>h%xl#Vtc++_{$(st&PGBtRXS{W+S5;t#Lih)YkKm^R`1JsCXZ z^ZSt2=BWCDb;l?jULZ&mjd1z553 zZXNV&1C@7g(2ZZDL^V*-p=~kvtemx=Fsg8tUK(umL4N7Txp&s`Co_$WE*;K|fe)sa zm1kLcaPFw*t67{1a___r^-CClzF%PG5d&JPpph~N>?O={%{_NaL!WL#XN;cTv{V7NQAORu|wf7L)6-YMS&dc#AGfU?`;uYYvWE&+`;yhAYWp*Huvvz#6tdm3 zH+JAVFW!g;u2bWlh;g?2M}BlK21iJoG#Q)gv>fjU2+HE3mY|qfp)nL97e zo33h)^%CfJEOI1{xJ-IP=vhWd&&%G1*ljy++3*ES95gRKc3DanV zw~~%BMc+>;llYV!VO{CR{?b|n;WbOiv0r2;uv=@trw!{!`i(*B46kR&3+n(Tk9Q}M= z)fy*pNuZY#=Khu_I+^TFot-IX(ap(2qNuH)655!e2+Lnp9bm4&#!$%R@uu$|z|Zbh z1y01Wwh+Gf{AGCmv)5tWiY}66HY6=)IYKcPP*@61uLrmFGKJ{G1%uNh{YzEsh{6)U;dAR#|?K++p<>a~5j zmy=p38iPMx7tTx||2{u@bU{k|&kZ354Nx!b&A`Q3^)CZGXi_TCy%(=;Cy6}kb#Uk2 z6TPvKXE{l%ykt%fjq*2HWzj7iYultU=Qg7$p|Gpri&#ng{wl=7cBu4NFD+Wx5XrE6 z3Dd4G|B47GDLPOaWw=`5&}xU;!*n#v@o0=e4lquAigJwU z87;RVN#ZeDj4}qjR?H+RKt-b{yd;R9CUZFq4-eTFdb5;rE{z`A_cFfaktjBG#&Aks z1ZS;i!2?#d;Q^~!@G$+_^qMZ5y{Z%Etm(vqcs*@JFV5(VHc3#F0L5M{;Q)1^MjQ!Y z&ygH1`RERO;}$iR$$0a_y0Pmm8}RSX*?{)ej!H%AXSc2Md9^)L$e$W)wuERjikCcW zE$)5$HvIdO`>?ueay8#MP{89qcL-PCc7$zN9V4jQ0LLLrH&KkFOw)#)6N&t2OT$|X zsLcF*a6zeWYCv)E$o&Mk0A~yJP3Z|mBH{3%ef>uLQT<#qZJYTjaY=d;8JI&TpMoak z)nw?#rO`8V?gSZ`@Q>0ceO4OI>k4a2Gq#8bfBQ{-G@ zx2`r+%P+5bRvQSlB1y8Erkj-9DQTuMT?V~`Sa?c&8>6P^w}Iq7PsfFJ+R@D3Hqth_ z0#F33AB#_-`zg|F+dwYz8nNvhiPEc86P+VuJW8SygTjy~K0)_tA8J!1HevZw+FOw4 z1U9YLor@8qS+1iTKZY32XgG#Zjv-^=R*aP57-!{V3Sov6sfKRd#mbc)Xdp9n!NaWM zdq#@bKU&0{!{gX{WE}SmO48Ufl*GNf-aDkXk%|~h7ZBB|49VV#)-pDAlyO>r8RxEw z;6bY+c+}c<%l*_)#>EirQ@GVq2+#;>K>Dn7tc>S=We@)Ax?#^^BGlI2@`x_{?zQXi z_fJ}l&194Ilbuq4?lbm|urw06(V-%JGdUMVOFW9Fo!gBcy=)^s_uM{g={HR<3AZ20 z;<2CDhg)_qZ3(Z@2MBOHflc4EqJLns0Y{qCMh#CI!1>Xeby`U&ONp!V`TBxxB{qTZ z#6i(W3`&e<;!2DUmLBiw;QYyp#O|er6~9D=g3?mUhG?fP1>4$@XrSWNwjY{=KP^*1 zK`L2-OQ!~N6W+VLDa#UY7O@e}!d$mm`)(#Yh z*Dma;a;BM9W;A9fyEc9>0BxD7{j*Kw>9;`gl`KUuUMM2TaV5pN*7sa;w&fK^kp-k^ zbv!1jI<@*|oGd3L#hL_3mXcBm$2mN;Aj@m2$gpTQ%JFR^UB+lSg9GCk930JH*P%3a z42)26*g25J?jy7t%wuenl5FZrvP_6Fq$Mp86{RG=^w9ogA&)oz;4t3w!$YjR`UQ8! ziU{6yQ7``RmmBbf7jD5T9fY4@VKpNr1kN|8^eFPHYgGf+MxephubySbXT8DU z-ViZ+4n+1*u_oc-o(?W=5|>uL$jl{GG8N3;Ig%$0o_v;(lHN>u99*1Am#ykIK~fy# zyvPXk4GwE7eAauf9E>AOh!%N__Xu+9@~Rc9SwVp)ugatoJvV@B%gsW;I}ub2R%bLQ zFdi!(rCpiw9JyO-K70^CQ9sey8nq)zzFcH5`dmGS8m1^s%W4y zFXcQbP>DGUSq}Bqb%BH@OY0=sk&+Z6BtI>lw34v2kg&Az+J>=QD@NJv28_UjF`%Cb z7%X59NlOzy7D!PZ^dTBm?6U2^WxceF;ax+{wH?IHBHg>5xvI_wxK;6-0Kglq2|sx(sXa8!V4pjZ5Y z9}8SONZXC<2Y&G}P6U0wdFAwyQ|fwl<5bn0hDN}(>@Ej&;EdHL?BiT=uUTgkaL#Sa z(MYCvWZ;8y<3wrH)tO79Pk>91CK=3xd$bRMF_HF*&P_soEnoIjiCf8Zka;8B;o@~r zT5I8VQ_o&7H~gb~8nM!>$n&U+OM~u}K3)B3ZUnirFm)qQoi)l#4dh&~^5?*uFJN6; z4(FcMi|g(j!hlvb-Z547e!CWL>tVWQf+Hjh; zEojvb)$*yAM5jAEhRvN3Y+u)o>uw&w)%T2YETXNxpj#Y9FAm}jfBq=!**}W=_NS0+ zZL=deVYXX^o+UACW&MZC=?dp#$ofoO85v6DFsxd(Wr1na*9YQEBDHe;l?f!}Xlg_LmZc8Le)M_RKww;AHesZENIH~W-LZF2PM)x>jK&jqL4>@)5N-876QJG2& z`Q1qb7nZIGeEFDuNpaJSRXZ*%>WT%Ox zD=SO$aROHq_44P3^5*K$^5@u~Ji4|Ws=N%uyIiPXFJFnK$)!HouYVQtuh)VrP1#+u zyb0$+$gv!CT0s(KU`77Z;!d9a^hS|>`=~(jSET5g^(0rO8HrDl1aVRqnHoxhB*2WI zie$}}O9g!M_lI!qhj!rqUNMN>gHmMk1AX`ACwFJC{R8*oZ9m+Lkuk;p=cS1)OH)pIRmE)hAg z@2Mza4R11ZaDyV@(oipbjo|V%=TLgJ8l$xO(|dxz-yRIgBO95{Gum*Zwku>wMD&Zv zq9P(8^r-gAy37?bBrkGDGyBzUZ3tB$0-`7~+7b#!`CR#=e+c^eNsLiwGe|#*s9yw9 z$ofLA-VTZ~#wf`Ng=Dr6i<7vtG~H_nMXMK-bdXE;0cHesQjvpr2>XY#crQuAhWFls zhktwz{{G5A{C;l^Ssi$tC33|w_6`^D<2%Q3>E{lh`ycPa6F+9QcuNu>xTlHPrGFIF^kox)+6%iuxmZGr%w zH@^R;VWhGollrA%y-}n%gL(^avO!H=T}ULwRvD&PY4AfD*@y@|7paz|F{QWNAg18# z8!9x{eO)a|3u#+Nj^sve<;REyMFx6pRm3F1S$l+mYsEov$i1BSMebc+cKumrq^h50 zp9K_*6UE_3nqO2NUUUWnErfo9r2a16)u-ZWeq z%)i2^j=Igk>YAcB-Mt=kwJ*EYrgx5@bbDDocDRa~0Vb6(^J;I0sV#|$DDNdU-GY6* z&EEN-i4~8PlLDZL_ZD0<9;q(;>Bsx+UhSU-wql}Z1z`212Zu_bhsp(VRgb*zPgSNp zBr7-dM8XtKx1V0Q168lY`^B)*Q||r5C@wX9xo& zmp(c$J*x2L5H6{LTU96z)?Xn&7hKjNtp;RCva3zib@q{bza7iu{?Gj&f>Ox zY236sjhlUPTD?9dy(`_W zSz<*8AN8s)j2fY!#twBG=mz*v6NLU zTwva<2C{nIr-VE@X%aQgbG)Bi?ekFRHSr!h>IA6A>B>-Ul;LWo9YmgKNm88;m)$0% zL0*#nEjh&@r@YFjj2uN3D9}XaWrm=Sr#LgK>&lxuZFJDW@G8>=bsQZd(MqQhm1>fp z1XvhU$qGeFXL{R4B1Kj!GM5`iNK9c$0t5(9g{MI04$`;`PNw!i{kA%z+DpSc+ zP+2H$S2i<+OS_rFI`~@ooSR4t zD@MC6Y$*EKKUdVQs`NHbQEzzZ`zvZsy4TjA(Upp8uZIN)5a8qhJH7@@i9Pb_{~~ea zlaCeAm#a<$NXtoQ&KVS#MrZF<#iXkSN(U9M%GC{U+VY6-US~||!B0pOUcFTmM+oK< z3cpsAH5x06W2Q~j<;#tL?m8QybHaiJWIxKN!m2>U zqaPLY84>!P3G1F_I`b?_qN25Dde4!Flt|E>7gd#3Wb|%Ot`tVL6tx#b^cC7lf00Wz zw&IN5;t3ESz;OvjNOV$7XDYNQtb3VJc`WOQVf)HfJob!Uy!TlfvFBgTLF$9&;DS?n zP8^a_g{jV|!D5*nHIAf}WmFAb<;#oCW7vu(HMO3dI5J~yysKXp1BzE8f`6;Y5hbP3 zUv$o`#;>Zm-$9e`=h=y%pcHpAs7=?5;EPn@%-H`@fG-bo4mIqG4p0m_##%0F)5k0H zviJ4ac({@R{&5;ZWJXdd>vxm06)zNR1L>qdS^~hPBeWL zAi#+Xkr2HNRt}@1Erzq#cHv29_v3;sBp>>gHO-%PW)JRq%NG3n8_QCH~ z*4pmSz#ZmnFwRj{D+^lc&NIFoMc-4=PlqTCMixE4P6U}Lc@o_#+s@qtILlg*M_p$C zg{`7hkj-F1T9k2@;3ngBWo>0uBeOxZSug|koeozHb)dA%t-Yzk!8Kgw4Bj&rs_kC> z=W)=Rlc3ceYucoPt527mMyQsZA9@3)WTlv+o#r%ZuGs7Rdm@dSE8$HSF2navgNqqWovQ%HZqZ937`Jm zC_erB@k)3ev^2Z1iz>t34_s_04VuYG{pqTcs7oo>Vsecqb*cKIBd1TPrTeX44{AcD*vOx^*HbU3H+d zLD4)iVb1XxmtM-Ucnhp!dr*7x%5fIOIV}{XlBPIkjRpioMWOJgDnnP!b@QgJn<7h4 zA6e6@z?GzC3fi1e8MEE$BW*OdpY-vdl!Qn?!X$rDR%TQTgoLFKDX{s65HHb;60 zNUY0HCV+-A4-g>0aRX0Fm{L>M4xzmziVgj7Ja}^l-u{$LxZ(|4@SC@sijKC*zVHw4 z%;20gQ9NpE6stPINJK;EqSckJSd9mt-cF5^!YjVAA0Pb9#NXF?&;|~!IyR#Bt@ zofe$Qs6{xh`gQ{qrHKse+5o0yDOIiM%0L622+~xbTYL4FZc8M7Mjk2li^(J_MobvE z>d^8cJG!fio)x*?XwdT*h3?FKE#$7A5Dcc8Y(Es%oWmEd9R(x_K20UqRB){aBe zqEY(mxpz^UdzTg`+LD+m&!uV;KN?+a7(~6a91FZ)EnL^9=Nc}Kso>n0PO02Z1lzkv zGI8{;9IAdNM<5%OcE&5zl5213Z#1%|&1)?onH*9;Pyz%vzECLRj8$zoe`6;*IlFkV zgtJ$*LvbZ}IP zSvuTSp+ru2HG;&Ez`mf$dnx|B%=|*Pyx5P_g&3D)#)+4E#m~XTPcTbNkiA)Pj8O0j zR)d=jxP&%<;%*|Da}Jlh#fD461d<{{ zDgl}KQB7~1gwwAxRa3Tuu=cH!$!;6*Qa=KM5+K0wgj5l?zIhX_e)(Fw_lYZk@eqEy za~yyB<0GDfqj>!G1itpdbsST}xM$ZWF8bUa9IW}i;+e}MxbAfuv2|@bQsYUy%Mz{8lqM^ooJ||WUFwamUhQQ5_Fxyy_}2G=^G~^AGT_u!-2eaVi3{s zRIe@ywhA{o=qh(EZu+gAayrQAgn`9@e#$kg7`FA{(s7JXFbY~xOc>l{;Y84iQ-jgp zAI7}FpOzZfS(U|LCO%B6w|Ro%nJTNUh^lQ#25fY-#V7j)#cBS$`jnH3)5(sH+D(ms zpackToMB+RfUeds-ul=ceDvj;sSrZA{MY+&!N+%ESQAzsF51$H-@R@N)~;^D$l-B3 z;FCLW_0BAA++V=I{bGbfWIs0l+uhio;vk|!ZG{v*c=cXfb^9>(4Qr2?+NL_NE(JIZ zcnomf?WzK+DKvvDr5^R$I6gwr2rf(&mA*}sPtr_eKqG=16ayH_|$yL0C`&_x@Qu02$nb{$m1oC4t~ z6B{5vfTe{<2-oa9xD z2Dd6f;nm(+spD8-C<(Gwd^3T+_!N~ZKZ63Ej$IMX+WB`P@9y3eV>9Wi>qddp1It74 zyD~6m{A1s-X#h7s9}8U3s5&hFGEkeIMZ2B~wMDPAH!2FD>R#z7@^1(QTWP8o<=HRn z9UPZt_QPn5nefP-jO+gT0=+222~kf|j?EF2DFO%(Aix5G3hnyc6BXD$U($oWd{iIr z68P@TW4P=aNAT944C10s?!q}Ax)&FJdM7TwZOAwHu+!VmDo{J5F zf^#A?mG(;EN9ifgHXS0N53ztmP^^3umXVSYRY=@!tKs_FkY{eku8^&sOmgOSPO1UI zQ?*rt0H5A5MW^t4dIG= zQ`q(&ci{z}--QoeJ&2#(GKgFD=)8!hG_)e3ua~;tY7%6wCF|M9Vna!g*0Zw{8oBkr z{LWS{sYn!*NQ#28Jl2e;a$`luKlTZ3Id+D+_d(uF+qwrSb&5V~Z(%ri;hUmX#LA1# zowQMCCu@Z>(-jPtEC&VcMb#8sypm%@Z8{{=LJ2rZ4Q36+t@s)SB?k@ODw>PDA1_cb zsL0ifn`kF?$hDNETd#7p;^Ey^kY{UmKlnEd*tXUDTX{9r#D_>U(Xh!kS1mRDF+hL- ziwJ!{N?Q;jB>HM;LcN|nU0+w5Yte74OtsX#V2~!23S^pWkkPZYMP>;pM+Kq5%(B-& zQ_G#%yM<{<9fhc5Ss1Jb)sK-7nbpADDL~~#L`Eu@{^V7+WGejsp?xq~kv){A;i#=8ol z>5_T~VcF?E-whxaN@RhZbj2yai$BE)OwId>0Ro(e(Ek0AoxtUP$MK{U=-&)H^IzD* z#ykfLjBE+7d1Nm>_RKY&!Te(PND&+U;ciZOsCj0yrE;v$xryPuz||jM8kSegidrq= zh!XZz9*za3+xSO>qU;fd+I;%m2=;|h5)3&rJBkq!KG-)9vkUYaH$3b)Z{ z=HTLXWm-*({^&s>a!Ut#(<)pP7ZVh&rS*sJWXqSOZ=MM^A`SG_^2ieIy%8V9^Se8xUVH?}9bz>L)=Zn8WD%Zzu zK+k%WK6eC<+17_AUvwINdEX%Rj%QF#bR(OOF$e~t@A|km$MX8oK$S25v+V3ew`j>$ zQxfXaF3Vn;RK(N6a~vSR$qDru^(1L1$>Mg1w3NaEVJOY1j-7s6Oh}t)Q0G;9-_q*( zgnU(-9V-~7eF~owFnzbg>R9#dhv&wG1BsTr6+a&IU1p9P z9Lqpg3xz9a6~R^#oIwL9ElOvt$nR{5xOP;rf!CF(?rWf}105!wGM)6Vv?%O4K}>)@ z80WTnm8HZB&qhh!Gu%+5h=S@?qot)s^{IBoYi*oL$5hFk6&R=vQCqyTDfn4H`I0oM z>mtj?`WzjVRX%d2U*4%08K@tk@hEFo>nL8q=w~+UgM@OxGAz+t?n!E7WOD#H(UkZeL-=kkSX(nCr z;?I}LL1KPo>4mHMDtYx0E+Vh6w{e0Xu_v;WSHMCoYEv&r}@ut3o?ge#+ZFmskUuN7yWL#26ARZNqSN&uc;*0HUs z`B7#w@xu2ZASeL>1X$XT-V$G^)n79luO>i>QsJ2f)Qy(%-NDr%j(N3aritq00qY>5*NoXa+*@g?mYVWWbE~2BHBiZVrE3T9YYRAp zVktanH#s0E0RjX#zMw%!N^-UYMM_ZmQExzL0I!}@l%Xs&U`qT0DIqKI3?2B>0YPm^ z$gGN5tt}C8p(oq=@f=U^GoN63jGQQc3l`~QOe!Nc!ik)yjCJosj{Vy~GHVj@I@4_0 zK$&B;hHQYXZmwu#oI%tlE?gmm`7dh4lJl2~%3FpkyeV6m4v*{Hm{u#JDrGMaug*fD zFpBn-A2Ee5?tEapSed4$>(1d$AF2ico3 zgy~voS>K4J@mEGRzA_vegJnQywM8SLoa#E?n6#8W3n)J`ftOXgDxVX^9cL-Hw0Y%b z(7hAE@7{l32daX}W84&Q;gzZ}1_NRv94(!qwW*rAptY+pvvUv5nTVjRoY;dI*~M`c z&r7C|L6+hW)JK2-0hTzZy>x)CNX4aB7TrKJqrs>Sq-Pbb9pdx?lR|Z0$rP!m)y3vV zH-1CGOO&U3E7qRpYC3rz;w(~j&fUC%5zPfb5o*h!5#&Zi;dkrG%sz;x!f)KZ+AF?jD2iOU%qsTkO4hEdb(OeRjs5V|p)F>GqxSl;OGdczdlp_S z0RjXFu+$)>r$e4L*tQ-W*JcY((Hara@8%dm(Ta%9p%B%u^=658E67|)aN4s9SvY0S zdp+uRd_r0};Z@4n!clm+W@W-&6Ni-Kwtcu72-)-K)+%d#}Cr z+QV6UoqhH>S4V6q`QtH=hdV4=0_YLc4{O%H1m=)H)EDr0i+535YMb_)NYfB)#Ovcd zk>W$Qery{>R&QL>VuL1ql~0^tv&#-3_iV{t69X2!f~}=XBySuwmD()-v|LvzC*AC) zk=H-*)FivDn-Lryt}3F`AsQ_HDw-UY;;y1Xg$fnUH)NmK_ra#t%>ZIBidaAHj0?GV zBitP(itj!2L|D}Tcl!v#ZpyU!uOXv1X_DVp&e?>@ZOL0GO(q4(?a+s9U5I9hW1u)! zfF{xulgGN;o)H)X83lr zAf80IXIEYLfSGifUVm!KDoB3FP-pW>5Yp)wkvl0cSEx{-!g&O?X;?E9Mr<>IW8%xz zJWjwea%5t}@D`i>g3c5MVbmnPi{QdLQMYQ zr1X?LlQ-7mR8NK4pHlhi(GV-qT zkj6a+T}P~Z@TJ+FRlu|9JpUO0boQ9lS~w_O@RB+~z;mR2-gkuxPdacdRM*230)?4l zHsu6|V^-ZO^UCk;w{cXU5`5yqE;6wxh&ATDOY(6yi9dj^Qh@PthO;X+7~%#p7I+9p zd`^CoDWY6{)fy$2`JI~_G}$?C^V>=^s+6Go6!ha} zU`3rW!L;4^M5wZ+8a=1~4WeAwIvX0t5vN1h__;t35`74wYEduv2GG55_z}RX&1HDJ zqz*~g5Cb`itWe>}46XyNNT|ZO1#REMSttWGY+!8m>t(u#%O_&Dh{*O?zhh9t0a&fC z`DQ~rochxzK_gII|m5AnrJ z5f#jkt4CdeH5IjPtW_s3KywRkWbwm~tkyT=)%nIs9K{U&yGQhAPT5$XEKZ@-%B9HQ z$qA_3I==?qRap{MRzXUmZC1{hn*)kQ$3lK6OG0|8;d;bMU9RhTKq1sMCoTr$rIkJx zt@8PeB01ia7DED+SPXGTeMyYVyp=X&V>(6KVs9)N+-c^7KV+2dI5hn900?N&ofTt$;Q3pi9E$v6rrg?dw2{ zezzQbNG9wXh946fj~F0~cR!^37;3Ub*}0jdpZpP0AWsy?6KbpmU!9R0pR9F`2=a1A zIxMOapN5$iBCXA8Pw?>wT*Gi=OR#%up!Mn))% z!ubN_uQXL%fQ31R(ulqLo62)Wwn$KM}>{I{zyr2Ox_HHcqGNK!NkF% zD)F;V2K(*tOna-{*nsR| zwPTa^gn=w(R2Wx zM|l@?Z1F^y=L#dZ^3@-9mi6{*~4GoJ#YW@9goPU$RH#`we^6pVnRqpYFNao zFOR5uflqD^F%gRD%!HZ@Y9e2H)~VaKGQuinGP~M?Forgt7(npo$gQPYaQyhqmVvf*vbSr!iwl<%L0sHBFi!Z5s#C_5ke=+BoI3Kh;fhIBz6 zx!3H?uhw;>yO%vzo4xGkbv2$$4CflUT)ED5NAmQG$86_>?lD#vtuq4#rO|BLhaX+A zg?S0z>~D{(2TWck9yNQ{Z_1W&=aqwsGr?yj%qL~RCk*Tt20I`=ET%^(jY$zUvWE!l zcUN^ep$r5Q#-JvdFQ=ks>+wb`yNQNpnq}2fzoF;{k0{I23}~xdR}wveM^`MnkO9neh9nAbvp2_B0mk1vgCF_UQ?G-Rs_K&9UtrCLHg@llC?L zDUWA+r9L2DhH*)lLtIIJ^Wd-Kl(Sip5>tIz0T|vzot3sL}EA}z%b~*UH@v=>zRT{ zo;$|#2^^H;51YN?7d7|GparOROi+c2S!3XcFd4@j>`6?782XeUj3cKp5tZS$fbhk{ zBXEir=SLB?(?#+}Jn4?o<&UVmSlxi1J5mQ7$Z|bMX~-cOpiju>2nY`fcfO?au*xs$ zNgYC1KPVmj1JN$DGvW2@Y1ZPv{y8|SC@4q5}Kp&tG z1YaQdQ=E^-6t|YR9KNk%NcSf-+qHbkzDQ2oScnb`E7Kpc6Lkbj4Mu@B{{99b*yC`gzg+ypMk=;7iTAzu#Je*erP~jx>KeMR_4)pl`gn z;@_o8ge$V+stlLH|mnn+U_ z8uJb6$BGG$?R;Di20FInoREf`LKcNkUP5t7fWGfhubw3S785s4C7uys9SO6_dd20R*=1}jN_VyBwu+QQuUP98uqPE{%bjimil}c zc+s1zt#%wzmyi4B>zBpQkf3G7%O!N`R6~0Cz8>kxW@+CDox;mYVo8EKpd)&a53Vd+ zp~901Og0ToY)edl+*MT9z&Qnz;_PwJiEf%p#~F?%Wf?X3EvkPOuMQutvTU#66W;!1ov!Nli?U=p}a%joP?cVnW1m z$d-qd#^Yo9nVYR}h*)J~Ps;GHB#vFwsU@A0>eCmz{&dkTX8-b!bkXTzs!-vH4!$q( z*d1oC{f5pXh66X6ecS7+@qezsBeussYxaM>(`;f#iUcxd+=6ij-P2B&44I!|ZD9^W zr*Qnbu-|DWc#@1Ht4N;ae@=rk3&1Sif`>fFRnYmc;EE$XY^(zw^iO+X27&Xdtb#q& z!J)8!88@9eD3^9h2zHL%Zk)iAK>Uaj{2k8>lnWb^Wt2B8xy0uMa+--d4f3d-OkTb> zNXW7kIwjEs;HP~Y<-`FH`jFLEL#0BNGg&%r&wcupwrBgIz3qbsHRQJ2yzb(e zm{03~5RsqL-vX<89#$LQHn^r0a-RFsOX;Q)e7BoY5S) ze8vRz3i)y%Cgiy6)y>&+uis(YM)uij-~2A|PfMP7aBfZD#fy2SUYpn{FdL4lLO2a{h^eNZ_l z6`pLsK{+S~<+r|3SJPC-LHX9oK{;oj{oO(NH>VwxFlZ$^+X0anw2~nsiiyL&?;x2S z>(_}R3x*qboQS(qj4S7|!G81!8A^G=sFUWCw*vk)LW+YmluX$?fxATR!U_9ZEs19> zATyj0f9$~I7=p3r$Ra*Rl1((MUao+SppFBjBk3NefIC!z*H4MO{>w4nJHp-|W*t5Z zx0Zv2YuV%8L&p*cs|PIwOxfhd&nY#7?+RR z3!nE?+rP`~Q+FS+Me*aCE^18p+uNsOq?FscF~m8nLHeK50u!llHrB{2Tf2JFU&DPyEpEi5dHruXwIqdgZkJ{ryMn z)F3N#5`v#}COr^*K3S&| z4>GfnAqNS{$JbVa-`{dkFj$EuYdCzUQ-&|&Cuawq05WI-=J>p5m%|^Ce-58;u3r)o zr>Sa=T#kc$;-`K%WjK2J&z#+C&D)iiPTTdD?6>Lt`^2K_ys@n0rp+xa*rMt(yV$l9 zn*L5TTXw3kXlRi_Eqrvby5 zj-AIUh13pG9Z6aA{GECcVy&#htur2%fV@pWe9SMP^dXhcE7q;yrcIBG+vIrLeZq;c zA)6j*`TJ(K9jMuUF@5T;1$*6F-lhugRv8QOb!Ke5K5k$0WnXB|c*=G=#n)x!a4gE1 zZ>Ybx9ccS^dgP4gUu$_;j*GI1ZE2|{R|!`|@bMz2g};ixF(je;5f61;4V8mZ;mL+r zLHXU}ps<2cIVk52`3lO2929`j<>nC#V**z(URXD*_j=(g6{fs@i)=!hF_6bd;k-vd4d7K)}N{fsFc6DV&) z{3PS3(DZ>q{ZgL%)WyOma)*y|!R3k3(+362I6J8T+JLZcfL6ajg-#{-#13@SB4Wu~$R$9jvSp*)|O^9o?f*8pU(YO44S5veqpwYX|bKHHVi$TZ~Eu zVv@tufx_(>bxYgEhR5y7i?6ipBQ1OQ(Zlx0<8vxU1+gcJ@v_*kF*!98W8!Vkd&{+I zlNyq>&bI+Iu4+q*?&z_i;@gXqjSaKIy3Q!I!B`?tLT3d9ypj3FW zAsm$7&K#8L5zo0pI4FPcU1pQ{9+UwQ_N#~S>xsg^E2F4zvU>Ht6F<;Lt4O!Q< z9|+?^er&jHvuPL|sfe6NoEhFQDJDte<(2G(K6>{;-ZnIQQqkiG_ZWViNgEv!Jb%A3 zrDvfkeXJA4H*$IX#vK&aFm&`Wqqbq}FS*O1VidQav~jfqD|T!WmrbmYgP zw8aJ4=%y3YLv{=+K)p!w&D^AE>_uH6MFD3kltvGPK!oEw!d`HN3QsaH?iv4pYo)pl z&M|0kCWd&+AgIr6R}PXf?qS!~q5@=;eBWb$@nrz?C@Z2+(G9Vmod)Sx*&-_eR!o?X zQH%_n_mEu%EI~Oqr|hnB5{h%miaNkZnXCxqt3nF^9&xqs`aqH_uoMia-EJVE8 z!G=**ok;6BZ$~}>M+irt&|@u-u|!OItZ1-V6IFAfiV*N>WF5mQ3lp&C)w!IJw$5Ah ziSO!^KKz!EPyQmYd7a}GcYkw8M;t6qOzF`sT}0df1T#lgBp|}*$IS9OvuxYsNWJ|M+0*Ip8W(coKkd z&&8ImvkK=LOa#3M=YiK@!+Y!l`fN4IfzJaW5{jaHf~Tx-lzJf4aDE|t0`5-POW|Q6 zxie39=dJ)Uk)2-cEd#bPfzX{tFO*S~lZXi>CQ*MJ1gR`Oz|}?b;z>uEG}<7DI0v$V zxENH2kiqZ&EU8_h-9k` zTwcdzMZ|x{W}9eAS#XM!=C2u(SAy9<%f?q$O@2U{njO~&VCqV zF&QhK$+T!+@!&YEmk>m|&_2BgeOJU&FCBBBYoSYtD8nCV$tk1`9_ENcp}q@8XjBxx zzs06tqGiKVPk5e5gj|f8zdb8{D3?V!`vS;G9Kvz zMHXo|fSqv4ouIOO>4uLNb*EIQP@%$k0>(%N&sQCCB91$7pS=bERA{-8%&+J~umr_9>4`50wc`uF{zi|8-^D==Z|N)@Roc7_*X6+S9Us2UL;YK0@+(@(mfGv& zBT71Iiwh^LvB{^u0+aLq@$lsqD>qm_UY3c zu<uM&o3|AoTj~ng}N;?*z`H1xwd9= zjRk8YhoIeR*-~SvGw(u+FMTea?neuj#3AyZVxCHrj65?VotW?mr|a#eZ2*j^EsZL@wG@ zmru*TSduSX_tFv>G%r0d6c;I6d<-8Jx}4cpf#meCDilCR;q+TP0Hw)L zu2*mu4$2=_4oZb52i!rq%k1~RRo5dQYP;U-8(ypHNp}bp&OW$HJbaJYAHQ1d-@`%4 zY+7&R3<~>)*-o20ha2lP1$E{R^7=%_U2g(eOCr0#YQhR|w=a9@$5k>To8rPQ`%#fy zSztn+9&(Cmx$>uNJ2PaFCJ>*W17;E5CsIzxu}YfDB)yMrD^QZ{!#^Jeg_MoNYnQ%KY+>%`Pt4?2^BO(s5i` zy1QpThpSB6=6WhqQ@Q!s1IqC|C7qNmJtc?Xw506J_r7@5!=WLXkwOVxRnV)yKp~z0 z?M@pijEcY?uG74bUUQX$a*-UAulZ$Jt`mu& z!dV3l%F+AH-uh#j%coOh0(J?*n;Ysd#6U*SjkK>I$lAi^;Sw}y4a;%y8`+T6i%oo3_>LMc41QJ0DoEx4iGu>MFGlds!A|ZD@YR{_WR(j!kYG zw|C$1xV4(gHZRdb8dMEkR}FbSeE1GfqK^OuTvP2Y`^pAoSBdhYevnYJZ8#{M|DEi3 zT`4tC?8KGJv*$*$Z+l(kpj3Er0ONE-ckpl09sH<_)She1Uj7SmP);U>3TG8ePW+nj z+tucL$#*Sa!Z3c!7Z^Q2od03(M{e7a-P7%By)6eN^5I=zC`&*B#bFNGB999X41CT!{w4HD{lr$oL;45WB(pHA>}zCe#M;VD*HbQ9fF z`_O1BP|Az5(Bwnv$Lw>Sez`3+j@ccbeN5wFuVy;-KhP@bH=Gg|hm*ou26{6{P&B7r zpv*K7UC(lz6MCt8HsE6feN-T;DV(!$+QX!0if90GRv%ij%NAzr#ZNt8cOPuqU%l@$ z;@8a@D?`nO9F(K>9WQ^XO-)VM+wOea<|VVCu~r|htCdFF@j2Zc6cQL#OSWB1Ct81M zqv{q#_?tw0#?4c7Lga`pVE-jkHDXS_xhM%>xzdGIsPH5KcZ#FBHikqzBB(Baa}U1* zWfI7Ue(}wJ8S(gq-wE*#YbB~dI5(0Ja&SCZ5gQ?X!kQyBYYk7xE>2oYcF>O{YKr`g z56F}cTgloy{(`^8IV_&35}!!pra3$=`IIrFdp(hKF9D)k7j$D zwOS(S*^)d@M~;(Z)`?FtyNI|%lsU?)v?ARZ`w`NuD|fR^_8hQ^olh!S_2%sz>d)Bm*Q%KeX%Czt!ld^A;+gm*uj5=& zrVhR6Tp;w}hyED5cn$Ow^FD7UdAyi{blx78gE2I2OXEt@wbiB_SxurkY%*D1^k(rE zpdPHM3{R`c>edin+x-WPMJJ72U5}?}R6N5rul}1C@4V9IXixfv>saG)sI#M)!AZwZ zg9;TYbb-qPgUJzlRN>qL!-oZ2LFy1DMgJNq23FM1j`<`=Kpn^%3;r84#OZDlXQh~Y z*FcE&2^A~Nghf7%OjwD51LQ_KBBGp_>^YK;aGVF}oV!`_=4v6LOU)>RgpAniijEQG zItYYUu&ZH)HNb;sy&xZQynQzS^l@iFLRhV6Qg=~9ZNowZ*B&?hPGU|A5)Sglwb>An z#(6)$2ZcPqkK--ZI*%EY*z^kVC`bL^Hzev;%8h)3BG-*Dc?q8{gbuVR#}%aZ<~uko z^@AUEE`3|A<&IyY{vD%P*ev23Th(sDm=Y$%z~$s$wO63#ZP>P<DG9 z8bLm2Xp=$bw@NfR_G#c_Plw1)|(?dBk-duB{FD;IB|22Uil8 zNavdCk6z=a-?;3D_44N+Ur;ZEer3wbf@jd{_#gz6C2#hHL2Ll*6cDg~&AK=lfpiNh1=19*|O7U1*lKyc?#2I#Z~PGel` zB6h{{nk=uUfS3`h*@`MElDhXyPQ|lqr(yYpBs#)KLGl{H8zxun{zm zg7rEpPMu2P=hkFT+OaoD&I#L%`DG*6yHOXf(k0tTF$@77GkREm&UAQng9@rXH(xYn z*X^c5uqQNrrpD`bV27?Q{}`8$#^EJ9N4v*mKPY{;UbE{p21mGES&Ki1%G|$w#BMw= z=EoIdSo&SOW5lmZu9ItYZC<^1RQh5_1j-W6_~?*bMEN4cx_V6 zKWvl!{TszQ4=XG+TN)bi%L{OmSG(Jp<&iasUK5CfH}A$Mo+I+QNQ`_`%QHor zkPz)z%;;hf?{aFVqHdy%B2~Y0XRc!q&Zj#fSgyM#4x&()PQBt>A;;s2*#)DTlI&i@vF|l02xhKL; zK<(h;elr~uIR&r!yj|96F4>p=!aerYzkZ+X|Eas|p2IU5$0~3}7ac~E$)DpXNO7Fw zX304EIkccKPR6Ww(w&{>!P6p+yd1N;yhbv_|LnS5HZ-nE%fNp9Q+L_%g_fN_9tN0~ zumQ3OlP7eM6ZNMbI%41W>-VT-)hy&em(aOFg*7n47!$tp3+3bzUTWI+Ja>=ZwEOtP zQTK5#@^PgEj*R1U4Ltnlf_?3;e%9`LT$2UyeocsHKJmqPWqih+w&HI%u+8pxykTGe zL$@o7${w%VkI6B=a<49W${wrRfBEZ2?VtVjgZB3iE!fxm!9(_)zx9Cq&WBFecRYJf zN8iaYd&O&u#9r>n6UEMfnav(*32gX415pJUfdD-WhqQje}}5h%KoJ zhTUn+K|hF*iPYcv>BRO2deV-eV>!IqSR$=Qn|D#F_eMa~qIw*uOS!tYCGc zp}L6ApRg~y(@fH*IqZ*qc%|57$$?w)Uwf|UK48>pa!^heL0jSkv!aAR>cjX}`=ATW z@uSBU?A2d% zvEBZ|x7vL_aie|i)!Xd--+!Z>_}N=*`4^sQUwFedH_ZS2WtUmwmu|E9pTEt%|BElS zZ+`A>`@p}yS&oD>m%*J=e0_Ax{`PyXwL?F1v;F0(ZtzDk;iRw{b!@(E`=(oV^`2oH zn;x~Vx^=gG`mv@hXkz%f7wofle9yIJ$CosL?6tpo)wMP`F=QXp9q-)FKgE9IYp=4e zf8HK@`}gbaQxm|CzxXm+lzxYP`WAbs9G%KZsh|r%)LFdjg~^ec{pY_uW#9ez+x?p0 zPW{CyL;ZAajC+Mw!QeKNjr$+ zeo_X4yVZ7a z6Ae~ZFwG@dXD~MvShG4&2<1lwN{Hw_$s0y4D~cZko1sI`wncE}k(^064jo_Nme>XKc_kGIvQ9wQh?C^DpIK7`|<*pO-h2SnJ zQJl(wAzS*{2g=K!l=y|iE>h)vgHXA^)8HAq|0=Usa2#0fe)xy3x9@quUca-Pl5xE1 zyFP9&y?MKR_VFd#@vlE-&-tJC+h2U^m3H-|6ZYjdOxws0+-{RU_8I%m=k1hHKVetx z9=3}wp0fY>wU^s}d(UzEZ(q7cH;#4tjz4|WE}b^}vYRv!q{m0Y80jNR_SV}^*~?VM zQ!kmYdr!>S#}6*}if++ZY9B&PIW||xk*cc+CcpQS_8tH8PB+?1npkeQX3D-scameT zx!v~v;HT`(AD7b=Uz(}#Bn6`;jiElkA;10cMLRxQx6iw2m%a8IFSFOY?S#gD%}y?~ z>`mWrx&6>z9rCgN%kMj3Kl%kY^e62%zUFct=Qkf1vG4nfN9E`Y*%3J-fB$c;vOoC5 zG5d};KW5+Z%xU}OZ@AJfnI5)@@4v(T&1>)0T&BUyq&B~7|3hj2^_@rTOMdrZ`@^rj zQqIPd9XYjRcOBMs+i&RV!no(YllH*}7wmIgIHh^9{}kdRD#M5nBx?&A?*C zD?>!*#28}Hq8~hu>KkKF=j@Z6s*iP6NjkCVX{-LkY7+^bhmKoTF|3-%QSrqM7y{_X zBf3>QZC0rem3){evjZ+*p3VBN9p;plVfsNyhi9dX?&!GDIeu)(zU?>fwcr2PNnhX? z(H+}c@06D(<9cAaWz&evrSvH^ z7~hDg@FWIT8COiYdtU`R`H>{oI}Q=ihX>z422gZQ%qC$|~b` zd`S8px1asuz4naDM(uCzKH7CnZ8_u?i*~{$t_!R8-=>11Aexim1Lf#90r#@CXF6Gj zE?XVwNFOtYmD}qqflsx2(_AQRRDf}!`PnH`Jc6`ij5~;P(&D@qa(=!fTU)ka9jD|2 z@EFH!ljoH&ODnjXdXfCm_2@p3c$ekfIR8NAgbSHfARYlJgFoi$zTEo*W`0|sUrCBy zlymWOGN5<9`Z}B5Ic&SHoUki*j@Z%prj2WY-_A2_8NLrZuw-xlmg{Ux&dQIzXqP=Y zvt$QPwe0_U+8+CYXY8~ux@F3qb7|f4{l?!Pw4eUs-FDCMIa@w7Yah7pl)d7%UH0d9 z%-DPGo45OqEfh7t0bz1DsXM}t%kg>s)ph%wzk1XSK1=Tp9c$XNE}O8S{bTmLE5;Qs zedIm;jU1kr{{92@-Ou0QTU@5Z`^br=>+_;#?zGEykH~=%Z_FAMo`hhKVFdij?2A#2 zbDWXCyMNaH>9te#e?B>*>t@+kM8=f%$wwFM>z}^UCU*_ne|z!e_O5%6+597?wtrgs zXxu;e@Qgiha>>5y6<6E#y`%OsUwV=2^OXJLwtKJi#_LYtI+>6zg%6_g-u}UZ_RK3r zZ1?22-F;Y2`DzZ$`2gyKadi+7r9;Oo6^Y#lo`JD0=H3XMRxz2yKHNco40y@29*`#p zFnpOk&}*xs=+jXCECKPuYu|WmP0&asn?yB;rl0$bJ>ns*so=@0&k~8xt1TN>cuL`# ze>g3%OLiOQB*}5sgwxYxt@G)a$TJY+g~QCs3r}s_`5E8!W1YlRKqlIO^`32e&7S^M zx>(rgl7Ppr^xN;5vkx6wwqO3r1NM@er|r~2+kWH^9<-giNA0nhW&7AcrQdbRh9-yX z$G&KtlBJBMY`Du~RajKls-Nc^S$6?tw+S zao>pjyXWt+ue@=GoRm2`!5$SE)Vhehv44B-tbOFjvJCd3edwVDo1PxA2XzyJgzG?M;u`sl}G>S9$wKj@v)#PWK1DaF2b-_1o;8 zqmp+-p50b6+!f9~SXG=qVRq*`HO4i-CU%8N{n0?fV1maeUf>=_qN*lYg!h<)avId?Fy5O29-$^OF& zrtPb5+ir*FmhCw|f4BY1&);b;ylUG1?BmB}gga)0N3oM~qF8yT(pU?QG3?4JH5F3k2h?YFCFW;>hu;5dJi3Y3DJcU{oT5`NeJVWpfPv)4>i+D{x`9_HUfDDXE;LdA! zQs=1-&Z|HEYr;%AS>1@jals?(dUQt{vdj!fW92LZY?SBg*g42oDgy*R#(!NPV-KB? zMR$6gR{^|ag&0Dd2YTug8A|mX6p=j}YG(v@J|(bN-M~S~D_trGmJPMDGBu9cEjL|m zGn&&LJG@{^L;Pws&M*Smung2LeAb_0spm$3j_8+HW3zy45cS8eLf1k1qsS}8eBnW3 zS#_Myb+%9PcIi5~ZTFDfvVY9(n;W*@f5+`IOOw`W=ptyGuw7H*_MQLqa>cdm-S^Mh zjNeGK)ng-4gAcV00#@&%-qoN8rXY%mh-O1|! zALrd)VK@y0cVN%Zhn9?yrY{kUwfUP4|2{3wjX>Up= zxK5BEC?7zbxJ~Zq3Kc3;*koX!Tg+y_=kJmwVZT1C;T-Xp7MUKw0U*(`ws8C_+ z0|SW7DhwgUE%u}k7H!0u@rcMb5woW#jO8kzeAuz490x@_W+6Wms~cTT*Cr#%x?qu4 zfX>A!fdr&rvGibvn zMDtULd@yH~qWzCQZ1%VRLvzzqicDb7$ufHcCOcNN3=F8pud=TqipEYlB7);8c}Xso z)Hw-0?)FQMdq@Vou2&3r57j$~Jsukojjm-`gMhp%>Y8JXwptCV)@1|e(v=gwpRo#Z z{s_l$Rfu8vsNHg7+Jo|V+JnLubA3~+#uswDT~xV^*3o4M8|}L?LSBHexEAs})PcGb zkYnCnw#nL%O%9KF(so^6JBJo+hlb%TdnfIxiMBn|s@reA^8uT03|Wh}SQZ<0>Gqa= z^9!%A`DV-Bb02$9q)ctnmUaEHO{Ip<&t9;86^|sfjsF}Jr|2i2X?+d~zihbuVzcM| zE7d1951mI~fM^WfF2Y#FIur4}`}+w9zc~1#x|Z+0Hge&t2aJ@iGKg5Eor4!PXf+h| z67g|B>PL5`E?rZGe>7;FeIBw`19u8DN6bFE5)!^#JD)IAi! z4sZ+TpTFGm*%i z$sxl*nHnCq30*teYc1PRTeLlLP;TBcX%|hl?Ez){{lC56jx3E>dr?9b=k1amE&G-) zl!LO|vUfc&YjfDip)p%-4p~Di{FdkG&)0|ID3Fv1-IT;M?xSAkKBceAK>;`^OIyG> z0ccKR0KRk^jgMg(;cjbvRon8QI-~qiPd0VI_>YgJIugV#p6x1!58!I>r$;+;8u|dv z{UZ0Xl_1@Jr4%Ee$)v&RgqR~g*H5X40!3K_xXa=K=*OG^7UcKSDF;r<2zRpr&agWt zfU<}$l~=C2U!Z>0xh_|zhn!v$;Q&A$+1Cw}P{x|{r|ky;Z1m%x?Y0*DcW|VGJ1BIr z>hraDen`{%6zc7 zlmF|0hraSQ=X##8r`&pp9X)*9j+~T(Qcn&_+BE9?I4Eqy=H98uJ0Qrv;p?;qkk@z2 z^g)q_hCq>A84?>Z15LiAYTM+{kL#KoQ~mdiv~0KP`_z4twri|ykIE_kpYMFoj?GP4 zdr6gAIBr+$YTGxx@CrNCY}w!5KWmMlQ8^bi|KY`kM0b4P+=z3eL9z;@Bo53daFe_N z2Spvaywx@-QPI2_3ge()WS(dUJIgrZf^h??deQ`EVhjcW%^77dg4|$)4ke&Z7!>lY z=AeL_KgYm%VZ=dMjj@E%HPROt@nP=51%I_QzZ>XN_h_fkA4EKH1vo)YAA`FV^0L+q zmFp9~%8hY#&OlvxyM_utY<`q&k#Y0S(dXcHs-?K7=W62tvC$^}GZ^$;)<=;J@^FAS zfWzyPcaQ#c9{s`b^lx?O2m!`ac^t=ZK__?W0msZn^=yCA5S*Oj0MSv$je>GF+d(M< zJvU=qb=8*>Km_6FqdY!=sC>+T744>kAu} zi_WCKazwq>tAqCigR#dTZFgP@o*tRdsBGAz9F*bOlIg)$TspFGIvmPUATiH(fQ8>owLtcD{?}e zcijurQCoZ`HSc2Q4hq5bbm&$Eb%4Uf^ih}U$>~|NH;#~xarQA@(jiCaLz3&e3i|23 zuDs~M$$%K7tuWwAd?@Tg;+Itz(;e*7k%Um3i_c(^RJCkx#fxV ztOA8``l7#RPsOp~5i2Wz+pngamq$J$cDJydNg}e9f!L^4*+I$E0CFM@L>QuYe{K$Q zDi;I~>5NOx-BA${AGSYa#>5EV3CmlYNDx7ai9B5(5rIX^iGy;39F&t~2Zb>yqJMpLSMrh3x3BtOh5l!Vyk3K%(1FSj$opN1 z?Ijx-s@rsZSq{pWO~}ER9-6o5;bFUMqG8wVp0b@Ia!`hc?6=?hkUcsl2W3uja8UNj zLHPnXD6F91plI&xc2Kxb;*mH&8Tx7E*dvA5813udBzy5w%>LDzw$LWoei*!370v+O z%unF9=5fQ}yUpJ8Y8l%Jv%S}vz5M5Oz3~`oGwXc@vM$)>&lS(DZ5HpFWFInn*DuRz zvErb(nDp~30n&-bfaeZM#OISbap7D93d5iBmiM=W9FoY(1dRP%O{V~P!}1pLGuPka&6nHBqjFH<5s$B! zDr0-D)6c#qMQwE<51tsYX4yeml7sS4=@E~lcN`QJG@@{ni3@?W(+$(MCAD%*shvJuzk{;Ymt-qc zcp`xb^5}hLfA+&22W9tFW-s~atO#6Uy^XzYOgd$GobzZ2Cp8e+;UmmEmWzyd&?{WX=LF{<=>}ZqPH-iHKdlgOx+;Gk zcv<`r@s-xC>Y$J}+A6}{4S52Mzl#2_k|&n~iar1}8)_W2+itzw4zYp~Uy@}7o{hOU zC_X-(01isOzG%;DD9JIAQ^ub1DLE6Ypllca{;{_0);N3m{z?B`o`*(;?2kWq*zP|% zWQ};lv$vHTly=8Ksl^J)xEz$WB$roEKytJ_?X+U3IV5LkjJ4~j z+zyI~?=bjVN&z>2BCI>{I?9k1vxomK5AkuXFrU#ZgDC7PtV~$kVF!T_3Ci)k5brBzH{vs9VZ#ni;XbYjIibT=@tLRT%%gLOV<9Jm>PH;_=Z&y;eFPKMRIFlI@8A0a~ zz1pG--xNILS4OAm`l~#xmIk?;dVWR2S3?xtY-m77TX6KfkRIr~P%ECc7@MAh3xo>C zwZ#$si0^hz*h*L*l5@g|a3;-Np+bcU=N=d@sGrd#4g2TD5Xym(WO7TyhuT~acgPq^ zh%}DG!QTUv5%xAGK-pftkjJlue)Z`>#)N$j=Vwr0@o~C*LK>*R^8-|)jaN+OBoN7_ zY8X~Q%$uu19fgA;-mY#c=c7o7K3{LMMP0&KT~ViVfIh?cbbEFNEL&*v>NQ(!e`yV$ z#QoY<&1M#7RSlg`C)&70%Vn-a2*COGE+QhXIe3YTYb}GKxu+P(bj_qzs8FH87DpKR zUT|Y5gzXDM*#($_QAeMZFwnC)mht#q@@ec7aoi9i-7ltS5pjQwP86m!^T%(PXpfG4M{%k7upn*P&p_SDpc6|z;X zJ5EZp%@YODr_53t?23UA&3hrVA-dAv{T%gPD8^K;N)9QeEq9!FHnVoTdv6k5GhN)2 znU%ZhCzNXK&L@pxj5_GdK0n?mzS?rrcdK~eLgk=Ts8Hd;0Jat5n2eVL!xzSncu&hC zOTb#X#SF-T`p?6Il9$phEkU1cpcZv3CX+Ivf)Hjr%@myWsqO^}>O;M7OwP7*a-o5? zSx>vrj>VY5vnda-T4%3`RJgE!wF|;X$0HrLW?_^{xc2}6a9Bx1K~xGmhPD9FSW8bXKe|bL zx_c`C-#MB1b8|l^B2P)Vbv^3YNV(?$t|s*i8UU~j(su)iTSvL)64Y-)UDzX|x0Nmq z-qLlax8wQn1`coPkL zC@duQE^Jz1HSt#PMiSuhGzI*%+AJ+lyxEeiqIBJ%MnMUjo-q&-YxO0HIz^FL(We1# zQlzN6u$pdO4gKLKOW6HbE_cfTh3SZ#2AH<;G13c&C0*2REl6r&jy$CMhdwnX7#EC> zNZTk7x0YUK6NR^-aCtnrPHNkBrzIAoY>l_tc!r~hI(jSEFo@Wmdoe@G1ca0hGqiX!5YxoOcyUPzzCtp;fOS>8G1Wc+moJO2WegHoYFg$oy_E#ewDZS=as03kh0VV7*u zGv@^n*wixug36Qy)9DIz3k1VD;Bu4j<#Y@=l*2EHv$_IpDJNxyM28~KY| zTNX*-&>eqrJz({))@Oq%&WRj^X1ifc_5HjGX*K1vXsj$S98$6FtoTw1sCB-1q7YIe zwhZ18qQvp^kwLcI!h4#={n*m=H6}^p?!a`=OVbJ!Dpc4yzM+H=@uxbb7Q%=2>nAYx4O%!K<<>_tZeNWdvy%bW~w%iDDtk|dY~e#Yq0wR zBD~Q7(XXP4Pf0P{*Z|@{9lw@BNlgs_KEOsg;Tl7N9kl)kEP){Tdx&?ZCSg*}2kT)( z@lj|0u(PL6D1Nw;-8Zs#;wuNGLWK%j9~i9l-ZA!sTf@yk7-RH;HpPiTC^}}7P?U2v ze1({e*q^{1Ha{&8@Vy36_yvS$!qj}LVMtZxe%BMtCb!s8Hd;04o(8 zTi5|%tXP*N%V*piFz1;C)~DLddfZd%mK)*IXztnGV@=LzVt~H#KWt`8m1j=2j zU-|+i88b113(?O|^y8p_-}BJE1mpxU21G3t<$I~y<7&zgn`<_`o#vLCHWYi9Jey*h zVkQm|DcauWagdh@yktJZxULHF#@i@NG-m-(%{6rqqAB>p4+$i}X0?U$ZFw={ObAwXVE z#0>&;DfD0*GZqz58x}RlH|wfQZy;jB6LA^q)rSU~)Ikl_ zZ#xMhVH4qM#>a)*JfpZ!fX+E>SamXoD}YBaDyL+~7S$HZt)}mXU39NRoN=wKxZZRk z7NRCP5vSpz$-sa}o?z$<;;4AvA1m?=wCcXfL8(w-5Nw*Ut+1)UxMA=BeH7uINX)EV zvndpZg_V_l6F;)nlzBElf#@oV;JEMK8}FNVbmXPvRAaOI#> zs4xh)#^MgM!qx`M^o=$Cv3c2Ez% zw=RoX_KZ*j*_n_ybsb3OgqfFwv{9F6DD;G-$g>I}Pw<~_l=UG@oP$20y?RkXk(Kc0tpc;+Of7Y}%{SbPuD`=A?)YA32wp+be#!1agS;%cj~wLxF`5;VlK@$Am97huCe zdLH;O#}JXkmEYE3*JZz*mxBPgAj;#IgF%+bkNL8gH%Uh)2+OYnB1nhwFf<6(!#fDj z3EJrF68ezen~O?CzvPtd7l8%dhQ6A7Z;`fI5eI0(M$N6*|TC}!2h=%l?kt5X{9`QZY zZB|>@!#)988}nLSA+ER-^0ljWBq`4Ut(+k^a#S}@NE{Hi=gaVEmS2ODEx+kA`nkh7>;}o}rp84^P@ct!{IY&1%zlyVhx)Y$NruA{KNCA*R#3 zHER!#+VIe*YFf9t^cZd~SzXRdTWP2|G1Rhc?Rls1;dz@DZ5y7m$@+pEoVHEWs}+t$3}cSt)2E@;c)SuFytR$Ll#6KCE%%1R!feJKkni2 z4Oz!@$^)9V)o@};pl4W+3aO_xZFU~#h**6Ym1D9^j?%XFf@oRsi?&@3(ezNmrsTZT zL?bGDTo>XF37wWu`lmvL3Twgd7@!JINMKPnI;k?Dtr!{|6WvW^!F|3ZC2> z7e9^*k7JzVX7IR2;re3J#(0BA)OmcF*;$}$G6*oZBw>?`>0*Mdvx=gyh4R19Jmu{ z%<3pwITKZQqM)ZWT%*5B^GgR9aq>l81ar6Fs{nYJY#^+Cih>HH6Ap;znrPRFkc%AV zuQQRAV};IZAoz1aAE;>4h-B4-aE3fzB*B`8b5P%|t`uWilRpQw0UI_u44R-@JQ68^ zbmuvXpm;AsO8EwjM0JrTNKu>;9>LH?!}`-!+d#vjA<;+*J1O10g+%_9T*Z4HoIC;1 z?&!$I`6>+M#MqTPqO!--ChRpSK29Q0oo@+sPF;llk<3p9OzF5y$8Ezk+acPezSvW5 z+P?9oT{P9UOLvail{;&8{r;Lg<)Tr$>C$n#@v?Ed=F(BS>Y}>s+dFJi+lOsvynfc3 zyh4R12Dl06AN&?&H%_o97iwX41tQs>C(Fo;4SzSD2PNMbSi$mQqZ zmsOtcn1y**?YE>ZY}r)3W>-$u?aGNEIUvJ!?Vbs{df&KReqhS3xO|UYcF7*wfAKEc zwP(tvc1&4oeB4eb&tt72duXm@pFX^7pLlf9{{F#5`@4G=?XN#O+fl7Tg$fn6E--{W z?rK*9_E+|MLm;0o^D_%EIZ%FvIQ5yW7ou<`8jfT@4s{?cfoR`@AT!LNOx!&?KaLKh z^Nmi7K4E!*YtR7bmnGLd;5_;hgfl{9T@~T|)B31L-T~+Cl;lL+lebZh&dY+LSvkU! zgY+EU=A8_Dql5JWe*mKLM+iB8^c$qU<7=osE=p7`YY;>p9MgL42!$gOl>t#9(nRqX zhet8~!;Xv{9qT$DT2ed?goxLMmwD6^vUF7Y*IG+*IBLoUpYk%3n&fc-M?HX;_u$;6p^%uV&;BWn?t#~}c+dH)3?$IH;;=rU`v3Jb&PmkI* zvDAiZHrs65;p2;T|FK28{jml6@B^pp{db?VcicN`e{+As-hTg*{p|w__MS&h+WQ_? z`s0iC>67ALq<3~+J$MsS;R83Cebei8?Hx;z6)HS|!7Fr!?=gGRtIfuB2fOE1vzPs( z=9*K9;Q{~?152{ls?J*Wg#+FyIPtLAyM9q~^fpCM304vYFk94ng!*Dk*8t+uT-aH< zCND=KJ&Ox31U-}~qNxhvIgfdy3nZZb_-UTdaXp|N{7yTK-obXZQ z8Ie!MW0^@EN91HojgH!cBDX1wk36Ne+AS5YnXK6dA8y#|-hZDp>$}trYM;h&yKZ0I zzVQW@+DxNmA3M~v1@-03V$0^5%QhpzZCG?2YSxs%CGYDoxne`54>c37cE~O_TBkyV z3af#OsJK$fcQ{)dG6wabn%#QYlwG%fO6qe9exU*b2IVtEACSDBZh|)#>&^$A&b@UB z@OpYbMBzcmVGoKjMG{dl$#T8|Fv64`>wrO=6S5VgKae{llEWJqBhn+Bl`b8F61wCh zA{mvaJGwBD5RR+`pZ>5?!f`|ltdj6*t>1N%o-(k4P~=hAA2*b#!|LTlnX9z}ypYQj z`6^T*cTUs>uCvZ->~VleNs>8a{0^_KZ)VM|Hj*RZkADP2g&t6_^+Hy(^HDr?8b+RG zZO@Bbo%;%j;NKZZrPGo8<7UMN_xg2J@|VZi!~@3@?poP5(?c30Z#Qp+cqNavcw@|W*u zNr%6<%PR}yJZ7&FB5zFUUC87FA9d`!TGBxek&aviWET-hQQDxGa92St2ljIF5|@kV zvRg`k-&Y(6qpZTd0W;^z;QXE73fXI+kH{|IB(X8n+mH-u99B-E9O*x@JY!c)&D-aH z{>AozPaL)T4lUW@@OH6^-yJHLHSdv^M?;7yw@WX;N7kHoD4q*JAQZ`wu1)gGc^PUg zic2So=EwU+<+!kYq^))ym+)~popq(xhwC;ao*~t5`-q&Ckzu8^ZDM@H#_Kh!*N1FO z`Nrf(@WwFZ!`}SalafDV4LKrwHP+oaACqNJPZ~#wFwqp$ zxzx6mgK|D0=j5LMe3MPqY&h`IYA2Zw0V^v_QqRT2B9wwoJ(L1Uz4$#NemO@4B#juR5YX@vaZ?qNH+% zUw=5q-sfo!GN6w$_D4CHvXIjyONjCUq+@W(aj{Yn@ti`v5M`8g=!;TWA;6>cC)DBS zZKA&EYQvPsq202H)~sE=ZOLBvoc;FB+mGA*k1pEcIF7KG-MIoV1LaG_IkIR+oCk2$ zaEJ=9Qi2k!j-VWlkC5f#_mqc4{B+G2PUUjj&}Nj!FOs)oa?