diff --git a/includes/licensing/_edition-requirements.md b/includes/licensing/_edition-requirements.md index e071c50031..6d9d909642 100644 --- a/includes/licensing/_edition-requirements.md +++ b/includes/licensing/_edition-requirements.md @@ -41,7 +41,7 @@ ms.topic: include |**[Microsoft Defender Application Guard (MDAG) configure via MDM](/windows/client-management/mdm/windowsdefenderapplicationguard-csp)**|❌|Yes|❌|Yes| |**[Microsoft Defender Application Guard (MDAG) for Edge enterprise mode and enterprise management](/windows/security/application-security/application-isolation/microsoft-defender-application-guard/configure-md-app-guard)**|❌|Yes|❌|Yes| |**[Microsoft Defender Application Guard (MDAG) for Edge standalone mode](/windows/security/application-security/application-isolation/microsoft-defender-application-guard/md-app-guard-overview)**|Yes|Yes|Yes|Yes| -|**[Microsoft Defender Application Guard (MDAG) for Microsoft Office](https://support.microsoft.com/office/application-guard-for-office-9e0fb9c2-ffad-43bf-8ba3-78f785fdba46)**|❌|Yes|❌|Yes| +|**[Microsoft Defender Application Guard (MDAG) for Microsoft Office](/defender-office-365/app-guard-for-office-install)**|❌|Yes|❌|Yes| |**Microsoft Defender Application Guard (MDAG) public APIs**|❌|Yes|❌|Yes| |**[Microsoft Defender for Endpoint](/microsoft-365/security/defender-endpoint)**|Yes|Yes|Yes|Yes| |**[Microsoft Defender SmartScreen](/windows/security/operating-system-security/virus-and-threat-protection/microsoft-defender-smartscreen/)**|Yes|Yes|Yes|Yes| diff --git a/includes/licensing/_licensing-requirements.md b/includes/licensing/_licensing-requirements.md index ba6683b1d6..d4d3b7204e 100644 --- a/includes/licensing/_licensing-requirements.md +++ b/includes/licensing/_licensing-requirements.md @@ -1,7 +1,7 @@ --- author: paolomatarazzo ms.author: paoloma -ms.date: 11/02/2023 +ms.date: 04/14/2025 ms.topic: include --- @@ -41,7 +41,7 @@ ms.topic: include |**[Microsoft Defender Application Guard (MDAG) configure via MDM](/windows/client-management/mdm/windowsdefenderapplicationguard-csp)**|❌|Yes|Yes|Yes|Yes| |**[Microsoft Defender Application Guard (MDAG) for Edge enterprise mode and enterprise management](/windows/security/application-security/application-isolation/microsoft-defender-application-guard/configure-md-app-guard)**|❌|Yes|Yes|Yes|Yes| |**[Microsoft Defender Application Guard (MDAG) for Edge standalone mode](/windows/security/application-security/application-isolation/microsoft-defender-application-guard/md-app-guard-overview)**|Yes|Yes|Yes|Yes|Yes| -|**[Microsoft Defender Application Guard (MDAG) for Microsoft Office](https://support.microsoft.com/office/application-guard-for-office-9e0fb9c2-ffad-43bf-8ba3-78f785fdba46)**|❌|❌|❌|❌|❌| +|**[Microsoft Defender Application Guard (MDAG) for Microsoft Office](/defender-office-365/app-guard-for-office-install)**|❌|❌|❌|❌|❌| |**Microsoft Defender Application Guard (MDAG) public APIs**|❌|Yes|Yes|Yes|Yes| |**[Microsoft Defender for Endpoint](/microsoft-365/security/defender-endpoint)**|❌|❌|Yes|❌|Yes| |**[Microsoft Defender SmartScreen](/windows/security/operating-system-security/virus-and-threat-protection/microsoft-defender-smartscreen/)**|Yes|Yes|Yes|Yes|Yes| diff --git a/windows/client-management/mdm/policy-csp-accounts.md b/windows/client-management/mdm/policy-csp-accounts.md index 2c00a22b4a..8500bffa81 100644 --- a/windows/client-management/mdm/policy-csp-accounts.md +++ b/windows/client-management/mdm/policy-csp-accounts.md @@ -144,7 +144,7 @@ Allows IT Admins the ability to disable the Microsoft Account Sign-In Assistant > [!CAUTION] -> If the Microsoft Account Sign-In Assistant service is disabled, the initial digital license activation with a Multiple Activation Key (MAK) will fail. +> If the Microsoft Account Sign-In Assistant service is disabled, the initial digital license activation with a Multiple Activation Key (MAK) or Digital Product Key (DPK) will fail. diff --git a/windows/configuration/unbranded-boot/index.md b/windows/configuration/unbranded-boot/index.md index efb6fe6da6..a7edd8a9cf 100644 --- a/windows/configuration/unbranded-boot/index.md +++ b/windows/configuration/unbranded-boot/index.md @@ -1,7 +1,7 @@ --- title: Unbranded Boot description: Learn about Unbranded Boot, a feature that suppresses Windows elements that appear when Windows starts. Unbranded Boot can also suppress the crash screen when Windows encounters an error that it can't recover from. -ms.date: 04/09/2025 +ms.date: 04/11/2025 ms.topic: how-to --- @@ -46,6 +46,9 @@ To enable Unbranded Boot using PowerShell, follow these steps: The following instructions provide details about how to configure your devices. Select the option that best suits your needs. +> [!NOTE] +> If Windows is already installed, you can't apply a provisioning package to configure Unbranded Boot. Instead, you must use the command prompt to configure Unbranded Boot. + #### [:::image type="icon" source="../images/icons/cmd.svg"::: **Command prompt**](#tab/cmd) You can use the `bcdedit.exe` command to configure Unbranded Boot settings at runtime. @@ -72,7 +75,7 @@ You can use the `bcdedit.exe` command to configure Unbranded Boot settings at ru bcdedit.exe -set {globalsettings} bootuxdisabled on ``` -1. Run the following command to suppress any error screens that are displayed during boot. If **noerrordisplay** is on and the boot manager hits a *WinLoad Error* or *Bad Disk Error*, the system displays a black screen +1. Run the following command to suppress any error screens that are displayed during boot. If `noerrordisplay` is set to `on` and the boot manager hits a *WinLoad Error* or *Bad Disk Error*, the system displays a black screen ```cmd bcdedit.exe -set {bootmgr} noerrordisplay on @@ -80,7 +83,7 @@ You can use the `bcdedit.exe` command to configure Unbranded Boot settings at ru #### [:::image type="icon" source="../images/icons/xml.svg"::: **Unattend**](#tab/unattend) -You can configure the Unattend settings in the `Microsoft-Windows-Embedded-BootExp` component to add Unbranded Boot features to your image during the design or imaging phase. You can manually create an Unattend answer file or use Windows System Image Manager (Windows SIM) to add the appropriate settings to your answer file. For more information about the Unbranded Boot settings and XML examples, see the settings in [Microsoft-Windows-Embedded-BootExp](/windows-hardware/customize/desktop/unattend/microsoft-windows-embedded-bootexp). +You can configure the Unattend settings in the `Microsoft-Windows-Embedded-BootExp` component to add Unbranded Boot features to your image during the design or imaging phase. You can manually create an Unattend answer file or use Windows System Image Manager (Windows SIM) to add the appropriate settings to your answer file. ### Unbranded Boot settings @@ -95,14 +98,14 @@ The following table lists Unbranded Boot settings and their values. | `HideBootStatusIndicator` | Contains an integer that suppresses the status indicator that displays during the OS loading phase. | - Set to `1` to suppress the status indicator
