From 93dd413ce5c6bca582d49ffe74d00ac8a3b9de0f Mon Sep 17 00:00:00 2001
From: SaiDuanZX <44047860+SaiDuanZX@users.noreply.github.com>
Date: Wed, 22 Jan 2020 15:39:25 +0800
Subject: [PATCH 0001/1414] Request more clear guidelines to add a Desktop App
Please talk with WIP product team and get a more clear guideline about how to add a new Desktop app to protected apps or exempted apps based on the PowerShell, the current guideline does not provide anything about how to get the "Product Name" field which we must to fill in and there are many possible different format of Product Name we may able to use.
---
.../create-wip-policy-using-intune-azure.md | 2 ++
1 file changed, 2 insertions(+)
diff --git a/windows/security/information-protection/windows-information-protection/create-wip-policy-using-intune-azure.md b/windows/security/information-protection/windows-information-protection/create-wip-policy-using-intune-azure.md
index b3f555bb13..a02c440908 100644
--- a/windows/security/information-protection/windows-information-protection/create-wip-policy-using-intune-azure.md
+++ b/windows/security/information-protection/windows-information-protection/create-wip-policy-using-intune-azure.md
@@ -214,6 +214,8 @@ Path Publisher
Where `O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US` is the **Publisher** name and `WORDPAD.EXE` is the **File** name.
+Regarding to how to get the Product Name for the Apps you wish to Add, please reach out to our Windows Support Team to request the guidelines
+
### Import a list of apps
This section covers two examples of using an AppLocker XML file to the **Protected apps** list. You’ll use this option if you want to add multiple apps at the same time.
From fabf1b6d14b37581fe381e8890bdbb45b66b125e Mon Sep 17 00:00:00 2001
From: MaratMussabekov <48041687+MaratMussabekov@users.noreply.github.com>
Date: Wed, 29 Jan 2020 09:59:21 +0500
Subject: [PATCH 0002/1414] Update hello-hybrid-cert-whfb-settings-pki.md
---
.../hello-hybrid-cert-whfb-settings-pki.md | 20 +++++++++++++++++++
1 file changed, 20 insertions(+)
diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-settings-pki.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-settings-pki.md
index 7c4e019e6d..7631e6620b 100644
--- a/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-settings-pki.md
+++ b/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-settings-pki.md
@@ -156,6 +156,26 @@ Sign-in to an **AD FS Windows Server 2016** computer with _Enterprise Admin_ equ
> [!NOTE]
> If you gave your Windows Hello for Business Authentication certificate template a different name, then replace **WHFBAuthentication** in the above command with the name of your certificate template. It's important that you use the template name rather than the template display name. You can view the template name on the **General** tab of the certificate template using the Certificate Template management console (certtmpl.msc). Or, you can view the template name using the **Get-CATemplate** ADCS Administration Windows PowerShell cmdlet on our Windows Server 2012 or later certificate authority.
+> [!IMPORTANT]
+> If the template was changed successfully, the output of the command will contain old and new values of the template parameters. New value must contain **CTPRIVATEKEY_FLAG_HELLO_LOGON_KEY** parameter. For example:
+>
+> CN=Certificate Templates,CN=Public Key Services,CN=Services,CN=Configuration,DC=[yourdomain]:WHFBAuthentication
+>
+> Old Value:
+> msPKI-Private-Key-Flag REG_DWORD = 5050080 (84213888)
+> CTPRIVATEKEY_FLAG_REQUIRE_SAME_KEY_RENEWAL -- 80 (128)
+> CTPRIVATEKEY_FLAG_ATTEST_NONE -- 0
+> TEMPLATE_SERVER_VER_WINBLUE< TEMPLATE_CLIENT_VER_WINBLUE< New Value:
+> msPKI-Private-Key-Flag REG_DWORD = 5250080 (86311040)
+> CTPRIVATEKEY_FLAG_REQUIRE_SAME_KEY_RENEWAL -- 80 (128)
+> CTPRIVATEKEY_FLAG_ATTEST_NONE -- 0
+> TEMPLATE_SERVER_VER_WINBLUE< CTPRIVATEKEY_FLAG_HELLO_LOGON_KEY -- 200000 (2097152)
+> TEMPLATE_CLIENT_VER_WINBLUE< CertUtil: -dsTemplate command completed successfully."
+
## Publish Templates
### Publish Certificate Templates to a Certificate Authority
From 8985b4a89eff9cd639b3ea486ed3a79c4b06581f Mon Sep 17 00:00:00 2001
From: MaratMussabekov <48041687+MaratMussabekov@users.noreply.github.com>
Date: Thu, 30 Jan 2020 12:05:15 +0500
Subject: [PATCH 0003/1414] Update
windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-settings-pki.md
Co-Authored-By: Trond B. Krokli <38162891+illfated@users.noreply.github.com>
---
.../hello-for-business/hello-hybrid-cert-whfb-settings-pki.md | 3 +--
1 file changed, 1 insertion(+), 2 deletions(-)
diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-settings-pki.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-settings-pki.md
index 7631e6620b..c627e71a66 100644
--- a/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-settings-pki.md
+++ b/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-settings-pki.md
@@ -157,7 +157,7 @@ Sign-in to an **AD FS Windows Server 2016** computer with _Enterprise Admin_ equ
> If you gave your Windows Hello for Business Authentication certificate template a different name, then replace **WHFBAuthentication** in the above command with the name of your certificate template. It's important that you use the template name rather than the template display name. You can view the template name on the **General** tab of the certificate template using the Certificate Template management console (certtmpl.msc). Or, you can view the template name using the **Get-CATemplate** ADCS Administration Windows PowerShell cmdlet on our Windows Server 2012 or later certificate authority.
> [!IMPORTANT]
-> If the template was changed successfully, the output of the command will contain old and new values of the template parameters. New value must contain **CTPRIVATEKEY_FLAG_HELLO_LOGON_KEY** parameter. For example:
+> If the template was changed successfully, the output of the command will contain old and new values of the template parameters. The new value must contain the **CTPRIVATEKEY_FLAG_HELLO_LOGON_KEY** parameter. Example:
>
> CN=Certificate Templates,CN=Public Key Services,CN=Services,CN=Configuration,DC=[yourdomain]:WHFBAuthentication
>
@@ -234,4 +234,3 @@ Sign-in to the certificate authority or management workstation with _Enterprise
4. [Configure Azure Device Registration](hello-hybrid-cert-trust-devreg.md)
5. Configure Windows Hello for Business settings: PKI (*You are here*)
6. [Sign-in and Provision](hello-hybrid-cert-whfb-provision.md)
-
From 2f21dc1a5031a8a47a9ade95acf93af2c9a2f1b8 Mon Sep 17 00:00:00 2001
From: MaratMussabekov <48041687+MaratMussabekov@users.noreply.github.com>
Date: Mon, 30 Mar 2020 08:24:44 +0500
Subject: [PATCH 0004/1414] Update
windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-settings-pki.md
Co-Authored-By: Trond B. Krokli <38162891+illfated@users.noreply.github.com>
---
.../hello-hybrid-cert-whfb-settings-pki.md | 32 +++++++++----------
1 file changed, 16 insertions(+), 16 deletions(-)
diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-settings-pki.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-settings-pki.md
index c627e71a66..503bdf5c4c 100644
--- a/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-settings-pki.md
+++ b/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-settings-pki.md
@@ -159,22 +159,22 @@ Sign-in to an **AD FS Windows Server 2016** computer with _Enterprise Admin_ equ
> [!IMPORTANT]
> If the template was changed successfully, the output of the command will contain old and new values of the template parameters. The new value must contain the **CTPRIVATEKEY_FLAG_HELLO_LOGON_KEY** parameter. Example:
>
-> CN=Certificate Templates,CN=Public Key Services,CN=Services,CN=Configuration,DC=[yourdomain]:WHFBAuthentication
->
-> Old Value:
-> msPKI-Private-Key-Flag REG_DWORD = 5050080 (84213888)
-> CTPRIVATEKEY_FLAG_REQUIRE_SAME_KEY_RENEWAL -- 80 (128)
-> CTPRIVATEKEY_FLAG_ATTEST_NONE -- 0
-> TEMPLATE_SERVER_VER_WINBLUE< TEMPLATE_CLIENT_VER_WINBLUE< New Value:
-> msPKI-Private-Key-Flag REG_DWORD = 5250080 (86311040)
-> CTPRIVATEKEY_FLAG_REQUIRE_SAME_KEY_RENEWAL -- 80 (128)
-> CTPRIVATEKEY_FLAG_ATTEST_NONE -- 0
-> TEMPLATE_SERVER_VER_WINBLUE< CTPRIVATEKEY_FLAG_HELLO_LOGON_KEY -- 200000 (2097152)
-> TEMPLATE_CLIENT_VER_WINBLUE< CertUtil: -dsTemplate command completed successfully."
+> CN=Certificate Templates,CN=Public Key Services,CN=Services,CN=Configuration,DC=[yourdomain]:WHFBAuthentication
+>
+> Old Value:
+> msPKI-Private-Key-Flag REG_DWORD = 5050080 (84213888)
+> CTPRIVATEKEY_FLAG_REQUIRE_SAME_KEY_RENEWAL -- 80 (128)
+> CTPRIVATEKEY_FLAG_ATTEST_NONE -- 0
+> TEMPLATE_SERVER_VER_WINBLUE<
+> TEMPLATE_CLIENT_VER_WINBLUE<
+> New Value:
+> msPKI-Private-Key-Flag REG_DWORD = 5250080 (86311040)
+> CTPRIVATEKEY_FLAG_REQUIRE_SAME_KEY_RENEWAL -- 80 (128)
+> CTPRIVATEKEY_FLAG_ATTEST_NONE -- 0
+> TEMPLATE_SERVER_VER_WINBLUE<
+> CTPRIVATEKEY_FLAG_HELLO_LOGON_KEY -- 200000 (2097152)
+> TEMPLATE_CLIENT_VER_WINBLUE<
+> CertUtil: -dsTemplate command completed successfully."
## Publish Templates
From 989cfad909656a6e216837bec4840f2939c18d38 Mon Sep 17 00:00:00 2001
From: VLG17 <41186174+VLG17@users.noreply.github.com>
Date: Mon, 4 May 2020 23:39:59 +0300
Subject: [PATCH 0005/1414] add info about 0x801c004D
https://github.com/MicrosoftDocs/windows-itpro-docs/issues/6505
---
.../hello-for-business/hello-errors-during-pin-creation.md | 1 +
1 file changed, 1 insertion(+)
diff --git a/windows/security/identity-protection/hello-for-business/hello-errors-during-pin-creation.md b/windows/security/identity-protection/hello-for-business/hello-errors-during-pin-creation.md
index 300a074c68..6631350839 100644
--- a/windows/security/identity-protection/hello-for-business/hello-errors-during-pin-creation.md
+++ b/windows/security/identity-protection/hello-for-business/hello-errors-during-pin-creation.md
@@ -98,6 +98,7 @@ For errors listed in this table, contact Microsoft Support for assistance.
| 0x801C03F0 | There is no key registered for the user. |
| 0x801C03F1 | There is no UPN in the token. |
| 0x801C044C | There is no core window for the current thread. |
+| 0x801c004D | Unable to enroll a device to use a PIN for login. |
## Related topics
From f304ed45fec6e178836d4f3b187a5442488c68f8 Mon Sep 17 00:00:00 2001
From: VLG17 <41186174+VLG17@users.noreply.github.com>
Date: Tue, 12 May 2020 09:49:48 +0300
Subject: [PATCH 0006/1414] Update description for 0x801c004D
as advised by mapalko in https://github.com/MicrosoftDocs/windows-itpro-docs/pull/6639
---
.../hello-for-business/hello-errors-during-pin-creation.md | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/windows/security/identity-protection/hello-for-business/hello-errors-during-pin-creation.md b/windows/security/identity-protection/hello-for-business/hello-errors-during-pin-creation.md
index 6631350839..01f18214de 100644
--- a/windows/security/identity-protection/hello-for-business/hello-errors-during-pin-creation.md
+++ b/windows/security/identity-protection/hello-for-business/hello-errors-during-pin-creation.md
@@ -98,7 +98,7 @@ For errors listed in this table, contact Microsoft Support for assistance.
| 0x801C03F0 | There is no key registered for the user. |
| 0x801C03F1 | There is no UPN in the token. |
| 0x801C044C | There is no core window for the current thread. |
-| 0x801c004D | Unable to enroll a device to use a PIN for login. |
+| 0x801c004D | DSREG_NO_DEFAULT_ACCOUNT: NGC provisioning is unable to find the default WAM account to use to request AAD token for provisioning. Unable to enroll a device to use a PIN for login. |
## Related topics
From 991c2cfea3e8b51e70938c65238c5000ca791ec7 Mon Sep 17 00:00:00 2001
From: Sinead O'Sullivan
Date: Thu, 4 Jun 2020 13:49:26 +0100
Subject: [PATCH 0007/1414] Create
changes-to-windows-diagnostic-data-collection.md
---
...s-to-windows-diagnostic-data-collection.md | 57 +++++++++++++++++++
1 file changed, 57 insertions(+)
create mode 100644 windows/privacy/changes-to-windows-diagnostic-data-collection.md
diff --git a/windows/privacy/changes-to-windows-diagnostic-data-collection.md b/windows/privacy/changes-to-windows-diagnostic-data-collection.md
new file mode 100644
index 0000000000..1b504439b7
--- /dev/null
+++ b/windows/privacy/changes-to-windows-diagnostic-data-collection.md
@@ -0,0 +1,57 @@
+---
+title: Changes to Windows diagnostic data collection
+description: This article provides information on changes to Windows diagnostic data collection Windows 10.
+keywords: privacy, diagnostic data
+ms.prod: w10
+ms.mktglfcycl: manage
+ms.sitesec: library
+ms.pagetype: security
+ms.localizationpriority: high
+audience: ITPro
+ms.author: daniha
+author: DaniHalfin
+manager: dansimp
+ms.collection: M365-security-compliance
+ms.topic: article
+---
+
+# Changes to Windows diagnostic data collection
+
+Applies to:
+- Windows 10, version 1903 and newer
+- The next version of Windows Server
+
+Microsoft is deeply committed to providing you with effective controls over your data and ongoing transparency into our data handling practices. As part of this effort, we are moving our major products and services to a model where data sent back to Microsoft from customer devices will be classified as either **Required** or **Optional**. We believe this will provide our customers with a simpler experience – information should be easier to find, easier to understand, and easier to act upon through the tools we provide.
+
+This topic is meant for IT administrators and explains the changes Windows is making to align to the new data collection taxonomy. These changes are focused in two areas:
+
+- [Taxonomy changes](#Taxonomy-changes)
+- [Behavioral changes](#Behaviorial-changes)
+
+> [!NOTE]
+> You can test the behavioral changes now in Windows 10 Insider Preview build 19577 and later.
+
+## Summary of changes
+
+In Windows 10, version 1903 and newer, you will see taxonomy updates in both the **Out-of-box-experience** (OOBE) and the **Diagnostics & feedback** privacy settings page. These changes are explained in the section named **Taxonomy** changes.
+
+Additionally, in an upcoming release of Windows 10, we’re simplifying your diagnostic data controls by moving from four diagnostic data controls to three: **Diagnostic data off**, **Required**, and **Optional**. We’re also clarifying the Security diagnostic data level to more accurately reflect its behavior by changing it to **Diagnostic data off**. All of these changes are explained in the section named **Behavioral changes**.
+
+## Taxonomy changes
+
+Starting in Windows 10, version 1903 and newer, both the **Out-of-Box-Experience** (OOBE) and the **Diagnostics & feedback** privacy setting pages will reflect the following changes:
+
+- The **Basic** diagnostic data level is being labeled as **Required**.
+- The **Full** diagnostic data level is being labeled as **Optional**.
+
+> [!IMPORTANT]
+> No action is required for the taxonomy changes, and your existing settings will be maintained as part of this update.
+
+## Behaviorial changes
+
+In an upcoming release of Windows 10, we’re simplifying your diagnostic data controls by moving from four diagnostic data controls to three: **Diagnostic data off**, **Required**, and **Optional**. If your devices are set to **Enhanced** when they are upgraded, the device settings will be migrated to the more privacy-preserving setting of **Required diagnostic data**, which means that analytic services that leverage enhanced data collection may not work properly. For a list of services, see the section named, **Services that rely on Enhanced diagnostic data**, later in this topic. Administrators should read through the details and determine whether to apply these new policies to restore the same collection settings as they had before this change. For a list of steps, see the section named **Configure a Windows 10 device to limit diagnostics**. For more information on services that rely on Enhanced diagnostic data, see **Services that rely on Enhanced diagnostic data**.
+
+Additionally, you will see the following policy changes in an upcoming release of Windows 10:
+| Policy type | Current policy | Renamed policy |
+| --- | --- | --- |
+| Group Policy |
From f549befa2cb7dd1dbd2762fbf117a522415ac182 Mon Sep 17 00:00:00 2001
From: Sinead O'Sullivan
Date: Thu, 4 Jun 2020 16:35:34 +0100
Subject: [PATCH 0008/1414] Update
changes-to-windows-diagnostic-data-collection.md
---
...s-to-windows-diagnostic-data-collection.md | 35 ++++++++++++++++++-
1 file changed, 34 insertions(+), 1 deletion(-)
diff --git a/windows/privacy/changes-to-windows-diagnostic-data-collection.md b/windows/privacy/changes-to-windows-diagnostic-data-collection.md
index 1b504439b7..b9785b1a62 100644
--- a/windows/privacy/changes-to-windows-diagnostic-data-collection.md
+++ b/windows/privacy/changes-to-windows-diagnostic-data-collection.md
@@ -54,4 +54,37 @@ In an upcoming release of Windows 10, we’re simplifying your diagnostic data c
Additionally, you will see the following policy changes in an upcoming release of Windows 10:
| Policy type | Current policy | Renamed policy |
| --- | --- | --- |
-| Group Policy |
+| Group Policy | Computer Configuration > Administrative Templates > Windows Components > Data Collection and Preview Builds > **Allow Telemetry**- **0 Security**
- **Basic**
- **Enhanced**
- **Full**
| Computer Configuration > Administrative Templates > Windows Components > Data Collection and Preview Builds > **Allow Diagnostic Data**- **Diagnostic data off (not recommended)**
- **Send required diagnostic data**
- **Send optional diagnostic data**
|
+| Group Policy |Computer Configuration > Administrative Templates > Windows Components > Data Collection and Preview Builds > **Configure telemetry opt-in settings user interface**| Computer Configuration > Administrative Templates > Windows Components > Data Collection and Preview Builds > **Configure diagnostic data opt-in settings user interface** |
+| Group Policy |Computer Configuration > Administrative Templates > Windows Components > Data Collection and Preview Builds > **Configure telemetry opt-in change notifications**| Computer Configuration > Administrative Templates > Windows Components > Data Collection and Preview Builds > **Configure diagnostic data opt-in change notifications** |
+| MDM | System/AllowTelemetry |
+
+A final set of changes includes two new policies that can help you fine-tune diagnostic data collection within your organization. These policies let you limit the amount of optional diagnostic data that’s sent back to Microsoft.
+
+- The **Limit dump collection** policy is a new policy that can be used to limit the types of [crash dumps](https://docs.microsoft.com/windows/win32/dxtecharts/crash-dump-analysis) that can be sent back to Microsoft. If this policy is enabled, Windows Error Reporting will send only kernel mini dumps and user mode triage dumps.
+ - Group Policy: Computer Configuration > Administrative Templates > Windows Components > Data Collection and Preview Builds > **Limit Dump Collection**
+ - MDM policy: System/ LimitDiagnosticLogCollection
+- The **Limit diagnostic log collection** policy is another new policy that limits the number of diagnostic logs that are sent back to Microsoft. If this policy is enabled, diagnostic logs are not sent back to Microsoft.
+ - Group Policy: Computer Configuration > Administrative Templates > Windows Components > Data Collection and Preview Builds > **Limit Diagnostic Log Collection**
+ - MDM policy: System/LimitDumpCollection
+
+>[!Important]
+>All of the changes mentioned in this section will not be released on versions of Windows, version 1809 and earlier as well as Windows Server 2019 and earlier.
+
+## Configure a Windows 10 device to limit diagnostics
+
+With the Enhanced diagnostic data level being split out into new policies, we are providing additional controls to manage what types of dumps are collected and whether to send additional diagnostic logs. Here are some steps on how to configure them:
+
+1. Choose to send optional diagnostic data by setting one of the following policies:
+ - Group Policy: Computer Configuration > Administrative Templates > Windows Components > Data Collection and Preview Builds > **Allow Diagnostic Data**. Set the policy value to **Send optional diagnostic data**
+ - MDM: System/AllowTelemetry. Set the policy value to 3.
+2. Enable the following Group Policy: Computer Configuration > Administrative Templates > Windows Components > Data Collection and Preview Builds > **Limit Dump Collection**
+3. Enable the following Group Policy: Computer Configuration > Administrative Templates > Windows Components > Data Collection and Preview Builds > **Limit Diagnostic Log Collection**
+
+## Services that rely on Enhanced diagnostic data
+
+Customers who use services that depend on Windows diagnostic data, such as Microsoft Managed Desktop or Desktop Analytics, may be impacted by the functional changes when they are released. These services will be updated to address these changes and guidance will be published on how to configure them properly.
+
+The following provides a list of the known changes:
+- [Microsoft Managed Desktop](http://aka.ms/mmd-diagnostic-data-level)
+- Desktop Analytics
\ No newline at end of file
From 642e2f8a35f2f8d26567f783fee313be5e30ede1 Mon Sep 17 00:00:00 2001
From: Sinead O'Sullivan
Date: Fri, 5 Jun 2020 16:44:37 +0100
Subject: [PATCH 0009/1414] Update windows-10-and-privacy-compliance.md
---
.../windows-10-and-privacy-compliance.md | 133 +++++++++---------
1 file changed, 70 insertions(+), 63 deletions(-)
diff --git a/windows/privacy/windows-10-and-privacy-compliance.md b/windows/privacy/windows-10-and-privacy-compliance.md
index 3631daf619..654f271d91 100644
--- a/windows/privacy/windows-10-and-privacy-compliance.md
+++ b/windows/privacy/windows-10-and-privacy-compliance.md
@@ -19,151 +19,150 @@ ms.date: 05/21/2019
# Windows 10 & Privacy Compliance:
A Guide for IT and Compliance Professionals
Applies to:
-- Windows 10, version 1809 and newer
-- Windows 10 Team Edition, version 1703 for Surface Hub
+- Windows 10 Enterprise
+- Windows 10 Education
- Windows Server 2016 and newer
-- Windows Analytics
-
-For more information about the GDPR, see:
-* [Windows and the GDPR: Information for IT Administrators and Decision Makers](gdpr-it-guidance.md)
-* [Microsoft GDPR Overview](https://aka.ms/GDPROverview)
-* [Microsoft Trust Center FAQs about the GDPR](https://aka.ms/gdpr-faq)
-* [Microsoft Service Trust Portal (STP)](https://aka.ms/stp)
-* [Get Started: Support for GDPR Accountability](https://servicetrust.microsoft.com/ViewPage/GDPRGetStarted)
## Overview
-At Microsoft, we are deeply committed to data privacy across all our products and services. With this guide, we provide IT and compliance professionals with data privacy considerations for Windows 10.
+IMPORTANT: Microsoft is [increasing transparency](https://blogs.microsoft.com/on-the-issues/2019/04/30/increasing-transparency-and-customer-control-over-data/) by categorizing the data we collect as required or optional. Windows 10 is in the process of updating devices to reflect this new categorization, and during this transition Basic diagnostic data will be recategorized as Required diagnostic data and Full diagnostic data will be recategorized as Optional diagnostic data. For more information, see [Changes to Windows diagnostic data](changes-to-windows-diagnostic-data-collection.md).
-Microsoft collects data through multiple interactions with users of Windows 10 devices. This information can contain personal data that may be used to provide, secure, and improve Windows 10 services. To help users and organizations control the collection of personal data, Windows 10 provides comprehensive transparency features, settings choices, controls and support for data subject requests, all of which are detailed in this guide.
+At Microsoft, we are deeply committed to data privacy across all our products and services. With this guide, we provide administrators and compliance professionals with data privacy considerations for Windows 10.
-This information allows IT and compliance professionals work together to better manage personal data privacy considerations and related regulations, such as the General Data Protection Regulation (GDPR).
+Microsoft collects data through multiple interactions with users of Windows 10 devices. This information can contain personal data that may be used to provide, secure, and improve Windows 10 services. To help users and organizations control the collection of personal data, Windows 10 provides comprehensive transparency features, settings choices, controls, and support for data subject requests, all of which are detailed in this article.
+This information allows administrators and compliance professionals to work together to better manage personal data privacy considerations and related regulations, such as the General Data Protection Regulation (GDPR)
## 1. Windows 10 data collection transparency
Transparency is an important part of the data collection process in Windows 10. Comprehensive information about the features and processes used to collect data is available to users and administrators directly within Windows, both during and after device set up.
-If interested in understanding how to manage settings related to data collection skip to the next section [Windows 10 data collection management](#12-data-collection-monitoring).
-
-
### 1.1 Device set up experience and support for layered transparency
-When setting up a device, a user can configure their privacy settings. Those privacy settings are key in determining the amount of personal data collected. For each privacy setting, the user is provided information about the setting along with the links to supporting information. This information explains what data is collected, how the data is used and how to manage the setting after the device setup is complete. The user can also review the privacy statement when connected to the network during this portion of setup. A brief overview of the set up experience for privacy settings are described in [this blog](https://blogs.windows.com/windowsexperience/2018/03/06/windows-insiders-get-first-look-new-privacy-screen-settings-layout-coming-windows-10/#uCC2bKYP8M5BqrDP.97).
+When setting up a device, a user can configure their privacy settings. Those privacy settings are key in determining the amount of personal data collected. For each privacy setting, the user is provided information about the setting along with the links to supporting information. This information explains what data is collected, how the data is used, and how to manage the setting after the device setup is complete. When connected to the network during this portion of setup, the user can also review the privacy statement. A brief overview of the set up experience for privacy settings is described in [this blog](https://blogs.windows.com/windowsexperience/2018/03/06/windows-insiders-get-first-look-new-privacy-screen-settings-layout-coming-windows-10/#uCC2bKYP8M5BqrDP.97).
The following table provides an overview of the Windows 10 privacy settings presented during the device setup experience that involve processing personal data and where to find additional information.
> [!NOTE]
-> This table is limited to the privacy settings that are available as part of setting up a Windows 10 device (Windows 10, version 1809 and later). For the full list of settings that involve data collection, see: [Manage connections from Windows operating system components to Microsoft services](manage-connections-from-windows-operating-system-components-to-microsoft-services.md).
+> This table is limited to the privacy settings that are available as part of setting up a Windows 10 device (Windows 10, version 1809 and newer). For the full list of settings that involve data collection, [see Manage connections from Windows operating system components to Microsoft services](manage-connections-from-windows-operating-system-components-to-microsoft-services).
| Feature/Setting | Description | Supporting Content | Privacy Statement |
| --- | --- | --- | --- |
-| Diagnostic Data | Microsoft uses diagnostic data to: keep Windows secure and up to date, troubleshoot problems, and make product improvements as described in more detail below. Regardless of level selected, the device will be just as secure and will operate normally. This data is collected by Microsoft and stored with one or more unique identifiers that can help us recognize an individual user on an individual device, and understand the device's service issues and use patterns.
Diagnostic data is categorized into four levels:
- **Security**
Information that’s required to help keep Windows, Windows Server, and System Center secure, including data about the Connected User Experiences and Telemetry component settings, the Malicious Software Removal Tool, and Windows Defender. - **Basic**
Basic device info, including: quality-related data, app compatibility, and data from the Security level. - **Enhanced**
Additional insights, including: how Windows, Windows Server, System Center, and apps are used; how they perform; advanced reliability data; and data from both the Basic and the Security levels. - **Full**
Information about the websites you browse, how you use apps and features; plus additional information about device health, device activity, enhanced error reporting, and data from Enhanced, Basic and the Security levels.
At Full, Microsoft also collects the memory state of your device when a system or app crash occurs (which may unintentionally include parts of a file you were using when a problem occurred).
| [Learn more](https://support.microsoft.com/help/4468236/diagnostics-feedback-and-privacy-in-windows-10-microsoft-privacy)
[Configure Windows diagnostic data in your organization](configure-windows-diagnostic-data-in-your-organization.md) | [Privacy Statement](https://privacy.microsoft.com/privacystatement#maindiagnosticsmodule) |
-| Inking and typing diagnostics | Microsoft collects inking and typing data to improve the language recognition and suggestion capabilities of apps and services running on Windows. | [Learn more](https://support.microsoft.com/help/4468236/diagnostics-feedback-and-privacy-in-windows-10-microsoft-privacy) | [Privacy Statement](https://privacy.microsoft.com/privacystatement#maindiagnosticsmodule) |
-| Speech | Use your voice for dictation and to talk to Cortana and other apps that use Windows cloud-based speech recognition. Microsoft collects voice data to help improve speech services. | [Learn more](https://support.microsoft.com/help/4468250/speech-inking-typing-and-privacy-microsoft-privacy) | [Privacy Statement](https://privacy.microsoft.com/privacystatement#mainspeechinkingtypingmodule) |
-| Location | Get location-based experiences like directions and weather. Let Windows and apps request your location and allow Microsoft to use your location data to improve location services. | [Learn more](https://support.microsoft.com/help/4468240/windows-10-location-service-and-privacy-microsoft-privacy) | [Privacy Statement](https://privacy.microsoft.com/privacystatement#mainlocationservicesmotionsensingmodule) |
+| Diagnostic Data | Microsoft uses diagnostic data to keep Windows secure, up to date, troubleshoot problems, and make product improvements. Regardless of what choices you make for diagnostic data collection, the device will be just as secure and will operate normally. This data is collected by Microsoft and stored with one or more unique identifiers that can help us recognize an individual user on an individual device and understand the device's service issues and use patterns.
Diagnostic data is categorized into the following:
- **Required diagnostic data**
Previously known as basic diagnostic data, required diagnostic data includes information about your device, its settings, capabilities, and whether it is performing properly, whether a device is ready for an update, and whether there are factors that may impede the ability to receive updates, such as low battery, limited disk space, or connectivity through a paid network. You can find out what is collected with required diagnostic data [here](https://docs.microsoft.com/windows/privacy/required-windows-diagnostic-events-and-fields-2004). - **Optional diagnostic data**
Previously known as full diagnostic data, optional diagnostic data includes more detailed information about your device and its settings, capabilities, and device health. When you choose to send optional diagnostic data, required diagnostic data will always be included. You can find out the types of optional diagnostic data collected [here](https://docs.microsoft.com/windows/privacy/windows-diagnostic-data).
| [Learn more](https://support.microsoft.com/en-us/4468236/diagnostics-feedback-and-privacy-in-windows-10-microsoft-privacy)
[Configure Windows diagnostic data in your organization](configure-windows-diagnostic-data-in-your-organization.md) | [Privacy Statement](https://privacy.microsoft.com/privacystatement#maindiagnosticsmodule) |
+| Inking and typing diagnostics | Microsoft collects optional inking and typing diagnostic data to improve the language recognition and suggestion capabilities of apps and services running on Windows. | [Learn more](https://support.microsoft.com/help/4468236/diagnostics-feedback-and-privacy-in-windows-10-microsoft-privacy) | [Privacy Statement](https://privacy.microsoft.com/privacystatement#maindiagnosticsmodule) |
+| Speech | Use your voice for dictation and to talk to Cortana and other apps that use Windows cloud-based speech recognition. Microsoft collects voice data to help improve speech services. | [Learn more](https://support.microsoft.com/help/4468250/windows-10-speech-voice-activation-inking-typing-privacy) | [Privacy Statement](https://privacy.microsoft.com/privacystatement#mainspeechinkingtypingmodule) |
+| Location | Get location-based experiences like directions and weather. Let Windows and apps request your location and allow Microsoft to use your location data to improve location services. | [Learn more](https://support.microsoft.com/help/4468240/windows-10-location-service-and-privacy) |[Privacy Statement](https://privacy.microsoft.com/privacystatement#mainlocationservicesmotionsensingmodule) |
| Find my device | Use your device’s location data to help you find your device if you lose it. | [Learn more](https://support.microsoft.com/help/11579/microsoft-account-find-and-lock-lost-windows-device) | [Privacy Statement](https://privacy.microsoft.com/privacystatement#mainlocationservicesmotionsensingmodule) |
-| Tailored Experiences | Let Microsoft offer you tailored experiences based on the diagnostic data you have chosen (Security, Basic, Enhanced, or Full). Tailored experiences mean personalized tips, ads, and recommendations to enhance Microsoft products and services for your needs. | [Learn more](https://support.microsoft.com/help/4468236/diagnostics-feedback-and-privacy-in-windows-10-microsoft-privacy) | [Privacy Statement](https://privacy.microsoft.com/privacystatement#maindiagnosticsmodule) |
-| Advertising Id | Apps can use advertising ID to provide more personalized advertising in accordance with the privacy policy of the app provider. | [Learn more](https://support.microsoft.com/help/4459081/general-privacy-settings-in-windows-10-microsoft-privacy) | [Privacy statement](https://privacy.microsoft.com/privacystatement#mainadvertisingidmodule) |
-| Activity History/Timeline – Cloud Sync | If you want timeline and other Windows features to help you continue what you were doing, even when you switch devices, send Microsoft your activity history, which includes info about websites you browse and how you use apps and services. | [Learn more](https://support.microsoft.com/help/4468227/windows-10-activity-history-and-your-privacy-microsoft-privacy) | [Privacy statement](https://privacy.microsoft.com/privacystatement#mainactivityhistorymodule) |
-| Cortana | Cortana is Microsoft’s personal digital assistant, which helps busy people get things done, even while they’re at work. Cortana on Windows is available in [certain regions and languages](https://support.microsoft.com/instantanswers/557b5e0e-0eb0-44db-87d6-5e5db6f9c5b0/cortana-s-regions-and-languages). Cortana learns from certain data about the user, such as location, searches, calendar, contacts, voice input, speech patterns, email, content and communication history from text messages. In Microsoft Edge, Cortana uses browsing history. The user is in control of how much data is shared.
Cortana has powerful configuration options, specifically optimized for a business. By signing in with an Azure Active Directory (Azure AD) account, enterprise users can give Cortana access to their enterprise/work identity, while getting all the functionality Cortana provides to them outside of work.
| [Learn more](https://support.microsoft.com/help/4468233/cortana-and-privacy-microsoft-privacy)
[Cortana integration in your business or enterprise](https://docs.microsoft.com/windows/configuration/cortana-at-work/cortana-at-work-overview) | [Privacy statement](https://privacy.microsoft.com/privacystatement#maincortanamodule) |
+| Tailored Experiences | Let Microsoft offer you tailored experiences based on the diagnostic data you choose to send. Tailored experiences include personalized tips, ads, and recommendations to enhance Microsoft products and services for your needs. | [Learn more](https://support.microsoft.com/help/4468236/diagnostics-feedback-and-privacy-in-windows-10-microsoft-privacy) | [Privacy Statement](https://privacy.microsoft.com/privacystatement#maindiagnosticsmodule) |
+| Advertising Id | Apps can use advertising ID to provide more personalized advertising in accordance with the privacy policy of the app provider. | [Learn more](https://support.microsoft.com/help/4459081/windows-10-general-privacy-settings) | [Privacy statement](https://support.microsoft.com/help/4459081/windows-10-general-privacy-settings) |
+| Activity History/Timeline – Cloud Sync | If you want Windows Timeline and other Windows features to help you continue what you were doing, even when you switch devices, send Microsoft your activity history, which includes info about websites you browse and how you use apps and services. | [Learn more](https://support.microsoft.com/help/4468227/windows-10-activity-history-and-your-privacy-microsoft-privacy) | [Privacy statement](https://privacy.microsoft.com/privacystatement#mainactivityhistorymodule) |
+| Cortana | Cortana is Microsoft’s personal digital assistant, which helps busy people get things done, even while they’re at work. Cortana on Windows is available in [certain regions and languages](https://support.microsoft.com/help/4026948/cortanas-regions-and-languages). Cortana learns from certain data about the user, such as location, searches, calendar, contacts, voice input, speech patterns, email, content and communication history from text messages. In Microsoft Edge, Cortana uses browsing history. The user is in control of how much data is shared.
Cortana has powerful configuration options, specifically optimized for a business. By signing in with an Azure Active Directory (Azure AD) account, enterprise users can give Cortana access to their enterprise/work identity, while getting all the functionality Cortana provides to them outside of work.
| [Learn more](https://support.microsoft.com/help/4468233/cortana-and-privacy-microsoft-privacy)
[Cortana integration in your business or enterprise](https://docs.microsoft.com/windows/configuration/cortana-at-work/cortana-at-work-overview) | [Privacy statement](https://privacy.microsoft.com/privacystatement#maincortanamodule) |
### 1.2 Data collection monitoring
-The Diagnostic Data Viewer (DDV) is a Windows app (available in Windows 10, version 1803 or later) that lets a user review the Windows diagnostic data that is being collected on their Windows 10 device and sent to Microsoft. DDV groups the information into simple categories based on how it is used by Microsoft. The [DDV Overview](diagnostic-data-viewer-overview.md) provides information on how users can get started on using this tool.
+[Diagnostic Data Viewer (DDV)](diagnostic-data-viewer-overview) is a Microsoft Store app (available in Windows 10, version 1803 and newer) that lets a user review the Windows diagnostic data that is being collected on their Windows 10 device and sent to Microsoft in real-time. DDV groups the information into simple categories that describe the data that’s being collected.
-An administrator can also use the Diagnostic Data Viewer for PowerShell module to view the diagnostic data collected from the device instead of using the Diagnostic Data Viewer UI. The [Diagnostic Data Viewer for PowerShell Overview](microsoft-diagnosticdataviewer.md) provides further information.
+An administrator can also use the Diagnostic Data Viewer for PowerShell module to view the diagnostic data collected from the device instead of using the Diagnostic Data Viewer UI. The [Diagnostic Data Viewer for PowerShell Overview](microsoft-diagnosticdataviewer) provides further information.
## 2. Windows 10 data collection management
-Windows 10 provides the ability to manage privacy settings through several different methods. Users can change their privacy settings using the Windows 10 settings (**Start** > **Settings** > **Privacy**). The organization can also manage the privacy settings using group policy or mobile device management (MDM). The following sections provide an overview on how to manage the privacy settings previously discussed in this article.
+Windows 10 provides the ability to manage privacy settings through several different methods. Users can change their privacy settings using the Windows 10 settings (**Start > Settings > Privacy**). The organization can also manage the privacy settings using Group Policy or Mobile Device Management (MDM). The following sections provide an overview on how to manage the privacy settings previously discussed in this article.
### 2.1 Privacy setting options for users
-Once a Windows 10 device is set up, a user can manage data collection settings by going to **Start** > **Settings** > **Privacy**. IT administrators can control privacy settings via setting policy on the device (see Section 2.2 below). If this is the case, the user will see an alert that says ‘Some settings are hidden or managed by your organization’ when they navigate to **Start** > **Settings** > **Privacy**. Meaning the user can only change settings in accordance with the policies that the administrator has applied to the device.
+Once a Windows 10 device is set up, a user can manage data collection settings by navigating to **Start > Settings > Privacy**. Administrators can control privacy settings via setting policy on the device (see Section 2.2 below). If this is the case, the user will see an alert that says **Some settings are hidden or managed by your organization** when they navigate to **Start > Settings > Privacy**. In this case, the user can only change settings in accordance with the policies that the administrator has applied to the device.
### 2.2 Privacy setting controls for administrators
-The IT department can configure and control privacy settings across their organization by using Group Policy, registry, or Mobile Device Management (MDM) settings.
+Administrators can configure and control privacy settings across their organization by using Group Policy, Mobile Device Management (MDM), or Windows registry settings.
-The following table provides an overview of the privacy settings discussed earlier in this document with details on how to configure these via policy. The table also provides information on what the default value would be for each of these privacy settings if you do not manage the setting via policy and suppress the Out-of-box Experience (OOBE) during device setup. For an IT administrator interested in minimizing data, we also provide the recommended value to set.
+The following table provides an overview of the privacy settings discussed earlier in this document with details on how to configure these policies. The table also provides information on what the default value would be for each of these privacy settings if you do not manage the setting by using policy and suppress the Out-of-box Experience (OOBE) during device setup. If you’re interested in minimizing data collection, we also provide the recommended value to set.
> [!NOTE]
-> This is not a complete list of settings that involve connecting to Microsoft services. To see a more detailed list, please refer to Manage connections from [Windows operating system components to Microsoft services](manage-connections-from-windows-operating-system-components-to-microsoft-services.md).