&P8TcR-=(fAx6m;0jX zP2hc?GD0+$ENW~oiCBo4TWtIH+DU8`g~Na-d?mDCztHYpLvme=HQUM>D{`?K`S{hwtPYk%1${b7s)|cvNzs2YYRAq ztc)E4O14cKoh~eRaZ*y-l0;Mz z;Xp=l9t`NBFtdz*a$I3oPig2~l$C+3!0Q9EkPaPiLdIb1fjlYKvrA4wS9yt%Hgnx@ zqQW@?rFP5p&&$lw(?r1>N(G1$Gi8&9jTFJhk^o2l8C>@~m6ZAhC&9CFrmy?ANcXx{)u2E^jzaVnFx;T%xj@Pf){d62$D zW#kTPoQ&yjeW+=}!*!YHnvKcX7?qyW?EBD7<@i|L_kr+qY*aEw^~V>4B#q+O)4C|{ zV_seeLl_5SuF>^?TgGV8x1(JK)z=G3a7>WTQN6Rezbw?Blj49X`Tr8A+`CEIz#tEhq~8XM{pE)nR% zNf=-9D;)fkiTIq#Dr3O?TO1KUJMpxs3UGbI!|S>1oj@)QRejMX?pAx*CP#-o`zXAMW7~|?#Xl-OWO_W4sEAGG z5O2Zw#0t%+s73j`GvZ_Oyr_24MwgcStEs!>C|^2Jv+H(_+6{X~?CE>A+0!l`w$Hs{ z(w=+mw7uZEX?ymy+wIv`P1|i3PuWxUP1q&dMr~3KOnYw0jvZOBJMKMfAG`Cgz5k9G z`}h~dyl@@o8I2Fmj zc0p;E?-{j^zv?=B@I=d=`ZJ$2+lDzVfr$u1BI8_>j5hMZvpJveM?8<3z3bQIm+*)u z>6BZoP?I>n%h!=fCYJZHy`C6GFw4x+Gwa>Jos)FExU6&}e{mUw92wrCU?CIfWs{U8 zpGIQzgXH*xpACNP{TbV*HCI3WQq zmxv^s<^4$aC}$vW8vaN~Z6EP2A3hDpdU_1vO3|O4vkq_KiAN=;6HgsGzf9HYwtd&6?H-?0w+`EsRK|ZC85TeOK)N>DYM({T%l>AsM9yh0pOqtWYGKx9 z7ix+Vsr&^#Ij^cMsLe;^P%NU3FeIVFI_I>(H5zj~pzZxmgjCwJQ)UNwxCh7*rhzc* zBWmBp8GGigC41>D2kc{qYWBzPx$nX{8PIrMvY z_2|bqDZ`!L6n3oCuX0e%CrS>=t{=bOj-S-Tx87GlH3{w9Ic)#%ombm+d&epVWiwHB zP!7mJdHEJ`P>wBG``4dlcRs#sFaF&J?CyiQKK&LZUFbL&I4`UL&nb>K5%|O-MlE+{ z+&LMtS3Yy6z2R#wvLka%+xs7G-x`}~3kT&lIu1%$D^!O#FX9yNyJhYG(~Rr}7Y42a zC@e6L0M^EtcxVsqx-q(eY|iYUhnz?ceVG4xA~E^_Ch17~_cYw;SjdcsvT)+1hfnYc z1j&;{^+bpSUQUYe-^T9*I}Q<(x`Z)CC>~zYIfBRsigIC0x6PiM^u|dDFBoR>#%fid zOFm;+{lf`yT#JkcPa~r2m=Kpir@jSAN7Nru*=*c|i!W?Usqgo;X6@Nm@3iZ#+HIeD z=!pG;Y-Xcfx7NsrE$ccN(PTTO>u0R3ysW~F$|;cpvVFX6qZ5-hHY{gBT`*2LQg=x5 zd5v~?v1yIPhBU0%k{prwrMAt_F52w;qRlPMi)YvxGzB{9z<1VK)Qz`T7`u!ODEg76 za1tXGa1bDOV)ABI9OF3N3hDy9w09qbIL2gz`NqoftbOj(l6~cE2kfJVm+g)3kv(J& z3Qi=Cc=mT5@jP^LaeWR7-G|Q9D_u@yMD;6d0q|4PzNvKsG$yAeJoE}@2{doAyITTs zKHqcCqTR4>*xvRnSGtqoh6QWPHhfJspMUKRd-=0=*-O7*r@i#~yX`BVy3206Y+A-a zJUm~7S5C}RF4<`%W-Hy>+04>}K^Zm5M(b5ev)-W*jICRcY(n8=7zk^>$r zVA%?$83LjHs6|H%DTG|wrqiGztf<=8y_O^=Wj(Ers6Z*NKX#FBtkTpp3AsZApOCXc zg*=^5FF&D7%4UK|lD zD^JqTAE}A_5er9A$RaL|L7p$QLocFiKGFf{f9DMxIV`NIu+kNI(Z@dx509cmEcoy= zX#0fOj;WgMo2uI-+uC-?_L^PJr`C6m*fkezw_C3{U{~##v>nZsUAJT0KL66)_OyLd z_AJqJFWzR)xqRB5f88E?{!It$c{g5c&$#+hyXB%?wtI5S>hnu>^2kwp=z$~lsXGqa zC+<3I|8VMmp-Og?>E9pe)eGu2w53=M$wBl+r3)@a3<^y! z(>sUlL*I3cUB7pojH>g74wR7;u$l@GO~n@VI(h; zCE%Ci0&eWNgXfs!7nV7p5S!%#zN%4roJ3yui3%~1%(*)OiYSU;LdnW46;YsEwLllY zPLR)pz)cNx^0w(Dd0-&jiVUao0lu>m@sU43wD(63Z%K1deLHQT|_i;Ni zH?Iq=S8w)5Q?t%q-68zfFWGMwZy%`~l+DCec2KzTF%o?BlJHQ&MkmJYO<#Yxefdoo zzqRo_Z#`e^btMrMfDDo$DYhrQITLuO@T(>JuMZ ziLsEMAum7VcwSNPwwju&hiqKVhW{p>`VQ8e;$u$7ruuK>>71XBfoD_+RC7qemi4c; z%&~3P?H#d;<>)UgHEfy37SfMbcw4faOM$! zWQ%zH{_;}Ni@j*OZQdE{POFVOI8MK$b2@}G|6H5-MoE)$vv5v@= zgY``}XJL zuj8(crDof{|1XZ(FTe9(XM)BU`UJ8?(9=P|vgQUmfm46%fc}hoIa@8|k4cpYfZs52 zCq?j;6DAY!Bhn{XId(ig2oWog@;XC=Im#jNRg(mgdrbfVcVcwJkaKh(2VFBcQ3O$L z^h=0zN0M1&*9nhVh-YP~*uNo^>xLZC3Vkxc-d-fAZ4g&L@&55KRg^b2aBxF@fUJ}i z$F5(@Edib`9ZDdsh;Lb4&U9OS&D@Spja1$&ch_7eu)2>a)p$a}K9BY?8&KtlH0E{5 zw5?fh*skFr+qGkx&77FCR%2N5h9rB*hR51AKDy)|KpP)#+vxD5P4C#QW*pbG#&66l zTVr9t4llLr_)Oat7VCC+reW=d+#lCdeaRj$2im0$Br2jK5cTrY$o#Mcv=>*#yk%O8mW#oV3T}0CkLYg$)B^IwxoR_PMEPuWp>M# zX#A%o=JSr!zcWpH&v##MFS}Jv)H=Xw-Iv`sX>*!f-gn0d873_I78*0O|Kg0<{r}i$ ze}DXmb5cS$9mV8^!Its%$2$S>@B?cF#6vpuO>>8XiJW3qAeB)DdrQLFlMh)Odo^R| z3EV+qf*~)ICZ@;;D?yTSeY(`p3E4<5h&qK%DUz}{?WI$|9n=&q9#JV1D^T7hN-WYv z-flP?L{KKj9!M%Up+`T)Tz1U4U8Dr&FD89Cn!IV&UT&#NTh@@1u*91$3eU(be7Io`AF11eM_YE!{quJBeTVJtM~>M8k1pEdM;GLnjM|Q!+id&xVcWlB#CGo) zw_V%EY+|CW>bBG!eA{GRm)4Th$I+1O@JBk3#-p$Jse*jh#YvU)aVp{$i}}30JIzXi z{QEBn{D>j^?(ixcIpfzAHDa8 ziW!y9tBmpk_H3K5r(C(sPRQ~5^y7=R%y=nQ52ZIjx_t#m@aJPfI48tWc!zpst8jks zj(g_q&p$I~fAoo2d+0=ToY@B+T(Y++{!czNYoFmkXu_utE!v-bdd~jz_F4PDLtACS ztZ>dD6r2kC^t^Su+vWOb>@iHv2wLQqW3DS{1# zaZ|@zyXAi&8o?iWH5oJDCPo+EcD0_lLvb8yEy(Wkzmd# zLpdr{wX;$r@)c6*ts|Rn(aqmr5|dAS3UW$wkQWMFX;Yk%Akus@FX>D&YBRrk5{1+1 zJR(k!>4KPCm<)RWKIR(c9@yvy91Y@F(%?&C-1s)jBxWYxMNQ6f7@QjFzlO@;wU~zV zYz%u9#>76#=1n$%VjdS&s2q)DQJe6*mvYDN#JZ4Stp*&!Yr`Ei?7_|*KgotkUg;gdCcQWqca?KUnf5|UsaC;gDdZ*dg)qh_wL36HI?Meyand(gh(7w)#NdBelD*jXcV zeCJyZ+E*(6<-h*0Kl=>)?0b*dOMd=td+9IUX9u^+6Nd`t7P1=ksS*1(&)tA7(+KF>)Hl~lsxR9ei zOzi%K3g>`?C?t-^k@0WioOok-Y++w}f%ar#W@RJZYKaNI7oym*OutJO6(60GzSNUC z`x`xqBb_`!I5J+oD4ZH6>BEn+QRg7q*WcXXs77L92{o0aOKvggD1c+c+ak#QR?)fKu1hjyvj+vHc(?dZW}d*r@D_UOIG?Y?`C+r#%iZigN| zY)6mI*{tfnr23C&R-YapwY|G=T(;Y#m+i32K640Z!`G^ z>eK=B0b>f?hg1g~86KbEP%<_c3r^@sg=kRsAUaTz6W4-Y4?W=fagqqN1=U}YC^jGa z0vq`g2uhQ_qI!c|s!u`mt&UD@e_Tf~6}AW%_Xn;RvwwKim3Hl(!UCupmu>W-G5hQ9 zzS5q3>FIbMI{QcMjo*E(z2p{kZiOc#c8w!Y#w{<*UvZySZL(ZxMpTJ2_L}7S|kQ3tY z#LmI*?wFlY9DqNGE)Y%uz{4tLBreaoVz#&T2o__&iJvn*bS4~O{1OvTTs3}pJb zWVkaS*)!6CFQ4J;ppTaePa=u%d73=%oAjlE= z|3Q27;Bom&E!#FRZU=Ua+m-vq?BYENi?;8XupK)_Y(mX6K0YLWMdkY@a4GELWv-)p zF_<_gg3a$f?o)J;ta=n6Oyv`F-SEAbaq%t4nZrR@R&)7NR#xXq@alWW1rGpZc;j|5 z+D&Vb~_u-y>gqq|J$##e|lqg{L>Ch+S|V6 zDtq~DGFBCyxX`39B!lp@%eUDV@)POTP5be4uiB=Ixn(=m{m_|WmyDi270_MSbFbkO z+?}#ssIsowqp^41ofMVt6KF->`2YsIACPk)L!i5CjpT!zT+-ZhaA z(NW5h6ME!D5XU*+DH-7opL`;JJjFCZ89LB7zB(Y{v5GqwkS1atiQpJ4DLfxEYc{Jq zGl}?Bx>@nfYGMp>heZ>e6Ap$7f|#_u9a0#F!B;fUNBPhNC&3@(AOj~u(Ks}|s-p9` zQym>}&bgh3d{svIHKF+=+)`ebqdfk&L-}Z9Z)ZVG(sATeHpvixmo`we6Y+T-?+;xE z9#(=oPAUs0D&&)o@endt&G7Qbt1-q{pzf?rP=Ahc6kE+PTW*YMULLdNOv7dm9=5~x zKVtWNR`i+2?4bvb+2KPo);clg{>IL+VcWfZ*!Ia`*{_R#*X}(wy<^ID@7!jS+v_&I zZP-Sp>Q?7-0s2p|zIUZYJBv8-NXhrL=*Uu(J2H4~3Og+;>%9ECwtN-2D(bt%rH1c^ z9^w&OQ>5|O`Q~n0)#k%?LpGxETJx1CNMZnOLs;F?c?_o$Xf_dJW?uccpuXiNm5+&Z ztlr`|pD4Y>b7H<_J0{XehT{uNLM!9x&xsy4&edByn~1IO7LOc*OLmRgKfLNXyF@-o zj@rNel)doT)AncIbeV0#7@Yy$cK57(>1!Xbn-7fHC;zSLnc+`9IcG2b-*;<%i`n=b zfyw#AV`lIBZTSj2bS{Gq{7#j0kvk|U9>hd}H7txS5h8vp=OT~CO5r^URyn;I!N+{kQ>O`*q4ifpCU%VXQWm03}LM`fxdfYJ{il2a%LzUU?~qD z;-t=Lh>`b#Ng$60y>Uh95VD94ptn0Za#BK!*T{x{D_=a{GU;cmyRFA2HlRMP~(js*hSo9 zG?w{wSmzsU`_RMl_K0p`ACPbKuzb%?KBkL3 zy+x5O^D_qX;Yk^<&mJ**NM%sg!BZ{!=s_8ia1PETFm4o!&Gc7UW!x}wzMq3gksH3m z3$dEOky+I@u(IMHV~TUa6`{m zL1H*{Tz9VO+!;A2(41&Vw4hFJh?b>?f0-Ck8!>_S-F`a8xlinn%7Os1;Ii(}8{DlY zL>hCYlN60dL_Sf8eC32y6V;s+6MqaO@_I=Ck8@%V2}j~WrzN!?`(6rtM7^$xh%QL= zgO{cbSw&heg1_9E8G7asMc?35aRd^zDk3i+54w3o>KBS`H+4xgZE1ed7EUbM$)gK) z{IO$p?4hG}?2$uu^vH2Ldia#h96M$6qNUk6WgD_RyGQJb0~2=rRpWO372|fvo^ji^ zcig6@CTz!K&9+Z2+xGFA?HO&_?uoiCx3;T3r~YWxr>r?LZlhxw=NkWPj;-n6k{q9z zR?}t{n*L3h#^Qpt+52-+G%K1vp>Zc-FEIL{k%%I#$>@TDR->buN}_ z1!WVl6;@CH6CoFJ{+NZX9jn{(ubZ|%|E9}iP|mEc|LU$;d+F~#sQFCg$jG?S4zM~i z&P;iZ!Aiub$IL$PI_V&T$i4w4Zl3-7l6&F{gz@jpIGW^i@JBirJjMAZ{N<>ynGjxI zwV+;Uvf z4wJHPidEk*!3Te0^BE+poA zA7 z^aYMBjaf8kH()CRJy*%n6S;;$Ey@wa< z|J{Aa7MAO_D96)3o#!_KI&yP>!|VD{a7Pt~$0bDbrZ{p}*dln@?;o^h{f~R?#lQ2Y zZgNid+IPS8pgmjhpZ6>G+rg8ka;1%GpgYe*S+ChsyeY58x;PNGagXi`$><0H*}MQljg6aPsoR@dsCb`G-n4NK4tgb zbJFg+7>2#Sy$SZ-m=?1|LPrf+hx1#;@x{}d~8xq&`A0ukrZKEvQkD{`OQY6xc=Zt2U@kl z7Qv&ZFh&jg)vvfn9&3z1vt#UpKiaVW{^k4ZS(k?;mYu?Q9bL8``igz_Ww+?=vci)O znr!cRc*Z_(pC+XV*WuZ3^k8<>(yVkx!!O z=x-5aaY1Y%!@*!R`lR}A_LMGa=%m7rCpseHag1m|v@Bv`jcPE< z#UzftDicS@H<3bW2eB3Y8}-47QMOK)$PDmBe6$7Oo+KTSj{|^SJig&;sQx@aLVN>m z4{D+pc@_3m5@e{bSoV)cJRVj#IiYtz$-PN`Ale4`=+^yAtPe>qcRsp=Wdu0VKq!Mu z_}4&Wr_E4>tcVyCksks@`zP`@V-$!V6687{jyZ)_y&F3BHq|%@@>j5jZU4UgcFiR_?Y677 z*>i5%Y0tQ3huwVbPP_b)UAFt;9kyfdHXEMarW+q!k4$Me^(xlM9ef&rcZl*wJe{}> z@=6D)M?9O0(j%Uy|I)+uniuV|SKP*P@YDFJ*FS16xoOhA>6trHOb4&|>%+ENch&#? zc{@`~2h}5@cMIW8Cnc4lNJVyJ3I_6`xj^sUO{Hn#ECmf8S9v|b07l?$zu-s z-6t8YA1r1}Hp=UFe#%S|j(|VfQJCyJdWo>q@^W}X!e416LHy`T5RjLNiFyW04&uUi z2jD64!=OY~Z#Z(ABh+`KM9O5JOv+kJ?Cy*ai7e^J-8b^#A)0(RIT7!xO|(l{X(40= zU_nM9i#X(^a6iN&9tT3`6VCApi;A5_tQL?Iaw)SPoOd+^1d0v)X@k{Jlm#=qwB>5@ zvpVE#WF={h;)6*Z1;25{% zWVjH24G-|fkw4o~R~UkPIt z%_~8;PbRNdsnLph3BBsETKRzDmf`&I+;yV?=Tbq^4a(3SSy5!oVZPZ45bM(>%} zrHB9zV^(>5Fw>?CBtRP@C+SjG*d0){WjN0Mhdk*#1y9=wl{JKe5`6`e;#jru>w_|M zWEIh`!yy~h#5X)TZo_gAYYNwR+$#O}!2Q(Zn6>MBa{j|*5nI|p(M8I2%0$Lw*sj}4p1#}u_#5`Ga9aD}Q->P%lHYyI?s@D)$JnsSz>wK0 zPDe4xM46*u=yFfV`nBjEqcN*9~;O*H7Vx()bd2JrYxPcYI zPP&l?9C4Bo3RNhd)tZP%%DNnc#N-eVA1ttQsm`~zI90+ke=QR?kv=R$BqAo-N zq%e=V^8F@VKmjJML69q$WCwEb!3LbQU)dRO9H|zpL5$Hn>}HOWynqD%Y&vNI$p!y_ z$i?<4!jX#Tr0ayS%igBA>yO80tkCiJu&RKB>Ql-^c9PX~9VyJJOr-f^RSDH;eW-42 z>DbW-=9JF?KSUhz%gR+aE0|eo8DDEYG2iy@9|iaUtQn1iQ~cPK@80i#xAA5c+fMu- zR)r@SxGpsYo_Xa?`WnOR-WY~_iJA*U8KGdEIeFPUbPuQPC;Fa)gdOu5hB`k6Zhsj=lkv4XGmkO_*89gV--21DlHKK;=78 zu6QXQK0biP$H#DXd>;l&*vcEWHUi-o@<_-Zp@;`@fs|a>{jRb}q+Li%$nye!OydDR z?R*DCx;QD^j=JgGH>fJwN&G!2rSqtZ6%qC(6t4y+QdB{CJiz%NPkiaM7m<(okE(^d za@gl7@fHPTR8#*^PuiWa;ChOX2}@b0$QsDS67Gjcb6%Zr0kYpC>OeZ5t7j7S52Iz| z?M+`R4|{QV#Ni*S6S3-m04~}f&S^JRCtPrufbx3d;Et0AD2-&_$D<={;3QWd!bRH? zR@uH+N6aAte+0y;q3`DrKO5I6j=Y@HxBk-v$WmrEND4#T2=V1&exaNjzhRNTSp{F) z_{Hg#=DV6rU(HA0I)#%rJZ{cW7DRltg0i_Nt)RU8^@r@SlM6PiyWijb>Pzg}J)M#8 zy?=4YK6w9vol=MY_E#UUXIXc zd9kl}=3aa4SM9fHmPo(vPF<%m8jCI4zi-OE^oB`$-j!2!V4Gj_jR&uNcYH+tNI>zf zLjXSXCY@7w;S-Zj>M)b;1!M^M;`jYN@R3&y&T{>r@W)=g_>mRmCb{0fJ@g3{2;}Wu zAlF}ECeL!Y(Jr~Xh&vM?&zpyGbz~9`U84+lJQ4<7!F0Jl?rfYIrTGb zNq@1@>JDWwfKuDRBS)#YkjOuwgZi8FWy$fqCL;ElpnH_zy2}0CgNjAIYQ` z|LKL4?y~q|3j!mLSAc;j5KrH6tZ+{7S9i?W`#*WY{^@m7g>wSld!OPzbi_XIvWdbu z0Uv*K);{>*qxRGTHGA<59p|LNlL!kf`@dg*kvk_p^>#TF-0^bJPYm0k%VTF%ic1O@oUX3+Tz@t&Ckq=PU*(-q&4T|V6h5v>adQ9cn$aXQN=yhp_59VIiVY> z^!7{qaGbx&ijhtfch){xVssO^ffxB(G3n^-ruG?DIA}!V{3ZCEqK+8cpd4X)v9n>= zAw)rhxdU~;kjfw`q5(I_m~QS`osYY5)zg2!Mn~$s$ep?JL;NmILE<4DJ|0*3%8ugM z1WA4m6GvK^l#V=rRD z9j}bMe2!UkMM=pyo;B{vX!3oox;lFPr z2459Zzu{>3CRc@Fj@3YZMcLbw6*cA>-VRNk2Wt5q6XhKiKl$-5d_|Kq5y{kz^PKqO zudlPOB@qtdl5||w(H{*djAP4}Y}0QWsbnOIe92TLums6cOt}yWuW(i|sy_M2S6pI0 z`bE1_Ob7h7!4G`Z752Ygwl~Fez^9D=<%=(~KYHb*Tk6G&CoJNc*ecNEcgN$4_WghP zxc$gqJ*WYs%Q=i2s~=2`nlv~(|Jo^g=H-*JO0h26j(^efp3L6q&XHPy?qx&PIFopqvlUiKEs&al+asdG%Hf3Eu&M{LzaHD-$z!bWVzk zM;I)f`^1KQ6AuoHFQY5oUxQ6Yk0WntBibq_+NM0&`Pd+wfm6(CU!aHTMqUuvIWi{@ zz!vj3hzZ0e4*Czu?6yC`N=L|lqejVouCOn`GYLV2i7S)hX=ne<8wfcme|*_>1re`w z^zla~@JnZiiFi;d^ZNuYQV|N2Nb!zxyvTo71}Y^Xhd8Nsx<80OcP8jaNQorT{z0%I z2juM>L>%?+BJl=A{-CG=jw=&<&_>}aWKxvf-h7Y8-?Cz|mmVM<(NJzY26Y`!hI~3< zrQLr5f&_?)N0_}Vk{OM_!B^D;9u1{vM`Y=VNK8aoh>0;1?L;!Zm8fP@2il!wm1rR< zLy8ol0RhQ0G#=AM)gzuwL+KIEAADraUil0*bams;KeK3Gdfiy(%ibB@`{1%YWpB-P zP0*XCQ9a_>MC6Zn#?&|auQ7Ys7J7?^F9|bg`j3KfWtXtrvKua%usdFTjo&Db|J#pu zKD@R9y2#mVivxq9lM$wiiA^7XmQp#7*N_ARsse}#)VHF}PgJ9IJq~^wv*FlI=%JCbGL^v$I!X{8} z_;6})>f(2!)`Vm@8_MGpa7;MUx|EBT{zIodCORf{PPm+LVSr$(aMsYvIRRgO(@N(A zJpc0H70yY8vjnb#!f0(FY}3HtE3d08p+ypV(z>2=cR@@{u>2U{RvS~Uzl@=8NaZMl z>S0Y9q+#qKCeoO!Rt1@YRssE;v#v$}9r_`+rGo(5PoBI!UOyEE`LcdS*zw|Aiu-Cw zssL$&5_@%`jDBSWkMHZriE^bRlen*@usXrSj^eET5MBckQ?w)Ov_mg~ha>I7aD{xJ zQ|A~6iCATFy>%L61@d#^$(QoF?uq=7-h79AL#Q(F4Un!ni;Da~p#uuC@&yr}4pF~N zLteIse&p!w!Jv!Eat;(nlqXTo6gLpm&^(I48Fc4HQ9);dym;n1NX5{S0@AaFq=LQ! zeNd$qS3h`C-+7Y~YNY-tVNxBGD3=2L(O4(gc{HH3obtyT9w)wn z^d}}r-bC`p9qKQCQ%7MYd;bwZ98Agfaz#-u5V8s#dQhaJGK4QsK#5&W1Pm&(rm~#~ z(-DgIukPyTkM(qfm-^#$@TiHmCOuv3IAzS3IVs8!x^Q$vLPS#Mggj4?Cn;aC7S3*aB?2`rz;I!PJ70wL0kbN(hz_{ED0*y8c zV>*lOtguO-g;}z_urTBkhOT`-T*!k0-E+bq#a+5)5T6`VG+mX?dmFJ`A!iUoxxLB? zb%VzpD4qDk8Tx1B4jA=;6!!fxI-U#i@}ul1KM^Zdg?=gQpY7);UME#B+MEi9!xDtU zz_jChDKBq_`XdzDLNdbJ@J+1PG4YneF1vH^vN(FXCL&yr5^3*(C|_mxS5H+guhNp= zH~s3|N#_8ax#M%vd6~G=XBLgJInu`t7upGSg$07}m&aG=e^!8Eg>uqWPNF-9=MbSn zPP89wnRz3Dnr*uXmL5I9hGnJvnSY`Ohx0LmCr5_SQ!_kAyB1#2%DC z|8cX)?J2ShH&lrT_t*yl;tBSePzLs(u+f+aWT56E4@OeN{3rUFcbbJj|R@5G0U$dmIFiNSy{jZs!= zh;rRTAo349R{H=sWgUn^e}_)Ew)}%}XBkl^fIj8xsn9V)%Cm}t0+i&x(kTf%pT_H~ z9F)xkPQ=*&gT8W3&Kz9CN93UV$q$*0PRl{LQVz;bUpNj5z%cvfSA{Pm=LCd<@@H~T zrsSaX9n$%Agk>&Sc#_FW(wcx-`FZ7$>&UMq;#YxBHe&Q&HddHs_B^Y!cdqhUD9Vpa zDT0ZO$1EsG(wRInUXMP36~$#ja(TY;Aszj9kn)7oKIO8JOB|~v>}~N!OP-=EO7#6T z(na5Cs-*iAwdMbU)Ib?k-U6BX+BhB$nQZ$X|H%WoAn9mVqDCR62{Y$CW! zxTlqBNotRZ_4Ds)r6A}kP$>p2fQSXt1Z zi|jZiP@I=32j}pzT0vJha%S3r{hq3eKTcu{q-gR4alTQ64lA%hp=67!c{oQN7d*5n z*Di!JxS9!yJiLjOsH;nQLp5b^(bB%7ne$Fcg$hqPlwUEdaBi@!W|z_Tw?-gkbfcGO zU{D|vs4&Q?3+#-I*yq5+$X*A3n}r)Z9gFX;Vz^ z+d*m{^p3Y?Al{e2wDG_Bv-W9r?C*;FntuRN3I)p>gRreBtKl0<4cvllKI*5akKnJsQ z>784l!jlb*eHl34R2CMb!Z`!YKaj!Btvi{RWE4mAy1Okalwcr4m-WfZDEJlOzn?{d zB6(9J$lnlA9FO2u#AoM0z8@oqbLH!b3nD)9Azy942kZDbe0OeAdM|Q)c;kdTnw*89SG!C1|He?qXnHu`Ap)xdBU-X z3sRmkKNGBnbzCv=u7{8n)GMx>mdIBuWa|B^pQW^3v!H>)Htx<13D|Q&9$_x)k!IXZdka8Qv};CiPWU5ke-%9*8mP^%mu0m@N7EW}>V= z=hPwUlBWd$9FuTfRzq1n8_W5X=h!@)%In)~6)IE!x{A2#TGHJhzg6Ntd(M?r;hZ9x zJd9%i16`VnP6I|+Iwn5;{3yLDvK~H1_i&4tXOzD zVd>%%yhI0KjB{|_YvSo!&ow|ba#{=Ucv~grE~h3%Lns-KhL#es85{kB2RY>D2oc90 zoQ%AT!l_^uj<`V(GJ+^P-eomADC`V(eS4ZXjNm)V2&C?2f zDX1%oPbaJy#UHn*0`XWS_LX=Vq;n=79lR(I^(CI8Q{w0MaC}uqM4p_d7a}d>cM&p4 z5QTp111Udlg8cg>nnj97H0gt1o`<8z+an_oNAz?jASJ?2zT)F;oRk17d{IYOaCTzf zPT};Bfba~FmuPpK;E@vvulJRLLGTsw(-9EY#ZUrKB*)Ae`GcJ>BSw#7B}Tj)heWmy6px%JyB|<9san7v4WWzV_+uN%>IL#qr@YVN(M{KkMnY*&kQa(}a7T!8 zq;rnoD|j<=F4&tMY)(i4dd6 z0$I@}>@^u4(UDCn5KtWLR%)NhL8(w-O=MRpZx-~m2o=sAvNk6e1mZ~7&{Yt|y9}RD znM5H?NU^-1QyBiB^5g{dip%3Ee@*0tMo%rbT9TPBc&onN3mptS%yZSC!r47{sSjdkY2a%jmN1TsfN{CZ;QV0-H;t51jp<|AapMg3D-wOU-P#^dvTx6|*f#hX~ zDh<*PWkg<_hRp!&S9ly6Z|9+Kwqy1DF=Yq!Md(lh6SY5%QMey5 zw-x8`uR?_*BN|R|(Pq(BLCD(>5R}@;_19_W*$b2%6mWg?$G?vvS-eH$y03y1j6I#>n$e9N~Jkp8BB?Cj5aGrU5xDh7>qAq7NE(GKh zUI!-`dZ<-7C>1JHxBw7VvKL{-u$)XRtQN>YaAGxtiBdcZGFK?q2cbfg zS?I5JDnE`14$YY zMkR#aMez!7o%r}qQ5ooo3Kc3;xWIwM!}?+6f;h*b%OJ-i5298h*vL{2bBFDe!tMk> zi4P*JfYL%pJW}yTElgxQT9RO#6VI#o2Iow|;^VEEoH~UnP2u7ZO_`E>-0=kCde41451_Cke>;5U633^d437tV{x=gzc+nAR=l(D zkv9LJTtsjz!OP%}PM0=zE-^ z?Sgvre?L%ms^+>7I#U!Yi!LNx3$C2vI6z6Q%0a16p~4dc7`1K<;PqeHAr zuvyeUuP(maZZoOm;hc!?1@dRds zqPo(1R19&{YpuHX1p>%Kd9=SrZUD;2YKpgq6zY1@XBD9&1^FL3lzb~Xs{>f*FaIDN zV?#OzNTVwK`nhOx%19s@&~`nGjJy!}a9}}X?12!EysW6cKoojM-|<^*MW5$HT~{eL zmy^p|4??^j`I91WnppkwzU@ST%0a16p~BV%hBzk3G7Vy&3qyz?CXtlcofSxNzWN{| zT@dGKLd_{axhqKW{ljG(F}BJ;QNAjocwZ3-UZru&WkY}?dkxC8-aQ8^1cN-BgLoz= zW``0_Sp;>WDWf?#u8PQ<3EIfy23$nQNwR!WkBNOPM7~uf<6Lz2$r=bgbu2p4F44ze zpmu_A7GhlaAc3-ju?I+sI&s`cKSo~az|kXA5w63i z5b>hQL8(xo!qx|Ns~2G)!{^|9RbU8v5l9xXpeUde&!dX`5lI(mlJrLqaz^~^9!)YH zhqI&jc+}xUoTwjqsR^yCz5y8VZZP+R5fqyVaw46Ho5_(0pJOqLbh42>Cyd_Rm89RHJ_W!QN7SRbnQt)=LXWOCiN}x%Cfa-l#V^o|dSSJ+GS zjMEsa{le=(7# z+&VxOR3cl12L=vEULK~u7lF{1b9BaONr)uc8Op<}0!9>O(v|XYn)la0a>@vWHiEVC zg_5*E0#S@Js4qe%`Z)tpQ9q9KVNXPUh=OQ;+Kpo>IG43vgy^1#M5v^HFXXZ|s!x$G z1u_+4L~agP;^ec-{2oJ4*|>5J544uyB^{XyQoJ88ukux>a6aMVRL2GV;TU6_^I{CA z@LGV!zsW#8oyTvR43hWBj4*1n8Pp3jVN5Oqkp%W4_Ce%Uw4k-ni?>I#R0^+teCkpAIPp>$ldaE;f_Z<%BF={EdA3k??gmBFw*;D*I#bUG_XK&P z^J$m}D}J-g0XpyqvI}wENB_-0xk$gJ)DZsTl8lc|x!n#5nKoK+8R4ON&Hn34ue2jS zd6PZ*<2Tt|ues4|wlv!0Z2aLjUE}1A$7)c+J>!ZU*8ch1%x37A5@g7qbM>SjD^xgd z&^Y~^%O~vkPv2@+>=`keZ`rSX%@y|WkKb%|vSF9(p0f5Y+-i2J#~98bCuDqN$et!y zT!)`~<)nT32XD2Vlajg7>+%T=uKO7g?Mhe_k6?J?g~u%H`@jH)ZHo`9!Rz6O-vrta zuz^XR5HhSV^&oC23!^u7JIY$u+yQfBh;T3Jht<*&25JZ71Y@d~*G&h&jD$Zh2tthK zMJ}?|K$No{^vgqh6uE*Y^ohqM>2XbrPd_ROVhDtP7;!-^C)z$_rZJBU+AHTLc~BsZ z8y|j8sklZsDuJ)Nwni0Sy1qI}t%S=GQJ0?eC;@&beN5Ix^QILybG&ZfP@6U8dpIcT zsbCJ>>3z?0_t?#Q&GvlHC+*@N_>}$dUmsH8Ds)yFW1Klkf#dT{Coc~tg)|%xUbUN} zh5`mgJWFyu9;c0HxVa<;UYwF64SUbGUuAY!9v2OaOwu8K%!7FO98Hn>Goionkx_Ck&>V+kbuJCDZvcZd|Xo_0iphP~%0)Ka^x1@f!~Wr>F_LLrMu!KAaT}wrG7$uLq>}}$DkG2b1FNP!!{e5${WHrY+M}Hle@~CLi zd8I<90V{HP)q{ABWnx%yB(D?Yo~F$i;&KFb?;f$Qd)jvUcYkrvOkvwKYJc<($LxxW z#_dx-e3KphZ#Uc9zUNwbOk-+?cBh&$s6Y0V7g^&MZ?$`W{6_nN8~50ozx`^(H|)|q z+w4u>d5s;D0mt{yt);#3Uted(|NAZWiPv0jSM3|Ow|xJ#HloSlvp;*QjgQytH(q&} z&HemSZ26a-Vz*tsL!S7s{pq(~XCL^1>+CgOvR`f7a}-smaAwf8G;K zVxtqo_SSE{!fx3&YVDuC*$&M#b%8G1C%^9+JNRF3u@~RA-R$_1{f95P%&&vRUwn$$ zqYL)U&)H|M|E6o~(Vx26zTmoP8HFd>IF|wN4W&?SEU|uW)x;ulLoH&txcE+q^7?Pg zh<6BnOkPU!FmYH(?s5lgH?romVdO$Ea+EK9dhTUWQeIfFm(eeN!=Oxr(oVEHZPf#r zYJ-6cDU)v|Wy7izXR;a;Q6}|8#X*!<(LSX-q!Yzmy-(2e1-JPnz!QYLLWh3HGeC?z zDodMko(?&!CC~YkzoxOv7y;u&4jZXYF%;?LON#S+{@jdDAxE zXxpj9rhWTYUTm*?+D;q!wvXD?Kk{k2=UBs@cJa6rY}?52klnI>%o+;&YuhtR_SLVu z&z}9O_u4z}Yua~x-fnxzPu^(mN8`zx0y5_Owf< z?SFspG5d%d^mpGsYd8Gd-S!Qiv)x|)Pxjka{nmZC*E<&-u)9d`_=YU zw@lf^-}7;M&u34`NIk*ExvvuG=s)w%QRg03&HY@2VZ#tYAYRR71$RWG8=1n0cOl}i zlxKh_JIY@-&?9IK1WOqGC^roJhIQzN&?^d|!8Z#bS45Edtk+3N*_~DcydZD4eucps zV`weGp##mrG4B(?P*0GN@^MmnFp(V14HY^EqF^XFDTs@xF5Xp8To*~6KT_0jIsG<~ zKk^|eFE8>809gA`h|7uMQ=L~jC>ybD%6ELe<$F+S{%lR9Ky%A>(VkKJgI8W*-}#)~ zwtc)NKLZUqdhF93x({H@WzV8e6 z*v<|V!jCNm?1*{Wfp^UuDvyD(S zFE{GAfhr6Rgb%t&WKe{{ss#Oty{BFr2SK!hxBD8EC)xS+hiwGD5{LIo1D4<`aG}f^ z2)RtGxv1zHMD!eku8ashIC37DgpeC-L4_<50!pC$B0Gfo@aAn9GI}Bv=8uqMOY+A@ zUHXR-O7}fqsyM{sIzE8t8IZLGQgQugbF7&J&7NAeKe_#+-TuATn;nya#~b!*Uw@fh zDTm?s{IdP~U%J~anHu%gkP(%NWAW%r!+!LOrqiC0w%vXI3A=HxjO^%`{j1N}*7>rt z8oVz4E9K~1zGK3^{kI;JuTn4U@JL-3%g%B8%exlrpFd^XWsP67!>-s-w?F&LNjXJg z8r_^~R;bVy8qY@$F32~o*>kTRv$x;3VDJCfQQJRNm*Y{hg%fg8=34f*_srY(|JDQc z(|`1cuMR%*@-h358q=RTylm5BHFw6hkBoH2zQk_R#WJkBe-;4P-}06_mgL0L?MMIg zuzla_9#u~|I1eB-I)YiU7NQ$ppcQPqtgE^(Cp{A2 zhwRj^-DanL@m9O%h}rFj7VYVmjM?$u{~Y^++fUe$xu)HHbjco*Bk|h5c+B4Tky$(S ztGC(RKYF8W-(9!=^U)bQ_Ft~I=Uh2z@4J6a2D@b+d~nh3KfYx59zSVEf8iv2TCQ4m49=xnUq59pff@r=Oo(sj1YB1V5;N5I;X;m-{*l=LFnr2I`MMUw(M2P%VY(C zrvZh`0cD4bC@12=_sB&OE*Nv!Ia2~`x%`3@=}#_#AJRGdQ#>w3g`+|qRkg^!7K$>X zoFED1=qs8c93prqgE!DTUBn$1PA7L@5$2^Be_IFAb&azVx+c_Y+eH*R81R}dy2b2Y z{*l?-u@qUtq6$rqad29Ese`u;D3_H%mQT{78yn*-2b9z~<6d`yo?rhvUY_zJgUzj^ z!5eA53?t&L2tYcIeemwUq|#_G@=R8bcPeZU^%1i}cbdKKUuwKfneD&9>>FRJc@n3i z2N=JM^$7;M!1#=@%5Lwt7IbRk`m?Aw;yL&I62yszVLd4sT*RX~GOQ!a^$_En>w|HQ zk>GlIqG3qa?%{jP{`l2u(;X>tgGf!b0_x(G2xhgdgL7z76mhGdToze2#SGQIwF_gT5vt|r_iI%YEK!_KCsq%)RFXI{V8-H zqDMOniYPDO*M2A1ja)J6Qp#AC6F{w^+Au+Mx+;L3h%ogD3VxZGp2&FyL0LEQ_d_^1 zTdb(!I7S#Svt+AEd2)nv_5gY@Cl3S!P>B#kM#{_t zphmw*ZoOdA>Zx=ez=~7Ds)qyJs36438^<09c0cl`S4R<_Q@I`1(Ya+&WM@?+#1)7L z^rkNHSR^5r5d^yWlSu3j`l%3qr9O>ew<{?b&~Lu)Mm+xZ8|R5gLqsp?DlZ}Q30e)_ z&nk~SEIj^+A8BkZ4(OoJJ}AKvs!*Xqg(nKIY1sW7{LvPcM0 zzM2YZ&4_3AG`0BsAjSFjS$Hc*deX1nw<2WqB6OxKs^2SpAd+4NhpQA3sU5tWv;weJ z`xh%b8HfszO!i$>jzowA%7FT`d9Z@enPWjpbc&7_u~~RoM4UTd#8U_ABJ%I8NHHhX z*PRI^wzqZCi@$gV+zjelVXDS82njBYASCqpouvpLky0e9EEtWjVLQ6AJgy zBch{>O!R5Mg#6ftgu@(+9O-}YxU&&n00`l!zx-o#LPQ5vlv`#<`FkrjAdrazBpEKA z_NHJwl}>!k#^s=_HJGRyJUk=XbB)&A827OzVW`5RUhNqTvKq*bW1T~B z?o@$TK|!xR{j~x(DdC&|${>H}jO-YsdHjV0_n>L`v!py?V*t@!YdMG)1Y#ic*lnI8 zPonN|;caE$q>N8@!cBGDVmAISIM7Elya$>RZ$oXM_ zsAH_W=#ZBSdNjf5ys3@_a))^}BpyWIH*m`19h9#%b&7+666@{owGb7&(11tjhC7zd z&H%K551t+%4bVn(`~?px#2{jT_W>;Bx?YH5)JQUs|_ zF%f1UEham#uDX*M`AIQ!C4aB#^#dY+mm7+%@u+1a(kN)1&L>$=mkqj+jnx6-A&*N5 zMY;my;o7WaB72q3PJlZJY zlJ0@f*UN~L0iBd!hvJC>;JjycMRGlkXxwsbdQ==GfUmZ4t-9k9f(JmavSP09DS`}i zikPCEgD;Xe$KeS%IXEwuxnd54Au+Mx)`hBmY&?$qo+lph5E%t;6c{4vb0#vj0xAb( zgNVxDqBEE{FM+7aLD?GU8s|OwYBLZ+qKx$x7cwH>s@Dum7@|$A7h)LF$zHFG&|!ed zERw_i_G+(92Zcg3B97cDI+C<%dj~R^Y-$aedEfP_+raVzNp4Y=+PS9V!1)urT>YV& zc)a3rCe;rL=XyFHq<}x}!M+VR5XcL9$qNzTzmD3GG_p%;Do){p4>etOn9C%I6Vr9fhj-FvE6nEd`HH zFu}Nv$z(MYvPA=l%M}D1G4`t=Z=PC4w=QqR; zIOd})vOz2QHyA<|=P-%<+c%|g0wN3WbUGt+3oynw7c&k@_$$EKlrO%LZD#*JWK}C2 T7h)D%00000NkvXXu0mjfK$-&g literal 0 HcmV?d00001 diff --git a/windows/configuration/lock-down-windows-10-to-specific-apps.md b/windows/configuration/lock-down-windows-10-to-specific-apps.md index eaf60f5ed2..a92afca98a 100644 --- a/windows/configuration/lock-down-windows-10-to-specific-apps.md +++ b/windows/configuration/lock-down-windows-10-to-specific-apps.md @@ -43,6 +43,156 @@ Process: ### Create XML file +Let's start by looking at the basic structure of the XML file. + +- A configuration xml can define multiple *profiles*. Each profile has a unique **Id** and defines a set of applications that are allowed to run. + +- A configuration xml can have multiple *config* section. Each config section associates a non-admin user account to a default profile **Id**. + +- Multiple config sections can be associated to the same profile. + +- A profile has no effect if it’s not associated to a config section. + + ![profile = app and config = account](images/profile-config.png) + +You can start your file by pasting the following XML (or any other examples in this topic) into a XML editor, and saving the file as *filename*.xml. + +``` + + + + + + + + + + + + + + + + + + +``` + +#### Profile + +A profile section in the XML has the following entries: + +- [**Id**](#id) + +- [**AllowedApps**](#allowedapps) + +- [**StartLayout**](#startlayout) + +- [**Taskbar**](#taskbar) + + +##### Id + +The profile Id is a GUID attribute to uniquely identify the profile. You can create a GUID using a GUID generator. The GUID just needs to be unique within this XML file. + +##### AllowedApps + +AllowedApps is a list of applications that are allowed to run. Apps can be Universal Windows Platform (UWP) apps or Classic Windows desktop apps. + +Based on the purpose of the kiosk device, define the list of applications that are allowed to run. This list can contain both UWP apps and desktop apps. When the mult-app kiosk configuration is applied to a device, AppLocker rules will be generated to allow the apps that are listed in the configuration. + +>[!NOTE] +>You cannot manage AppLocker rules that are generated by the multi-app kiosk configuration in [MMC snap-ins](https://technet.microsoft.com/library/hh994629.aspx#BKMK_Using_Snapins). + +- For UWP apps, you need to provide the App User Model ID (AUMID). [Learn how to get the AUMID](https://go.microsoft.com/fwlink/p/?LinkId=614867), or [get the AUMID from the Start Layout XML](#startlayout). +- For desktop apps, you need to specify the full path of the executable, which can contain one or more system environment variables in the form of %variableName% (i.e. %systemroot%, %windir%). + +Here are the predefined assigned access AppLocker rules for **UWP apps**: +1. Default rule is to allow all users to launch the signed package apps. +2. The package app deny list is generated at runtime when the assigned access user signs in. Based on the installed/provisioned package apps available for the user account, assigned access generates the deny list. This list will exclude the default allowed inbox package apps which are critical for the system to function, and then exclude the allowed packages that enterprises defined in the assigned access configuration. If there are multiple apps within the same package, all these apps will be excluded. This deny list will be used to prevent the user from accessing the apps which are currently available for the user but not in the allowed list. + +>[!NOTE] +>Assigned access multi-app mode doesn’t block the enterprises or the users from installing UWP apps. When a new UWP app is installed during the current assigned access user session, this app will not be in the deny list. When the user signs out and signs in back next time, it will be included in the deny list. If this is an enterprise-deployed line-of-business app and you want to allow it to run, update the assigned access configuration to include it in the allowed app list. + +Here are the predefined assigned access AppLocker rules for **desktop apps**: +1. Default rule is to allow all users to launch the desktop programs signed with Microsoft Certificate in order for the system to boot and function. The rule also allows the admin user group to launch all desktop programs. +2. There is a predefined inbox desktop app deny list for the assigned access user account, and this deny list is adjusted based on the desktop app allow list that you defined in the multi-app configuration. +3. Enterprise-defined allowed desktop apps are added in the AppLocker allow list. + +The following example allows Groove Music, Movies & TV, Photos, Weather, Calculator, Paint, and Notepad apps to run on the device. + +``` + + + + + + + + + + + +``` + +##### StartLayout + +After you define the list of allowed applications, you can customize the Start layout for your kiosk experience. You can choose to pin all the allowed apps on the Start screen or just a subset, depending on whether you want the end user to directly access them on the Start screen. + +The easiest way to create a customized Start layout to apply to other Windows 10 devices is to set up the Start screen on a test device and then export the layout. For detailed steps, see [Customize and export Start layout](customize-and-export-start-layout.md). + +A few things to note here: + +- The test device on which you customize the Start layout should have the same OS version that is installed on the device where you plan to deploy the multi-app assigned access configuration. +- Since the multi-app assigned access experience is intended for fixed-purpose devices, to ensure the device experiences are consistent and predictable, use the *full* Start layout option instead of the *partial* Start layout. +- There are no apps pinned on the taskbar in the multi-app mode, and it is not supported to configure Taskbar layout using the `` tag in a layout modification XML as part of the assigned access configuration. +- The following example uses DesktopApplicationLinkPath to pin the desktop app to start. When the desktop app doesn’t have a shortcut link on the target device, [learn how to provision .lnk files using Windows Configuration Designer](#lnk-files). + +This example pins Groove Music, Movies & TV, Photos, Weather, Calculator, Paint, and Notepad apps on Start. + +``` + + + + + + + + + + + + + + + + + + + + + + ]]> + +``` + +![What the Start screen looks like when the XML sample is applied](images/sample-start.png) + +##### Taskbar + +Define whether you want to have the taskbar present in the kiosk device. For tablet-based or touch-enabled all-in-one kiosks, when you don’t attach a keyboard and mouse, you can hide the taskbar as part of the multi-app experience if you want. + +The following example exposes the taskbar to the end user: + + `` + +The following example hides the taskbar: + + `` + +>[!NOTE] +>This is different from the **Automatically hide the taskbar** option in tablet mode, which shows the taskbar when swiping up from or moving the mouse pointer down to the bottom of the screen. Setting **ShowTaskbar** as **false** will always keep the taskbar hidden. + ### Add XML file to provisioning package @@ -54,6 +204,10 @@ Process: *There are some Mixed Reality specific bits we wanted to include. For example, the IT Admin needs to include the Mixed Reality Portal as an allowed app if they want to include Mixed Reality apps in kiosk mode.