deepblue/windows-itpro-docs
1
0
Fork 0
mirror of https://github.com/MicrosoftDocs/windows-itpro-docs.git synced 2025-05-11 21:07:23 +00:00
Code Issues Actions 2 Packages Projects Releases Wiki Activity

resolve merge conflict

Browse Source
This commit is contained in:
Aaron Czechowski 2024-08-15 16:27:43 -07:00
commit 2745f86859
73 changed files with 202 additions and 2271 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
.openpublishing.redirection.education.json
View File

@ -92,7 +92,7 @@
},
{
"source_path": "education/windows/enable-s-mode-on-surface-go-devices.md",
"redirect_url": "/windows/deployment/s-mode",
"redirect_url": "/previous-versions/windows/it-pro/windows-10/deployment/s-mode/index",
"redirect_document_id": false
},
{
@ -147,7 +147,7 @@
},
{
"source_path": "education/windows/test-windows10s-for-edu.md",
"redirect_url": "/windows/deployment/s-mode",
"redirect_url": "/previous-versions/windows/it-pro/windows-10/deployment/s-mode/index",
"redirect_document_id": false
},
{

50
.openpublishing.redirection.json
View File

@ -10997,7 +10997,7 @@
},
{
"source_path": "windows/plan/act-technical-reference.md",
"redirect_url": "/windows/deployment/planning/compatibility-administrator-users-guide",
"redirect_url": "/previous-versions/windows/it-pro/windows-10/deployment/compatibility/compatibility-administrator-users-guide",
"redirect_document_id": false
},
{
@ -11042,12 +11042,12 @@
},
{
"source_path": "windows/plan/applying-filters-to-data-in-the-sua-tool.md",
"redirect_url": "/windows/deployment/planning/applying-filters-to-data-in-the-sua-tool",
"redirect_url": "/previous-versions/windows/it-pro/windows-10/deployment/compatibility/applying-filters-to-data-in-the-sua-tool",
"redirect_document_id": false
},
{
"source_path": "windows/plan/available-data-types-and-operators-in-compatibility-administrator.md",
"redirect_url": "/windows/deployment/planning/available-data-types-and-operators-in-compatibility-administrator",
"redirect_url": "/previous-versions/windows/it-pro/windows-10/deployment/compatibility/available-data-types-and-operators-in-compatibility-administrator",
"redirect_document_id": false
},
{
@ -11082,17 +11082,17 @@
},
{
"source_path": "windows/plan/compatibility-administrator-users-guide.md",
"redirect_url": "/windows/deployment/planning/compatibility-administrator-users-guide",
"redirect_url": "/previous-versions/windows/it-pro/windows-10/deployment/compatibility/compatibility-administrator-users-guide",
"redirect_document_id": false
},
{
"source_path": "windows/plan/compatibility-fix-database-management-strategies-and-deployment.md",
"redirect_url": "/windows/deployment/planning/compatibility-fix-database-management-strategies-and-deployment",
"redirect_url": "/previous-versions/windows/it-pro/windows-10/deployment/compatibility/compatibility-fix-database-management-strategies-and-deployment",
"redirect_document_id": false
},
{
"source_path": "windows/plan/compatibility-fixes-for-windows-8-windows-7-and-windows-vista.md",
"redirect_url": "/windows/deployment/planning/compatibility-fixes-for-windows-8-windows-7-and-windows-vista",
"redirect_url": "/previous-versions/windows/it-pro/windows-10/deployment/compatibility/compatibility-fixes-for-windows-8-windows-7-and-windows-vista",
"redirect_document_id": false
},
{
@ -11112,12 +11112,12 @@
},
{
"source_path": "windows/plan/creating-a-custom-compatibility-fix-in-compatibility-administrator.md",
"redirect_url": "/windows/deployment/planning/creating-a-custom-compatibility-fix-in-compatibility-administrator",
"redirect_url": "/previous-versions/windows/it-pro/windows-10/deployment/compatibility/creating-a-custom-compatibility-fix-in-compatibility-administrator",
"redirect_document_id": false
},
{
"source_path": "windows/plan/creating-a-custom-compatibility-mode-in-compatibility-administrator.md",
"redirect_url": "/windows/deployment/planning/creating-a-custom-compatibility-mode-in-compatibility-administrator",
"redirect_url": "/previous-versions/windows/it-pro/windows-10/deployment/compatibility/creating-a-custom-compatibility-mode-in-compatibility-administrator",
"redirect_document_id": false
},
{
@ -11127,7 +11127,7 @@
},
{
"source_path": "windows/plan/creating-an-apphelp-message-in-compatibility-administrator.md",
"redirect_url": "/windows/deployment/planning/creating-an-apphelp-message-in-compatibility-administrator",
"redirect_url": "/previous-versions/windows/it-pro/windows-10/deployment/compatibility/creating-an-apphelp-message-in-compatibility-administrator",
"redirect_document_id": false
},
{
@ -11202,7 +11202,7 @@
},
{
"source_path": "windows/plan/enabling-and-disabling-compatibility-fixes-in-compatibility-administrator.md",
"redirect_url": "/windows/deployment/planning/enabling-and-disabling-compatibility-fixes-in-compatibility-administrator",
"redirect_url": "/previous-versions/windows/it-pro/windows-10/deployment/compatibility/enabling-and-disabling-compatibility-fixes-in-compatibility-administrator",
"redirect_document_id": false
},
{
@ -11222,7 +11222,7 @@
},
{
"source_path": "windows/plan/fixing-applications-by-using-the-sua-tool.md",
"redirect_url": "/windows/deployment/planning/fixing-applications-by-using-the-sua-tool",
"redirect_url": "/previous-versions/windows/it-pro/windows-10/deployment/compatibility/fixing-applications-by-using-the-sua-tool",
"redirect_document_id": false
},
{
@ -11242,7 +11242,7 @@
},
{
"source_path": "windows/plan/installing-and-uninstalling-custom-compatibility-databases-in-compatibility-administrator.md",
"redirect_url": "/windows/deployment/planning/installing-and-uninstalling-custom-compatibility-databases-in-compatibility-administrator",
"redirect_url": "/previous-versions/windows/it-pro/windows-10/deployment/compatibility/installing-and-uninstalling-custom-compatibility-databases-in-compatibility-administrator",
"redirect_document_id": false
},
{
@ -11267,7 +11267,7 @@
},
{
"source_path": "windows/plan/managing-application-compatibility-fixes-and-custom-fix-databases.md",
"redirect_url": "/windows/deployment/planning/managing-application-compatibility-fixes-and-custom-fix-databases",
"redirect_url": "/previous-versions/windows/it-pro/windows-10/deployment/compatibility/managing-application-compatibility-fixes-and-custom-fix-databases",
"redirect_document_id": false
},
{
@ -11317,12 +11317,12 @@
},
{
"source_path": "windows/plan/searching-for-fixed-applications-in-compatibility-administrator.md",
"redirect_url": "/windows/deployment/planning/searching-for-fixed-applications-in-compatibility-administrator",
"redirect_url": "/previous-versions/windows/it-pro/windows-10/deployment/compatibility/searching-for-fixed-applications-in-compatibility-administrator",
"redirect_document_id": false
},
{
"source_path": "windows/plan/searching-for-installed-compatibility-fixes-with-the-query-tool-in-compatibility-administrator.md",
"redirect_url": "/windows/deployment/planning/searching-for-installed-compatibility-fixes-with-the-query-tool-in-compatibility-administrator",
"redirect_url": "/previous-versions/windows/it-pro/windows-10/deployment/compatibility/searching-for-installed-compatibility-fixes-with-the-query-tool-in-compatibility-administrator",
"redirect_document_id": false
},
{
@ -11367,7 +11367,7 @@
},
{
"source_path": "windows/plan/showing-messages-generated-by-the-sua-tool.md",
"redirect_url": "/windows/deployment/planning/showing-messages-generated-by-the-sua-tool",
"redirect_url": "/previous-versions/windows/it-pro/windows-10/deployment/compatibility/showing-messages-generated-by-the-sua-tool",
"redirect_document_id": false
},
{
@ -11382,12 +11382,12 @@
},
{
"source_path": "windows/plan/sua-users-guide.md",
"redirect_url": "/windows/deployment/planning/sua-users-guide",
"redirect_url": "/previous-versions/windows/it-pro/windows-10/deployment/compatibility/sua-users-guide",
"redirect_document_id": false
},
{
"source_path": "windows/plan/tabs-on-the-sua-tool-interface.md",
"redirect_url": "/windows/deployment/planning/tabs-on-the-sua-tool-interface",
"redirect_url": "/previous-versions/windows/it-pro/windows-10/deployment/compatibility/tabs-on-the-sua-tool-interface",
"redirect_document_id": false
},
{
@ -11402,7 +11402,7 @@
},
{
"source_path": "windows/plan/testing-your-application-mitigation-packages.md",
"redirect_url": "/windows/deployment/planning/testing-your-application-mitigation-packages",
"redirect_url": "/previous-versions/windows/it-pro/windows-10/deployment/compatibility/testing-your-application-mitigation-packages",
"redirect_document_id": false
},
{
@ -11427,7 +11427,7 @@
},
{
"source_path": "windows/plan/understanding-and-using-compatibility-fixes.md",
"redirect_url": "/windows/deployment/planning/understanding-and-using-compatibility-fixes",
"redirect_url": "/previous-versions/windows/it-pro/windows-10/deployment/compatibility/understanding-and-using-compatibility-fixes",
"redirect_document_id": false
},
{
@ -11442,27 +11442,27 @@
},
{
"source_path": "windows/plan/using-the-compatibility-administrator-tool.md",
"redirect_url": "/windows/deployment/planning/using-the-compatibility-administrator-tool",
"redirect_url": "/previous-versions/windows/it-pro/windows-10/deployment/compatibility/using-the-compatibility-administrator-tool",
"redirect_document_id": false
},
{
"source_path": "windows/plan/using-the-sdbinstexe-command-line-tool.md",
"redirect_url": "/windows/deployment/planning/using-the-sdbinstexe-command-line-tool",
"redirect_url": "/previous-versions/windows/it-pro/windows-10/deployment/compatibility/using-the-sdbinstexe-command-line-tool",
"redirect_document_id": false
},
{
"source_path": "windows/plan/using-the-sua-tool.md",
"redirect_url": "/windows/deployment/planning/using-the-sua-tool",
"redirect_url": "/previous-versions/windows/it-pro/windows-10/deployment/compatibility/using-the-sua-tool",
"redirect_document_id": false
},
{
"source_path": "windows/plan/using-the-sua-wizard.md",
"redirect_url": "/windows/deployment/planning/using-the-sua-wizard",
"redirect_url": "/previous-versions/windows/it-pro/windows-10/deployment/compatibility/using-the-sua-wizard",
"redirect_document_id": false
},
{
"source_path": "windows/plan/viewing-the-events-screen-in-compatibility-administrator.md",
"redirect_url": "/windows/deployment/planning/viewing-the-events-screen-in-compatibility-administrator",
"redirect_url": "/previous-versions/windows/it-pro/windows-10/deployment/compatibility/viewing-the-events-screen-in-compatibility-administrator",
"redirect_document_id": false
},
{