+> This is not a complete list of settings that involve connecting to Microsoft services. To see a more detailed list, see [Manage connections from Windows operating system components to Microsoft services](manage-connections-from-windows-operating-system-components-to-microsoft-services).
| Feature/Setting | GP/MDM Documentation | Default State if the Setup experience is suppressed | State to stop/minimize data collection |
|---|---|---|---|
| [Speech](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-priv-speech) | Group Policy:
**Computer Configuration** > **Control Panel** > **Regional and Language Options** > **Allow users to enable online speech recognition services**
MDM: [Privacy/AllowInputPersonalization](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-privacy#privacy-allowinputpersonalization) | Off | Off |
-| [Location](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-priv-location) | Group Policy:
**Computer Configuration** > **Windows Components** > **App Privacy** > **Let Windows apps access location**
MDM: [Privacy/LetAppsAccessLocation](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-privacy#privacy-letappsaccesslocation) | Off (Windows 10, version 1903 and later) | Off |
+| [Location](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-priv-location) | Group Policy:
**Computer Configuration** > **Windows Components** > **App Privacy** > **Let Windows apps access location**
MDM: [Privacy/LetAppsAccessLocation](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-privacy#privacy-allowinputpersonalization) | Off (Windows 10, version 1903 and later) | Off |
| [Find my device](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#find-my-device) | Group Policy:
**Computer Configuration** > **Windows Components** > **Find My Device** > **Turn On/Off Find My Device**
MDM: [Experience/AllFindMyDevice](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-experience#experience-allowfindmydevice) | Off | Off |
-| [Diagnostic Data](configure-windows-diagnostic-data-in-your-organization.md#enterprise-management) | Group Policy:
**Computer Configuration** > **Windows Components** > **Data Collection and Preview Builds** > **Allow Telemetry**
MDM: [System/AllowTelemetry](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-system#system-allowtelemetry) | Desktop SKUs:
Basic (Windows 10, version 1903 and later)
Server SKUs:
Enhanced | Security and block endpoints |
+| [Diagnostic Data](configure-windows-diagnostic-data-in-your-organization.md#enterprise-management) | Group Policy:
**Computer Configuration** > **Windows Components** > **Data Collection and Preview Builds** > **Allow Telemetry**
MDM: [System/AllowTelemetry](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-system#system-allowtelemetry) | Desktop editions:
Required diagnostic data (Windows 10, version 1903 and later)
Server editions:
Required diagnostic data | Security and block endpoints |
| [Inking and typing diagnostics](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-priv-ink) | Group Policy:
**Computer Configuration** > **Windows Components** > **Text Input** > **Improve inking and typing recognition**
MDM: [TextInput/AllowLinguisticDataCollection](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-textinput#textinput-allowlinguisticdatacollection) | Off (Windows 10, version 1809 and later) | Off |
-| Tailored Experiences | Group Policy:
**User Configuration** > **Windows Components** > **Cloud Content** > **Do not use diagnostic data for tailored experiences**
MDM: Link TBD | Off | Off |
-| Advertising ID | Group Policy:
**Configuration** > **System** > **User Profile** > **Turn off the advertising Id**
MDM: [Privacy/DisableAdvertisingId](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-privacy#privacy-disableadvertisingid) | Off | Off |
+| Tailored Experiences | Group Policy:
**User Configuration** > **Windows Components** > **Cloud Content** > **Do not use diagnostic data for tailored experiences**
MDM: [Experience/AllowTailoredExperiencesWithDiagnosticData](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-experience#experience-allowtailoredexperienceswithdiagnosticdata) | Off | Off |
+| Advertising ID | Group Policy:
**Computer Configuration** > **System** > **User Profile** > **Turn off the advertising Id**
MDM: [Privacy/DisableAdvertisingId](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-privacy#privacy-disableadvertisingid) | Off | Off |
| Activity History/Timeline – Cloud Sync | Group Policy:
**Computer Configuration** > **System** > **OS Policies** > **Allow upload of User Activities**
MDM: [Privacy/EnableActivityFeed](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-privacy#privacy-enableactivityfeed) | Off | Off |
| [Cortana](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#2-cortana-and-search) | Group Policy:
**Computer Configuration** > **Windows Components** > **Search** > **Allow Cortana**
MDM: [Experience/AllowCortana](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-experience#experience-allowcortana) | Off | Off |
### 2.3 Guidance for configuration options
-This section provides general details and links to more detailed information as well as instructions for IT administrators and compliance professional. These instructions allow IT admins and compliance pros to manage the device compliance. This information includes details about setting up a device, to configuring the device’s settings after setup is completed to minimize data collected and drive privacy related user experiences.
+This section provides general details and links to more detailed information, as well as instructions for administrators and compliance professionals. These instructions allow you to manage device settings to manage the compliance objectives of your organization. This information includes details about setting up a device, configuring the device’s settings after setup is complete to minimize data collection, and driving privacy-related user experiences.
#### 2.3.1 Managing the device setup experience
-Windows deployment can be configured using several different methods, which provide an administrator with options to control: how a device is set up, what’s enabled by default, and what the user is able to change on the system after they log on.
+Windows deployment can be configured using several different methods that provide an administrator with options for control, including how a device is set up, which options are enabled by default, and what the user is able to change on the device after they log on.
-The [Deploy and update Windows 10](https://docs.microsoft.com/windows/deployment/) section of the Windows IT Pro Center provides an overview of the different options.
+If you want the ability to fully control and apply restrictions on data being sent back to Microsoft, you can use [Configuration Manager](https://docs.microsoft.com/mem/configmgr/) as a deployment solution. Configuration Manager can be used to deploy a customized boot image using a variety of [deployment methods](https://docs.microsoft.com/en-us/mem/configmgr/osd/get-started/prepare-for-operating-system-deployment). You can further restrict any Configuration Manager-specific diagnostic data from being sent back to Microsoft by turning off this setting as outlined in the instructions [here](https://docs.microsoft.com/en-us/mem/configmgr/core/plan-design/diagnostics/frequently-asked-questions).
+
+Alternatively, your administrators can also choose to use Windows Autopilot. Autopilot lessens the overall burden of deployment while allowing administrators to fully customize the out-of-box experience. However, since Windows Autopilot is a cloud-based solution, administrators should be aware that a minimal set of device identifiers are sent back to Microsoft during initial device boot up. This device-specific information is used to identify the device so that it can receive the administrator-configured Autopilot profile and policies.
+
+You can use the following articles to learn more about Autopilot and how to use Autopilot to deploy Windows 10:
+- https://docs.microsoft.com/windows/deployment/windows-Autopilot/windows-Autopilot
+- https://docs.microsoft.com/windows/deployment/windows-Autopilot/deployment-process
#### 2.3.2 Managing connections from Windows components to Microsoft services
-IT administrators can manage the data sent from their organization to Microsoft by configuring settings associated with the functionality provided by these Windows components.
+Administrators can manage the data sent from their organization to Microsoft by configuring settings associated with the functionality provided by Windows components.
-See [Manage connections from Windows operating system components to Microsoft services](https://technet.microsoft.com/itpro/windows/manage/manage-connections-from-windows-operating-system-components-to-microsoft-services) for more details, including the different methods available on how to configure each setting, the impact to functionality and which versions of Windows that are applicable.
+For more details, see [Manage connections from Windows operating system components to Microsoft services](manage-connections-from-windows-operating-system-components-to-microsoft-services). This topic includes the different methods available on how to configure each setting, the impact to functionality, and which versions of Windows that are applicable.
#### 2.3.3 Managing Windows 10 connections
-Some Windows components, apps, and related services transfer data to Microsoft network endpoints. An administrator may want to block these endpoints as an additional measure of ensuring privacy compliance within their organization.
+Some Windows components, apps, and related services transfer data to Microsoft network endpoints. An administrator may want to block these endpoints for their organization to meet their specific compliance objectives.
-[Manage connection endpoints for Windows 10, version 1809](manage-windows-1809-endpoints.md) provides a list of endpoints for the latest Windows 10 release, along with the functionality that would be impacted. Details for additional Windows versions can be found on the [Windows Privacy site](https://docs.microsoft.com/windows/privacy/) under the “Manage Windows 10 connection endpoints” section of the left-hand navigation menu.
+[Manage connection endpoints for Windows 10, version 1903](manage-windows-1903-endpoints) provides a list of endpoints for the latest Windows 10 release, along with descriptions of any functionality that would be impacted by restricting data collection. Details for additional Windows versions can be found on the Windows Privacy site under the Manage Windows 10 connection endpoints section of the left-hand navigation menu.
#### 2.3.4 Limited functionality baseline
-An organization may want to further minimize the amount of data shared with Microsoft or apps by managing the connections and configuring additional settings on their devices. Similar to [Security baselines](https://docs.microsoft.com/windows/security/threat-protection/windows-security-baselines), we have a limited functionality baseline-focused configuring settings to minimize the data shared, however this comes with some potential impact to functionality on the device. The [Manage connections from Windows operating system components to Microsoft services](manage-connections-from-windows-operating-system-components-to-microsoft-services.md) article provides details on how to apply the baseline, along with the full list of settings covered in the baseline and the functionality that would be impacted. Administrators who don’t want to apply the baseline can still find details on how to configure each setting individually to find the right balance between data sharing and impact to functionality for their organization.
+An organization may want to further minimize the amount of data sent back to Microsoft or shared with Microsoft apps by managing the connections and configuring additional settings on their devices. Similar to [Windows security baselines](https://docs.microsoft.com/windows/security/threat-protection/windows-security-baselines), Microsoft has released a limited functionality baseline focused on configuring settings to minimize the data sent back to Microsoft. However, the functionality of the device could be impacted by applying these settings. The [Manage connections from Windows operating system components to Microsoft services](manage-connections-from-windows-operating-system-components-to-microsoft-services) article provides details on how to apply the baseline, along with the full list of settings covered in the baseline and the functionality that would be impacted. Administrators that don’t want to apply the baseline can still find details on how to configure each setting individually to find the right balance between data sharing and impact to functionality for their organization.
+
+>[!IMPORTANT]
+>We recommend that you fully test any modifications to these settings before deploying them in your organization.
#### 2.3.5 Diagnostic data: Managing notifications for change of level at logon
-Windows 10, version 1803, and later provides users with a notification during sign in about changes to the diagnostic data level on the device so they are aware of any changes where additional data may be collected. For instance, if the diagnostic level on the device is set to Basic and an administrator changes it to Full, users will be notified when they next sign in. The IT administrator can disable these notifications by setting Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Data Collection and Preview Builds** > **Configure telemetry opt-in change notifications** or the MDM policy `ConfigureTelemetryOptInChangeNotification`.
+Starting with Windows 10, version 1803, if an administrator modifies the diagnostic data collection setting, users are notified of this change during the initial device sign in. For example, if you configure the device to send optional diagnostic data, users will be notified the next time they sign into the device. You can disable these notifications by using the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Data Collection and Preview Builds** > **Configure telemetry opt-in change notifications** or the MDM policy `ConfigureTelemetryOptInChangeNotification`.
#### 2.3.6 Diagnostic data: Managing end user choice for changing the setting
-Windows 10, version 1803 and later, allows users to change their diagnostic data level to a lower setting than what their IT administrator has set. For instance, if the administrator has set the diagnostic data level to Enhanced or Full, a user can change the setting to Basic by going into **Settings** > **Privacy** > **Diagnostic & feedback**. The administrator can disable the user ability to change the setting via **Setting** > **Privacy** by setting the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Data Collection and Preview Builds** > **Configure telemetry opt-in setting user interface** or the MDM policy `ConfigureTelemetryOptInSettingsUx`.
+Windows 10, version 1803 and newer allows users to change their diagnostic data level to a lower setting than what their administrator has set. For example, if you have configured the device to send optional diagnostic data, a user can change the setting so that only required diagnostic data is sent by going into **Settings** > **Privacy** > **Diagnostics & feedback**. Administrators can restrict a user’s ability to change the setting using **Setting** > **Privacy** by setting the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Data Collection and Preview Builds** > **Configure telemetry opt-in setting user interface** or the MDM policy `ConfigureTelemetryOptInSettingsUx`.
#### 2.3.7 Diagnostic data: Managing device-based data delete
-Windows 10, version 1803 and later, allows a user to delete diagnostic data collected from their device by going into **Settings** > **Privacy** > **Diagnostic & feedback** and clicking the **Delete** button. An IT administrator can also delete diagnostic data for a device using the [Clear-WindowsDiagnosticData](https://docs.microsoft.com/powershell/module/windowsdiagnosticdata/Clear-WindowsDiagnosticData?view=win10-ps) PowerShell cmdlet script.
+Windows 10, version 1809 and newer allows a user to delete diagnostic data collected from their device by using **Settings** > **Privacy** > **Diagnostic & feedback** and clicking the **Delete** button under the **Delete diagnostic data** heading. An administrator can also delete diagnostic data for a device using the [Clear-WindowsDiagnosticData](https://docs.microsoft.com/powershell/module/windowsdiagnosticdata/Clear-WindowsDiagnosticData?view=win10-ps) PowerShell cmdlet.
An administrator can disable a user’s ability to delete their device’s diagnostic data by setting the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Data Collection and Preview Builds** > **Disable deleting diagnostic data** or the MDM policy `DisableDeviceDelete`.
## 3. The process for exercising data subject rights
-This section discusses the different methods Microsoft provides for users and IT administrators to exercise data subject rights for data collected from a Windows 10 device.
+This section discusses the different methods Microsoft provides for users and administrators to exercise data subject rights for data collected from a Windows 10 device.
### 3.1 Delete
-Users can delete their device-based data by going to **Settings** > **Privacy** > **Diagnostic & feedback** and clicking the **Delete** button. Administrators can also use the [Clear-WindowsDiagnosticData](https://docs.microsoft.com/powershell/module/windowsdiagnosticdata/Clear-WindowsDiagnosticData?view=win10-ps) PowerShell cmdlet script.
+Users can delete their device-based data by going to **Settings** > **Privacy** > **Diagnostic & feedback** and clicking the **Delete** button under the **Delete diagnostic data** heading. Administrators can also use the [Clear-WindowsDiagnosticData](https://docs.microsoft.com/powershell/module/windowsdiagnosticdata/Clear-WindowsDiagnosticData?view=win10-ps) PowerShell cmdlet.
### 3.2 View
-The [Diagnostic Data Viewer (DDV)](diagnostic-data-viewer-overview.md) provides a view into the diagnostic data being collected from the Windows 10 device. IT administrators can also use the [Get-DiagnosticData](microsoft-diagnosticdataviewer.md#install-and-use-the-diagnostic-data-viewer-for-powershell) PowerShell cmdlet script.
+The [Diagnostic Data Viewer (DDV)](diagnostic-data-viewer-overview) provides a view into the diagnostic data being collected from a Windows 10 device. Administrators can also use the [Get-DiagnosticData](microsoft-diagnosticdataviewer.md#install-and-use-the-diagnostic-data-viewer-for-powershell) PowerShell cmdlet.
### 3.3 Export
-The [Diagnostic Data Viewer (DDV)](diagnostic-data-viewer-overview.md) provides the ability to export the diagnostic data captured while the app is running, by clicking the Export data button in the top menu. IT administrators can also use the [Get-DiagnosticData](microsoft-diagnosticdataviewer.md#install-and-use-the-diagnostic-data-viewer-for-powershell) PowerShell cmdlet script.
+The [Diagnostic Data Viewer (DDV)](diagnostic-data-viewer-overview) provides the ability to export the diagnostic data captured while the app is running, by clicking the **Export** data button in the top menu. Administrators can also use the [Get-DiagnosticData](microsoft-diagnosticdataviewer.md#install-and-use-the-diagnostic-data-viewer-for-powershell) PowerShell cmdlet script.
### 3.4 Devices connected to a Microsoft account
-If a user signs in to a Windows experience or app on their device with their Microsoft account (MSA), they can view, delete, and export data associated with their MSA on the [Privacy dashboard](https://account.microsoft.com/privacy).
+If a user signs in to a Windows experience or app on their device with their Microsoft account, they can view, delete, and export data associated with their Microsoft account on the [Privacy dashboard](https://account.microsoft.com/privacy).
## 4. Cross-border data transfers
@@ -177,26 +176,34 @@ Microsoft’s [Privacy Statement](https://privacy.microsoft.com/privacystatement
The following sections provide details about how privacy data is collected and managed across related Windows products.
-### 5.1 Windows Server 2016 and 2019
+### 5.1 Windows Server 2016 and newer
-Windows Server follows the same mechanisms as Windows 10 for handling of personal data. There are some differences regarding [diagnostic default settings for Windows Server](https://microsoft-my.sharepoint.com/personal/v-colinm_microsoft_com/Documents/WINDOWS%20PRIVACY/Windows%20diagnostic%20data%20and%20Windows%20Server).
+Windows Server follows the same mechanisms as Windows 10 for handling of personal data.
### 5.2 Surface Hub
-Surface Hub is a shared device used within an organization. The device identifier collected as part of diagnostic data is not connected to an individual user. For removing Windows diagnostic data sent to Microsoft for a Surface Hub, Microsoft created the Surface Hub Delete Diagnostic Data tool available in the Microsoft Store.
+[Surface Hub](https://docs.microsoft.com/surface-hub/) is a shared device used within an organization. The device identifier collected as part of diagnostic data is not connected to a user. To delete the Windows diagnostic data sent to Microsoft for Surface Hub, you can use the Surface Hub Delete Diagnostic Data tool available in the Microsoft Store
-For more details, see [Windows 10 Team Edition, Version 1703 for Surface Hub](gdpr-it-guidance.md#windows-10-team-edition-version-1703-for-surface-hub).
+>[!IMPORTANT]
+>Apps and services that run on Windows but are not considered part of Windows will manage data collection using their own controls. Please contact the publisher for further guidance on how to control the data collection and transmission of these apps and services.
-### 5.3 Windows 10 Analytics
+An administrator can configure privacy-related settings, such as choosing to only send required diagnostic data. Surface Hub does not support Group Policy for centralized management. However, administrators can use MDM to apply these settings to Surface Hub. For more information about Surface Hub and MDM, see [Manage settings with an MDM provider (Surface Hub)](https://docs.microsoft.com/surface-hub/manage-settings-with-mdm-for-surface-hub).
-[Windows Analytics](https://docs.microsoft.com/windows/deployment/update/windows-analytics-overview) is a set of solutions for Azure Portal that provide you with extensive data about the state of devices in your deployment. There are currently three solutions which you can use singly or in any combination: Device Health, Update Compliance, and Upgrade Readiness. Windows Analytics is a separate offering from Windows 10 and is dependent on enabling a minimum set of data collection on the device to function.
+### 5.3 Desktop Analytics
-For more details, see the [Windows Analytics overview page](https://docs.microsoft.com/windows/deployment/update/windows-analytics-overview).
+[Desktop Analytics](https://docs.microsoft.com/en-us/mem/configmgr/desktop-analytics/overview) is a set of solutions for Azure Portal that provide you with extensive data about the state of devices in your deployment. Desktop Analytics is a separate offering from Windows 10 and is dependent on enabling a minimum set of data collection on the device to function.
+### 5.4 Microsoft Managed Desktop
+
+[Microsoft Managed Desktop (MMD)](https://docs.microsoft.com/microsoft-365/managed-desktop/service-description/?view=o365-worldwide) is a service that provides your users with a secure modern experience and always keeps devices up to date with the latest versions of Windows 10 Enterprise edition, Office 365 ProPlus, and Microsoft security services.
## Additional Resources
-* [Microsoft Trust Center: GDPR Overview](https://www.microsoft.com/trustcenter/privacy/gdpr/gdpr-overview)
-* [Microsoft Trust Center: Privacy at Microsoft](https://www.microsoft.com/TrustCenter/Privacy/privacy-overview)
+* [Microsoft Trust Center: GDPR Overview](https://www.microsoft.com/trust-center/privacy/gdpr-overview)
+* [Microsoft Trust Center: Privacy at Microsoft](https://www.microsoft.com/trust-center/privacy)
* [Windows IT Pro Docs](https://docs.microsoft.com/windows/#pivot=it-pro)
-
+* [Microsoft Privacy Statement](https://privacy.microsoft.com/en-US/privacystatement)
+* [Manage connections from Windows operating system components to Microsoft services](manage-connections-from-windows-operating-system-components-to-microsoft-services)
+* [Privacy at Microsoft](https://privacy.microsoft.com/privacy-report)
+* [Changes to Windows diagnostic data](changes-to-windows-diagnostic-data-collection)
+* [Microsoft Service Trust Portal](https://servicetrust.microsoft.com/)
From bd803b9ab0e4c5277f0c5e7d8fa3df2477ebb176 Mon Sep 17 00:00:00 2001
From: Sinead O'Sullivan
Date: Fri, 5 Jun 2020 20:31:42 +0100
Subject: [PATCH 0010/1414] updates to privacy docs
---
...ws-diagnostic-data-in-your-organization.md | 495 +++++-------------
.../windows-10-and-privacy-compliance.md | 2 +-
2 files changed, 141 insertions(+), 356 deletions(-)
diff --git a/windows/privacy/configure-windows-diagnostic-data-in-your-organization.md b/windows/privacy/configure-windows-diagnostic-data-in-your-organization.md
index 518fe19374..ee94dae814 100644
--- a/windows/privacy/configure-windows-diagnostic-data-in-your-organization.md
+++ b/windows/privacy/configure-windows-diagnostic-data-in-your-organization.md
@@ -20,426 +20,211 @@ ms.date: 04/29/2019
**Applies to**
-- Windows 10 Enterprise
-- Windows 10 Mobile
-- Windows Server
+- Windows 10 Enterprise
+- Windows 10 Education
+- Windows Server 2016 and newer
-This article applies to Windows and Windows Server diagnostic data only. It describes the types of diagnostic data we may gather, the ways you might manage it in your organization, and some examples of how diagnostic data can provide you with valuable insights into your enterprise deployments. Microsoft uses the data to quickly identify and address issues affecting its customers.
+This article applies to Windows 10, Windows Server, Surface Hub, and Hololens diagnostic data only. It describes the types of diagnostic data that’s sent back to Microsoft and the ways you can manage it within your organization. Microsoft uses the data to quickly identify and address issues affecting its customers.
-Use this article to make informed decisions about how you might configure diagnostic data in your organization. Diagnostic data is a term that means different things to different people and organizations. For this article, we discuss diagnostic data as system data that is uploaded by the Connected User Experiences and Telemetry component. Microsoft uses diagnostic data to keep Windows secure and up to date, troubleshoot problems, and make product improvements.
+IMPORTANT: Microsoft is [increasing transparency](https://blogs.microsoft.com/on-the-issues/2019/04/30/increasing-transparency-and-customer-control-over-data/) by categorizing the data we collect as required or optional. Windows 10 is in the process of updating devices to reflect this new categorization, and during this transition Basic diagnostic data will be recategorized as Required diagnostic data and Full diagnostic data will be recategorized as Optional diagnostic data. For more information, see [Changes to Windows diagnostic data](changes-to-windows-diagnostic-data-collection).
-We are always striving to improve our documentation and welcome your feedback. You can provide feedback by contacting telmhelp@microsoft.com.
+## Overview
-## Overview of Windows diagnostic data
+Microsoft collects Windows diagnostic data to solve problems and to keep Windows up to date, secure, and operating properly. It also helps us improve Windows and related Microsoft products and services and, for customers who have turned on the **Tailored experiences** setting, to provide more relevant tips and recommendations to tailor Microsoft and third-party products and services for Windows to the customer’s needs.
-At Microsoft, we use Windows diagnostic data to inform our decisions and focus our efforts in providing the most robust, most valuable platform for your business and the people who count on Windows to enable them to be as productive as possible. Diagnostic data gives users a voice in the operating system’s development. This guide describes the importance of Windows diagnostic data and how we protect that data. Additionally, it differentiates between diagnostic data and functional data. It also describes the diagnostic data levels that Windows supports. Of course, you can choose how much diagnostic data is shared with Microsoft, and this guide demonstrates how.
-
-To frame a discussion about diagnostic data, it is important to understand Microsoft’s privacy principles. We earn customer trust every day by focusing on six key privacy principles as described at [privacy.microsoft.com](https://privacy.microsoft.com/). These principles guided the implementation of the Windows diagnostic data system in the following ways:
-
-- **Control.** We offer customers control of the diagnostic data they share with us by providing easy-to-use management tools.
-- **Transparency.** We provide information about the diagnostic data that Windows and Windows Server collects so our customers can make informed decisions.
-- **Security.** We encrypt diagnostic data in transit from your device via TLS 1.2, and additionally use certificate pinning to secure the connection.
-- **Strong legal protections.** We respect customers’ local privacy laws and fight for legal protection of their privacy as a fundamental human right.
-- **No content-based targeting.** We take steps to avoid and minimize the collection of customer content, such as the content of files, chats, or emails, through the Windows diagnostic data system. Customer content inadvertently collected is kept confidential and not used for user targeting.
-- **Benefits to you.** We collect Windows diagnostic data to help provide you with an up-to-date, more secure, reliable and performant product, and to improve Windows for all our customers.
-
-In previous versions of Windows and Windows Server, Microsoft used diagnostic data to check for updated or new Windows Defender signatures, check whether Windows Update installations were successful, gather reliability information through the Reliability Analysis Component (RAC), and gather reliability information through the Windows Customer Experience Improvement Program (CEIP) on Windows. In Windows 10 and Windows Server, you can control diagnostic data streams by using the Privacy option in Settings, Group Policy, or MDM.
-
-For Windows 10, we invite IT pros to join the [Windows Insider Program](http://insider.windows.com) to give us feedback on what we can do to make Windows work better for your organization.
-
-## Understanding Windows diagnostic data
-
-Windows as a Service is a fundamental change in how Microsoft plans, builds, and delivers the operating system. Historically, we released a major Windows version every few years. The effort required to deploy large and infrequent Windows versions was substantial. That effort included updating the infrastructure to support the upgrade. Windows as a Service accelerates the cadence to provide rich updates more frequently, and these updates require substantially less effort to roll out than earlier versions of Windows. Since it provides more value to organizations in a shorter timeframe, delivering Windows as a Service is a top priority for us.
-
-The release cadence of Windows may be fast, so feedback is critical to its success. We rely on diagnostic data at each stage of the process to inform our decisions and prioritize our efforts.
-
-### What is Windows diagnostic data?
-
-Windows diagnostic data is vital technical data from Windows devices about the device and how Windows and related software are performing. It's used in the following ways:
-
-- Keep Windows up to date
-- Keep Windows secure, reliable, and performant
-- Improve Windows – through the aggregate analysis of the use of Windows
-- Personalize Windows engagement surfaces
-
-Here are some specific examples of Windows diagnostic data:
-
-- Type of hardware being used
-- Applications installed and usage details
-- Reliability information on device drivers
-
-### What is NOT diagnostic data?
-
-Diagnostic data can sometimes be confused with functional data. Some Windows components and apps connect to Microsoft services directly, but the data they exchange is not diagnostic data. For example, exchanging a user’s location for local weather or news is not an example of diagnostic data—it is functional data that the app or service requires to satisfy the user’s request.
-
-There are subtle differences between diagnostic data and functional data. Windows collects and sends diagnostic data in the background automatically. You can control how much information is gathered by setting the diagnostic data level. Microsoft tries to avoid collecting personal information wherever possible (for example, if a crash dump is collected and a document was in memory at the time of the crash).
-On the other hand, functional data can contain personal information. However, a user action, such as requesting news or asking Cortana a question, usually triggers collection and transmission of functional data.
-
-If you’re an IT pro that wants to manage Windows functional data sent from your organization to Microsoft, see [Manage connections from Windows operating system components to Microsoft services](https://docs.microsoft.com/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services/).
-
-The following are specific examples of functional data:
-
-- Current location for weather
-- Bing searches
-- Wallpaper and desktop settings synced across multiple devices
+For more information about how Windows diagnostic data is used, see [Diagnostics, feedback, and privacy in Windows 10](https://support.microsoft.com/help/4468236/diagnostics-feedback-and-privacy-in-windows-10-microsoft-privacy).
### Diagnostic data gives users a voice
-Windows and Windows Server diagnostic data gives every user a voice in the operating system’s development and ongoing improvement. It helps us understand how Windows 10 and Windows Server behaves in the real world, focus on user priorities, and make informed decisions that benefit them. For our enterprise customers, representation in the dataset on which we will make future design decisions is a real benefit. The following sections offer real examples of these benefits.
+Diagnostic data gives every user a voice in the operating system’s development and ongoing improvement. It helps us understand how Windows 10 and Windows Server behaves in the real world, focus on user priorities, and make informed decisions that benefit both consumer and enterprise customers. The following sections offer real examples of these benefits.
-### Improve app and driver quality
+### _Improve app and driver quality_
-Our ability to collect diagnostic data that drives improvements to Windows and Windows Server helps raise the bar for app and device driver quality. Diagnostic data helps us to quickly identify and fix critical reliability and security issues with apps and device drivers on given configurations. For example, we can identify an app that hangs on devices using a specific version of a video driver, allowing us to work with the app and device driver vendor to quickly fix the issue. The result is less downtime and reduced costs and increased productivity associated with troubleshooting these issues.
+Our ability to collect diagnostic data that drives improvements to Windows and Windows Server helps raise the bar for app and device driver quality. Diagnostic data helps us to quickly identify and fix critical reliability and security issues with apps and device drivers used on Windows. For example, we can identify an app that hangs on devices using a specific version of a video driver, allowing us to work with the app and device driver vendor to quickly fix the issue. The result is less downtime and reduced costs and increased productivity associated with troubleshooting these issues.
-#### Real-world example of how Windows diagnostic data helps
+For example, in an earlier version of Windows 10 there was a version of a video driver that was crashing on some devices, causing the device to restart. We detected the problem in our diagnostic data, and immediately contacted the third-party developer who builds the video driver. Working with the developer, we provided an updated driver to Windows Insiders within 24 hours. Based on diagnostic data from the Windows Insiders’ devices, we were able to validate the new version of the video driver and rolled it out to the broad public as an update the next day. Diagnostic data helped us find, fix, and resolve this problem in just 48 hours, providing a better user experience and reducing costly support calls.
-There was a version of a video driver that was crashing on some devices running Windows 10, causing the device to reboot. We detected the problem in our diagnostic data, and immediately contacted the third-party developer who builds the video driver. Working with the developer, we provided an updated driver to Windows Insiders within 24 hours. Based on diagnostic data from the Windows Insiders’ devices, we were able to validate the new version of the video driver, and rolled it out to the broad public as an update the next day. Diagnostic data helped us find, fix, and resolve this problem in just 48 hours, providing a better user experience and reducing costly support calls.
+### _Improve end-user productivity_
-### Improve end-user productivity
-
-Windows diagnostic data also helps Microsoft better understand how customers use (or do not use) the operating system’s features and related services. The insights we gain from this data helps us prioritize our engineering effort to directly impact our customers’ experiences. Examples are:
+Windows diagnostic data also helps Microsoft better understand how customers use (or do not use) the operating system’s features and related services. The insights we gain from this data helps us prioritize our engineering effort to directly impact our customers’ experiences. These examples show how the use of diagnostic data enables Microsoft to build or enhance features which can help organizations increase employee productivity while lowering help desk calls.
- **Start menu.** How do people change the Start menu layout? Do they pin other apps to it? Are there any apps that they frequently unpin? We use this dataset to adjust the default Start menu layout to better reflect people’s expectations when they turn on their device for the first time.
- **Cortana.** We use diagnostic data to monitor the scalability of our cloud service, improving search performance.
-- **Application switching.** Research and observations from earlier Windows versions showed that people rarely used Alt+Tab to switch between applications. After discussing this with some users, we learned they loved the feature, saying that it would be highly productive, but they did not know about it previously. Based on this, we created the Task View button in Windows 10 to make this feature more discoverable. Later diagnostic data showed significantly higher usage of this feature.
-
-**These examples show how the use of diagnostic data enables Microsoft to build or enhance features which can help organizations increase employee productivity while lowering help desk calls.**
-
-### Insights into your own organization
-
-Sharing information with Microsoft helps make Windows and other products better, but it can also help make your internal processes and user experiences better. Microsoft provides a set of solutions that leverage information shared by customers to provide insights customized for your internal use. The first of these was [Upgrade Readiness](/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness), followed by [Desktop Analytics](https://aka.ms/DADocs). Both help organizations with [Windows as a Service](/windows/deployment/update/wass-overview) adoption and potential compatibility challenges. For E5 customers, [Microsoft Defender Advanced Threat Protection](/windows/security/threat-protection/microsoft-defender-atp/microsoft-defender-advanced-threat-protection), a platform designed to help enterprise networks prevent, detect, investigate, and respond to advanced threats.
+- **Application switching.** Research and observations from earlier Windows versions showed that people rarely used Alt+Tab to switch between apps. After discussing this with some users, we learned they loved the feature, saying that it would be highly productive, but they did not know about it previously. Based on this, we created the Task View button in Windows 10 to make this feature more discoverable. Later diagnostic data showed significantly higher usage of this feature.
## How Microsoft handles diagnostic data
-The diagnostic data is categorized into four levels:
-
-- [**Security**](#security-level). Information that’s required to help keep Windows and Windows Server secure, including data about the Connected User Experiences and Telemetry component settings, the Malicious Software Removal Tool, and Windows Defender.
-
-- [**Basic**](#basic-level). Basic device info, including: quality-related data, app compatibility, and data from the **Security** level.
-
-- [**Enhanced**](#enhanced-level). Additional insights, including: how Windows, Windows Server, and apps are used, how they perform, advanced reliability data, and data from both the **Basic** and the **Security** levels.
-
-- [**Full**](#full-level). Includes information about the websites you browse, how you use apps and features, plus additional information about device health, device activity (sometimes referred to as usage), and enhanced error reporting. At Full, Microsoft also collects the memory state of your device when a system or app crash occurs. It includes data from the **Security**, **Basic**, and **Enhanced** levels.
-
-Diagnostic data levels are cumulative, meaning each subsequent level includes data collected through lower levels. For more information see the [Diagnostic data levels](#diagnostic-data-levels) section.
+Use the following sections to learn more about how Microsoft handles diagnostic data.
### Data collection
-Windows 10 and Windows Server includes the Connected User Experiences and Telemetry component, which uses Event Tracing for Windows (ETW) tracelogging technology that gathers and stores diagnostic data events and data. The operating system and some Microsoft management solutions, such as System Center, use the same logging technology.
+Depending on the diagnostic data settings on the device, diagnostic data can be collected via the following methods:
+ - Small payloads of structured information referred to as diagnostic data events, managed by the Connected User Experiences and Telemetry component.
+ - Diagnostic logs for additional troubleshooting, also managed by the Connected User Experience and Telemetry component.
+ - Crash reporting and crash dumps, managed by [Windows Error Reporting](https://docs.microsoft.com/en-us/windows/win32/wer/windows-error-reporting).
-1. Operating system features and some management applications are instrumented to publish events and data. Examples of management applications include Virtual Machine Manager (VMM), Server Manager, and Storage Spaces.
-1. Events are gathered using public operating system event logging and tracing APIs.
-1. You can configure the diagnostic data level by using MDM policy, Group Policy, or registry settings.
-1. The Connected User Experiences and Telemetry component transmits the diagnostic data.
-
-Info collected at the Enhanced and Full levels of diagnostic data is typically gathered at a fractional sampling rate, which can be as low as 1% of devices reporting data at those levels.
+Later in this document we provide further details about how to control what’s collected and what data can be included in these different types of diagnostic data.
### Data transmission
-All diagnostic data is encrypted using SSL and uses certificate pinning during transfer from the device to the Microsoft Data Management Service. With Windows 10, data is uploaded on a schedule that is sensitive to event priority, battery use, and network cost. Real-time events, such as Windows Defender Advanced Threat Protection, are always sent immediately. Normal events are not uploaded on metered networks, unless you are on a metered server connection. On a free network, normal events can be uploaded every 4 hours if on battery, or every 15 minutes if on A/C power. Diagnostic and crash data are only uploaded on A/C power and free networks.
-
-The data transmitted at the Basic and Enhanced data diagnostic levels is quite small; typically less than 1 MB per device per day, but occasionally up to 2 MB per device per day.
+All diagnostic data is encrypted using TLS and uses certificate pinning during transfer from the device to the Microsoft data management services.
### Endpoints
-The Microsoft Data Management Service routes data back to our secure cloud storage. Only Microsoft personnel with a valid business justification are permitted access.
+The following table lists the endpoints related how you can manage the collection and control of diagnostic data. For more information around the endpoints that are used to send data back to Microsoft, see [Manage connection endpoints for Windows 10 Enterprise, version 1903](manage-windows-1903-endpoints).
-Solutions like Desktop Analytics or Microsoft Defender Advanced Threat Protection need Windows devices to reach diagnostics endpoints which enable organizations to leverage solutions based on diagnostics data. These solutions leverage Windows components like the Connected User Experiences and Telemetry service, Windows Defender Advanced Threat Protection service, Windows Error Reporting, and Online Crash Analysis.
-
-For a complete list of diagnostics endpoints leveraged by Desktop Analytics, see [Enable data sharing for Desktop Analytics](https://docs.microsoft.com/configmgr/desktop-analytics/enable-data-sharing).
-For a complete list of diagnostics endpoints leveraged by Microsoft Defender Advanced Threat Protection, see [Enable access to Microsoft Defender ATP service URLs in the proxy server](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/configure-proxy-internet#enable-access-to-microsoft-defender-atp-service-urls-in-the-proxy-server).
-
-The following table defines the endpoints for Connected User Experiences and Telemetry component:
-
-| Windows release | Endpoint |
+| Windows service | Endpoint |
| - | - |
-| Windows 10, versions 1703 or later, with the 2018-09 cumulative update installed | **Diagnostics data:** v10c.vortex-win.data.microsoft.com**Functional:** v20.vortex-win.data.microsoft.com**Microsoft Defender Advanced Threat Protection** is country specific and the prefix changes by country,for example: **de**.vortex-win.data.microsoft.com**Settings:** settings-win.data.microsoft.com |
-| Windows 10, versions 1803 or later, without the 2018-09 cumulative update installed | **Diagnostics data:** v10.events.data.microsoft.com**Functional:** v20.vortex-win.data.microsoft.com**Microsoft Defender Advanced Threat Protection** is country specific and the prefix changes by country,for example: **de**.vortex-win.data.microsoft.com**Settings:** settings-win.data.microsoft.com |
-| Windows 10, version 1709 or earlier | **Diagnostics data:** v10.vortex-win.data.microsoft.com**Functional:** v20.vortex-win.data.microsoft.com**Microsoft Defender Advanced Threat Protection** is country specific and the prefix changes by country,for example: **de**.vortex-win.data.microsoft.com**Settings:** settings-win.data.microsoft.com |
-
-The following table defines **additional diagnostics endpoints** not covered by services in the links above:
-
-| Service | Endpoint |
-| - | - |
-| OneDrive app for Windows 10 | |
-
-The following table defines the endpoints for other diagnostic data services:
-
-| Service | Endpoint |
-| - | - |
-| [Windows Error Reporting](https://msdn.microsoft.com/library/windows/desktop/bb513641.aspx) | watson.telemetry.microsoft.com |
+|Connected User Experiences and Telemetry | v10.events.data.microsoft.com |
+| | v10c.events.data.microsoft.com |
+| | v10.vortex-win.data.microsoft.com |
+| [Windows Error Reporting](https://docs.microsoft.com/windows/win32/wer/windows-error-reporting) | watson.telemetry.microsoft.com |
+| | watson.microsoft.com |
+| | umwatsonc.telemetry.microsoft.com |
+| | umwatsonc.events.data.microsoft.com |
+| | *-umwatsonc.events.data.microsoft.com |
| | ceuswatcab01.blob.core.windows.net |
| | ceuswatcab02.blob.core.windows.net |
| | eaus2watcab01.blob.core.windows.net |
| | eaus2watcab02.blob.core.windows.net |
| | weus2watcab01.blob.core.windows.net |
| | weus2watcab02.blob.core.windows.net |
-| [Online Crash Analysis](https://msdn.microsoft.com/library/windows/desktop/ee416349.aspx) | oca.telemetry.microsoft.com |
-| OneDrive app for Windows 10 | vortex.data.microsoft.com/collect/v1 |
-| Microsoft Defender Advanced Threat Protection | |
+|Authentication | login.live.com
IMPORTANT: This endpoint is used for device authentication. We do not recommend disabling this endpoint.
+| [Online Crash Analysis](https://docs.microsoft.com/en-us/windows/win32/dxtecharts/crash-dump-analysis) | oca.telemetry.microsoft.com |
+| | oca.microsoft.com
+| | kmwatsonc.telemetry.microsoft.com
+| | *-kmwatsonc.telemetry.microsoft.com
+|Settings | settings-win.data.microsoft.com
IMPORTANT: This endpoint is used to remotely configure diagnostics-related settings and data collection. For example, we use the settings endpoint to remotely block an event from being sent back to Microsoft. We do not recommend disabling this endpoint. This endpoint does not upload Windows diagnostic data
-### Data use and access
+### Data access
-The principle of least privileged access guides access to diagnostic data. Microsoft does not share personal data of our customers with third parties, except at the customer’s discretion or for the limited purposes described in the [Privacy Statement](https://privacy.microsoft.com/privacystatement). Microsoft may share business reports with OEMs and third-party partners that include aggregated and anonymized diagnostic data information. Data-sharing decisions are made by an internal team including privacy, legal, and data management.
+The principle of least privileged access guides access to Windows diagnostic data. Microsoft does not share personal data of our customers with third parties, except at the customer’s discretion or for the limited purposes described in the [Privacy Statement](https://privacy.microsoft.com/en-US/privacystatement). Microsoft may share business reports with hardware manufacturers and third-party partners that include aggregated and anonymized diagnostic data information. Data-sharing decisions are made by an internal team including privacy, legal, and data management. Only Microsoft personnel with a valid business justification are permitted access.
### Retention
-Microsoft believes in and practices information minimization. We strive to gather only the info we need and to store it only for as long as it’s needed to provide a service or for analysis. Much of the info about how Windows and apps are functioning is deleted within 30 days. Other info may be retained longer, such as error reporting data or Microsoft Store purchase history.
+Microsoft believes in and practices data minimization. We strive to gather only the info we need and to store it only for as long as it’s needed to provide a service or for analysis. For more information on how long data is retained, see the section named **Our retention of personal data** in the [Microsoft Privacy Statement](https://privacy.microsoft.com/en-US/privacystatement).
-## Manage enterprise diagnostic data level
+#### Diagnostic data settings
-### Enterprise management
+There are four diagnostic data collection settings. Each setting is described in more detail in the sections that follow.
-Sharing diagnostic data with Microsoft is enabled by default on Windows 10, 1903 and later. Sharing this data provides many benefits to enterprises, so we do not recommend turning it off. For most enterprise customers, simply adjusting the diagnostic data level and managing specific components is the best option.
+- Diagnostic data off (Security)
+- Required diagnostic data (Basic)
+- Enhanced
+- Optional diagnostic data (Full)
-Customers can set the diagnostic data level in both the user interface and with existing management tools. Users can change the diagnostic data level in the **Diagnostic data** setting. In the **Settings** app, in **Privacy** > **Diagnostics & feedback**. They can choose between Basic and Full. The Enhanced level will only be displayed as an option when Group Policy or Mobile Device Management (MDM) are invoked with this level. The Security level is not available.
+Here’s a summary of the types of data that is included with each setting:
-IT pros can use various methods, including Group Policy and Mobile Device Management (MDM), to choose a diagnostic data level. If you’re using Windows 10 Enterprise, Windows 10 Education, or Windows Server, the Security diagnostic data level is available when managing the policy. Setting the diagnostic data level through policy sets the upper boundary for the users’ choices. To disable user choice after setting the level with the policy, you will need to use the "Configure telemetry opt-in setting user interface" group policy. The remainder of this article describes how to use group policy to configure levels and settings interface.