* + +##### placeholder for lnk + + ## old method (pre-1709) From 96ad864e478f59d4163b6667c7469c7336cd21fe Mon Sep 17 00:00:00 2001 From: jdeckerMS Date: Mon, 7 Aug 2017 12:55:08 -0700 Subject: [PATCH 04/37] fix level heads --- .../lock-down-windows-10-to-specific-apps.md | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/windows/configuration/lock-down-windows-10-to-specific-apps.md b/windows/configuration/lock-down-windows-10-to-specific-apps.md index a92afca98a..19996b5275 100644 --- a/windows/configuration/lock-down-windows-10-to-specific-apps.md +++ b/windows/configuration/lock-down-windows-10-to-specific-apps.md @@ -222,12 +222,12 @@ This topic describes how to lock down apps on a local device. You can also use A ![install create lockdown customize](images/lockdownapps.png) -## Install apps +### Install apps First, install the desired apps on the device for the target user account(s). This works for both Store and Win32. For Store apps, you must log on as that user for the app to install. For Win32 you can install an app for all users without logging on to the particular account. -## Use AppLocker to set rules for apps +### Use AppLocker to set rules for apps After you install the desired apps, set up AppLocker rules to only allow specific apps, and block everything else. @@ -268,7 +268,7 @@ After you install the desired apps, set up AppLocker rules to only allow specifi 13. Restart the device. -## Other settings to lock down +### Other settings to lock down In addition to specifying the apps that users can run, you should also restrict some settings and functions on the device. For a more secure experience, we recommend that you make the following configuration changes to the device: @@ -304,7 +304,7 @@ In addition to specifying the apps that users can run, you should also restrict To learn more about locking down features, see [Customizations for Windows 10 Enterprise](https://go.microsoft.com/fwlink/p/?LinkId=691442). -## Customize Start screen layout for the device (recommended) +### Customize Start screen layout for the device (recommended) Configure the Start menu on the device to only show tiles for the permitted apps. You will make the changes manually, export the layout to an .xml file, and then apply that file to devices to prevent users from making changes. For instructions, see [Manage Windows 10 Start layout options](windows-10-start-layout-options-and-policies.md). From 7c99a65fa5a3e3a692bccef679db8e81b1f786a8 Mon Sep 17 00:00:00 2001 From: jdeckerMS Date: Mon, 7 Aug 2017 12:58:09 -0700 Subject: [PATCH 05/37] sync --- .../lock-down-windows-10-to-specific-apps.md | 27 +++++++++---------- 1 file changed, 13 insertions(+), 14 deletions(-) diff --git a/windows/configuration/lock-down-windows-10-to-specific-apps.md b/windows/configuration/lock-down-windows-10-to-specific-apps.md index 19996b5275..543adcbe20 100644 --- a/windows/configuration/lock-down-windows-10-to-specific-apps.md +++ b/windows/configuration/lock-down-windows-10-to-specific-apps.md @@ -18,7 +18,7 @@ ms.localizationpriority: high - Windows 10 -A [kiosk device](set-up-a-kiosk-for-windows-10-for-desktop-editions.md) typically runs a single app, and users are prevented from accessing any features or functions on the device outside of the kiosk app. In Windows 10, version 1709, the [AssignedAccess configuration service provider (CSP)](https://docs.microsoft.com/windows/client-management/mdm/assignedaccess-csp) has been expanded to make it easy for administrators to create kiosks that run more than one app. You can configure multi-app kiosks using a provisioning package, rather than creating rules in **AppLocker**. +A [kiosk device](set-up-a-kiosk-for-windows-10-for-desktop-editions.md) typically runs a single app, and users are prevented from accessing any features or functions on the device outside of the kiosk app. In Windows 10, version 1709, the [AssignedAccess configuration service provider (CSP)](https://docs.microsoft.com/windows/client-management/mdm/assignedaccess-csp) has been expanded to make it easy for administrators to create kiosks that run more than one app. You can configure multi-app kiosks using a provisioning package. >[!NOTE] >For devices running versions of Windows 10 earlier than version 1709, you can [create AppLocker rules](#1703) to configure a multi-app kiosk. @@ -26,22 +26,21 @@ A [kiosk device](set-up-a-kiosk-for-windows-10-for-desktop-editions.md) typicall The benefit of a multi-app kiosk, or fixed-purpose device, is to provide an easy-to-understand experience for individuals by putting in front of them only the things they need to use, and removing from their view the things they don’t need to access. >[!WARNING] ->The assigned access feature is intended for corporate-owned fixed-purpose devices, like kiosks. When the multi-app assigned access configuration is applied on the device, certain policies are enforced system-wide, and will impact other users on the device. Deleting the multi-app configuration will remove the assigned access lockdown profiles associated with the users, but it cannot revert all the enforced policies (such as Start layout). A factory reset is needed to clear all the assigned access enforced policies. +>The assigned access feature is intended for corporate-owned fixed-purpose devices, like kiosks. When the multi-app assigned access configuration is applied on the device, certain policies are enforced system-wide, and will impact other users on the device. Deleting the multi-app configuration will remove the assigned access lockdown profiles associated with the users, but it cannot revert all the enforced policies (such as Start layout). A factory reset is needed to clear all the policies enforced via assigned access. -## new method (1709) Process: 1. [Create XML file](#create-xml-file) 2. [Add XML file to provisioning package](#add-xml) 3. [Apply provisioning package to device](#apply-ppkg) -### Prerequisites +## Prerequisites - (latest version of WCD -- is Store version okay at GA?) - kiosk device on 1709 -### Create XML file +## Create XML file Let's start by looking at the basic structure of the XML file. @@ -78,7 +77,7 @@ You can start your file by pasting the following XML (or any other examples in t ``` -#### Profile +### Profile A profile section in the XML has the following entries: @@ -91,11 +90,11 @@ A profile section in the XML has the following entries: - [**Taskbar**](#taskbar) -##### Id +#### Id The profile Id is a GUID attribute to uniquely identify the profile. You can create a GUID using a GUID generator. The GUID just needs to be unique within this XML file. -##### AllowedApps +#### AllowedApps AllowedApps is a list of applications that are allowed to run. Apps can be Universal Windows Platform (UWP) apps or Classic Windows desktop apps. @@ -135,7 +134,7 @@ The following example allows Groove Music, Movies & TV, Photos, Weather, Calcula ``` -##### StartLayout +#### StartLayout After you define the list of allowed applications, you can customize the Start layout for your kiosk experience. You can choose to pin all the allowed apps on the Start screen or just a subset, depending on whether you want the end user to directly access them on the Start screen. @@ -178,7 +177,7 @@ This example pins Groove Music, Movies & TV, Photos, Weather, Calculator, Paint, ![What the Start screen looks like when the XML sample is applied](images/sample-start.png) -##### Taskbar +#### Taskbar Define whether you want to have the taskbar present in the kiosk device. For tablet-based or touch-enabled all-in-one kiosks, when you don’t attach a keyboard and mouse, you can hide the taskbar as part of the multi-app experience if you want. @@ -195,17 +194,17 @@ The following example hides the taskbar: -### Add XML file to provisioning package +## Add XML file to provisioning package -### Apply provisioning package to device +## Apply provisioning package to device -### mixed-reality +## mixed-reality *There are some Mixed Reality specific bits we wanted to include. For example, the IT Admin needs to include the Mixed Reality Portal as an allowed app if they want to include Mixed Reality apps in kiosk mode.* -##### placeholder for lnk +#### placeholder for lnk From 53f8bfb3464bea8a375d85651ed9c4914dabc0f3 Mon Sep 17 00:00:00 2001 From: jdeckerMS Date: Mon, 7 Aug 2017 13:06:47 -0700 Subject: [PATCH 06/37] add xml to code sample --- .../configuration/lock-down-windows-10-to-specific-apps.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/configuration/lock-down-windows-10-to-specific-apps.md b/windows/configuration/lock-down-windows-10-to-specific-apps.md index 543adcbe20..e76ce71a80 100644 --- a/windows/configuration/lock-down-windows-10-to-specific-apps.md +++ b/windows/configuration/lock-down-windows-10-to-specific-apps.md @@ -46,7 +46,7 @@ Let's start by looking at the basic structure of the XML file. - A configuration xml can define multiple *profiles*. Each profile has a unique **Id** and defines a set of applications that are allowed to run. -- A configuration xml can have multiple *config* section. Each config section associates a non-admin user account to a default profile **Id**. +- A configuration xml can have multiple *config* sections. Each config section associates a non-admin user account to a default profile **Id**. - Multiple config sections can be associated to the same profile. @@ -56,7 +56,7 @@ Let's start by looking at the basic structure of the XML file. You can start your file by pasting the following XML (or any other examples in this topic) into a XML editor, and saving the file as *filename*.xml. -``` +```xml From 8e09327ace3db1b69e7ad133eb67f5b2cba9ae2e Mon Sep 17 00:00:00 2001 From: jdeckerMS Date: Tue, 8 Aug 2017 06:53:59 -0700 Subject: [PATCH 07/37] sync --- .../lock-down-windows-10-to-specific-apps.md | 48 +++++++++++++++---- 1 file changed, 40 insertions(+), 8 deletions(-) diff --git a/windows/configuration/lock-down-windows-10-to-specific-apps.md b/windows/configuration/lock-down-windows-10-to-specific-apps.md index e76ce71a80..c732e8f652 100644 --- a/windows/configuration/lock-down-windows-10-to-specific-apps.md +++ b/windows/configuration/lock-down-windows-10-to-specific-apps.md @@ -54,7 +54,7 @@ Let's start by looking at the basic structure of the XML file. ![profile = app and config = account](images/profile-config.png) -You can start your file by pasting the following XML (or any other examples in this topic) into a XML editor, and saving the file as *filename*.xml. +You can start your file by pasting the following XML (or any other examples in this topic) into a XML editor, and saving the file as *filename*.xml. Each section of this XML is explained in this topic. ```xml @@ -92,11 +92,17 @@ A profile section in the XML has the following entries: #### Id -The profile Id is a GUID attribute to uniquely identify the profile. You can create a GUID using a GUID generator. The GUID just needs to be unique within this XML file. +The profile **Id** is a GUID attribute to uniquely identify the profile. You can create a GUID using a GUID generator. The GUID just needs to be unique within this XML file. + +```xml + + … + +``` #### AllowedApps -AllowedApps is a list of applications that are allowed to run. Apps can be Universal Windows Platform (UWP) apps or Classic Windows desktop apps. +**AllowedApps** is a list of applications that are allowed to run. Apps can be Universal Windows Platform (UWP) apps or Classic Windows desktop apps. Based on the purpose of the kiosk device, define the list of applications that are allowed to run. This list can contain both UWP apps and desktop apps. When the mult-app kiosk configuration is applied to a device, AppLocker rules will be generated to allow the apps that are listed in the configuration. @@ -107,20 +113,22 @@ Based on the purpose of the kiosk device, define the list of applications that a - For desktop apps, you need to specify the full path of the executable, which can contain one or more system environment variables in the form of %variableName% (i.e. %systemroot%, %windir%). Here are the predefined assigned access AppLocker rules for **UWP apps**: + 1. Default rule is to allow all users to launch the signed package apps. 2. The package app deny list is generated at runtime when the assigned access user signs in. Based on the installed/provisioned package apps available for the user account, assigned access generates the deny list. This list will exclude the default allowed inbox package apps which are critical for the system to function, and then exclude the allowed packages that enterprises defined in the assigned access configuration. If there are multiple apps within the same package, all these apps will be excluded. This deny list will be used to prevent the user from accessing the apps which are currently available for the user but not in the allowed list. ->[!NOTE] ->Assigned access multi-app mode doesn’t block the enterprises or the users from installing UWP apps. When a new UWP app is installed during the current assigned access user session, this app will not be in the deny list. When the user signs out and signs in back next time, it will be included in the deny list. If this is an enterprise-deployed line-of-business app and you want to allow it to run, update the assigned access configuration to include it in the allowed app list. + >[!NOTE] + >Multi-app kiosk mode doesn’t block the enterprise or the users from installing UWP apps. When a new UWP app is installed during the current assigned access user session, this app will not be in the deny list. When the user signs out and signs in again, the app will be included in the deny list. If this is an enterprise-deployed line-of-business app and you want to allow it to run, update the assigned access configuration to include it in the allowed app list. Here are the predefined assigned access AppLocker rules for **desktop apps**: + 1. Default rule is to allow all users to launch the desktop programs signed with Microsoft Certificate in order for the system to boot and function. The rule also allows the admin user group to launch all desktop programs. 2. There is a predefined inbox desktop app deny list for the assigned access user account, and this deny list is adjusted based on the desktop app allow list that you defined in the multi-app configuration. 3. Enterprise-defined allowed desktop apps are added in the AppLocker allow list. The following example allows Groove Music, Movies & TV, Photos, Weather, Calculator, Paint, and Notepad apps to run on the device. -``` +```xml @@ -149,7 +157,7 @@ A few things to note here: This example pins Groove Music, Movies & TV, Photos, Weather, Calculator, Paint, and Notepad apps on Start. -``` +```xml @@ -192,14 +200,38 @@ The following example hides the taskbar: >[!NOTE] >This is different from the **Automatically hide the taskbar** option in tablet mode, which shows the taskbar when swiping up from or moving the mouse pointer down to the bottom of the screen. Setting **ShowTaskbar** as **false** will always keep the taskbar hidden. +### Configs + +Under **Configs**, define which user account will be associated with the profile. When this user account signs in on the device, the associated assigned access profile will be enforced, including the allowed apps, Start layout, and taskbar configuration, as well as other local group policies or MDM policies set as part of the multi-app experience. + +The full multi-app assigned access experience can only work for non-admin users. It’s not supported to associate an admin user with the assigned access profile; doing this in the XML file will result in unexpected/unsupported experiences when this admin user signs in. + +Before applying the multi-app configuration, make sure the specified user account is available on the device, otherwise it will fail. + + +```xml + + + MultiAppKioskUser + + + +``` + + + ## Add XML file to provisioning package + + ## Apply provisioning package to device -## mixed-reality + + +## Considerations for mixed-reality devices *There are some Mixed Reality specific bits we wanted to include. For example, the IT Admin needs to include the Mixed Reality Portal as an allowed app if they want to include Mixed Reality apps in kiosk mode.* From 7c6c964ce3f53611d05e560a80f7393a593dea4f Mon Sep 17 00:00:00 2001 From: jdeckerMS Date: Tue, 8 Aug 2017 09:00:36 -0700 Subject: [PATCH 08/37] modify toc --- windows/configuration/TOC.md | 2 + ...change-history-for-configure-windows-10.md | 1 + windows/configuration/kiosk-shared-pc.md | 2 +- .../lock-down-windows-10-applocker.md | 119 ++++++ .../lock-down-windows-10-to-specific-apps.md | 114 +----- windows/configuration/lock-down-windows-10.md | 15 - windows/configuration/multi-app-kiosk-xml.md | 364 ++++++++++++++++++ 7 files changed, 502 insertions(+), 115 deletions(-) create mode 100644 windows/configuration/lock-down-windows-10-applocker.md delete mode 100644 windows/configuration/lock-down-windows-10.md create mode 100644 windows/configuration/multi-app-kiosk-xml.md diff --git a/windows/configuration/TOC.md b/windows/configuration/TOC.md index 876c4c17b2..4166b7475b 100644 --- a/windows/configuration/TOC.md +++ b/windows/configuration/TOC.md @@ -9,6 +9,8 @@ ### [Set up a kiosk on Windows 10 Pro, Enterprise, or Education](set-up-a-kiosk-for-windows-10-for-desktop-editions.md) ### [Guidelines for choosing an app for assigned access (kiosk mode)](guidelines-for-assigned-access-app.md) ### [Create a Windows 10 kiosk that runs multiple apps](lock-down-windows-10-to-specific-apps.md) +#### [Use AppLocker to create a Windows 10 kiosk that runs multiple apps](lock-down-windows-10-applocker.md) +#### [Multi-app kiosk XML reference](multi-app-kiosk-xml.md) ## [Configure Windows 10 Mobile devices](mobile-devices/configure-mobile.md) ### [Set up a kiosk on Windows 10 Mobile or Windows 10 Mobile Enterprise](mobile-devices/set-up-a-kiosk-for-windows-10-for-mobile-edition.md) ### [Use Windows Configuration Designer to configure Windows 10 Mobile devices](mobile-devices/provisioning-configure-mobile.md) diff --git a/windows/configuration/change-history-for-configure-windows-10.md b/windows/configuration/change-history-for-configure-windows-10.md index 2a495b4f5a..6e279b9adc 100644 --- a/windows/configuration/change-history-for-configure-windows-10.md +++ b/windows/configuration/change-history-for-configure-windows-10.md @@ -19,6 +19,7 @@ This topic lists new and updated topics in the [Configure Windows 10](index.md) The topics in this library have been updated for Windows 10, version 1709 (also known as the Fall Creators Update). The following new topics have been added: - [Create a Windows 10 kiosk that runs multiple apps](lock-down-windows-10-to-specific-apps.md) +- [Multi-app kiosk XML reference](multi-app-kiosk-xml.md) ## July 2017 | New or changed topic | Description | diff --git a/windows/configuration/kiosk-shared-pc.md b/windows/configuration/kiosk-shared-pc.md index 21d8d0d394..420e550a78 100644 --- a/windows/configuration/kiosk-shared-pc.md +++ b/windows/configuration/kiosk-shared-pc.md @@ -20,4 +20,4 @@ Some desktop devices in an enterprise serve a special purpose, such as a common | [Set up a shared or guest PC with Windows 10](set-up-shared-or-guest-pc.md) | Windows 10, version 1607, introduced *shared PC mode*, which optimizes Windows 10 for shared use scenarios, such as touchdown spaces in an enterprise and temporary customer use in retail. | | [Set up a kiosk on Windows 10 Pro, Enterprise, or Education](set-up-a-kiosk-for-windows-10-for-desktop-editions.md) | You can configure a device running Windows 10 Pro, Windows 10 Enterprise, or Windows 10 Education as a kiosk device, so that users can only interact with a single application that you select. | | [Guidelines for choosing an app for assigned access (kiosk mode)](guidelines-for-assigned-access-app.md) | You can choose almost any Windows app for assigned access; however, some apps may not provide a good user experience. This topic provides guidelines to help you choose an approprate app for a kiosk device. | -| [Lock down Windows 10 to specific apps (AppLocker)](lock-down-windows-10-to-specific-apps.md) | Learn how to configure a device running Windows 10 Enterprise or Windows 10 Education so that users can only run a few specific apps. The result is similar to a kiosk device, but with multiple apps available. For example, you might set up a library computer so that users can search the catalog and browse the Internet, but can't run any other apps or change computer settings. | \ No newline at end of file +| [Create a Windows 10 kiosk that runs multiple apps](lock-down-windows-10-to-specific-apps.md) | Learn how to configure a device running Windows 10 Enterprise or Windows 10 Education so that users can only run a few specific apps. The result is similar to a kiosk device, but with multiple apps available. For example, you might set up a library computer so that users can search the catalog and browse the Internet, but can't run any other apps or change computer settings. | \ No newline at end of file diff --git a/windows/configuration/lock-down-windows-10-applocker.md b/windows/configuration/lock-down-windows-10-applocker.md new file mode 100644 index 0000000000..398e2d77e9 --- /dev/null +++ b/windows/configuration/lock-down-windows-10-applocker.md @@ -0,0 +1,119 @@ +--- +title: Use AppLocker to create a Windows 10 kiosk that runs multiple apps (Windows 10) +description: Learn how to use AppLocker to configure a kiosk device running Windows 10 Enterprise or Windows 10 Education so that users can only run a few specific apps. +ms.assetid: 14DDDC96-88C7-4181-8415-B371F25726C8 +keywords: ["lockdown", "app restrictions", "applocker"] +ms.prod: w10 +ms.mktglfcycl: manage +ms.sitesec: library +ms.pagetype: edu, security +author: jdeckerms +ms.localizationpriority: high +--- + +# Use AppLocker to create a Windows 10 kiosk that runs multiple apps + + +**Applies to** + +- Windows 10 + +Learn how to configure a device running Windows 10 Enterprise or Windows 10 Education, version 1703 and earlier, so that users can only run a few specific apps. The result is similar to [a kiosk device](set-up-a-device-for-anyone-to-use.md), but with multiple apps available. For example, you might set up a library computer so that users can search the catalog and browse the Internet, but can't run any other apps or change computer settings. + +>[!NOTE] +>For devices running Windows 10, version 1709, we recommend the [multi-app kiosk method](lock-down-windows-10-to-specific-apps.md). + +You can restrict users to a specific set of apps on a device running Windows 10 Enterprise or Windows 10 Education by using [AppLocker](/windows/device-security/applocker/applocker-overview). AppLocker rules specify which apps are allowed to run on the device. + +AppLocker rules are organized into collections based on file format. If no AppLocker rules for a specific rule collection exist, all files with that file format are allowed to run. However, when an AppLocker rule for a specific rule collection is created, only the files explicitly allowed in a rule are permitted to run. For more information, see [How AppLocker works](/windows/device-security/applocker/how-applocker-works-techref). + +This topic describes how to lock down apps on a local device. You can also use AppLocker to set rules for applications in a domain by using Group Policy. + +![install create lockdown customize](images/lockdownapps.png) + +## Install apps + + +First, install the desired apps on the device for the target user account(s). This works for both Store and Win32. For Store apps, you must log on as that user for the app to install. For Win32 you can install an app for all users without logging on to the particular account. + +## Use AppLocker to set rules for apps + + +After you install the desired apps, set up AppLocker rules to only allow specific apps, and block everything else. + +1. Run Local Security Policy (secpol.msc) as an administrator. + +2. Go to **Security Settings** > **Application Control Policies** > **AppLocker**, and select **Configure rule enforcement**. + + ![configure rule enforcement](images/apprule.png) + +3. Check **Configured** under **Executable rules**, and then click **OK**. + +4. Right-click **Executable Rules** and then click **Automatically generate rules**. + + ![automatically generate rules](images/genrule.png) + +5. Select the folder that contains the apps that you want to permit, or select C:\\ to analyze all apps. + +6. Type a name to identify this set of rules, and then click **Next**. + +7. On the **Rule Preferences** page, click **Next**. Be patient, it might take awhile to generate the rules. + +8. On the **Review Rules** page, click **Create**. The wizard will now create a set of rules allowing the installed set of apps. + +9. Read the message and click **Yes**. + + ![default rules warning](images/appwarning.png) + +10. (optional) If you want a rule to apply to a specific set of users, right-click on the rule and select **Properties**. Then use the dialog to choose a different user or group of users. + +11. (optional) If rules were generated for apps that should not be run, you can delete them by right-clicking on the rule and selecting **Delete**. + +12. Before AppLocker will enforce rules, the **Application Identity** service must be turned on. To force the Application Identity service to automatically start on reset, open a command prompt and run: + + ``` syntax + sc config appidsvc start=auto + ``` + +13. Restart the device. + +## Other settings to lock down + + +In addition to specifying the apps that users can run, you should also restrict some settings and functions on the device. For a more secure experience, we recommend that you make the following configuration changes to the device: + +- Remove **All apps**. + + Go to **Group Policy Editor** > **User