- The default value is `0`| | `HideBootStatusMessage` | Contains an integer that suppresses the startup status text that displays during the OS loading phase. | - Set to `1` to suppress the startup status text
- The default value is `0`| +For more information about the Unbranded Boot settings and XML examples, see the settings in [Microsoft-Windows-Embedded-BootExp](/windows-hardware/customize/desktop/unattend/microsoft-windows-embedded-bootexp). + #### [:::image type="icon" source="../images/icons/provisioning-package.svg"::: **PPKG**](#tab/ppkg) Customize the boot screen using Windows Configuration Designer and Deployment Image Servicing and Management (DISM). You must enable Unbranded Boot on the installation media with DISM before you can apply settings for Unbranded Boot using either Windows Configuration Designer or applying a provisioning package during setup. -If Windows is already installed, you can't apply a provisioning package to configure Unbranded Boot. You must use the command prompt to configure Unbranded Boot if Windows is installed. - [!INCLUDE [provisioning-package-1](../../../includes/configure/provisioning-package-1.md)] |Path|Value| @@ -115,38 +118,33 @@ If Windows is already installed, you can't apply a provisioning package to confi > [!TIP] > For more information, see [SMISettings](/windows/configuration/wcd/wcd-smisettings) in the Windows Configuration Designer reference. -1. Once you have finished configuring the settings and building the package or image, you use DISM to apply the settings. - 1. Open a command prompt with administrator privileges. - 1. Copy install.wim to a temporary folder on hard drive (in the following steps, it assumes it's called c:\\wim). - 1. Create a new directory. +Once you finish to configure the settings and building the package or image, use DISM to apply the settings: - ```cmd - md c:\wim - ``` +1. Open a command prompt with administrator privileges +1. Copy `install.wim` to a temporary folder on the hard drive (for example, `c:\wim`) +1. Create a new directory to mount the image: - 1. Mount the image. - - ```cmd - dism /mount-wim /wimfile:c:\bootmedia\sources\install.wim /index:1 /MountDir:c:\wim - ``` - - 1. Enable the feature. - - ```cmd - dism /image:c:\wim /enable-feature /featureName:Client-EmbeddedBootExp - ``` - - 1. Commit the change. - - ```cmd - dism /unmount-wim /MountDir:c:\wim /Commit - ``` + ```cmd + md c:\wim + ``` +1. Mount the image: + ```cmd + dism /mount-wim /wimfile:c:\bootmedia\sources\install.wim /index:1 /MountDir:c:\wim + ``` +1. Enable the feature: + ```cmd + dism /image:c:\wim /enable-feature /featureName:Client-EmbeddedBootExp + ``` +1. Commit the change: + ```cmd + dism /unmount-wim /MountDir:c:\wim /Commit + ``` --- In the following image: -1. `BootLogo` is outlined in green, the +1. `BootLogo` is outlined in green 1. `BootStatusIndicator` is outlined in red 1. `BootStatusMessage` is outlined in blue diff --git a/windows/deployment/windows-autopatch/manage/windows-autopatch-hotpatch-updates.md b/windows/deployment/windows-autopatch/manage/windows-autopatch-hotpatch-updates.md index b52cda4040..59e83f707a 100644 --- a/windows/deployment/windows-autopatch/manage/windows-autopatch-hotpatch-updates.md +++ b/windows/deployment/windows-autopatch/manage/windows-autopatch-hotpatch-updates.md @@ -1,7 +1,7 @@ --- title: Hotpatch updates description: Use Hotpatch updates to receive security updates without restarting your device -ms.date: 04/04/2025 +ms.date: 04/11/2025 ms.service: windows-client ms.subservice: autopatch ms.topic: how-to @@ -21,25 +21,20 @@ Hotpatch updates are designed to reduce downtime and disruptions. Hotpatch updat Hotpatch is an extension of Windows Update and requires Autopatch to create and deploy hotpatches to devices enrolled in the Autopatch quality update policy. -> [!NOTE] -> Hotpatch is also available on Windows Server and Windows 365. For more information, see [Hotpatch for Windows Server Azure Edition](/windows-server/get-started/enable-hotpatch-azure-edition). - ## Key benefits - Hotpatch updates streamline the installation process and enhance compliance efficiency. - No changes are required to your existing update ring configurations. Your existing ring configurations are honored alongside Hotpatch policies. - The [Hotpatch quality update report](../monitor/windows-autopatch-hotpatch-quality-update-report.md) provides a per policy level view of the current update statuses for all devices that receive Hotpatch updates. -## Release cycles +## Prerequisites -For more information about the release calendar for Hotpatch updates, see [Release notes for Hotpatch](https://support.microsoft.com/topic/release-notes-for-hotpatch-public-preview-on-windows-11-version-24h2-enterprise-clients-c117ee02-fd35-4612-8ea9-949c5d0ba6d1). +To benefit from Hotpatch updates, devices must meet the following prerequisites: -| Quarter | Baseline updates (requires restart) | Hotpatch (no restart required) | -| ----- | ----- | ----- | -| 1 | January | February and March | -| 2 | April | May and June | -| 3 | July | August and September | -| 4 | October | November and December | +- For licensing requirements, see [Prerequisites](../prepare/windows-autopatch-prerequisites.md) +- Windows 11 Enterprise version 24H2 or later +- Devices must be on the latest baseline release version to qualify for Hotpatch updates. Microsoft releases Baseline updates quarterly as standard cumulative updates. For more information on the latest schedule for these releases, see [Release notes for Hotpatch](https://support.microsoft.com/topic/release-notes-for-hotpatch-in-azure-automanage-for-windows-server-2022-4e234525-5bd5-4171-9886-b475dabe0ce8?preview=true). +- Microsoft Intune to manage hotpatch update deployment with the [Windows quality update policy with hotpatch turned on](#enroll-devices-to-receive-hotpatch-updates). ## Operating system configuration prerequisites @@ -49,28 +44,30 @@ To prepare a device to receive Hotpatch updates, configure the following operati VBS must be turned on for a device to be offered Hotpatch updates. For information on how to set and detect if VBS is enabled, see [Virtualization-based Security (VBS)](/windows/security/hardware-security/enable-virtualization-based-protection-of-code-integrity?tabs=security). -### Arm 64 devices must disable compiled hybrid PE usage (CHPE) (Arm 64 CPU Only) (Public preview) +> [!NOTE] +> Devices might be temporarily ineligible because they don’t have VBS enabled or aren’t currently on the latest baseline release. To ensure that all your Windows devices are configured properly to be eligible for hotpatch updates, see [Troubleshoot hotpatch updates](#troubleshoot-hotpatch-updates). + +### Arm 64 devices must disable compiled hybrid PE usage (CHPE) (Arm 64 CPU Only) > [!IMPORTANT] > **Arm 64 devices are in public preview**. It's being actively developed and might not be complete. They're made available on a "Preview" basis. You can test and use these features in production environments and scenarios and provide feedback. -This requirement only applies to Arm 64 CPU devices when using Hotpatch updates. Hotpatch updates aren't compatible with servicing