+| | **Diagnostic data off (Security)** | **Required (Basic)** | **Enhanced** |**Optional (Full)**|
+| --- | --- | --- | --- | --- |
+| **Diagnostic data events** | No Windows diagnostic data sent. | Minimum data required data to keep the device secure, up to date, and performing as expected. | Additional data about the websites you browse, how Windows and apps are used and how they perform, and device activity. The additional data helps Microsoft to fix and improve products and services for all users. | Additional data about the websites you browse, how Windows and apps are used and how they perform. This data also includes data about device activity, and enhanced error reporting that helps Microsoft to fix and improve products and services for all users.|
+| **Crash Metadata** | N/A | Yes | Yes | Yes |
+| **Crash Dumps** | N/A | No | Triage dumps only
For more information about crash dumps, see [Windows Error Reporting](https://docs.microsoft.com/windows/win32/wer/windows-error-reporting). | Full memory dumps
For more information about crash dumps, see [Windows Error Reporting](https://docs.microsoft.com/windows/win32/wer/windows-error-reporting). |
+| **Crash Metadata** | N/A | No | No | No |
+| **Data collection** | N/A | 100% | Sampling applies | Sampling applies |
-#### Manage your diagnostic data settings
-Use the steps in this article to set and/or adjust the diagnostic data settings for Windows and Windows Server in your organization.
+#### Diagnostic data off
-> [!IMPORTANT]
-> These diagnostic data levels only apply to Windows and Windows Server components and apps that use the Connected User Experiences and Telemetry component. Non-Windows components, such as Microsoft Office or other 3rd-party apps, may communicate with their cloud services outside of these diagnostic data levels. You should work with your app vendors to understand their diagnostic data policy, and how you can to opt in or opt out. For more information on how Microsoft Office uses diagnostic data, see [Overview of privacy controls for Microsoft 365 Apps for enterprise](/deployoffice/privacy/overview-privacy-controls).
+This setting was previously labeled as **Security**. When you configure this setting, no Windows diagnostic data is sent from your device. This is only available on Windows Server, Windows 10 Enterprise, and Windows 10 Education. If you choose this setting, devices in your organization will still be secure.
-The lowest diagnostic data setting level supported through management policies is **Security**. The lowest diagnostic data setting supported through the Settings UI is **Basic**. The default diagnostic data setting for Windows Server is **Enhanced**.
+>[!NOTE]
+> If your organization relies on Windows Update, the minimum recommended setting is **Required diagnostic data**. Because no Windows Update information is collected when diagnostic data is off, important information about update failures is not sent. Microsoft uses this information to fix the causes of those failures and improve the quality of our updates.
-### Configure the diagnostic data level
+#### Required diagnostic data
-You can configure your device's diagnostic data settings using the management tools you’re already using, such as Group Policy, MDM, or Windows Provisioning. You can also manually change your settings using Registry Editor. Setting your diagnostic data levels through a management policy sets the upper level for diagnostic data on the device.
+Required diagnostic data, previously labeled as **Basic**, gathers a limited set of data that’s critical for understanding the device and its configuration. This data helps to identify problems that can occur on a specific hardware or software configuration. For example, it can help determine if crashes are more frequent on devices with a specific amount of memory or that are running a specific driver version.
+
+This is the default setting for Windows 10 Education editions, as well as all desktop editions starting with Windows 10, version 1903.
+
+Required diagnostic data includes:
+
+- Basic device data that helps provide an understanding about the types of Windows devices and the configurations and types of native and virtualized Windows Servers in the ecosystem. Examples include:
+
+ - Device attributes, such as camera resolution and display type
+ - Battery attributes, such as capacity and type
+ - Networking attributes, such as number of network adapters, speed of network adapters, mobile operator network, and IMEI number
+ - Processor and memory attributes, such as number of cores, architecture, speed, memory size, and firmware
+ - Virtualization attribute, such as Second Level Address Translation (SLAT) support and guest operating system
+ - Operating system attributes, such as Windows edition and virtualization state
+ - Storage attributes, such as number of drives, type, and size
+
+- Quality metrics that helps provide an understanding about how the Connected User Experiences and diagnostic data component is functioning, including % of uploaded events, dropped events, blocked events, and the last upload time.
+
+- Quality-related information that helps Microsoft develop a basic understanding of how a device and its operating system are performing. Some examples are the device characteristics of a Connected Standby device, the number of crashes or hangs, and app state change details, such as how much processor time and memory were used, and the total uptime for an app.
+
+- Compatibility data that helps provide an understanding about which apps are installed on a device or virtual machine and identifies potential compatibility problems.
+
+- System data that helps provide an understanding about whether a device meets the minimum requirements to upgrade to the next version of the operating system. System information includes the amount of memory, as well as information about the processor and BIOS.
+
+- A list of accessory device data, such as printers or external storage devices, that are connected to Windows devices and whether these devices will function after upgrading to a new version of the operating system.
+
+- Driver data that includes specific driver activity that’s meant to help figure out whether apps and devices will function after upgrading to a new version of the operating system. This can help to determine blocking issues and then help Microsoft and our partners apply fixes and improvements.
+
+- Information about how the Microsoft Store performs, including app downloads, installations, and updates. It also includes Microsoft Store launches, page views, suspend and resumes, and obtaining licenses.
+
+#### Enhanced diagnostic data
+
+>[!NOTE]
+We’re simplifying your diagnostic data controls by moving from four diagnostic data controls to three: **Diagnostic data off**, **Required**, and **Optional**. making changes to the enhanced diagnostic data level. For more info about this change, see [Changes to Windows diagnostic data](changes-to-windows-diagnostic-data-collection).
+
+Enhanced diagnostic data includes data about the websites you browse, how Windows and apps are used and how they perform, and device activity. The additional data helps Microsoft to fix and improve products and services for all users. When you choose to send enhanced diagnostic data, required diagnostic data will always be included, and we collect the following additional information:
+ - Operating system events that help to gain insights into different areas of the operating system, including networking, Hyper-V, Cortana, storage, file system, and other components.
+ - Operating system app events resulting from Microsoft apps and management tools that were downloaded from the Microsoft Store or pre-installed with Windows or Windows Server, including Server Manager, Photos, Mail, and Microsoft Edge.
+ - Device-specific events that are specific to certain devices, such as Surface Hub and Microsoft HoloLens. For example, Microsoft HoloLens sends Holographic Processing Unit (HPU)-related events.
+ - All crash dump types, except for heap dumps and full dumps. For more information about crash dumps, see [Windows Error Reporting](https://docs.microsoft.com/windows/win32/wer/windows-error-reporting).
+
+ #### Optional diagnostic data
+
+Optional diagnostic data, previously labeled as **Full**, includes more detailed information about your device and its settings, capabilities, and device health. Optional diagnostic data also includes data about the websites you browse, device activity, and enhanced error reporting that helps Microsoft to fix and improve products and services for all users. When you choose to send optional diagnostic data, required diagnostic data will always be included, and we collect the following additional information:
+
+ - Additional data about the device, connectivity, and configuration, beyond that collected under required diagnostic data.
+ - Status and logging information about the health of operating system and other system components beyond what is collected under required diagnostic data.
+ - App activity, such as which programs are launched on a device, how long they run, and how quickly they respond to input.
+ - Browser activity, including browsing history and search terms, in Microsoft browsers (Microsoft Edge or Internet Explorer).
+ - Enhanced error reporting, including the memory state of the device when a system or app crash occurs (which may unintentionally contain user content, such as parts of a file you were using when the problem occurred). Crash data is never used for Tailored experiences.
+
+>[!Note]
+>Crash dumps collected in optional diagnostic data may unintentionally contain personal data, such as portions of memory from a document and a web page. For more information about crash dumps, see [Windows Error Reporting](https://docs.microsoft.com/windows/win32/wer/windows-error-reporting).
+
+#### Manage enterprise diagnostic data
+
+Use the steps in this section to configure the diagnostic data settings for Windows and Windows Server in your organization.
+
+>[!IMPORTANT]
+>These diagnostic data settings only apply to components, features, and apps that are considered a part of the Windows operating system. Third-party apps and other Microsoft apps, such as Microsoft Office, that customers install may also collect and send diagnostic data using their own controls. You should work with your app vendors to understand their diagnostic data policy, and how you can opt in or opt out. For more information on how Microsoft Office uses diagnostic data, see [Overview of privacy controls for Microsoft 365 Apps for enterprise](https://docs.microsoft.com/deployoffice/privacy/overview-privacy-controls). If you would like to control Windows data collection that is not Windows diagnostic data, see [Manage connections from Windows operating system components to Microsoft services](manage-connections-from-windows-operating-system-components-to-microsoft-services).
+
+You can configure your device's diagnostic data settings using the management tools you’re already using, such as Group Policy or MDM.
Use the appropriate value in the table below when you configure the management policy.
-| Level | Value |
+| Category | Value |
| - | - |
-| Security | **0** |
-| Basic | **1** |
-| Enhanced | **2** |
-| Full | **3** |
+|Diagnostic data off (Security) | 0 |
+| Required (Basic) | 1 |
+| Enhanced | 2 |
+|Optional (Full) | 3 |
- > [!NOTE]
- > When both the Computer Configuration policy and User Configuration policy are set, the more restrictive policy is used.
+>[!Note]
+>When both the Computer Configuration policy and User Configuration policies are set, the more restrictive policy is used.
-### Use Group Policy to set the diagnostic data level
+#### Use Group Policy to manage diagnostic data collection
-Use a Group Policy object to set your organization’s diagnostic data level.
+You can use Group Policy to set your organization’s diagnostic data setting:
-1. From the Group Policy Management Console, go to **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Data Collection and Preview Builds**.
+1. From the Group Policy Management Console, go to **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Data Collection and Preview Builds**.
-1. Double-click **Allow Telemetry**.
+ 1. Double-click **Allow Telemetry**.
-1. In the **Options** box, select the level that you want to configure, and then click **OK**.
+>[!NOTE]
+> If devices in your organization are running Windows 10, 1803 and newer, the user can still use Settings to set the diagnostic data setting to a more restrictive value, unless the **Configure diagnostic data opt-in settings user interface** policy is set.
-### Use MDM to set the diagnostic data level
+ 2. In the **Options** box, choose the setting that you want to configure, and then click **OK**.
-Use the [Policy Configuration Service Provider (CSP)](https://docs.microsoft.com/windows/client-management/mdm/policy-configuration-service-provider) to apply the System/AllowTelemetry MDM policy.
+#### Use MDM to manage diagnostic data collection
-### Use Registry Editor to set the diagnostic data level
+[Policy Configuration Service Provider (CSP)](https://docs.microsoft.com/windows/client-management/mdm/policy-configuration-service-provider) to apply the System/AllowTelemetry MDM policy.
-Use Registry Editor to manually set the registry level on each device in your organization or you can write a script to edit the registry. If a management policy already exists, such as Group Policy or MDM, it will override this registry setting.
+#### Limit optional diagnostic data for Desktop Analytics
-1. Open Registry Editor, and go to **HKEY\_LOCAL\_MACHINE\\Software\\Policies\\Microsoft\\Windows\\DataCollection**.
-
-1. Right-click **DataCollection**, click New, and then click **DWORD (32-bit) Value**.
-
-1. Type **AllowTelemetry**, and then press ENTER.
-
-1. Double-click **AllowTelemetry**, set the desired value from the table above, and then click **OK.**
-
-1. Click **File** > **Export**, and then save the file as a .reg file, such as **C:\\AllowTelemetry.reg**. You can run this file from a script on each device in your organization.
-
-### Additional diagnostic data controls
-
-There are a few more settings that you can turn off that may send diagnostic data information:
-
-- To turn off Windows Update diagnostic data, you have two choices. Either turn off Windows Update, or set your devices to be managed by an on premises update server, such as [Windows Server Update Services (WSUS)](https://docs.microsoft.com/windows-server/administration/windows-server-update-services/get-started/windows-server-update-services-wsus) or [Microsoft Endpoint Configuration Manager](https://docs.microsoft.com/configmgr/index/).
-
-- Turn off **Windows Defender Cloud-based Protection** and **Automatic sample submission** in **Settings** > **Update & security** > **Windows Defender**.
-
-- Manage the Malicious Software Removal Tool in your organization. For more info, see Microsoft KB article [891716](https://support.microsoft.com/kb/891716).
-
-- Turn off **Improve inking and typing** in **Settings** > **Privacy**. At diagnostic data levels **Enhanced** and **Full**, Microsoft uses Linguistic Data Collection info to improve language model features such as autocomplete, spellcheck, suggestions, input pattern recognition, and dictionary.
-
- > [!NOTE]
- > Microsoft does not intend to gather sensitive information, such as credit card numbers, usernames and passwords, email addresses, or other similarly sensitive information for Linguistic Data Collection. We guard against such events by using technologies to identify and remove sensitive information before linguistic data is sent from the user's device. If we determine that sensitive information has been inadvertently received, we delete the information.
-
-## Diagnostic data levels
-
-These levels are available on all desktop and mobile editions of Windows 10, except for the **Security** level, which is limited to Windows 10 Enterprise, Windows 10 Education, Windows 10 Mobile Enterprise, Windows 10 IoT Core (IoT Core), and Windows Server.
-
-### Security level
-
-The Security level gathers only the diagnostic data info that is required to keep Windows devices, Windows Server, and guests protected with the latest security updates. This level is only available on Windows Server, Windows 10 Enterprise, Windows 10 Education, Windows 10 Mobile Enterprise, and Windows IoT Core editions.
-
-> [!NOTE]
-> If your organization relies on Windows Update for updates, you shouldn’t use the **Security** level. Because no Windows Update information is gathered at this level, important information about update failures is not sent. Microsoft uses this information to fix the causes of those failures and improve the quality of our updates.
-
-Windows Server Update Services (WSUS) and Microsoft Endpoint Configuration Manager functionality is not affected at this level, nor is diagnostic data about Windows Server features or System Center gathered.
-
-The data gathered at this level includes:
-
-- **Connected User Experiences and Telemetry component settings**. If general diagnostic data has been gathered and is queued, it is sent to Microsoft. Along with this diagnostic data, the Connected User Experiences and Telemetry component may download a configuration settings file from Microsoft’s servers. This file is used to configure the Connected User Experiences and Telemetry component itself. The data gathered by the client for this request includes OS information, device id (used to identify what specific device is requesting settings) and device class (for example, whether the device is server or desktop).
-
-- **Malicious Software Removal Tool (MSRT)** The MSRT infection report contains information, including device info and IP address.
-
- > [!NOTE]
- > You can turn off the MSRT infection report. No MSRT information is included if MSRT is not used. If Windows Update is turned off, MSRT will not be offered to users. For more info, see Microsoft KB article [891716](https://support.microsoft.com/kb/891716).
-
-- **Windows Defender/Endpoint Protection**. Windows Defender and System Center Endpoint Protection requires some information to function, including: anti-malware signatures, diagnostic information, User Account Control settings, Unified Extensible Firmware Interface (UEFI) settings, and IP address.
-
- > [!NOTE]
- > This reporting can be turned off and no information is included if a customer is using third-party antimalware software, or if Windows Defender is turned off. For more info, see [Windows Defender](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-defender).
-
- Microsoft recommends that Windows Update, Windows Defender, and MSRT remain enabled unless the enterprise uses alternative solutions such as Windows Server Update Services, Microsoft Endpoint Configuration Manager, or a third-party antimalware solution. Windows Update, Windows Defender, and MSRT provide core Windows functionality such as driver and OS updates, including security updates.
-
-For servers with default diagnostic data settings and no Internet connectivity, you should set the diagnostic data level to **Security**. This stops data gathering for events that would not be uploaded due to the lack of Internet connectivity.
-
-No user content, such as user files or communications, is gathered at the **Security** diagnostic data level, and we take steps to avoid gathering any information that directly identifies a company or user, such as name, email address, or account ID. However, in rare circumstances, MSRT information may unintentionally contain personal information. For instance, some malware may create entries in a computer’s registry that include information such as a username, causing it to be gathered. MSRT reporting is optional and can be turned off at any time.
-
-### Basic level
-
-The Basic level gathers a limited set of data that’s critical for understanding the device and its configuration. This level also includes the **Security** level data. This level helps to identify problems that can occur on a specific hardware or software configuration. For example, it can help determine if crashes are more frequent on devices with a specific amount of memory or that are running a specific driver version. The Connected User Experiences and Telemetry component does not gather diagnostic data about System Center, but it can transmit diagnostic data for other non-Windows applications if they have user consent.
-
-This is the default level for Windows 10 Education editions, as well as all desktop editions starting with Windows 10, version 1903.
-
-The normal upload range for the Basic diagnostic data level is between 109 KB - 159 KB per day, per device.
-
-The data gathered at this level includes:
-
-- **Basic device data**. Helps provide an understanding about the types of Windows devices and the configurations and types of native and virtualized Windows Servers in the ecosystem. Examples include:
-
- - Device attributes, such as camera resolution and display type
- - Internet Explorer version
- - Battery attributes, such as capacity and type
- - Networking attributes, such as number of network adapters, speed of network adapters, mobile operator network, and IMEI number
- - Processor and memory attributes, such as number of cores, architecture, speed, memory size, and firmware
- - Virtualization attribute, such as Second Level Address Translation (SLAT) support and guest operating system
- - Operating system attributes, such as Windows edition and virtualization state
- - Storage attributes, such as number of drives, type, and size
-
-- **Connected User Experiences and Telemetry component quality metrics**. Helps provide an understanding about how the Connected User Experiences and Telemetry component is functioning, including % of uploaded events, dropped events, and the last upload time.
-
-- **Quality-related information**. Helps Microsoft develop a basic understanding of how a device and its operating system are performing. Some examples are the device characteristics of a Connected Standby device, the number of crashes or hangs, and application state change details, such as how much processor time and memory were used, and the total uptime for an app.
-
-- **Compatibility data**. Helps provide an understanding about which apps are installed on a device or virtual machine and identifies potential compatibility problems.
-
- - **General app data and app data for Internet Explorer add-ons**. Includes a list of apps that are installed on a native or virtualized instance of the OS and whether these apps function correctly after an upgrade. This app data includes the app name, publisher, version, and basic details about which files have been blocked from usage.
-
- - **Internet Explorer add-ons**. Includes a list of Internet Explorer add-ons that are installed on a device and whether these apps will work after an upgrade.
-
- - **System data**. Helps provide an understanding about whether a device meets the minimum requirements to upgrade to the next version of the operating system. System information includes the amount of memory, as well as information about the processor and BIOS.
-
- - **Accessory device data**. Includes a list of accessory devices, such as printers or external storage devices, that are connected to Windows PCs and whether these devices will function after upgrading to a new version of the operating system.
-
- - **Driver data**. Includes specific driver usage that’s meant to help figure out whether apps and devices will function after upgrading to a new version of the operating system. This can help to determine blocking issues and then help Microsoft and our partners apply fixes and improvements.
-
-- **Microsoft Store**. Provides information about how the Microsoft Store performs, including app downloads, installations, and updates. It also includes Microsoft Store launches, page views, suspend and resumes, and obtaining licenses.
-
-### Enhanced level
-
-The Enhanced level gathers data about how Windows and apps are used and how they perform. This level also includes data from both the **Basic** and **Security** levels. This level helps to improve the user experience with the operating system and apps. Data from this level can be abstracted into patterns and trends that can help Microsoft determine future improvements.
-
-This level is needed to quickly identify and address Windows and Windows Server quality issues.
-
-The normal upload range for the Enhanced diagnostic data level is between 239 KB - 348 KB per day, per device.
-
-The data gathered at this level includes:
-
-- **Operating system events**. Helps to gain insights into different areas of the operating system, including networking, Hyper-V, Cortana, storage, file system, and other components.
-
-- **Operating system app events**. A set of events resulting from Microsoft applications and management tools that were downloaded from the Store or pre-installed with Windows or Windows Server, including Server Manager, Photos, Mail, and Microsoft Edge.
-
-- **Device-specific events**. Contains data about events that are specific to certain devices, such as Surface Hub and Microsoft HoloLens. For example, Microsoft HoloLens sends Holographic Processing Unit (HPU)-related events.
-
-- **Some crash dump types**. All crash dump types, except for heap dumps and full dumps.
-
-If the Connected User Experiences and Telemetry component detects a problem on Windows 10 that requires gathering more detailed instrumentation, the Connected User Experiences and Telemetry component at the **Enhanced** diagnostic data level will only gather data about the events associated with the specific issue.
-
-### Full level
-
-The Full level gathers data necessary to identify and to help fix problems, following the approval process described below. This level also includes data from the Basic, Enhanced, and Security levels.
-
-Additionally, at this level, devices opted in to the [Windows Insider Program](http://insider.windows.com) will send events, such as reliability and app responsiveness. that can show Microsoft how pre-release binaries and features are performing. These events help us make decisions on which builds are flighted. All devices in the [Windows Insider Program](http://insider.windows.com) are automatically set to this level.
-
-If a device experiences problems that are difficult to identify or repeat using Microsoft’s internal testing, additional data becomes necessary. This data can include any user content that might have triggered the problem and is gathered from a small sample of devices that have both opted into the **Full** diagnostic data level and have exhibited the problem.
-
-However, before more data is gathered, Microsoft’s privacy governance team, including privacy and other subject matter experts, must approve the diagnostics request made by a Microsoft engineer. If the request is approved, Microsoft engineers can use the following capabilities to get the information:
-
-- Ability to run a limited, pre-approved list of Microsoft certified diagnostic tools, such as msinfo32.exe, powercfg.exe, and dxdiag.exe.
-
-- Ability to get registry keys.
-
-- All crash dump types, including heap dumps and full dumps.
-
-> [!NOTE]
-> Crash dumps collected at this diagnostic data level may unintentionally contain personal data, such as portions of memory from a documents, a web page, etc.
-
-## Limit Enhanced diagnostic data to the minimum required by Desktop Analytics
-
-> [!IMPORTANT]
-> The Upgrade Readiness and Device Health solutions of Windows Analytics are being retired on January 31, 2020. [Update Compliance](/windows/deployment/update/update-compliance-get-started) will continue to be supported.
-> For more information, see [Windows Analytics retirement on January 31, 2020](https://support.microsoft.com/help/4521815/windows-analytics-retirement).
-
-Desktop Analytics reports are powered by diagnostic data not included in the **Basic** level, such as crash reports and certain operating system events.
-
-In Windows 10, version 1709, we introduced the **Limit Enhanced diagnostic data to the minimum required by Windows Analytics** feature. When enabled, this feature lets you send only the following subset of **Enhanced** level diagnostic data.
-
-- **Operating system events.** Limited to a small set required for analytics reports and documented in the [Windows 10 diagnostic data events and fields collected through the limit enhanced diagnostic data policy](enhanced-diagnostic-data-windows-analytics-events-and-fields.md) topic.
-
-- **Some crash dump types.** Triage dumps for user mode and mini dumps for kernel mode.
-
-> [!NOTE]
-> Triage dumps are a type of [minidumps](https://docs.microsoft.com/windows/desktop/debug/minidump-files) that go through a process of user-sensitive information scrubbing. Some user-sensitive information may be missed in the process, and will therefore be sent with the dump.
-
-With the retirement of Windows Analytics, this policy will continue to be supported by Desktop Analytics, but will not include Office related diagnostic data.
-
-### Enable limiting enhanced diagnostic data to the minimum required by Desktop Analytics
-
-1. Set the diagnostic data level to **Enhanced**, using either Group Policy or MDM.
-
- a. Using Group Policy, set the **Computer Configuration/Administrative Templates/Windows Components/Data Collection and Preview Builds/Allow telemetry** setting to **2**.
-
- -OR-
-
- b. Using MDM, use the Policy CSP to set the **System/AllowTelemetry** value to **2**.
-
- -AND-
-
-1. Enable the **LimitEnhancedDiagnosticDataWindowsAnalytics** setting, using either Group Policy or MDM.
-
- a. Using Group Policy, set the **Computer Configuration/Administrative Templates/Windows Components/Data collection and Preview builds/Limit Enhanced diagnostic data to the minimum required by Windows Analytics** setting to **Enabled**.
-
- -OR-
-
- b. Using MDM, use the Policy CSP to set the **System/LimitEnhancedDiagnosticDataWindowsAnalytics** value to **1**.
-
-## Additional resources
-
-FAQs
-
-- [Cortana, Search, and privacy](https://privacy.microsoft.com/windows-10-cortana-and-privacy)
-- [Windows 10 feedback, diagnostics, and privacy](https://privacy.microsoft.com/windows-10-feedback-diagnostics-and-privacy)
-- [Windows 10 camera and privacy](https://privacy.microsoft.com/windows-10-camera-and-privacy)
-- [Windows 10 location service and privacy](https://privacy.microsoft.com/windows-10-location-and-privacy)
-- [Microsoft Edge and privacy](https://privacy.microsoft.com/windows-10-microsoft-edge-and-privacy)
-- [Windows 10 speech, inking, typing, and privacy](https://privacy.microsoft.com/windows-10-speech-inking-typing-and-privacy-faq)
-- [Windows Hello and privacy](https://privacy.microsoft.com/windows-10-windows-hello-and-privacy)
-- [Wi-Fi Sense](https://privacy.microsoft.com/windows-10-about-wifi-sense)
-- [Windows Update Delivery Optimization](https://privacy.microsoft.com/windows-10-windows-update-delivery-optimization)
-
-Blogs
-
-- [Privacy and Windows 10](https://blogs.windows.com/windowsexperience/2015/09/28/privacy-and-windows-10)
-
-Privacy Statement
-
-- [Microsoft Privacy Statement](https://privacy.microsoft.com/privacystatement)
-
-TechNet
-
-- [Manage connections from Windows operating system components to Microsoft services](manage-connections-from-windows-operating-system-components-to-microsoft-services.md)
-
-Web Pages
-
-- [Privacy at Microsoft](https://privacy.microsoft.com)
+For more information about how to limit the diagnostic data to the minimum required by Desktop Analytics, see [Enable data sharing for Desktop Analytics](https://docs.microsoft.com/en-us/mem/configmgr/desktop-analytics/enable-data-sharing).
\ No newline at end of file
diff --git a/windows/privacy/windows-10-and-privacy-compliance.md b/windows/privacy/windows-10-and-privacy-compliance.md
index 654f271d91..47a63b484c 100644
--- a/windows/privacy/windows-10-and-privacy-compliance.md
+++ b/windows/privacy/windows-10-and-privacy-compliance.md
@@ -25,7 +25,7 @@ Applies to:
## Overview
-IMPORTANT: Microsoft is [increasing transparency](https://blogs.microsoft.com/on-the-issues/2019/04/30/increasing-transparency-and-customer-control-over-data/) by categorizing the data we collect as required or optional. Windows 10 is in the process of updating devices to reflect this new categorization, and during this transition Basic diagnostic data will be recategorized as Required diagnostic data and Full diagnostic data will be recategorized as Optional diagnostic data. For more information, see [Changes to Windows diagnostic data](changes-to-windows-diagnostic-data-collection.md).
+IMPORTANT: Microsoft is [increasing transparency](https://blogs.microsoft.com/on-the-issues/2019/04/30/increasing-transparency-and-customer-control-over-data/) by categorizing the data we collect as required or optional. Windows 10 is in the process of updating devices to reflect this new categorization, and during this transition Basic diagnostic data will be recategorized as Required diagnostic data and Full diagnostic data will be recategorized as Optional diagnostic data. For more information, see [Changes to Windows diagnostic data](changes-to-windows-diagnostic-data-collection).
At Microsoft, we are deeply committed to data privacy across all our products and services. With this guide, we provide administrators and compliance professionals with data privacy considerations for Windows 10.
From 2a5b3f1b14f19ba4762525ce0c00c56edfd15ccf Mon Sep 17 00:00:00 2001
From: Sinead O'Sullivan
Date: Fri, 5 Jun 2020 21:11:08 +0100
Subject: [PATCH 0011/1414] updates to privacy docs
---
...s-to-windows-diagnostic-data-collection.md | 4 +--
.../windows-10-and-privacy-compliance.md | 27 ++++++++++---------
2 files changed, 16 insertions(+), 15 deletions(-)
diff --git a/windows/privacy/changes-to-windows-diagnostic-data-collection.md b/windows/privacy/changes-to-windows-diagnostic-data-collection.md
index b9785b1a62..fa81776ddf 100644
--- a/windows/privacy/changes-to-windows-diagnostic-data-collection.md
+++ b/windows/privacy/changes-to-windows-diagnostic-data-collection.md
@@ -76,8 +76,8 @@ A final set of changes includes two new policies that can help you fine-tune dia
With the Enhanced diagnostic data level being split out into new policies, we are providing additional controls to manage what types of dumps are collected and whether to send additional diagnostic logs. Here are some steps on how to configure them:
1. Choose to send optional diagnostic data by setting one of the following policies:
- - Group Policy: Computer Configuration > Administrative Templates > Windows Components > Data Collection and Preview Builds > **Allow Diagnostic Data**. Set the policy value to **Send optional diagnostic data**
- - MDM: System/AllowTelemetry. Set the policy value to 3.
+ - Group Policy: Computer Configuration > Administrative Templates > Windows Components > Data Collection and Preview Builds > **Allow Diagnostic Data**. Set the policy value to **Send optional diagnostic data**
+ - MDM: System/AllowTelemetry. Set the policy value to 3.
2. Enable the following Group Policy: Computer Configuration > Administrative Templates > Windows Components > Data Collection and Preview Builds > **Limit Dump Collection**
3. Enable the following Group Policy: Computer Configuration > Administrative Templates > Windows Components > Data Collection and Preview Builds > **Limit Diagnostic Log Collection**
diff --git a/windows/privacy/windows-10-and-privacy-compliance.md b/windows/privacy/windows-10-and-privacy-compliance.md
index 47a63b484c..0ecbeaf982 100644
--- a/windows/privacy/windows-10-and-privacy-compliance.md
+++ b/windows/privacy/windows-10-and-privacy-compliance.md
@@ -25,7 +25,8 @@ Applies to:
## Overview
-IMPORTANT: Microsoft is [increasing transparency](https://blogs.microsoft.com/on-the-issues/2019/04/30/increasing-transparency-and-customer-control-over-data/) by categorizing the data we collect as required or optional. Windows 10 is in the process of updating devices to reflect this new categorization, and during this transition Basic diagnostic data will be recategorized as Required diagnostic data and Full diagnostic data will be recategorized as Optional diagnostic data. For more information, see [Changes to Windows diagnostic data](changes-to-windows-diagnostic-data-collection).
+>[!IMPORTANT]
+>Microsoft is [increasing transparency](https://blogs.microsoft.com/on-the-issues/2019/04/30/increasing-transparency-and-customer-control-over-data/) by categorizing the data we collect as required or optional. Windows 10 is in the process of updating devices to reflect this new categorization, and during this transition Basic diagnostic data will be recategorized as Required diagnostic data and Full diagnostic data will be recategorized as Optional diagnostic data. For more information, see [Changes to Windows diagnostic data](changes-to-windows-diagnostic-data-collection).
At Microsoft, we are deeply committed to data privacy across all our products and services. With this guide, we provide administrators and compliance professionals with data privacy considerations for Windows 10.
@@ -48,7 +49,7 @@ The following table provides an overview of the Windows 10 privacy settings pres
| Feature/Setting | Description | Supporting Content | Privacy Statement |
| --- | --- | --- | --- |
-| Diagnostic Data | Microsoft uses diagnostic data to keep Windows secure, up to date, troubleshoot problems, and make product improvements. Regardless of what choices you make for diagnostic data collection, the device will be just as secure and will operate normally. This data is collected by Microsoft and stored with one or more unique identifiers that can help us recognize an individual user on an individual device and understand the device's service issues and use patterns.
Diagnostic data is categorized into the following:
- **Required diagnostic data**
Previously known as basic diagnostic data, required diagnostic data includes information about your device, its settings, capabilities, and whether it is performing properly, whether a device is ready for an update, and whether there are factors that may impede the ability to receive updates, such as low battery, limited disk space, or connectivity through a paid network. You can find out what is collected with required diagnostic data [here](https://docs.microsoft.com/windows/privacy/required-windows-diagnostic-events-and-fields-2004). - **Optional diagnostic data**
Previously known as full diagnostic data, optional diagnostic data includes more detailed information about your device and its settings, capabilities, and device health. When you choose to send optional diagnostic data, required diagnostic data will always be included. You can find out the types of optional diagnostic data collected [here](https://docs.microsoft.com/windows/privacy/windows-diagnostic-data).
| [Learn more](https://support.microsoft.com/en-us/4468236/diagnostics-feedback-and-privacy-in-windows-10-microsoft-privacy)
[Configure Windows diagnostic data in your organization](configure-windows-diagnostic-data-in-your-organization.md) | [Privacy Statement](https://privacy.microsoft.com/privacystatement#maindiagnosticsmodule) |
+| Diagnostic Data | Microsoft uses diagnostic data to keep Windows secure, up to date, troubleshoot problems, and make product improvements. Regardless of what choices you make for diagnostic data collection, the device will be just as secure and will operate normally. This data is collected by Microsoft and stored with one or more unique identifiers that can help us recognize an individual user on an individual device and understand the device's service issues and use patterns.
Diagnostic data is categorized into the following:
- **Required diagnostic data**
Previously known as basic diagnostic data, required diagnostic data includes information about your device, its settings, capabilities, and whether it is performing properly, whether a device is ready for an update, and whether there are factors that may impede the ability to receive updates, such as low battery, limited disk space, or connectivity through a paid network. You can find out what is collected with required diagnostic data [here](https://docs.microsoft.com/windows/privacy/required-windows-diagnostic-data-events-and-fields-2004). - **Optional diagnostic data**
Previously known as full diagnostic data, optional diagnostic data includes more detailed information about your device and its settings, capabilities, and device health. When you choose to send optional diagnostic data, required diagnostic data will always be included. You can find out the types of optional diagnostic data collected [here](https://docs.microsoft.com/windows/privacy/windows-diagnostic-data).
| [Learn more](https://support.microsoft.com/4468236/diagnostics-feedback-and-privacy-in-windows-10-microsoft-privacy)
[Configure Windows diagnostic data in your organization](configure-windows-diagnostic-data-in-your-organization.md) | [Privacy Statement](https://privacy.microsoft.com/privacystatement#maindiagnosticsmodule) |
| Inking and typing diagnostics | Microsoft collects optional inking and typing diagnostic data to improve the language recognition and suggestion capabilities of apps and services running on Windows. | [Learn more](https://support.microsoft.com/help/4468236/diagnostics-feedback-and-privacy-in-windows-10-microsoft-privacy) | [Privacy Statement](https://privacy.microsoft.com/privacystatement#maindiagnosticsmodule) |
| Speech | Use your voice for dictation and to talk to Cortana and other apps that use Windows cloud-based speech recognition. Microsoft collects voice data to help improve speech services. | [Learn more](https://support.microsoft.com/help/4468250/windows-10-speech-voice-activation-inking-typing-privacy) | [Privacy Statement](https://privacy.microsoft.com/privacystatement#mainspeechinkingtypingmodule) |
| Location | Get location-based experiences like directions and weather. Let Windows and apps request your location and allow Microsoft to use your location data to improve location services. | [Learn more](https://support.microsoft.com/help/4468240/windows-10-location-service-and-privacy) |[Privacy Statement](https://privacy.microsoft.com/privacystatement#mainlocationservicesmotionsensingmodule) |
@@ -98,11 +99,11 @@ The following table provides an overview of the privacy settings discussed earli
This section provides general details and links to more detailed information, as well as instructions for administrators and compliance professionals. These instructions allow you to manage device settings to manage the compliance objectives of your organization. This information includes details about setting up a device, configuring the device’s settings after setup is complete to minimize data collection, and driving privacy-related user experiences.
-#### 2.3.1 Managing the device setup experience
+#### _2.3.1 Managing the device setup experience_
Windows deployment can be configured using several different methods that provide an administrator with options for control, including how a device is set up, which options are enabled by default, and what the user is able to change on the device after they log on.
-If you want the ability to fully control and apply restrictions on data being sent back to Microsoft, you can use [Configuration Manager](https://docs.microsoft.com/mem/configmgr/) as a deployment solution. Configuration Manager can be used to deploy a customized boot image using a variety of [deployment methods](https://docs.microsoft.com/en-us/mem/configmgr/osd/get-started/prepare-for-operating-system-deployment). You can further restrict any Configuration Manager-specific diagnostic data from being sent back to Microsoft by turning off this setting as outlined in the instructions [here](https://docs.microsoft.com/en-us/mem/configmgr/core/plan-design/diagnostics/frequently-asked-questions).
+If you want the ability to fully control and apply restrictions on data being sent back to Microsoft, you can use [Configuration Manager](https://docs.microsoft.com/mem/configmgr/) as a deployment solution. Configuration Manager can be used to deploy a customized boot image using a variety of [deployment methods](https://docs.microsoft.com/mem/configmgr/osd/get-started/prepare-for-operating-system-deployment). You can further restrict any Configuration Manager-specific diagnostic data from being sent back to Microsoft by turning off this setting as outlined in the instructions [here](https://docs.microsoft.com/mem/configmgr/core/plan-design/diagnostics/frequently-asked-questions).
Alternatively, your administrators can also choose to use Windows Autopilot. Autopilot lessens the overall burden of deployment while allowing administrators to fully customize the out-of-box experience. However, since Windows Autopilot is a cloud-based solution, administrators should be aware that a minimal set of device identifiers are sent back to Microsoft during initial device boot up. This device-specific information is used to identify the device so that it can receive the administrator-configured Autopilot profile and policies.
@@ -110,34 +111,34 @@ You can use the following articles to learn more about Autopilot and how to use
- https://docs.microsoft.com/windows/deployment/windows-Autopilot/windows-Autopilot
- https://docs.microsoft.com/windows/deployment/windows-Autopilot/deployment-process
-#### 2.3.2 Managing connections from Windows components to Microsoft services
+#### _2.3.2 Managing connections from Windows components to Microsoft services_
Administrators can manage the data sent from their organization to Microsoft by configuring settings associated with the functionality provided by Windows components.
For more details, see [Manage connections from Windows operating system components to Microsoft services](manage-connections-from-windows-operating-system-components-to-microsoft-services). This topic includes the different methods available on how to configure each setting, the impact to functionality, and which versions of Windows that are applicable.
-#### 2.3.3 Managing Windows 10 connections
+#### _2.3.3 Managing Windows 10 connections_
Some Windows components, apps, and related services transfer data to Microsoft network endpoints. An administrator may want to block these endpoints for their organization to meet their specific compliance objectives.
-[Manage connection endpoints for Windows 10, version 1903](manage-windows-1903-endpoints) provides a list of endpoints for the latest Windows 10 release, along with descriptions of any functionality that would be impacted by restricting data collection. Details for additional Windows versions can be found on the Windows Privacy site under the Manage Windows 10 connection endpoints section of the left-hand navigation menu.
+[Manage connection endpoints for Windows 10, version 1903](manage-windows-1903-endpoints) provides a list of endpoints for the latest Windows 10 release, along with descriptions of any functionality that would be impacted by restricting data collection. Details for additional Windows versions can be found on the [Windows Privacy site](https://docs.microsoft.com/windows/privacy/) under the **Manage Windows 10 connection endpoints** section of the left-hand navigation menu.
-#### 2.3.4 Limited functionality baseline
+#### _2.3.4 Limited functionality baseline_
An organization may want to further minimize the amount of data sent back to Microsoft or shared with Microsoft apps by managing the connections and configuring additional settings on their devices. Similar to [Windows security baselines](https://docs.microsoft.com/windows/security/threat-protection/windows-security-baselines), Microsoft has released a limited functionality baseline focused on configuring settings to minimize the data sent back to Microsoft. However, the functionality of the device could be impacted by applying these settings. The [Manage connections from Windows operating system components to Microsoft services](manage-connections-from-windows-operating-system-components-to-microsoft-services) article provides details on how to apply the baseline, along with the full list of settings covered in the baseline and the functionality that would be impacted. Administrators that don’t want to apply the baseline can still find details on how to configure each setting individually to find the right balance between data sharing and impact to functionality for their organization.
>[!IMPORTANT]
>We recommend that you fully test any modifications to these settings before deploying them in your organization.
-#### 2.3.5 Diagnostic data: Managing notifications for change of level at logon
+#### _2.3.5 Diagnostic data: Managing notifications for change of level at logon_
Starting with Windows 10, version 1803, if an administrator modifies the diagnostic data collection setting, users are notified of this change during the initial device sign in. For example, if you configure the device to send optional diagnostic data, users will be notified the next time they sign into the device. You can disable these notifications by using the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Data Collection and Preview Builds** > **Configure telemetry opt-in change notifications** or the MDM policy `ConfigureTelemetryOptInChangeNotification`.
-#### 2.3.6 Diagnostic data: Managing end user choice for changing the setting
+#### _2.3.6 Diagnostic data: Managing end user choice for changing the setting_
Windows 10, version 1803 and newer allows users to change their diagnostic data level to a lower setting than what their administrator has set. For example, if you have configured the device to send optional diagnostic data, a user can change the setting so that only required diagnostic data is sent by going into **Settings** > **Privacy** > **Diagnostics & feedback**. Administrators can restrict a user’s ability to change the setting using **Setting** > **Privacy** by setting the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Data Collection and Preview Builds** > **Configure telemetry opt-in setting user interface** or the MDM policy `ConfigureTelemetryOptInSettingsUx`.
-#### 2.3.7 Diagnostic data: Managing device-based data delete
+#### _2.3.7 Diagnostic data: Managing device-based data delete_
Windows 10, version 1809 and newer allows a user to delete diagnostic data collected from their device by using **Settings** > **Privacy** > **Diagnostic & feedback** and clicking the **Delete** button under the **Delete diagnostic data** heading. An administrator can also delete diagnostic data for a device using the [Clear-WindowsDiagnosticData](https://docs.microsoft.com/powershell/module/windowsdiagnosticdata/Clear-WindowsDiagnosticData?view=win10-ps) PowerShell cmdlet.
@@ -191,7 +192,7 @@ An administrator can configure privacy-related settings, such as choosing to onl
### 5.3 Desktop Analytics
-[Desktop Analytics](https://docs.microsoft.com/en-us/mem/configmgr/desktop-analytics/overview) is a set of solutions for Azure Portal that provide you with extensive data about the state of devices in your deployment. Desktop Analytics is a separate offering from Windows 10 and is dependent on enabling a minimum set of data collection on the device to function.