Configuration** > **Administrative Templates\\Start Menu and Taskbar\\Remove All Programs list from the Start menu**. + +- Hide **Ease of access** feature on the logon screen. + + Go to **Control Panel** > **Ease of Access** > **Ease of Access Center**, and turn off all accessibility tools. + +- Disable the hardware power button. + + Go to **Power Options** > **Choose what the power button does**, change the setting to **Do nothing**, and then **Save changes**. + +- Disable the camera. + + Go to **Settings** > **Privacy** > **Camera**, and turn off **Let apps use my camera**. + +- Turn off app notifications on the lock screen. + + Go to **Group Policy Editor** > **Computer Configuration** > **Administrative Templates\\System\\Logon\\Turn off app notifications on the lock screen**. + +- Disable removable media. + + Go to **Group Policy Editor** > **Computer Configuration** > **Administrative Templates\\System\\Device Installation\\Device Installation Restrictions**. Review the policy settings available in **Device Installation Restrictions** for the settings applicable to your situation. + + **Note**   + To prevent this policy from affecting a member of the Administrators group, in **Device Installation Restrictions**, enable **Allow administrators to override Device Installation Restriction policies**. + +   + +To learn more about locking down features, see [Customizations for Windows 10 Enterprise](https://go.microsoft.com/fwlink/p/?LinkId=691442). + +## Customize Start screen layout for the device (recommended) + + +Configure the Start menu on the device to only show tiles for the permitted apps. You will make the changes manually, export the layout to an .xml file, and then apply that file to devices to prevent users from making changes. For instructions, see [Manage Windows 10 Start layout options](windows-10-start-layout-options-and-policies.md). \ No newline at end of file diff --git a/windows/configuration/lock-down-windows-10-to-specific-apps.md b/windows/configuration/lock-down-windows-10-to-specific-apps.md index c732e8f652..bb01d18c03 100644 --- a/windows/configuration/lock-down-windows-10-to-specific-apps.md +++ b/windows/configuration/lock-down-windows-10-to-specific-apps.md @@ -21,7 +21,7 @@ ms.localizationpriority: high A [kiosk device](set-up-a-kiosk-for-windows-10-for-desktop-editions.md) typically runs a single app, and users are prevented from accessing any features or functions on the device outside of the kiosk app. In Windows 10, version 1709, the [AssignedAccess configuration service provider (CSP)](https://docs.microsoft.com/windows/client-management/mdm/assignedaccess-csp) has been expanded to make it easy for administrators to create kiosks that run more than one app. You can configure multi-app kiosks using a provisioning package. >[!NOTE] ->For devices running versions of Windows 10 earlier than version 1709, you can [create AppLocker rules](#1703) to configure a multi-app kiosk. +>For devices running versions of Windows 10 earlier than version 1709, you can [create AppLocker rules](lock-down-windows-10-applocker.md) to configure a multi-app kiosk. The benefit of a multi-app kiosk, or fixed-purpose device, is to provide an easy-to-understand experience for individuals by putting in front of them only the things they need to use, and removing from their view the things they don’t need to access. @@ -206,7 +206,21 @@ Under **Configs**, define which user account will be associated with the profile The full multi-app assigned access experience can only work for non-admin users. It’s not supported to associate an admin user with the assigned access profile; doing this in the XML file will result in unexpected/unsupported experiences when this admin user signs in. + + +The account can be local, domain, or Azure Active Directory (Azure AD). Groups are not supported. +• Local account can be entered as `machinename\account` or `.\account` or just `account`. +• Domain account should be entered as `domain\account`. +• Azure AD account must be specified in this format: `AzureAD\{email address}`. **AzureAD** must be provided AS IS (consider it’s a fixed domain name), then follow with the Azure AD email address, e.g. **AzureAD\someone@contoso.onmicrosoft.com**. + +>[!WARNING] +>Although **Start** > **Settings** > **Accounts** > **Other users** > **Set up assigned access** only supports specifying a local user account, Assigned Access can be configured via WMI or CSP to run its applications under a domain user or service account, rather than a local account. However, use of domain user or service accounts introduces risks that an attacker subverting the Assigned Access application might gain access to sensitive domain resources that have been inadvertently left accessible to any domain account. We recommend that customers proceed with caution when using domain accounts with Assigned Access, and consider the domain resources potentially exposed by the decision to do so. + + Before applying the multi-app configuration, make sure the specified user account is available on the device, otherwise it will fail. + +>[!NOTE] +>For both domain and Azure AD accounts, it’s not required that target account is explicitly added to the device. As long as the device is AD-joined or Azure AD-joined, the account can be discovered in the domain forest or tenant that the device is joined to. For local accounts, it is required that the account exist before you configure the account for AssignedAccess. ```xml @@ -220,7 +234,6 @@ Before applying the multi-app configuration, make sure the specified user accoun - ## Add XML file to provisioning package @@ -240,105 +253,8 @@ Before applying the multi-app configuration, make sure the specified user accoun - -## old method (pre-1709) - -Learn how to configure a device running Windows 10 Enterprise or Windows 10 Education so that users can only run a few specific apps. The result is similar to [a kiosk device](set-up-a-device-for-anyone-to-use.md), but with multiple apps available. For example, you might set up a library computer so that users can search the catalog and browse the Internet, but can't run any other apps or change computer settings. - -You can restrict users to a specific set of apps on a device running Windows 10 Enterprise or Windows 10 Education by using [AppLocker](/windows/device-security/applocker/applocker-overview). AppLocker rules specify which apps are allowed to run on the device. - -AppLocker rules are organized into collections based on file format. If no AppLocker rules for a specific rule collection exist, all files with that file format are allowed to run. However, when an AppLocker rule for a specific rule collection is created, only the files explicitly allowed in a rule are permitted to run. For more information, see [How AppLocker works](/windows/device-security/applocker/how-applocker-works-techref). - -This topic describes how to lock down apps on a local device. You can also use AppLocker to set rules for applications in a domain by using Group Policy. - -![install create lockdown customize](images/lockdownapps.png) - -### Install apps -First, install the desired apps on the device for the target user account(s). This works for both Store and Win32. For Store apps, you must log on as that user for the app to install. For Win32 you can install an app for all users without logging on to the particular account. - -### Use AppLocker to set rules for apps - - -After you install the desired apps, set up AppLocker rules to only allow specific apps, and block everything else. - -1. Run Local Security Policy (secpol.msc) as an administrator. - -2. Go to **Security Settings** > **Application Control Policies** > **AppLocker**, and select **Configure rule enforcement**. - - ![configure rule enforcement](images/apprule.png) - -3. Check **Configured** under **Executable rules**, and then click **OK**. - -4. Right-click **Executable Rules** and then click **Automatically generate rules**. - - ![automatically generate rules](images/genrule.png) - -5. Select the folder that contains the apps that you want to permit, or select C:\\ to analyze all apps. - -6. Type a name to identify this set of rules, and then click **Next**. - -7. On the **Rule Preferences** page, click **Next**. Be patient, it might take awhile to generate the rules. - -8. On the **Review Rules** page, click **Create**. The wizard will now create a set of rules allowing the installed set of apps. - -9. Read the message and click **Yes**. - - ![default rules warning](images/appwarning.png) - -10. (optional) If you want a rule to apply to a specific set of users, right-click on the rule and select **Properties**. Then use the dialog to choose a different user or group of users. - -11. (optional) If rules were generated for apps that should not be run, you can delete them by right-clicking on the rule and selecting **Delete**. - -12. Before AppLocker will enforce rules, the **Application Identity** service must be turned on. To force the Application Identity service to automatically start on reset, open a command prompt and run: - - ``` syntax - sc config appidsvc start=auto - ``` - -13. Restart the device. - -### Other settings to lock down - - -In addition to specifying the apps that users can run, you should also restrict some settings and functions on the device. For a more secure experience, we recommend that you make the following configuration changes to the device: - -- Remove **All apps**. - - Go to **Group Policy Editor** > **User Configuration** > **Administrative Templates\\Start Menu and Taskbar\\Remove All Programs list from the Start menu**. - -- Hide **Ease of access** feature on the logon screen. - - Go to **Control Panel** > **Ease of Access** > **Ease of Access Center**, and turn off all accessibility tools. - -- Disable the hardware power button. - - Go to **Power Options** > **Choose what the power button does**, change the setting to **Do nothing**, and then **Save changes**. - -- Disable the camera. - - Go to **Settings** > **Privacy** > **Camera**, and turn off **Let apps use my camera**. - -- Turn off app notifications on the lock screen. - - Go to **Group Policy Editor** > **Computer Configuration** > **Administrative Templates\\System\\Logon\\Turn off app notifications on the lock screen**. - -- Disable removable media. - - Go to **Group Policy Editor** > **Computer Configuration** > **Administrative Templates\\System\\Device Installation\\Device Installation Restrictions**. Review the policy settings available in **Device Installation Restrictions** for the settings applicable to your situation. - - **Note**   - To prevent this policy from affecting a member of the Administrators group, in **Device Installation Restrictions**, enable **Allow administrators to override Device Installation Restriction policies**. - -   - -To learn more about locking down features, see [Customizations for Windows 10 Enterprise](https://go.microsoft.com/fwlink/p/?LinkId=691442). - -### Customize Start screen layout for the device (recommended) - - -Configure the Start menu on the device to only show tiles for the permitted apps. You will make the changes manually, export the layout to an .xml file, and then apply that file to devices to prevent users from making changes. For instructions, see [Manage Windows 10 Start layout options](windows-10-start-layout-options-and-policies.md).   diff --git a/windows/configuration/lock-down-windows-10.md b/windows/configuration/lock-down-windows-10.md deleted file mode 100644 index 0bcecb6b1a..0000000000 --- a/windows/configuration/lock-down-windows-10.md +++ /dev/null @@ -1,15 +0,0 @@ ---- -title: Lock down Windows 10 (Windows 10) -description: Windows 10 provides a number of features and methods to help you lock down specific parts of a Windows 10 device. -ms.assetid: 955BCD92-0A1A-4C48-98A8-30D7FAF2067D -keywords: lockdown -ms.prod: w10 -ms.mktglfcycl: manage -ms.sitesec: library -ms.pagetype: security, mobile -author: jdeckerms -ms.localizationpriority: high ---- - -# Lock down Windows 10 - diff --git a/windows/configuration/multi-app-kiosk-xml.md b/windows/configuration/multi-app-kiosk-xml.md new file mode 100644 index 0000000000..a532786d85 --- /dev/null +++ b/windows/configuration/multi-app-kiosk-xml.md @@ -0,0 +1,364 @@ +--- +title: Create a Windows 10 kiosk that runs multiple apps (Windows 10) +description: Learn how to configure a kiosk device running Windows 10 Enterprise or Windows 10 Education so that users can only run a few specific apps. +ms.assetid: 14DDDC96-88C7-4181-8415-B371F25726C8 +keywords: ["lockdown", "app restrictions", "applocker"] +ms.prod: w10 +ms.mktglfcycl: manage +ms.sitesec: library +ms.pagetype: edu, security +author: jdeckerms +ms.localizationpriority: high +--- + +# Create a Windows 10 kiosk that runs multiple apps + + +**Applies to** + +- Windows 10 + +A [kiosk device](set-up-a-kiosk-for-windows-10-for-desktop-editions.md) typically runs a single app, and users are prevented from accessing any features or functions on the device outside of the kiosk app. In Windows 10, version 1709, the [AssignedAccess configuration service provider (CSP)](https://docs.microsoft.com/windows/client-management/mdm/assignedaccess-csp) has been expanded to make it easy for administrators to create kiosks that run more than one app. You can configure multi-app kiosks using a provisioning package. + +>[!NOTE] +>For devices running versions of Windows 10 earlier than version 1709, you can [create AppLocker rules](#1703) to configure a multi-app kiosk. + +The benefit of a multi-app kiosk, or fixed-purpose device, is to provide an easy-to-understand experience for individuals by putting in front of them only the things they need to use, and removing from their view the things they don’t need to access. + +>[!WARNING] +>The assigned access feature is intended for corporate-owned fixed-purpose devices, like kiosks. When the multi-app assigned access configuration is applied on the device, certain policies are enforced system-wide, and will impact other users on the device. Deleting the multi-app configuration will remove the assigned access lockdown profiles associated with the users, but it cannot revert all the enforced policies (such as Start layout). A factory reset is needed to clear all the policies enforced via assigned access. + + +Process: +1. [Create XML file](#create-xml-file) +2. [Add XML file to provisioning package](#add-xml) +3. [Apply provisioning package to device](#apply-ppkg) + +## Prerequisites + +- (latest version of WCD -- is Store version okay at GA?) +- kiosk device on 1709 + + +## Create XML file + +Let's start by looking at the basic structure of the XML file. + +- A configuration xml can define multiple *profiles*. Each profile has a unique **Id** and defines a set of applications that are allowed to run. + +- A configuration xml can have multiple *config* sections. Each config section associates a non-admin user account to a default profile **Id**. + +- Multiple config sections can be associated to the same profile. + +- A profile has no effect if it’s not associated to a config section. + + ![profile = app and config = account](images/profile-config.png) + +You can start your file by pasting the following XML (or any other examples in this topic) into a XML editor, and saving the file as *filename*.xml. Each section of this XML is explained in this topic. + +```xml + + + + + + + + + + + + + + + + + + +``` + +### Profile + +A profile section in the XML has the following entries: + +- [**Id**](#id) + +- [**AllowedApps**](#allowedapps) + +- [**StartLayout**](#startlayout) + +- [**Taskbar**](#taskbar) + + +#### Id + +The profile **Id** is a GUID attribute to uniquely identify the profile. You can create a GUID using a GUID generator. The GUID just needs to be unique within this XML file. + +```xml + + … + +``` + +#### AllowedApps + +**AllowedApps** is a list of applications that are allowed to run. Apps can be Universal Windows Platform (UWP) apps or Classic Windows desktop apps. + +Based on the purpose of the kiosk device, define the list of applications that are allowed to run. This list can contain both UWP apps and desktop apps. When the mult-app kiosk configuration is applied to a device, AppLocker rules will be generated to allow the apps that are listed in the configuration. + +>[!NOTE] +>You cannot manage AppLocker rules that are generated by the multi-app kiosk configuration in [MMC snap-ins](https://technet.microsoft.com/library/hh994629.aspx#BKMK_Using_Snapins). + +- For UWP apps, you need to provide the App User Model ID (AUMID). [Learn how to get the AUMID](https://go.microsoft.com/fwlink/p/?LinkId=614867), or [get the AUMID from the Start Layout XML](#startlayout). +- For desktop apps, you need to specify the full path of the executable, which can contain one or more system environment variables in the form of %variableName% (i.e. %systemroot%, %windir%). + +Here are the predefined assigned access AppLocker rules for **UWP apps**: + +1. Default rule is to allow all users to launch the signed package apps. +2. The package app deny list is generated at runtime when the assigned access user signs in. Based on the installed/provisioned package apps available for the user account, assigned access generates the deny list. This list will exclude the default allowed inbox package apps which are critical for the system to function, and then exclude the allowed packages that enterprises defined in the assigned access configuration. If there are multiple apps within the same package, all these apps will be excluded. This deny list will be used to prevent the user from accessing the apps which are currently available for the user but not in the allowed list. + + >[!NOTE] + >Multi-app kiosk mode doesn’t block the enterprise or the users from installing UWP apps. When a new UWP app is installed during the current assigned access user session, this app will not be in the deny list. When the user signs out and signs in again, the app will be included in the deny list. If this is an enterprise-deployed line-of-business app and you want to allow it to run, update the assigned access configuration to include it in the allowed app list. + +Here are the predefined assigned access AppLocker rules for **desktop apps**: + +1. Default rule is to allow all users to launch the desktop programs signed with Microsoft Certificate in order for the system to boot and function. The rule also allows the admin user group to launch all desktop programs. +2. There is a predefined inbox desktop app deny list for the assigned access user account, and this deny list is adjusted based on the desktop app allow list that you defined in the multi-app configuration. +3. Enterprise-defined allowed desktop apps are added in the AppLocker allow list. + +The following example allows Groove Music, Movies & TV, Photos, Weather, Calculator, Paint, and Notepad apps to run on the device. + +```xml + + + + + + + + + + + +``` + +#### StartLayout + +After you define the list of allowed applications, you can customize the Start layout for your kiosk experience. You can choose to pin all the allowed apps on the Start screen or just a subset, depending on whether you want the end user to directly access them on the Start screen. + +The easiest way to create a customized Start layout to apply to other Windows 10 devices is to set up the Start screen on a test device and then export the layout. For detailed steps, see [Customize and export Start layout](customize-and-export-start-layout.md). + +A few things to note here: + +- The test device on which you customize the Start layout should have the same OS version that is installed on the device where you plan to deploy the multi-app assigned access configuration. +- Since the multi-app assigned access experience is intended for fixed-purpose devices, to ensure the device experiences are consistent and predictable, use the *full* Start layout option instead of the *partial* Start layout. +- There are no apps pinned on the taskbar in the multi-app mode, and it is not supported to configure Taskbar layout using the `` tag in a layout modification XML as part of the assigned access configuration. +- The following example uses DesktopApplicationLinkPath to pin the desktop app to start. When the desktop app doesn’t have a shortcut link on the target device, [learn how to provision .lnk files using Windows Configuration Designer](#lnk-files). + +This example pins Groove Music, Movies & TV, Photos, Weather, Calculator, Paint, and Notepad apps on Start. + +```xml + + + + + + + + + + + + + + + + + + + + + + ]]> + +``` + +![What the Start screen looks like when the XML sample is applied](images/sample-start.png) + +#### Taskbar + +Define whether you want to have the taskbar present in the kiosk device. For tablet-based or touch-enabled all-in-one kiosks, when you don’t attach a keyboard and mouse, you can hide the taskbar as part of the multi-app experience if you want. + +The following example exposes the taskbar to the end user: + + `` + +The following example hides the taskbar: + + `` + +>[!NOTE] +>This is different from the **Automatically hide the taskbar** option in tablet mode, which shows the taskbar when swiping up from or moving the mouse pointer down to the bottom of the screen. Setting **ShowTaskbar** as **false** will always keep the taskbar hidden. + +### Configs + +Under **Configs**, define which user account will be associated with the profile. When this user account signs in on the device, the associated assigned access profile will be enforced, including the allowed apps, Start layout, and taskbar configuration, as well as other local group policies or MDM policies set as part of the multi-app experience. + +The full multi-app assigned access experience can only work for non-admin users. It’s not supported to associate an admin user with the assigned access profile; doing this in the XML file will result in unexpected/unsupported experiences when this admin user signs in. + + + +The account can be local, domain, or Azure Active Directory (Azure AD). Groups are not supported. +• Local account can be entered as `machinename\account` or `.\account` or just `account`. +• Domain account should be entered as `domain\account`. +• Azure AD account must be specified in this format: `AzureAD\{email address}`. **AzureAD** must be provided AS IS (consider it’s a fixed domain name), then follow with the Azure AD email address, e.g. **AzureAD\someone@contoso.onmicrosoft.com**. + +>[!WARNING] +>Although **Start** > **Settings** > **Accounts** > **Other users** > **Set up assigned access** only supports specifying a local user account, Assigned Access can be configured via WMI or CSP to run its applications under a domain user or service account, rather than a local account. However, use of domain user or service accounts introduces risks that an attacker subverting the Assigned Access application might gain access to sensitive domain resources that have been inadvertently left accessible to any domain account. We recommend that customers proceed with caution when using domain accounts with Assigned Access, and consider the domain resources potentially exposed by the decision to do so. + + +Before applying the multi-app configuration, make sure the specified user account is available on the device, otherwise it will fail. + +>[!NOTE] +>For both domain and Azure AD accounts, it’s not required that target account is explicitly added to the device. As long as the device is AD-joined or Azure AD-joined, the account can be discovered in the domain forest or tenant that the device is joined to. For local accounts, it is required that the account exist before you configure the account for AssignedAccess. + + +```xml + + + MultiAppKioskUser + + + +``` + + + + +## Add XML file to provisioning package + + + + +## Apply provisioning package to device + + + +## Considerations for mixed-reality devices + +*There are some Mixed Reality specific bits we wanted to include. For example, the IT Admin needs to include the Mixed Reality Portal as an allowed app if they want to include Mixed Reality apps in kiosk mode.