CHPE OS binaries located in the `%SystemRoot%\SyChpe32` folder. To ensure all the Hotpatch updates are applied, you must set the CHPE disable flag and restart the device to disable CHPE usage. You only need to set this flag one time. The registry setting remains applied through updates. To disable CHPE, create and/or set the following DWORD registry key: -Path: `HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management` -DWORD key value: HotPatchRestrictions=1 +This requirement only applies to Arm 64 CPU devices when using Hotpatch updates. Hotpatch updates aren't compatible with servicing CHPE OS binaries located in the `%SystemRoot%\SyChpe32` folder. + +To ensure all the Hotpatch updates are applied, you must set the CHPE disable flag and restart the device to disable CHPE usage. You only need to set this flag one time. The registry setting remains applied through updates. > [!IMPORTANT] > This setting is required because it forces the operating system to use the emulation x86-only binaries instead of CHPE binaries on Arm 64 devices. CHPE binaries include native Arm 64 code to improve performance, excluding the CHPE binaries might affect performance or compatibility. Be sure to test application compatibility and performance before rolling out Hotpatch updates widely on Arm 64 CPU based devices. +To disable CHPE, create and/or set the following DWORD registry key: +Path: `HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management` +DWORD key value: HotPatchRestrictions=1 + +> [!NOTE] +> There are no plans to support hotpatch updates on Arm64 devices with CHPE enabled. Disabling CHPE is required only for Arm64 devices. AMD and Intel CPUs don’t have CHPE. + If you choose to no longer use Hotpatch updates, clear the CHPE disable flag (`HotPatchRestrictions=0`) then restart the device to turn on CHPE usage. -## Eligible devices - -To benefit from Hotpatch updates, devices must meet the following prerequisites: - -- Operating System: Devices must be running Windows 11 24H2 or later. -- VBS (Virtualization-based security): VBS must be enabled to ensure secure installation of Hotpatch updates. -- Latest Baseline Release: Devices must be on the latest baseline release version to qualify for Hotpatch updates. Microsoft releases Baseline updates quarterly as standard cumulative updates. For more information on the latest schedule for these releases, see [Release notes for Hotpatch](https://support.microsoft.com/topic/release-notes-for-hotpatch-in-azure-automanage-for-windows-server-2022-4e234525-5bd5-4171-9886-b475dabe0ce8?preview=true). - ## Ineligible devices Devices that don't meet one or more prerequisites automatically receive the Latest Cumulative Update (LCU) instead. Latest Cumulative Update (LCU) contains monthly updates that supersede the previous month's updates containing both security and nonsecurity releases. @@ -80,6 +77,32 @@ LCUs requires you to restart the device, but the LCU ensures that the device rem > [!NOTE] > If devices aren't eligible for Hotpatch updates, these devices are offered the LCU. The LCU keeps your configured Update ring settings, it doesn't change the settings. +## Release cycles + +For more information about the release calendar for hotpatch updates, see [Release notes for Hotpatch](https://support.microsoft.com/topic/release-notes-for-hotpatch-public-preview-on-windows-11-version-24h2-enterprise-clients-c117ee02-fd35-4612-8ea9-949c5d0ba6d1). + +- Baseline: Includes the latest security fixes, cumulative new features, and enhancements. Restart required. +- Hotpatch: Includes security updates. No restarted required. + +| Quarter | Baseline updates (requires restart) | Hotpatch (no restart required) | +| ----- | ----- | ----- | +| 1 | January | February and March | +| 2 | April | May and June | +| 3 | July | August and September | +| 4 | October | November and December | + +## Hotpatch on Windows 11 Enterprise or Windows Server 2025 + +> [!NOTE] +> Hotpatch is also available on Windows Server and Windows 365. For more information, see [Hotpatch for Windows Server Azure Edition](/windows-server/get-started/enable-hotpatch-azure-edition). + +Hotpatch updates are similar between Windows 11 and Windows Server 2025. + +- Windows Autopatch manages Windows 11 updates +- Azure Update Manager and optional Azure Arc subscription for Windows 2025 Datacenter/Standard Editions (on-premises) manages Windows Server 2025 Datacenter Azure Edition. For more information, on Windows Server and Windows 365, see [Hotpatch for Windows Server Azure Edition](/windows-server/get-started/enable-hotpatch-azure-edition). + +The calendar dates, eight hotpatch months, and four baseline months, planned each year are the same for all the hotpatch-supported operating systems (OS). It’s possible for additional baseline months for one OS (for example, Windows Server 2022), while there are hotpatch months for another OS, such as Server 2025 or Windows 11, version 24H2. Review the release notes from [Windows release health](/windows/release-health/) to keep up to date. + ## Enroll devices to receive Hotpatch updates > [!NOTE] @@ -94,11 +117,11 @@ LCUs requires you to restart the device, but the LCU ensures that the device rem 1. Select **Create**, and select **Windows quality update policy**. 1. Under the **Basics** section, enter a name for your new policy and select Next. 1. Under the **Settings** section, set **"When available, apply without restarting the device ("Hotpatch")** to **Allow**. Then, select **Next**. -1. Select the appropriate Scope tags or leave as Default and select **Next**. +1. Select the appropriate Scope tags or leave as Default. Then, select **Next**. 1. Assign the devices to the policy and select **Next**. 1. Review the policy and select **Create**. -These steps ensure that targeted devices, which are [eligible](#eligible-devices) to receive Hotpatch updates, are configured properly. [Ineligible devices](#ineligible-devices) are offered the latest cumulative updates (LCU). +These steps ensure that targeted devices, which are [eligible](#prerequisites) to receive Hotpatch updates, are configured properly. [Ineligible devices](#ineligible-devices) are offered the latest cumulative updates (LCU). > [!NOTE] > Turning on Hotpatch updates doesn't change the existing deadline-driven or scheduled install configurations on your managed devices. Deferral and active hour settings still apply. @@ -106,3 +129,48 @@ These steps ensure that targeted devices, which are [eligible](#eligible-devices ## Roll back a hotpatch update Automatic rollback of a Hotpatch update isn’t supported but you can uninstall them. If you experience an unexpected issue with hotpatch updates, you can investigate by uninstalling the hotpatch update and installing the latest standard cumulative update (LCU) and restart. Uninstalling a hotpatch update is quick, however, it does require a device restart. + +## Troubleshoot hotpatch updates + +### Step 1: Verify the device is eligible for hotpatch updates and on a hotpatch baseline before the hotpatch update is installed + +Hotpatching follows the hotpatch release cycle. Review the prerequisites