+[Desktop Analytics](https://docs.microsoft.com/mem/configmgr/desktop-analytics/overview) is a set of solutions for Azure Portal that provide you with extensive data about the state of devices in your deployment. Desktop Analytics is a separate offering from Windows 10 and is dependent on enabling a minimum set of data collection on the device to function.
### 5.4 Microsoft Managed Desktop
@@ -202,7 +203,7 @@ An administrator can configure privacy-related settings, such as choosing to onl
* [Microsoft Trust Center: GDPR Overview](https://www.microsoft.com/trust-center/privacy/gdpr-overview)
* [Microsoft Trust Center: Privacy at Microsoft](https://www.microsoft.com/trust-center/privacy)
* [Windows IT Pro Docs](https://docs.microsoft.com/windows/#pivot=it-pro)
-* [Microsoft Privacy Statement](https://privacy.microsoft.com/en-US/privacystatement)
+* [Microsoft Privacy Statement](https://privacy.microsoft.com/privacystatement)
* [Manage connections from Windows operating system components to Microsoft services](manage-connections-from-windows-operating-system-components-to-microsoft-services)
* [Privacy at Microsoft](https://privacy.microsoft.com/privacy-report)
* [Changes to Windows diagnostic data](changes-to-windows-diagnostic-data-collection)
From fec6e45f5afe9a9fcbb7846b4e8daa5c7352cb10 Mon Sep 17 00:00:00 2001
From: Sinead O'Sullivan
Date: Fri, 5 Jun 2020 21:50:20 +0100
Subject: [PATCH 0012/1414] fixes from build report
---
...s-to-windows-diagnostic-data-collection.md | 2 +-
...ws-diagnostic-data-in-your-organization.md | 14 +++++------
.../windows-10-and-privacy-compliance.md | 24 +++++++++----------
3 files changed, 20 insertions(+), 20 deletions(-)
diff --git a/windows/privacy/changes-to-windows-diagnostic-data-collection.md b/windows/privacy/changes-to-windows-diagnostic-data-collection.md
index fa81776ddf..80152039e2 100644
--- a/windows/privacy/changes-to-windows-diagnostic-data-collection.md
+++ b/windows/privacy/changes-to-windows-diagnostic-data-collection.md
@@ -86,5 +86,5 @@ With the Enhanced diagnostic data level being split out into new policies, we ar
Customers who use services that depend on Windows diagnostic data, such as Microsoft Managed Desktop or Desktop Analytics, may be impacted by the functional changes when they are released. These services will be updated to address these changes and guidance will be published on how to configure them properly.
The following provides a list of the known changes:
-- [Microsoft Managed Desktop](http://aka.ms/mmd-diagnostic-data-level)
+- [Microsoft Managed Desktop](https://aka.ms/mmd-diagnostic-data-level)
- Desktop Analytics
\ No newline at end of file
diff --git a/windows/privacy/configure-windows-diagnostic-data-in-your-organization.md b/windows/privacy/configure-windows-diagnostic-data-in-your-organization.md
index ee94dae814..7528588be8 100644
--- a/windows/privacy/configure-windows-diagnostic-data-in-your-organization.md
+++ b/windows/privacy/configure-windows-diagnostic-data-in-your-organization.md
@@ -26,7 +26,7 @@ ms.date: 04/29/2019
This article applies to Windows 10, Windows Server, Surface Hub, and Hololens diagnostic data only. It describes the types of diagnostic data that’s sent back to Microsoft and the ways you can manage it within your organization. Microsoft uses the data to quickly identify and address issues affecting its customers.
-IMPORTANT: Microsoft is [increasing transparency](https://blogs.microsoft.com/on-the-issues/2019/04/30/increasing-transparency-and-customer-control-over-data/) by categorizing the data we collect as required or optional. Windows 10 is in the process of updating devices to reflect this new categorization, and during this transition Basic diagnostic data will be recategorized as Required diagnostic data and Full diagnostic data will be recategorized as Optional diagnostic data. For more information, see [Changes to Windows diagnostic data](changes-to-windows-diagnostic-data-collection).
+IMPORTANT: Microsoft is [increasing transparency](https://blogs.microsoft.com/on-the-issues/2019/04/30/increasing-transparency-and-customer-control-over-data/) by categorizing the data we collect as required or optional. Windows 10 is in the process of updating devices to reflect this new categorization, and during this transition Basic diagnostic data will be recategorized as Required diagnostic data and Full diagnostic data will be recategorized as Optional diagnostic data. For more information, see [Changes to Windows diagnostic data](changes-to-windows-diagnostic-data-collection.md).
## Overview
@@ -61,7 +61,7 @@ Use the following sections to learn more about how Microsoft handles diagnostic
Depending on the diagnostic data settings on the device, diagnostic data can be collected via the following methods:
- Small payloads of structured information referred to as diagnostic data events, managed by the Connected User Experiences and Telemetry component.
- Diagnostic logs for additional troubleshooting, also managed by the Connected User Experience and Telemetry component.
- - Crash reporting and crash dumps, managed by [Windows Error Reporting](https://docs.microsoft.com/en-us/windows/win32/wer/windows-error-reporting).
+ - Crash reporting and crash dumps, managed by [Windows Error Reporting](https://docs.microsoft.com/windows/win32/wer/windows-error-reporting).
Later in this document we provide further details about how to control what’s collected and what data can be included in these different types of diagnostic data.
@@ -71,7 +71,7 @@ All diagnostic data is encrypted using TLS and uses certificate pinning during t
### Endpoints
-The following table lists the endpoints related how you can manage the collection and control of diagnostic data. For more information around the endpoints that are used to send data back to Microsoft, see [Manage connection endpoints for Windows 10 Enterprise, version 1903](manage-windows-1903-endpoints).
+The following table lists the endpoints related how you can manage the collection and control of diagnostic data. For more information around the endpoints that are used to send data back to Microsoft, see [Manage connection endpoints for Windows 10 Enterprise, version 1903](manage-windows-1903-endpoints.md).
| Windows service | Endpoint |
| - | - |
@@ -90,7 +90,7 @@ The following table lists the endpoints related how you can manage the collectio
| | weus2watcab01.blob.core.windows.net |
| | weus2watcab02.blob.core.windows.net |
|Authentication | login.live.com
IMPORTANT: This endpoint is used for device authentication. We do not recommend disabling this endpoint.
-| [Online Crash Analysis](https://docs.microsoft.com/en-us/windows/win32/dxtecharts/crash-dump-analysis) | oca.telemetry.microsoft.com |
+| [Online Crash Analysis](https://docs.microsoft.com/windows/win32/dxtecharts/crash-dump-analysis) | oca.telemetry.microsoft.com |
| | oca.microsoft.com
| | kmwatsonc.telemetry.microsoft.com
| | *-kmwatsonc.telemetry.microsoft.com
@@ -166,7 +166,7 @@ Required diagnostic data includes:
#### Enhanced diagnostic data
>[!NOTE]
-We’re simplifying your diagnostic data controls by moving from four diagnostic data controls to three: **Diagnostic data off**, **Required**, and **Optional**. making changes to the enhanced diagnostic data level. For more info about this change, see [Changes to Windows diagnostic data](changes-to-windows-diagnostic-data-collection).
+We’re simplifying your diagnostic data controls by moving from four diagnostic data controls to three: **Diagnostic data off**, **Required**, and **Optional**. making changes to the enhanced diagnostic data level. For more info about this change, see [Changes to Windows diagnostic data](changes-to-windows-diagnostic-data-collection.md).
Enhanced diagnostic data includes data about the websites you browse, how Windows and apps are used and how they perform, and device activity. The additional data helps Microsoft to fix and improve products and services for all users. When you choose to send enhanced diagnostic data, required diagnostic data will always be included, and we collect the following additional information:
- Operating system events that help to gain insights into different areas of the operating system, including networking, Hyper-V, Cortana, storage, file system, and other components.
@@ -192,7 +192,7 @@ Optional diagnostic data, previously labeled as **Full**, includes more detailed
Use the steps in this section to configure the diagnostic data settings for Windows and Windows Server in your organization.
>[!IMPORTANT]
->These diagnostic data settings only apply to components, features, and apps that are considered a part of the Windows operating system. Third-party apps and other Microsoft apps, such as Microsoft Office, that customers install may also collect and send diagnostic data using their own controls. You should work with your app vendors to understand their diagnostic data policy, and how you can opt in or opt out. For more information on how Microsoft Office uses diagnostic data, see [Overview of privacy controls for Microsoft 365 Apps for enterprise](https://docs.microsoft.com/deployoffice/privacy/overview-privacy-controls). If you would like to control Windows data collection that is not Windows diagnostic data, see [Manage connections from Windows operating system components to Microsoft services](manage-connections-from-windows-operating-system-components-to-microsoft-services).
+>These diagnostic data settings only apply to components, features, and apps that are considered a part of the Windows operating system. Third-party apps and other Microsoft apps, such as Microsoft Office, that customers install may also collect and send diagnostic data using their own controls. You should work with your app vendors to understand their diagnostic data policy, and how you can opt in or opt out. For more information on how Microsoft Office uses diagnostic data, see [Overview of privacy controls for Microsoft 365 Apps for enterprise](https://docs.microsoft.com/deployoffice/privacy/overview-privacy-controls). If you would like to control Windows data collection that is not Windows diagnostic data, see [Manage connections from Windows operating system components to Microsoft services](manage-connections-from-windows-operating-system-components-to-microsoft-services.md).
You can configure your device's diagnostic data settings using the management tools you’re already using, such as Group Policy or MDM.
@@ -227,4 +227,4 @@ You can use Group Policy to set your organization’s diagnostic data setting:
#### Limit optional diagnostic data for Desktop Analytics
-For more information about how to limit the diagnostic data to the minimum required by Desktop Analytics, see [Enable data sharing for Desktop Analytics](https://docs.microsoft.com/en-us/mem/configmgr/desktop-analytics/enable-data-sharing).
\ No newline at end of file
+For more information about how to limit the diagnostic data to the minimum required by Desktop Analytics, see [Enable data sharing for Desktop Analytics](https://docs.microsoft.com/mem/configmgr/desktop-analytics/enable-data-sharing).
\ No newline at end of file
diff --git a/windows/privacy/windows-10-and-privacy-compliance.md b/windows/privacy/windows-10-and-privacy-compliance.md
index 0ecbeaf982..394b7f44b3 100644
--- a/windows/privacy/windows-10-and-privacy-compliance.md
+++ b/windows/privacy/windows-10-and-privacy-compliance.md
@@ -26,7 +26,7 @@ Applies to:
## Overview
>[!IMPORTANT]
->Microsoft is [increasing transparency](https://blogs.microsoft.com/on-the-issues/2019/04/30/increasing-transparency-and-customer-control-over-data/) by categorizing the data we collect as required or optional. Windows 10 is in the process of updating devices to reflect this new categorization, and during this transition Basic diagnostic data will be recategorized as Required diagnostic data and Full diagnostic data will be recategorized as Optional diagnostic data. For more information, see [Changes to Windows diagnostic data](changes-to-windows-diagnostic-data-collection).
+>Microsoft is [increasing transparency](https://blogs.microsoft.com/on-the-issues/2019/04/30/increasing-transparency-and-customer-control-over-data/) by categorizing the data we collect as required or optional. Windows 10 is in the process of updating devices to reflect this new categorization, and during this transition Basic diagnostic data will be recategorized as Required diagnostic data and Full diagnostic data will be recategorized as Optional diagnostic data. For more information, see [Changes to Windows diagnostic data](changes-to-windows-diagnostic-data-collection.md).
At Microsoft, we are deeply committed to data privacy across all our products and services. With this guide, we provide administrators and compliance professionals with data privacy considerations for Windows 10.
@@ -45,7 +45,7 @@ When setting up a device, a user can configure their privacy settings. Those pri
The following table provides an overview of the Windows 10 privacy settings presented during the device setup experience that involve processing personal data and where to find additional information.
> [!NOTE]
-> This table is limited to the privacy settings that are available as part of setting up a Windows 10 device (Windows 10, version 1809 and newer). For the full list of settings that involve data collection, [see Manage connections from Windows operating system components to Microsoft services](manage-connections-from-windows-operating-system-components-to-microsoft-services).
+> This table is limited to the privacy settings that are available as part of setting up a Windows 10 device (Windows 10, version 1809 and newer). For the full list of settings that involve data collection, [see Manage connections from Windows operating system components to Microsoft services](manage-connections-from-windows-operating-system-components-to-microsoft-services.md).
| Feature/Setting | Description | Supporting Content | Privacy Statement |
| --- | --- | --- | --- |
@@ -61,9 +61,9 @@ The following table provides an overview of the Windows 10 privacy settings pres
### 1.2 Data collection monitoring
-[Diagnostic Data Viewer (DDV)](diagnostic-data-viewer-overview) is a Microsoft Store app (available in Windows 10, version 1803 and newer) that lets a user review the Windows diagnostic data that is being collected on their Windows 10 device and sent to Microsoft in real-time. DDV groups the information into simple categories that describe the data that’s being collected.
+[Diagnostic Data Viewer (DDV)](diagnostic-data-viewer-overview.md) is a Microsoft Store app (available in Windows 10, version 1803 and newer) that lets a user review the Windows diagnostic data that is being collected on their Windows 10 device and sent to Microsoft in real-time. DDV groups the information into simple categories that describe the data that’s being collected.
-An administrator can also use the Diagnostic Data Viewer for PowerShell module to view the diagnostic data collected from the device instead of using the Diagnostic Data Viewer UI. The [Diagnostic Data Viewer for PowerShell Overview](microsoft-diagnosticdataviewer) provides further information.
+An administrator can also use the Diagnostic Data Viewer for PowerShell module to view the diagnostic data collected from the device instead of using the Diagnostic Data Viewer UI. The [Diagnostic Data Viewer for PowerShell Overview](microsoft-diagnosticdataviewer.md) provides further information.
## 2. Windows 10 data collection management
@@ -81,7 +81,7 @@ Administrators can configure and control privacy settings across their organizat
The following table provides an overview of the privacy settings discussed earlier in this document with details on how to configure these policies. The table also provides information on what the default value would be for each of these privacy settings if you do not manage the setting by using policy and suppress the Out-of-box Experience (OOBE) during device setup. If you’re interested in minimizing data collection, we also provide the recommended value to set.
> [!NOTE]
-> This is not a complete list of settings that involve connecting to Microsoft services. To see a more detailed list, see [Manage connections from Windows operating system components to Microsoft services](manage-connections-from-windows-operating-system-components-to-microsoft-services).
+> This is not a complete list of settings that involve connecting to Microsoft services. To see a more detailed list, see [Manage connections from Windows operating system components to Microsoft services](manage-connections-from-windows-operating-system-components-to-microsoft-services.md).
| Feature/Setting | GP/MDM Documentation | Default State if the Setup experience is suppressed | State to stop/minimize data collection |
|---|---|---|---|
@@ -115,17 +115,17 @@ You can use the following articles to learn more about Autopilot and how to use
Administrators can manage the data sent from their organization to Microsoft by configuring settings associated with the functionality provided by Windows components.
-For more details, see [Manage connections from Windows operating system components to Microsoft services](manage-connections-from-windows-operating-system-components-to-microsoft-services). This topic includes the different methods available on how to configure each setting, the impact to functionality, and which versions of Windows that are applicable.
+For more details, see [Manage connections from Windows operating system components to Microsoft services](manage-connections-from-windows-operating-system-components-to-microsoft-services.md). This topic includes the different methods available on how to configure each setting, the impact to functionality, and which versions of Windows that are applicable.
#### _2.3.3 Managing Windows 10 connections_
Some Windows components, apps, and related services transfer data to Microsoft network endpoints. An administrator may want to block these endpoints for their organization to meet their specific compliance objectives.
-[Manage connection endpoints for Windows 10, version 1903](manage-windows-1903-endpoints) provides a list of endpoints for the latest Windows 10 release, along with descriptions of any functionality that would be impacted by restricting data collection. Details for additional Windows versions can be found on the [Windows Privacy site](https://docs.microsoft.com/windows/privacy/) under the **Manage Windows 10 connection endpoints** section of the left-hand navigation menu.
+[Manage connection endpoints for Windows 10, version 1903](manage-windows-1903-endpoints.md) provides a list of endpoints for the latest Windows 10 release, along with descriptions of any functionality that would be impacted by restricting data collection. Details for additional Windows versions can be found on the [Windows Privacy site](https://docs.microsoft.com/windows/privacy/) under the **Manage Windows 10 connection endpoints** section of the left-hand navigation menu.
#### _2.3.4 Limited functionality baseline_
-An organization may want to further minimize the amount of data sent back to Microsoft or shared with Microsoft apps by managing the connections and configuring additional settings on their devices. Similar to [Windows security baselines](https://docs.microsoft.com/windows/security/threat-protection/windows-security-baselines), Microsoft has released a limited functionality baseline focused on configuring settings to minimize the data sent back to Microsoft. However, the functionality of the device could be impacted by applying these settings. The [Manage connections from Windows operating system components to Microsoft services](manage-connections-from-windows-operating-system-components-to-microsoft-services) article provides details on how to apply the baseline, along with the full list of settings covered in the baseline and the functionality that would be impacted. Administrators that don’t want to apply the baseline can still find details on how to configure each setting individually to find the right balance between data sharing and impact to functionality for their organization.
+An organization may want to further minimize the amount of data sent back to Microsoft or shared with Microsoft apps by managing the connections and configuring additional settings on their devices. Similar to [Windows security baselines](https://docs.microsoft.com/windows/security/threat-protection/windows-security-baselines), Microsoft has released a limited functionality baseline focused on configuring settings to minimize the data sent back to Microsoft. However, the functionality of the device could be impacted by applying these settings. The [Manage connections from Windows operating system components to Microsoft services](manage-connections-from-windows-operating-system-components-to-microsoft-services.md) article provides details on how to apply the baseline, along with the full list of settings covered in the baseline and the functionality that would be impacted. Administrators that don’t want to apply the baseline can still find details on how to configure each setting individually to find the right balance between data sharing and impact to functionality for their organization.
>[!IMPORTANT]
>We recommend that you fully test any modifications to these settings before deploying them in your organization.
@@ -155,7 +155,7 @@ Users can delete their device-based data by going to **Settings** > **Privacy**
### 3.2 View
-The [Diagnostic Data Viewer (DDV)](diagnostic-data-viewer-overview) provides a view into the diagnostic data being collected from a Windows 10 device. Administrators can also use the [Get-DiagnosticData](microsoft-diagnosticdataviewer.md#install-and-use-the-diagnostic-data-viewer-for-powershell) PowerShell cmdlet.
+The [Diagnostic Data Viewer (DDV)](diagnostic-data-viewer-overview.md) provides a view into the diagnostic data being collected from a Windows 10 device. Administrators can also use the [Get-DiagnosticData](microsoft-diagnosticdataviewer.md#install-and-use-the-diagnostic-data-viewer-for-powershell) PowerShell cmdlet.
### 3.3 Export
@@ -204,7 +204,7 @@ An administrator can configure privacy-related settings, such as choosing to onl
* [Microsoft Trust Center: Privacy at Microsoft](https://www.microsoft.com/trust-center/privacy)
* [Windows IT Pro Docs](https://docs.microsoft.com/windows/#pivot=it-pro)
* [Microsoft Privacy Statement](https://privacy.microsoft.com/privacystatement)
-* [Manage connections from Windows operating system components to Microsoft services](manage-connections-from-windows-operating-system-components-to-microsoft-services)
+* [Manage connections from Windows operating system components to Microsoft services](manage-connections-from-windows-operating-system-components-to-microsoft-services.md)
* [Privacy at Microsoft](https://privacy.microsoft.com/privacy-report)
-* [Changes to Windows diagnostic data](changes-to-windows-diagnostic-data-collection)
-* [Microsoft Service Trust Portal](https://servicetrust.microsoft.com/)
+* [Changes to Windows diagnostic data](changes-to-windows-diagnostic-data-collection,md)
+* [Microsoft Service Trust Portal](https://servicetrust.microsoft.com/)
\ No newline at end of file
From 53124cd9bfcb21ae085c58adb0df209704f43e1d Mon Sep 17 00:00:00 2001
From: Sinead O'Sullivan
Date: Fri, 5 Jun 2020 22:05:50 +0100
Subject: [PATCH 0013/1414] Update windows-10-and-privacy-compliance.md
---
windows/privacy/windows-10-and-privacy-compliance.md | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/windows/privacy/windows-10-and-privacy-compliance.md b/windows/privacy/windows-10-and-privacy-compliance.md
index 394b7f44b3..570cadcfe4 100644
--- a/windows/privacy/windows-10-and-privacy-compliance.md
+++ b/windows/privacy/windows-10-and-privacy-compliance.md
@@ -159,7 +159,7 @@ The [Diagnostic Data Viewer (DDV)](diagnostic-data-viewer-overview.md) provides
### 3.3 Export
-The [Diagnostic Data Viewer (DDV)](diagnostic-data-viewer-overview) provides the ability to export the diagnostic data captured while the app is running, by clicking the **Export** data button in the top menu. Administrators can also use the [Get-DiagnosticData](microsoft-diagnosticdataviewer.md#install-and-use-the-diagnostic-data-viewer-for-powershell) PowerShell cmdlet script.
+The [Diagnostic Data Viewer (DDV)](diagnostic-data-viewer-overview.md) provides the ability to export the diagnostic data captured while the app is running, by clicking the **Export** data button in the top menu. Administrators can also use the [Get-DiagnosticData](microsoft-diagnosticdataviewer.md#install-and-use-the-diagnostic-data-viewer-for-powershell) PowerShell cmdlet script.
### 3.4 Devices connected to a Microsoft account
@@ -206,5 +206,5 @@ An administrator can configure privacy-related settings, such as choosing to onl
* [Microsoft Privacy Statement](https://privacy.microsoft.com/privacystatement)
* [Manage connections from Windows operating system components to Microsoft services](manage-connections-from-windows-operating-system-components-to-microsoft-services.md)
* [Privacy at Microsoft](https://privacy.microsoft.com/privacy-report)
-* [Changes to Windows diagnostic data](changes-to-windows-diagnostic-data-collection,md)
+* [Changes to Windows diagnostic data](changes-to-windows-diagnostic-data-collection.md)
* [Microsoft Service Trust Portal](https://servicetrust.microsoft.com/)
\ No newline at end of file
From eea752c603044e9cd6b590c51414a976d0c30e8c Mon Sep 17 00:00:00 2001
From: Marty Hernandez Avedon
Date: Fri, 5 Jun 2020 17:11:55 -0400
Subject: [PATCH 0014/1414] added page describing app guard browser extension
---
.../md-app-guard-browser-extension.md | 73 +++++++++++++++++++
.../md-app-guard-overview.md | 7 +-
2 files changed, 77 insertions(+), 3 deletions(-)
create mode 100644 windows/security/threat-protection/microsoft-defender-application-guard/md-app-guard-browser-extension.md
diff --git a/windows/security/threat-protection/microsoft-defender-application-guard/md-app-guard-browser-extension.md b/windows/security/threat-protection/microsoft-defender-application-guard/md-app-guard-browser-extension.md
new file mode 100644
index 0000000000..c4dcc0c416
--- /dev/null
+++ b/windows/security/threat-protection/microsoft-defender-application-guard/md-app-guard-browser-extension.md
@@ -0,0 +1,73 @@
+---
+title: Microsoft Defender Application Guard Extension
+description: Learn about the Microsoft Defender Application Guard browser extension for Chrome, and how you can manage it for yourself and your users.
+ms.prod: w10
+ms.mktglfcycl: manage
+ms.sitesec: library
+ms.pagetype: security
+ms.localizationpriority: medium
+author: martyav
+ms.author: v-maave
+ms.date: 03/28/2019
+ms.reviewer:
+manager: dansimp
+ms.custom: asr
+---
+
+# Microsoft Defender Application Guard Extension
+
+This article applies to:
+
+- Windows 10
+
+Microsoft Defender Application Guard Extension is a web browser extension that protects your device from advanced attacks, by redirecting untrusted websites to an isolated version of the [Microsoft Edge](https://www.microsoft.com/en-us/edge) browser. If an untrusted website turns out to be malicious, it remains within Application Guard's secure container, keeping your device protected.
+
+## Supported browsers
+
+The Microsoft Defender Application Guard Extension is available for [Chrome](https://chrome.google.com/webstore/detail/application-guard-extensi/mfjnknhkkiafjajicegabkbimfhplplj/) and [Firefox](https://addons.mozilla.org/en-US/firefox/addon/application-guard-extension/). It can be installed individually by the user, or deployed across the enterprise by an administrator.
+
+> [!TIP]
+> This extension broadens Microsoft Defender Application Guard support to browsers *other* than Microsoft Edge.
+>
+> It is not necessary to install any extension on Edge to access Application Guard's protective features, since Application Guard offers [native support](https://docs.microsoft.com/deployedge/microsoft-edge-security-windows-defender-application-guard) to that browser.
+
+## Prerequisites
+
+Microsoft Defender Application Guard Extension works with the following editions of Windows 10, version 1803 or later:
+
+- Windows 10 Professional
+- Windows 10 Enterprise
+- Windows 10 Education
+
+Application Guard Extension also requires that the [Application Guard companion app](https://www.microsoft.com/en-gb/p/windows-defender-application-guard-companion/9n8gnlc8z9c8?activetab=pivot:overviewtab) be installed locally. The app enables Application Guard to work with web browsers other than Microsoft Edge.
+
+## Known issues
+
+Issue | Mitigation
+-|-
+Extensions cannot automatically turn on for incognito mode (off by default) | Disable Incognito via policy, by setting **IncognitoModeAvailablity** to **1**
+Extensions can be turned off | Use ExtensionSettings policy by setting **Installation_mode** to **force_installed**.
+Chrome does not offer url to extensions on cold start | Don’t let users disable background process via policy, by setting **backgroundModeEnabled** to **1**.
+If the user's network roams or the network isolation policy changes, an untrusted page may load | If a page attempts to load but is no longer trusted, Application Guard will try to redirect the page and invalidate the cache. However, this issue is only partially mitigated on the backend and leaves browsers open to drive-by attacks under certain circumstances.
+
+
+## Troubleshooting guide
+
+
+
+Error message | Cause | Actions
+-|-|-
+Application Guard undetermined state | The extension was unable to communicate with the companion app during the last information request. | • Install the companion app and reboot • If the companion app is already installed, reboot and see if that resolves the error • If you still see the error after rebooting, uninstall and re-install the companion app • Check for updates in both the Chrome and Microsoft stores
+Launch in WDAG failed with a companion communication error | The extension couldn't talk to the companion app, but was able to at the beginning of the session. This can be caused by the companion app being uninstalled while Chrome was running. | • Make sure the companion app is installed • If the companion app is installed, reboot and see if that resolves the error • If you still see the error after rebooting, uninstall and re-install the companion app • Check for updates in both the Chrome and Microsoft stores
+Process trust response failed with a companion communication error | The extension couldn't talk to the companion app, but was able to at the beginning of the session. This can be caused by the companion app being uninstalled while Chrome was running.| • Make sure the companion app is installed. • If the companion app is installed, reboot and see if that resolves the error • If you still see the error after rebooting, uninstall and re-install the companion app • Check for updates in both the Chrome and Microsoft stores
+ExceptionThrown | An unexpected exception was thrown. | • File a bug • Retry the operation
+Unexpected response while processing trusted state | The extension was able to communicate with the companion app, but the API failed and a failure response code was sent back to the extension. | • File a bug • Check if Edge is working • Retry the operation
+Main page navigation caught an unexpected error | An unexpected exception was thrown during the main page navigation. | • File a bug • Retry the operation
+Protocol out of sync | The extension and native app cannot communicate with each other. This is likely caused by one being updated without supporting the protocol of the other. | Check for updates in both the Chrome and Microsoft stores
+Failed to determine if Application Guard is enabled | The extension was able to communicate with the companion app, but the information request failed in the app. | • Restart Chrome • Check for updates in both the Chrome and Microsoft stores
+Security patch level does not match | Microsoft determined that there was a security issue with either the extension or the companion app, and has issued a mandatory update. | Check for updates in both the Chrome and Microsoft stores
+
+## Related articles
+
+- [Microsoft Defender Application Guard overview](md-app-guard-overview.md)
+- [Testing scenarios using Microsoft Defender Application Guard in your business or organization](test-scenarios-md-app-guard.md)
diff --git a/windows/security/threat-protection/microsoft-defender-application-guard/md-app-guard-overview.md b/windows/security/threat-protection/microsoft-defender-application-guard/md-app-guard-overview.md
index 9a278e3b9b..a3ad365834 100644
--- a/windows/security/threat-protection/microsoft-defender-application-guard/md-app-guard-overview.md
+++ b/windows/security/threat-protection/microsoft-defender-application-guard/md-app-guard-overview.md
@@ -18,7 +18,7 @@ ms.custom: asr
**Applies to:** [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
-Microsoft Defender Application Guard (Application Guard) is designed to help prevent old and newly emerging attacks to help keep employees productive. Using our unique hardware isolation approach, our goal is to destroy the playbook that attackers use by making current attack methods obsolete.
+Microsoft Defender Application Guard (Application Guard) is designed to help prevent old and newly emerging attacks to help keep employees productive. Using our unique hardware isolation approach, our goal is to destroy the playbook that attackers use by making current attack methods obsolete.
## What is Application Guard and how does it work?
@@ -42,10 +42,11 @@ Application Guard has been created to target several types of systems:
## Related articles
-|Article |Description |
-|------|------------|
+|Article | Description |
+|--------|-------------|
|[System requirements for Microsoft Defender Application Guard](reqs-md-app-guard.md) |Specifies the prerequisites necessary to install and use Application Guard.|
|[Prepare and install Microsoft Defender Application Guard](install-md-app-guard.md) |Provides instructions about determining which mode to use, either Standalone or Enterprise-managed, and how to install Application Guard in your organization.|
|[Configure the Group Policy settings for Microsoft Defender Application Guard](configure-md-app-guard.md) |Provides info about the available Group Policy and MDM settings.|
|[Testing scenarios using Microsoft Defender Application Guard in your business or organization](test-scenarios-md-app-guard.md)|Provides a list of suggested testing scenarios that you can use to test Application Guard in your organization.|
+| [Microsoft Defender Application Guard Extension for web browsers](md-app-guard-browser-extension) | Describes the Application Guard extension for Chrome and Firefox, including known issues, and a trouble-shooting guide |
|[Frequently asked questions - Microsoft Defender Application Guard](faq-md-app-guard.md)|Provides answers to frequently asked questions about Application Guard features, integration with the Windows operating system, and general configuration.|
From 46c05757ef25d2519db0a35b80124e7bde432f8a Mon Sep 17 00:00:00 2001
From: Sinead O'Sullivan
Date: Sun, 7 Jun 2020 09:33:00 +0100
Subject: [PATCH 0015/1414] fixed bookmarks
---
.../privacy/changes-to-windows-diagnostic-data-collection.md | 5 +++--
...configure-windows-diagnostic-data-in-your-organization.md | 2 +-
2 files changed, 4 insertions(+), 3 deletions(-)
diff --git a/windows/privacy/changes-to-windows-diagnostic-data-collection.md b/windows/privacy/changes-to-windows-diagnostic-data-collection.md
index 80152039e2..816f0bc2c5 100644
--- a/windows/privacy/changes-to-windows-diagnostic-data-collection.md
+++ b/windows/privacy/changes-to-windows-diagnostic-data-collection.md
@@ -25,8 +25,8 @@ Microsoft is deeply committed to providing you with effective controls over your
This topic is meant for IT administrators and explains the changes Windows is making to align to the new data collection taxonomy. These changes are focused in two areas:
-- [Taxonomy changes](#Taxonomy-changes)
-- [Behavioral changes](#Behaviorial-changes)
+- [Taxonomy changes](#taxonomy-changes)
+- [Behavioral changes](#behaviorial-changes)
> [!NOTE]
> You can test the behavioral changes now in Windows 10 Insider Preview build 19577 and later.
@@ -52,6 +52,7 @@ Starting in Windows 10, version 1903 and newer, both the **Out-of-Box-Experience
In an upcoming release of Windows 10, we’re simplifying your diagnostic data controls by moving from four diagnostic data controls to three: **Diagnostic data off**, **Required**, and **Optional**. If your devices are set to **Enhanced** when they are upgraded, the device settings will be migrated to the more privacy-preserving setting of **Required diagnostic data**, which means that analytic services that leverage enhanced data collection may not work properly. For a list of services, see the section named, **Services that rely on Enhanced diagnostic data**, later in this topic. Administrators should read through the details and determine whether to apply these new policies to restore the same collection settings as they had before this change. For a list of steps, see the section named **Configure a Windows 10 device to limit diagnostics**. For more information on services that rely on Enhanced diagnostic data, see **Services that rely on Enhanced diagnostic data**.
Additionally, you will see the following policy changes in an upcoming release of Windows 10:
+
| Policy type | Current policy | Renamed policy |
| --- | --- | --- |
| Group Policy | Computer Configuration > Administrative Templates > Windows Components > Data Collection and Preview Builds > **Allow Telemetry**- **0 Security**
- **Basic**
- **Enhanced**
- **Full**
| Computer Configuration > Administrative Templates > Windows Components > Data Collection and Preview Builds > **Allow Diagnostic Data**- **Diagnostic data off (not recommended)**
- **Send required diagnostic data**
- **Send optional diagnostic data**
|
diff --git a/windows/privacy/configure-windows-diagnostic-data-in-your-organization.md b/windows/privacy/configure-windows-diagnostic-data-in-your-organization.md
index 7528588be8..f8a87eb5b8 100644
--- a/windows/privacy/configure-windows-diagnostic-data-in-your-organization.md
+++ b/windows/privacy/configure-windows-diagnostic-data-in-your-organization.md
@@ -166,7 +166,7 @@ Required diagnostic data includes:
#### Enhanced diagnostic data
>[!NOTE]
-We’re simplifying your diagnostic data controls by moving from four diagnostic data controls to three: **Diagnostic data off**, **Required**, and **Optional**. making changes to the enhanced diagnostic data level. For more info about this change, see [Changes to Windows diagnostic data](changes-to-windows-diagnostic-data-collection.md).
+>We’re simplifying your diagnostic data controls by moving from four diagnostic data controls to three: **Diagnostic data off**, **Required**, and **Optional**. making changes to the enhanced diagnostic data level. For more info about this change, see [Changes to Windows diagnostic data](changes-to-windows-diagnostic-data-collection.md).
Enhanced diagnostic data includes data about the websites you browse, how Windows and apps are used and how they perform, and device activity. The additional data helps Microsoft to fix and improve products and services for all users. When you choose to send enhanced diagnostic data, required diagnostic data will always be included, and we collect the following additional information:
- Operating system events that help to gain insights into different areas of the operating system, including networking, Hyper-V, Cortana, storage, file system, and other components.
From b35b67d5b5e19289260882ddfb1293bfae6d14f8 Mon Sep 17 00:00:00 2001
From: Sinead O'Sullivan
Date: Sun, 7 Jun 2020 19:55:34 +0100
Subject: [PATCH 0016/1414] bookmarkupdate
---
windows/privacy/windows-10-and-privacy-compliance.md | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/windows/privacy/windows-10-and-privacy-compliance.md b/windows/privacy/windows-10-and-privacy-compliance.md
index 570cadcfe4..ac0fc0d1bc 100644
--- a/windows/privacy/windows-10-and-privacy-compliance.md
+++ b/windows/privacy/windows-10-and-privacy-compliance.md
@@ -88,7 +88,7 @@ The following table provides an overview of the privacy settings discussed earli
| [Speech](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-priv-speech) | Group Policy:
**Computer Configuration** > **Control Panel** > **Regional and Language Options** > **Allow users to enable online speech recognition services**
MDM: [Privacy/AllowInputPersonalization](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-privacy#privacy-allowinputpersonalization) | Off | Off |
| [Location](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-priv-location) | Group Policy:
**Computer Configuration** > **Windows Components** > **App Privacy** > **Let Windows apps access location**
MDM: [Privacy/LetAppsAccessLocation](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-privacy#privacy-allowinputpersonalization) | Off (Windows 10, version 1903 and later) | Off |
| [Find my device](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#find-my-device) | Group Policy:
**Computer Configuration** > **Windows Components** > **Find My Device** > **Turn On/Off Find My Device**
MDM: [Experience/AllFindMyDevice](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-experience#experience-allowfindmydevice) | Off | Off |
-| [Diagnostic Data](configure-windows-diagnostic-data-in-your-organization.md#enterprise-management) | Group Policy:
**Computer Configuration** > **Windows Components** > **Data Collection and Preview Builds** > **Allow Telemetry**
MDM: [System/AllowTelemetry](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-system#system-allowtelemetry) | Desktop editions:
Required diagnostic data (Windows 10, version 1903 and later)
Server editions:
Required diagnostic data | Security and block endpoints |
+| [Diagnostic Data](configure-windows-diagnostic-data-in-your-organization.md##manage-enterprise-diagnostic-data) | Group Policy:
**Computer Configuration** > **Windows Components** > **Data Collection and Preview Builds** > **Allow Telemetry**
MDM: [System/AllowTelemetry](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-system#system-allowtelemetry) | Desktop editions:
Required diagnostic data (Windows 10, version 1903 and later)
Server editions:
Required diagnostic data | Security and block endpoints |
| [Inking and typing diagnostics](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-priv-ink) | Group Policy:
**Computer Configuration** > **Windows Components** > **Text Input** > **Improve inking and typing recognition**
MDM: [TextInput/AllowLinguisticDataCollection](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-textinput#textinput-allowlinguisticdatacollection) | Off (Windows 10, version 1809 and later) | Off |
| Tailored Experiences | Group Policy:
**User Configuration** > **Windows Components** > **Cloud Content** > **Do not use diagnostic data for tailored experiences**
MDM: [Experience/AllowTailoredExperiencesWithDiagnosticData](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-experience#experience-allowtailoredexperienceswithdiagnosticdata) | Off | Off |
| Advertising ID | Group Policy:
**Computer Configuration** > **System** > **User Profile** > **Turn off the advertising Id**
MDM: [Privacy/DisableAdvertisingId](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-privacy#privacy-disableadvertisingid) | Off | Off |
From a613da634debef3591449a6ef0c170e05c0e4a1e Mon Sep 17 00:00:00 2001
From: Sinead O'Sullivan
Date: Mon, 8 Jun 2020 12:11:47 +0100
Subject: [PATCH 0017/1414] edit review updates
---
...anges-to-windows-diagnostic-data-collection.md | 10 +++++-----
...indows-diagnostic-data-in-your-organization.md | 15 ++++++---------
2 files changed, 11 insertions(+), 14 deletions(-)
diff --git a/windows/privacy/changes-to-windows-diagnostic-data-collection.md b/windows/privacy/changes-to-windows-diagnostic-data-collection.md
index 816f0bc2c5..8ccdc3aa0d 100644
--- a/windows/privacy/changes-to-windows-diagnostic-data-collection.md
+++ b/windows/privacy/changes-to-windows-diagnostic-data-collection.md
@@ -55,10 +55,10 @@ Additionally, you will see the following policy changes in an upcoming release o
| Policy type | Current policy | Renamed policy |
| --- | --- | --- |
-| Group Policy | Computer Configuration > Administrative Templates > Windows Components > Data Collection and Preview Builds > **Allow Telemetry**- **0 Security**
- **Basic**
- **Enhanced**
- **Full**
| Computer Configuration > Administrative Templates > Windows Components > Data Collection and Preview Builds > **Allow Diagnostic Data**- **Diagnostic data off (not recommended)**
- **Send required diagnostic data**
- **Send optional diagnostic data**
|
+| Group Policy | Computer Configuration > Administrative Templates > Windows Components > Data Collection and Preview Builds > **Allow Telemetry**- **0 - Security**
- **1 - Basic**
- **2 - Enhanced**
- **3 - Full**
| Computer Configuration > Administrative Templates > Windows Components > Data Collection and Preview Builds > **Allow Diagnostic Data**- **Diagnostic data off (not recommended)**
- **Send required diagnostic data**
- **Send optional diagnostic data**
|
| Group Policy |Computer Configuration > Administrative Templates > Windows Components > Data Collection and Preview Builds > **Configure telemetry opt-in settings user interface**| Computer Configuration > Administrative Templates > Windows Components > Data Collection and Preview Builds > **Configure diagnostic data opt-in settings user interface** |
| Group Policy |Computer Configuration > Administrative Templates > Windows Components > Data Collection and Preview Builds > **Configure telemetry opt-in change notifications**| Computer Configuration > Administrative Templates > Windows Components > Data Collection and Preview Builds > **Configure diagnostic data opt-in change notifications** |
-| MDM | System/AllowTelemetry |
+| MDM | System/AllowTelemetry |
A final set of changes includes two new policies that can help you fine-tune diagnostic data collection within your organization. These policies let you limit the amount of optional diagnostic data that’s sent back to Microsoft.
@@ -74,11 +74,11 @@ A final set of changes includes two new policies that can help you fine-tune dia
## Configure a Windows 10 device to limit diagnostics
-With the Enhanced diagnostic data level being split out into new policies, we are providing additional controls to manage what types of dumps are collected and whether to send additional diagnostic logs. Here are some steps on how to configure them:
+With the Enhanced diagnostic data level being split out into new policies, we're providing additional controls to manage what types of dumps are collected and whether to send additional diagnostic logs. Here are some steps on how to configure them:
1. Choose to send optional diagnostic data by setting one of the following policies:
- - Group Policy: Computer Configuration > Administrative Templates > Windows Components > Data Collection and Preview Builds > **Allow Diagnostic Data**. Set the policy value to **Send optional diagnostic data**
- - MDM: System/AllowTelemetry. Set the policy value to 3.
+ - Group Policy: Computer Configuration > Administrative Templates > Windows Components > Data Collection and Preview Builds > **Allow Diagnostic Data**. Set the policy value to **Send optional diagnostic data**.
+ - MDM: System/AllowTelemetry. Set the policy value to **3**.