* + + +#### placeholder for lnk + + + + +## old method (pre-1709) + +Learn how to configure a device running Windows 10 Enterprise or Windows 10 Education so that users can only run a few specific apps. The result is similar to [a kiosk device](set-up-a-device-for-anyone-to-use.md), but with multiple apps available. For example, you might set up a library computer so that users can search the catalog and browse the Internet, but can't run any other apps or change computer settings. + +You can restrict users to a specific set of apps on a device running Windows 10 Enterprise or Windows 10 Education by using [AppLocker](/windows/device-security/applocker/applocker-overview). AppLocker rules specify which apps are allowed to run on the device. + +AppLocker rules are organized into collections based on file format. If no AppLocker rules for a specific rule collection exist, all files with that file format are allowed to run. However, when an AppLocker rule for a specific rule collection is created, only the files explicitly allowed in a rule are permitted to run. For more information, see [How AppLocker works](/windows/device-security/applocker/how-applocker-works-techref). + +This topic describes how to lock down apps on a local device. You can also use AppLocker to set rules for applications in a domain by using Group Policy. + +![install create lockdown customize](images/lockdownapps.png) + +### Install apps + + +First, install the desired apps on the device for the target user account(s). This works for both Store and Win32. For Store apps, you must log on as that user for the app to install. For Win32 you can install an app for all users without logging on to the particular account. + +### Use AppLocker to set rules for apps + + +After you install the desired apps, set up AppLocker rules to only allow specific apps, and block everything else. + +1. Run Local Security Policy (secpol.msc) as an administrator. + +2. Go to **Security Settings** > **Application Control Policies** > **AppLocker**, and select **Configure rule enforcement**. + + ![configure rule enforcement](images/apprule.png) + +3. Check **Configured** under **Executable rules**, and then click **OK**. + +4. Right-click **Executable Rules** and then click **Automatically generate rules**. + + ![automatically generate rules](images/genrule.png) + +5. Select the folder that contains the apps that you want to permit, or select C:\\ to analyze all apps. + +6. Type a name to identify this set of rules, and then click **Next**. + +7. On the **Rule Preferences** page, click **Next**. Be patient, it might take awhile to generate the rules. + +8. On the **Review Rules** page, click **Create**. The wizard will now create a set of rules allowing the installed set of apps. + +9. Read the message and click **Yes**. + + ![default rules warning](images/appwarning.png) + +10. (optional) If you want a rule to apply to a specific set of users, right-click on the rule and select **Properties**. Then use the dialog to choose a different user or group of users. + +11. (optional) If rules were generated for apps that should not be run, you can delete them by right-clicking on the rule and selecting **Delete**. + +12. Before AppLocker will enforce rules, the **Application Identity** service must be turned on. To force the Application Identity service to automatically start on reset, open a command prompt and run: + + ``` syntax + sc config appidsvc start=auto + ``` + +13. Restart the device. + +### Other settings to lock down + + +In addition to specifying the apps that users can run, you should also restrict some settings and functions on the device. For a more secure experience, we recommend that you make the following configuration changes to the device: + +- Remove **All apps**. + + Go to **Group Policy Editor** > **User Configuration** > **Administrative Templates\\Start Menu and Taskbar\\Remove All Programs list from the Start menu**. + +- Hide **Ease of access** feature on the logon screen. + + Go to **Control Panel** > **Ease of Access** > **Ease of Access Center**, and turn off all accessibility tools. + +- Disable the hardware power button. + + Go to **Power Options** > **Choose what the power button does**, change the setting to **Do nothing**, and then **Save changes**. + +- Disable the camera. + + Go to **Settings** > **Privacy** > **Camera**, and turn off **Let apps use my camera**. + +- Turn off app notifications on the lock screen. + + Go to **Group Policy Editor** > **Computer Configuration** > **Administrative Templates\\System\\Logon\\Turn off app notifications on the lock screen**. + +- Disable removable media. + + Go to **Group Policy Editor** > **Computer Configuration** > **Administrative Templates\\System\\Device Installation\\Device Installation Restrictions**. Review the policy settings available in **Device Installation Restrictions** for the settings applicable to your situation. + + **Note**   + To prevent this policy from affecting a member of the Administrators group, in **Device Installation Restrictions**, enable **Allow administrators to override Device Installation Restriction policies**. + +   + +To learn more about locking down features, see [Customizations for Windows 10 Enterprise](https://go.microsoft.com/fwlink/p/?LinkId=691442). + +### Customize Start screen layout for the device (recommended) + + +Configure the Start menu on the device to only show tiles for the permitted apps. You will make the changes manually, export the layout to an .xml file, and then apply that file to devices to prevent users from making changes. For instructions, see [Manage Windows 10 Start layout options](windows-10-start-layout-options-and-policies.md). + + +  + +  + + + + + From b2ee56a3681b00531d4939ccff35d672c2fdfa48 Mon Sep 17 00:00:00 2001 From: jdeckerMS Date: Tue, 8 Aug 2017 10:01:44 -0700 Subject: [PATCH 09/37] sync --- .../images/multiappassignedaccesssettings.png | Bin 0 -> 5081 bytes .../lock-down-windows-10-to-specific-apps.md | 62 +++ windows/configuration/multi-app-kiosk-xml.md | 421 +++++------------- 3 files changed, 177 insertions(+), 306 deletions(-) create mode 100644 windows/configuration/images/multiappassignedaccesssettings.png diff --git a/windows/configuration/images/multiappassignedaccesssettings.png b/windows/configuration/images/multiappassignedaccesssettings.png new file mode 100644 index 0000000000000000000000000000000000000000..86e2e0a451e756326fa5d8891cb4e8d50c361f20 GIT binary patch literal 5081 zcmbW5XHb({x5tA@5fnuZdISUkArL@Ba_B{BLKg@qB~qjX2oS1-&_o46i1c0zN(oI` zkd8`|-diY&n1qh>P;Wf<(>wFd+?o5~+5f%Pv)7uvo@eiw-`=ku8bB^Hb20+}fXmuY z4PyX+u9Mb>F)`5E{ea^Yn$US0L(~9e{oG45pM% z$9wI<;yVtnUWy%5a$GXMYW;#ES&x?){wBcOkC&w1RVcxAkL4eJAD-Ua7y8Q-)8hS+$n8Y>8YB zM^ur)o6=&j%MNEfSf3uZ4KTXll-~lobjTb64^RuSp>rh(`v&#>1OFC z_8DvCDB{0~kQP3F`*qA~0fkYIU~~lQl|~%zv}5RbpVQi#^(ViTtD0h#peGHTUpFQw z{dDdd>W+*kI7Lvrjd@<`@CR_)H$k{_)jgR!W1Tgh z4k${SD?8&9R}4}IUa6PZ=Srtq`rx6_OLyfFgogG~U^!*;G-&5r*g<6t*Q8(h*!<-7 z@BO9fsl0>lLG=e=RMu7oilw=^xy*bJ10!Q!t?-?(-9)npDL2ghN{hVD$F`!(Y&&vN zu8s+iGxD+bVmjFevUbDocckGZOKYi?5S0^Z9-X%yg!9pH;mZLf10T(pYr8$S^Ewtr zW??+R`t5<`JBWAWoA&k;UZ8yDMU{egz2`TE$Vb-09CiNAZ8`a;&n*W$)4uF_b&tF+ zS+4A|K!} z?t%9h_wa0=@K=^L=*)=5qg5r%1J~fCrx83EC#r!=syCG}b~Rl49-pjVf`c+fJKS$6 z5v7AjqZLR(=^=k%%S0KSL7IXa5kIplgI538GvY^-KHC4}>xU}$KkPs|4&G3eqlaG) z%F*JQHw@PuKjAve4F~~FU7?5-7Z;N7*hmS{;uaQP4r5PQM^`r7K zmt-JqAG1g9w_Kg87`T$E&L;d6{n?;5Gf-jPa9)<7`0>#dj+{o<*@T{In;7&M3!(tN zH~jEKocyI9`Qjc++gx?uu7IdbAMLPswQ!dK_#yYr%7(-F-0$d&Y_6h@wZjg+BJtZ_(=zncRO{t(P`{LOcmkCVMDGInjNDv;}iL8>ob=T9rpH z&yXD80iO+!0|Vi%Cp$*8g$K)6#~GG*O+n$u(vr|1L)Hd1vx1?b$_H(X!VUAwbCE!jtZ(>%*;R)_FFk_Oc4nGbgxz&rmaZ3B{gIa*2YA63G>m*Q@5&-2nCN; zfoK$tK}oT-;VNhwz+!zwGQC0!YW+oRBYcLP%sxK}EgQtic7M6FzBoTAG2IXwx0JFi ziDlvfe)_YY4)R5>o>9|z0^`)B7!E~F!APIwv~eA2g|+R?`EqpwzHIRBgoM}6%xod5 zd0!7cGw)42mszY(O@r0|P;hiR+#1BVo%QI3K)!rDgpv*B&OfRI!Kvm4C@mO${sl(Ewcnz958X0*56G( z;P+gqD^OeN=^L@JmM%JMpg*F6zY|2kitd_!GD3nY2N#vF2Y1ACO>TG@*bG8c)4JO?qD;O7EZf>^+h`~h(kA&2v)k)gu=JdbBo+Walg6$hr4m|Efq`c6;N{mm6yiVQg z%(wZcd}-s|>Cn(;(x3|0Yp(+k$KOOh9(NsS2E>&u+`^NZHG9kLrFi5>`62uAj4Cm< zwV&rsi#Hti^3=dVCHLq18<3=BbcB~WTfZ?k-lJ>vu}4SDv+SW?)gk6zW=7x`&wpI_ zRQVm7@uy;$_<+qk72EYb6|0J#j!t#aN#h9>=oNaFV0-)1yx?Z}lpF^vbKR4avAVt< z^orw5q+HQ#AI1=0r!I1S==ck#I8ZajB~I^|Pw(Eu{gi{-V*(u3g`|TpKa3 zl9v`4T<<+#FjjF(XL(3hX0HTURazAAd2<2VnqBWkbScxv4S05_)#@@L8-Ao-S}mcA z*S-=l-P&aEqRI9n@VPY`#46~CUPNUz`U3!b;^E;oQl zROS$jidS*TQ7rL16+%JAMdb&@!5Nj2mbzfgicfj3Q(?8-;;((Aa8wCJy&OEoJR)+ZaU)cE}$FwV8>t81a z)hY#OpdAD0{(T=9hs-iF4Kd~4amun6k>yqz-0`yD_}{D^xM6&g4EYaQRmauZ_5a~6 z3i$s;TyY_M_nCZdWUM;dm0Dw=tL%Ndp zi&*a8$_ZeP*i{XSH{4Z;@DebyX_H>cb!zIA-eqh5FJ7Bz3vi2^{tR*bno4N<0zcfP z_-l#DZig@jMArwYeyXV6-mtRxS534V;do8;0{RWfIVcDol&tm1iu9QKvYJFVuP$tR zWW}d8Rnig=y6*KR-(3X(qJ=jaLmv-{TorRGPig2Ziz_a(_ho)I9NV2@tKGXC&%0X0FVyCk8+>ZIK%?| zg~X$OLO*lhL2%I+V?L8S`l`+t22KL~Yt9JW>W>d`Ka{g@Zf`)KYT4`pJt4!NKH>ON zK5f_RT(6{!p|``j^7%$~cMX)RbM2;LX(x(FD>B@%fYq1UE7iCKh4-SgeUqt}AmmeX zwcV<6mJhMTu&9~x*Ago1-iAr9cK43fY*jk(SRIFqlPC7P6%rB)ijHt6b|Y4iubzmo z>pEZ2IWyiRdKmV(@%=agf!GAA>2}`FgJ)l>tsCQwIiUwQCsE6R2>S)G%ilV-#Ioe1 zbgL4~>P`2kB9j7(^l3d+PL$pfV9_=>VDS=tMgl2yb-(N~@BT>rabxLUr12YzmpGPK z6taNlq?LxyZEr<}XFnji9SaZ$C6MN~FJ6eaj_r86o`+8mm1~sig+8yHwLa`5JEKv( z{`ha5Z&HiNzlt7;CGcWQ%Z(6VC_DasMM6t;VUO?;r%CW?qxm9)yz_ha=3U^?5ujMi z${GY8c`mqs>K7FVAw_n;_%t7Oe$r3TlVgTGRlNumZUOaN=Cr=QZNQb;$8BSq+~P-si3AHYtpo*U&#=0bCsjN>}{QzJx(W1*b?gygW*P z4d{0JMtSkSDL9w~i%deWW$alK{4!v$+Wra&vb$}Hza@b0bxq4C?;q|OyvjoP2d_UX zJrN9X(hSr5yEvd~gKhRMjPkrZeYU_CWe;o1Rjd@ZL24OCa7&6*X>UB2Zpzwu8hmK%L!~A&#R%rT(-)(PS(&QV3!BZk+z(m zw^O|_K1r14O~T|O#7uCxJ(EfCsZ2Q@iw0wqSU=$D{ZN!sV8(8ht;sxsb0_qg)}uo zr`YB#E{o|zoAZ>W>2tByFggsX-HEolV^`XB()5>0Tk}hKRg zl6mBc1mJf<+kx|998?)XNK*xttxicvdZ&r54klT$l6tpyp{&l{QZ6v z^jEhO!{2ts;l32Io08Y2|($`(17>m`Cp*I{y8dV`1v+=}!ODzu)Q3)%YoNj_dF9@qQ1| zdOY@>|MA-d=H|2B9lN*J%HCW+jOEk*bR;m8LL1(uhu2S@%nBeS8i!^<-Z()Yf5MO}G zk6$JnQWe-dP;oLU7v;65Lz2`PgyW|Gmgi4RW3@KRz1#%j7osE4s^mglW*L4Q10Xc! z9BKya*Bz%4AB+6Cz<%}RE)jBCm{W8?&KCff1S^4Jx5&hW;biSj`7p(SC%3~#pO7U* zjhn782oSHmhp9@8R-mZFZ&2Dm8(=8C98DiE|3|=oV}*b3mqM> ## Add XML file to provisioning package +Before you add the XML file to a provisioning package, you can [validate your configuration XML against the XSD](multi-app-kiosk-xml.md). +Use the Windows Configuration Designer tool to create a provisioning package. [Learn how to install Windows Configuration Designer.](provisioning-packages/provisioning-install-icd.md) + +>[!IMPORTANT] +>When you build a provisioning package, you may include sensitive information in the project files and in the provisioning package (.ppkg) file. Although you have the option to encrypt the .ppkg file, project files are not encrypted. You should store the project files in a secure location and delete the project files when they are no longer needed. + +1. Open Windows Configuration Designer (by default, %systemdrive%\\Program Files (x86)\\Windows Kits\\10\\Assessment and Deployment Kit\\Imaging and Configuration Designer\\x86\\ICD.exe). + +2. Choose **Advanced provisioning**. + +3. Name your project, and click **Next**. + +4. Choose **All Windows desktop editions** and click **Next**. + +5. On **New project**, click **Finish**. The workspace for your package opens. + +6. Expand **Runtime settings** > **AssignedAccess** > **MultiAppAssignedAccessSettings**. + +7. Enter **layout.xml**. This value creates a placeholder in the customizations.xml file that you will replace with the contents of the layout.xml file in a later step. + +7. Save your project and close Windows Configuration Designer. + +7. In File Explorer, open the project's directory. (The default location is C:\Users\\*user name*\Documents\Windows Imaging and Configuration Designer (WICD)\\*project name*) + +7. Open the customizations.xml file in a text editor. The **<Customizations>** section will look like this: + + ![Customizations file with the placeholder text to replace highlighted](images/customization-start.png) + +7. Replace **layout.xml** with the text from the layout.xml file, [with markup characters replaced with escape characters](#escape). + +8. Save and close the customizations.xml file. + +8. Open Windows Configuration Designer and open your project. + +8. On the **File** menu, select **Save.** + +9. On the **Export** menu, select **Provisioning package**. + +10. Change **Owner** to **IT Admin**, which will set the precedence of this provisioning package higher than provisioning packages applied to this device from other sources, and then select **Next.** + +11. Optional. In the **Provisioning package security** window, you can choose to encrypt the package and enable package signing. + + - **Enable package encryption** - If you select this option, an auto-generated password will be shown on the screen. + + - **Enable package signing** - If you select this option, you must select a valid certificate to use for signing the package. You can specify the certificate by clicking **Select...** and choosing the certificate you want to use to sign the package. + +12. Click **Next** to specify the output location where you want the provisioning package to go when it's built. By default, Windows Imaging and Configuration Designer (ICD) uses the project folder as the output location. + + Optionally, you can click **Browse** to change the default output location. + +13. Click **Next**. + +14. Click **Build** to start building the package. The provisioning package doesn't take long to build. The project information is displayed in the build page and the progress bar indicates the build status. + + If you need to cancel the build, click **Cancel**. This cancels the current build process, closes the wizard, and takes you back to the **Customizations Page**. + +15. If your build fails, an error message will show up that includes a link to the project folder. You can scan the logs to determine what caused the error. Once you fix the issue, try building the package again. + + If your build is successful, the name of the provisioning package, output directory, and project directory will be shown. + + - If you choose, you can build the provisioning package again and pick a different path for the output package. To do this, click **Back** to change the output package name and path, and then click **Next** to start another build. + - If you are done, click **Finish** to close the wizard and go back to the **Customizations Page**. ## Apply provisioning package to device diff --git a/windows/configuration/multi-app-kiosk-xml.md b/windows/configuration/multi-app-kiosk-xml.md index a532786d85..642995cf1e 100644 --- a/windows/configuration/multi-app-kiosk-xml.md +++ b/windows/configuration/multi-app-kiosk-xml.md @@ -1,6 +1,6 @@ --- -title: Create a Windows 10 kiosk that runs multiple apps (Windows 10) -description: Learn how to configure a kiosk device running Windows 10 Enterprise or Windows 10 Education so that users can only run a few specific apps. +title: Multi-app kiosk XML reference (Windows 10) +description: XML and XSD for multi-app kiosk device configuration. ms.assetid: 14DDDC96-88C7-4181-8415-B371F25726C8 keywords: ["lockdown", "app restrictions", "applocker"] ms.prod: w10 @@ -8,128 +8,24 @@ ms.mktglfcycl: manage ms.sitesec: library ms.pagetype: edu, security author: jdeckerms -ms.localizationpriority: high +ms.localizationpriority: medium --- -# Create a Windows 10 kiosk that runs multiple apps +# Multi-app kiosk XML reference **Applies to** - Windows 10 -A [kiosk device](set-up-a-kiosk-for-windows-10-for-desktop-editions.md) typically runs a single app, and users are prevented from accessing any features or functions on the device outside of the kiosk app. In Windows 10, version 1709, the [AssignedAccess configuration service provider (CSP)](https://docs.microsoft.com/windows/client-management/mdm/assignedaccess-csp) has been expanded to make it easy for administrators to create kiosks that run more than one app. You can configure multi-app kiosks using a provisioning package. - ->[!NOTE] ->For devices running versions of Windows 10 earlier than version 1709, you can [create AppLocker rules](#1703) to configure a multi-app kiosk. - -The benefit of a multi-app kiosk, or fixed-purpose device, is to provide an easy-to-understand experience for individuals by putting in front of them only the things they need to use, and removing from their view the things they don’t need to access. - ->[!WARNING] ->The assigned access feature is intended for corporate-owned fixed-purpose devices, like kiosks. When the multi-app assigned access configuration is applied on the device, certain policies are enforced system-wide, and will impact other users on the device. Deleting the multi-app configuration will remove the assigned access lockdown profiles associated with the users, but it cannot revert all the enforced policies (such as Start layout). A factory reset is needed to clear all the policies enforced via assigned access. - - -Process: -1. [Create XML file](#create-xml-file) -2. [Add XML file to provisioning package](#add-xml) -3. [Apply provisioning package to device](#apply-ppkg) - -## Prerequisites - -- (latest version of WCD -- is Store version okay at GA?) -- kiosk device on 1709 - - -## Create XML file - -Let's start by looking at the basic structure of the XML file. - -- A configuration xml can define multiple *profiles*. Each profile has a unique **Id** and defines a set of applications that are allowed to run. - -- A configuration xml can have multiple *config* sections. Each config section associates a non-admin user account to a default profile **Id**. - -- Multiple config sections can be associated to the same profile. - -- A profile has no effect if it’s not associated to a config section. - - ![profile = app and config = account](images/profile-config.png) - -You can start your file by pasting the following XML (or any other examples in this topic) into a XML editor, and saving the file as *filename*.xml. Each section of this XML is explained in this topic. +## Full XML sample ```xml - - - - - - - - - - - - - - - - -``` - -### Profile - -A profile section in the XML has the following entries: - -- [**Id**](#id) - -- [**AllowedApps**](#allowedapps) - -- [**StartLayout**](#startlayout) - -- [**Taskbar**](#taskbar) - - -#### Id - -The profile **Id** is a GUID attribute to uniquely identify the profile. You can create a GUID using a GUID generator. The GUID just needs to be unique within this XML file. - -```xml - - … - -``` - -#### AllowedApps - -**AllowedApps** is a list of applications that are allowed to run. Apps can be Universal Windows Platform (UWP) apps or Classic Windows desktop apps. - -Based on the purpose of the kiosk device, define the list of applications that are allowed to run. This list can contain both UWP apps and desktop apps. When the mult-app kiosk configuration is applied to a device, AppLocker rules will be generated to allow the apps that are listed in the configuration. - ->[!NOTE] ->You cannot manage AppLocker rules that are generated by the multi-app kiosk configuration in [MMC snap-ins](https://technet.microsoft.com/library/hh994629.aspx#BKMK_Using_Snapins). - -- For UWP apps, you need to provide the App User Model ID (AUMID). [Learn how to get the AUMID](https://go.microsoft.com/fwlink/p/?LinkId=614867), or [get the AUMID from the Start Layout XML](#startlayout). -- For desktop apps, you need to specify the full path of the executable, which can contain one or more system environment variables in the form of %variableName% (i.e. %systemroot%, %windir%). - -Here are the predefined assigned access AppLocker rules for **UWP apps**: - -1. Default rule is to allow all users to launch the signed package apps. -2. The package app deny list is generated at runtime when the assigned access user signs in. Based on the installed/provisioned package apps available for the user account, assigned access generates the deny list. This list will exclude the default allowed inbox package apps which are critical for the system to function, and then exclude the allowed packages that enterprises defined in the assigned access configuration. If there are multiple apps within the same package, all these apps will be excluded. This deny list will be used to prevent the user from accessing the apps which are currently available for the user but not in the allowed list. - - >[!NOTE] - >Multi-app kiosk mode doesn’t block the enterprise or the users from installing UWP apps. When a new UWP app is installed during the current assigned access user session, this app will not be in the deny list. When the user signs out and signs in again, the app will be included in the deny list. If this is an enterprise-deployed line-of-business app and you want to allow it to run, update the assigned access configuration to include it in the allowed app list. - -Here are the predefined assigned access AppLocker rules for **desktop apps**: - -1. Default rule is to allow all users to launch the desktop programs signed with Microsoft Certificate in order for the system to boot and function. The rule also allows the admin user group to launch all desktop programs. -2. There is a predefined inbox desktop app deny list for the assigned access user account, and this deny list is adjusted based on the desktop app allow list that you defined in the multi-app configuration. -3. Enterprise-defined allowed desktop apps are added in the AppLocker allow list. - -The following example allows Groove Music, Movies & TV, Photos, Weather, Calculator, Paint, and Notepad apps to run on the device. - -```xml - + + + @@ -140,25 +36,7 @@ The following example allows Groove Music, Movies & TV, Photos, Weather, Calcula -``` - -#### StartLayout - -After you define the list of allowed applications, you can customize the Start layout for your kiosk experience. You can choose to pin all the allowed apps on the Start screen or just a subset, depending on whether you want the end user to directly access them on the Start screen. - -The easiest way to create a customized Start layout to apply to other Windows 10 devices is to set up the Start screen on a test device and then export the layout. For detailed steps, see [Customize and export Start layout](customize-and-export-start-layout.md). - -A few things to note here: - -- The test device on which you customize the Start layout should have the same OS version that is installed on the device where you plan to deploy the multi-app assigned access configuration. -- Since the multi-app assigned access experience is intended for fixed-purpose devices, to ensure the device experiences are consistent and predictable, use the *full* Start layout option instead of the *partial* Start layout. -- There are no apps pinned on the taskbar in the multi-app mode, and it is not supported to configure Taskbar layout using the `` tag in a layout modification XML as part of the assigned access configuration. -- The following example uses DesktopApplicationLinkPath to pin the desktop app to start. When the desktop app doesn’t have a shortcut link on the target device, [learn how to provision .lnk files using Windows Configuration Designer](#lnk-files). - -This example pins Groove Music, Movies & TV, Photos, Weather, Calculator, Paint, and Notepad apps on Start. - -```xml - + @@ -181,184 +59,115 @@ This example pins Groove Music, Movies & TV, Photos, Weather, Calculator, Paint, ]]> -``` - -![What the Start screen looks like when the XML sample is applied](images/sample-start.png) - -#### Taskbar - -Define whether you want to have the taskbar present in the kiosk device. For tablet-based or touch-enabled all-in-one kiosks, when you don’t attach a keyboard and mouse, you can hide the taskbar as part of the multi-app experience if you want. - -The following example exposes the taskbar to the end user: - - `` - -The following example hides the taskbar: - - `` - ->[!NOTE] ->This is different from the **Automatically hide the taskbar** option in tablet mode, which shows the taskbar when swiping up from or moving the mouse pointer down to the bottom of the screen. Setting **ShowTaskbar** as **false** will always keep the taskbar hidden. - -### Configs - -Under **Configs**, define which user account will be associated with the profile. When this user account signs in on the device, the associated assigned access profile will be enforced, including the allowed apps, Start layout, and taskbar configuration, as well as other local group policies or MDM policies set as part of the multi-app experience. - -The full multi-app assigned access experience can only work for non-admin users. It’s not supported to associate an admin user with the assigned access profile; doing this in the XML file will result in unexpected/unsupported experiences when this admin user signs in. - - - -The account can be local, domain, or Azure Active Directory (Azure AD). Groups are not supported. -• Local account can be entered as `machinename\account` or `.\account` or just `account`. -• Domain account should be entered as `domain\account`. -• Azure AD account must be specified in this format: `AzureAD\{email address}`. **AzureAD** must be provided AS IS (consider it’s a fixed domain name), then follow with the Azure AD email address, e.g. **AzureAD\someone@contoso.onmicrosoft.com**. - ->[!WARNING] ->Although **Start** > **Settings** > **Accounts** > **Other users** > **Set up assigned access** only supports specifying a local user account, Assigned Access can be configured via WMI or CSP to run its applications under a domain user or service account, rather than a local account. However, use of domain user or service accounts introduces risks that an attacker subverting the Assigned Access application might gain access to sensitive domain resources that have been inadvertently left accessible to any domain account. We recommend that customers proceed with caution when using domain accounts with Assigned Access, and consider the domain resources potentially exposed by the decision to do so. - - -Before applying the multi-app configuration, make sure the specified user account is available on the device, otherwise it will fail. - ->[!NOTE] ->For both domain and Azure AD accounts, it’s not required that target account is explicitly added to the device. As long as the device is AD-joined or Azure AD-joined, the account can be discovered in the domain forest or tenant that the device is joined to. For local accounts, it is required that the account exist before you configure the account for AssignedAccess. - - -```xml - + + + + MultiAppKioskUser - + + ``` - - - -## Add XML file to provisioning package - - - - -## Apply provisioning package to device - - - -## Considerations for mixed-reality devices - -*There are some Mixed Reality specific bits we wanted to include. For example, the IT Admin needs to include the Mixed Reality Portal as an allowed app if they want to include Mixed Reality apps in kiosk mode.