to ensure the device is [eligible](#prerequisites) for hotpatch updates. For information on devices that don’t meet the prerequisites, see [Ineligible devices](#ineligible-devices). + +For the latest release schedule, see the [hotpatch release notes](https://support.microsoft.com/topic/release-notes-for-hotpatch-public-preview-on-windows-11-version-24h2-enterprise-clients-c117ee02-fd35-4612-8ea9-949c5d0ba6d1). For information on Windows update history, see [Windows 11, version 24H2 update history](https://support.microsoft.com/topic/windows-11-version-24h2-update-history-0929c747-1815-4543-8461-0160d16f15e5). + +### Step 2: Verify the device has Virtualization-based security (VBS) turned on + +1. Select **Start**, and enter `System information` in the Search. +1. Select **System information** from the results. +1. Under **System summary**, under the **Item column**, find **Virtualization-based security**. +1. Under the **Value column**, ensure it states **Running**. + +### Step 3: Verify the device is properly configured to turn on hotpatch updates + +1. In Intune, review your configured policies within Autopatch to see which groups of devices are targeted with a hotpatch policy by going to the **Windows Update** > **Quality Updates** page. +1. Ensure the hotpatch update policy is set to **Allow**. +1. On the device, select **Start** > **Settings** > **Windows Update** > **Advanced options** > **Configured update policies** > find **Enable hotpatching when available**. This setting indicates that the device is enrolled in hotpatch updates as configured by Autopatch. + +### Step 4: Disable compiled hybrid PE usage (CHPE) (Arm64 CPU only) + +For more information, see [Arm 64 devices must disable compiled hybrid PE usage (CHPE) (Arm 64 CPU Only)](#arm-64-devices-must-disable-compiled-hybrid-pe-usage-chpe-arm-64-cpu-only). + +### Step 5: Use Event viewer to verify the device has hotpatch updates turned on + +1. Right-click on the **Start** menu, and select **Event viewer**. +1. Search for **AllowRebootlessUpdates** in the filter. If AllowRebootlessUpdates is set to `1`, the device is enrolled in the Autopatch update policy and has hotpatch updates turned on: + +`` +"data": { +"payload": "{\"Orchestrator\":{\"UpdatePolicy\":{\"Update/AllowRebootlessUpdates\":true}}}", +"isEnrolled": 1, +"isCached": 1, +"vbsState": 2, +`` + +### Step 6: Check Windows Logs for any hotpatch errors + +Hotpatch updates provide an inbox monitor service that checks for the health of the updates installed on the device. If the monitor service detects an error, the service logs an event in the Windows Application Logs. If there's a critical error, the device installs the standard (LCU) update to ensure the device is fully secure. + +1. Right-click on the **Start** menu, and select **Event viewer**. +1. Search for **hotpatch** in the filter to view the logs. diff --git a/windows/deployment/windows-autopatch/overview/windows-autopatch-faq.yml b/windows/deployment/windows-autopatch/overview/windows-autopatch-faq.yml index 899e555ff1..6213202ab5 100644 --- a/windows/deployment/windows-autopatch/overview/windows-autopatch-faq.yml +++ b/windows/deployment/windows-autopatch/overview/windows-autopatch-faq.yml @@ -4,7 +4,7 @@ metadata: description: Answers to frequently asked questions about Windows Autopatch. ms.service: windows-client ms.topic: faq - ms.date: 03/31/2025 + ms.date: 04/11/2025 audience: itpro ms.localizationpriority: medium manager: aaroncz @@ -97,6 +97,59 @@ sections: - question: Can I configure when to move to the next ring or is it controlled by Windows Autopatch? answer: | You're in full control over when updates are deployed to their devices. Autopatch groups will recommend a set of intelligent defaults but those are fully customizable so that you can achieve your desired rollout. + - name: Hotpatch updates + questions: + - question: What are the licensing requirements for hotpatch updates? + answer: | + Windows 11 Enterprise E3 or E5, Windows 11 Enterprise F3 or F5, Windows 11 Education A3 or A5, or a Windows 365 Enterprise license. For more information, see [Prerequisites](../prepare/windows-autopatch-prerequisites.md). + - question: Can I still restart devices as often as I want? + answer: | + Yes, devices that install hotpatch updates are protected the moment the update is installed. However, if a user or your IT Admin wishes to restart the PC you can do it anytime. The device restarts and runs the hotpatch updates. + - question: Can I use hotpatch updates on Arm64 devices? + answer: | + Yes, hotpatch updates are available for Arm64 devices. For more information, see [Arm 64 devices must disable compiled hybrid PE usage (CHPE) (Arm 64 CPU Only)](../manage/windows-autopatch-hotpatch-updates.md#arm-64-devices-must-disable-compiled-hybrid-pe-usage-chpe-arm-64-cpu-only)). + - question: What is the default hotpatch behavior on Windows Home or Pro devices? + answer: | + Hotpatch updates aren't available to Home or Pro devices. Hotpatching requires domain admin or group policy. It's available only via Windows Autopatch update policy, which includes Windows 365 Enterprise, E3/E5, F3 and A3/A5 licenses. + - question: How do I enroll devices to receive hotpatch updates? + answer: | + For more information, see [Enroll devices to receive hotpatch updates](../manage/windows-autopatch-hotpatch-updates.md#enroll-devices-to-receive-hotpatch-updates). + - question: What if some devices in my hotpatch policy aren't eligible for hotpatch updates? + answer: | + For more information on eligibility, see [Prerequisites](../prepare/windows-autopatch-prerequisites.md) and [ineligible devices](../manage/windows-autopatch-hotpatch-updates.md#ineligible-devices). + - question: How is hotpatching different for Windows 11 Enterprise and Windows Server 2025? + answer: | + For more information, see [Hotpatch on Windows 11 Enterprise or Windows Server 2025](../manage/windows-autopatch-hotpatch-updates.md#hotpatch-on-windows-11-enterprise-or-windows-server-2025). + - question: How can I tell which of my devices installed a hotpatch update? + answer: | + Devices receiving the hotpatch update have a different KB number tracking the release and a different OS version than devices receiving the standard update that requires a restart. The monthly KB release articles indicate if the KB installed is hotpatch capable and the corresponding OS version. The following Windows Update message appears “Great news! The latest security update was installed without a restart.” + - question: What if I restart a device after receiving a hotpatch update? + answer: | + The device stays on the hotpatch update KB/OS version after a restart. It won't receive any new features as part of the regular servicing track until the next quarterly cumulative baseline update. + - question: Do hotpatch updates only update common system binaries loaded in third-party processes or only Microsoft processes? + answer: | + Hotpatch updates aren't limited to Microsoft processes. Hotpatch updates are only created for OS binaries. Any process loading OS binaries that have hotpatch updates installed are updated