2. Enable the following Group Policy: Computer Configuration > Administrative Templates > Windows Components > Data Collection and Preview Builds > **Limit Dump Collection**
3. Enable the following Group Policy: Computer Configuration > Administrative Templates > Windows Components > Data Collection and Preview Builds > **Limit Diagnostic Log Collection**
diff --git a/windows/privacy/configure-windows-diagnostic-data-in-your-organization.md b/windows/privacy/configure-windows-diagnostic-data-in-your-organization.md
index f8a87eb5b8..9dbc7e0766 100644
--- a/windows/privacy/configure-windows-diagnostic-data-in-your-organization.md
+++ b/windows/privacy/configure-windows-diagnostic-data-in-your-organization.md
@@ -26,7 +26,8 @@ ms.date: 04/29/2019
This article applies to Windows 10, Windows Server, Surface Hub, and Hololens diagnostic data only. It describes the types of diagnostic data that’s sent back to Microsoft and the ways you can manage it within your organization. Microsoft uses the data to quickly identify and address issues affecting its customers.
-IMPORTANT: Microsoft is [increasing transparency](https://blogs.microsoft.com/on-the-issues/2019/04/30/increasing-transparency-and-customer-control-over-data/) by categorizing the data we collect as required or optional. Windows 10 is in the process of updating devices to reflect this new categorization, and during this transition Basic diagnostic data will be recategorized as Required diagnostic data and Full diagnostic data will be recategorized as Optional diagnostic data. For more information, see [Changes to Windows diagnostic data](changes-to-windows-diagnostic-data-collection.md).
+>[!IMPORTANT]
+>Microsoft is [increasing transparency](https://blogs.microsoft.com/on-the-issues/2019/04/30/increasing-transparency-and-customer-control-over-data/) by categorizing the data we collect as required or optional. Windows 10 is in the process of updating devices to reflect this new categorization, and during this transition Basic diagnostic data will be recategorized as Required diagnostic data and Full diagnostic data will be recategorized as Optional diagnostic data. For more information, see [Changes to Windows diagnostic data](changes-to-windows-diagnostic-data-collection.md).
## Overview
@@ -75,12 +76,8 @@ The following table lists the endpoints related how you can manage the collectio
| Windows service | Endpoint |
| - | - |
-|Connected User Experiences and Telemetry | v10.events.data.microsoft.com |
-| | v10c.events.data.microsoft.com |
-| | v10.vortex-win.data.microsoft.com |
-| [Windows Error Reporting](https://docs.microsoft.com/windows/win32/wer/windows-error-reporting) | watson.telemetry.microsoft.com |
-| | watson.microsoft.com |
-| | umwatsonc.telemetry.microsoft.com |
+|Connected User Experiences and Telemetry | v10.events.data.microsoft.com
v10c.events.data.microsoft.com
v10.vortex-win.data.microsoft.com |
+| [Windows Error Reporting](https://docs.microsoft.com/windows/win32/wer/windows-error-reporting) | watson.telemetry.microsoft.com
watson.microsoft.com
umwatsonc.telemetry.microsoft.com |
| | umwatsonc.events.data.microsoft.com |
| | *-umwatsonc.events.data.microsoft.com |
| | ceuswatcab01.blob.core.windows.net |
@@ -117,10 +114,10 @@ Here’s a summary of the types of data that is included with each setting:
| | **Diagnostic data off (Security)** | **Required (Basic)** | **Enhanced** |**Optional (Full)**|
| --- | --- | --- | --- | --- |
-| **Diagnostic data events** | No Windows diagnostic data sent. | Minimum data required data to keep the device secure, up to date, and performing as expected. | Additional data about the websites you browse, how Windows and apps are used and how they perform, and device activity. The additional data helps Microsoft to fix and improve products and services for all users. | Additional data about the websites you browse, how Windows and apps are used and how they perform. This data also includes data about device activity, and enhanced error reporting that helps Microsoft to fix and improve products and services for all users.|
+| **Diagnostic data events** | No Windows diagnostic data sent. | Minimum data required to keep the device secure, up to date, and performing as expected. | Additional data about the websites you browse, how Windows and apps are used and how they perform, and device activity. The additional data helps Microsoft to fix and improve products and services for all users. | Additional data about the websites you browse, how Windows and apps are used and how they perform. This data also includes data about device activity, and enhanced error reporting that helps Microsoft to fix and improve products and services for all users.|
| **Crash Metadata** | N/A | Yes | Yes | Yes |
| **Crash Dumps** | N/A | No | Triage dumps only
For more information about crash dumps, see [Windows Error Reporting](https://docs.microsoft.com/windows/win32/wer/windows-error-reporting). | Full memory dumps
For more information about crash dumps, see [Windows Error Reporting](https://docs.microsoft.com/windows/win32/wer/windows-error-reporting). |
-| **Crash Metadata** | N/A | No | No | No |
+| **Diagnostic logs** | N/A | No | No | No |
| **Data collection** | N/A | 100% | Sampling applies | Sampling applies |
From 28952fbc2579b3ef555f8426dd5dac68cc0f06a0 Mon Sep 17 00:00:00 2001
From: Sinead O'Sullivan
Date: Mon, 8 Jun 2020 12:58:49 +0100
Subject: [PATCH 0018/1414] Update
configure-windows-diagnostic-data-in-your-organization.md
---
...ws-diagnostic-data-in-your-organization.md | 47 ++++++++-----------
1 file changed, 19 insertions(+), 28 deletions(-)
diff --git a/windows/privacy/configure-windows-diagnostic-data-in-your-organization.md b/windows/privacy/configure-windows-diagnostic-data-in-your-organization.md
index 9dbc7e0766..4dbb71e72a 100644
--- a/windows/privacy/configure-windows-diagnostic-data-in-your-organization.md
+++ b/windows/privacy/configure-windows-diagnostic-data-in-your-organization.md
@@ -77,21 +77,13 @@ The following table lists the endpoints related how you can manage the collectio
| Windows service | Endpoint |
| - | - |
|Connected User Experiences and Telemetry | v10.events.data.microsoft.com
v10c.events.data.microsoft.com
v10.vortex-win.data.microsoft.com |
-| [Windows Error Reporting](https://docs.microsoft.com/windows/win32/wer/windows-error-reporting) | watson.telemetry.microsoft.com
watson.microsoft.com
umwatsonc.telemetry.microsoft.com |
-| | umwatsonc.events.data.microsoft.com |
-| | *-umwatsonc.events.data.microsoft.com |
-| | ceuswatcab01.blob.core.windows.net |
-| | ceuswatcab02.blob.core.windows.net |
-| | eaus2watcab01.blob.core.windows.net |
-| | eaus2watcab02.blob.core.windows.net |
-| | weus2watcab01.blob.core.windows.net |
-| | weus2watcab02.blob.core.windows.net |
-|Authentication | login.live.com
IMPORTANT: This endpoint is used for device authentication. We do not recommend disabling this endpoint.
-| [Online Crash Analysis](https://docs.microsoft.com/windows/win32/dxtecharts/crash-dump-analysis) | oca.telemetry.microsoft.com |
-| | oca.microsoft.com
-| | kmwatsonc.telemetry.microsoft.com
-| | *-kmwatsonc.telemetry.microsoft.com
-|Settings | settings-win.data.microsoft.com
IMPORTANT: This endpoint is used to remotely configure diagnostics-related settings and data collection. For example, we use the settings endpoint to remotely block an event from being sent back to Microsoft. We do not recommend disabling this endpoint. This endpoint does not upload Windows diagnostic data
+| [Windows Error Reporting](https://docs.microsoft.com/windows/win32/wer/windows-error-reporting) | watson.telemetry.microsoft.com
watson.microsoft.com
umwatsonc.telemetry.microsoft.com
umwatsonc.events.data.microsoft.com
*-umwatsonc.events.data.microsoft.com
ceuswatcab01.blob.core.windows.net
ceuswatcab02.blob.core.windows.net
eaus2watcab01.blob.core.windows.net
eaus2watcab02.blob.core.windows.net
weus2watcab01.blob.core.windows.net
weus2watcab02.blob.core.windows.net |
+|Authentication | login.live.com
+IMPORTANT: This endpoint is used for device authentication. We do not recommend disabling this endpoint.|
+| [Online Crash Analysis](https://docs.microsoft.com/windows/win32/dxtecharts/crash-dump-analysis) | oca.telemetry.microsoft.com
oca.microsoft.com
kmwatsonc.telemetry.microsoft.com
*-kmwatsonc.telemetry.microsoft.com |
+|Settings | settings-win.data.microsoft.com
+
+IMPORTANT: This endpoint is used to remotely configure diagnostics-related settings and data collection. For example, we use the settings endpoint to remotely block an event from being sent back to Microsoft. We do not recommend disabling this endpoint. This endpoint does not upload Windows diagnostic data
### Data access
@@ -101,7 +93,7 @@ The principle of least privileged access guides access to Windows diagnostic dat
Microsoft believes in and practices data minimization. We strive to gather only the info we need and to store it only for as long as it’s needed to provide a service or for analysis. For more information on how long data is retained, see the section named **Our retention of personal data** in the [Microsoft Privacy Statement](https://privacy.microsoft.com/en-US/privacystatement).
-#### Diagnostic data settings
+## Diagnostic data settings
There are four diagnostic data collection settings. Each setting is described in more detail in the sections that follow.
@@ -121,14 +113,14 @@ Here’s a summary of the types of data that is included with each setting:
| **Data collection** | N/A | 100% | Sampling applies | Sampling applies |
-#### Diagnostic data off
+### Diagnostic data off
This setting was previously labeled as **Security**. When you configure this setting, no Windows diagnostic data is sent from your device. This is only available on Windows Server, Windows 10 Enterprise, and Windows 10 Education. If you choose this setting, devices in your organization will still be secure.
>[!NOTE]
> If your organization relies on Windows Update, the minimum recommended setting is **Required diagnostic data**. Because no Windows Update information is collected when diagnostic data is off, important information about update failures is not sent. Microsoft uses this information to fix the causes of those failures and improve the quality of our updates.
-#### Required diagnostic data
+### Required diagnostic data
Required diagnostic data, previously labeled as **Basic**, gathers a limited set of data that’s critical for understanding the device and its configuration. This data helps to identify problems that can occur on a specific hardware or software configuration. For example, it can help determine if crashes are more frequent on devices with a specific amount of memory or that are running a specific driver version.
@@ -160,7 +152,7 @@ Required diagnostic data includes:
- Information about how the Microsoft Store performs, including app downloads, installations, and updates. It also includes Microsoft Store launches, page views, suspend and resumes, and obtaining licenses.
-#### Enhanced diagnostic data
+### Enhanced diagnostic data
>[!NOTE]
>We’re simplifying your diagnostic data controls by moving from four diagnostic data controls to three: **Diagnostic data off**, **Required**, and **Optional**. making changes to the enhanced diagnostic data level. For more info about this change, see [Changes to Windows diagnostic data](changes-to-windows-diagnostic-data-collection.md).
@@ -171,7 +163,7 @@ Enhanced diagnostic data includes data about the websites you browse, how Window
- Device-specific events that are specific to certain devices, such as Surface Hub and Microsoft HoloLens. For example, Microsoft HoloLens sends Holographic Processing Unit (HPU)-related events.
- All crash dump types, except for heap dumps and full dumps. For more information about crash dumps, see [Windows Error Reporting](https://docs.microsoft.com/windows/win32/wer/windows-error-reporting).
- #### Optional diagnostic data
+ ### Optional diagnostic data
Optional diagnostic data, previously labeled as **Full**, includes more detailed information about your device and its settings, capabilities, and device health. Optional diagnostic data also includes data about the websites you browse, device activity, and enhanced error reporting that helps Microsoft to fix and improve products and services for all users. When you choose to send optional diagnostic data, required diagnostic data will always be included, and we collect the following additional information:
@@ -184,7 +176,7 @@ Optional diagnostic data, previously labeled as **Full**, includes more detailed
>[!Note]
>Crash dumps collected in optional diagnostic data may unintentionally contain personal data, such as portions of memory from a document and a web page. For more information about crash dumps, see [Windows Error Reporting](https://docs.microsoft.com/windows/win32/wer/windows-error-reporting).
-#### Manage enterprise diagnostic data
+## Manage enterprise diagnostic data
Use the steps in this section to configure the diagnostic data settings for Windows and Windows Server in your organization.
@@ -205,23 +197,22 @@ Use the appropriate value in the table below when you configure the management p
>[!Note]
>When both the Computer Configuration policy and User Configuration policies are set, the more restrictive policy is used.
-#### Use Group Policy to manage diagnostic data collection
+### Use Group Policy to manage diagnostic data collection
You can use Group Policy to set your organization’s diagnostic data setting:
-1. From the Group Policy Management Console, go to **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Data Collection and Preview Builds**.
-
- 1. Double-click **Allow Telemetry**.
+ 1. From the Group Policy Management Console, go to **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Data Collection and Preview Builds**.
+ 2. Double-click **Allow Telemetry**.
>[!NOTE]
> If devices in your organization are running Windows 10, 1803 and newer, the user can still use Settings to set the diagnostic data setting to a more restrictive value, unless the **Configure diagnostic data opt-in settings user interface** policy is set.
- 2. In the **Options** box, choose the setting that you want to configure, and then click **OK**.
+ 3. In the **Options** box, choose the setting that you want to configure, and then click **OK**.
-#### Use MDM to manage diagnostic data collection
+### Use MDM to manage diagnostic data collection
[Policy Configuration Service Provider (CSP)](https://docs.microsoft.com/windows/client-management/mdm/policy-configuration-service-provider) to apply the System/AllowTelemetry MDM policy.
-#### Limit optional diagnostic data for Desktop Analytics
+## Limit optional diagnostic data for Desktop Analytics
For more information about how to limit the diagnostic data to the minimum required by Desktop Analytics, see [Enable data sharing for Desktop Analytics](https://docs.microsoft.com/mem/configmgr/desktop-analytics/enable-data-sharing).
\ No newline at end of file
From 1c3833caf2311e35f384a6425b27e04ce5e359d7 Mon Sep 17 00:00:00 2001
From: Sinead O'Sullivan
Date: Mon, 8 Jun 2020 13:17:35 +0100
Subject: [PATCH 0019/1414] Update
configure-windows-diagnostic-data-in-your-organization.md
---
...nfigure-windows-diagnostic-data-in-your-organization.md | 7 ++-----
1 file changed, 2 insertions(+), 5 deletions(-)
diff --git a/windows/privacy/configure-windows-diagnostic-data-in-your-organization.md b/windows/privacy/configure-windows-diagnostic-data-in-your-organization.md
index 4dbb71e72a..487554e2ef 100644
--- a/windows/privacy/configure-windows-diagnostic-data-in-your-organization.md
+++ b/windows/privacy/configure-windows-diagnostic-data-in-your-organization.md
@@ -78,12 +78,9 @@ The following table lists the endpoints related how you can manage the collectio
| - | - |
|Connected User Experiences and Telemetry | v10.events.data.microsoft.com
v10c.events.data.microsoft.com
v10.vortex-win.data.microsoft.com |
| [Windows Error Reporting](https://docs.microsoft.com/windows/win32/wer/windows-error-reporting) | watson.telemetry.microsoft.com
watson.microsoft.com
umwatsonc.telemetry.microsoft.com
umwatsonc.events.data.microsoft.com
*-umwatsonc.events.data.microsoft.com
ceuswatcab01.blob.core.windows.net
ceuswatcab02.blob.core.windows.net
eaus2watcab01.blob.core.windows.net
eaus2watcab02.blob.core.windows.net
weus2watcab01.blob.core.windows.net
weus2watcab02.blob.core.windows.net |
-|Authentication | login.live.com
-IMPORTANT: This endpoint is used for device authentication. We do not recommend disabling this endpoint.|
+|Authentication | login.live.com
IMPORTANT: This endpoint is used for device authentication. We do not recommend disabling this endpoint.|
| [Online Crash Analysis](https://docs.microsoft.com/windows/win32/dxtecharts/crash-dump-analysis) | oca.telemetry.microsoft.com
oca.microsoft.com
kmwatsonc.telemetry.microsoft.com
*-kmwatsonc.telemetry.microsoft.com |
-|Settings | settings-win.data.microsoft.com
-
-IMPORTANT: This endpoint is used to remotely configure diagnostics-related settings and data collection. For example, we use the settings endpoint to remotely block an event from being sent back to Microsoft. We do not recommend disabling this endpoint. This endpoint does not upload Windows diagnostic data
+|Settings | settings-win.data.microsoft.com
IMPORTANT: This endpoint is used to remotely configure diagnostics-related settings and data collection. For example, we use the settings endpoint to remotely block an event from being sent back to Microsoft. We do not recommend disabling this endpoint. This endpoint does not upload Windows diagnostic data |
### Data access
From c5464fa458d682f220adf24565a008c6e06febf4 Mon Sep 17 00:00:00 2001
From: Sinead O'Sullivan
Date: Mon, 8 Jun 2020 15:11:18 +0100
Subject: [PATCH 0020/1414] editreviewupdates
---
.../configure-windows-diagnostic-data-in-your-organization.md | 2 +-
windows/privacy/windows-10-and-privacy-compliance.md | 2 +-
2 files changed, 2 insertions(+), 2 deletions(-)
diff --git a/windows/privacy/configure-windows-diagnostic-data-in-your-organization.md b/windows/privacy/configure-windows-diagnostic-data-in-your-organization.md
index 487554e2ef..baf24cbc3f 100644
--- a/windows/privacy/configure-windows-diagnostic-data-in-your-organization.md
+++ b/windows/privacy/configure-windows-diagnostic-data-in-your-organization.md
@@ -208,7 +208,7 @@ You can use Group Policy to set your organization’s diagnostic data setting:
### Use MDM to manage diagnostic data collection
-[Policy Configuration Service Provider (CSP)](https://docs.microsoft.com/windows/client-management/mdm/policy-configuration-service-provider) to apply the System/AllowTelemetry MDM policy.
+Use [Policy Configuration Service Provider (CSP)](https://docs.microsoft.com/windows/client-management/mdm/policy-configuration-service-provider) to apply the System/AllowTelemetry MDM policy.
## Limit optional diagnostic data for Desktop Analytics
diff --git a/windows/privacy/windows-10-and-privacy-compliance.md b/windows/privacy/windows-10-and-privacy-compliance.md
index ac0fc0d1bc..f9bf3793a0 100644
--- a/windows/privacy/windows-10-and-privacy-compliance.md
+++ b/windows/privacy/windows-10-and-privacy-compliance.md
@@ -49,7 +49,7 @@ The following table provides an overview of the Windows 10 privacy settings pres
| Feature/Setting | Description | Supporting Content | Privacy Statement |
| --- | --- | --- | --- |
-| Diagnostic Data | Microsoft uses diagnostic data to keep Windows secure, up to date, troubleshoot problems, and make product improvements. Regardless of what choices you make for diagnostic data collection, the device will be just as secure and will operate normally. This data is collected by Microsoft and stored with one or more unique identifiers that can help us recognize an individual user on an individual device and understand the device's service issues and use patterns.
Diagnostic data is categorized into the following:
- **Required diagnostic data**
Previously known as basic diagnostic data, required diagnostic data includes information about your device, its settings, capabilities, and whether it is performing properly, whether a device is ready for an update, and whether there are factors that may impede the ability to receive updates, such as low battery, limited disk space, or connectivity through a paid network. You can find out what is collected with required diagnostic data [here](https://docs.microsoft.com/windows/privacy/required-windows-diagnostic-data-events-and-fields-2004). - **Optional diagnostic data**
Previously known as full diagnostic data, optional diagnostic data includes more detailed information about your device and its settings, capabilities, and device health. When you choose to send optional diagnostic data, required diagnostic data will always be included. You can find out the types of optional diagnostic data collected [here](https://docs.microsoft.com/windows/privacy/windows-diagnostic-data).
| [Learn more](https://support.microsoft.com/4468236/diagnostics-feedback-and-privacy-in-windows-10-microsoft-privacy)
[Configure Windows diagnostic data in your organization](configure-windows-diagnostic-data-in-your-organization.md) | [Privacy Statement](https://privacy.microsoft.com/privacystatement#maindiagnosticsmodule) |
+| Diagnostic Data | Microsoft uses diagnostic data to keep Windows secure, up to date, troubleshoot problems, and make product improvements. Regardless of what choices you make for diagnostic data collection, the device will be just as secure and will operate normally. This data is collected by Microsoft and stored with one or more unique identifiers that can help us recognize an individual user on an individual device and understand the device's service issues and use patterns.
Diagnostic data is categorized into the following:
- **Required diagnostic data**
Previously known as basic diagnostic data, required diagnostic data includes information about your device, its settings, capabilities, and whether it is performing properly, whether a device is ready for an update, and whether there are factors that may impede the ability to receive updates, such as low battery, limited disk space, or connectivity through a paid network. You can find out what is collected with required diagnostic data [here](https://docs.microsoft.com/windows/privacy/required-windows-diagnostic-data-events-and-fields-2004). - **Optional diagnostic data**
Previously known as full diagnostic data, optional diagnostic data includes more detailed information about your device and its settings, capabilities, and device health. When you choose to send optional diagnostic data, required diagnostic data will always be included. You can find out the types of optional diagnostic data collected [here](https://docs.microsoft.com/windows/privacy/windows-diagnostic-data).
| [Learn more]https://support.microsoft.com/help/4468236/diagnostics-feedback-and-privacy-in-windows-10-microsoft-privacy)
[Configure Windows diagnostic data in your organization](configure-windows-diagnostic-data-in-your-organization.md) | [Privacy Statement](https://privacy.microsoft.com/privacystatement#maindiagnosticsmodule) |
| Inking and typing diagnostics | Microsoft collects optional inking and typing diagnostic data to improve the language recognition and suggestion capabilities of apps and services running on Windows. | [Learn more](https://support.microsoft.com/help/4468236/diagnostics-feedback-and-privacy-in-windows-10-microsoft-privacy) | [Privacy Statement](https://privacy.microsoft.com/privacystatement#maindiagnosticsmodule) |
| Speech | Use your voice for dictation and to talk to Cortana and other apps that use Windows cloud-based speech recognition. Microsoft collects voice data to help improve speech services. | [Learn more](https://support.microsoft.com/help/4468250/windows-10-speech-voice-activation-inking-typing-privacy) | [Privacy Statement](https://privacy.microsoft.com/privacystatement#mainspeechinkingtypingmodule) |
| Location | Get location-based experiences like directions and weather. Let Windows and apps request your location and allow Microsoft to use your location data to improve location services. | [Learn more](https://support.microsoft.com/help/4468240/windows-10-location-service-and-privacy) |[Privacy Statement](https://privacy.microsoft.com/privacystatement#mainlocationservicesmotionsensingmodule) |
From 23d63b2a220237776009fcae32782c2573123f70 Mon Sep 17 00:00:00 2001
From: Dani Halfin
Date: Mon, 8 Jun 2020 16:00:13 -0700
Subject: [PATCH 0021/1414] updating toc and index
---
windows/privacy/TOC.md | 35 -----------------------------------
windows/privacy/index.yml | 28 +++++++---------------------
2 files changed, 7 insertions(+), 56 deletions(-)
delete mode 100644 windows/privacy/TOC.md
diff --git a/windows/privacy/TOC.md b/windows/privacy/TOC.md
deleted file mode 100644
index fe73e90c9e..0000000000
--- a/windows/privacy/TOC.md
+++ /dev/null
@@ -1,35 +0,0 @@
-# [Privacy](index.yml)
-## [Beginning your General Data Protection Regulation (GDPR) journey for Windows 10](gdpr-win10-whitepaper.md)
-## [Windows and the GDPR: Information for IT Administrators and Decision Makers](gdpr-it-guidance.md)
-## [Windows 10 & Privacy Compliance: A Guide for IT and Compliance Professionals](Windows-10-and-privacy-compliance.md)
-## [Windows 10 personal data services configuration](windows-personal-data-services-configuration.md)
-## [Configure Windows diagnostic data in your organization](configure-windows-diagnostic-data-in-your-organization.md)
-## Diagnostic Data Viewer
-### [Diagnostic Data Viewer Overview](diagnostic-data-viewer-overview.md)
-### [Diagnostic Data Viewer for PowerShell Overview](Microsoft-DiagnosticDataViewer.md)
-## Basic level Windows diagnostic data events and fields
-### [Windows 10, version 2004 required Windows diagnostic data events and fields](required-windows-diagnostic-data-events-and-fields-2004.md)
-### [Windows 10, version 1903 and Windows 10, version 1909 basic level Windows diagnostic events and fields](basic-level-windows-diagnostic-events-and-fields-1903.md)
-### [Windows 10, version 1809 basic level Windows diagnostic events and fields](basic-level-windows-diagnostic-events-and-fields-1809.md)
-### [Windows 10, version 1803 basic level Windows diagnostic events and fields](basic-level-windows-diagnostic-events-and-fields-1803.md)
-### [Windows 10, version 1709 basic level Windows diagnostic events and fields](basic-level-windows-diagnostic-events-and-fields-1709.md)
-### [Windows 10, version 1703 basic level Windows diagnostic events and fields](basic-level-windows-diagnostic-events-and-fields-1703.md)
-## Enhanced level Windows diagnostic data events and fields
-### [Windows 10 diagnostic data events and fields collected through the limit enhanced diagnostic data policy](enhanced-diagnostic-data-windows-analytics-events-and-fields.md)
-## Full level categories
-### [Windows 10, version 1709 and newer diagnostic data for the Full level](windows-diagnostic-data.md)
-### [Windows 10, version 1703 diagnostic data for the Full level](windows-diagnostic-data-1703.md)
-## Manage Windows 10 connection endpoints
-### [Manage connections from Windows operating system components to Microsoft services](manage-connections-from-windows-operating-system-components-to-microsoft-services.md)
-### [Manage connections from Windows operating system components to Microsoft services using MDM](manage-connections-from-windows-operating-system-components-to-microsoft-services-using-MDM.md)
-### [Connection endpoints for Windows 10, version 2004](manage-windows-2004-endpoints.md)
-### [Connection endpoints for Windows 10, version 1903](manage-windows-1903-endpoints.md)
-### [Connection endpoints for Windows 10, version 1809](manage-windows-1809-endpoints.md)
-### [Connection endpoints for Windows 10, version 1803](manage-windows-1803-endpoints.md)
-### [Connection endpoints for Windows 10, version 1709](manage-windows-1709-endpoints.md)
-### [Connection endpoints for non-Enterprise editions of Windows 10, version 2004](windows-endpoints-2004-non-enterprise-editions.md)
-### [Connection endpoints for non-Enterprise editions of Windows 10, version 1903](windows-endpoints-1903-non-enterprise-editions.md)
-### [Connection endpoints for non-Enterprise editions of Windows 10, version 1809](windows-endpoints-1809-non-enterprise-editions.md)
-### [Connection endpoints for non-Enterprise editions of Windows 10, version 1803](windows-endpoints-1803-non-enterprise-editions.md)
-### [Connection endpoints for non-Enterprise editions of Windows 10, version 1709](windows-endpoints-1709-non-enterprise-editions.md)
-
diff --git a/windows/privacy/index.yml b/windows/privacy/index.yml
index 43423ceb3e..02e0f86fd7 100644
--- a/windows/privacy/index.yml
+++ b/windows/privacy/index.yml
@@ -23,9 +23,9 @@ highlightedContent:
# itemType: architecture | concept | deploy | download | get-started | how-to-guide | learn | overview | quickstart | reference | sample | tutorial | video | whats-new
items:
# Card
- - title: Start with GDPR basics
- itemType: get-started
- url: gdpr-it-guidance.md
+ - title: Windows privacy & compliance guide for IT and compliance professionals
+ itemType: overview
+ url: Windows-10-and-privacy-compliance.md
# Card
- title: Configure Windows diagnostic data
itemType: how-to-guide
@@ -41,20 +41,15 @@ productDirectory:
summary: For the latest Windows 10 version, learn more about what Windows diagnostic data is collected at various diagnostics levels.
items:
# Card
- - title: Basic level events and fields
+ - title: Required diagnostic data
# imageSrc should be square in ratio with no whitespace
imageSrc: https://docs.microsoft.com/media/common/i_extend.svg
- summary: Learn more about basic Windows diagnostic data events and fields collected.
+ summary: Learn more about required Windows diagnostic data events and fields collected
url: basic-level-windows-diagnostic-events-and-fields.md
# Card
- - title: Enhanced level events and fields
- imageSrc: https://docs.microsoft.com/media/common/i_delivery.svg
- summary: Learn more about Windows diagnostic data events and fields used by Windows Analytics.
- url: enhanced-diagnostic-data-windows-analytics-events-and-fields.md
- # Card
- - title: Full level data categories
+ - title: Optional diagnostic data
imageSrc: https://docs.microsoft.com/media/common/i_get-started.svg
- summary: Learn more about all Windows diagnostic data collected.
+ summary: Get examples of the types of optional diagnostic data collected from Windows
url: windows-diagnostic-data.md
# conceptualContent section (optional)
@@ -161,15 +156,6 @@ additionalContent:
sections:
- items:
# Card
- - title: More Windows privacy
- links:
- - text: "Windows 10 & Privacy Compliance: A Guide for IT and Compliance Professionals"
- url: Windows-10-and-privacy-compliance.md
- - text: Windows 10 personal data services configuration
- url: windows-personal-data-services-configuration.md
- - text: Beginning your GDPR journey for Windows 10
- url: gdpr-win10-whitepaper.md
- # Card
- title: View and manage Windows 10 connection endpoints
links:
- text: Manage Windows 10 connection endpoints
From cd58f68e09006746f0e093dbbba1ba2483820b4c Mon Sep 17 00:00:00 2001
From: Dani Halfin
Date: Mon, 8 Jun 2020 16:00:51 -0700
Subject: [PATCH 0022/1414] updating toc and index
---
windows/privacy/toc.yml | 0
1 file changed, 0 insertions(+), 0 deletions(-)
create mode 100644 windows/privacy/toc.yml
diff --git a/windows/privacy/toc.yml b/windows/privacy/toc.yml
new file mode 100644
index 0000000000..e69de29bb2
From a7789a383783ddd602da3b78197451835dc2c383 Mon Sep 17 00:00:00 2001
From: Dani Halfin
Date: Mon, 8 Jun 2020 18:34:37 -0700
Subject: [PATCH 0023/1414] fixing toc
---
windows/privacy/toc.yml | 66 +++++++++++++++++++++++++++++++++++++++++
1 file changed, 66 insertions(+)
diff --git a/windows/privacy/toc.yml b/windows/privacy/toc.yml
index e69de29bb2..48721791cf 100644
--- a/windows/privacy/toc.yml
+++ b/windows/privacy/toc.yml
@@ -0,0 +1,66 @@
+- name: Privacy
+ href: index.yml
+ expanded: true
+ items:
+ - name: "Windows 10 & Privacy Compliance: A Guide for IT and Compliance Professionals"
+ href: Windows-10-and-privacy-compliance.md
+ - name: Configure Windows diagnostic data in your organization
+ href: configure-windows-diagnostic-data-in-your-organization.md
+ - name: Changes to Windows diagnostic data collection
+ href: changes-to-windows-diagnostic-data-collection.md
+ - name: Diagnostic Data Viewer
+ items:
+ - name: Diagnostic Data Viewer Overview
+ href: diagnostic-data-viewer-overview.md
+ - name: Diagnostic Data Viewer for PowerShell Overview
+ href: Microsoft-DiagnosticDataViewer.md
+ - name: Required Windows diagnostic data events and fields
+ items:
+ - name: Windows 10, version 2004 required Windows diagnostic data events and fields
+ href: required-windows-diagnostic-data-events-and-fields-2004.md
+ - name: Windows 10, version 1903 and Windows 10, version 1909 required level Windows diagnostic events and fields
+ href: basic-level-windows-diagnostic-events-and-fields-1903.md
+ - name: Windows 10, version 1809 required Windows diagnostic events and fields
+ href: basic-level-windows-diagnostic-events-and-fields-1809.md
+ - name: Windows 10, version 1803 required Windows diagnostic events and fields
+ href: basic-level-windows-diagnostic-events-and-fields-1803.md
+ - name: Windows 10, version 1709 required Windows diagnostic events and fields
+ href: basic-level-windows-diagnostic-events-and-fields-1709.md
+ - name: Windows 10, version 1703 required Windows diagnostic events and fields
+ href: basic-level-windows-diagnostic-events-and-fields-1703.md
+ - name: Optional Windows diagnostic data events and fields
+ items:
+ - name: Windows 10, version 1709 and newer optional diagnostic data
+ href: windows-diagnostic-data.md
+ - name: Windows 10, version 1703 optional diagnostic data
+ href: windows-diagnostic-data-1703.md
+ - name: Deprecated diagnostic data levels
+ items:
+ - name: Windows 10 diagnostic data events and fields collected through the limit enhanced diagnostic data policy
+ href: enhanced-diagnostic-data-windows-analytics-events-and-fields.md
+ - name: Manage Windows 10 connection endpoints
+ items:
+ - name: Manage connections from Windows operating system components to Microsoft services
+ href: manage-connections-from-windows-operating-system-components-to-microsoft-services.md
+ - name: Manage connections from Windows operating system components to Microsoft services using MDM
+ href: manage-connections-from-windows-operating-system-components-to-microsoft-services-using-MDM.md
+ - name: Connection endpoints for Windows 10, version 2004
+ href: manage-windows-2004-endpoints.md
+ - name: Connection endpoints for Windows 10, version 1903
+ href: manage-windows-1903-endpoints.md
+ - name: Connection endpoints for Windows 10, version 1809
+ href: manage-windows-1809-endpoints.md
+ - name: Connection endpoints for Windows 10, version 1803
+ href: manage-windows-1803-endpoints.md
+ - name: Connection endpoints for Windows 10, version 1709
+ href: manage-windows-1709-endpoints.md
+ - name: Connection endpoints for non-Enterprise editions of Windows 10, version 2004
+ href: windows-endpoints-2004-non-enterprise-editions.md
+ - name: Connection endpoints for non-Enterprise editions of Windows 10, version 1903
+ href: windows-endpoints-1903-non-enterprise-editions.md
+ - name: Connection endpoints for non-Enterprise editions of Windows 10, version 1809
+ href: windows-endpoints-1809-non-enterprise-editions.md
+ - name: Connection endpoints for non-Enterprise editions of Windows 10, version 1803
+ href: windows-endpoints-1803-non-enterprise-editions.md
+ - name: Connection endpoints for non-Enterprise editions of Windows 10, version 1709
+ href: windows-endpoints-1709-non-enterprise-editions.md
\ No newline at end of file
From 73f57888479295d8a16c6438f5e382105775d54b Mon Sep 17 00:00:00 2001
From: Dani Halfin
Date: Mon, 8 Jun 2020 19:15:15 -0700
Subject: [PATCH 0024/1414] one more fix to remove old files
---
.openpublishing.redirection.json | Bin 2576176 -> 2578320 bytes
windows/privacy/gdpr-it-guidance.md | 308 -------------
windows/privacy/gdpr-win10-whitepaper.md | 340 ---------------
windows/privacy/toc.yml | 1 -
...ws-personal-data-services-configuration.md | 408 ------------------
5 files changed, 1057 deletions(-)
delete mode 100644 windows/privacy/gdpr-it-guidance.md
delete mode 100644 windows/privacy/gdpr-win10-whitepaper.md
delete mode 100644 windows/privacy/windows-personal-data-services-configuration.md
diff --git a/.openpublishing.redirection.json b/.openpublishing.redirection.json
index af5222988d92153d130950539faba798275c0555..2b4fa84488cb25d793c2476fbe101636fd6422fb 100644
GIT binary patch
delta 209
zcmV;?051Qqo}B@ZublyagaL#Cgad>Ggaw2Kga?EOgb9QSgbRcWgbjoagb#!egb{=i
zgcF1mgcXDqgcpPugc*bygd2n$gdKz)gdc<;gdv0?gd>C`ge8O~v?umXm+;jQte0Lh
zBMz59MI#CgX#jKpEdXZ#bpUAqWS0?e0lSwlFCz}Oe6<5!0hcgEBRZFUL?g17Pzwfd
zmrRN#B(=~6fB~0KyCDP@WdL#ja{zAuZUA8bYyd3)WB_3RbO2$Of&2y&m$p+79G6fM
L3+T7NO($>xe+EKA
delta 94
zcmV~$xf#J=007YMC+=IseME%pU&XV
diff --git a/windows/privacy/gdpr-it-guidance.md b/windows/privacy/gdpr-it-guidance.md
deleted file mode 100644
index f0e1c95a3d..0000000000
--- a/windows/privacy/gdpr-it-guidance.md
+++ /dev/null
@@ -1,308 +0,0 @@
----
-title: Windows and the GDPR-Information for IT Administrators and Decision Makers
-description: Use this topic to understand the relationship between users in your organization and Microsoft in the context of the GDPR (General Data Protection Regulation).
-keywords: privacy, GDPR, windows, IT
-ms.prod: w10
-ms.mktglfcycl: manage
-ms.sitesec: library
-ms.pagetype: security
-ms.localizationpriority: high
-audience: ITPro
-author: dansimp
-ms.author: dansimp
-manager: dansimp
-ms.collection: M365-security-compliance
-ms.topic: article
-ms.date: 05/11/2018
-ms.reviewer:
----
-# Windows and the GDPR: Information for IT Administrators and Decision Makers
-
-Applies to:
-- Windows 10, version 1703 and newer
-- Windows 10 Team Edition, version 1703 for Surface Hub
-- Windows Server 2016 and newer
-- Desktop Analytics
-
-This topic provides IT Decision Makers with a basic understanding of the relationship between users in an organization and Microsoft in the context of the GDPR (General Data Protection Regulation). You will also learn what role an IT organization plays for that relationship.
-
-For more information about the GDPR, see:
-* [Microsoft GDPR Overview](https://aka.ms/GDPROverview)
-* [Microsoft Trust Center FAQs about the GDPR](https://aka.ms/gdpr-faq)
-* [Microsoft Service Trust Portal (STP)](https://aka.ms/stp)
-* [Get Started: Support for GDPR Accountability](https://servicetrust.microsoft.com/ViewPage/GDPRGetStarted)
-
-## GDPR fundamentals
-
-Here are some GDPR fundamentals:
-
-* On May 25, 2018, this EU data privacy law is implemented. It sets a new global bar for data privacy rights, security, and compliance.
-* The GDPR is fundamentally about protecting and enabling the privacy rights of individuals – both customers and employees.
-* The European law establishes strict global data privacy requirements governing how organizations manage and protect personal data while respecting individual choice – no matter where data is sent, processed, or stored.
-* A request by an individual to an organization to take an action on their personal data is referred to here as a *data subject request*, or *DSR*.
-
-Microsoft believes data privacy is a fundamental right, and that the GDPR is an important step forward for clarifying and enabling individual privacy rights. We also recognize that the GDPR required significant changes by organizations all over the world with regard to the discovery, management, protection, and reporting of personal data that is collected, processed, and stored within an organization.
-
-### What is personal data under the GDPR?
-
-Article 4 (1) of [the GDPR](http://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32016R0679&from=en) defines personal data as any information relating to an identified or identifiable person. There is no distinction between a person’s private, public, or work roles. As defined by the GDPR, personal data includes, but is not limited to:
-* Name
-* Email address
-* Credit card numbers
-* IP addresses
-* Social media posts
-* Location information
-* Handwriting patterns
-* Voice input to cloud-based speech services
-
-### Controller and processor under the GDPR: Who does what
-
-#### Definition
-
-The GDPR describes specific requirements for allocating responsibility for controller and processor activities related to personal data. Thus, every organization that processes personal data must determine whether it is acting as a controller or processor for a specific scenario.
-
-* **Controller**: GDPR Article 4 (7) defines the ‘controller’ as the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data.
-* **Processor**: According to the GDPR Article 4 (8) ‘processor’ means a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller.
-
-#### Controller scenario
-
-For example, when an organization is using Microsoft Windows Defender Advanced Threat Protection (ATP) to detect, investigate, and respond to advanced threats on their networks as part of their IT operations, that organization is collecting data from the user’s device – data, that might include personal data. In this scenario, the organization is the *controller* of the respective personal data, since the organization controls the purpose and means of the processing for data being collected from the devices that have Windows Defender ATP enabled.
-
-#### Processor scenario
-
-In the controller scenario described above, Microsoft is a *processor* because Microsoft provides data processing services to that controller (in the given example, an organization that subscribed to Windows Defender ATP and enabled it for the user’s device). As processor, Microsoft only processes data on behalf of the enterprise customer and does not have the right to process data beyond their instructions as specified in a written contract, such as the [Microsoft Product Terms and the Microsoft Online Services Terms (OST)](https://www.microsoft.com/licensing/product-licensing/products.aspx).
-
-## GDPR relationship between a Windows 10 user and Microsoft
-
-For Windows 10 services, Microsoft usually is the controller (with exceptions, such as Windows Defender ATP). The following sections describe what that means for the related data.
-
-### Types of data exchanged with Microsoft
-
-Microsoft collects data from or generates data through interactions with users of Windows 10 devices. This information can contain personal data, as defined in [Article 4 (1) of the GDPR](http://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=OJ:L:2016:119:FULL&from=EN), that may be used to provide, support, and improve Windows 10 services.
-
-Microsoft discloses data collection and privacy practices in detail, for example:
-* As part of the Windows 10 installation;
-* In the Windows 10 privacy settings;
-* Via the web-based [Microsoft Privacy dashboard](https://account.microsoft.com/privacy); and
-* In the [Microsoft Privacy Statement](https://privacy.microsoft.com/en-us/privacystatement).
-
-It is important to differentiate between two distinct types of data Windows services are dealing with.
-
-#### Windows functional data
-
-A user action, such as performing a Skype call, usually triggers the collection and transmission of Windows *functional data*. Some Windows components and applications connecting to Microsoft services also exchange Windows functional data to provide user functionality.
-
-Some other examples of Windows functional data:
-* The Weather app which can use the device’s location to retrieve local weather or community news.
-* Wallpaper and desktop settings that are synchronized across multiple devices.
-
-For more info on how IT Professionals can manage Windows functional data sent from an organization to Microsoft, see [Manage connections from Windows operating system components to Microsoft services](manage-connections-from-windows-operating-system-components-to-microsoft-services.md).
-
-#### Windows diagnostic data
-
-Windows diagnostic data is used to keep the operating system secure and up-to-date, troubleshoot problems, and make product improvements. The data is encrypted before being sent back to Microsoft.
-
-Some examples of diagnostic data include:
-* The type of hardware being used, information about installed apps and usage details, and reliability data on drivers running on the device.