137
.openpublishing.redirection.windows-deployment.json
View File

@ -127,7 +127,7 @@
},
{
"source_path": "windows/deployment/planning/act-technical-reference.md",
"redirect_url": "/windows/deployment/planning/compatibility-administrator-users-guide",
"redirect_url": "/previous-versions/windows/it-pro/windows-10/deployment/compatibility/compatibility-administrator-users-guide",
"redirect_document_id": false
},
{
@ -1369,6 +1369,141 @@
"source_path": "windows/deployment/windows-autopatch/manage/windows-autopatch-windows-quality-update-signals.md",
"redirect_url": "/windows/deployment/windows-autopatch/manage/windows-autopatch-windows-quality-update-overview",
"redirect_document_id": true
},
{
"source_path": "windows/deployment/planning/available-data-types-and-operators-in-compatibility-administrator.md",
"redirect_url": "/previous-versions/windows/it-pro/windows-10/deployment/compatibility/available-data-types-and-operators-in-compatibility-administrator",
"redirect_document_id": false
},
{
"source_path": "windows/deployment/planning/compatibility-administrator-users-guide.md",
"redirect_url": "/previous-versions/windows/it-pro/windows-10/deployment/compatibility/compatibility-administrator-users-guide",
"redirect_document_id": false
},
{
"source_path": "windows/deployment/planning/compatibility-fix-database-management-strategies-and-deployment.md",
"redirect_url": "/previous-versions/windows/it-pro/windows-10/deployment/compatibility/compatibility-fix-database-management-strategies-and-deployment",
"redirect_document_id": false
},
{
"source_path": "windows/deployment/planning/creating-a-custom-compatibility-fix-in-compatibility-administrator.md",
"redirect_url": "/previous-versions/windows/it-pro/windows-10/deployment/compatibility/creating-a-custom-compatibility-fix-in-compatibility-administrator",
"redirect_document_id": false
},
{
"source_path": "windows/deployment/planning/creating-a-custom-compatibility-mode-in-compatibility-administrator.md",
"redirect_url": "/previous-versions/windows/it-pro/windows-10/deployment/compatibility/creating-a-custom-compatibility-mode-in-compatibility-administrator",
"redirect_document_id": false
},
{
"source_path": "windows/deployment/planning/creating-an-apphelp-message-in-compatibility-administrator.md",
"redirect_url": "/previous-versions/windows/it-pro/windows-10/deployment/compatibility/creating-an-apphelp-message-in-compatibility-administrator",
"redirect_document_id": false
},
{
"source_path": "windows/deployment/planning/enabling-and-disabling-compatibility-fixes-in-compatibility-administrator.md",
"redirect_url": "/previous-versions/windows/it-pro/windows-10/deployment/compatibility/enabling-and-disabling-compatibility-fixes-in-compatibility-administrator",
"redirect_document_id": false
},
{
"source_path": "windows/deployment/planning/installing-and-uninstalling-custom-compatibility-databases-in-compatibility-administrator.md",
"redirect_url": "/previous-versions/windows/it-pro/windows-10/deployment/compatibility/installing-and-uninstalling-custom-compatibility-databases-in-compatibility-administrator",
"redirect_document_id": false
},
{
"source_path": "windows/deployment/planning/managing-application-compatibility-fixes-and-custom-fix-databases.md",
"redirect_url": "/previous-versions/windows/it-pro/windows-10/deployment/compatibility/managing-application-compatibility-fixes-and-custom-fix-databases",
"redirect_document_id": false
},
{
"source_path": "windows/deployment/planning/searching-for-fixed-applications-in-compatibility-administrator.md",
"redirect_url": "/previous-versions/windows/it-pro/windows-10/deployment/compatibility/searching-for-fixed-applications-in-compatibility-administrator",
"redirect_document_id": false
},
{
"source_path": "windows/deployment/planning/searching-for-installed-compatibility-fixes-with-the-query-tool-in-compatibility-administrator.md",
"redirect_url": "/previous-versions/windows/it-pro/windows-10/deployment/compatibility/searching-for-installed-compatibility-fixes-with-the-query-tool-in-compatibility-administrator",
"redirect_document_id": false
},
{
"source_path": "windows/deployment/planning/testing-your-application-mitigation-packages.md",
"redirect_url": "/previous-versions/windows/it-pro/windows-10/deployment/compatibility/testing-your-application-mitigation-packages",
"redirect_document_id": false
},
{
"source_path": "windows/deployment/planning/understanding-and-using-compatibility-fixes.md",
"redirect_url": "/previous-versions/windows/it-pro/windows-10/deployment/compatibility/understanding-and-using-compatibility-fixes",
"redirect_document_id": false
},
{
"source_path": "windows/deployment/planning/using-the-compatibility-administrator-tool.md",
"redirect_url": "/previous-versions/windows/it-pro/windows-10/deployment/compatibility/using-the-compatibility-administrator-tool",
"redirect_document_id": false
},
{
"source_path": "windows/deployment/planning/using-the-sdbinstexe-command-line-tool.md",
"redirect_url": "/previous-versions/windows/it-pro/windows-10/deployment/compatibility/using-the-sdbinstexe-command-line-tool",
"redirect_document_id": false
},
{
"source_path": "windows/deployment/planning/viewing-the-events-screen-in-compatibility-administrator.md",
"redirect_url": "/previous-versions/windows/it-pro/windows-10/deployment/compatibility/viewing-the-events-screen-in-compatibility-administrator",
"redirect_document_id": false
},
{
"source_path": "windows/deployment/planning/compatibility-fixes-for-windows-8-windows-7-and-windows-vista.md",
"redirect_url": "/previous-versions/windows/it-pro/windows-10/deployment/compatibility/compatibility-fixes-for-windows-8-windows-7-and-windows-vista",
"redirect_document_id": false
},
{
"source_path": "windows/deployment/planning/applying-filters-to-data-in-the-sua-tool.md",
"redirect_url": "/previous-versions/windows/it-pro/windows-10/deployment/compatibility/applying-filters-to-data-in-the-sua-tool",
"redirect_document_id": false
},
{
"source_path": "windows/deployment/planning/fixing-applications-by-using-the-sua-tool.md",
"redirect_url": "/previous-versions/windows/it-pro/windows-10/deployment/compatibility/fixing-applications-by-using-the-sua-tool",
"redirect_document_id": false
},
{
"source_path": "windows/deployment/planning/showing-messages-generated-by-the-sua-tool.md",
"redirect_url": "/previous-versions/windows/it-pro/windows-10/deployment/compatibility/showing-messages-generated-by-the-sua-tool",
"redirect_document_id": false
},
{
"source_path": "windows/deployment/planning/sua-users-guide.md",
"redirect_url": "/previous-versions/windows/it-pro/windows-10/deployment/compatibility/sua-users-guide",
"redirect_document_id": false
},
{
"source_path": "windows/deployment/planning/tabs-on-the-sua-tool-interface.md",
"redirect_url": "/previous-versions/windows/it-pro/windows-10/deployment/compatibility/tabs-on-the-sua-tool-interface",
"redirect_document_id": false
},
{
"source_path": "windows/deployment/planning/using-the-sua-tool.md",
"redirect_url": "/previous-versions/windows/it-pro/windows-10/deployment/compatibility/using-the-sua-tool",
"redirect_document_id": false
},
{
"source_path": "windows/deployment/planning/using-the-sua-wizard.md",
"redirect_url": "/previous-versions/windows/it-pro/windows-10/deployment/compatibility/using-the-sua-wizard",
"redirect_document_id": false
},
{
"source_path": "windows/deployment/windows-10-pro-in-s-mode.md",
"redirect_url": "/previous-versions/windows/it-pro/windows-10/deployment/s-mode/switch-edition-from-s-mode",
"redirect_document_id": false
},
{
"source_path": "windows/deployment/s-mode.md",
"redirect_url": "/previous-versions/windows/it-pro/windows-10/deployment/s-mode/index",
"redirect_document_id": false
},
{
"source_path": "windows/deployment/windows-autopatch/deploy/windows-autopatch-groups-manage-autopatch-groups.md",
"redirect_url": "/windows/deployment/windows-autopatch/manage/windows-autopatch-manage-autopatch-groups",
"redirect_document_id": true
}
]
}