before the application or operating system uses the binaries. This includes common system dynamic link libraries (DLLs) like ntdll.dll. + - question: How can I find out if a hotpatch update was applied to the specific DLL? + answer: | + You can see the hotpatch modules in the memory dump. Symbols for hotpatched DLLs depend on the function that receives the update. Some code that is hotpatch-updated could be public (symbols), while other functions could be private (no symbols). + - question: Are there kernel-mode hotpatch updates? + answer: | + Yes, there are kernel-mode hotpatch updates. + - question: What does a failure to apply a hotpatch update look like? + answer: | + Hotpatch failures are the same as CBS failures when installing other KBs (not enough disk space or download errors for example). In addition, hotpatch update errors are recorded in the event logs. Search the system log for the keyword “hotpatch” to see if your system encountered any errors. + - question: Can you switch from hotpatch update to the Standard Windows monthly updates? + answer: | + Yes, you can. You can manually download the standard Windows monthly update from the Microsoft Update Catalog. In this case, the device stops receiving hotpatch updates and receives standard Windows updates until the month after the next baseline update. Since the device is still enrolled in hotpatching, the device automatically rejoins the hotpatch cadence of updates after the update is released on the baseline month. + - question: How do hotpatch update events show up in audit logs? + answer: | + Process explorer shows it loaded in memory OS ``_hotpatch`` loaded in memory. The hotpatch update KB includes a link to the CSV file listing the update payload. + - question: Can I get security alerts through Event Tracing for Windows (ETW) about hotpatch updates? + answer: | + Hotpatch events are captured in the audit log. Search for “hotpatch” in the audit log to find related errors if any were captured. + - question: Do I need to test hotpatch updates if I already test monthly updates? + answer: | + You should test hotpatch updates when released 8 times a year (according to plan) and the regular monthly updates 12 times a year. There are no hotpatch updates for you to test in January (1B), April (4B), July (7B), or October (10B). - name: Support questions: - question: Does Windows Autopatch Support Dual Scan for Windows Update? diff --git a/windows/deployment/windows-autopatch/whats-new/windows-autopatch-whats-new-2025.md b/windows/deployment/windows-autopatch/whats-new/windows-autopatch-whats-new-2025.md index d51b82e4f8..4754455eb7 100644 --- a/windows/deployment/windows-autopatch/whats-new/windows-autopatch-whats-new-2025.md +++ b/windows/deployment/windows-autopatch/whats-new/windows-autopatch-whats-new-2025.md @@ -1,7 +1,7 @@ --- title: What's new 2025 description: This article lists the 2025 feature releases and any corresponding Message center post numbers. -ms.date: 03/31/2025 +ms.date: 04/11/2025 ms.service: windows-client ms.subservice: autopatch ms.topic: whats-new @@ -21,6 +21,15 @@ This article lists new and updated feature releases, and service releases, with Minor corrections such as typos, style, or formatting issues aren't listed. +## April 2025 + +### April feature releases or updates + +| Article | Description | +| ----- | ----- | +| [Hotpatch updates](../manage/windows-autopatch-hotpatch-updates.md) | Added [troubleshooting](../manage/windows-autopatch-hotpatch-updates.md#troubleshoot-hotpatch-updates) section | +| [FAQ](../overview/windows-autopatch-faq.yml) | Added [hotpatch updates](../overview/windows-autopatch-faq.yml#hotpatch-updates) section to the FAQ. | + ## March 2025 ### March feature releases or updates diff --git a/windows/security/application-security/application-control/app-control-for-business/design/microsoft-recommended-driver-block-rules.md b/windows/security/application-security/application-control/app-control-for-business/design/microsoft-recommended-driver-block-rules.md index 67506d5785..533c043649 100644 --- a/windows/security/application-security/application-control/app-control-for-business/design/microsoft-recommended-driver-block-rules.md +++ b/windows/security/application-security/application-control/app-control-for-business/design/microsoft-recommended-driver-block-rules.md @@ -19,7 +19,7 @@ Microsoft has strict requirements for code running in kernel. So, malicious acto - Malicious behaviors (malware) or certificates used to sign malware - Behaviors that aren't malicious but circumvent the Windows Security Model and can be exploited by attackers to elevate privileges in the Windows kernel -Drivers can be submitted to Microsoft for security analysis at the [Microsoft Security Intelligence Driver Submission page](https://www.microsoft.com/en-us/wdsi/driversubmission). For more information about driver submission, see [Improve kernel security with the new Microsoft Vulnerable and Malicious Driver Reporting Center](https://www.microsoft.com/security/blog/2021/12/08/improve-kernel-security-with-the-new-microsoft-vulnerable-and-malicious-driver-reporting-center/). To report an issue or request a change to the blocklist, including updating a block rule once a driver has been fixed, visit the [Microsoft Security Intelligence portal](https://www.microsoft.com/wdsi) or submit feedback on this article. +Drivers can be submitted to Microsoft for security analysis at the [Microsoft Security Intelligence Driver Submission page](https://www.microsoft.com/wdsi/driversubmission). For more information about driver submission, see [Improve kernel security with the new Microsoft Vulnerable and Malicious Driver Reporting Center](https://www.microsoft.com/security/blog/2021/12/08/improve-kernel-security-with-the-new-microsoft-vulnerable-and-malicious-driver-reporting-center/). To report an issue or request a change to the blocklist, including updating a block rule once a driver has been fixed, visit the [Microsoft Security Intelligence portal](https://www.microsoft.com/wdsi). > [!NOTE] > Blocking drivers can cause devices or software to malfunction, and in rare cases, lead to blue screen. The vulnerable driver blocklist is not guaranteed to block every driver found to have vulnerabilities. Microsoft attempts to balance the security risks from vulnerable drivers with the potential impact on compatibility and reliability to produce the blocklist. As always, Microsoft recommends using an explicit allow list approach to security wherever possible. @@ -36,9 +36,9 @@ With Windows 11 2022 update, the vulnerable driver blocklist is enabled by defa > > - For Windows Insiders, the option to turn Microsoft's vulnerable driver blocklist on or off using **Windows Security** settings is grayed out when HVCI, Smart App Control, or S mode is enabled. You must disable HVCI or Smart App Control, or switch the device out of S mode, and restart the device before you can turn off the Microsoft vulnerable driver blocklist. -The blocklist is updated with each new major release of Windows, typically 1-2 times per year, including most recently with the Windows 11 2022 