-* For users who have turned on “Tailored experiences”, it can be used to offer personalized tips, ads, and recommendations to enhance Microsoft products and services for the needs of the user.
-
-Diagnostic data is categorized into the levels "Security", "Basic", "Enhanced", and "Full". For a detailed discussion about these diagnostic data levels please see [Configure Windows diagnostic data in your organization](configure-windows-diagnostic-data-in-your-organization.md). To find more about what information is collected and how it is handled, see [Understanding Windows diagnostic data](configure-windows-diagnostic-data-in-your-organization.md#understanding-windows-diagnostic-data).
-
-> [!IMPORTANT]
-> Other Microsoft services as well as 3rd party applications and drivers running on Windows devices may implement their own functionality, independently from Windows, to transport their diagnostic data. Please contact the publisher for further guidance on how to control the diagnostic data collection level and transmission of these applications and services.
-
-### Windows services where Microsoft is the processor under the GDPR
-
-Most Windows 10 services are controller services in terms of the GDPR – for both Windows functional data and Windows diagnostic data. But there are a few Windows services where Microsoft is a processor for functional data under the GDPR, such as [Desktop Analytics](https://aka.ms/dadocs), [Update Compliance](https://docs.microsoft.com/windows/deployment/update/update-compliance-monitor) and [Windows Defender Advanced Threat Protection (ATP)](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp).
-
->[!NOTE]
->Both Desktop Analytics and Windows Defender ATP are subscription services for organizations. Some functionality requires a certain license (please see [Compare Windows 10 editions](https://www.microsoft.com/windowsforbusiness/compare)).
-
-#### Desktop Analytics
-
-> [!IMPORTANT]
-> The Upgrade Readiness and Device Health solutions of Windows Analytics are being retired on January 31, 2020. [Update Compliance](/windows/deployment/update/update-compliance-get-started) will continue to be supported.
-> For more information, see [Windows Analytics retirement on January 31, 2020](https://support.microsoft.com/en-us/help/4521815/windows-analytics-retirement).
-
-[Desktop Analytics](https://aka.ms/dadocs) is a cloud-based service that integrates with Configuration Manager. The service provides insight and intelligence for you to make more informed decisions about the update readiness of Windows Windows devices in their environment. It uses Windows diagnostic data from devices enrolled by the IT organization of an enterprise with data aggregated from millions of devices into the Desktop Analytics service.
-
-Windows [transmits Windows diagnostic data](enhanced-diagnostic-data-windows-analytics-events-and-fields.md) to Microsoft datacenters, where that data is analyzed and stored. With Desktop Analytics, the IT organization can then view the analyzed data to detect and fix issues or to improve their processes for upgrading to Windows 10.
-
-As a result, in terms of the GDPR, the organization that has subscribed to Desktop Analytics is acting as the controller, while Microsoft is the processor for Desktop Analytics.
-> [!NOTE]
-> The IT organization must explicitly enable Desktop Analytics for a device after the organization subscribes.
-
-> [!IMPORTANT]
-> Desktop Analytics does not collect Windows Diagnostic data by itself. Instead, Desktop Analytics only uses a subset of Windows Diagnostic data that is collected by Windows for an enrolled device. The Windows Diagnostic data collection is controlled by the IT department of an organization or the user of a device. See [Enable data sharing for Desktop Analytics](https://docs.microsoft.com/configmgr/desktop-analytics/enable-data-sharing)
-
-#### Windows Defender ATP
-
-[Windows Defender ATP](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp) is cloud-based service that collects and analyzes usage data from an organization’s devices to detect security threats. Some of the data can contain personal data as defined by the GDPR. Enrolled devices transmit usage data to Microsoft datacenters, where that data is analyzed, processed, and stored. The security operations center (SOC) of the organization can view the analyzed data using the [Windows Defender ATP portal](https://securitycenter.windows.com/).
-
-As a result, in terms of the GDPR, the organization that has subscribed to Windows Defender ATP is acting as the controller, while Microsoft is the processor for Windows Defender ATP.
-
-> [!NOTE]
-> The IT organization must explicitly enable Windows Defender ATP for a device after the organization subscribes.
-
-#### At a glance – Windows 10 services GDPR mode of operations
-
-The following table lists in what GDPR mode – controller or processor – Windows 10 services are operating.
-
-| Service | Microsoft GDPR mode of operation |
-| --- | --- |
-| Windows Functional data | Controller or Processor* |
-| Windows Diagnostic data | Controller |
-| Desktop Analytics | Processor |
-| Windows Defender Advanced Threat Detection (ATP) | Processor |
-
-*Table 1: Windows 10 GDPR modes of operations for different Windows 10 services*
-
-*/*Depending on which application/feature this is referring to.*
-
-## Windows diagnostic data and Windows 10
-
-
-### Recommended Windows 10 settings
-
-Windows diagnostic data collection level for Windows 10 can be set by a user in Windows (*Start > Settings > Privacy > Diagnostics & feedback*) or by the IT department of an organization, using Group Policy or Mobile Device Management (MDM) techniques.
-
-* For Windows 10, version 1803 and version 1809, Microsoft recommends setting the Windows diagnostic level to “Enhanced”. This enables organizations to get the full functionality of [Desktop Analytics](#desktop-analytics).
-
->[!NOTE]
->For more information on the Enhanced level, see [Configure Windows diagnostic data in your organization](configure-windows-diagnostic-data-in-your-organization.md).
-
-* For Windows 10, version 1709, and Windows 10, version 1703, the recommended Windows diagnostic level configuration for EEA and Switzerland commercial users is “Basic”.
-
->[!NOTE]
->For Windows 7, Microsoft recommends [using Commercial Data Opt-in setting](/previous-versions/windows/it-pro/windows-7/ee126127(v=ws.10)) to facilitate upgrade planning to Windows 10.
-
-### Additional information for Desktop Analytics
-
-The basic functionality of Desktop Analytics works at the “Basic” diagnostic data level. Other functionality of Desktop Analytics, such as usage or health data for updated devices, require “Enhanced”.
-
-Those organizations who wish to share the smallest set of events for Desktop Analytics and have set the Windows diagnostic level to “Enhanced” can use the [“Limit Enhanced diagnostic data to the minimum required by Desktop Analytics”](/windows/privacy/configure-windows-diagnostic-data-in-your-organization#limit-enhanced-diagnostic-data-to-the-minimum-required-by-desktop-analytics) setting. This filtering mechanism was that Microsoft introduced in Windows 10, version 1709. When enabled, this feature limits the operating system diagnostic data events included in the Enhanced level to the smallest set of data required by Desktop Analytics.
-
-> [!NOTE]
-> Additional information can be found at [Desktop Analytics data privacy](https://docs.microsoft.com/configmgr/desktop-analytics/privacy).
-
-## Controlling Windows 10 data collection and notification about it
-
-Windows 10 sends diagnostic data to Microsoft services, and some of that data can contain personal data. Both the user and the IT organization have the ability to control the transmission of that data to Microsoft.
-
-### Adjusting privacy settings by the user
-
-A user has the ability to adjust additional privacy settings in Windows by navigating to *Start > Settings > Privacy*. For example, a user can control if location is enabled or disabled, whether or not to transmit feedback on inking and typing input to Microsoft for improving the personal accuracy of these services, or if Windows collects activities for syncing it with other devices.
-
-For a standard user in an organization, some privacy settings might be controlled by their IT department. This is done using Group Policies or Mobile Device Management (MDM) settings. If this is the case, the user will see an alert that says ‘Some settings are hidden or managed by your organization’ when they navigate to *Start > Settings > Privacy*. As such, the user can only change some settings, but not all.
-
-### Users can lower the diagnostic level
-
-Starting with Windows 10, version 1803, a user can change the Windows diagnostics data level for their device below to what was set by their IT department. Organizations can allow or disallow this feature by configuring the Group Policy **Computer Configuration\Administrative Templates\Windows Components\Data Collection and Preview Builds\Configure telemetry opt-in setting user interface** or the MDM policy **ConfigureTelemetryOptInSettingsUx**.
-
-If an IT organization has not disabled this policy, users within the organization can change their own Windows diagnostic data collection level in *Start > Settings > Privacy > Diagnostics & feedback*. For example, if the IT organization enabled this policy and set the level to “Full”, a user can modify the Windows diagnostics data level setting to “Basic”.
-
-### Notification at logon
-
-Windows 10, version 1803, and later can provide users with a notification during their logon. If the IT organization has not disabled the Group Policy **Computer Configuration\Administrative Templates\Windows Components\Data Collection and Preview Builds\Configure telemetry opt-in change notifications** or the MDM policy **ConfigureTelemetryOptInChangeNotification**, Windows diagnostic data notifications can appear at logon so that the users of a device are aware of the data collection.
-
-This notification can also be shown when the diagnostic level for the device was changed. For instance, if the diagnostic level on the device is set to “Basic” and the IT organization changes it to “Full”, users will be notified on their next logon.
-
-### Diagnostic Data Viewer (DDV)
-
-In Windows 10, version 1803 and later, users can invoke the [Diagnostic Data Viewer (DDV)](diagnostic-data-viewer-overview.md) to see what Windows diagnostic data is collected on their local device. This app lets a user review the diagnostic data collected on his device that is being sent to Microsoft. The DDV groups the information into simple categories based on how it is used by Microsoft.
-
-A user can turn on Windows diagnostic data viewing by going to go to *Start > Settings > Privacy > Diagnostics & feedback*. Under the ‘Diagnostic data viewer’ section, the user has to enable the ‘If data viewing is enabled, you can see your diagnostics data’ option. After DDV is installed on the device, the user can start it by clicking the ‘Diagnostic Data Viewer’ in the ‘Diagnostic data viewer’ section of *Start > Settings > Privacy > Diagnostics & feedback*.
-
-Also, the user can delete all Windows diagnostic data collected from the device. This is done by clicking the ‘Delete’ button in the ‘Delete diagnostic data’ section of *Start > Settings > Privacy > Diagnostics & feedback*.
-
-### Windows 10 personal data services configuration
-
-Microsoft assembled a list of Windows 10 services configuration settings that are useful for personal data privacy protection and related regulations, such as the General Data Protection Regulation (GDPR). There is one section with settings for service data that is managed at Microsoft and a section for local data that is managed by an IT organization.
-
-IT Professionals that are interested in this configuration, see [Windows 10 personal data services configuration](windows-personal-data-services-configuration.md).
-
-### Windows 10 connections to Microsoft
-
-To find out more about the network connections that Windows components make to Microsoft as well as the privacy settings that affect data shared with either Microsoft or apps, see [Manage connections from Windows operating system components to Microsoft services](https://docs.microsoft.com/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services). This article describe how these settings can be managed by an IT Professional, and fronts an array of Windows version-specific articles.
-
-### At-a-glance: the relationship between an IT organization and the GDPR
-
-Because Microsoft is a controller for data collected by Windows 10, the user can work with Microsoft to satisfy GDPR requirements. While this relationship between Microsoft and a user is evident in a consumer scenario, an IT organization can influence that relationship in an enterprise scenario. For example, the IT organization has the ability to centrally configure the Windows diagnostic data level by using Group Policy or MDM settings.
-
-## Windows Server
-
-Windows Server follows the same mechanisms as Windows 10 for handling of personal data – for example, when collecting Windows diagnostic data.
-
-More detailed information about Windows Server and the GDPR is available at Beginning your General Data Protection Regulation (GDPR) journey for Windows Server.
-
-### Windows diagnostic data and Windows Server
-
-The lowest diagnostic data setting level supported on Windows Server 2016 and Windows Server 2019 through management policies is “Security”. The lowest diagnostic data setting supported through the Settings UI is “Basic”. The default diagnostic data level for all Windows Server 2016 and Windows Server 2019 editions is “Enhanced”.
-
-IT administrators can configure the Windows Server diagnostic data settings using familiar management tools, such as Group Policy, MDM, or Windows Provisioning. IT administrators can also manually change settings using Registry Editor. Setting the Windows Server diagnostic data levels through a management policy overrides any device-level settings.
-
-There are two options for deleting Windows diagnostic data from a Windows Server machine:
-
-- If the “Desktop Experience” option was chosen during the installation of Windows Server 2019, then there are the same options available for an IT administrator that end users have with Windows 10, version 1803 and version 1809, to submit a request for deleting that device’s diagnostic data. This is done by clicking the **Delete** button in the **Delete diagnostic data** section of **Start > Settings > Privacy > Diagnostics & feedback**.
-- Microsoft has provided a [PowerShell cmdlet](https://docs.microsoft.com/powershell/module/windowsdiagnosticdata) that IT administrators can use to delete Windows diagnostic data via the command line on a machine running Windows Server 2016 or Windows Server 2019. This cmdlet provides the same functionality for deleting Windows diagnostic data as with Desktop Experience on Windows Server 2019. For more information, see [the PowerShell Gallery](https://www.powershellgallery.com/packages/WindowsDiagnosticData).
-
-### Backups and Windows Server
-
-Backups, including live backups and backups that are stored locally within an organization or in the cloud, can contain personal data.
-
-- Backups an organizations creates, for example by using Windows Server Backup (WSB), are under its control. For example, for exporting personal data contained in a backup, the organization needs to restore the appropriate backup sets to facilitate the respective data subject request (DSR).
-- The GDPR also applies when storing backups in the cloud. For example, an organization can use Microsoft Azure Backup to backup files and folders from physical or virtual Windows Server machines (located on-premises or in Azure) to the cloud. The organization that is subscribed to this backup service also has the obligation to restore the data in order to exercise the respective DSR.
-
-## Windows 10 Team Edition, Version 1703 for Surface Hub
-
-Surface Hub is a shared device used within an organization. The device identifier collected as part of diagnostic data is not connected to a user. For removing Windows diagnostic data sent to Microsoft for a Surface Hub, Microsoft created the Surface Hub Delete Diagnostic Data tool available in the Microsoft Store.
-
-> [!NOTE]
-> Additional apps running on the device, that are not delivered as part of the in-box experience of Surface Hub, may implement their own diagnostic data collection and transmission functionality independently to collect and process personal data. Please contact the app publisher for further guidance on how to control this.
-
-An IT administrator can configure privacy- related settings, such as setting the Windows diagnostic data level to Basic. Surface Hub does not support group policy for centralized management; however, IT administrators can use MDM to apply these settings to Surface Hub. For more information about Surface Hub and MDM, please see [Manage settings with an MDM provider](https://docs.microsoft.com/surface-hub/manage-settings-with-mdm-for-surface-hub).
-
-## Further reading
-
-### Optional settings / features that further improve the protection of personal data
-
-Personal data protection is one of the goals of the GDPR. One way of improving personal data protection is to use the modern and advanced security features of Windows 10. An IT organization can learn more at [Mitigate threats by using Windows 10 security features](/windows/security/threat-protection/overview-of-threat-mitigations-in-windows-10) and [Standards for a highly secure Windows 10 device](https://docs.microsoft.com/windows-hardware/design/device-experiences/oem-highly-secure).
-
-> [!NOTE]
-> Some of these features might require a particular Windows hardware, such as a computer with a Trusted Platform Module (TPM) chip, and can depend on a particular Windows product (such as Windows 10 E5).
-
-### Windows Security Baselines
-
-Microsoft has created Windows Security Baselines to efficiently configure Windows 10 and Windows Server. For more information, please visit [Windows Security Baselines](/windows/security/threat-protection/windows-security-baselines).
-
-### Windows Restricted Traffic Limited Functionality Baseline
-
-To make it easier to deploy settings that restrict connections from Windows 10 and Windows Server to Microsoft, IT Professionals can apply the Windows Restricted Traffic Limited Functionality Baseline, available [here](https://go.microsoft.com/fwlink/?linkid=828887).
-
->[!IMPORTANT]
->Some of the settings of the Windows Restricted Traffic Limited Functionality Baseline will reduce the functionality and security configuration of a device in the organization and are therefore not recommended.
-
-### Microsoft Trust Center and Service Trust Portal
-
-Please visit our [GDPR section of the Microsoft Trust Center](https://www.microsoft.com/trustcenter/privacy/gdpr) to obtain additional resources and to learn more about how Microsoft can help you fulfill specific GDPR requirements. There you can find lots of useful information about the GDPR, including how Microsoft is helping customers to successfully master the GDPR, a FAQ list, and a list of [resources for GDPR compliance](https://www.microsoft.com/TrustCenter/Privacy/gdpr/resources). Also, please check out the [Compliance Manager](https://aka.ms/compliancemanager) of the Microsoft [Service Trust Portal (STP)](https://aka.ms/stp) and [Get Started: Support for GDPR Accountability](https://servicetrust.microsoft.com/ViewPage/GDPRGetStarted).
-
-### Additional resources
-
-#### FAQs
-
-* [Windows 10 feedback, diagnostics, and privacy](https://privacy.microsoft.com/windows-10-feedback-diagnostics-and-privacy)
-* [Microsoft Edge and privacy](https://privacy.microsoft.com/windows-10-microsoft-edge-and-privacy)
-* [Windows Hello and privacy](https://privacy.microsoft.com/windows-10-windows-hello-and-privacy)
-* [Wi-Fi Sense](https://privacy.microsoft.com/windows-10-about-wifi-sense)
-
-#### Blogs
-
-* [Privacy and Windows 10](https://blogs.windows.com/windowsexperience/2015/09/28/privacy-and-windows-10)
-
-#### Privacy Statement
-
-* [Microsoft Privacy Statement](https://privacy.microsoft.com/privacystatement)
-
-#### Other resources
-
-* [Privacy at Microsoft](https://privacy.microsoft.com/)
diff --git a/windows/privacy/gdpr-win10-whitepaper.md b/windows/privacy/gdpr-win10-whitepaper.md
deleted file mode 100644
index 71f256d128..0000000000
--- a/windows/privacy/gdpr-win10-whitepaper.md
+++ /dev/null
@@ -1,340 +0,0 @@
----
-title: General Data Protection Regulation (GDPR) for Windows 10
-description: Use this article to understand what GDPR is and which products Microsoft provides to help you get started towards compliance.
-keywords: privacy, GDPR
-ms.prod: w10
-ms.mktglfcycl: manage
-ms.sitesec: library
-ms.pagetype: security
-ms.localizationpriority: high
-audience: ITPro
-author: dansimp
-ms.author: dansimp
-manager: dansimp
-ms.collection: M365-security-compliance
-ms.topic: article
-ms.date: 09/25/2017
-ms.reviewer:
----
-
-# Beginning your General Data Protection Regulation (GDPR) journey for Windows 10
-
-This article provides info about the GDPR, including what it is, and the products Microsoft provides to help you to become compliant.
-
-## Introduction
-On May 25, 2018, a European privacy law is due to take effect that sets a new global bar for privacy rights, security, and compliance.
-
-The General Data Protection Regulation, or GDPR, is fundamentally about protecting and enabling the privacy rights of individuals. The GDPR establishes strict global privacy requirements governing how you manage and protect personal data while respecting individual choice — no matter where data is sent, processed, or stored.
-
-Microsoft and our customers are now on a journey to achieve the privacy goals of the GDPR. At Microsoft, we believe privacy is a fundamental right, and we believe that the GDPR is an important step forward for clarifying and enabling individual privacy rights. But we also recognize that the GDPR will require significant changes by organizations all over the world.
-
-We have outlined our commitment to the GDPR and how we are supporting our customers within the [Get GDPR compliant with the Microsoft Cloud](https://blogs.microsoft.com/on-the-issues/2017/02/15/get-gdpr-compliant-with-the-microsoft-cloud/#hv52B68OZTwhUj2c.99) blog post by our Chief Privacy Officer [Brendon Lynch](https://blogs.microsoft.com/on-the-issues/author/brendonlynch/) and the [Earning your trust with contractual commitments to the General Data Protection Regulation](https://blogs.microsoft.com/on-the-issues/2017/04/17/earning-trust-contractual-commitments-general-data-protection-regulation/#6QbqoGWXCLavGM63.99)” blog post by [Rich Sauer](https://blogs.microsoft.com/on-the-issues/author/rsauer/) - Microsoft Corporate Vice President & Deputy General Counsel.
-
-Although your journey to GDPR-compliance may seem challenging, we're here to help you. For specific information about the GDPR, our commitments and how to begin your journey, please visit the [GDPR section of the Microsoft Trust Center](https://www.microsoft.com/trustcenter/privacy/gdpr).
-
-## GDPR and its implications
-The GDPR is a complex regulation that may require significant changes in how you gather, use and manage personal data. Microsoft has a long history of helping our customers comply with complex regulations, and when it comes to preparing for the GDPR, we are your partner on this journey.
-
-The GDPR imposes rules on organizations that offer goods and services to people in the European Union (EU), or that collect and analyze data tied to EU residents, no matter where those businesses are located. Among the key elements of the GDPR are the following:
-
-- **Enhanced personal privacy rights.** Strengthened data protection for residents of EU by ensuring they have the right to access to their personal data, to correct inaccuracies in that data, to erase that data, to object to processing of their personal data, and to move it.
-
-- **Increased duty for protecting personal data.** Reinforced accountability of organizations that process personal data, providing increased clarity of responsibility in ensuring compliance.
-
-- **Mandatory personal data breach reporting.** Organizations that control personal data are required to report personal data breaches that pose a risk to the rights and freedoms of individuals to their supervisory authorities without undue delay, and, where feasible, no later than 72 hours once they become aware of the breach.
-
-As you might anticipate, the GDPR can have a significant impact on your business, potentially requiring you to update privacy policies, implement and strengthen data protection controls and breach notification procedures, deploy highly transparent policies, and further invest in IT and training. Microsoft Windows 10 can help you effectively and efficiently address some of these requirements.
-
-## Personal and sensitive data
-As part of your effort to comply with the GDPR, you will need to understand how the regulation defines personal and sensitive data and how those definitions relate to data held by your organization.
-
-The GDPR considers personal data to be any information related to an identified or identifiable natural person. That can include both direct identification (such as, your legal name) and indirect identification (such as, specific information that makes it clear it is you the data references). The GDPR also makes clear that the concept of personal data includes online identifiers (such as, IP addresses, mobile device IDs) and location data.
-
-The GDPR introduces specific definitions for genetic data (such as, an individual’s gene sequence) and biometric data. Genetic data and biometric data along with other sub categories of personal data (personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership: data concerning health; or data concerning a person’s sex life or sexual orientation) are treated as sensitive personal data under the GDPR. Sensitive personal data is afforded enhanced protections and generally requires an individual’s explicit consent where these data are to be processed.
-
-### Examples of info relating to an identified or identifiable natural person (data subject)
-This list provides examples of several types of info that will be regulated through GDPR. This is not an exhaustive list.
-
-- Name
-
-- Identification number (such as, SSN)
-
-- Location data (such as, home address)
-
-- Online identifier (such as, e-mail address, screen names, IP address, device IDs)
-
-- Pseudonymous data (such as, using a key to identify individuals)
-
-- Genetic data (such as, biological samples from an individual)
-
-- Biometric data (such as, fingerprints, facial recognition)
-
-## Getting started on the journey towards GDPR compliance
-Given how much is involved to become GDPR-compliant, we strongly recommend that you don't wait to prepare until enforcement begins. You should review your privacy and data management practices now. We recommend that you begin your journey to GDPR compliance by focusing on four key steps:
-
-- **Discover.** Identify what personal data you have and where it resides.
-
-- **Manage.** Govern how personal data is used and accessed.
-
-- **Protect.** Establish security controls to prevent, detect, and respond to vulnerabilities and data breaches.
-
-- **Report.** Act on data requests, report data breaches, and keep required documentation.
-
- 
-
-For each of the steps, we've outlined example tools, resources, and features in various Microsoft solutions, which can be used to help you address the requirements of that step. While this article isn't a comprehensive “how to,” we've included links for you to find out more details, and more information is available in the [GDPR section of the Microsoft Trust Center](https://www.microsoft.com/trustcenter/privacy/gdpr).
-
-## Windows 10 security and privacy
-As you work to comply with the GDPR, understanding the role of your desktop and laptop client machines in creating, accessing, processing, storing and managing data that may qualify as personal and potentially sensitive data under the GDPR is important. Windows 10 provides capabilities that will help you comply with the GDPR requirements to implement appropriate technical and organizational security measures to protect personal data.
-
-With Windows 10, your ability to protect, detect and defend against the types of attacks that can lead to data breaches is greatly improved. Given the stringent requirements around breach notification within the GDPR, ensuring that your desktop and laptop systems are well defended will lower the risks you face that could result in costly breach analysis and notification.
-
-In this section, we'll talk about how Windows 10 provides capabilities that fit squarely in the **Protect** stage of your journey, including these 4 scenarios:
-
-- **Threat protection: Pre-breach threat resistance.** Disrupt the malware and hacking industry by moving the playing field to one where they lose the attack vectors that they depend on.
-
-- **Threat protection: Post-breach detection and response.** Detect, investigate, and respond to advanced threats and data breaches on your networks.
-
-- **Identity protection.** Next generation technology to help protect your user’s identities from abuse.
-
-- **Information protection.** Comprehensive data protection while meeting compliance requirements and maintaining user productivity.
-
-These capabilities, discussed in more detail below with references to specific GDPR requirements, are built on top of advanced device protection that maintains the integrity and security of the operating system and data.
-
-A key provision within the GDPR is data protection by design and by default, and helping with your ability to meet this provision are features within Windows 10 such as the Trusted Platform Module (TPM) technology designed to provide hardware-based, security-related functions. A TPM chip is a secure crypto-processor that is designed to carry out cryptographic operations.
-
-The chip includes multiple physical security mechanisms to make it tamper resistant, and malicious software is unable to tamper with the security functions of the TPM. Some of the key advantages of using TPM technology are that you can:
-
-- Generate, store, and limit the use of cryptographic keys.
-
-- Use TPM technology for platform device authentication by using the TPM’s unique RSA key, which is burned into itself.
-
-- Help to ensure platform integrity by taking and storing security measurements.
-
-Additional advanced device protection relevant to your operating without data breaches include Windows Trusted Boot to help maintain the integrity of the system by ensuring malware is unable to start before system defenses.
-
-### Threat protection: Pre-breach threat resistance
-The GDPR requires you to implement appropriate technical and organizational security measures to protect personal data.
-
-Your ability to meet this requirement to implement appropriate technical security measures should reflect the threats you face in today’s increasingly hostile IT environment. Today’s security threat landscape is one of aggressive and tenacious threats. In previous years, malicious attackers mostly focused on gaining community recognition through their attacks or the thrill of temporarily taking a system offline. Since then, attacker’s motives have shifted toward making money, including holding devices and data hostage until the owner pays the demanded ransom.
-
-Modern attacks increasingly focus on large-scale intellectual property theft; targeted system degradation that can result in financial loss; and now even cyberterrorism that threatens the security of individuals, businesses, and national interests all over the world. These attackers are typically highly trained individuals and security experts, some of whom are in the employ of nation states that have large budgets and seemingly unlimited human resources. Threats like these require an approach that can meet this challenge.
-
-Not only are these threats a risk to your ability to maintain control of any personal or sensitive data you may have, but they are a material risk to your overall business as well. Consider recent data from Ponemon Institute, Verizon, and Microsoft:
-
-- The average cost of the type of data breach the GDPR will expect you to report is $3.5M. (Ponemon Institute).
-
-- 63% of these breaches involve weak or stolen passwords that the GDPR expects you to address. (2016 Data Breach Investigations Report, Verizon Enterprise).
-
-- Over 300,000 new malware samples are created and spread every day making your task to address data protection even more challenging. (Microsoft Malware Protection Center, Microsoft).
-
-As seen with recent ransomware attacks, once called the "black plague" of the Internet, attackers are going after bigger targets that can afford to pay more, with potentially catastrophic consequences. Desktops and laptops, that contain personal and sensitive data, are commonly targeted where control over data might be lost.
-
-In response to these threats and as a part of your mechanisms to resist these types of breaches so that you remain in compliance with the GDPR, Windows 10 provides built in technology, detailed below including the following:
-
-- Microsoft Defender Antivirus to respond to emerging threats on data.
-
-- Microsoft Edge to systemically disrupt phishing, malware, and hacking attacks.
-
-- Windows Defender Device Guard to block all unwanted applications on client machines.
-
-#### Responding to emerging data threats
-Microsoft Defender Antivirus is a built-in antimalware solution that provides security and antimalware management for desktops, portable computers, and servers. In Windows 10, it uses a multi-pronged approach to improve antimalware:
-
-- **Cloud-delivered protection.** Helps to detect and block new malware within seconds, even if the malware has never been seen before.
-
-- **Rich local context.** Improves how malware is identified. Windows 10 informs Microsoft Defender Antivirus not only about content like files and processes, but also where the content came from, where it's been stored, and more.
-
-- **Extensive global sensors.** Help to keep Microsoft Defender Antivirus current and aware of even the newest malware. This is accomplished in two ways: by collecting the rich local context data from end points and by centrally analyzing that data.
-
-- **Tamper proofing.** Helps to guard Microsoft Defender Antivirus itself against malware attacks. For example, Microsoft Defender Antivirus uses Protected Processes, which prevents untrusted processes from attempting to tamper with Microsoft Defender Antivirus components, its registry keys, and so on.
-
-- **Enterprise-level features.** Give IT pros the tools and configuration options necessary to make Microsoft Defender Antivirus an enterprise-class antimalware solution.
-
-#### Systemically disrupting phishing, malware, and hacking attacks
-In today’s threat landscape, your ability to provide those mechanisms should be tied to the specific data-focused attacks you face through phishing, malware and hacking due to the browser-related attacks.
-
-As part of Windows 10, Microsoft has brought you Microsoft Edge, our safest and most secure browser to-date. Over the past two years, we have been continuously innovating, and we’re proud of the progress we’ve made. This quality of engineering is reflected by the reduction of Common Vulnerabilities and Exposures (CVE) when comparing Microsoft Edge with Internet Explorer over the past year. Browser-related attacks on personal and sensitive data that you will need to protect under the GDPR means this innovation in Windows 10 is important.
-
-While no modern browser — or any complex application — is free of vulnerabilities, many of the vulnerabilities for Microsoft Edge have been responsibly reported by professional security researchers who work with the Microsoft Security Response Center (MSRC) and the Microsoft Edge team to ensure customers are protected well before any attacker might use these vulnerabilities in the wild. Even better, there is no evidence that any vulnerabilities have been exploited in the wild as zero-day attacks.
-
-
-
-However, many businesses worldwide have come under increasing threat of targeted attacks, where attackers are crafting specialized attacks against a specific business, attempting to take control of corporate networks and data.
-
-#### Blocking all unwanted apps
-Application Control is your best defense in a world where there are more than 300,000 new malware samples each day. As part of Windows 10, Windows Defender Device Guard is a combination of enterprise-related hardware and software security features that, when configured together, will lock a device down so that it can only run trusted applications that you define in your code integrity policies. If the app isn’t trusted it can’t run, period.
-
-With hardware that meets basic requirements, it also means that even if an attacker manages to get control of the Windows kernel, he or she will be much less likely to be able to run malicious executable code. With appropriate hardware, Windows Defender Device Guard can use the new virtualization-based security in Windows 10 to isolate the Code Integrity service from the Microsoft Windows kernel itself. In this case, the Code Integrity service runs alongside the kernel in a Windows hypervisor-protected container.
-
-Windows Defender Device Guard protects threats that can expose personal or sensitive data to attack, including:
-
-- Exposure to new malware, for which the "signature" is not yet known
-
-- Exposure to unsigned code (most malware is unsigned)
-
-- Malware that gains access to the kernel and then, from within the kernel, captures sensitive information or damages the system
-
-- DMA-based attacks, for example, attacks launched from a malicious device that read secrets from memory, making the enterprise more vulnerable to attack; and
-
-- Exposure to boot kits or to a physically present attacker at boot time.
-
-### Threat protection: Post-breach detection and response
-The GDPR includes explicit requirements for breach notification where a personal data breach means, “a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, personal data transmitted, stored or otherwise processed.”
-
-As noted in the Windows Security Center white paper, [Post Breach: Dealing with Advanced Threats](http://wincom.blob.core.windows.net/documents/Post_Breach_Dealing_with_Advanced_Threats_Whitepaper.pdf), “_Unlike pre-breach, post-breach assumes a breach has already occurred – acting as a flight recorder and Crime Scene Investigator (CSI). Post-breach provides security teams the information and toolset needed to identify, investigate, and respond to attacks that otherwise will stay undetected and below the radar._”
-
-#### Insightful security diagnostic data
-For nearly two decades, Microsoft has been turning threats into useful intelligence that can help fortify our platform and protect customers. Today, with the immense computing advantages afforded by the cloud, we are finding new ways to use our rich analytics engines driven by threat intelligence to protect our customers.
-
-By applying a combination of automated and manual processes, machine learning and human experts, we can create an Intelligent Security Graph that learns from itself and evolves in real-time, reducing our collective time to detect and respond to new incidents across our products.
-
-
-
-The scope of Microsoft’s threat intelligence spans, literally, billions of data points: 35 billion messages scanned monthly, 1 billion customers across enterprise and consumer segments accessing 200+ cloud services, and 14 billion authentications performed daily. All this data is pulled together on your behalf by Microsoft to create the Intelligent Security Graph that can help you protect your front door dynamically to stay secure, remain productive, and meet the requirements of the GDPR.
-
-#### Detecting attacks and forensic investigation
-Even the best endpoint defenses may be breached eventually, as cyberattacks become more sophisticated and targeted.
-
-Windows Defender Advanced Threat Protection (ATP) helps you detect, investigate, and respond to advanced attacks and data breaches on your networks. GDPR expects you to protect against attacks and breaches through technical security measures to ensure the ongoing confidentiality, integrity, and availability of personal data.
-
-Among the key benefits of ATP are the following:
-
-- Detecting the undetectable - sensors built deep into the operating system kernel, Windows security experts, and unique optics from over 1 billion machines and signals across all Microsoft services.
-
-- Built in, not bolted on - agentless with high performance and low impact, cloud-powered; easy management with no deployment.
-
-- Single pane of glass for Windows security - explore 6 months of rich machine timeline that unifies security events from Windows Defender ATP, Microsoft Defender Antivirus.
-
-- Power of the Microsoft graph - leverages the Microsoft Intelligence Security Graph to integrate detection and exploration with Office 365 ATP subscription, to track back and respond to attacks.
-
-Read more at [What’s new in the Windows Defender ATP Creators Update preview](https://blogs.microsoft.com/microsoftsecure/2017/03/13/whats-new-in-the-windows-defender-atp-creators-update-preview/).
-
-To provide Detection capabilities, Windows 10 improves our OS memory and kernel sensors to enable detection of attackers who are employing in-memory and kernel-level attacks – shining a light into previously dark spaces where attackers hid from conventional detection tools. We’ve already successfully leveraged this new technology against zero-days attacks on Windows.
-
-
-
-We continue to upgrade our detections of ransomware and other advanced attacks, applying our behavioral and machine-learning detection library to counter changing attacks trends. Our historical detection capability ensures new detection rules apply to up to six months of stored data to detect attacks that previously went unnoticed. Customers can also add customized detection rules or IOCs to augment the detection dictionary.
-
-Customers asked us for a single pane of glass across the entire Windows security stack. Microsoft Defender Antivirus detections and Windows Defender Device Guard blocks are the first to surface in the Windows Defender ATP portal interleaved with Windows Defender ATP detections. The new user entity adds identity as a pivot, providing insight into actions, relationships, and alerts that span machines and allow us to track attackers moving laterally across the network.
-
-Our alert page now includes a new process tree visualization that aggregates multiple detections and related events into a single view that helps security teams reduce the time to resolve cases by providing the information required to understand and resolve incidents without leaving the alert page.
-
-Security Operations (SecOps) can hunt for evidence of attacks, such as file names or hashes, IP addresses or URLs, behaviors, machines, or users. They can do this immediately by searching the organization’s cloud inventory, across all machines – and going back up to 6 months in time – even if machines are offline, have been reimaged, or no longer exist.
-
-
-
-When detecting an attack, security teams can now take immediate action: isolate machines, ban files from the network, kill or quarantine running processes or files, or retrieve an investigation package from a machine to provide forensic evidence – with a click of a button. Because while detecting advanced attacks is important – shutting them down is even more so.
-
-
-
-### Identity Protection
-Identify and access management is another area where the GDPR has placed special emphasis by calling for mechanisms to grant and restrict access to data subject personal data (for example, role-based access, segregation of duties).
-
-#### Multi-factor protection
-Biometric authentication – using your face, iris, or fingerprint to unlock your devices – is much safer than traditional passwords. You– uniquely you– plus your device are the keys to your apps, data, and even websites and services – not a random assortment of letters and numbers that are easily forgotten, hacked, or written down and pinned to a bulletin board.
-
-Your ability to protect personal and sensitive data, that may be stored or accessed through desktop or laptops will be further enhanced by adopting advanced authentication capabilities such as Windows Hello for Business and Windows Hello companion devices. Windows Hello for Business, part of Windows 10, gives users a personal, secured experience where the device is authenticated based on their presence. Users can log in with a look or a touch, with no need for a password.
-
-In conjunction with Windows Hello for Business, biometric authentication uses fingerprints or facial recognition and is more secure, more personal, and more convenient. If an application supports Hello, Windows 10 enables you to authenticate applications, enterprise content, and even certain online experiences without a password being stored on your device or in a network server at all.
-Windows Hello for Business works with the Companion Device Framework to enhance the user authentication experience. Using the Windows Hello Companion Device Framework, a companion device can provide a rich experience for Windows Hello even when biometrics are not available (for example, if the Windows 10 desktop lacks a camera for face authentication or fingerprint reader device).
-
-There are numerous ways one can use the Windows Hello Companion Device Framework to build a great Windows unlock experience with a companion device. For example, users can:
-
-- Work offline (for example, while traveling on a plane)
-
-- Attach their companion device to PC via USB, touch the button on the companion device, and automatically unlock their PC.
-
-- Carry a phone in their pocket that is already paired with their PC over Bluetooth. Upon hitting the spacebar on their PC, their phone receives a notification. Approve it and the PC simply unlocks.
-
-- Tap their companion device to an NFC reader to quickly unlock their PC.
-
-- Wear a fitness band that has already authenticated the wearer. Upon approaching PC, and by performing a special gesture (like clapping), the PC unlocks.
-
-#### Protection against attacks by isolating user credentials
-As noted in the [Windows 10 Credential Theft Mitigation Guide](https://www.microsoft.com/download/confirmation.aspx?id=54095), “_the tools and techniques criminals use to carry out credential theft and reuse attacks improve, malicious attackers are finding it easier to achieve their goals. Credential theft often relies on operational practices or user credential exposure, so effective mitigations require a holistic approach that addresses people, processes, and technology. In addition, these attacks rely on the attacker stealing credentials after compromising a system to expand or persist access, so organizations must contain breaches rapidly by implementing strategies that prevent attackers from moving freely and undetected in a compromised network._”
-
-An important design consideration for Windows 10 was mitigating credential theft — in particular, derived credentials. Windows Defender Credential Guard provides significantly improved security against derived credential theft and reuse by implementing a significant architectural change in Windows designed to help eliminate hardware-based isolation attacks rather than simply trying to defend against them.
-
-When Credential Manager domain credentials, NTLM, and Kerberos derived credentials are protected using virtualization-based security, the credential theft attack techniques and tools used in many targeted attacks are blocked. Malware running in the operating system with administrative privileges can't extract secrets that are protected by virtualization-based security. While Windows Defender Credential Guard is a powerful mitigation, persistent threat attacks will likely shift to new attack techniques and you should also incorporate Windows Defender Device Guard, as described above, and other security strategies and architectures.
-
-### Information Protection
-The GDPR is focused on information protection regarding data that is considered as personal or sensitive in relation to a natural person, or data subject. Device protection, protection against threats, and identity protection are all important elements of a Defense in Depth strategy surrounding a layer of information protection in your laptop and desktop systems.
-
-As to the protection of data, the GDPR recognizes that in assessing data security risk, consideration should be given to the risks that are presented such as accidental loss, unauthorized disclosure of, or access to, personal data transmitted, stored or otherwise processed. It also recommends that measures taken to maintain an appropriate level of security should consider the state-of-the-art and the costs of implementation in relation to the risks among other factors.
-
-Windows 10 provides built in risk mitigation capabilities for today’s threat landscape. In this section, we will look at the types of technologies that will help your journey toward GDPR compliance and at the same time provide you with solid overall data protection as part of a comprehensive information protection strategy.
-
-
-
-#### Encryption for lost or stolen devices
-The GDPR calls for mechanisms that implement appropriate technical security measures to confirm the ongoing confidentiality, integrity, and availability of both personal data and processing systems. BitLocker Encryption, first introduced as part of Microsoft's Next-Generation Secure Computing Base architecture in 2004 and made available with Windows Vista, is a built-in data protection feature that integrates with the operating system and addresses the threats of data theft or exposure from lost, stolen, or inappropriately decommissioned computers.
-
-BitLocker provides the most protection when used with a Trusted Platform Module (TPM) version 1.2 or later. The TPM is a hardware component installed in many newer computers by the computer manufacturers. It works with BitLocker to protect user data and to ensure that a computer has not been tampered with while the system was offline.
-
-Data on a lost or stolen computer is vulnerable to unauthorized access, either by running a software-attack tool against it or by transferring the computer's hard disk to a different computer. BitLocker helps mitigate unauthorized data access by enhancing file and system protections. BitLocker also helps render data inaccessible when BitLocker-protected computers are decommissioned or recycled.
-
-Related to BitLocker are Encrypted Hard Drives, a new class of hard drives that are self-encrypting at a hardware level and allow for full disk hardware encryption. Encrypted Hard Drives use the rapid encryption that is provided by BitLocker Drive Encryption to enhance data security and management.
-
-By offloading the cryptographic operations to hardware, Encrypted Hard Drives increase BitLocker performance and reduce CPU usage and power consumption. Because Encrypted Hard Drives encrypt data quickly, enterprise devices can expand BitLocker deployment with minimal impact on productivity.
-
-Some of the benefits of Encrypted Hard Drives include:
-
-- **Better performance.** Encryption hardware, integrated into the drive controller, allows the drive to operate at full data rate with no performance degradation.
-
-- **Strong security based in hardware.** Encryption is always "on" and the keys for encryption never leave the hard drive. User authentication is performed by the drive before it will unlock, independently of the operating system
-
-- **Ease of use.** Encryption is transparent to the user because it is on by default. There is no user interaction needed to enable encryption. Encrypted Hard Drives are easily erased using on-board encryption key; there is no need to re-encrypt data on the drive.