7
.openpublishing.redirection.windows-security.json
View File

@ -5127,7 +5127,7 @@
},
{
"source_path": "windows/security/threat-protection/windows-defender-application-control/LOB-win32-apps-on-s.md",
"redirect_url": "/windows/security/application-security/application-control/windows-defender-application-control/deployment/LOB-win32-apps-on-s",
"redirect_url": "/previous-versions/windows/it-pro/windows-10/deployment/s-mode/wdac-allow-lob-win32-apps",
"redirect_document_id": false
},
{
@ -9284,6 +9284,11 @@
"source_path": "windows/security/information-protection/windows-information-protection/wip-learning.md",
"redirect_url": "/previous-versions/windows/it-pro/windows-10/security/information-protection/windows-information-protection/wip-learning",
"redirect_document_id": false
},
{
"source_path": "windows/security/application-security/application-control/windows-defender-application-control/deployment/LOB-win32-apps-on-s.md",
"redirect_url": "/previous-versions/windows/it-pro/windows-10/deployment/s-mode/wdac-allow-lob-win32-apps",
"redirect_document_id": false
}
]
}

8
education/windows/toc.yml
View File

@ -16,14 +16,6 @@ items:
href: windows-11-se-settings-list.md
- name: Frequently Asked Questions (FAQ)
href: windows-11-se-faq.yml
- name: Windows in S Mode
items:
- name: Overview
href: /windows/deployment/s-mode?context=/education/context/context
- name: Switch Windows edition from S mode
href: /windows/deployment/windows-10-pro-in-s-mode?context=/education/context/context
- name: Deploy Win32 apps to S Mode devices
href: /windows/security/threat-protection/windows-defender-application-control/lob-win32-apps-on-s?context=/education/context/context
- name: Shared devices and guests access
href: /windows/configuration/shared-devices-concepts?context=/education/context/context
- name: Take tests and assessments in Windows

63
windows/deployment/TOC.yml
View File

@ -1,3 +1,4 @@
items:
- name: Deploy and update Windows client
href: index.yml
items:
@ -367,10 +368,6 @@
href: do/waas-delivery-optimization-reference.md?context=/windows/deployment/context/context
- name: FoD and language packs for WSUS and Configuration Manager
href: update/fod-and-lang-packs.md
- name: Windows client in S mode
href: s-mode.md
- name: Switch to Windows client Pro or Enterprise from S mode
href: windows-10-pro-in-s-mode.md
- name: Windows client deployment tools
items:
- name: Windows client deployment scenarios and tools
@ -494,63 +491,7 @@
- name: USMT Resources
href: usmt/usmt-resources.md
- name: Application Compatibility Toolkit (ACT) Technical Reference
items:
- name: SUA User's Guide
items:
- name: Overview
href: planning/sua-users-guide.md
- name: Use the SUA Wizard
href: planning/using-the-sua-wizard.md
- name: Use the SUA Tool
href: planning/using-the-sua-tool.md
- name: Tabs on the SUA Tool Interface
href: planning/tabs-on-the-sua-tool-interface.md
- name: Show Messages Generated by the SUA Tool
href: planning/showing-messages-generated-by-the-sua-tool.md
- name: Apply Filters to Data in the SUA Tool
href: planning/applying-filters-to-data-in-the-sua-tool.md
- name: Fix apps using the SUA Tool
href: planning/fixing-applications-by-using-the-sua-tool.md
- name: Compatibility Fixes for Windows 10, Windows 8, Windows 7, and Windows Vista
href: planning/compatibility-fixes-for-windows-8-windows-7-and-windows-vista.md
- name: Compatibility Administrator User's Guide
items:
- name: Overview
href: planning/compatibility-administrator-users-guide.md
- name: Use the Compatibility Administrator Tool
href: planning/using-the-compatibility-administrator-tool.md
- name: Available Data Types and Operators in Compatibility Administrator
href: planning/available-data-types-and-operators-in-compatibility-administrator.md
- name: Search for Fixed Applications in Compatibility Administrator
href: planning/searching-for-fixed-applications-in-compatibility-administrator.md
- name: Search for Installed Compatibility Fixes with the Query Tool in Compatibility Administrator
href: planning/searching-for-installed-compatibility-fixes-with-the-query-tool-in-compatibility-administrator.md
- name: Create a Custom Compatibility Fix in Compatibility Administrator
href: planning/creating-a-custom-compatibility-fix-in-compatibility-administrator.md
- name: Create a Custom Compatibility Mode in Compatibility Administrator
href: planning/creating-a-custom-compatibility-mode-in-compatibility-administrator.md
- name: Create an AppHelp Message in Compatibility Administrator
href: planning/creating-an-apphelp-message-in-compatibility-administrator.md
- name: View the Events Screen in Compatibility Administrator
href: planning/viewing-the-events-screen-in-compatibility-administrator.md
- name: Enable and Disable Compatibility Fixes in Compatibility Administrator
href: planning/enabling-and-disabling-compatibility-fixes-in-compatibility-administrator.md
- name: Install and Uninstall Custom Compatibility Databases in Compatibility Administrator
href: planning/installing-and-uninstalling-custom-compatibility-databases-in-compatibility-administrator.md
- name: Manage Application-Compatibility Fixes and Custom Fix Databases
items:
- name: Overview
href: planning/managing-application-compatibility-fixes-and-custom-fix-databases.md
- name: Understand and Use Compatibility Fixes
href: planning/understanding-and-using-compatibility-fixes.md
- name: Compatibility Fix Database Management Strategies and Deployment
href: planning/compatibility-fix-database-management-strategies-and-deployment.md
- name: Test Your Application Mitigation Packages
href: planning/testing-your-application-mitigation-packages.md
- name: Use the Sdbinst.exe Command-Line Tool
href: planning/using-the-sdbinstexe-command-line-tool.md
- name: Add fonts in Windows
href: windows-missing-fonts.md
- name: Customize Windows PE boot images
href: customize-boot-image.md
href: customize-boot-image.md

BIN
windows/deployment/images/s-mode-flow-chart.png
View File

Binary file not shown.
Side by Side

Before

Width:  |  Height:  |  Size: 31 KiB

BIN
windows/deployment/images/smodeconfig.png
View File

Binary file not shown.
Side by Side

Before

Width:  |  Height:  |  Size: 64 KiB

44
windows/deployment/planning/applying-filters-to-data-in-the-sua-tool.md
View File