* - - -#### placeholder for lnk - - - - -## old method (pre-1709) - -Learn how to configure a device running Windows 10 Enterprise or Windows 10 Education so that users can only run a few specific apps. The result is similar to [a kiosk device](set-up-a-device-for-anyone-to-use.md), but with multiple apps available. For example, you might set up a library computer so that users can search the catalog and browse the Internet, but can't run any other apps or change computer settings. - -You can restrict users to a specific set of apps on a device running Windows 10 Enterprise or Windows 10 Education by using [AppLocker](/windows/device-security/applocker/applocker-overview). AppLocker rules specify which apps are allowed to run on the device. - -AppLocker rules are organized into collections based on file format. If no AppLocker rules for a specific rule collection exist, all files with that file format are allowed to run. However, when an AppLocker rule for a specific rule collection is created, only the files explicitly allowed in a rule are permitted to run. For more information, see [How AppLocker works](/windows/device-security/applocker/how-applocker-works-techref). - -This topic describes how to lock down apps on a local device. You can also use AppLocker to set rules for applications in a domain by using Group Policy. - -![install create lockdown customize](images/lockdownapps.png) - -### Install apps - - -First, install the desired apps on the device for the target user account(s). This works for both Store and Win32. For Store apps, you must log on as that user for the app to install. For Win32 you can install an app for all users without logging on to the particular account. - -### Use AppLocker to set rules for apps - - -After you install the desired apps, set up AppLocker rules to only allow specific apps, and block everything else. - -1. Run Local Security Policy (secpol.msc) as an administrator. - -2. Go to **Security Settings** > **Application Control Policies** > **AppLocker**, and select **Configure rule enforcement**. - - ![configure rule enforcement](images/apprule.png) - -3. Check **Configured** under **Executable rules**, and then click **OK**. - -4. Right-click **Executable Rules** and then click **Automatically generate rules**. - - ![automatically generate rules](images/genrule.png) - -5. Select the folder that contains the apps that you want to permit, or select C:\\ to analyze all apps. - -6. Type a name to identify this set of rules, and then click **Next**. - -7. On the **Rule Preferences** page, click **Next**. Be patient, it might take awhile to generate the rules. - -8. On the **Review Rules** page, click **Create**. The wizard will now create a set of rules allowing the installed set of apps. - -9. Read the message and click **Yes**. - - ![default rules warning](images/appwarning.png) - -10. (optional) If you want a rule to apply to a specific set of users, right-click on the rule and select **Properties**. Then use the dialog to choose a different user or group of users. - -11. (optional) If rules were generated for apps that should not be run, you can delete them by right-clicking on the rule and selecting **Delete**. - -12. Before AppLocker will enforce rules, the **Application Identity** service must be turned on. To force the Application Identity service to automatically start on reset, open a command prompt and run: - - ``` syntax - sc config appidsvc start=auto - ``` - -13. Restart the device. - -### Other settings to lock down - - -In addition to specifying the apps that users can run, you should also restrict some settings and functions on the device. For a more secure experience, we recommend that you make the following configuration changes to the device: - -- Remove **All apps**. - - Go to **Group Policy Editor** > **User Configuration** > **Administrative Templates\\Start Menu and Taskbar\\Remove All Programs list from the Start menu**. - -- Hide **Ease of access** feature on the logon screen. - - Go to **Control Panel** > **Ease of Access** > **Ease of Access Center**, and turn off all accessibility tools. - -- Disable the hardware power button. - - Go to **Power Options** > **Choose what the power button does**, change the setting to **Do nothing**, and then **Save changes**. - -- Disable the camera. - - Go to **Settings** > **Privacy** > **Camera**, and turn off **Let apps use my camera**. - -- Turn off app notifications on the lock screen. - - Go to **Group Policy Editor** > **Computer Configuration** > **Administrative Templates\\System\\Logon\\Turn off app notifications on the lock screen**. - -- Disable removable media. - - Go to **Group Policy Editor** > **Computer Configuration** > **Administrative Templates\\System\\Device Installation\\Device Installation Restrictions**. Review the policy settings available in **Device Installation Restrictions** for the settings applicable to your situation. - - **Note**   - To prevent this policy from affecting a member of the Administrators group, in **Device Installation Restrictions**, enable **Allow administrators to override Device Installation Restriction policies**. - -   - -To learn more about locking down features, see [Customizations for Windows 10 Enterprise](https://go.microsoft.com/fwlink/p/?LinkId=691442). - -### Customize Start screen layout for the device (recommended) - - -Configure the Start menu on the device to only show tiles for the permitted apps. You will make the changes manually, export the layout to an .xml file, and then apply that file to devices to prevent users from making changes. For instructions, see [Manage Windows 10 Start layout options](windows-10-start-layout-options-and-policies.md). - - -  - -  - - - - - +## XSD for AssignedAccess configuration XML + +```xml + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +``` \ No newline at end of file From ecf0396ff22eff74f32d69c6ba54703b68b2ca03 Mon Sep 17 00:00:00 2001 From: jdeckerMS Date: Tue, 8 Aug 2017 10:11:19 -0700 Subject: [PATCH 10/37] sync --- ...-by-using-provisioning-packages-and-icd.md | 2 +- .../lock-down-windows-10-to-specific-apps.md | 24 +++++++++---------- 2 files changed, 12 insertions(+), 14 deletions(-) diff --git a/windows/configuration/customize-windows-10-start-screens-by-using-provisioning-packages-and-icd.md b/windows/configuration/customize-windows-10-start-screens-by-using-provisioning-packages-and-icd.md index c4a13cef3a..18f215ad22 100644 --- a/windows/configuration/customize-windows-10-start-screens-by-using-provisioning-packages-and-icd.md +++ b/windows/configuration/customize-windows-10-start-screens-by-using-provisioning-packages-and-icd.md @@ -100,7 +100,7 @@ Use the Windows Configuration Designer tool to create a provisioning package. [L - **Enable package encryption** - If you select this option, an auto-generated password will be shown on the screen. - - **Enable package signing** - If you select this option, you must select a valid certificate to use for signing the package. You can specify the certificate by clicking **Select...** and choosing the certificate you want to use to sign the package. + - **Enable package signing** - If you select this option, you must select a valid certificate to use for signing the package. You can specify the certificate by clicking **Browse** and choosing the certificate you want to use to sign the package. 12. Click **Next** to specify the output location where you want the provisioning package to go when it's built. By default, Windows Imaging and Configuration Designer (ICD) uses the project folder as the output location. diff --git a/windows/configuration/lock-down-windows-10-to-specific-apps.md b/windows/configuration/lock-down-windows-10-to-specific-apps.md index eec365b65e..302ba40b43 100644 --- a/windows/configuration/lock-down-windows-10-to-specific-apps.md +++ b/windows/configuration/lock-down-windows-10-to-specific-apps.md @@ -183,6 +183,10 @@ This example pins Groove Music, Movies & TV, Photos, Weather, Calculator, Paint, ``` +>[!NOTE] +>If an app is not installed for the user but is included in the Start layout XML, the app will not be shown on the Start screen. + + ![What the Start screen looks like when the XML sample is applied](images/sample-start.png) #### Taskbar @@ -256,21 +260,13 @@ Use the Windows Configuration Designer tool to create a provisioning package. [L 6. Expand **Runtime settings** > **AssignedAccess** > **MultiAppAssignedAccessSettings**. -7. Enter **layout.xml**. This value creates a placeholder in the customizations.xml file that you will replace with the contents of the layout.xml file in a later step. +7. In the center pane, click **Browse** to locate and select the assigned access configuration XML file that you created. -7. Save your project and close Windows Configuration Designer. + ![Screenshot of the MultiAppAssignedAccessSettings field in Windows Configuration Designer](images/multiappassignedaccesssettings.png) -7. In File Explorer, open the project's directory. (The default location is C:\Users\\*user name*\Documents\Windows Imaging and Configuration Designer (WICD)\\*project name*) +8. (**Optional**: If you want to apply the provisioning package after device initial setup and there is an admin user already available on the kiosk device, skip this step.) Create an admin user account in **Runtime settings** > **Accounts** > **Users**. Provide a **UserName** and **Password**, and select **UserGroup** as **Administrators**. With this account, you can view the provisioning status and logs if needed. -7. Open the customizations.xml file in a text editor. The **<Customizations>** section will look like this: - - ![Customizations file with the placeholder text to replace highlighted](images/customization-start.png) - -7. Replace **layout.xml** with the text from the layout.xml file, [with markup characters replaced with escape characters](#escape). - -8. Save and close the customizations.xml file. - -8. Open Windows Configuration Designer and open your project. +8. (**Optional**: If you already have a non-admin account on the kiosk device, skip this step.) Create a local standard user account in **Runtime settings** > **Accounts** > **Users**. Make sure the **UserName** is the same as the account that you specify in the configuration XML. Select **UserGroup** as **Standard Users**. 8. On the **File** menu, select **Save.** @@ -282,7 +278,7 @@ Use the Windows Configuration Designer tool to create a provisioning package. [L - **Enable package encryption** - If you select this option, an auto-generated password will be shown on the screen. - - **Enable package signing** - If you select this option, you must select a valid certificate to use for signing the package. You can specify the certificate by clicking **Select...** and choosing the certificate you want to use to sign the package. + - **Enable package signing** - If you select this option, you must select a valid certificate to use for signing the package. You can specify the certificate by clicking **Browse** and choosing the certificate you want to use to sign the package. 12. Click **Next** to specify the output location where you want the provisioning package to go when it's built. By default, Windows Imaging and Configuration Designer (ICD) uses the project folder as the output location. @@ -300,6 +296,8 @@ Use the Windows Configuration Designer tool to create a provisioning package. [L - If you choose, you can build the provisioning package again and pick a different path for the output package. To do this, click **Back** to change the output package name and path, and then click **Next** to start another build. - If you are done, click **Finish** to close the wizard and go back to the **Customizations Page**. + +15. Copy the provisioning package to the root directory of a USB drive. ## Apply provisioning package to device From 20d7e2954a06b99f18c97b747c2f8274b14aa29b Mon Sep 17 00:00:00 2001 From: jdeckerMS Date: Tue, 8 Aug 2017 10:41:26 -0700 Subject: [PATCH 11/37] sync --- .../lock-down-windows-10-to-specific-apps.md | 41 +++++++++++++++++++ 1 file changed, 41 insertions(+) diff --git a/windows/configuration/lock-down-windows-10-to-specific-apps.md b/windows/configuration/lock-down-windows-10-to-specific-apps.md index 302ba40b43..0aa83ed072 100644 --- a/windows/configuration/lock-down-windows-10-to-specific-apps.md +++ b/windows/configuration/lock-down-windows-10-to-specific-apps.md @@ -302,6 +302,47 @@ Use the Windows Configuration Designer tool to create a provisioning package. [L ## Apply provisioning package to device +Provisioning packages can be applied to a device during the first-run experience (out-of-box experience or "OOBE") and after ("runtime"). + + +### During initial setup, from a USB drive + +1. Start with a computer on the first-run setup screen. If the PC has gone past this screen, reset the PC to start over. To reset the PC, go to **Settings** > **Update & security** > **Recovery** > **Reset this PC**. + + ![The first screen to set up a new PC](../images/oobe.jpg) + +2. Insert the USB drive. Windows Setup will recognize the drive and ask if you want to set up the device. Select **Set up**. + + ![Set up device?](../images/setupmsg.jpg) + +3. The next screen asks you to select a provisioning source. Select **Removable Media** and tap **Next**. + + ![Provision this device](../images/prov.jpg) + +4. Select the provisioning package (\*.ppkg) that you want to apply, and tap **Next**. + + ![Choose a package](../images/choose-package.png) + +5. Select **Yes, add it**. + + ![Do you trust this package?](../images/trust-package.png) + + + +### After setup, from a USB drive, network folder, or SharePoint site + +1. Sign in with an admin account. +2. Insert the USB drive to a desktop computer, navigate to **Settings** > **Accounts** > **Access work or school** > **Add or remove a provisioning package** > **Add a package**, and select the package to install. + +>[!NOTE] +>if your provisioning package doesn’t include the assigned access user account creation, make sure the account you specified in the multi-app configuration XML exists on the device. + +![add a package option](../images/package.png) + +### Validate provisioning + +- Go to **Settings** > **Accounts** > **Access work or school**, and then click **Add or remove a provisioning package**. You should see a list of packages that were applied to the device, including the one you applied for the multi-app configuration. +- Optionally, run Event Viewer (eventvwr.exe) and look through logs under **Applications and Services Logs** > **Microsoft** > **Windows** > **Provisioning-Diagnostics-Provider** > **Admin**. ## Considerations for mixed-reality devices From 7afa9eded4414290970ef1ee5326b906200bd5e7 Mon Sep 17 00:00:00 2001 From: jdeckerMS Date: Tue, 8 Aug 2017 10:58:32 -0700 Subject: [PATCH 12/37] fix image links --- .../lock-down-windows-10-to-specific-apps.md | 93 +++++++++++++++++-- 1 file changed, 83 insertions(+), 10 deletions(-) diff --git a/windows/configuration/lock-down-windows-10-to-specific-apps.md b/windows/configuration/lock-down-windows-10-to-specific-apps.md index 0aa83ed072..c25edb0187 100644 --- a/windows/configuration/lock-down-windows-10-to-specific-apps.md +++ b/windows/configuration/lock-down-windows-10-to-specific-apps.md @@ -213,9 +213,9 @@ The full multi-app assigned access experience can only work for non-admin users. The account can be local, domain, or Azure Active Directory (Azure AD). Groups are not supported. -• Local account can be entered as `machinename\account` or `.\account` or just `account`. -• Domain account should be entered as `domain\account`. -• Azure AD account must be specified in this format: `AzureAD\{email address}`. **AzureAD** must be provided AS IS (consider it’s a fixed domain name), then follow with the Azure AD email address, e.g. **AzureAD\someone@contoso.onmicrosoft.com**. +- Local account can be entered as `machinename\account` or `.\account` or just `account`. +- Domain account should be entered as `domain\account`. +- Azure AD account must be specified in this format: `AzureAD\{email address}`. **AzureAD** must be provided AS IS (consider it’s a fixed domain name), then follow with the Azure AD email address, e.g. **AzureAD\someone@contoso.onmicrosoft.com**. >[!WARNING] >Although **Start** > **Settings** > **Accounts** > **Other users** > **Set up assigned access** only supports specifying a local user account, Assigned Access can be configured via WMI or CSP to run its applications under a domain user or service account, rather than a local account. However, use of domain user or service accounts introduces risks that an attacker subverting the Assigned Access application might gain access to sensitive domain resources that have been inadvertently left accessible to any domain account. We recommend that customers proceed with caution when using domain accounts with Assigned Access, and consider the domain resources potentially exposed by the decision to do so. @@ -309,23 +309,23 @@ Provisioning packages can be applied to a device during the first-run experience 1. Start with a computer on the first-run setup screen. If the PC has gone past this screen, reset the PC to start over. To reset the PC, go to **Settings** > **Update & security** > **Recovery** > **Reset this PC**. - ![The first screen to set up a new PC](../images/oobe.jpg) + ![The first screen to set up a new PC](images/oobe.jpg) 2. Insert the USB drive. Windows Setup will recognize the drive and ask if you want to set up the device. Select **Set up**. - ![Set up device?](../images/setupmsg.jpg) + ![Set up device?](images/setupmsg.jpg) 3. The next screen asks you to select a provisioning source. Select **Removable Media** and tap **Next**. - ![Provision this device](../images/prov.jpg) + ![Provision this device](images/prov.jpg) 4. Select the provisioning package (\*.ppkg) that you want to apply, and tap **Next**. - ![Choose a package](../images/choose-package.png) + ![Choose a package](images/choose-package.png) 5. Select **Yes, add it**. - ![Do you trust this package?](../images/trust-package.png) + ![Do you trust this package?](images/trust-package.png) @@ -337,20 +337,93 @@ Provisioning packages can be applied to a device during the first-run experience >[!NOTE] >if your provisioning package doesn’t include the assigned access user account creation, make sure the account you specified in the multi-app configuration XML exists on the device. -![add a package option](../images/package.png) +![add a package option](images/package.png) ### Validate provisioning - Go to **Settings** > **Accounts** > **Access work or school**, and then click **Add or remove a provisioning package**. You should see a list of packages that were applied to the device, including the one you applied for the multi-app configuration. - Optionally, run Event Viewer (eventvwr.exe) and look through logs under **Applications and Services Logs** > **Microsoft** > **Windows** > **Provisioning-Diagnostics-Provider** > **Admin**. +### Validate multi-app kiosk configuration + +Sign in with the assigned access user account you specified in the configuration to check out the multi-app experience. + +>[!NOTE] +>The setting will take effect the next time the assigned access user signs in. If that user account is signed in when you apply the configuration, make sure the user signs out and signs back in to validate the experience. + +The following sections explain what to expect on a multi-app kiosk. + +#### App launching and switching experience + +In the multi-app mode, to maximize the user productivity and streamline the experience, an app will be always launched in full screen when the users click the tile on the Start. The users can minimize and close the app, but cannot resize the app window. + +The users can switch apps just as they do today in Windows. They can use the Task View button, Alt + Tab hotkey, and the swipe in from the left gesture to view all the open apps in task view. They can click the Windows button to show Start, from which they can open apps, and they can switch to an opened app by clicking it on the taskbar. + +#### Start changes + +When the assigned access user signs in, you should see a restricted Start experience: +- Start gets launched in full screen and prevents the end user from accessing the desktop. +- Start shows the layout aligned with what you defined in the multi-app configuration XML. +- Start prevents the end user from changing the tile layout. + - The user cannot resize, reposition, and unpin the tiles. + - The user cannot pin additional tiles on the start. +- Start hides **All Apps** list. +- Start hides all the folders on Start (including File Explorer, Settings, Documents, Downloads, Music, Pictures, Videos, HomeGroup, Network, and Personal folders). +- Only **User** and **Power** buttons are available. (You can control whether to show the **User/Power** buttons using [existing policies](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-start).) +- Start hides **Change account settings** option under **User** button. + +#### Taskbar changes + +If the applied multi-app configuration enables taskbar, when the assigned access user signs in, you should see a restricted Taskbar experience: +- Disables context menu of Start button (Quick Link) +- Disables context menu of taskbar +- Prevents the end user from changing the taskbar +- Disables Cortana and Search Windows +- Hides notification icons and system icons, e.g. Action Center, People, Windows Ink Workspace +- Allows the end user to view the status of the network connection and power state, but disables the flyout of **Network/Power** to prevent end user from changing the settings + +#### Blocked hotkeys + +The multi-app mode blocks the following hotkeys, which are not relevant for the lockdown experience. + +| Hotkey | Action | +| --- | --- | +| Windows logo key + A | Open Action center | +| Windows logo key + Shift + C | Open Cortana in listening mode | +| Windows logo key + D | Display and hide the desktop | +| Windows logo key + Alt + D | Display and hide the date and time on the desktop | +| Windows logo key + E | Open File Explorer | +| Windows logo key + F | Open Feedback Hub | +| Windows logo key + G | Open Game bar when a game is open | +| Windows logo key + I | Open Settings | +| Windows logo key + J | Set focus to a Windows tip when one is available. | +| Windows logo key + O | Lock device orientation | +| Windows logo key + Q | Open search | +| Windows logo key + R | Open the Run dialog box | +| Windows logo key + S | Open search | +| Windows logo key + X | Open the Quick Link menu | +| Windows logo key + comma (,) | Temporarily peek at the desktop | +| Windows logo key + Ctrl + F | Search for PCs (if you're on a network) | + + +#### Locked-down Ctrl+Alt+Del screen + +The multi-app mode removes options (e.g. **Change a password**, **Task Manager**, **Network**) in the Ctrl+Alt+Del screen to ensure the users cannot access the functionalities that are not allowed in the lockdown experience. + + + + + + + + ## Considerations for mixed-reality devices *There are some Mixed Reality specific bits we wanted to include. For example, the IT Admin needs to include the Mixed Reality Portal as an allowed app if they want to include Mixed Reality apps in kiosk mode.* -#### placeholder for lnk +## placeholder for lnk From 9fef01eed8d22124633263f9ba3634f8d14dbb01 Mon Sep 17 00:00:00 2001 From: jdeckerMS Date: Tue, 8 Aug 2017 12:31:38 -0700 Subject: [PATCH 13/37] test table --- .../lock-down-windows-10-to-specific-apps.md | 48 ++++++++++++++++++- 1 file changed, 46 insertions(+), 2 deletions(-) diff --git a/windows/configuration/lock-down-windows-10-to-specific-apps.md b/windows/configuration/lock-down-windows-10-to-specific-apps.md index c25edb0187..61203cce6c 100644 --- a/windows/configuration/lock-down-windows-10-to-specific-apps.md +++ b/windows/configuration/lock-down-windows-10-to-specific-apps.md @@ -206,7 +206,7 @@ The following example hides the taskbar: ### Configs -Under **Configs**, define which user account will be associated with the profile. When this user account signs in on the device, the associated assigned access profile will be enforced, including the allowed apps, Start layout, and taskbar configuration, as well as other local group policies or MDM policies set as part of the multi-app experience. +Under **Configs**, define which user account will be associated with the profile. When this user account signs in on the device, the associated assigned access profile will be enforced, including the allowed apps, Start layout, and taskbar configuration, as well as other local group policies or mobile device management (MDM) policies set as part of the multi-app experience. The full multi-app assigned access experience can only work for non-admin users. It’s not supported to associate an admin user with the assigned access profile; doing this in the XML file will result in unexpected/unsupported experiences when this admin user signs in. @@ -406,12 +406,14 @@ The multi-app mode blocks the following hotkeys, which are not relevant for the | Windows logo key + Ctrl + F | Search for PCs (if you're on a network) | + #### Locked-down Ctrl+Alt+Del screen The multi-app mode removes options (e.g. **Change a password**, **Task Manager**, **Network**) in the Ctrl+Alt+Del screen to ensure the users cannot access the functionalities that are not allowed in the lockdown experience. +#### Auto-trigger touch keyboard - +In the multi-app mode, the touch keyboard will be automatically triggered when there is an input needed and no physical keyboard is attached on touch-enabled devices. You don’t need to configure any other setting to enforce this behavior. @@ -422,10 +424,52 @@ The multi-app mode removes options (e.g. **Change a password**, **Task Manager** *There are some Mixed Reality specific bits we wanted to include. For example, the IT Admin needs to include the Mixed Reality Portal as an allowed app if they want to include Mixed Reality apps in kiosk mode.