-
-- **Lower cost of ownership.** There is no need for new infrastructure to manage encryption keys, since BitLocker leverages your Active Directory Domain Services infrastructure to store recovery information. Your device operates more efficiently because processor cycles don't need to be used for the encryption process.
-
-#### Preventing accidental data leaks to unauthorized users
-Part of the reality of your operating in a mobile-first, cloud-first world is the notion that some laptops will have multiple purposes – both business and personal. Yet that data that is considered as personal and sensitive regarding EU residents considered as “data subjects” must be protected in line with the requirements of the GDPR.
-
-Windows Information Protection helps people separate their work and personal data and keeps data encrypted wherever it’s stored. Your employees can safely use both work and personal data on the same device without switching applications. Windows Information Protection helps end users avoid inadvertent data leaks by sending a warning when copy/pasting information in non-corporate applications – end users can still proceed but the action will be logged centrally.
-
-For example, employees can’t send protected work files from a personal email account instead of their work account. They also can’t accidently post personal or sensitive data from a corporate site into a tweet. Windows Information Protection also helps ensure that they aren’t saving personal or sensitive data in a public cloud storage location.
-
-#### Capabilities to classify, assign permissions and share data
-Windows Information Protection is designed to coexist with advanced data loss prevention (DLP) capabilities found in Microsoft 365 Apps for enterprise, Azure Information Protection, and Azure Rights Management. Advanced DLP prevents printing, for example, or protects work data that is emailed outside your company.
-
-To continuously protect your data, regardless of where it is stored, with whom it is shared, or if the device is running iOS, Android or Windows, the classification and protection needs to be built into the file itself, so this protection can travel with the data wherever it goes. Microsoft Azure Information Protection (AIP) is designed to provide this persistent data protection both on-premises and in the cloud.
-
-Data classification is an important part of any data governance plan. Adopting a classification scheme that applies throughout your business can be particularly helpful in responding to what the GDPR calls data subject (for example, your EU employee or customer) requests, because it enables enterprises to identify more readily and process personal data requests.
-
-Azure Information Protection can be used to help you classify and label your data at the time of creation or modification. Protection in the form of encryption, which the GDPR recognizes may be appropriate at times, or visual markings can then be applied to data needing protection.
-
-With Azure Information Protection, you can either query for data marked with a sensitivity label or intelligently identify sensitive data when a file or email is created or modified. Once identified, you can automatically classify and label the data – all based on the company’s desired policy.
-
-Azure Information Protection also helps your users share sensitive data in a secure manner. In the example below, information about a sensitive acquisition was encrypted and restricted to a group of people who were granted only a limited set of permissions on the information – they could modify the content but could not copy or print it.
-
-
-
-## Related content for associated Windows 10 solutions
-
-- **Windows Hello for Business:** https://www.youtube.com/watch?v=WOvoXQdj-9E and https://docs.microsoft.com/windows/access-protection/hello-for-business/hello-identity-verification
-
-- **Microsoft Defender Antivirus:** https://www.youtube.com/watch?v=P1aNEy09NaI and https://docs.microsoft.com/windows/threat-protection/microsoft-defender-antivirus/microsoft-defender-antivirus-in-windows-10
-
-- **Windows Defender Advanced Threat Protection:** https://www.youtube.com/watch?v=qxeGa3pxIwg and https://docs.microsoft.com/windows/threat-protection/windows-defender-atp/windows-defender-advanced-threat-protection
-
-- **Windows Defender Device Guard:** https://www.youtube.com/watch?v=F-pTkesjkhI and https://docs.microsoft.com/windows/device-security/device-guard/device-guard-deployment-guide
-
-- **Windows Defender Credential Guard:** https://www.youtube.com/watch?v=F-pTkesjkhI and https://docs.microsoft.com/windows/access-protection/credential-guard/credential-guard
-
-- **Windows Information Protection:** https://www.youtube.com/watch?v=wLkQOmK7-Jg and https://docs.microsoft.com/windows/threat-protection/windows-information-protection/protect-enterprise-data-using-wip
-
-- Windows 10 Security Guide: https://technet.microsoft.com/itpro/windows/keep-secure/windows-10-security-guide
-
-## Disclaimer
-This article is a commentary on the GDPR, as Microsoft interprets it, as of the date of publication. We’ve spent a lot of time with GDPR and like to think we’ve been thoughtful about its intent and meaning. But the application of GDPR is highly fact-specific, and not all aspects and interpretations of GDPR are well-settled.
-
-As a result, this article is provided for informational purposes only and should not be relied upon as legal advice or to determine how GDPR might apply to you and your organization. We encourage you to work with a legally-qualified professional to discuss GDPR, how it applies specifically to your organization, and how best to ensure compliance.
-
-MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED, OR STATUTORY, AS TO THE INFORMATION IN THIS ARTICLE. This article is provided “as-is.” Information and views expressed in this article, including URL and other Internet website references, may change without notice.
-
-This article does not provide you with any legal rights to any intellectual property in any Microsoft product. You may copy and use this article for your internal, reference purposes only.
-
-Published September 2017
-Version 1.0
-© 2017 Microsoft. All rights reserved.
diff --git a/windows/privacy/toc.yml b/windows/privacy/toc.yml
index 48721791cf..18e7d05236 100644
--- a/windows/privacy/toc.yml
+++ b/windows/privacy/toc.yml
@@ -1,6 +1,5 @@
- name: Privacy
href: index.yml
- expanded: true
items:
- name: "Windows 10 & Privacy Compliance: A Guide for IT and Compliance Professionals"
href: Windows-10-and-privacy-compliance.md
diff --git a/windows/privacy/windows-personal-data-services-configuration.md b/windows/privacy/windows-personal-data-services-configuration.md
deleted file mode 100644
index 273f2bac8d..0000000000
--- a/windows/privacy/windows-personal-data-services-configuration.md
+++ /dev/null
@@ -1,408 +0,0 @@
----
-title: Windows 10 personal data services configuration
-description: Learn more about Windows 10 configuration settings that are useful for complying with regulations such as the GDPR and protecting users' personal data.
-keywords: privacy, GDPR, windows, IT
-ms.prod: w10
-ms.mktglfcycl: manage
-ms.sitesec: library
-ms.pagetype: security
-ms.localizationpriority: high
-audience: ITPro
-author: dansimp
-ms.author: dansimp
-manager: dansimp
-ms.collection: M365-security-compliance
-ms.topic: article
-ms.date: 05/11/2018
-ms.reviewer:
----
-# Windows 10 personal data services configuration
-
-Applies to:
-- Windows 10, version 1803 and newer
-
-Microsoft assembled a list of Windows 10 services configuration settings that are useful for personal data privacy protection and related regulations, such as the General Data Protection Regulation (GDPR). There is one section with settings for service data that is managed at Microsoft and a section for local data that is managed by an IT organization.
-
-IT Professionals that are interested in applying these settings via group policies can find the configuration for download [here](https://go.microsoft.com/fwlink/?linkid=874149).
-
-## Introduction
-
-Microsoft collects data from or generates it through interactions with users of Windows 10 devices. This information can contain personal data that may be used to provide, support, and improve Windows 10 services.
-
-Many Windows 10 services are controller services. A user can manage data collection settings, for example by opening *Start > Settings > Privacy* or by visiting the [Microsoft Privacy dashboard](https://account.microsoft.com/privacy). While this relationship between Microsoft and a user is evident in a consumer type scenario, an IT organization can influence that relationship. For example, the IT department has the ability to configure the Windows diagnostic data level across their organization by using Group Policy, registry, or Mobile Device Management (MDM) settings.
-
-Below is a collection of settings related to the Windows 10 personal data services configuration that IT Professionals can use as guidance for influencing Windows diagnostic data collection and personal data protection.
-
-## Windows diagnostic data
-
-Windows 10 collects Windows diagnostic data—such as usage data, performance data, inking, typing, and utterance data—and sends it back to Microsoft. That data is used for keeping the operating system secure and up-to-date, to troubleshoot problems, and to make product improvements. For users who have turned on "Tailored experiences", that data can also be used to offer personalized tips, ads, and recommendations to enhance Microsoft products and services for your needs.
-
-The following options for configuring Windows diagnostic data are relevant in this context.
-
-### Diagnostic level
-
-This setting determines the amount of Windows diagnostic data sent to Microsoft.
-
->[!NOTE]
->In Windows 10, version 1709, Microsoft introduced a new feature: “Limit Enhanced diagnostic data to the minimum required by Windows Analytics”. When enabled, this feature limits the operating system diagnostic data events included in the Enhanced level to the smallest set of data required by [Windows Analytics](https://www.microsoft.com/windowsforbusiness/windows-analytics). For more information on the Enhanced level, see [Configure Windows diagnostic data in your organization](configure-windows-diagnostic-data-in-your-organization.md).
-
-#### Group Policy
-
-> [!div class="mx-tableFixed"]
->| | |
->|:-|:-|
->| **Group Policy** | Computer Configuration\Administrative Templates\Windows Components\Data Collection and Preview Builds |
->| **Policy Name** | Allow Telemetry |
->| **Default setting** | 2 - Enhanced |
->| **Recommended** | 2 - Enhanced |
-
-> [!div class="mx-tableFixed"]
->| | |
->|:-|:-|
->| **Group Policy** | User Configuration\Administrative Templates\Windows Components\Data Collection and Preview Builds |
->| **Policy Name** | Allow Telemetry |
->| **Default setting** | 2 - Enhanced |
->| **Recommended** | 2 - Enhanced |
-
->[!NOTE]
->When both the Computer Configuration policy and User Configuration policy are set, the more restrictive policy is used.
-
-#### Registry
-
-> [!div class="mx-tableFixed"]
->| | |
->|:-|:-|
->| **Registry key** | HKLM\Software\Policies\Microsoft\Windows\DataCollection |
->| **Value** | AllowTelemetry |
->| **Type** | REG_DWORD |
->| **Setting** | "00000002" |
-
-> [!div class="mx-tableFixed"]
->| | |
->|:-|:-|
->| **Registry key** | HKCU\Software\Policies\Microsoft\Windows\DataCollection |
->| **Value** | AllowTelemetry |
->| **Type** | REG_DWORD |
->| **Setting** | "00000002" |
-
-#### MDM
-
-> [!div class="mx-tableFixed"]
->| | |
->|:-|:-|
->| **MDM CSP** | System |
->| **Policy** | AllowTelemetry (scope: device and user) |
->| **Default setting** | 2 – Enhanced |
->| **Recommended** | 2 – Allowed |
-
-### Diagnostic opt-in change notifications
-
-This setting determines whether a device shows notifications about Windows diagnostic data levels to people on first logon or when changes occur in the diagnostic configuration.
-
-#### Group Policy
-
-> [!div class="mx-tableFixed"]
->| | |
->|:-|:-|
->| **Group Policy** | Computer Configuration\Administrative Templates\Windows Components\Data Collection and Preview Builds |
->| **Policy Name** | Configure telemetry opt-in change notifications |
->| **Default setting** | Enabled |
->| **Recommended** | Enabled |
-
-#### Registry
-
-> [!div class="mx-tableFixed"]
->| | |
->|:-|:-|
->| **Registry key** | HKLM\Software\Policies\Microsoft\Windows\DataCollection |
->| **Value** | DisableTelemetryOptInChangeNotification |
->| **Type** | REG_DWORD |
->| **Setting** | "00000000" |
-
-#### MDM
-
-> [!div class="mx-tableFixed"]
->| | |
->|:-|:-|
->| **MDM CSP** | System |
->| **Policy** | ConfigureTelemetryOptInChangeNotification |
->| **Default setting** | 0 – Enabled |
->| **Recommended** | 0 – Enabled |
-
-### Configure telemetry opt-in setting user interface
-
-This setting determines whether people can change their own Windows diagnostic data level in *Start > Settings > Privacy > Diagnostics & feedback*.
-
-#### Group Policy
-
-> [!div class="mx-tableFixed"]
->| | |
->|:-|:-|
->| **Group Policy** | Computer Configuration\Administrative Templates\Windows Components\Data Collection and Preview Builds |
->| **Policy Name** | Configure telemetry opt-in setting user interface |
->| **Default setting** | Enabled |
->| **Recommended** | Enabled |
-
-#### Registry
-
-> [!div class="mx-tableFixed"]
->| | |
->|:-|:-|
->| **Registry key** | HKLM\Software\Policies\Microsoft\Windows\DataCollection |
->| **Value** | DisableTelemetryOptInSettingsUx |
->| **Type** | REG_DWORD |
->| **Setting** | "00000001" |
-
-#### MDM
-
-> [!div class="mx-tableFixed"]
->| | |
->|:-|:-|
->| **MDM CSP** | System |
->| **Policy** | ConfigureTelemetryOptInSettingsUx |
->| **Default setting** | 0 – Enabled |
->| **Recommended** | 0 – Enabled |
-
-## Policies affecting personal data protection managed by the Enterprise IT
-
-There are additional settings usually managed by the Enterprise IT that also affect the protection of personal data.
-
-The following options for configuring these policies are relevant in this context.
-
-### BitLocker
-
-The following settings determine whether fixed and removable drives are protected by the BitLocker Drive Encryption.
-
-#### Fixed Data Drives
-
-#### Group Policy
-
-> [!div class="mx-tableFixed"]
->| | |
->|:-|:-|
->| **Group Policy** | Computer Configuration\Administrative Templates\Windows Components\Bitlocker Drive Encryption\Fixed Data Drives |
->| **Policy Name** | Deny write access to fixed drives not protected by BitLocker |
->| **Default setting** | Not configured |
->| **Recommended** | Enabled |
-
-#### Registry
-
-> [!div class="mx-tableFixed"]
->| | |
->|:-|:-|
->| **Registry key** | HKLM\System\CurrentControlSet\Policies\Microsoft\FVE |
->| **Value** | FDVDenyWriteAccess |
->| **Type** | REG_DWORD |
->| **Setting** | "00000001" |
-
-#### MDM
-
-> [!div class="mx-tableFixed"]
->| | |
->|:-|:-|
->| **MDM CSP** | BitLocker |
->| **Policy** | FixedDrivesRequireEncryption |
->| **Default setting** | Disabled |
->| **Recommended** | Enabled (see [instructions](/windows/client-management/mdm/bitlocker-csp#fixeddrivesrequireencryption)) |
-
-#### Removable Data Drives
-
-#### Group Policy
-
-> [!div class="mx-tableFixed"]
->| | |
->|:-|:-|
->| **Group Policy** | Computer Configuration\Administrative Templates\Windows Components\Bitlocker Drive Encryption\Removable Data Drives |
->| **Policy Name** | Deny write access to removable drives not protected by BitLocker |
->| **Default setting** | Not configured |
->| **Recommended** | Enabled |
-
-#### Registry
-
-> [!div class="mx-tableFixed"]
->| | |
->|:-|:-|
->| **Registry key** | HKLM\System\CurrentControlSet\Policies\Microsoft\FVE |
->| **Value** | RDVDenyWriteAccess |
->| **Type** | REG_DWORD |
->| **Setting** | "00000001" |
-
-> [!div class="mx-tableFixed"]
->| | |
->|:-|:-|
->| **Registry key** | HKLM\Software\Policies\Microsoft\FVE |
->| **Value** | RDVDenyCrossOrg |
->| **Type** | REG_DWORD |
->| **Setting** | "00000000" |
-
-#### MDM
-
-> [!div class="mx-tableFixed"]
->| | |
->|:-|:-|
->| **MDM CSP** | BitLocker |
->| **Policy** | RemovableDrivesRequireEncryption |
->| **Default setting** | Disabled |
->| **Recommended** | Enabled (see [instructions](/windows/client-management/mdm/bitlocker-csp#removabledrivesrequireencryption)) |
-
-### Privacy – AdvertisingID
-
-This setting determines if the advertising ID, which preventing apps from using the ID for experiences across apps, is turned off.
-
-#### Group Policy
-
-> [!div class="mx-tableFixed"]
->| | |
->|:-|:-|
->| **Group Policy** | Computer Configuration\Administrative Templates\System\User Profiles |
->| **Policy Name** | Turn off the advertising ID |
->| **Default setting** | Not configured |
->| **Recommended** | Enabled |
-
-#### Registry
-
-> [!div class="mx-tableFixed"]
->| | |
->|:-|:-|
->| **Registry key** | HKLM\Software\Policies\Microsoft\Windows\AdvertisingInfo |
->| **Value** | DisabledByGroupPolicy |
->| **Type** | REG_DWORD |
->| **Setting** | "00000001" |
-
-#### MDM
-
-> [!div class="mx-tableFixed"]
->| | |
->|:-|:-|
->| **MDM CSP** | Privacy |
->| **Policy** | DisableAdvertisingId |
->| **Default setting** | 65535 (default) - Not configured |
->| **Recommended** | 1 – Enabled |
-
-### Edge
-
-These settings whether employees send “Do Not Track” from the Microsoft Edge web browser to websites.
-
->[!NOTE]
->Please see [this Microsoft blog post](https://blogs.microsoft.com/on-the-issues/2015/04/03/an-update-on-microsofts-approach-to-do-not-track/) for more details on why the “Do Not Track” is no longer the default setting.
-
-#### Group Policy
-
-> [!div class="mx-tableFixed"]
->| | |
->|:-|:-|
->| **Group Policy** | Computer Configuration\Administrative Templates\Windows Components\Microsoft Edge |
->| **Policy Name** | Configure Do Not Track |
->| **Default setting** | Disabled |
->| **Recommended** | Disabled |
-
-> [!div class="mx-tableFixed"]
->| | |
->|:-|:-|
->| **Group Policy** | User Configuration\Administrative Templates\Windows Components\Microsoft Edge |
->| **Policy Name** | Configure Do Not Track |
->| **Default setting** | Disabled |
->| **Recommended** | Disabled |
-
-#### Registry
-
-> [!div class="mx-tableFixed"]
->| | |
->|:-|:-|
->| **Registry key** | HKLM\Software\Policies\Microsoft\MicrosoftEdge\Main |
->| **Value** | DoNotTrack |
->| **Type** | REG_DWORD |
->| **Setting** | "00000000" |
-
-> [!div class="mx-tableFixed"]
->| | |
->|:-|:-|
->| **Registry key** | HKCU\Software\Policies\Microsoft\MicrosoftEdge\Main |
->| **Value** | DoNotTrack |
->| **Type** | REG_DWORD |
->| **Setting** | "00000000" |
-
-#### MDM
-
-> [!div class="mx-tableFixed"]
->| | |
->|:-|:-|
->| **MDM CSP** | Browser |
->| **Policy** | AllowDoNotTrack (scope: device + user) |
->| **Default setting** | 0 (default) – Not allowed |
->| **Recommended** | 0 – Not allowed |
-
-### Internet Explorer
-
-These settings whether employees send “Do Not Track” header from the Microsoft Explorer web browser to websites.
-
-#### Group Policy
-
-> [!div class="mx-tableFixed"]
->| | |
->|:-|:-|
->| **Group Policy** | Computer Configuration\Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Advanced Page |
->| **Policy Name** | Always send Do Not Track header |
->| **Default setting** | Disabled |
->| **Recommended** | Disabled |
-
-> [!div class="mx-tableFixed"]
->|||
->|:-|:-|
->| **Group Policy** | User Configuration\Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Advanced Page |
->| **Policy Name** | Always send Do Not Track header |
->| **Default setting** | Disabled |
->| **Recommended** | Disabled |
-
-#### Registry
-
-> [!div class="mx-tableFixed"]
->|||
->|:-|:-|
->| **Registry key** | HKLM\Software\Policies\Microsoft\Internet Explorer\Main |
->| **Value** | DoNotTrack |
->| **Type** | REG_DWORD |
->| **Setting** | "00000000" |
-
-> [!div class="mx-tableFixed"]
->|||
->|:-|:-|
->| **Registry key** | HKCU\Software\Policies\Microsoft\Internet Explorer\Main |
->| **Value** | DoNotTrack |
->| **Type** | REG_DWORD |
->| **Setting** | "00000000" |
-
-#### MDM
-
-> [!div class="mx-tableFixed"]
->|||
->|:-|:-|
->| **MDM CSP** | N/A |
-
-## Additional resources
-
-### FAQs
-
-* [Windows 10 feedback, diagnostics, and privacy](https://privacy.microsoft.com/windows-10-feedback-diagnostics-and-privacy)
-* [Microsoft Edge and privacy](https://privacy.microsoft.com/windows-10-microsoft-edge-and-privacy)
-* [Windows Hello and privacy](https://privacy.microsoft.com/windows-10-windows-hello-and-privacy)
-* [Wi-Fi Sense](https://privacy.microsoft.com/windows-10-about-wifi-sense)
-
-### Blogs
-
-* [Privacy and Windows 10](https://blogs.windows.com/windowsexperience/2015/09/28/privacy-and-windows-10)
-
-### Privacy Statement
-
-* [Microsoft Privacy Statement](https://privacy.microsoft.com/privacystatement)
-
-### Windows Privacy on docs.microsoft.com
-
-* [Manage connections from Windows operating system components to Microsoft services](manage-connections-from-windows-operating-system-components-to-microsoft-services.md)
-* [Manage connections from Windows 10 operating system components to Microsoft services](https://docs.microsoft.com/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services)
-* [Understanding Windows diagnostic data](configure-windows-diagnostic-data-in-your-organization.md#understanding-windows-diagnostic-data)
-* [Configure Windows diagnostic data in your organization](configure-windows-diagnostic-data-in-your-organization.md)
-
-### Other resources
-
-* [Privacy at Microsoft](https://privacy.microsoft.com/)
From 5f3a87ef1d136e86421f2adb955fa03660da7680 Mon Sep 17 00:00:00 2001
From: Dani Halfin
Date: Mon, 8 Jun 2020 19:35:54 -0700
Subject: [PATCH 0025/1414] andddd fixing redirects
---
.openpublishing.redirection.json | Bin 2578320 -> 2577980 bytes
1 file changed, 0 insertions(+), 0 deletions(-)
diff --git a/.openpublishing.redirection.json b/.openpublishing.redirection.json
index 2b4fa84488cb25d793c2476fbe101636fd6422fb..4ae1cb972425fdf9204f8bf89cf24045e5753c6e 100644
GIT binary patch
delta 125
zcmW;AyA6U+7=Y1S#W&(xK}A8pTSDy=#29THhTH|Ct(aLOO2;I`MprD
zTcI)(HR>2NXwsrhhb}!#`dADYGGfexDKq9QuyI(jVvWm&Egn8Q0zxA8rLK;W#DVq5
WQ+-vEK7B*pC;j=S{IZnuMIXK#-zp0L
delta 137
zcmYMpyAHun9Khim>bSHnb-z=so=rT4!O)0!4v)~`H<^UUf9e}ZEKEE^NAV;^qi_9Q
z*F+s}iHcEV$YPO0lczwD5;hKHDpaZAQl~+a7Hv9o>CtDvkP%}hO!1iE6EG*do6klf
hTkmCk2!lteV
Date: Mon, 8 Jun 2020 19:46:22 -0700
Subject: [PATCH 0026/1414] adding a card to index
---
windows/privacy/index.yml | 7 +++++++
1 file changed, 7 insertions(+)
diff --git a/windows/privacy/index.yml b/windows/privacy/index.yml
index 02e0f86fd7..76b4acd568 100644
--- a/windows/privacy/index.yml
+++ b/windows/privacy/index.yml
@@ -51,6 +51,13 @@ productDirectory:
imageSrc: https://docs.microsoft.com/media/common/i_get-started.svg
summary: Get examples of the types of optional diagnostic data collected from Windows
url: windows-diagnostic-data.md
+ # Card
+ - title: Changes to Windows diagnostic data collection
+ imageSrc: https://docs.microsoft.com/media/common/i_get-started.svg
+ summary: See what changes Windows is making to align to the new data collection taxonomy
+ url: windows-diagnostic-data.md
+
+ /media/common/i_build.svg
# conceptualContent section (optional)
# conceptualContent:
From d1edcf53a6dfa9e1bbc791ba058bd34625d8c337 Mon Sep 17 00:00:00 2001
From: Dani Halfin
Date: Mon, 8 Jun 2020 19:49:02 -0700
Subject: [PATCH 0027/1414] and possibly fixing toc for it pro guide
---
windows/privacy/toc.yml | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/windows/privacy/toc.yml b/windows/privacy/toc.yml
index 18e7d05236..24234a9e3b 100644
--- a/windows/privacy/toc.yml
+++ b/windows/privacy/toc.yml
@@ -2,7 +2,7 @@
href: index.yml
items:
- name: "Windows 10 & Privacy Compliance: A Guide for IT and Compliance Professionals"
- href: Windows-10-and-privacy-compliance.md
+ href: windows-10-and-privacy-compliance.md
- name: Configure Windows diagnostic data in your organization
href: configure-windows-diagnostic-data-in-your-organization.md
- name: Changes to Windows diagnostic data collection
From 2589b1c35323ab64bebe82d572ad29b5bd244879 Mon Sep 17 00:00:00 2001
From: Dani Halfin
Date: Mon, 8 Jun 2020 20:04:41 -0700
Subject: [PATCH 0028/1414] fixing index again
---
windows/privacy/index.yml | 6 ++----
1 file changed, 2 insertions(+), 4 deletions(-)
diff --git a/windows/privacy/index.yml b/windows/privacy/index.yml
index 76b4acd568..c80f9f16aa 100644
--- a/windows/privacy/index.yml
+++ b/windows/privacy/index.yml
@@ -53,11 +53,9 @@ productDirectory:
url: windows-diagnostic-data.md
# Card
- title: Changes to Windows diagnostic data collection
- imageSrc: https://docs.microsoft.com/media/common/i_get-started.svg
+ imageSrc: https://docs.microsoft.com/media/common/i_build.svg
summary: See what changes Windows is making to align to the new data collection taxonomy
- url: windows-diagnostic-data.md
-
- /media/common/i_build.svg
+ url: windows-diagnostic-data.md
# conceptualContent section (optional)
# conceptualContent:
From eec276404400549e9d3902ec876aa70750d867e2 Mon Sep 17 00:00:00 2001
From: Brian Lich
Date: Tue, 9 Jun 2020 12:52:18 -0700
Subject: [PATCH 0029/1414] Update toc.yml
---
windows/privacy/toc.yml | 8 +++-----
1 file changed, 3 insertions(+), 5 deletions(-)
diff --git a/windows/privacy/toc.yml b/windows/privacy/toc.yml
index 24234a9e3b..7378b77892 100644
--- a/windows/privacy/toc.yml
+++ b/windows/privacy/toc.yml
@@ -33,10 +33,8 @@
href: windows-diagnostic-data.md
- name: Windows 10, version 1703 optional diagnostic data
href: windows-diagnostic-data-1703.md
- - name: Deprecated diagnostic data levels
- items:
- - name: Windows 10 diagnostic data events and fields collected through the limit enhanced diagnostic data policy
- href: enhanced-diagnostic-data-windows-analytics-events-and-fields.md
+ - name: Windows 10 diagnostic data events and fields collected through the limit enhanced diagnostic data policy
+ href: enhanced-diagnostic-data-windows-analytics-events-and-fields.md
- name: Manage Windows 10 connection endpoints
items:
- name: Manage connections from Windows operating system components to Microsoft services
@@ -62,4 +60,4 @@
- name: Connection endpoints for non-Enterprise editions of Windows 10, version 1803
href: windows-endpoints-1803-non-enterprise-editions.md
- name: Connection endpoints for non-Enterprise editions of Windows 10, version 1709
- href: windows-endpoints-1709-non-enterprise-editions.md
\ No newline at end of file
+ href: windows-endpoints-1709-non-enterprise-editions.md
From 3879b805213ecb837823871baef39017a0b430e8 Mon Sep 17 00:00:00 2001
From: Brian Lich
Date: Tue, 9 Jun 2020 13:23:56 -0700
Subject: [PATCH 0030/1414] Update windows-10-and-privacy-compliance.md
---
windows/privacy/windows-10-and-privacy-compliance.md | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/windows/privacy/windows-10-and-privacy-compliance.md b/windows/privacy/windows-10-and-privacy-compliance.md
index f9bf3793a0..23ab033106 100644
--- a/windows/privacy/windows-10-and-privacy-compliance.md
+++ b/windows/privacy/windows-10-and-privacy-compliance.md
@@ -49,7 +49,7 @@ The following table provides an overview of the Windows 10 privacy settings pres
| Feature/Setting | Description | Supporting Content | Privacy Statement |
| --- | --- | --- | --- |
-| Diagnostic Data | Microsoft uses diagnostic data to keep Windows secure, up to date, troubleshoot problems, and make product improvements. Regardless of what choices you make for diagnostic data collection, the device will be just as secure and will operate normally. This data is collected by Microsoft and stored with one or more unique identifiers that can help us recognize an individual user on an individual device and understand the device's service issues and use patterns.
Diagnostic data is categorized into the following:
- **Required diagnostic data**
Previously known as basic diagnostic data, required diagnostic data includes information about your device, its settings, capabilities, and whether it is performing properly, whether a device is ready for an update, and whether there are factors that may impede the ability to receive updates, such as low battery, limited disk space, or connectivity through a paid network. You can find out what is collected with required diagnostic data [here](https://docs.microsoft.com/windows/privacy/required-windows-diagnostic-data-events-and-fields-2004). - **Optional diagnostic data**
Previously known as full diagnostic data, optional diagnostic data includes more detailed information about your device and its settings, capabilities, and device health. When you choose to send optional diagnostic data, required diagnostic data will always be included. You can find out the types of optional diagnostic data collected [here](https://docs.microsoft.com/windows/privacy/windows-diagnostic-data).
| [Learn more]https://support.microsoft.com/help/4468236/diagnostics-feedback-and-privacy-in-windows-10-microsoft-privacy)
[Configure Windows diagnostic data in your organization](configure-windows-diagnostic-data-in-your-organization.md) | [Privacy Statement](https://privacy.microsoft.com/privacystatement#maindiagnosticsmodule) |
+| Diagnostic Data | Microsoft uses diagnostic data to keep Windows secure, up to date, troubleshoot problems, and make product improvements. Regardless of what choices you make for diagnostic data collection, the device will be just as secure and will operate normally. This data is collected by Microsoft and stored with one or more unique identifiers that can help us recognize an individual user on an individual device and understand the device's service issues and use patterns.
Diagnostic data is categorized into the following:
- **Required diagnostic data**
Previously known as basic diagnostic data, required diagnostic data includes information about your device, its settings, capabilities, and whether it is performing properly, whether a device is ready for an update, and whether there are factors that may impede the ability to receive updates, such as low battery, limited disk space, or connectivity through a paid network. You can find out what is collected with required diagnostic data [here](https://docs.microsoft.com/windows/privacy/required-windows-diagnostic-data-events-and-fields-2004). - **Optional diagnostic data**
Previously known as full diagnostic data, optional diagnostic data includes more detailed information about your device and its settings, capabilities, and device health. When you choose to send optional diagnostic data, required diagnostic data will always be included. You can find out the types of optional diagnostic data collected [here](https://docs.microsoft.com/windows/privacy/windows-diagnostic-data).
| [Learn more](https://support.microsoft.com/help/4468236/diagnostics-feedback-and-privacy-in-windows-10-microsoft-privacy)
[Configure Windows diagnostic data in your organization](configure-windows-diagnostic-data-in-your-organization.md) | [Privacy Statement](https://privacy.microsoft.com/privacystatement#maindiagnosticsmodule) |
| Inking and typing diagnostics | Microsoft collects optional inking and typing diagnostic data to improve the language recognition and suggestion capabilities of apps and services running on Windows. | [Learn more](https://support.microsoft.com/help/4468236/diagnostics-feedback-and-privacy-in-windows-10-microsoft-privacy) | [Privacy Statement](https://privacy.microsoft.com/privacystatement#maindiagnosticsmodule) |
| Speech | Use your voice for dictation and to talk to Cortana and other apps that use Windows cloud-based speech recognition. Microsoft collects voice data to help improve speech services. | [Learn more](https://support.microsoft.com/help/4468250/windows-10-speech-voice-activation-inking-typing-privacy) | [Privacy Statement](https://privacy.microsoft.com/privacystatement#mainspeechinkingtypingmodule) |
| Location | Get location-based experiences like directions and weather. Let Windows and apps request your location and allow Microsoft to use your location data to improve location services. | [Learn more](https://support.microsoft.com/help/4468240/windows-10-location-service-and-privacy) |[Privacy Statement](https://privacy.microsoft.com/privacystatement#mainlocationservicesmotionsensingmodule) |
@@ -207,4 +207,4 @@ An administrator can configure privacy-related settings, such as choosing to onl
* [Manage connections from Windows operating system components to Microsoft services](manage-connections-from-windows-operating-system-components-to-microsoft-services.md)
* [Privacy at Microsoft](https://privacy.microsoft.com/privacy-report)
* [Changes to Windows diagnostic data](changes-to-windows-diagnostic-data-collection.md)
-* [Microsoft Service Trust Portal](https://servicetrust.microsoft.com/)
\ No newline at end of file
+* [Microsoft Service Trust Portal](https://servicetrust.microsoft.com/)
From 27e00fd1bff94153fceac6428247d7c203ad39ef Mon Sep 17 00:00:00 2001
From: Brian Lich
Date: Tue, 9 Jun 2020 13:37:58 -0700
Subject: [PATCH 0031/1414] Update
changes-to-windows-diagnostic-data-collection.md
---
.../privacy/changes-to-windows-diagnostic-data-collection.md | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/windows/privacy/changes-to-windows-diagnostic-data-collection.md b/windows/privacy/changes-to-windows-diagnostic-data-collection.md
index 8ccdc3aa0d..6f0d9b215c 100644
--- a/windows/privacy/changes-to-windows-diagnostic-data-collection.md
+++ b/windows/privacy/changes-to-windows-diagnostic-data-collection.md
@@ -88,4 +88,4 @@ Customers who use services that depend on Windows diagnostic data, such as Micro
The following provides a list of the known changes:
- [Microsoft Managed Desktop](https://aka.ms/mmd-diagnostic-data-level)
-- Desktop Analytics
\ No newline at end of file
+- [Desktop Analytics](https://docs.microsoft.com/mem/configmgr/desktop-analytics/overview)
From ac971dac5e5eabeda47a22fb6c7be5e993e15e10 Mon Sep 17 00:00:00 2001
From: Brian Lich
Date: Tue, 9 Jun 2020 13:51:48 -0700
Subject: [PATCH 0032/1414] Update
changes-to-windows-diagnostic-data-collection.md
---
.../privacy/changes-to-windows-diagnostic-data-collection.md | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/windows/privacy/changes-to-windows-diagnostic-data-collection.md b/windows/privacy/changes-to-windows-diagnostic-data-collection.md
index 6f0d9b215c..078c9a01c0 100644
--- a/windows/privacy/changes-to-windows-diagnostic-data-collection.md
+++ b/windows/privacy/changes-to-windows-diagnostic-data-collection.md
@@ -17,7 +17,7 @@ ms.topic: article
# Changes to Windows diagnostic data collection
-Applies to:
+**Applies to**
- Windows 10, version 1903 and newer
- The next version of Windows Server
From c62604fc5f0b8bc3beb469537d5a4bfa35fa7076 Mon Sep 17 00:00:00 2001
From: Marty Hernandez Avedon
Date: Fri, 12 Jun 2020 15:24:11 -0400
Subject: [PATCH 0033/1414] copy edits, improvements
---
.../md-app-guard-browser-extension.md | 53 +++++++++----------
1 file changed, 25 insertions(+), 28 deletions(-)
diff --git a/windows/security/threat-protection/microsoft-defender-application-guard/md-app-guard-browser-extension.md b/windows/security/threat-protection/microsoft-defender-application-guard/md-app-guard-browser-extension.md
index c4dcc0c416..1c2700fcec 100644
--- a/windows/security/threat-protection/microsoft-defender-application-guard/md-app-guard-browser-extension.md
+++ b/windows/security/threat-protection/microsoft-defender-application-guard/md-app-guard-browser-extension.md
@@ -8,7 +8,7 @@ ms.pagetype: security
ms.localizationpriority: medium
author: martyav
ms.author: v-maave
-ms.date: 03/28/2019
+ms.date: 06/12/2020
ms.reviewer:
manager: dansimp
ms.custom: asr
@@ -16,56 +16,53 @@ ms.custom: asr
# Microsoft Defender Application Guard Extension
-This article applies to:
+**Applies to:**
- Windows 10
Microsoft Defender Application Guard Extension is a web browser extension that protects your device from advanced attacks, by redirecting untrusted websites to an isolated version of the [Microsoft Edge](https://www.microsoft.com/en-us/edge) browser. If an untrusted website turns out to be malicious, it remains within Application Guard's secure container, keeping your device protected.
-## Supported browsers
-
-The Microsoft Defender Application Guard Extension is available for [Chrome](https://chrome.google.com/webstore/detail/application-guard-extensi/mfjnknhkkiafjajicegabkbimfhplplj/) and [Firefox](https://addons.mozilla.org/en-US/firefox/addon/application-guard-extension/). It can be installed individually by the user, or deployed across the enterprise by an administrator.
-
-> [!TIP]
-> This extension broadens Microsoft Defender Application Guard support to browsers *other* than Microsoft Edge.
->
-> It is not necessary to install any extension on Edge to access Application Guard's protective features, since Application Guard offers [native support](https://docs.microsoft.com/deployedge/microsoft-edge-security-windows-defender-application-guard) to that browser.
-
## Prerequisites
-Microsoft Defender Application Guard Extension works with the following editions of Windows 10, version 1803 or later:
+Application Guard (the feature, not the browser extension) must be installed and enabled — either locally, in Standalone mode, or as part of an enterprise environment, in Enterprise-managed mode. Application Guard itself has its own set of [requirements](reqs-md-app-guard.md).
+
+> [!TIP]
+> Application Guard offers [native support](https://docs.microsoft.com/deployedge/microsoft-edge-security-windows-defender-application-guard) to Microsoft Edge, so the extension and companion app are not necessary for users running that browser.
+
+The Microsoft Defender Application Guard Extension works with the following editions of Windows 10, version 1803 or later:
- Windows 10 Professional
- Windows 10 Enterprise
- Windows 10 Education
-Application Guard Extension also requires that the [Application Guard companion app](https://www.microsoft.com/en-gb/p/windows-defender-application-guard-companion/9n8gnlc8z9c8?activetab=pivot:overviewtab) be installed locally. The app enables Application Guard to work with web browsers other than Microsoft Edge.
+The Microsoft Defender Application Guard Extension is available for [Chrome](https://chrome.google.com/webstore/detail/application-guard-extensi/mfjnknhkkiafjajicegabkbimfhplplj/) and [Firefox](https://addons.mozilla.org/en-US/firefox/addon/application-guard-extension/). It can be deployed across the enterprise by an administrator, or downloaded and installed manually by a user on their own device.
+
+The extension also requires that the [Application Guard companion app](https://www.microsoft.com/p/windows-defender-application-guard-companion/9n8gnlc8z9c8?activetab=pivot:overviewtab) be installed locally. The app enables Application Guard to work with web browsers other than Microsoft Edge.
## Known issues
-Issue | Mitigation
--|-
-Extensions cannot automatically turn on for incognito mode (off by default) | Disable Incognito via policy, by setting **IncognitoModeAvailablity** to **1**
-Extensions can be turned off | Use ExtensionSettings policy by setting **Installation_mode** to **force_installed**.
-Chrome does not offer url to extensions on cold start | Don’t let users disable background process via policy, by setting **backgroundModeEnabled** to **1**.
-If the user's network roams or the network isolation policy changes, an untrusted page may load | If a page attempts to load but is no longer trusted, Application Guard will try to redirect the page and invalidate the cache. However, this issue is only partially mitigated on the backend and leaves browsers open to drive-by attacks under certain circumstances.
-
+Issue | Mitigation | Notes
+-|-|-
+Extensions cannot automatically turn on for private browsing or "Incognito" mode | Disable Incognito via policy, by setting **IncognitoModeAvailablity** to **1** | Chrome and Firefox extensions are turned off by default when running those browsers in Incognito mode.
+Extensions can be turned off | Use ExtensionSettings policy by setting **Installation_mode** to **force_installed**. |
+Chrome does not offer url to extensions on cold start | Don’t let users disable background process via policy, by setting **backgroundModeEnabled** to **1**. | The cold start issue is caused by a user abruptly exiting Chrome, via the tray icon or task manager, then re-starting the browser.
+If the user's network roams or the network isolation policy changes, an untrusted page may load | N/A | Although Application Guard will attempt to redirect the untrusted page and invalidate the cache, under certain circumstances, this issue leaves browsers open to drive-by attacks.