@ -1,44 +0,0 @@
---
title: Applying Filters to Data in the SUA Tool (Windows 10)
description: Learn how to apply filters to results from the Standard User Analyzer (SUA) tool while testing your application.
manager: aaroncz
ms.author: frankroj
ms.service: windows-client
author: frankroj
ms.date: 10/28/2022
ms.topic: conceptual
ms.subservice: itpro-deploy
---
# Applying Filters to Data in the SUA Tool
**Applies to**
- Windows 10
- Windows 8.1
- Windows 8
- Windows 7
- Windows Server 2012
- Windows Server 2008 R2
On the user interface for the Standard User Analyzer (SUA) tool, you can apply filters to the issues that the tool has found so that you can view only the information that interests you.
**To apply filters to data in the SUA tool**
1. Use the SUA tool to test an application. For more information, see [Using the SUA Tool](using-the-sua-tool.md).
2. After you finish testing, in the SUA tool, click a tab that shows issues that the SUA tool has found. All tabs except the **App Info** tab can show issues.
3. On the **Options** menu, click a command that corresponds to the filter that you want to apply. The following table describes the commands.
|Options menu command|Description|
|--- |--- |
|**Filter Noise**|Filters noise from the issues.<p>This command is selected by default.|
|**Load Noise Filter File**|Opens the **Open Noise Filter File** dialog box, in which you can load an existing noise filter (.xml) file.|
|**Export Noise Filter File**|Opens the **Save Noise Filter File** dialog box, in which you can save filter settings as a noise filter (.xml) file.|
|**Only Display Records with Application Name in StackTrace**|Filters out records that do not have the application name in the stack trace. <p>However, because the SUA tool captures only the first 32 stack frames, this command can also filter out real issues with the application where the call stack is deeper than 32 frames.|
|**Show More Details in StackTrace**|Shows additional stack frames that are related to the SUA tool, but not related to the diagnosed application.|
|**Warn Before Deleting AppVerifier Logs**|Displays a warning message before the SUA tool deletes all of the existing SUA-related log files on the computer.<p>This command is selected by default.|
|**Logging**|Provides the following logging-related options:<ul><li>Show or hide log errors.<li>Show or hide log warnings.<li>Show or hide log information.</ul><p>To maintain a manageable file size, we recommend that you do not select the option to show informational messages.|

76
windows/deployment/planning/available-data-types-and-operators-in-compatibility-administrator.md
View File

@ -1,76 +0,0 @@
---
title: Available Data Types and Operators in Compatibility Administrator (Windows 10)
description: The Compatibility Administrator tool provides a way to query your custom-compatibility databases.
manager: aaroncz
ms.author: frankroj
ms.service: windows-client
author: frankroj
ms.date: 10/28/2022
ms.topic: conceptual
ms.subservice: itpro-deploy
---
# Available Data Types and Operators in Compatibility Administrator
**Applies to**
- Windows 10
- Windows 8.1
- Windows 8
- Windows 7
- Windows Server 2012
- Windows Server 2008 R2
The Compatibility Administrator tool provides a way to query your custom-compatibility databases.
## Available Data Types
Customized-compatibility databases in Compatibility Administrator contain the following data types.
- **Integer**. A numerical value with no fractional part. All integers are unsigned because none of the attributes can have a negative value.
- **String**. A series of alphanumeric characters manipulated as a group.
- **Boolean**. A value of True or False.
## Available Attributes
The following table shows the attributes you can use for querying your customized-compatibility databases in Compatibility Administrator.
|Attribute|Description|Data type|
|--- |--- |--- |
|APP_NAME|Name of the application.|String|
|DATABASE_GUID|Unique ID for your compatibility database.|String|
|DATABASE_INSTALLED|Specifies if you have installed the database.|Boolean|
|DATABASE_NAME|Descriptive name of your database.|String|
|DATABASE_PATH|Location of the database on your computer.|String|
|FIX_COUNT|Number of compatibility fixes applied to a specific application.|Integer|
|FIX_NAME|Name of your compatibility fix.|String|
|MATCH_COUNT|Number of matching files for a specific, fixed application.|Integer|
|MATCHFILE_NAME|Name of a matching file used to identify a specific, fixed application.|String|
|MODE_COUNT|Number of compatibility modes applied to a specific, fixed application.|Integer|
|MODE_NAME|Name of your compatibility mode.|String|
|PROGRAM_APPHELPTYPE|Type of AppHelp message applied to an entry. The value can be 1 or 2, where 1 enables the program to run and 2 blocks the program.|Integer|
|PROGRAM_DISABLED|Specifies if you disabled the compatibility fix for an application. If True, Compatibility Administrator does not apply the fixes to the application.|Boolean|
|PROGRAM_GUID|Unique ID for an application.|String|
|PROGRAM_NAME|Name of the application that you are fixing.|String|
## Available Operators
The following table shows the operators that you can use for querying your customized-compatibility databases in the Compatibility Administrator.
|Symbol|Description|Data type|Precedence|
|--- |--- |--- |--- |
|>|Greater than|Integer or string|1|
|>=|Greater than or equal to|Integer or string|1|
|<|Less than|Integer or string|1|
|<=|Less than or equal to|Integer or string|1|
|<>|Not equal to|Integer or string|1|
|=|Equal to|Integer, string, or Boolean|1|
|HAS|A special SQL operator used to check if the left-hand operand contains a substring specified by the right-hand operand.|Left-hand operand. MATCHFILE_NAME, MODE_NAME, FIX_NAME<div class="alert">Note: Only the HAS operator can be applied to the MATCHFILE_NAME, MODE_NAME, and FIX_NAME attributes.</div><br/>Right-hand operand. String|1|
|OR|Logical OR operator|Boolean|2|
|AND|Logical AND operator|Boolean|2|
## Related topics
[Using the Compatibility Administrator Tool](using-the-compatibility-administrator-tool.md)

45
windows/deployment/planning/compatibility-administrator-users-guide.md
View File

@ -1,45 +0,0 @@
---
title: Compatibility Administrator User's Guide (Windows 10)
manager: aaroncz
ms.author: frankroj
description: The Compatibility Administrator tool helps you resolve potential application-compatibility issues before deploying a new version of Windows.
ms.service: windows-client
author: frankroj
ms.topic: conceptual
ms.subservice: itpro-deploy
ms.date: 10/28/2022
---
# Compatibility Administrator User's Guide
**Applies to**
- Windows 10
- Windows 8.1
- Windows 8
- Windows 7
- Windows Server 2012
- Windows Server 2008 R2
The Compatibility Administrator tool helps you resolve potential application-compatibility issues before deploying a new version of Windows to your organization. Compatibility Administrator provides:
- Compatibility fixes, compatibility modes, and AppHelp messages that you can use to resolve specific compatibility issues.
- Tools for creating customized compatibility fixes, compatibility modes, AppHelp messages, and compatibility databases.
- A query tool that you can use to search for installed compatibility fixes on your local computers.
The following flowchart shows the steps for using the Compatibility Administrator tool to create your compatibility fixes, compatibility modes, and AppHelp messages.
![act compatibility admin flowchart.](images/dep-win8-l-act-compatadminflowchart.jpg)
> [!IMPORTANT]
> Application Compatibility Toolkit (ACT) installs a 32-bit and a 64-bit version of the Compatibility Administrator tool. You must use the 32-bit version to create and work with custom databases for 32-bit applications, and the 64-bit version to create and work with custom databases for 64-bit applications.
## In this section
|Topic|Description|
|--- |--- |
|[Using the Compatibility Administrator Tool](using-the-compatibility-administrator-tool.md)|This section provides information about using the Compatibility Administrator tool.|
|[Managing Application-Compatibility Fixes and Custom Fix Databases](managing-application-compatibility-fixes-and-custom-fix-databases.md)|This section provides information about managing your application-compatibility fixes and custom-compatibility fix databases. This section explains the reasons for using compatibility fixes and how to deploy custom-compatibility fix databases.|
|[Using the Sdbinst.exe Command-Line Tool](using-the-sdbinstexe-command-line-tool.md)|Ensure that you deploy your customized database (.Sdb) files to other computers in your organization before your compatibility fixes, compatibility modes, and AppHelp messages are applied. You can deploy your customized database files in several ways, including, by using a logon script, by using Group Policy, or by performing file copy operations.|

163
windows/deployment/planning/compatibility-fix-database-management-strategies-and-deployment.md
View File