update released in September 2022. The most current blocklist is now also available for Windows 10 20H2 and Windows 11 21H2 users as an optional update from Windows Update. Microsoft will occasionally publish future updates through regular Windows servicing. +The blocklist is updated with each new major release of Windows, typically 1-2 times per year. The most current blocklist is now also available for Windows 10 20H2 and Windows 11 21H2 users as an optional update from Windows Update. Microsoft will occasionally publish future updates through regular Windows servicing. -Customers who always want the most up-to-date driver blocklist can also use App Control for Business to apply the latest recommended driver blocklist contained in this article. For your convenience, we provide a download of the most up-to-date vulnerable driver blocklist along with instructions to apply it on your computer at the end of this article. Otherwise, use the following XML to create your own custom App Control policies. +Customers who always want the most up-to-date driver blocklist can also use App Control for Business to apply the latest recommended driver blocklist. For your convenience, we provide a download of the most up-to-date vulnerable driver blocklist along with instructions to apply it on your computer at the end of this article. ## Blocking vulnerable drivers using App Control @@ -49,7 +49,7 @@ Microsoft recommends enabling [HVCI](../../../../hardware-security/enable-virtua ## Steps to download and apply the vulnerable driver blocklist binary -If you prefer to apply the [vulnerable driver blocklist](#vulnerable-driver-blocklist-xml) exactly as shown, follow these steps: +If you prefer to apply the vulnerable driver blocklist, follow these steps: 1. Download the [App Control policy refresh tool](https://aka.ms/refreshpolicy) 2. Download and extract the [vulnerable driver blocklist binaries](https://aka.ms/VulnerableDriverBlockList) @@ -70,4978 +70,13 @@ To check that the policy was successfully applied on your computer: ## Vulnerable driver blocklist XML -> [!IMPORTANT] -> The following policy contains **Allow All** rules. If your version of Windows supports App Control multiple policies, we recommend deploying this policy alongside any existing App Control policies. If you do plan to merge this policy with another policy, you may need to remove the **Allow All** rules before merging it if the other policy applies an explicit allow list. For more information, see [Create an App Control Deny Policy](create-appcontrol-deny-policy.md#guidance-on-creating-app-control-deny-policies). +The recommended blocklist xml policy file can be downloaded from the [Microsoft Download Center](https://aka.ms/VulnerableDriverBlockList). + +This policy contains **Allow All** rules. If your version of Windows supports App Control multiple policies, we recommend deploying this policy alongside any existing App Control policies. If you do plan to merge this policy with another policy, you may need to remove the **Allow All** rules before merging it if the other policy applies an explicit allow list. For more information, see [Create an App Control Deny Policy](create-appcontrol-deny-policy.md#guidance-on-creating-app-control-deny-policies). > [!NOTE] > To use this policy with Windows Server 2016, you must convert the policy XML on a device running a newer operating system. -The following recommended blocklist xml policy file can also be downloaded from the [Microsoft Download Center](https://aka.ms/VulnerableDriverBlockList). - -```xml - - - 10.0.27770.0 - {2E07F7E4-194C-4D20-B7C9-6F44A6C5A234} - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - 0 - - - - Microsoft Windows Driver Policy - - - - - 10.0.27770.0 - - - - {A244370E-44C9-4C06-B551-F6016E563076} - -``` - ## More information - [Merge App Control for Business policies](../deployment/merge-appcontrol-policies.md) diff --git a/windows/security/application-security/application-control/toc.yml b/windows/security/application-security/application-control/toc.yml index 3a7a1fa706..438d97451c 100644 --- a/windows/security/application-security/application-control/toc.yml +++ b/windows/security/application-security/application-control/toc.yml @@ -9,6 +9,8 @@ items: items: - name: Overview href: user-account-control/index.md + - name: UAC Architecture + href: user-account-control/architecture.md - name: How UAC works href: user-account-control/how-it-works.md - name: UAC settings and configuration diff --git a/windows/security/application-security/application-control/user-account-control/architecture.md b/windows/security/application-security/application-control/user-account-control/architecture.md new file mode 100644 index 0000000000..7f33e45173 --- /dev/null +++ b/windows/security/application-security/application-control/user-account-control/architecture.md @@ -0,0 +1,129 @@ +--- +title: User Account Control architecture +description: Learn about the User Account Control (UAC) architecture. +ms.topic: concept-article +ms.date: 04/15/2025 +--- + +# UAC Architecture + +The following diagram details the UAC architecture. + +:::image type="content" source="images/uac-architecture.gif" alt-text="Diagram that describes the UAC architecture."::: + +## User + +- **User performs operation requiring privilege**: If the operation changes the file system or registry, Virtualization is called. All other operations call ShellExecute. +- **ShellExecute**: ShellExecute calls CreateProcess. ShellExecute looks for the `ERROR_ELEVATION_REQUIRED` error from CreateProcess. If it receives the error, ShellExecute calls the Application Information service to attempt to perform the requested task with the elevated prompt. +- **CreateProcess**: If the application requires elevation, CreateProcess rejects the call with `ERROR_ELEVATION_REQUIRED`. + +## System + +- **Application Information service**: + - A system service that helps start apps that require one or more elevated privileges or user rights to run. + - The Application Information service helps start such apps by creating a new process for the application with an administrative user's full access token when elevation is required. + - Depending on the configured policies, the user might give consent. + +- **Elevating an ActiveX install**: + - If ActiveX isn't installed, the system checks the UAC slider level. + - If ActiveX is installed, the **User Account Control: Switch to the secure desktop when prompting for elevation** Group Policy setting is checked. + +- **Check UAC slider level**: UAC has a slider to select from four levels of notification: + - **Always notify** will: + - Notify you when programs try to install software or make changes to your computer. + - Notify you when you make changes to Windows settings. + - Freeze other tasks until you respond. + - Recommended if you often install new software or visit unfamiliar websites. + - **Notify me only when programs try to make changes to my computer** will: + - Notify you when programs try to install software or make changes to your computer. + - Not notify you when you make changes to Windows settings. + - Freeze