## Troubleshooting guide
-
+
Error message | Cause | Actions
-|-|-
-Application Guard undetermined state | The extension was unable to communicate with the companion app during the last information request. | • Install the companion app and reboot • If the companion app is already installed, reboot and see if that resolves the error • If you still see the error after rebooting, uninstall and re-install the companion app • Check for updates in both the Chrome and Microsoft stores
-Launch in WDAG failed with a companion communication error | The extension couldn't talk to the companion app, but was able to at the beginning of the session. This can be caused by the companion app being uninstalled while Chrome was running. | • Make sure the companion app is installed • If the companion app is installed, reboot and see if that resolves the error • If you still see the error after rebooting, uninstall and re-install the companion app • Check for updates in both the Chrome and Microsoft stores
-Process trust response failed with a companion communication error | The extension couldn't talk to the companion app, but was able to at the beginning of the session. This can be caused by the companion app being uninstalled while Chrome was running.| • Make sure the companion app is installed. • If the companion app is installed, reboot and see if that resolves the error • If you still see the error after rebooting, uninstall and re-install the companion app • Check for updates in both the Chrome and Microsoft stores
+Application Guard undetermined state | The extension was unable to communicate with the companion app during the last information request. | • Install the [companion app](https://www.microsoft.com/p/windows-defender-application-guard-companion/9n8gnlc8z9c8?activetab=pivot:overviewtab) and reboot • If the companion app is already installed, reboot and see if that resolves the error • If you still see the error after rebooting, uninstall and re-install the companion app • Check for updates in both the Microsoft store and the respective web store for the affected browser (Chrome or Firefox)
ExceptionThrown | An unexpected exception was thrown. | • File a bug • Retry the operation
-Unexpected response while processing trusted state | The extension was able to communicate with the companion app, but the API failed and a failure response code was sent back to the extension. | • File a bug • Check if Edge is working • Retry the operation
+Failed to determine if Application Guard is enabled | The extension was able to communicate with the companion app, but the information request failed in the app. | • Restart the browser • Check for updates in both the Microsoft store and the respective web store for the affected browser (Chrome or Firefox)
+Launch in WDAG failed with a companion communication error | The extension couldn't talk to the companion app, but was able to at the beginning of the session. This can be caused by the companion app being uninstalled while Chrome was running. | • Make sure the companion app is installed • If the companion app is installed, reboot and see if that resolves the error • If you still see the error after rebooting, uninstall and re-install the companion app • Check for updates in both the Microsoft store and the respective web store for the affected browser (Chrome or Firefox)
Main page navigation caught an unexpected error | An unexpected exception was thrown during the main page navigation. | • File a bug • Retry the operation
-Protocol out of sync | The extension and native app cannot communicate with each other. This is likely caused by one being updated without supporting the protocol of the other. | Check for updates in both the Chrome and Microsoft stores
-Failed to determine if Application Guard is enabled | The extension was able to communicate with the companion app, but the information request failed in the app. | • Restart Chrome • Check for updates in both the Chrome and Microsoft stores
-Security patch level does not match | Microsoft determined that there was a security issue with either the extension or the companion app, and has issued a mandatory update. | Check for updates in both the Chrome and Microsoft stores
+Process trust response failed with a companion communication error | The extension couldn't talk to the companion app, but was able to at the beginning of the session. This can be caused by the companion app being uninstalled while Chrome was running.| • Make sure the companion app is installed. • If the companion app is installed, reboot and see if that resolves the error • If you still see the error after rebooting, uninstall and re-install the companion app • Check for updates in both the Microsoft store and the respective web store for the affected browser (Chrome or Firefox)
+Protocol out of sync | The extension and native app cannot communicate with each other. This is likely caused by one being updated without supporting the protocol of the other. | Check for updates in both the Microsoft store and the respective web store for the affected browser (Chrome or Firefox)
+Security patch level does not match | Microsoft determined that there was a security issue with either the extension or the companion app, and has issued a mandatory update. | Check for updates in both the Microsoft store and the respective web store for the affected browser (Chrome or Firefox)
+Unexpected response while processing trusted state | The extension was able to communicate with the companion app, but the API failed and a failure response code was sent back to the extension. | • File a bug • Check if Edge is working • Retry the operation
## Related articles
From ef1ceba5f831fdd19190d22a6fc74b4db1b19a51 Mon Sep 17 00:00:00 2001
From: Marty Hernandez Avedon
Date: Fri, 12 Jun 2020 17:30:31 -0400
Subject: [PATCH 0034/1414] copy edits, testing scenarios, screenshots
---
...guard-chrome-extension-evaluation-page.png | Bin 0 -> 69414 bytes
...-guard-chrome-extension-launchIng-edge.png | Bin 0 -> 116788 bytes
.../md-app-guard-browser-extension.md | 10 +-
.../test-scenarios-md-app-guard.md | 90 +++++++++++-------
4 files changed, 59 insertions(+), 41 deletions(-)
create mode 100644 windows/security/threat-protection/microsoft-defender-application-guard/images/app-guard-chrome-extension-evaluation-page.png
create mode 100644 windows/security/threat-protection/microsoft-defender-application-guard/images/app-guard-chrome-extension-launchIng-edge.png
diff --git a/windows/security/threat-protection/microsoft-defender-application-guard/images/app-guard-chrome-extension-evaluation-page.png b/windows/security/threat-protection/microsoft-defender-application-guard/images/app-guard-chrome-extension-evaluation-page.png
new file mode 100644
index 0000000000000000000000000000000000000000..4ad77f8a0641b1d454a94e364b7a10f81aca1d6b
GIT binary patch
literal 69414
zcmX6^19V(n*G?KI)7Wm4#&%<;F&o>O*tXT!W@FoGY}>YzN%GJ8{WELUopsK+NB7)~
z=h-`4K~CZ;B0eGn1jJX#U!qD75Ku4>5MR{bVZkMRD$mT|3$&S#tPli5Z7dSV09*+{
zYV=D<76QV90s_J>2m<02T;z8Q0pZL90dcAi0l}RL0fA$e*`~+~u7EX^mJo&b{O_CF
zS&{%QL9qL!;RpeN-2dMXa@e-i7+eVFBq=Kfw~O=@oq)q?eEJ#OBZQ==kc!*t`G%{P
z_Ta+x&DMIIj!qptPAg99u8q;0@Nrz+Ejc;#EEIx2^sVrz@~j9V0;;AtLL92*F%h7N
zd8p;dM!HFRq3FW%D(fkBBk2bYQxo7DzaD?zRge=&DPsU2+>zTcuKPUs!nb^vbtuEW(k+Q6$ulAT*^i(jR4XCqsnSV)NJ
zm<$u3uSJn;B5CH28tQp7lODAfC&weYhmaXX*6R-*{sxi>5GY6*wit>GNK_(E7(rnp
zt)W92tNT?lM+7No#-D>ygjuF?T6%`LxC6w*g-uMxR6<3T6cZ04+kaX?4ag5*ik7Ve
z_xLmCzqLQr<`W@HsCRi$<9Ht?JimXOYwGCqL$amE$D?n$IewclzxTdkw$n)==JRlP
z(s8|>SC+Rs((xUL%R0ZGUp*D
z(1Z!u=h%)F6$7dlifdc3=Ge%|tEwm9DB|m*vB0t}>|KfF%vk1iV}FyxjGN`xw%@
ze5I9*j!rFhcglIW42CQE0fUYTZx6r}6%G;+(!M%oc{)Fw73JU6hm;~p)BO_+g
zB)`>l_1f0y`RGMTf2|_|b=`69w>KFWlceO9osy+~1jQgdY|kW{Kw#SyP22V2?DH^|
z!|ZXdPVBk=?Xu&|7C^{WN>+4i-sz~|M}dj>4~=1f`R7W#@2fRI_ml*0_5f2MB4ZHh
zZa)F4F$$e`Hk@&F>>V<3Cg5xMy4M`Z%Y^NxASvo`^87c5vuR~!
z6W7EC;(}Nw?r7i|(FV~A{4^6ldugz)A_fvYO{RFP2l-pfZ~`Asq@Yi(eHFriPIZTb
z=RtBEcoSzjd8hi1p6;qCbKI7e7J*xHGhaS>MVWFNC1|p~XUVy`kFv?mo{V>k5eZqz
zDk`FJzMsHmd+gfVwA@TZ;VMovcRS;$>DuEpZ`gAdTewKmB%7>txmE;pEa@aw?;n+j
zo)Wh1e`fneLqiJ_wnv63Nog8@PfN$uQ|?5DB}#eMv(S3MElC-lEE8@%>2Zng=f^YX
z?X)l%VPaxXJ=xhfX~%|c%#N#Xg7f1KC9!W5!KW8Nfkf=LKfkVr2|mZ2Kd&qqK3~;Z
z_NqKb%m@f4hVU~ufPKfsS@ALyKi|&lHR?^j>bW
z42>qyzU)&9j2up6{M?ITh1m4QY}>Rgm8hDXJMoY4wR$HG4JN$S9j=NmZXB9>y)Ma~
z$DcZjF<@vTC~iM5c9@l@twz>pazMM(CQdd%Lkw=KJoryUxiNb2Z?%7T**%S%cd}q2
z)*9b@ACgb)8MrCHBi9
zYTNF_XG_&3fB!}R*P3PuBvA5asHCWc^H3ii9`4VUV(GP-n5>tXnygp){{122(PR(i
zBBs5OqQ=iyGqzsEl?Y}klMgHzMWdW`}*verm~
zs6RB8D_c$K1T|k_(b^pTpa0N-WnrZU*914FtdoS
zRxK+>ke9-k&r(vZYh(5P4GY+RBk8;@2i_qTer0;lmD#vqOTmaoo
zbhZLrP|Wd`R^py|uMl*~`dw^Q7j~R?Nlt$9>483=&Si*j
z9nM6&x-Rd#vNJYZAL@NZq2#+{Xo0+-htHj)=E0ihce=Yc>2Rk|IqZrlu
zZPYqf+gl>88TCc|V^)h4{HC3|`aZtBM-gylC&=+9rBP-%^h`yiQ8F8fvS%Opkgk;`eov5_D_8pg
z1&2)jC(KoHWNPXj6EPHz-O{O9M%vQ(sBWSO==gTg?5d*hxYcraXo`r06fRznn38e_
z9?O`skK0W?2v&vZm*i(H$Vl$%k+%VaTf0WR1AR3o@_t36A1S$Og=v4H@(IDEe0TZf
zi0Xc#zX|cJ4s+#s6J8p0ZE99|SowQ#(75bOogRu*iO%AmR_E=Qf1hjLHZ^-qx;xWi
zk>LaCvxa>iw7QX)wrA%)*r>(`;QblNCq_R@Z8J-p(lzQs4jN78i$5=6J>L^oJ@dEBBX`WRFhy
zJhEC^Sy@y++O{qnG#WqpXr9t!l$+xv6BNXv1X
z?d>03BsUi^bZew)XM!_TdXtmeg>xyt+uif!2LII|am(gKG*<7_a6W78&cq*Ms!B`Q
zIy#IA5i_fq-#2Uge~fV`ZN*Qj?k5EtUR3CGMzC9P{$V0p7I*RVDi*n$jHc6Qi#o`_
zA2IjCq~|eg;IuWk7|J5QTdU?{@?X|YejpkZ!|_TJW31{OQN5BB$0*FmZ(v)fu|7dO
z)qHX$BiC|`o3?PN(C)2sZk%s6L19Nhnqy+Nvshb@8XXJe1X}B~#vjmfC^T~-43w_4
zg!~vwuJ?LynWef$KVNUiPVa12?=s+-xFNr3;xI&jQ^0Mgx8J~5tWm-cy2R9M=0|<4W*xn2@t%4MCh>L2O8l7-Wn%YtM}43
zZ_2Tx6?WzMZ*AF;g&W7uTq#>-Ze3C00?+}lj~1yt-?&C`DJw(UG+YxOevwHoOPAFA+Eh
zA+XuD(tE?_T(=V$W-HR^DuqoHbDt8rm)#sgJOaD|Eh*F;IC9e35{Y=4m_4+ERxgzC
z=7-_vt=wN8NfaF}_7VkLP#C*51kVs^&Tmq1-EQbXyYV+c$~-quW7
z#ILr8(Vu)raM=fp0-n(eg?P@lN3Ew3u}ZtG<`priv;q(1<-Js=vVu7EW)sNk{;*n`
zAh=I2BgzMajMFl`gRvtxx3`sHcMFrKuf7*zgKASH@*76Hw|(MGjmrRhPqeMqS+;zu
zk3o`;hUl4+#_R2O0z8jHvzN<-93wkJYTwq6*zuK1v?ze_IXqPTEHwK0N@KEFj!$rN
zvh6Sq@jtV!kKb~Hn!{TRohkRhuv%y0x9@ts;UA;@&b@dU#zaF!BOJ6^+cMTOZ_uTj{-3l$#VxCwpEXOaW=)j>t1T9XR`xUv8*5U8ney
zcx(SE;Ia)Q5(2C1qGhF(WnNByYjZWhiC19=4X;U>vypo|Kq1it?eu+M&ncAHBTQNDXAxPB
z$4tH$8z(1}lav4aqN!ug+S-~s=w`TeCxpOG=gBV@A_+M1fP;;8oMC7$OVG<93$^#t
zb=1&C57+20=0^uwTF+sb-oH&r%*_oa>D-BTJi;z9^i2mFrInT4|iO8TXfbG4yMD8m3
zEEiFcCl;6cMO&X?YI45mjG%2__^msN63{hbUo|N1)16xA;UtBLb-u6M_xXo>)-(K3
zDss3JkBGnxkM8rVr48tPj&3Ej(7OM4h?{
zgWa?NoXx(>Ae+ku`o)xpG+<$&ZRpxt)kp)pa
z)WYP1Cdxy*tY+_iBwjagbT1FFZqARIu%IObb@9}V#zD~S)#pA>+HYR3J77oK2k#_f
z!*nG+6Fhb(!V9marQS|;{oD1KFDPhN?#DxxEv$NjA%U!x-XThC_aM&aRe{%Ir~sM6
z(V5K0PIH+t(bH~0LoTlE@YZvG1^>F+Q{(-Y`0||XSk8^%1_3>}R<$vuPl?vcF*EeG
z>z^O@Ak$R|6@~pN;-~DRyoN|%fcQ?)-T($39Z$e-RPjy`TmQ2*nJkv@#YI({t_Kb&
zX{qO(r|KfT?k=tv$A9xJmzF=Td1Jdbd<6(Nt$P~iw1@L@bNx1xl6YT_3&_#KW7vg<
zVo9cctLd%)$MTT=JCp)cRM#sTob-uG5zIzI#*S&7=ebjNQvx}&v$N~Ms1`IdG%XK{
zS{6W{7`52dW+x;v0KV=jwK6w^7MJVQi$eg!rX|M$9~4PV%oV;N-%^qO&K8`|C56h(
zzr>VV281BVVNSOk`*xAc!dGmMZlCUYW%#ezS5T2xd>o$D2NZ7XLSbRGD!EdWVQbRpPjffh&(
zZX?ALVutOm?PtY~Za_3}=#n0*7wQk?Zig@A*?&!M_k~0&*rc+CsLA+PVutEut_cBS
zL*;4xee-McoAr^9V#qT<6LVE&{J5YYtFJSolm(kc3|vnnZ%P`T^Vq9vI=GF&3{1ADsdYr)4r+JJ6&VQYy+?V|6BDsrI|!_ooZxMvBQ1
z5s2DLNq+x>zTjYC`a@BM@7gG{a*d{~7=Aa`b*ASoBJ^rhA*VOojfj*AyduOmuH(jy3)lY8@fdNBr
zb`kkDzmr)034*7oLDwC|T7^WFoT*qJ2mbc#59a318?N7E)utXO*KD|c1|d{eI(}2I
zVa!j-dQ1WyEL)X`+Y{x17CC#aIPzDwjTvX&&)%@bCQ8-|dr>b`OL`ySa!?k0E{pAM
zC#o!~eP-s`N#Bj`^IT7$I@%0Sw+LCjkl5?`I$(F5-u1GXOWvCuiU}OfVsQJeB5Eg*
zUQ%0+{foi1`wHkc*|=k-fTL9uLsU)^eU;n3UqGp;G2!+OWVhbbk$_UBitRb&am6@w
z{~pX?Ep6)NtVm{-trsF+UE;H5^*s5^)ms|KB8!RG&(hn3@Qlg(#=SWotMtWhY`vYN
z*yI-F<>Coec+T7F?A1E16r!KO)b3wwus;W&;mF{D;h4A~p61)f4oR<*
zIXu>dvU+W_y1D<=T1Nc1{kwQx-O_`FBO5^g=hlK+xD&Z7(LJ~&bsrG4(Nc<*I+7}
z4?^2*C)n$4ZHppl6j`eCW{99&r4AXuR!1#5nB=1bg??^LJoS&ok4F5-Ep6>6dbe=)
z+?s23BF@~36uz*)9$k_0X@ht70Z2|5n4Q32uxli+@2J3FX
zedz8iKY)NIncwHS17yt^p>p=!$MXQ|9zZ~zB(}3%-*S(XQ#9*rKMDH&ZqxOr+Uv#U
z8V&(Yey7{^nXOAEUfq*N5d}6Agcq{uL#EfhkEdb)KbA2X`w7yZ;}o*W2uyp6DKqAY
zUIS&m1UtGtoNnDk4?|&MKjhYt3R^j1Jcl^E-utgR+#R{CoQg5c4a`gXj^M~Q{$dlg
zzq4Rj9b}b_I$q;#;OPs;@eO7D`*e};fTA;0O|0?n0po4w+$|!*R!{6AL-zjMmqG7E
zn_UP4Q1pxO15S;%IXwu?c=_J(Wt1v1x#SUDn&Rd+8U)C4LD)O`2$AS>!W|*ijh#6EK6_
z+kb7lWu_r>Xb#B0^Fs9Ho0wrM>^%RN#zUVWf8kQ67F@%8Anp+~qUGVJ>La0|K)=O+
z$3p!%Fam~d!T!Q^LF^wXiWgrs-;~i&U6qHk;on;y*uGs4F0l7kQ>{mt&f{}ot7~gK
zO_El!ynlM?=nQLdWo2bW3lstUg4E9A!<=AW1dOFhdVjucEvacg@UgtfnmLh2rnFX#
zfi>pTcp9rln-g^cg=~INQE-Z`M|gQv8{(4lN{c<2S*ATK7}?v!$a#j2<-Ps4BfCY9M7(#p-~hM4M9s5=7DBUCWuiBvRkVNA8Q{b%q+EYssaIHr|gD;v<3yzzNBa;8;th=ialzptQ
zD0VacvGS2+O5AdnK7i90y$^KRLI5C
zKe4;Ups(`~eV>QTIiG-5ATdh`Ju+0;;3k%+hB@2f!npG-Nz^)6&e~`)fWE~hZc}8K
zC7)*E6{~z@b9>rq8db_EE*na^=GuItD-mYxOBBHxi5^=BGM2LDey9vR(q`3Qiw(Ev7&Q|*&K80MW
zpeMusb4$zJ#PNC^GTxtX0@G^R?y}9$FrnzN!>xzuRxNumJf&r2I|CT<o_776tuR6nt9>-*4MCy-aZ+sJ&yl)pc4eHe!wU8~Ir
z!$sY|@Y&1KUaaHDj}#_{0eHikmj5TX+=g>|Jcbv7VrvZZRho*{nE+r%2p8aRH^B)u
z4iu#9XT)&+bJXK*Z*QN}{YO|{7Ok-~dB{X4pR^#XdDX^p5Ig@tYn
zE=7Jxj{%PRNL;uR(f*(+nx+E4z~Wz=$W56vt9ibX)}QaI;%wUbvrH}Mw@}Rq|M^zM
z_r(IoOI0Ebw-^QwWoir=iTU74dysncj>O6BK)^t8wb^EME^KgB@bmDitgKVvk
z{15mHbNw6YbdM>M#hnz$s9)S(DePJr(G3kv@))N?^osk(Z+khjqr+1mWHJ5n5)$)&
z@HR*P!@7tHT@RaVSqst)Ka(s}zrxjO9iv&n|2RrXg==JB=d;)1H#J8rVW-gZ7ZWXt
zV)y6PPl*gna!E08A3?|Hn1l`K`Iy;9XxDE~UyH%*e1FC9bb|OviVcV#g##o!RYx`G
z|2M&}h;@O;bl-P!3sDg4qbz#rWWMj{r=&H2E8)NK$K{gheLnHZN-9F~uf?OI@8T-A
z3U<_x$}nyB^Bnj1f@LX~X{4sI(*XlT#~O-Y*DP@sZTB4!pyHwvd|PK2fk@`2Ip&oA
z-?ZGe)N`4^#9TAN^E+lx;Img#ViYRL0D?t&ViG1g{Bzi_av_VwEH&K7E(W;0sOub2
zbR7N|6M)7uId3Ml?zRk-gsTYik3yUsQ(V@MU;hIq!9<`N_u5Z=Tv%0ppwKCiFz5{i
zj^+)A8t~uToOsBZ>HaDqim38q{Wk^F-RFcWOgkMM+9WB-aIaFA?8$e(xb4U?w-m#6Y8%&hm|9JiaQ=
zS1;x){#WreFC)*fik#@T7hgEK^}BIVFTC@?WRVqr?q@vZ<)2)F;g4|9Q$F@DgeV6L1HQNHV7_i$mXqwL
z7Ik;4X*YG!7y=#^G~5thl_-3KFaGp-XWrdEV^gh!ILBsTVPOIWNywF{Ums6oVt^+xYR7$YiGq1)HK!*z53@IDgp%EOW(-54OkgBjOy)hhBVIad2w
za>Lrx@z-xbT!)0iC#51CDclM}_Drl4{BOtQf38$YMg^Kbb0m!VhhzanEYD$E($s?i
z%{Vus6-#Bd=A>D2du_x%IkCIDhWrkvl9^t!GKsI(FmM~_nETyM($ciuFYhELIxCUo
zRV{>5cQGf?^q;NL$@G*7Qmh7j2+K|0GDznaV$yD&JKtT-mnFZa724+TN8xKsSd?Uo
z_FS1=w0#A0u0t_+&Z1iaS@w2(S2bS(yqc4~WcwWc+|2CutM+~vi^64&GG=+nZuS424@^_MfKE7#*!-DzJw>{!Z
zgmNZ2Bn*@#=acLfX#-=Ve63A+kxL#+?WMD-__Ky+#5tCkY|jCIvlOI414F!RZkuKj
zIL$x{tyH2n)jfAz&g8MYnELe>d%+hfz}x^EX3U<`PtL|g+z_GfY2-;V#4qg1c&Sn(
z`}Ln>!jv(xRicm2s;fNW2gzE5^J98vY*ZK`77ebL2~xDddEDJsp}(8FrirsBWqr#Y
zgyt9%SrkI)ID-vn?jfHNtFAsbnyYBARq38UX}^#6~diP{rA@g(6NNT?(G=kQR`850hl5L2P2qHWl#J^
zgv$HeVtjy(1nw$ry(0zQPvo`1>b2v#52OcO`XPR|c4rsHqwHl$X2ouH47jdH63E^UVMV}Q=X{z)kCRiFJi%Psa8
ze4Z*!+Cy6?*+((50EFtCe6@Jm9IveXMQKe>REOTs}KcOQct_g@=?QEB&gec@Z
zhe%Pc4gNmua4BvVqc;ri6=s4eS4b69#NFZJsgJVE9F!2DWb^HDE>`6Ygdly+%*}#+
zQ(eS`74-s8ugeO21eDzi6BL!I#JKj)La42+{
z=*er>AkFdzg4S=#=@$iIjkQS8=>tZ4s(mm^c?C<&3l-bzxZ$4!~MSJchk
z@XhOaEAQj8vU#OOozqXbp@ZA8E@2Bv$>s&gyN6M;9N+L^V&8bjN$$YU*ZJU$$B)Ai
z${dg{$;&?pHSTNm&CF|`t;_jE?Pa`#zt{aJa}X@uWVkSQ|C4-H
zy}~XRs}qSM7s@UmM{*ZJ-^-|Ie${N}`0kR_D*@8j(phN3LnjuGs*fhw
zy;D`2B8D$D1h<1QPH<%6oE$2-G+i6MyE1rI^6^pzK8o3?fs*w2YC}&?4H84JVlsg5
zH~&7uM-R{sHG6Nb<{q|QrWC2_a9Ym0d9ECzj{>TD3J=pfTi&aNQ#&pB#;_UmH??eU
z7d2x~dy|3?tsA5zXcLc4V!W#%`sW+w8Md#Mw*E=45qUh4^!pj67;~?o7dDFHtt_3!
zEaq8{Ir(@#IV-reWJfj$KWi>sFN>hm(Xhtgk$oA6XOOz0jXba0TQR+g5j*3}%1Tys
z24X+a3FJ8uRj4tY>OJHV{SE;^H67CKKHBC
zTv*Kq;73IWZ@G>;qE{}SxGfP+N%^3YFBJ9KQ;#m6Y2_#M`gV)PQr~8!E4GphdJy)g
zzsZTacJUvKiaM``W{V%i&=x(eHLr?TEgW#&Yvc4I*Ia(&T)T;|D~Focelf=x1}Lw0
z#d&@>a5f8YrzjWa2uj)`fR)JpzgI7Qm&^6=v$p?YBAmG2Czq<$W%;_}@+|O0)p&b5
z>(_Ak@&r_edPPh=m0zw>-&sBP)LN^6)nfr+L^);7RVM6DgjtUlAJrSap2&N;vj>iM
z)l-d!F6VdJKM80=8XB`&ppvKh{yF2DPo1%Gwa>NAp1fvxf65(654(7@REaUojuXi9
zkEQPmhTMni@3^R>-fktxnUr?EZ+UJ#{PN6df?|>t`)ffY&;LlVSc-73BpGGrcj1`5
zy)Z%C2@5Ek{uO`IX5)JFG@Uj1zJ373V?L*Shb_-v4=~zxdxhC6)J`IRUoDH`yXv{h
zb*?f~BT;ub_QqNUIZEYmCk^K{0YCQ)KKK5PwWjlgHXihwuT7TA3ycljqf#JC-<r$$jq?5goIk!%S+SVS
z4n0y2LOOFl`JmJ&cx5iM{ia%#qI_26ud=kK8)&i9v~;&>gi^mEkcCi0;C}l@t+bvN
zZ?hVe@?;;s4*-Ik*ra!KJ0F=ylp&BFT>J^TSYZ#Mg_|uIAWyn!(;h>12X&)l0l8g$
zRiw}W&nq~g6kCy5m=P`PQKCf#xp89I^(-!dT1!2zY>76ChT{w&f7c*;{WV9u9$wj
zk{lON=jZqCy$X%`n2r+CZi9!f(d%}5IU4mYM66~qM_MV~MA4H6Wn~OA4QY`Ov3~{Y
zq+eWq&dSaiuP@JldHr}k&ohlCFPOcdnBJ==5@&s|O=~;po56WFan#NKfWYvv?rX5d
zQI#QkgAgkGAMFBT%b1^6i_pClnipez#8c&|Uj1M6oP8?KldKniJ6RnEAkdsnoDCan
z_3L_GI1fb;uiSumz;tXHFZNyQ#ra57Vb2w1z13G9*QJ}qN&if}tplYlMhwc!S8BvHW9bbtd|4++3zix?
zR)oLuZ!9FAAhuB~L9%Mlhdk&-Uh8Fas%wyx=tq^e=yxGd>jqA&*hneFH`bv(PTk(u
zKE8Fgc%h2QBp1qG2DOZ?U)&p-hi?-750G|Q`3Mil%uTgw@^3J!N)+7OOvB;>)`Q0p
z4DmR0tJ((~N!7IlnVw$KjHA?H>Bd4$v~a1slD{WKC5)dFIOa3MKPy@5bOxGhAwY!=
zsMpr{*HeT@4r(i4`+p&k;|&xzAO51vDNC0uObf+>*=rYXu2-{Hzc+(Di?09+hF-R$
zp!%P0KS2-bHAUE%;u4goRtT>@zWMMDbZszgZvALLvhzExw3Bu5$1VEBnUYg>U(U
zM~KpHj_4hgl!$ysBl|N`vt=JANf}N_n3z|$mMUok`@ZbAh&*HdW#dJAj(C*hd*h+d
zWv4AGl)$^uhm#=!ac=rjt=sRfwJvbwYN>H>X-+QPxFN9${=pcr3HDgY0;2zHU95fC
z()$+lU;3ZF;!M@u?4SW-|0wc*5B`V&Hd&K2m9;f+(PC1CCb9>NRkerxg%mObQYYGz
zFZ~F9)J{AgBfK}Fo?iWtB@<|1utt$A@aqqwUkOqC2pgW7Q7XT%&vjz-lnU1fmA%9c
zk|_Lgt5i$E_v~?F~93nnx@=E_xESd#rB
zPM80|4~y6mdv+=wQ3F!f7!Txd(TFIxkh<$oIwx@>IBP(W{j5d&2w=70I@J1Kp(GCj
zE-V*uv=uhSh5Pq~U`eHLCYVYqb>*X3BQFvU(fC3`A4Eh@Dxx-}>?%9cNZfdfx!MjA
zEW)!)4_TI-LhDsI0AsGLIh98Sq{4Eksk
zY0bvz8AFvXwBrr-4>f}g6SbCsDSTfJ3FfFTzfx}sws?kz0U`!q<57xyKh1^gXR4JU
z@D)U3LAr5ISK&>eCQ1cy&%m-~PD;+E=Xv9{u6`UNVL
zKRQJcUD_j6{L#n!ML5XeVDBe2I`vWN6V-q7N-I>hP%5()?<=pKD7M|=S5F?as-7_Y
zw=L9C6*^^x0S^r(k7aBWZt`g2vyXP%H$AIzkIu-ku&}hf9~Ov&1SO1$EKIf5Q|Jut
zk7p`08zah;OKw4TQ&5EVr_-L*P?i9ZTBBh(-5l1G{QUfwtMvj27%UT$l|8EFiB6A)
z0efxUse+oCxFy}3{&9?wnG*Rc8;gl4I2;n5Pi?xf-3Dd(kL|h8+n+U_kBg3bIkskN
zkKFw3J1|~1NI3$BJpU9dyDyCv?EPfY*#0DyFVz?gGpJUm52i8~z(aqLSdgAxT^*`e
zal~b>ORt~g<-%dLK^RL~*fRiJsCMM;NSeHRB8K
z4ODojt~Z}Tog`Kk?y#plYhpvi<4>0QJsc6OfNfdSR29=X1JM~Gr++F)!aQ6|dR*gq
zN5I?OMvR5~uT&qMRX?9Engs|_MWW5l8047hp9sR^Z~>6PVb%awv8
zAxm_f>HWLk45tBnMYl8)!v_3M}WOl^_pZ6`EI-8_3hi)anlJ$|CQK8pz)L@9{}b$@bB&p&6uA+3SZC?UipMkFgFwkr2Ux{FHMg+*mdBpKDUQeQO!z+b
z-h#*I>B?ap^{nf1u^h#Er&QeB-8X9@ZIS5)Yp{Bwf|RkjDtnTuJI~)52VBj6@rnV+TEMFv5Q2TER@1a9|5f&0lF
zZ*zbDw9hMmc=BIfXSl8Act(cn^yLcz&ZF6AIF$KTW4ya9u)rU{$p21}ApV<`sVTQd
zjhuVSFgDiC6zWN!DLY*61MMh=4IGX<=t#s{&)83aJitPvX}MU>hn8pC%^w7em9gZs
zN?}*zu1l{AlhE4W#->{njlAgB<4TpJy#Hn>boO{KPZ5a#)SH~#hLB5TNzR@`P9E18
zTzqBwh(J)G;>xYsnt?B40uqp=Oc%zGqKJDUhX@2jT$(OK$g&m7TDOPw7Qh;Nnz1+7
zXpG;kLc0jbhul{eR!mdOwFNeQrGRwBY1h(`f|WCNYn6B}9<*N05Z^(gB9M9TL-#6{
zXe&xykmaWVd1^HCi3uH$ilfjNU%fV~cdKDgUyYUiRkB9nrS)5A`_pR6xvQ_FvXUe8
z8>`jZ=o|+<_1QY?N_WIct3ZD_5e0YLZ&Wy)lfeisDT-Jj=*XkNTBpA%Rm@(9ud$NY
z!icDvkr{Wb8qVYZdrghLu!%aj>HB>Z{`ht_f4*#csYN5zbmcrJ`}AM3`%|98-UIB_
z`(I5qh97HR3)zEcV40j0@S?3!X0S{1|9%ew61d5prL~vgMTa8a7kZfMML@+Z0_Q6%
z`j+~Kvj^LMwQwACzA3Pme$msyShGx@F5)YrL(bEVwrZ&FQe{5vP+Y#@P~j4NAB9E#
z!yk356P|Qavq41X;|O;VBW7Ta;(=8h_Lum+8r~4g{Lw~ZBDoD)n@pzL;DG$m_?WK^
z@xt;PwPEqfcqjd#;Vt5X$BC-54}0{k=AA(+xof1VH1sxw#ZDiqGZMIZX0<}dm^;2A
z1T>0@st)6S51HFEhZ0SI
z?e!}LPHAG>+VrvlgiYS@W~<2w#)%7hdYHheJX@2uShO?Q#YL^bi%qJk)f&S~-5*#1
z{t&)h2QD_*K{+7hrdy`@N}+`|%P8PC>#1
zXWsw)S59
zW$`EK{jxf$+E{mZ)A?_tUtHrY%mph=oiX%Umdka{TT_dbjn-vl24{=-V6-vj?*o65
zRISw$@v7#Uxs_Fcb2k`GY_k6FWs{=ACc}?bRMHIa4k{A`XFA|#w0vHnFngaG%l)(%
zf<(JHoX`ThO8T=w7`PgInWv{{GPnXU5fQgf9R*5h;|AHXhVcXV`ay4)gpPxq_N^Mvl>p>OT{
zhHjnD*}7~+G@3O|nF6_(biSugf@D9~b0>I)ij~X$q
znGIU0cK31>nEdGse_6cbzB>q`{!Y2u^^VI}xgzQLU2H9cLQ0NM%$)&u8o$C%tbg?7
z-0qFp>7EpE+}bjD=SLXFmBEc=N*bkF-ASqT
z3fXr`GKy%r?~ZeQcyo3JK(ZP*1QUC+JvU|#!fscy{c#$C%givaOQ~mka%j4HNsP^R
z1N)ddazDeP&gA>mb1k88;)}-viBQgAN$XD8Mief4$mp#pw!kB){Dg&|7~4d~Qk_RX
zGU)dLfF|_7_mlNAv-7K3I~&Kj@rpF#?79(+(d&y{=D93^FYY4m)j@4$92;MGaARe
zJ`1!&N^{JG~fWVcdRY{n?x0u%!n{$-8f
z%fG-Eo~qY*{g7U?F<8I$2@?Jj^Ro(t$NQHj6>XRl$L%6*b*+sjLC93D%?|f`={J>u
zraC(vzVOn}jLot11L~
z7kPXtUhx-g{`ON73~aLm8vk`n5Ap|k3|J*!-)4%yu=18;HWGuaKs?dTQLk@L|Hohtw_@q`x>LTk
z$PLv9HpQrzceS~*w_^e;)5YP(Xl+=kES*+EMDj1ap_o(I+{%#PdR-%nj6f+$i><~G
zPV9<;LBfCgJ7_M}X;ZZIR_2l(<|S#-R>?K`icnB;cp{}1oK|WTCCphvl0V9{YQvHq
zA|L}_m5!xrU3RQ>GrHmQNC%6f2}-RR@Yw1QT{q~6-R;qM)-YG2Yh5qAurC3uPBOk<
z9thGN*6TYuCkD+ZR~p=4oNusQY=IQ`K!f4a!3rRw+5K@g^cv^wVZcGfO4UsoION$A
z%H@;!p0W0ywchw$^@N!SugtfJ3eCO^cTlMLOsg?e3nJQY=aRxEcntHLe6!$qVStb1h}Kw42)hTz*gf^Eo)a
zM^>#eFR|=1N3_&E_@kCGtId?D2xZ;Gs3-r|5V!yJb-C`^Sy!(HZte;VXk~oR;cguk
zg3D#e6dX;E_C9-NE!omC0zJ`KzD!tuqQRbw_JiJfwdPMWPd?WO*Nt(+*T|GP;xa=~
z6Tig}O^yY(`y8f#U2tm2Mn`a4r=(ID^hGTnorb1_L3QsvwSNt5m7>X{EaK{_`@gqoBNVQ6P
z;=I*1PO2D})fBU+s3^38XP@?|$;2Ri2<^Ac+zA^vXHO=R>(Br4I@cY>=)Eqi^o%}0
zFVF8jRqdDDHf<*qhm%=j1+n~6T!e?<6k@(z%>1W#{zQ4AbRJuNEh|gzp+LM4{}Ohs
zro}jW!pHNCu?h`G^%iqxFy#iVq-o{xcsf#ginb9ioLD_}x!Rbq;s_2~fTNWV9I)^_A+Vg>XH{f>tT)#k&bo$TKy8EzP4oC3GT(Q%d
zesaI3jtg82@y`HVK2N6437GShcAT*~?zY-QB{p{Un`aF9T7!OZpO5;_A3mjbRSvCF+D>j3bb_l&^MYaz03^fzP}J!tL&753MZ)-NPtT)zI;D-p8=26%)C1f%A*4y!>ms
z`FeVTiRgY=ptD$4)~khRZI{iJXWL3j{OEXui+l#A?3>!?^Ietu7~G^mN+zRa;tz*C
zxgqbTl1w$A$eK-)C-JL}5^Ex?7e5`3V3|ueXQkof?uJaqJ!K{zsy^J)=PrU}h6KyS
zZgrgXi-1ecBaoj5+hw9FQjEv*w)KpE3Ki*J$E2-qTUdyF$?hE-)$vLW^^tG#4ouDC
zAHCb-wxaV)=CHot*lW!*C!d!DN9r%T897Is&E3&Pp*Im
zyU`ORjvmvYSSJ%{#FZFNC4
z`wIM04?>KzLzK9=VU*27ofxIG-49REH8~xaQdUqAoMted4^Ck!f;%2cTK^bpPi=SR
z&57#i691l{uZY&=7rj;&gG1t;;R9y(rhdbbqLt(|5>@kwZ`F4Vr2U40I6r<7Sm*Mj
zJkoJt$@y^lKi=LlEXuHp;}j`DLZlm!?vw@zrMtUJx*G(fTe=&hJEf#Xx*O@Cd*}gX
zAAR3)dkM
zoTxFj!2H@N=&|yL$=4otn>AOimO_k;|7)D@cH$MXhLE!mW(Qa9Vl?EOddu^3b4Zs^
z4$T{tyQUa(#<$Ge9alZCD`lW`WhB3bEVE>I^*&OOjAC5Q=Anro7Js^9mS^}f?J-Q-
zdOGv;3eGJAHX_0^J1Ja^-1QO8Tqx9W9+$ij$I2H9w_AOYc0YIKq+&?XoFWj=l2Rg$
z5vraRn%+rACK{DDNVOqbe=)XH8H4Nc3xC|)=!MC4^UT}Jd`^rUQj_!1*J;zphj>p>
zl4}N_lu%_k6eJWRU$h)2;XSnL1pBq$*b~+LJe#t<#-I6+lsIqC1UpQ)--l+2oqY_K
z3Y48|e9i0jF$k=Psx40kKKhPmt1GOj(wu5b}quDo^zIU1ar{(AOvA|f9_vb7&-S)>`H^yWNAxGlR>Y&dC?YKp{NQ84lr{g&6A05>zf6K(AOeZ>Nj3c_nB_eU+g_q(%A
z%;_6++&u_BM-m(&hqb-gp3!s~LJ8rj_W#~JrZeJhN!7RIA1W`L8h1ng3-d~Gy*KEZ
zS?)-EG$X{Ju3>|O1zM9J@%3&n^=ZRo05g~{)*rsI6~^Ee3~lDMT*8OLXNp(y%f|C<}1XaUO_%Za<^Bw`xj
zT*_us;kb!qxgl%AUF<@cS82Mxt>BB%I-1=&_FZI
z`G=^>ZA9f}d{%s2kZI{Mk!VxDSD^w_ik5g1lxA}VnvfssoWHp3>iUMVtHrhtVg}
zUapIDRIhl;uem50Wh`+em#Na!nSj5fFdG8t8*s4OL~Q34@Mv|Py*NiMmayQ3VYpqY*eeINWhG|rdt~a&~i6%HP
zVX!K&StehO!qR4M*@Q6U<692g4xpJl1Ud>vj_`LtYIuEY8%NkJFT2nX$uh7*&|
z4=YxRJ`$N3PWodvp$PJsAI=xn&juA}-)&55B^tXxq`$d_U*^0g(3?~+t^c|;og;Bm
za^V^zPh23E!3VdzY|RyfgQLdoy~vT#i0IQYbI8qcl(62grR~TW=?NvPG#9x0O_17K
z|I#~og-VB5`o{~6Qyi7hz*N^Cx>pP?8n=`;&|{*3~$5b-obp##HP$`(VB)MYbv3l5ob2O>?7m3?fYYvOE6+c)2(GF4I#
ze6f{YH;U!zfgD4u@_PI`HJ$z*xMEw~h8X=*E;X9*yaVj;#-IITAA+8cRO=}f-Ufd>
zeY_QmE9O
zm3k^fXEXlX+i5UBUn~waxOrZ}y?mk1f&F8qf29_>z)iEVuqUMuymbcAcA7bEQi1gi
z&ad7zv;*8iZmdC64V5no8zpcv19jfhEo`3!v-6An@a5Imoy_>kQjnIbR2ZNd%8g%$
zeG1vV8A7mrm}!|uO7I72^CeA{ad=;!OBJL0ijr%5F6_knaON~rw6>Guv(|roFU4bD
z+UfY#4*lm+#~ruEiEEwhD>a4P)eEE*V%5fe!;Q5n3sJ^Ik2gwS<*d;<*Oxs#hx@)pdDEVeT=c(P_-sH(xr<&rcy4KhClckp7{IoL5M5B{V0~_X2mRz9?>C8hMC9!lg
zC)O_m5p<6-rIEckJ*D39Dt|bMRMi&x9^@IMfz4!y+vm+>DL}(DJ0pf!4#oReo?TKT
z4O31=&}hj^?j13Eb+s=&kyA{yTtF~@6-nt&Qsv~nFjcV4N~6=`=DKD&U$odn#(t=FjiwjMnJ}|Qb1(|1CaCcKJd#SnF!7w=l8-^@HTU;M
zI|l7mv6OttZ~j$u7S2$q_Psf2kh#*r>O!Vq`33m<^guM(RMgkxqB1^l&;D25W9u@B
z^Ej^Mr*zpgqy#&z6v?F6@@%31vijFyZx`-9iRrS$2Pgk!`Yitce48JcXatx4p=SdF*$aSI*2H
z@0@%uzDLp1g};gUyxv4@;ADm!1U{0CkO(p#NpWlJvZ?w=&@nTO{Tv~eQCjuhTL<0&ghUrJ}x|g{Emii#uXY>!}m1}6IO!@aGUQBFA
z7Xy@Y?4((TTuBR)OQMlK#F*ZTGh~x)d|7#C%P8)%I>69$exGM<$$8-Us!#1M7;e=n
zsfeRa4!_vew&H7Vc$lS{l73reo9_I!?GPKdB6%NIz0&iUxg6;yj>gSP*8aRQOGw@C
zH}1{V#s@+H5{6gu78ox<0!HDcpihHrc8xQ?=Zkd-E-qvv`VET;U=*PWBH3LUjMAWf
z{wG)O>(>QVAf-01U3vIKHh9TslMQ;>H_?(#jS;Y8j?hrtmBy$