@ -1,163 +0,0 @@
---
title: Compatibility Fix Database Management Strategies and Deployment (Windows 10)
manager: aaroncz
ms.author: frankroj
description: Learn how to deploy your compatibility fixes into an application-installation package or through a centralized compatibility-fix database.
ms.service: windows-client
author: frankroj
ms.date: 10/28/2022
ms.topic: conceptual
ms.subservice: itpro-deploy
---
# Compatibility Fix Database Management Strategies and Deployment
**Applies to**
- Windows 10
- Windows 8.1
- Windows 8
- Windows 7
- Windows Server 2012
- Windows Server 2008 R2
To use fixes in application-compatibility mitigation strategy, define a strategy to manage your custom compatibility-fix database. Typically, you can use one of the two following approaches:
- Deploying your compatibility fixes as part of an application-installation package.
- Deploying your compatibility fixes through a centralized compatibility-fix database.
Microsoft provides general recommends the following remedies for improving the management of your custom compatibility-fix databases.
> [!NOTE]
> These recommendations are not based on irrespective of the approach you decide to use. The following are the general recommendations.
- **Define standards for when you will apply compatibility fixes**
Ensure that the standards and scenarios for using compatibility fixes are defined, based on your specific business and technology needs.
- **Define standards for your custom compatibility-fix databases**
Compatibility fixes must include a version check, so that mapping to particular applications becomes easy. Ensure that your compatibility fixes always, so that the fix won't be applied to newer versions of your applications.
- **Define your resources responsible for addressing questions and enforcing your standards**
Ensure you determine who will be responsible for staying current with the technology and standards that are related to your compatibility fixes and custom compatibility-fix databases. As your databases are managed over time, ensure that someone in your organization stays current with the relevant technology.
## Strategies for Deploying Your Compatibility Fixes
We recommend the usage of one of the two strategies to deploy your compatibility fixes into your organization. They are:
- Deploying your compatibility fixes as part of an application-installation package.
- Deploying your compatibility fixes through a centralized compatibility-fix database.
Determine which method best meets your organization's deployment needs.
### Deploying Fixes as Part of an Application-Installation Package
One strategy to deploy compatibility fixes is to create a custom compatibility-fix database that contains a single entry that is applied directly to the application-installation package. While this method is the most straightforward one for deployment, it has been shown that this method can become overly complex, especially if you are fixing a large number of applications.
If the following considerations apply to your organization, you should avoid this strategy and instead consider using a centralized compatibility-fix database, as described in the next section.
- **How many applications require compatibility fixes?**
Custom compatibility-fix databases are actual databases. Therefore, if you have 1000 applications to be fixed, it will take longer to open and query 1000 single-row databases for a match, instead of a single database with 1000 rows.
- **Will you be able to track which applications are installed on which computer?**
You might determine that your initial set of compatibility fixes isn't comprehensive, and that you must deploy an updated version of the compatibility-fix database to resolve the other issues. If you deployed the initial set by using the application-installation package, you'll be required to locate each client computer that is running the application and replace the compatibility fix.
### Deploying Fixes Through a Centralized Compatibility-Fix Database
The other recommended strategy for deploying compatibility fixes into your organization is to create and manage either a single custom compatibility-fix database, or else to create and manage several custom databases for large subsets of your organization. This strategy will help to enforce your company policy and to provide consistent updates for application fixes that you discover later.
This approach tends to work best for organizations that have a well-developed deployment infrastructure in place, with centralized ownership of the process. We recommend that you consider the following before using this approach:
- Does your organization have the tools required to deploy and update a compatibility-fix database for all of the affected computers?
If you intend to manage a centralized compatibility-fix database, you must verify that your organization has the required tools to deploy and update all of the affected computers in your organization.
- Do you have centralized resources that can manage and update the centralized compatibility-fix database?
Ensure that you've identified the appropriate owners for the deployment process, for the applications, and for the database updates, in addition to determining the process by which compatibility issues can be deployed to specific computers.
### Merging Centralized Compatibility-Fix Databases
If you decide to use the centralized compatibility-fix database deployment strategy, you can merge any of your individual compatibility-fix databases. This provision enables you to create a single custom compatibility-fix database that can be used to search for and determine whether Windows&reg; should apply a fix to a specific executable (.exe) file. We recommend merging your databases based on the following process.
**To merge your custom-compatibility databases**
1. Verify that your application-compatibility testers are performing their tests on computers with the latest version of your compatibility-fix database. For example, Custom DB1.
2. If the tester determines that an application requires an extra compatibility fix that isn't a part of the original compatibility-fix database, the tester must create a new custom compatibility database with all of the required information for that single fix, for example, Custom DB2.
3. The tester applies the new Custom DB2 information to the application and then tests for both the functionality and integration, to ensure that the compatibility issues are addressed.
4. After the application passes all of the required functionality and integration tests, the tester can send Custom DB2 to the team that manages the central compatibility-fix database.
5. The team that manages the centralized database opens Custom DB1 and uses the Compatibility Administrator to include the new compatibility fixes that were included in Custom DB2.
> [!NOTE]
> Custom DB1 contains a unique GUID that makes updating the database easier. For example, if you install a new version of the custom compatibility-fix database that uses the same GUID as the previous version, the computer will automatically uninstall the old version.
6. The centralized management team then redeploys the new version of Custom DB1 to all of the end users in your organization.
### Deploying Your Custom Compatibility-Fix Databases
Deploying your custom compatibility-fix database into your organization requires you to perform the following actions:
1. Store your custom compatibility-fix database (.sib file) in a location that is accessible to all of your organization's computers.
2. Use the Sdbinst.exe command-line tool to install the custom compatibility-fix database locally.
In order to meet the two requirements above, we recommend that you use one of the following two methods:
- **Using a Windows Installer package and a custom script**
You can package your .sib file and a custom deployment script into a file with the .msi extension, and then deploy the .msi file into your organization.
> [!IMPORTANT]
> Ensure that you mark your custom script so that it does not impersonate the calling user. For example, if you use Microsoft&reg; Visual Basic&reg; Scripting Edition (VBScript), the custom action type would be:
>`msidbCustomActionTypeVBScript + msidbCustomActionTypeInScript + msidbCustomActionTypeNoImpersonate = 0x0006 + 0x0400 + 0x0800 = 0x0C06 = 3078 decimal)`
- **Using a network share and a custom script**
You can store the .sib file on your network share, and then call to a script available on your specified computers.
> [!IMPORTANT]
> Ensure that you call the script at a time when it can receive elevated rights. For example, you should call the script by using computer startup scripts instead of a user logon script. You must also ensure that the installation of the custom compatibility-fix database occurs with Administrator rights.
### Example Script for installation of .sib File based on .msi File
The following examples show an installation of a custom compatibility-fix database based on a .msi file.
```
'InstallSDB.vbs
Function Install
Dim WshShell
Set WshShell = CreateObject("WScript.Shell")
WshShell.Run "sdbinst.exe -q " & CHR(34) & "%ProgramFiles%\MyOrganizationSDB\MyOrg.sdb" & CHR(34), 0, true
WshShell.Run "cmd.exe /c " & CHR(34) & "del " & CHR(34) & "%ProgramFiles%\MyOrganizationSDB\MyOrg.sdb" & CHR(34) & CHR(34), 0
WshShell.Run "reg.exe delete HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{guidFromMyOrgsSdb}.sdb /f", 0
End Function
Function UnInstall
Dim WshShell
Set WshShell = CreateObject("WScript.Shell")
WshShell.Run "sdbinst.exe -q -u -g {guidFromMyOrgsSdb}", 0
End Function
```
### Initial Deployment and Updates
Application-compatibility is tested, from which issues are reported, even before a new Windows operating system is deployed. To handle these issues, include the custom compatibility-fix database, which includes all of your known issues, in your corporate image. Later, update your compatibility-fix database; provide the updates by using one of the two mechanisms that are described in the "Deploying Your Custom Compatibility Fix Databases" section.
## Related articles
[Managing Application-Compatibility Fixes and Custom Fix Databases](managing-application-compatibility-fixes-and-custom-fix-databases.md)

162
windows/deployment/planning/compatibility-fixes-for-windows-8-windows-7-and-windows-vista.md
View File