other tasks until you respond. + - Recommended if you don't often install apps or visit unfamiliar websites. + - **Notify me only when programs try to make changes to my computer (do not dim my desktop)** will: + - Notify you when programs try to install software or make changes to your computer. + - Not notify you when you make changes to Windows settings. + - Not freeze other tasks until you respond. + - Not recommended. Choose this option only if it takes a long time to dim the desktop on your computer. + - **Never notify (Disable UAC prompts)** will: + - Not notify you when programs try to install software or make changes to your computer. + - Not notify you when you make changes to Windows settings. + - Not freeze other tasks until you respond. + - Not recommended due to security concerns. + +- **Secure desktop enabled**: The **User Account Control: Switch to the secure desktop when prompting for elevation** policy setting is checked: + - If the secure desktop is enabled, all elevation requests go to the secure desktop regardless of prompt behavior policy settings for administrators and standard users. + - If the secure desktop isn't enabled, all elevation requests go to the interactive user's desktop, and the per-user settings for administrators and standard users are used. + +- **CreateProcess**: + - CreateProcess calls AppCompat, Fusion, and Installer detection to assess if the app requires elevation. + - The file is then inspected to determine its requested execution level, which is stored in the application manifest for the file. + - CreateProcess fails if the requested execution level specified in the manifest doesn't match the access token and returns an error (ERROR_ELEVATION_REQUIRED) to ShellExecute. + +- **AppCompat**: + - The AppCompat database stores information in the application compatibility fix entries for an application. + +- **Fusion**: + - The Fusion database stores information from application manifests that describe the applications. + - The manifest schema is updated to add a new requested execution level field. + +- **Installer detection**: + - Installer detection detects setup files and helps prevent installations from being run without the user's knowledge and consent. + +## Kernel + +- **Virtualization**: Virtualization technology ensures that noncompliant apps don't silently fail to run or fail in a way that the cause can't be determined. UAC also provides file and registry virtualization and logging for applications that write to protected areas. +- **File system and registry**: The per-user file and registry virtualization redirects per-computer registry and file write requests to equivalent per-user locations. Read requests are redirected to the virtualized per-user location first and to the per-computer location second. + +The slider never turns off UAC completely. If you set it to **Never notify**, it will: + +- Keep the UAC service running +- Cause all elevation request initiated by administrators to be autoapproved without showing a UAC prompt +- Automatically deny all elevation requests for standard users + +> [!IMPORTANT] +> In order to fully disable UAC, you must disable the policy **User Account Control: Run all administrators in Admin Approval Mode**. Some Universal Windows Platform apps might not work when UAC is disabled. + +## Virtualization + +Because system administrators in enterprise environments attempt to secure systems, many line-of-business (LOB) applications are designed to use only a standard user access token. As a result, you don't need to replace most apps when UAC is turned on. + +Windows includes file and registry virtualization technology for apps that aren't UAC-compliant and that requires an administrator's access token to run correctly. When an administrative app that isn't UAC-compliant attempts to write to a protected folder, such as *Program Files*, UAC gives the app its own virtualized view of the resource it's attempting to change. The virtualized copy is maintained in the user's profile. This strategy creates a separate copy of the virtualized file for each user that runs the noncompliant app. + +Most app tasks operate properly by using virtualization features. Although virtualization allows most applications to run, it's a short-term fix and not a long-term solution. App developers should modify their apps to be compliant as soon as possible, rather than relying on file, folder, and registry virtualization. + +Virtualization isn't an option in the following scenarios: + +- Virtualization doesn't apply to apps that are elevated and run with a full administrative access token +- Virtualization supports only 32-bit apps. Nonelevated 64-bit apps receive an access denied message when they attempt to acquire a handle (a unique identifier) to a Windows object. Native Windows 64-bit apps are required to be compatible with UAC and to write data into the correct locations +- Virtualization is disabled if the app includes an app manifest with a requested execution level attribute + +## Request execution levels + +An app manifest is an XML file that describes and identifies the shared and private side-by-side assemblies that an app should bind to at run time. The app manifest includes entries for UAC app compatibility purposes. Administrative apps that include an entry in the app manifest prompt the user for permission to access the user's access token. Although they lack an entry in the app manifest, most administrative app can run without modification by using app compatibility fixes. App compatibility fixes are database entries that enable applications that aren't UAC-compliant to work properly. + +All UAC-compliant apps should have a requested execution level added to the application manifest. If the application requires administrative access to the system, marking the app with a requested execution level of *require administrator* ensures that the system identifies this program as an administrative app, and performs the necessary elevation steps. Requested execution levels specify the privileges required for an app. + +## Installer detection technology + +Installation programs are apps designed to deploy software. Most installation programs write to system directories and registry keys. These protected system locations are typically writeable only by an administrator in Installer detection technology, which means that standard users don't have sufficient access to install programs. Windows heuristically detects installation programs and requests administrator credentials or approval from the administrator user in order to run with access privileges. Windows also heuristically detects updates and programs that uninstall applications. One of the design goals of UAC is to prevent installations from being run without the user's knowledge and consent because installation programs write to protected areas of the file system and registry. + +Installer detection only applies to: + +- 32-bit executable files +- Applications without a requested execution level attribute +- Interactive processes running as a standard user with UAC enabled + +Before a 32-bit process is