* + ## placeholder for lnk +## Policies set by multi-app kiosk configuration + +### Group Policy + +The following local policies affect all **non-administrator** users on the system, regardless whether the user is configured as an assigned access user or not. This includes local users, domain users, and Azure Active Directory users. + +| Setting | Value | +| --- | --- | +Remove access to the context menus for the task bar | Enabled +Clear history of recently opened documents on exit | Enabled +Prevent users from customizing their Start Screen | Enabled +Prevent users from uninstalling applications from Start | Enabled +Remove All Programs list from the Start menu | Enabled +Remove Run menu from Start Menu | Enabled +Disable showing balloon notifications as toast | Enabled +Do not allow pinning items in Jump Lists | Enabled +Do not allow pinning programs to the Taskbar | Enabled +Do not display or track items in Jump Lists from remote locations | Enabled +Remove Notifications and Action Center | Enabled +Lock all taskbar settings | Enabled +Lock the Taskbar | Enabled +Prevent users from adding or removing toolbars | Enabled +Prevent users from resizing the taskbar | Enabled +Remove frequent programs list from the Start Menu | Enabled +Remove Pinned programs from the taskbar | Enabled +Remove the Security and Maintenance icon | Enabled +Turn off all balloon notifications | Enabled +Turn off feature advertisement balloon notifications | Enabled +Turn off toast notifications | Enabled +Remove Task Manager | Enabled +Remove Change Password option in Security Options UI | Enabled +Remove Sign Out option in Security Options UI | Enabled +Remove All Programs list from the Start Menu | Enabled – Remove and disable setting +Prevent access to drives from My Computer | Enabled - Restrict all drivers + + + + + +### MDM policy + From ed412a7a5e6f06098c5a9d01216e1f4e798e04cd Mon Sep 17 00:00:00 2001 From: jdeckerMS Date: Tue, 8 Aug 2017 12:59:56 -0700 Subject: [PATCH 14/37] lnk files --- .../lock-down-windows-10-to-specific-apps.md | 28 +++++++++++++++---- 1 file changed, 22 insertions(+), 6 deletions(-) diff --git a/windows/configuration/lock-down-windows-10-to-specific-apps.md b/windows/configuration/lock-down-windows-10-to-specific-apps.md index 61203cce6c..fdc42e2380 100644 --- a/windows/configuration/lock-down-windows-10-to-specific-apps.md +++ b/windows/configuration/lock-down-windows-10-to-specific-apps.md @@ -425,8 +425,7 @@ In the multi-app mode, the touch keyboard will be automatically triggered when t *There are some Mixed Reality specific bits we wanted to include. For example, the IT Admin needs to include the Mixed Reality Portal as an allowed app if they want to include Mixed Reality apps in kiosk mode.* - -## placeholder for lnk + ## Policies set by multi-app kiosk configuration @@ -471,15 +470,32 @@ Prevent access to drives from My Computer | Enabled - Restrict all drivers ### MDM policy +Some of the MDM policies affect all users on the system (i.e. system-wide). +Setting | Value | System-wide + --- | --- | --- +Experience/AllowCortana | Disabled | Yes +Start/AllowPinnedFolderSettings | Disabled | Yes +Start/HidePeopleBar | Enabled | Yes +Start/HideChangeAccountSettings | Enabled | Yes +WindowsInkWorkspace/AllowWindowsInkWorkspace | Disabled | Yes +Start/StartLayout | Configuration dependent | No +WindowsLogon/DontDisplayNetworkSectionUI | Enabled | Yes + +## Provision .lnk files using Windows Configuration Designer +First, create your desktop app's shortcut file by installing the app on a test device. Right-click the installed application, and choose **Send to** > **Desktop (create shortcut)**. Rename the shortcut to `.lnk` -  - -  - +Next, create a batch file with two commands. If the desktop app is already installed on the target device, skip the first command for MSI install. +``` +msiexec /I ".msi" /qn /norestart +copy .lnk "%AllUsersProfile\Microsoft\Windows\Start Menu\Programs\.lnk" +``` +In Windows Configuration Designer, under **ProvisioningCommands** > **DeviceContext**: +- Under CommandFiles, upload your batch file, your .lnk file, and your desktop app installation file +- Under CommandLine, enter cmd /c .bat From 37f226072848bb36e2dbad17d70eb95849e5f189 Mon Sep 17 00:00:00 2001 From: jdeckerMS Date: Wed, 9 Aug 2017 06:54:32 -0700 Subject: [PATCH 15/37] Edu or Ent --- windows/configuration/lock-down-windows-10-to-specific-apps.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/configuration/lock-down-windows-10-to-specific-apps.md b/windows/configuration/lock-down-windows-10-to-specific-apps.md index fdc42e2380..3eab3df448 100644 --- a/windows/configuration/lock-down-windows-10-to-specific-apps.md +++ b/windows/configuration/lock-down-windows-10-to-specific-apps.md @@ -37,7 +37,7 @@ Process: ## Prerequisites - (latest version of WCD -- is Store version okay at GA?) -- kiosk device on 1709 +- The kiosk device must be running Windows 10 (Enterprise or Education), version 1709 ## Create XML file From 0b0cf6d2edfa9d1454141905f75680762e0935f6 Mon Sep 17 00:00:00 2001 From: jdeckerMS Date: Wed, 9 Aug 2017 12:37:23 -0700 Subject: [PATCH 16/37] Johnson feedback --- .../lock-down-windows-10-to-specific-apps.md | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) diff --git a/windows/configuration/lock-down-windows-10-to-specific-apps.md b/windows/configuration/lock-down-windows-10-to-specific-apps.md index 3eab3df448..47da3a434e 100644 --- a/windows/configuration/lock-down-windows-10-to-specific-apps.md +++ b/windows/configuration/lock-down-windows-10-to-specific-apps.md @@ -37,7 +37,7 @@ Process: ## Prerequisites - (latest version of WCD -- is Store version okay at GA?) -- The kiosk device must be running Windows 10 (Enterprise or Education), version 1709 +- The kiosk device must be running Windows 10 (Pro, Enterprise, or Education), version 1709 ## Create XML file @@ -195,11 +195,15 @@ Define whether you want to have the taskbar present in the kiosk device. For tab The following example exposes the taskbar to the end user: - `` +```xml + +``` The following example hides the taskbar: - `` +```xml + +``` >[!NOTE] >This is different from the **Automatically hide the taskbar** option in tablet mode, which shows the taskbar when swiping up from or moving the mouse pointer down to the bottom of the screen. Setting **ShowTaskbar** as **false** will always keep the taskbar hidden. From 87a2d0a7d0408baf31ee5cf1532594df9c9c7246 Mon Sep 17 00:00:00 2001 From: jdeckerMS Date: Thu, 10 Aug 2017 07:04:27 -0700 Subject: [PATCH 17/37] Evan feedback --- .../lock-down-windows-10-to-specific-apps.md | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/windows/configuration/lock-down-windows-10-to-specific-apps.md b/windows/configuration/lock-down-windows-10-to-specific-apps.md index 47da3a434e..6f1dbb4855 100644 --- a/windows/configuration/lock-down-windows-10-to-specific-apps.md +++ b/windows/configuration/lock-down-windows-10-to-specific-apps.md @@ -480,7 +480,7 @@ Setting | Value | System-wide --- | --- | --- Experience/AllowCortana | Disabled | Yes Start/AllowPinnedFolderSettings | Disabled | Yes -Start/HidePeopleBar | Enabled | Yes +Start/HidePeopleBar | Enabled | No Start/HideChangeAccountSettings | Enabled | Yes WindowsInkWorkspace/AllowWindowsInkWorkspace | Disabled | Yes Start/StartLayout | Configuration dependent | No @@ -495,11 +495,11 @@ Next, create a batch file with two commands. If the desktop app is already insta ``` msiexec /I ".msi" /qn /norestart -copy .lnk "%AllUsersProfile\Microsoft\Windows\Start Menu\Programs\.lnk" +copy .lnk "%AllUsersProfile%\Microsoft\Windows\Start Menu\Programs\.lnk" ``` In Windows Configuration Designer, under **ProvisioningCommands** > **DeviceContext**: -- Under CommandFiles, upload your batch file, your .lnk file, and your desktop app installation file -- Under CommandLine, enter cmd /c .bat +- Under **CommandFiles**, upload your batch file, your .lnk file, and your desktop app installation file +- Under **CommandLine**, enter cmd /c *FileName*.bat From ed13ede835e8e1b2d493cfa1cdf80e32802cefc2 Mon Sep 17 00:00:00 2001 From: jdeckerMS Date: Thu, 10 Aug 2017 07:09:26 -0700 Subject: [PATCH 18/37] Chandler feedback --- .../lock-down-windows-10-to-specific-apps.md | 22 +++++++++---------- 1 file changed, 11 insertions(+), 11 deletions(-) diff --git a/windows/configuration/lock-down-windows-10-to-specific-apps.md b/windows/configuration/lock-down-windows-10-to-specific-apps.md index 6f1dbb4855..0f9c3e2e49 100644 --- a/windows/configuration/lock-down-windows-10-to-specific-apps.md +++ b/windows/configuration/lock-down-windows-10-to-specific-apps.md @@ -44,7 +44,7 @@ Process: Let's start by looking at the basic structure of the XML file. -- A configuration xml can define multiple *profiles*. Each profile has a unique **Id** and defines a set of applications that are allowed to run. +- A configuration xml can define multiple *profiles*. Each profile has a unique **Id** and defines a set of applications that are allowed to run, whether the taskbar is visible, and can include a custom Start layout. - A configuration xml can have multiple *config* sections. Each config section associates a non-admin user account to a default profile **Id**. @@ -96,8 +96,8 @@ The profile **Id** is a GUID attribute to uniquely identify the profile. You can ```xml - … - + … + ``` #### AllowedApps @@ -139,7 +139,7 @@ The following example allows Groove Music, Movies & TV, Photos, Weather, Calcula - + ``` #### StartLayout @@ -180,7 +180,7 @@ This example pins Groove Music, Movies & TV, Photos, Weather, Calculator, Paint, ]]> - + ``` >[!NOTE] @@ -222,7 +222,7 @@ The account can be local, domain, or Azure Active Directory (Azure AD). Groups a - Azure AD account must be specified in this format: `AzureAD\{email address}`. **AzureAD** must be provided AS IS (consider it’s a fixed domain name), then follow with the Azure AD email address, e.g. **AzureAD\someone@contoso.onmicrosoft.com**. >[!WARNING] ->Although **Start** > **Settings** > **Accounts** > **Other users** > **Set up assigned access** only supports specifying a local user account, Assigned Access can be configured via WMI or CSP to run its applications under a domain user or service account, rather than a local account. However, use of domain user or service accounts introduces risks that an attacker subverting the Assigned Access application might gain access to sensitive domain resources that have been inadvertently left accessible to any domain account. We recommend that customers proceed with caution when using domain accounts with Assigned Access, and consider the domain resources potentially exposed by the decision to do so. +>Assigned Access can be configured via WMI or CSP to run its applications under a domain user or service account, rather than a local account. However, use of domain user or service accounts introduces risks that an attacker subverting the Assigned Access application might gain access to sensitive domain resources that have been inadvertently left accessible to any domain account. We recommend that customers proceed with caution when using domain accounts with Assigned Access, and consider the domain resources potentially exposed by the decision to do so. Before applying the multi-app configuration, make sure the specified user account is available on the device, otherwise it will fail. @@ -233,11 +233,11 @@ Before applying the multi-app configuration, make sure the specified user accoun ```xml - - MultiAppKioskUser - - - + + MultiAppKioskUser + + + ``` From fff16fccbb7870a0c3303141f082f75aa1bbd94d Mon Sep 17 00:00:00 2001 From: jdeckerMS Date: Thu, 10 Aug 2017 07:29:04 -0700 Subject: [PATCH 19/37] Chandler feedback --- .../lock-down-windows-10-to-specific-apps.md | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) diff --git a/windows/configuration/lock-down-windows-10-to-specific-apps.md b/windows/configuration/lock-down-windows-10-to-specific-apps.md index 0f9c3e2e49..851affbd69 100644 --- a/windows/configuration/lock-down-windows-10-to-specific-apps.md +++ b/windows/configuration/lock-down-windows-10-to-specific-apps.md @@ -474,17 +474,17 @@ Prevent access to drives from My Computer | Enabled - Restrict all drivers ### MDM policy -Some of the MDM policies affect all users on the system (i.e. system-wide). +Some of the MDM policies based on the [Policy configuration service provider (CSP)](https://docs.microsoft.com/windows/client-management/mdm/policy-configuration-service-provider) affect all users on the system (i.e. system-wide). Setting | Value | System-wide --- | --- | --- -Experience/AllowCortana | Disabled | Yes -Start/AllowPinnedFolderSettings | Disabled | Yes -Start/HidePeopleBar | Enabled | No -Start/HideChangeAccountSettings | Enabled | Yes -WindowsInkWorkspace/AllowWindowsInkWorkspace | Disabled | Yes +Experience/AllowCortana | 0 - Not allowed | Yes +Start/AllowPinnedFolderSettings | 0 - Shortcut is hidden and disables the setting in the Settings app | Yes +Start/HidePeopleBar | 1 - True (hide) | No +Start/HideChangeAccountSettings | 1 - True (hide) | Yes +WindowsInkWorkspace/AllowWindowsInkWorkspace | 0 - Access to ink workspace is disabled and the feature is turned off | Yes Start/StartLayout | Configuration dependent | No -WindowsLogon/DontDisplayNetworkSectionUI | Enabled | Yes +WindowsLogon/DontDisplayNetworkSelectionUI | <Enabled/> | Yes ## Provision .lnk files using Windows Configuration Designer From e216a81eb02c29097cd41a4670d5099b936d79f8 Mon Sep 17 00:00:00 2001 From: jdeckerMS Date: Thu, 10 Aug 2017 12:33:05 -0700 Subject: [PATCH 20/37] new troubleshooting topic multi-app --- windows/configuration/TOC.md | 1 + .../multi-app-kiosk-troubleshoot.md | 50 +++++++++++++++++++ 2 files changed, 51 insertions(+) create mode 100644 windows/configuration/multi-app-kiosk-troubleshoot.md diff --git a/windows/configuration/TOC.md b/windows/configuration/TOC.md index 4166b7475b..e418e5df3f 100644 --- a/windows/configuration/TOC.md +++ b/windows/configuration/TOC.md @@ -9,6 +9,7 @@ ### [Set up a kiosk on Windows 10 Pro, Enterprise, or Education](set-up-a-kiosk-for-windows-10-for-desktop-editions.md) ### [Guidelines for choosing an app for assigned access (kiosk mode)](guidelines-for-assigned-access-app.md) ### [Create a Windows 10 kiosk that runs multiple apps](lock-down-windows-10-to-specific-apps.md) +#### [Troubleshoot multi-app kiosk](multi-app-kiosk-troubleshoot.md) #### [Use AppLocker to create a Windows 10 kiosk that runs multiple apps](lock-down-windows-10-applocker.md) #### [Multi-app kiosk XML reference](multi-app-kiosk-xml.md) ## [Configure Windows 10 Mobile devices](mobile-devices/configure-mobile.md) diff --git a/windows/configuration/multi-app-kiosk-troubleshoot.md b/windows/configuration/multi-app-kiosk-troubleshoot.md new file mode 100644 index 0000000000..9f065e2414 --- /dev/null +++ b/windows/configuration/multi-app-kiosk-troubleshoot.md @@ -0,0 +1,50 @@ +--- +title: Troubleshoot multi-app kiosk (Windows 10) +description: Tips for troubleshooting multi-app kiosk configuration. +ms.assetid: 14DDDC96-88C7-4181-8415-B371F25726C8 +keywords: ["lockdown", "app restrictions"] +ms.prod: w10 +ms.mktglfcycl: manage +ms.sitesec: library +ms.pagetype: edu, security +author: jdeckerms +ms.localizationpriority: medium +--- + +# Troubleshoot multi-app kiosk + + +**Applies to** + +- Windows 10 + +## Unexpected results + +For example: +- Start is not launched in full-screen +- Blocked hotkeys are allowed +- Task Manager, Cortana, or Settings can be launched +- Start layout has more apps than expected + +**Troubleshooting steps** + +1. [Verify that the provisioning package is applied successfully](lock-down-windows-10-to-specific-apps.md#validate-provisioning). +2. Verify that the account (config) is mapped to a profile in the configuration XML file. +3. Verify that the configuration XML file is authored and formatted correctly. Correct any configuration errors, then create and apply a new provisioning package. Sign out and sign in again to check the new configuration. +4. If the issue persists, [capture traces](https://msdn.microsoft.com/library/windows/desktop/dn904629.aspx) for components with the following GUIDs: + - 94097d3d-2a5a-5b8a-cdbd-194dd2e51a00 + - ab84611c-2678-5cd7-d292-c940f9be6c6d + - f9f7f27c-5e5d-5273-468f-038e61965660 + - 3e8fb07b-3e10-5981-01a9-fbd924fd5436 + +## Apps configured in AllowedList are blocked + +1. Ensure the account is mapped to the correct profile and that the apps are specific for that profile. +2. Check the EventViewer logs for Applocker and AppxDeployment (under **Application and Services Logs\Microsoft\Windows**). + + +## Start layout not as expected + +- Make sure the Start layout is authored correctly. Ensure that the attributes **Size**, **Row**, and **Column** are specified for each application and are valid. +- Check if the apps included in the Start layout are installed for the assigned access user. +- Check if the shortcut exists on the target device, if a desktop app is missing on Start. From a756d2c12fc071651ff60efbb189fd9143e22c25 Mon Sep 17 00:00:00 2001 From: jdeckerMS Date: Thu, 10 Aug 2017 12:35:53 -0700 Subject: [PATCH 21/37] plus feedback --- windows/configuration/multi-app-kiosk-troubleshoot.md | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/windows/configuration/multi-app-kiosk-troubleshoot.md b/windows/configuration/multi-app-kiosk-troubleshoot.md index 9f065e2414..2e4d7088da 100644 --- a/windows/configuration/multi-app-kiosk-troubleshoot.md +++ b/windows/configuration/multi-app-kiosk-troubleshoot.md @@ -48,3 +48,7 @@ For example: - Make sure the Start layout is authored correctly. Ensure that the attributes **Size**, **Row**, and **Column** are specified for each application and are valid. - Check if the apps included in the Start layout are installed for the assigned access user. - Check if the shortcut exists on the target device, if a desktop app is missing on Start. + +## Feedback + +Feedback and bugs can be submitted in the Feedback Hub. You can use the Problems Steps Recorder to reproduce the issue, and attach the resulting .zip file to your feedback. \ No newline at end of file From 3b96acd451e306aa12d1c1e3dde8bbadff17e464 Mon Sep 17 00:00:00 2001 From: jdeckerMS Date: Thu, 10 Aug 2017 12:37:01 -0700 Subject: [PATCH 22/37] add link --- windows/configuration/multi-app-kiosk-troubleshoot.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/configuration/multi-app-kiosk-troubleshoot.md b/windows/configuration/multi-app-kiosk-troubleshoot.md index 2e4d7088da..6d9ef040cc 100644 --- a/windows/configuration/multi-app-kiosk-troubleshoot.md +++ b/windows/configuration/multi-app-kiosk-troubleshoot.md @@ -51,4 +51,4 @@ For example: ## Feedback -Feedback and bugs can be submitted in the Feedback Hub. You can use the Problems Steps Recorder to reproduce the issue, and attach the resulting .zip file to your feedback. \ No newline at end of file +Feedback and bugs can be submitted in the Feedback Hub. You can use the [Problems Steps Recorder](https://support.microsoft.com/help/22878/windows-10-record-steps) to reproduce the issue, and attach the resulting .zip file to your feedback. \ No newline at end of file From 9fbecd8f17baccaae5ce699651f437a03f1dd246 Mon Sep 17 00:00:00 2001 From: jdeckerMS Date: Thu, 10 Aug 2017 12:41:06 -0700 Subject: [PATCH 23/37] add policy links --- .../lock-down-windows-10-to-specific-apps.md | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/windows/configuration/lock-down-windows-10-to-specific-apps.md b/windows/configuration/lock-down-windows-10-to-specific-apps.md index 851affbd69..da932fc46b 100644 --- a/windows/configuration/lock-down-windows-10-to-specific-apps.md +++ b/windows/configuration/lock-down-windows-10-to-specific-apps.md @@ -478,13 +478,13 @@ Some of the MDM policies based on the [Policy configuration service provider (CS Setting | Value | System-wide --- | --- | --- -Experience/AllowCortana | 0 - Not allowed | Yes -Start/AllowPinnedFolderSettings | 0 - Shortcut is hidden and disables the setting in the Settings app | Yes +[Experience/AllowCortana](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-experience#experience-allowcortana) | 0 - Not allowed | Yes +[Start/AllowPinnedFolderSettings](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-start#start-allowpinnedfoldersettings) | 0 - Shortcut is hidden and disables the setting in the Settings app | Yes Start/HidePeopleBar | 1 - True (hide) | No -Start/HideChangeAccountSettings | 1 - True (hide) | Yes -WindowsInkWorkspace/AllowWindowsInkWorkspace | 0 - Access to ink workspace is disabled and the feature is turned off | Yes -Start/StartLayout | Configuration dependent | No -WindowsLogon/DontDisplayNetworkSelectionUI | <Enabled/> | Yes +[Start/HideChangeAccountSettings](https://docs.microsoft.com/en-us/windows/client-management/mdm/policy-csp-start#start-hidechangeaccountsettings) | 1 - True (hide) | Yes +[WindowsInkWorkspace/AllowWindowsInkWorkspace](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-windowsinkworkspace#windowsinkworkspace-allowwindowsinkworkspace) | 0 - Access to ink workspace is disabled and the feature is turned off | Yes +[Start/StartLayout](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-start#start-startlayout) | Configuration dependent | No +[WindowsLogon/DontDisplayNetworkSelectionUI](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-windowslogon#windowslogon-dontdisplaynetworkselectionui) | <Enabled/> | Yes ## Provision .lnk files using Windows Configuration Designer From aa9bb660860770c7285d390d73643f46c40226fb Mon Sep 17 00:00:00 2001 From: jdeckerMS Date: Fri, 11 Aug 2017 06:36:54 -0700 Subject: [PATCH 24/37] sync --- .../lock-down-windows-10-to-specific-apps.md | 39 ++++++++++++++----- 1 file changed, 30 insertions(+), 9 deletions(-) diff --git a/windows/configuration/lock-down-windows-10-to-specific-apps.md b/windows/configuration/lock-down-windows-10-to-specific-apps.md index da932fc46b..41c14f7bac 100644 --- a/windows/configuration/lock-down-windows-10-to-specific-apps.md +++ b/windows/configuration/lock-down-windows-10-to-specific-apps.md @@ -1,6 +1,6 @@ --- title: Create a Windows 10 kiosk that runs multiple apps (Windows 10) -description: Learn how to configure a kiosk device running Windows 10 Enterprise or Windows 10 Education so that users can only run a few specific apps. +description: Learn how to configure a kiosk device running Windows 10 so that users can only run a few specific apps. ms.assetid: 14DDDC96-88C7-4181-8415-B371F25726C8 keywords: ["lockdown", "app restrictions", "applocker"] ms.prod: w10 @@ -34,10 +34,12 @@ Process: 2. [Add XML file to provisioning package](#add-xml) 3. [Apply provisioning package to device](#apply-ppkg) +If you don't want to use a provisioning package, you can deploy the configuration XML file using [mobile device management (MDM)](#alternate-methods) or you can configure assigned access using the [MDM Bridge WMI Provider](#bridge). + ## Prerequisites - (latest version of WCD -- is Store version okay at GA?) -- The kiosk device must be running Windows 10 (Pro, Enterprise, or Education), version 1709 +- The kiosk device must be running Windows 10 (S, Pro, Enterprise, or Education), version 1709 ## Create XML file @@ -343,12 +345,31 @@ Provisioning packages can be applied to a device during the first-run experience ![add a package option](images/package.png) + + ### Validate provisioning - Go to **Settings** > **Accounts** > **Access work or school**, and then click **Add or remove a provisioning package**. You should see a list of packages that were applied to the device, including the one you applied for the multi-app configuration. - Optionally, run Event Viewer (eventvwr.exe) and look through logs under **Applications and Services Logs** > **Microsoft** > **Windows** > **Provisioning-Diagnostics-Provider** > **Admin**. -### Validate multi-app kiosk configuration + + +## Use MDM to deploy the multi-app configuration + + +Multi-app kiosk mode is enabled by the [AssignedAccess configuration service provider (CSP)](https://docs.microsoft.com/windows/client-management/mdm/assignedaccess-csp). Your MDM policy can contain the assigned access configuration XML. + +If your test device is enrolled with a MDM server which supports applying the assigned access configuration, you can use it to apply the setting remotely. + +The OMA-URI for multi-app policy is `./Device/Vendor/MSFT/AssignedAccess/Configuration`. + + + +## Use MDM Bridge WMI Provider to configure assigned access + + + +## Validate multi-app kiosk configuration Sign in with the assigned access user account you specified in the configuration to check out the multi-app experience. @@ -357,13 +378,13 @@ Sign in with the assigned access user account you specified in the configuration The following sections explain what to expect on a multi-app kiosk. -#### App launching and switching experience +### App launching and switching experience In the multi-app mode, to maximize the user productivity and streamline the experience, an app will be always launched in full screen when the users click the tile on the Start. The users can minimize and close the app, but cannot resize the app window. The users can switch apps just as they do today in Windows. They can use the Task View button, Alt + Tab hotkey, and the swipe in from the left gesture to view all the open apps in task view. They can click the Windows button to show Start, from which they can open apps, and they can switch to an opened app by clicking it on the taskbar. -#### Start changes +### Start changes When the assigned access user signs in, you should see a restricted Start experience: - Start gets launched in full screen and prevents the end user from accessing the desktop. @@ -376,7 +397,7 @@ When the assigned access user signs in, you should see a restricted Start experi - Only **User** and **Power** buttons are available. (You can control whether to show the **User/Power** buttons using [existing policies](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-start).) - Start hides **Change account settings** option under **User** button. -#### Taskbar changes +### Taskbar changes If the applied multi-app configuration enables taskbar, when the assigned access user signs in, you should see a restricted Taskbar experience: - Disables context menu of Start button (Quick Link) @@ -386,7 +407,7 @@ If the applied multi-app configuration enables taskbar, when the assigned access - Hides notification icons and system icons, e.g. Action Center, People, Windows Ink Workspace - Allows the end user to view the status of the network connection and power state, but disables the flyout of **Network/Power** to prevent end user from changing the settings -#### Blocked hotkeys +### Blocked hotkeys The multi-app mode blocks the following hotkeys, which are not relevant for the lockdown experience. @@ -411,11 +432,11 @@ The multi-app mode blocks the following hotkeys, which are not relevant for the -#### Locked-down Ctrl+Alt+Del screen +### Locked-down Ctrl+Alt+Del screen The multi-app mode removes options (e.g. **Change a password**, **Task Manager**, **Network**) in the Ctrl+Alt+Del screen to ensure the users cannot access the functionalities that are not allowed in the lockdown experience. -#### Auto-trigger touch keyboard +### Auto-trigger touch keyboard In the multi-app mode, the touch keyboard will be automatically triggered when there is an input needed and no physical keyboard is attached on touch-enabled devices. You don’t need to configure any other setting to enforce this behavior. From 6b9c893a165dd1f242f418767bc40f827fa31077 Mon Sep 17 00:00:00 2001 From: jdeckerMS Date: Fri, 11 Aug 2017 09:10:37 -0700 Subject: [PATCH 25/37] add WMI Bridge --- .../lock-down-windows-10-to-specific-apps.md | 66 +++++++++++++++++++ 1 file changed, 66 insertions(+) diff --git a/windows/configuration/lock-down-windows-10-to-specific-apps.md b/windows/configuration/lock-down-windows-10-to-specific-apps.md index 41c14f7bac..c8b830041f 100644 --- a/windows/configuration/lock-down-windows-10-to-specific-apps.md +++ b/windows/configuration/lock-down-windows-10-to-specific-apps.md @@ -367,6 +367,72 @@ The OMA-URI for multi-app policy is `./Device/Vendor/MSFT/AssignedAccess/Configu ## Use MDM Bridge WMI Provider to configure assigned access +Environments that use WMI can use the [MDM Bridge WMI Provider](https://msdn.microsoft.com/library/windows/desktop/dn905224.aspx) to configure the MDM_AssignedAccess class. See [PowerShell Scripting with WMI Bridge Provider](https://msdn.microsoft.com/windows/hardware/commercialize/customize/mdm/using-powershell-scripting-with-the-wmi-bridge-provider) for more details about using a PowerShell script to configure AssignedAccess. + +Here’s an example to set AssignedAccess configuration: + +1. Download the [psexec tool](https://technet.microsoft.com/sysinternals/bb897553.aspx). +2. Run `psexec.exe -i -s cmd.exe`. +3. **WHAT GOES HERE? DOC JUST SAYS "powershell"** +4. Execute the following script: + +```ps +$nameSpaceName="root\cimv2\mdm\dmmap" +$className="MDM_AssignedAccess" +$obj = Get-CimInstance -Namespace $namespaceName -ClassName $className +$obj.Configuration = @" +<?xml version="1.0" encoding="utf-8" ?