@ -1,162 +0,0 @@
---
title: Compatibility Fixes for Windows 10, Windows 8, Windows 7, & Windows Vista
description: Find released compatibility fixes for all Windows operating systems from Windows Vista through Windows 10.
manager: aaroncz
ms.author: frankroj
ms.service: windows-client
author: frankroj
ms.date: 10/28/2022
ms.topic: conceptual
ms.subservice: itpro-deploy
---
# Compatibility Fixes for Windows 10, Windows 8, Windows 7, and Windows Vista
**Applies to**
- Windows 10
- Windows 8.1
- Windows 8
- Windows 7
- Windows Server 2012
- Windows Server 2008 R2
You can fix some compatibility issues that are due to the changes made between Windows operating system versions. These issues can include User Account Control (UAC) restrictions.
> [!IMPORTANT]
> The Application Compatibility Toolkit (ACT) installs a 32-bit and a 64-bit version of the Compatibility Administrator. You must use the 32-bit version for 32-bit applications and the 64-bit version to work for 64-bit applications. You will receive an error message if you try to use the wrong version.
If you start the Compatibility Administrator as an Administrator (with elevated privileges), all repaired applications can run successfully; however, virtualization and redirection might not occur as expected. To verify that a compatibility fix addresses an issue, you must test the repaired application by running it under the destination user account.
## Compatibility Fixes
The following table lists the known released compatibility fixes for all Windows operating systems from Windows Vista through Windows 10. The fixes are listed in alphabetical order.
|Fix|Fix Description|
|--- |--- |
|8And16BitAggregateBlts|8/16-bit mitigation can cause performance issues in applications. This layer aggregates all the blt operations and improves performance.|
|8And16BitDXMaxWinMode|The 8/16-bit mitigation runs applications that use DX8/9 in a maximized windowed mode. This layer mitigates applications that exhibit graphical corruption in full screen mode.|
|8And16BitGDIRedraw|This fix repairs applications that use GDI and that work in 8-bit color mode. The application is forced to repaint its window on RealizePalette.|
|AccelGdipFlush|This fix increases the speed of GdipFlush, which has perf issues in DWM.|
|AoaMp4Converter|This fix resolves a display issue for the AoA Mp4 Converter.|
|BIOSRead|This problem is indicated when an application can't access the **Device\PhysicalMemory** object beyond the kernel-mode drivers, on any of the Windows Server® 2003 operating systems.<p>The fix enables OEM executable (.exe) files to use the GetSystemFirmwareTable function instead of the NtOpenSection function when the BIOS is queried for the **\Device\Physical** memory information.|
|BlockRunasInteractiveUser|This problem occurs when **InstallShield** creates installers and uninstallers that fail to complete and that generate error messages or warnings.<p>The fix blocks **InstallShield** from setting the value of RunAs registry keys to InteractiveUser Because InteractiveUser no longer has Administrator rights.<div class="alert">**Note:** For more detailed information about this application fix, see [Using the BlockRunAsInteractiveUser Fix](/previous-versions/windows/it-pro/windows-7/dd638336(v=ws.10)).</div>|
|ChangeFolderPathToXPStyle|This fix is required when an application can't return shell folder paths when it uses the **SHGetFolder** API.<p>The fix intercepts the **SHGetFolder**path request to the common **appdata** file path and returns the Windows® XP-style file path instead of the Windows Vista-style file path.|
|ClearLastErrorStatusonIntializeCriticalSection|This fix is indicated when an application fails to start.<p>The fix modifies the InitializeCriticalSection function call so that it checks the NTSTATUS error code, and then sets the last error to ERROR_SUCCESS.|
|CopyHKCUSettingsFromOtherUsers|This problem occurs when an application's installer must run in elevated mode and depends on the HKCU settings that are provided for other users.<p>The fix scans the existing user profiles and tries to copy the specified keys into the HKEY_CURRENT_USER registry area.<p>You can control this fix further by entering the relevant registry keys as parameters that are separated by the ^ Symbol; for example: Software\MyCompany\Key1^Software\MyCompany\Key2.<div class="alert">**Note:** For more detailed information about this application fix, see [Using the CopyHKCUSettingsFromOtherUsers Fix](/previous-versions/windows/it-pro/windows-7/dd638375(v=ws.10)).</div>|
|CorrectCreateBrushIndirectHatch|This problem occurs when an access violation error message displays and the application fails when you select or crop an image.<p>The fix corrects the brush style hatch value, which is passed to the CreateBrushIndirect() function and enables the information to be correctly interpreted.|
|CorrectFilePaths|This problem occurs when: <ul><li>An application tries to write files to the hard disk and is denied access.</li><li>An application receives a file not found or path not found error message.</li></ul><p>The fix modifies the file path names to point to a new location on the hard disk.<div class="alert">**Note:** For more detailed information about the CorrectFilePaths application fix, see [Using the CorrectFilePaths Fix](/previous-versions/windows/it-pro/windows-7/cc766201(v=ws.10)). We recommend that you use this fix together with the CorrectFilePathsUninstall fix if you're applying it to a setup installation file.</div>|
|CorrectFilePathsUninstall|This problem occurs when an uninstalled application leaves behind files, directories, and links.<p>The fix corrects the file paths that are used by the uninstallation process of an application.<div class="alert">**Note:** For more detailed information about this fix, see [Using the CorrectFilePathsUninstall Fix](/previous-versions/windows/it-pro/windows-7/dd638414(v=ws.10)). We recommend that you use this fix together with the CorrectFilePaths fix if you're applying it to a setup installation file.</div>|
|CorrectShellExecuteHWND|This problem occurs when you start an executable (.exe) and:<ul><li>A taskbar item blinks instead of an elevation prompt being opened, or when the application doesn't provide a valid HWND value when it calls the ShellExecute(Ex) function.<p>The fix intercepts the ShellExecute(Ex) calls, and then inspects the HWND value. If the value is invalid, this fix enables the call to use the currently active HWND value.<div class="alert">**Note:** For more detailed information about the CorrectShellExecuteHWND application fix, see [Using the CorrectShellExecuteHWND Fix](/previous-versions/windows/it-pro/windows-7/cc722028(v=ws.10)).</div>|
|CustomNCRender|This fix instructs DWM to not render the non-client area forcing the application to do its own NC rendering. This issue often gives windows an XP look.|
|DelayApplyFlag|This fix applies a KERNEL, USER, or PROCESS flag if the specified DLL is loaded.<p>You can control this fix further by typing the following command at the command prompt:<p>`DLL_Name;Flag_Type;Hexidecimal_Value`<br>Where the DLL_Name is the name of the specific DLL, including the file extension. Flag_Type is KERNEL, USER, or PROCESS, and a Hexidecimal_Value, starting with 0x and up to 64 bits long.<div class="alert">**Note:** The PROCESS flag type can have a 32-bit length only. You can separate multiple entries with a backslash ().</div>|
|DeprecatedServiceShim|The problem is indicated when an application tries to install a service that has a dependency on a deprecated service. An error message displays.<p>The fix intercepts the CreateService function calls and removes the deprecated dependency service from the lpDependencies parameter.<p>You can control this fix further by typing the following command at the command prompt:<p>`Deprecated_Service\App_Service/Deprecated_Service2 \App_Service2` where:<ul><li>Deprecated_Service is the name of the deprecated service</li><li>App_Service is the name of the specific application service that is to be modified</li></ul>For example, NtLmSsp\WMI.<div class="alert">**Note:** If you don't provide an App_Service name, the deprecated service is removed from all newly created services.</div><div class="alert">**Note:** You can separate multiple entries with a forward slash (/).</div>|
|DirectXVersionLie|This problem occurs when an application fails because it doesn't find the correct version number for DirectX®.<p>The fix modifies the DXDIAGN GetProp function call to return the correct DirectX version.</div><p>You can control this fix further by typing the following command at the command prompt:<br>`MAJORVERSION.MINORVERSION.LETTER`<p>For example, 9.0.c.|
|DetectorDWM8And16Bit|This fix offers mitigation for applications that work in 8/16-bit display color mode because these legacy color modes aren't supported in Windows 8 .|
|Disable8And16BitD3D|This fix improves performance of 8/16-bit color applications that render using D3D and don't mix direct draw.|
|Disable8And16BitModes|This fix disables 8/16-bit color mitigation and enumeration of 8/16-bit color modes.|
|DisableDWM|The problem occurs when some objects aren't drawn or object artifacts remain on the screen in an application.<p>The fix temporarily disables the Windows Aero menu theme functionality for unsupported applications.<div class="alert">**Note:** For more detailed information about this application fix, see [Using the DisableDWM Fix](/previous-versions/windows/it-pro/windows-7/cc722418(v=ws.10)).</div>|
|DisableFadeAnimations|The problem is indicated when an application fades animation, buttons, or other controls don't function properly.<p>The fix disables the fade animations functionality for unsupported applications.|
|DisableThemeMenus|The problem occurs when an application behaves unpredictably when it tries to detect and use the correct Windows settings.<p>The fix temporarily disables the Windows Aero menu theme functionality for unsupported applications.|
|DisableWindowsDefender|The fix disables Windows Defender for security applications that don't work with Windows Defender.|
|DWM8And16BitMitigation|The fix offers mitigation for applications that work in 8/16-bit display color mode because these legacy color modes aren't supported in Windows 8.|
|DXGICompat|The fix allows application-specific compatibility instructions to be passed to the DirectX engine.|