created, the following attributes are checked to determine whether it's an installer: + +- File name includes keywords such as "install," "setup," or "update." +- Versioning Resource fields contain the following keywords: Vendor, Company Name, Product Name, File Description, Original Filename, Internal Name, and Export Name. +- Keywords in the side-by-side manifest are embedded in the executable file. +- Keywords in specific StringTable entries are linked in the executable file. +- Key attributes in the resource script data are linked in the executable file. +- Executable file contains targeted sequences of bytes. + +> [!NOTE] +> The keywords and sequences of bytes were derived from common characteristics observed from various installer technologies. + +> [!NOTE] +> The *User Account Control: Detect application installations and prompt for elevation* policy must be enabled for installer detection to detect installation programs. For more information, see [User Account Control settings list](settings-and-configuration.md#user-account-control-settings-list). \ No newline at end of file diff --git a/windows/security/application-security/application-control/user-account-control/how-it-works.md b/windows/security/application-security/application-control/user-account-control/how-it-works.md index 628efba7cf..0d85a5660e 100644 --- a/windows/security/application-security/application-control/user-account-control/how-it-works.md +++ b/windows/security/application-security/application-control/user-account-control/how-it-works.md @@ -2,7 +2,7 @@ title: How User Account Control works description: Learn about User Account Control (UAC) components and how it interacts with the end users. ms.topic: concept-article -ms.date: 03/26/2024 +ms.date: 04/15/2025 --- # How User Account Control works @@ -34,8 +34,8 @@ When a user signs in, the system creates an access token for that user. The acce When an administrator logs on, two separate access tokens are created for the user: a *standard user access token* and an *administrator access token*. The standard user access token: - Contains the same user-specific information as the administrator access token, but the administrative Windows privileges and SIDs are removed -- It's used to start applications that don't perform administrative tasks (standard user apps) -- It's used to display the desktop by executing the process *explorer.exe*. Explorer.exe is the parent process from which all other user-initiated processes inherit their access token. As a result, all apps run as a standard user unless a user provides consent or credentials to approve an app to use a full administrative access token +- Is used to start applications that don't perform administrative tasks (standard user apps) +- Is used to display the desktop by executing the process *explorer.exe*. Explorer.exe is the parent process from which all other user-initiated processes inherit their access token. As a result, all apps run as a standard user unless a user provides consent or credentials to approve an app to use a full administrative access token A user that is a member of the Administrators group can sign in, browse the Web, and read e-mail while using a standard user access token. When the administrator needs to perform a task that requires the administrator access token, Windows automatically prompts the user for approval. This prompt is called an *elevation prompt*, and its behavior can be configured via policy or registry. @@ -91,105 +91,8 @@ The elevation process is further secured by directing the prompt to the *secure When an executable file requests elevation, the *interactive desktop*, also called the *user desktop*, is switched to the secure desktop. The secure desktop dims the user desktop and displays an elevation prompt that must be responded to before continuing. When the user selects **Yes** or **No**, the desktop switches back to the user desktop. > [!NOTE] -> Starting in **Windows Server 2019**, it's not possible to paste the content of the clipboard on the secure desktop. This is the same behavior of the currently supported Windows client OS versions. +> Starting in **Windows Server 2019**, it's not possible to paste the content of the clipboard on the secure desktop. This behavior is the same as the currently supported Windows client OS versions. Malware can present an imitation of the secure desktop, but when the **User Account Control: Behavior of the elevation prompt for administrators in Admin Approval Mode** policy setting is set to **Prompt for consent**, the malware doesn't gain elevation if the user selects **Yes** on the imitation. If the policy setting is set to **Prompt for credentials**, malware imitating the credential prompt might be able to gather the credentials from the user. However, the malware doesn't gain elevated privilege and the system has other protections that mitigate malware from taking control of the user interface even with a harvested password. While malware could present an imitation of the secure desktop, this issue can't occur unless a user previously installed the malware on the PC. Because processes requiring an administrator access token can't silently install when UAC is enabled, the user must explicitly provide consent by selecting **Yes** or by providing administrator credentials. The specific behavior of the UAC elevation prompt is dependent upon security policies. - -## UAC Architecture - -The following diagram details the UAC architecture. - -:::image type="content" source="images/uac-architecture.gif" alt-text="Diagram that describes the UAC architecture."::: - -To better understand each component, review the following tables: - -### User - -|Component|Description| -|--- |--- | -|User performs operation requiring privilege|If the operation changes the file system or registry, Virtualization is called. All other operations call ShellExecute.| -|ShellExecute|ShellExecute calls CreateProcess. ShellExecute looks for the ERROR_ELEVATION_REQUIRED error from CreateProcess. If it receives the error, ShellExecute calls the Application Information service to attempt to perform the requested task with the elevated prompt.| -|CreateProcess|If the application requires elevation, CreateProcess rejects the call with ERROR_ELEVATION_REQUIRED.| - -### System - -|Component|Description| -|--- |--- | -|Application Information service|A system service that helps start apps that require one or more elevated privileges or user rights to run, such as local administrative tasks, and apps that require higher integrity levels. The Application Information service helps start such apps by creating a new process for the application with an administrative user's full access token when elevation is required. Depending on the configured policies, the user might give consent.| -|Elevating an ActiveX install|If ActiveX isn't installed, the system checks the UAC slider level. If ActiveX is installed, the **User Account Control: Switch to the secure desktop when prompting for elevation** Group Policy setting is checked.| -|Check UAC slider level|UAC has a slider to select from four levels of notification.