> +<AssignedAccessConfiguration xmlns="http://schemas.microsoft.com/AssignedAccess/2017/config"> + <Profiles> + <Profile Id="{9A2A490F-10F6-4764-974A-43B19E722C23}"> + <AllAppsList> + <AllowedApps> + <App AppUserModelId="Microsoft.ZuneMusic_8wekyb3d8bbwe!Microsoft.ZuneMusic" /> + <App AppUserModelId="Microsoft.ZuneVideo_8wekyb3d8bbwe!Microsoft.ZuneVideo" /> + <App AppUserModelId="Microsoft.Windows.Photos_8wekyb3d8bbwe!App" /> + <App AppUserModelId="Microsoft.BingWeather_8wekyb3d8bbwe!App" /> + <App AppUserModelId="Microsoft.WindowsCalculator_8wekyb3d8bbwe!App" /> + <App DesktopAppPath="%windir%\system32\mspaint.exe" /> + <App DesktopAppPath="C:\Windows\System32\notepad.exe" /> + </AllowedApps> + </AllAppsList> + <StartLayout> + <![CDATA[<LayoutModificationTemplate xmlns:defaultlayout="http://schemas.microsoft.com/Start/2014/FullDefaultLayout" xmlns:start="http://schemas.microsoft.com/Start/2014/StartLayout" Version="1" xmlns="http://schemas.microsoft.com/Start/2014/LayoutModification"> + <LayoutOptions StartTileGroupCellWidth="6" /> + <DefaultLayoutOverride> + <StartLayoutCollection> + <defaultlayout:StartLayout GroupCellWidth="6"> + <start:Group Name="Group1"> + <start:Tile Size="4x4" Column="0" Row="0" AppUserModelID="Microsoft.ZuneMusic_8wekyb3d8bbwe!Microsoft.ZuneMusic" /> + <start:Tile Size="2x2" Column="4" Row="2" AppUserModelID="Microsoft.ZuneVideo_8wekyb3d8bbwe!Microsoft.ZuneVideo" /> + <start:Tile Size="2x2" Column="4" Row="0" AppUserModelID="Microsoft.Windows.Photos_8wekyb3d8bbwe!App" /> + <start:Tile Size="2x2" Column="4" Row="4" AppUserModelID="Microsoft.BingWeather_8wekyb3d8bbwe!App" /> + <start:Tile Size="4x2" Column="0" Row="4" AppUserModelID="Microsoft.WindowsCalculator_8wekyb3d8bbwe!App" /> + </start:Group> + <start:Group Name="Group2"> + <start:DesktopApplicationTile Size="2x2" Column="2" Row="0" DesktopApplicationLinkPath="%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\Accessories\Paint.lnk" /> + <start:DesktopApplicationTile Size="2x2" Column="0" Row="0" DesktopApplicationLinkPath="%APPDATA%\Microsoft\Windows\Start Menu\Programs\Accessories\Notepad.lnk" /> + </start:Group> + </defaultlayout:StartLayout> + </StartLayoutCollection> + </DefaultLayoutOverride> + </LayoutModificationTemplate> + ]]> + </StartLayout> + <Taskbar ShowTaskbar="true"/> + </Profile> + </Profiles> + <Configs> + <Config> + <Account>MultiAppKioskUser</Account> + <DefaultProfile Id="{9A2A490F-10F6-4764-974A-43B19E722C23}"/> + </Config> + </Configs> +</AssignedAccessConfiguration> +"@ + +Set-CimInstance -CimInstance $obj +``` ## Validate multi-app kiosk configuration From bc67748390c8a8b2da57ac3d9e895b48451fad55 Mon Sep 17 00:00:00 2001 From: jdeckerMS Date: Fri, 11 Aug 2017 09:38:20 -0700 Subject: [PATCH 26/37] Lily feedback --- .../lock-down-windows-10-to-specific-apps.md | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/windows/configuration/lock-down-windows-10-to-specific-apps.md b/windows/configuration/lock-down-windows-10-to-specific-apps.md index c8b830041f..cb6ea2db23 100644 --- a/windows/configuration/lock-down-windows-10-to-specific-apps.md +++ b/windows/configuration/lock-down-windows-10-to-specific-apps.md @@ -224,13 +224,13 @@ The account can be local, domain, or Azure Active Directory (Azure AD). Groups a - Azure AD account must be specified in this format: `AzureAD\{email address}`. **AzureAD** must be provided AS IS (consider it’s a fixed domain name), then follow with the Azure AD email address, e.g. **AzureAD\someone@contoso.onmicrosoft.com**. >[!WARNING] ->Assigned Access can be configured via WMI or CSP to run its applications under a domain user or service account, rather than a local account. However, use of domain user or service accounts introduces risks that an attacker subverting the Assigned Access application might gain access to sensitive domain resources that have been inadvertently left accessible to any domain account. We recommend that customers proceed with caution when using domain accounts with Assigned Access, and consider the domain resources potentially exposed by the decision to do so. +>Assigned access can be configured via WMI or CSP to run its applications under a domain user or service account, rather than a local account. However, use of domain user or service accounts introduces risks that an attacker subverting the assigned access application might gain access to sensitive domain resources that have been inadvertently left accessible to any domain account. We recommend that customers proceed with caution when using domain accounts with assigned access, and consider the domain resources potentially exposed by the decision to do so. Before applying the multi-app configuration, make sure the specified user account is available on the device, otherwise it will fail. >[!NOTE] ->For both domain and Azure AD accounts, it’s not required that target account is explicitly added to the device. As long as the device is AD-joined or Azure AD-joined, the account can be discovered in the domain forest or tenant that the device is joined to. For local accounts, it is required that the account exist before you configure the account for AssignedAccess. +>For both domain and Azure AD accounts, it’s not required that target account is explicitly added to the device. As long as the device is AD-joined or Azure AD-joined, the account can be discovered in the domain forest or tenant that the device is joined to. For local accounts, it is required that the account exist before you configure the account for assigned access. ```xml @@ -521,6 +521,11 @@ In the multi-app mode, the touch keyboard will be automatically triggered when t ## Policies set by multi-app kiosk configuration +It is not recommended to set policies enforced in assigned access multi-app mode to different values using other channels, as the multi-app mode has been optimized to provide a locked-down experience. + +When the multi-app assigned access configuration is applied on the device, certain policies are enforced system-wide, and will impact other users on the device. + + ### Group Policy The following local policies affect all **non-administrator** users on the system, regardless whether the user is configured as an assigned access user or not. This includes local users, domain users, and Azure Active Directory users. From 2d85f06145509ee674f5d7f339823568804160a5 Mon Sep 17 00:00:00 2001 From: jdeckerMS Date: Fri, 11 Aug 2017 09:45:12 -0700 Subject: [PATCH 27/37] Chien-Her feedback --- .../configuration/lock-down-windows-10-to-specific-apps.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/configuration/lock-down-windows-10-to-specific-apps.md b/windows/configuration/lock-down-windows-10-to-specific-apps.md index cb6ea2db23..f05e2550d7 100644 --- a/windows/configuration/lock-down-windows-10-to-specific-apps.md +++ b/windows/configuration/lock-down-windows-10-to-specific-apps.md @@ -21,7 +21,7 @@ ms.localizationpriority: high A [kiosk device](set-up-a-kiosk-for-windows-10-for-desktop-editions.md) typically runs a single app, and users are prevented from accessing any features or functions on the device outside of the kiosk app. In Windows 10, version 1709, the [AssignedAccess configuration service provider (CSP)](https://docs.microsoft.com/windows/client-management/mdm/assignedaccess-csp) has been expanded to make it easy for administrators to create kiosks that run more than one app. You can configure multi-app kiosks using a provisioning package. >[!NOTE] ->For devices running versions of Windows 10 earlier than version 1709, you can [create AppLocker rules](lock-down-windows-10-applocker.md) to configure a multi-app kiosk. +>For devices running versions of Windows 10 earlier than version 1709, you can [create AppLocker rules](lock-down-windows-10-applocker.md) to configure a multi-app kiosk. Avoid applying AppLocker rules to devices running the multi-app kiosk configuration described in this topic. The benefit of a multi-app kiosk, or fixed-purpose device, is to provide an easy-to-understand experience for individuals by putting in front of them only the things they need to use, and removing from their view the things they don’t need to access. @@ -109,7 +109,7 @@ The profile **Id** is a GUID attribute to uniquely identify the profile. You can Based on the purpose of the kiosk device, define the list of applications that are allowed to run. This list can contain both UWP apps and desktop apps. When the mult-app kiosk configuration is applied to a device, AppLocker rules will be generated to allow the apps that are listed in the configuration. >[!NOTE] ->You cannot manage AppLocker rules that are generated by the multi-app kiosk configuration in [MMC snap-ins](https://technet.microsoft.com/library/hh994629.aspx#BKMK_Using_Snapins). +>You cannot manage AppLocker rules that are generated by the multi-app kiosk configuration in [MMC snap-ins](https://technet.microsoft.com/library/hh994629.aspx#BKMK_Using_Snapins). Avoid applying AppLocker rules to devices running the multi-app kiosk configuration. - For UWP apps, you need to provide the App User Model ID (AUMID). [Learn how to get the AUMID](https://go.microsoft.com/fwlink/p/?LinkId=614867), or [get the AUMID from the Start Layout XML](#startlayout). - For desktop apps, you need to specify the full path of the executable, which can contain one or more system environment variables in the form of %variableName% (i.e. %systemroot%, %windir%). From 7fddc375e7014407e015a982346103e87ef5df10 Mon Sep 17 00:00:00 2001 From: jdeckerMS Date: Fri, 11 Aug 2017 09:48:37 -0700 Subject: [PATCH 28/37] fix link --- windows/configuration/lock-down-windows-10-to-specific-apps.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/configuration/lock-down-windows-10-to-specific-apps.md b/windows/configuration/lock-down-windows-10-to-specific-apps.md index f05e2550d7..644d811400 100644 --- a/windows/configuration/lock-down-windows-10-to-specific-apps.md +++ b/windows/configuration/lock-down-windows-10-to-specific-apps.md @@ -247,7 +247,7 @@ Before applying the multi-app configuration, make sure the specified user accoun ## Add XML file to provisioning package -Before you add the XML file to a provisioning package, you can [validate your configuration XML against the XSD](multi-app-kiosk-xml.md). +Before you add the XML file to a provisioning package, you can [validate your configuration XML against the XSD](multi-app-kiosk-xml.md#xsd-for-assignedaccess-configuration-xml). Use the Windows Configuration Designer tool to create a provisioning package. [Learn how to install Windows Configuration Designer.](provisioning-packages/provisioning-install-icd.md) From 588b2a64b717a578812bca04d286bcff0200ff9b Mon Sep 17 00:00:00 2001 From: jdeckerMS Date: Mon, 14 Aug 2017 12:07:14 -0700 Subject: [PATCH 29/37] fixed meta fields --- windows/configuration/lock-down-windows-10-applocker.md | 2 ++ windows/configuration/lock-down-windows-10-to-specific-apps.md | 2 ++ windows/configuration/multi-app-kiosk-troubleshoot.md | 2 ++ windows/configuration/multi-app-kiosk-xml.md | 2 ++ 4 files changed, 8 insertions(+) diff --git a/windows/configuration/lock-down-windows-10-applocker.md b/windows/configuration/lock-down-windows-10-applocker.md index 398e2d77e9..d4422e7212 100644 --- a/windows/configuration/lock-down-windows-10-applocker.md +++ b/windows/configuration/lock-down-windows-10-applocker.md @@ -9,6 +9,8 @@ ms.sitesec: library ms.pagetype: edu, security author: jdeckerms ms.localizationpriority: high +ms.date: 10/05/2017 +ms.author: jdecker --- # Use AppLocker to create a Windows 10 kiosk that runs multiple apps diff --git a/windows/configuration/lock-down-windows-10-to-specific-apps.md b/windows/configuration/lock-down-windows-10-to-specific-apps.md index 644d811400..3d5708f045 100644 --- a/windows/configuration/lock-down-windows-10-to-specific-apps.md +++ b/windows/configuration/lock-down-windows-10-to-specific-apps.md @@ -9,6 +9,8 @@ ms.sitesec: library ms.pagetype: edu, security author: jdeckerms ms.localizationpriority: high +ms.date: 10/05/2017 +ms.author: jdecker --- # Create a Windows 10 kiosk that runs multiple apps diff --git a/windows/configuration/multi-app-kiosk-troubleshoot.md b/windows/configuration/multi-app-kiosk-troubleshoot.md index 6d9ef040cc..def3c5d507 100644 --- a/windows/configuration/multi-app-kiosk-troubleshoot.md +++ b/windows/configuration/multi-app-kiosk-troubleshoot.md @@ -9,6 +9,8 @@ ms.sitesec: library ms.pagetype: edu, security author: jdeckerms ms.localizationpriority: medium +ms.date: 10/05/2017 +ms.author: jdecker --- # Troubleshoot multi-app kiosk diff --git a/windows/configuration/multi-app-kiosk-xml.md b/windows/configuration/multi-app-kiosk-xml.md index 642995cf1e..d355221ba5 100644 --- a/windows/configuration/multi-app-kiosk-xml.md +++ b/windows/configuration/multi-app-kiosk-xml.md @@ -9,6 +9,8 @@ ms.sitesec: library ms.pagetype: edu, security author: jdeckerms ms.localizationpriority: medium +ms.date: 10/05/2017 +ms.author: jdecker --- # Multi-app kiosk XML reference From 2b87e7e324f520425b5327d82d15c65a7b56c880 Mon Sep 17 00:00:00 2001 From: jdeckerMS Date: Wed, 16 Aug 2017 12:22:04 -0700 Subject: [PATCH 30/37] MR kiosk --- .../lock-down-windows-10-to-specific-apps.md | 14 +++++++++++++- 1 file changed, 13 insertions(+), 1 deletion(-) diff --git a/windows/configuration/lock-down-windows-10-to-specific-apps.md b/windows/configuration/lock-down-windows-10-to-specific-apps.md index 3d5708f045..c9c2485ef7 100644 --- a/windows/configuration/lock-down-windows-10-to-specific-apps.md +++ b/windows/configuration/lock-down-windows-10-to-specific-apps.md @@ -515,10 +515,22 @@ In the multi-app mode, the touch keyboard will be automatically triggered when t ## Considerations for mixed-reality devices -*There are some Mixed Reality specific bits we wanted to include. For example, the IT Admin needs to include the Mixed Reality Portal as an allowed app if they want to include Mixed Reality apps in kiosk mode.* +With the advent of [mixed-reality devices (video link)](https://www.youtube.com/watch?v=u0jqNioU2Lo), you might want to create a kiosk that can run mixed-reality apps. +To create a multi-app kiosk that can run mixed reality apps, you must include the following apps in the [AllowedApps list](#allowedapps): +- +- +- + +These are in addition to any mixed reality apps that you allow. + +**Before your kiosk user signs in:** An admin user must sign in to the PC, connect a mixed reality device, and complete the guided setup for the Mixed Reality Portal. The first time that the Mixed Reality Portal is set up, some files and content are downloaded. A kiosk user would not have permissions to download and so their setup of the Mixed Reality Portal would fail. + +After the admin has completed setup, the kiosk account can sign in and repeat the setup. The admin user may want to complete the kiosk user setup before providing the PC to employees or customers. + +There is a difference between the mixed reality experiences for a kiosk user and other users. Typically, when a user connects a mixed reality device, they begin in the [Mixed Reality home](https://developer.microsoft.com/windows/mixed-reality/navigating_the_windows_mixed_reality_home). The Mixed Reality home is a shell that runs in "silent" mode when the PC is configured as a kiosk. When a kiosk user connects a mixed reality device, they will see only a blank display in the device, and will not have access to the features and functionality available in the home. To run a mixed reality app, the kiosk user must launch the app from the PC Start screen. ## Policies set by multi-app kiosk configuration From b2e8ce08843fad85db358d43a3747994d3d702bd Mon Sep 17 00:00:00 2001 From: jdeckerMS Date: Wed, 16 Aug 2017 12:36:19 -0700 Subject: [PATCH 31/37] fix format --- .../configuration/lock-down-windows-10-to-specific-apps.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/windows/configuration/lock-down-windows-10-to-specific-apps.md b/windows/configuration/lock-down-windows-10-to-specific-apps.md index c9c2485ef7..522492d226 100644 --- a/windows/configuration/lock-down-windows-10-to-specific-apps.md +++ b/windows/configuration/lock-down-windows-10-to-specific-apps.md @@ -520,9 +520,9 @@ With the advent of [mixed-reality devices (video link)](https://www.youtube.com/ To create a multi-app kiosk that can run mixed reality apps, you must include the following apps in the [AllowedApps list](#allowedapps): -- -- -- +- `` +- `` +- `` These are in addition to any mixed reality apps that you allow. From 1bd8cd5d0dd63c39a1547f9fe45aa596386b5d03 Mon Sep 17 00:00:00 2001 From: jdeckerMS Date: Wed, 16 Aug 2017 12:49:43 -0700 Subject: [PATCH 32/37] test --- windows/configuration/lock-down-windows-10-to-specific-apps.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/configuration/lock-down-windows-10-to-specific-apps.md b/windows/configuration/lock-down-windows-10-to-specific-apps.md index 522492d226..d306a1794f 100644 --- a/windows/configuration/lock-down-windows-10-to-specific-apps.md +++ b/windows/configuration/lock-down-windows-10-to-specific-apps.md @@ -520,7 +520,7 @@ With the advent of [mixed-reality devices (video link)](https://www.youtube.com/ To create a multi-app kiosk that can run mixed reality apps, you must include the following apps in the [AllowedApps list](#allowedapps): -- `` +- `` test - `` - `` From cc4b1ebc7ed0b9c7179b0c1a9d3a7178510aab2d Mon Sep 17 00:00:00 2001 From: jdeckerMS Date: Wed, 16 Aug 2017 12:51:34 -0700 Subject: [PATCH 33/37] remove test --- windows/configuration/lock-down-windows-10-to-specific-apps.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/configuration/lock-down-windows-10-to-specific-apps.md b/windows/configuration/lock-down-windows-10-to-specific-apps.md index d306a1794f..522492d226 100644 --- a/windows/configuration/lock-down-windows-10-to-specific-apps.md +++ b/windows/configuration/lock-down-windows-10-to-specific-apps.md @@ -520,7 +520,7 @@ With the advent of [mixed-reality devices (video link)](https://www.youtube.com/ To create a multi-app kiosk that can run mixed reality apps, you must include the following apps in the [AllowedApps list](#allowedapps): -- `` test +- `` - `` - `` From 326bea237934aad4d65430233388c1bad260c5a6 Mon Sep 17 00:00:00 2001 From: jdeckerMS Date: Wed, 16 Aug 2017 12:57:17 -0700 Subject: [PATCH 34/37] reformat --- .../lock-down-windows-10-to-specific-apps.md | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/windows/configuration/lock-down-windows-10-to-specific-apps.md b/windows/configuration/lock-down-windows-10-to-specific-apps.md index 522492d226..68e5b214ee 100644 --- a/windows/configuration/lock-down-windows-10-to-specific-apps.md +++ b/windows/configuration/lock-down-windows-10-to-specific-apps.md @@ -520,9 +520,11 @@ With the advent of [mixed-reality devices (video link)](https://www.youtube.com/ To create a multi-app kiosk that can run mixed reality apps, you must include the following apps in the [AllowedApps list](#allowedapps): -- `` -- `` -- `` +```xml + + + +``` These are in addition to any mixed reality apps that you allow. From 1f00f87eeb91469ce0400ee303618ec723ca8361 Mon Sep 17 00:00:00 2001 From: jdeckerMS Date: Wed, 16 Aug 2017 13:38:58 -0700 Subject: [PATCH 35/37] fix format --- .../configuration/lock-down-windows-10-to-specific-apps.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/configuration/lock-down-windows-10-to-specific-apps.md b/windows/configuration/lock-down-windows-10-to-specific-apps.md index 68e5b214ee..93da718408 100644 --- a/windows/configuration/lock-down-windows-10-to-specific-apps.md +++ b/windows/configuration/lock-down-windows-10-to-specific-apps.md @@ -513,10 +513,10 @@ In the multi-app mode, the touch keyboard will be automatically triggered when t -## Considerations for mixed-reality devices +## Considerations for mixed reality devices -With the advent of [mixed-reality devices (video link)](https://www.youtube.com/watch?v=u0jqNioU2Lo), you might want to create a kiosk that can run mixed-reality apps. +With the advent of [mixed reality devices (video link)](https://www.youtube.com/watch?v=u0jqNioU2Lo), you might want to create a kiosk that can run mixed reality apps. To create a multi-app kiosk that can run mixed reality apps, you must include the following apps in the [AllowedApps list](#allowedapps): From 70c1756f3a73c5f7875db440c695afe4ccc3806c Mon Sep 17 00:00:00 2001 From: jdeckerMS Date: Tue, 29 Aug 2017 06:26:17 -0700 Subject: [PATCH 36/37] fixed MR section heading --- windows/configuration/lock-down-windows-10-to-specific-apps.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/configuration/lock-down-windows-10-to-specific-apps.md b/windows/configuration/lock-down-windows-10-to-specific-apps.md index 93da718408..173cf6862b 100644 --- a/windows/configuration/lock-down-windows-10-to-specific-apps.md +++ b/windows/configuration/lock-down-windows-10-to-specific-apps.md @@ -513,7 +513,7 @@ In the multi-app mode, the touch keyboard will be automatically triggered when t -## Considerations for mixed reality devices +## Considerations for Windows Mixed Reality immersive headsets With the advent of [mixed reality devices (video link)](https://www.youtube.com/watch?v=u0jqNioU2Lo), you might want to create a kiosk that can run mixed reality apps. From a7581f6be6c09f01f97c41ced21ade0e44449e87 Mon Sep 17 00:00:00 2001 From: jdeckerMS Date: Wed, 6 Sep 2017 07:15:33 -0700 Subject: [PATCH 37/37] wmi powershell --- windows/configuration/lock-down-windows-10-to-specific-apps.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/configuration/lock-down-windows-10-to-specific-apps.md b/windows/configuration/lock-down-windows-10-to-specific-apps.md index 173cf6862b..64859ceeb0 100644 --- a/windows/configuration/lock-down-windows-10-to-specific-apps.md +++ b/windows/configuration/lock-down-windows-10-to-specific-apps.md @@ -375,7 +375,7 @@ Here’s an example to set AssignedAccess configuration: 1. Download the [psexec tool](https://technet.microsoft.com/sysinternals/bb897553.aspx). 2. Run `psexec.exe -i -s cmd.exe`. -3. **WHAT GOES HERE? DOC JUST SAYS "powershell"** +3. In the command prompt launched by psexec.exe, enter `powershell.exe` to open PowerShell. 4. Execute the following script: ```ps