|DXMaximizedWindowedMode|Applications that use DX8/9 are run in a maximized windowed mode. This is required for applications that use GDI/DirectDraw in addition to Direct3D.|
|ElevateCreateProcess|The problem is indicated when: <ul><li>installations</li><li>de-installations</li><li>updates</li></ul> fail because the host process calls the CreateProcess function and it returns an ERROR_ELEVATION_REQUIRED error message.<p>The fix handles the error code and attempts to recall the CreateProcess function together with requested elevation. If the fixed application already has a UAC manifest, the error code is returned unchanged.<div class="alert">**Note:** For more detailed information about this application fix, see [Using the ElevateCreateProcess Fix](/previous-versions/windows/it-pro/windows-7/cc722422(v=ws.10)).</div>|
|EmulateOldPathIsUNC|The problem occurs when an application fails because of an incorrect UNC path.<p>The fix exchanges the PathIsUNC function to return a value of True for UNC paths in Windows.|
|EmulateGetDiskFreeSpace|The problem is indicated when an application fails to install or to run. An error message is generated that there isn't enough free disk space to install or use the application. The error message occurs even though there's enough free disk space to meet the application requirements.<p>The fix determines the amount of free space. If the amount of free space is larger than 2 GB, the compatibility fix returns a value of 2 GB. However, if the amount of free space is smaller than 2 GB, the compatibility fix returns the actual-free space amount.<div class="alert">**Note:** For more detailed information about this application fix, see [Using the EmulateGetDiskFreeSpace Fix](/previous-versions/windows/it-pro/windows-7/ff720129(v=ws.10)).</div>|
|EmulateSorting|The problem occurs when an application experiences search functionality issues.<p>The fix forces applications that use the CompareStringW/LCMapString sorting table to use an older version of the table.<div class="alert">**Note:** For more detailed information about this e application fix, see [Using the EmulateSorting Fix](/previous-versions/windows/it-pro/windows-7/cc749209(v=ws.10)).</div>|
|EmulateSortingWindows61|The fix emulates the sorting order of Windows 7 and Windows Server 2008 R2 for various APIs.|
|EnableRestarts|The problem is indicated when an application and computer appear to hang because processes can't end to allow the computer to complete its restart processes.<p>The fix enables the computer to restart and finish the installation process by verifying and enabling that the SeShutdownPrivilege service privilege exists.<div class="alert">**Note:** For more detailed information about this application fix, see [Using the EnableRestarts Fix](/previous-versions/windows/it-pro/windows-7/ff720128(v=ws.10)).</div>|
|ExtraAddRefDesktopFolder|The problem occurs when an application invokes the Release() method too many times and causes an object to be prematurely destroyed.<p>The fix invokes the AddRef() method on the Desktop folder, which the SHGetDesktopFolder function returns, to counteract the problem.|
|FailObsoleteShellAPIs|The problem occurs when an application fails because it generated deprecated API calls.<p>The fix either fully implements the obsolete functions or implements the obsolete functions with stubs that fail.<div class="alert">**Note:** You can type FailAll=1 at the command prompt to suppress the function implementation and force all functions to fail.</div>|
|FailRemoveDirectory|The problem occurs when an application uninstall process doesn't remove all of the application files and folders.<p>This fix fails calls to RemoveDirectory() when called with a path matching the one specified in the shim command line. Only a single path is supported. The path can contain environment variables, but must be an exact path - no partial paths are supported.<p>The fix resolves an issue where an application expects RemoveDirectory() to delete a folder immediately even though a handle is open to it.|
|FakeLunaTheme|The problem occurs when a theme application doesn't properly display: the colors are washed out or the user interface isn't detailed.<p>The fix intercepts the GetCurrentThemeName API and returns the value for the Windows XP default theme (Luna).<div class="alert">**Note:** For more detailed information about the FakeLunaTheme application fix, see [Using the FakeLunaTheme Fix](/previous-versions/windows/it-pro/windows-7/cc766315(v=ws.10)).</div>|
|FlushFile|This problem is indicated when a file is updated and changes don't immediately appear on the hard disk. Applications can't see the file changes.<p>The fix enables the WriteFile function to call to the FlushFileBuffers APIs, which flush the file cache onto the hard disk.|
|FontMigration|The fix replaces an application-requested font with a better font selection, to avoid text truncation.|
|ForceAdminAccess|The problem occurs when an application fails to function during an explicit administrator check.<p>The fix allows the user to temporarily imitate being a part of the Administrators group by returning a value of True during the administrator check.<div class="alert">**Note:** For more detailed information about this application fix, see [Using the ForceAdminAccess Fix](/previous-versions/windows/it-pro/windows-7/cc766024(v=ws.10)).</div>|
|ForceInvalidateOnClose|The fix invalidates any windows that exist under a closing or hiding window for applications that rely on the invalidation messages.|
|ForceLoadMirrorDrvMitigation|The fix loads the Windows 8-mirror driver mitigation for applications where the mitigation isn't automatically applied.|
|FreestyleBMX|The fix resolves an application race condition that is related to window message order.|
|GetDriveTypeWHook|The application presents unusual behavior during installation; for example, the setup program states that it can't install to a user-specified location.<p>The fix exchanges GetDriveType() so that only the root information appears for the file path. This is required when an application passes an incomplete or badly formed file path when it tries to retrieve the drive type on which the file path exists.|
|GlobalMemoryStatusLie|The problem occurs when a Computer memory full error message that displays when you start an application.<p>The fix modifies the memory status structure, so that it reports a swap file that is 400 MB, regardless of the true swap file size.|
|HandleBadPtr|The problem occurs when an access violation error message that displays because an API is performing pointer validation before it uses a parameter.<p>The fix supports using lpBuffer validation from the InternetSetOptionA and InternetSetOptionW functions to perform the more parameter validation.|
|HandleMarkedContentNotIndexed|The problem occurs when an application that fails when it changes an attribute on a file or directory.<p>The fix intercepts any API calls that return file attributes and directories that are invoked from the %TEMP% directory. The fix then resets the FILE_ATTRIBUTE_NOT_CONTENT_INDEXED attribute to its original state.|
|HeapClearAllocation|The problem is indicated when the allocation process shuts down unexpectedly.<p>The fix uses zeros to clear out the heap allocation for an application.|
|IgnoreAltTab|The problem occurs when an application fails to function when special key combinations are used.<p>The fix intercepts the RegisterRawInputDevices API and prevents the delivery of the WM_INPUT messages. This delivery failure forces the included hooks to be ignored and forces DInput to use Windows-specific hooks.<div class="alert">**Note:** For more detailed information about this application fix, see [Using the IgnoreAltTab Fix](/previous-versions/windows/it-pro/windows-7/cc722093(v=ws.10)).</div>|
|IgnoreChromeSandbox|The fix allows Google Chrome to run on systems where ntdll is loaded above 4 GB.|
|IgnoreDirectoryJunction|The problem occurs when a read or access violation error message that displays when an application tries to find or open files.<p>The fix links the FindNextFileW, FindNextFileA, FindFirstFileExW, FindFirstFileExA, FindFirstFileW, and FindFirstFileA APIs to prevent them from returning directory junctions.<div class="alert">**Note:** Symbolic links appear to start in Windows Vista.</div>|
|IgnoreException|The problem is indicated when an application stops functioning immediately after it starts, or the application starts with only a cursor appearing on the screen.<p>The fix enables the application to ignore specified exceptions. By default, this fix ignores privileged-mode exceptions; however, it can be configured to ignore any exception.<p>You can control this fix further by typing the following command at the command prompt:<p>`Exception1;Exception2`<br>Where Exception1 and Exception2 are specific exceptions to be ignored. For example: ACCESS_VIOLATION_READ:1;ACCESS_VIOLATION_WRITE:1.<p>**Important:** You should use this compatibility fix only if you're certain that it's acceptable to ignore the exception. You might experience more compatibility issues if you choose to incorrectly ignore an exception.<div class="alert">**Note:** For more detailed information about this application fix, see [Using the IgnoreException Fix](/previous-versions/windows/it-pro/windows-7/cc766154(v=ws.10)).</div>|
|IgnoreFloatingPointRoundingControl|This fix enables an application to ignore the rounding control request and to behave as expected in previous versions of the application.<p>Before the C runtime library supported floating point SSE2, it ignored the rounding control request and used the round to nearest option by default. This shim ignores the rounding control request to support applications relying on old behavior.|
|IgnoreFontQuality|The problem occurs when application text appears to be distorted.<p>The fix enables color-keyed fonts to properly work with anti-aliasing.|
|IgnoreMessageBox|The problem occurs when a message box that displays with debugging or extraneous content when the application runs on an unexpected operating system.<p>The fix intercepts the MessageBox* APIs and inspects them for specific message text. If matching text is found, the application continues without showing the message box.<div class="alert">**Note:** For more detailed information about this application fix, see [Using the IgnoreMessageBox Fix](/previous-versions/windows/it-pro/windows-7/cc749044(v=ws.10)).</div>|
|IgnoreMSOXMLMF|The problem occurs when an error message that states that the operating system can't locate the MSVCR80D.DLL file.<p>The fix ignores the registered MSOXMLMF.DLL object, which Microsoft® Office 2007 loads into the operating system anytime that you load an XML file, and then it fails the CoGetClassObject for its CLSID. This compatibility fix ignores the registered MSOXMLMF and fails the CoGetClassObject for its CLSID.|
|IgnoreSetROP2|The fix ignores read-modify-write operations on the desktop to avoid performance issues.|
|InstallComponent|The fix prompts the user to install.Net 3.5 or .NET 2.0 because .NET isn't included with Windows 8.|
|LoadLibraryRedirect|The fix forces an application to load system versions of libraries instead of loading redistributable versions that shipped with the application.|
|LocalMappedObject|The problem occurs when an application unsuccessfully tries to create an object in the Global namespace.<p>The fix intercepts the function call to create the object and replaces the word Global with Local.<div class="alert">**Note:** For more detailed information about this application fix, see [Using the LocalMappedObject Fix](/previous-versions/windows/it-pro/windows-7/cc749287(v=ws.10)).</div>|
|MakeShortcutRunas|The problem is indicated when an application fails to uninstall because of access-related errors.<p>The fix locates any RunDLL.exe-based uninstallers and forces them to run with different credentials during the application installation. After it applies this fix, the installer will create a shortcut that specifies a matching string to run during the application installationenabling the uninstallation to occur later.<div class="alert">**Note:** For more detailed information about this application fix, see [Using the MakeShortcutRunas Fix](/previous-versions/windows/it-pro/windows-7/dd638338(v=ws.10))</div>|
|ManageLinks|The fix intercepts common APIs that are going to a directory or to an executable (.exe) file, and then converts any symbolic or directory junctions before passing it back to the original APIs.|
|MirrorDriverWithComposition|The fix allows mirror drivers to work properly with acceptable performance with desktop composition.|
|MoveToCopyFileShim|The problem occurs when an application experiences security access issues during setup.<p>The fix forces the CopyFile APIs to run instead of the MoveFile APIs. CopyFile APIs avoid moving the security descriptor, which enables the application files to get the default descriptor of the destination folder and prevents the security access issue.|
|OpenDirectoryAcl|The problem occurs when an error message that states that you don't have the appropriate permissions to access the application.<p>The fix reduces the security privilege levels on a specified set of files and folders.<div class="alert">**Note:** For more detailed information about this application fix, see [Using the OpenDirectoryACL Fix](/previous-versions/windows/it-pro/windows-7/dd638417(v=ws.10)).</div>|
|PopCapGamesForceResPerf|The fix resolves the performance issues in PopCap games like Bejeweled2. The performance issues are visible in certain low-end cards at certain resolutions where the 1024x768 buffer is scaled to fit the display resolution.|
|PreInstallDriver|The fix preinstalls drivers for applications that would otherwise try to install or start drivers during the initial start process.|
|PreInstallSmarteSECURE|The fix preinstalls computer-wide CLSIDs for applications that use SmartSECURE copy protection, which would otherwise try to install the CLSIDs during the initial start process.|
|ProcessPerfData|The problem occurs because the application tried to read the process performance data registry value to determine if another instance of the application is running. This problem results in an Unhandled Exception error message.<p>The fix handles the failure case by passing a fake process performance data registry key, so that the application perceives that it's the only instance running.<div class="alert">**Note:** This issue seems to occur most frequently with .NET applications.|
|PromoteDAM|The fix registers an application for power state change notifications.</div>|
|PropagateProcessHistory|The problem occurs when an application incorrectly fails to apply an application fix.<p>The fix sets the _PROCESS_HISTORY environment variable so that child processes can look in the parent directory for matching information while searching for application fixes.|
|ProtectedAdminCheck|The problem occurs when an application fails to run because of incorrect Protected Administrator permissions.<p>The fix addresses the issues that occur when applications use non-standard Administrator checks. This issue can result in false positives for user accounts that are being run as Protected Administrators. In this case, the associated SID exists, but the SID is set as deny-only.|
|RedirectCRTTempFile|The fix intercepts failing CRT calls that try to create a temporary file at the root of the volume. The fix instead redirects the calls to a temporary file in the user's temporary directory.|
|RedirectHKCUKeys|The problem occurs when an application can't be accessed because of User Account Control (UAC) restrictions.<p>The fix duplicates any newly created HKCU keys to other users' HKCU accounts. This fix is generic for UAC restrictions, whereby the HKCU keys are required, but are unavailable to an application at runtime.|
|RedirectMP3Codec|This problem occurs when you can't play MP3 files.<p>The fix intercepts the CoCreateInstance call for the missing filter and then redirects it to a supported version.|
|RedirectShortcut|The problem occurs when an application's shortcut can't be accessed, or the application uninstallation process doesn't remove application shortcuts.<p>The fix redirects all of the shortcuts created during the application setup to appear according to a specified path.<p>Start Menu shortcuts: Appear in the \ProgramData\Microsoft\Windows\Start Menu directory for all users.<br>Desktop or Quick Launch shortcuts: You must manually place the shortcuts on the individual user's desktop or Quick Launch bar.<p>This issue occurs because of UAC restrictions: specifically, when an application setup runs by using elevated privileges and stores the shortcuts according to the elevated user's context. In this situation, a restricted user can't access the shortcuts.<p>You can't apply this fix to an .exe file that includes a manifest and provides a run level.|
|RelaunchElevated|The problem occurs when installers, uninstallers, or updaters fail when they're started from a host application.<p>The fix enables a child .exe file to run with elevated privileges when it's difficult to determine the parent process with either the ElevateCreateProcess fix or by marking the .exe files to RunAsAdmin.<div class="alert">**Note:** For more detailed information about this application fix, see [Using the RelaunchElevated Fix](/previous-versions/windows/it-pro/windows-7/dd638373(v=ws.10)).</div>|
|RetryOpenSCManagerWithReadAccess|The problem occurs when an application tries to open the Service Control Manager (SCM) and receives an Access Denied error message.<p>The fix retries the call and requests a more restricted set of rights that include the following items:<li>SC_MANAGER_CONNECT<li>SC_MANAGER_ENUMERATE_SERVICE<li>SC_MANAGER_QUERY_LOCK_STATUS<li>STANDARD_READ_RIGHTS<div class="alert">**Note:** For more detailed information about this application fix, see [Using the RetryOpenSCManagerwithReadAccess Fix](/previous-versions/windows/it-pro/windows-7/cc721915(v=ws.10)).</div>|
|RetryOpenServiceWithReadAccess|The problem occurs when an Unable to open service due to your application using the OpenService() API to test for the existence of a particular service error message displays.<p>The fix retries the OpenService() API call and verifies that the user has Administrator rights, isn't a Protected Administrator, and by using read-only access. Applications can test for the existence of a service by calling the OpenService() API but some applications ask for all access when making this check. This fix retries the call but only asking for read-only access. The user needs to be an administrator for this fix to work<div class="alert">**Note:** For more detailed information about this application fix, see [Using the RetryOpenServiceWithReadAccess Fix](/previous-versions/windows/it-pro/windows-7/cc766423(v=ws.10)).</div>|
|RunAsAdmin|The problem occurs when an application fails to function by using the Standard User or Protected Administrator account.<p>The fix enables the application to run by using elevated privileges. The fix is the equivalent of specifying requireAdministrator in an application manifest.<div class="alert">**Note:** For more detailed information about this application fix, see [Using the RunAsAdmin Fix](/previous-versions/windows/it-pro/windows-7/dd638315(v=ws.10)).</div>|
|RunAsHighest|The problem occurs when administrators can't view the read/write version of an application that presents a read-only view to standard users.<p>The fix enables the application to run by using the highest available permissions. This fix is the equivalent of specifying highestAvailable in an application manifest.<div class="alert">**Note:** For more detailed information about this application fix, see [Using the RunAsHighest Fix](/previous-versions/windows/it-pro/windows-7/dd638322(v=ws.10)).</div>|
|RunAsInvoker|The problem occurs when an application isn't detected as requiring elevation.<p>The fix enables the application to run by using the privileges that are associated with the creation process, without requiring elevation. This fix is the equivalent of specifying asInvoker in an application manifest.<div class="alert">**Note:** For more detailed information about this application fix, see [Using the RunAsInvoker Fix](/previous-versions/windows/it-pro/windows-7/dd638389(v=ws.10)).</div>|
|SecuROM7|The fix repairs applications by using SecuROM7 for copy protection.|
|SessionShim|The fix intercepts API calls from applications that are trying to interact with services that are running in another session, by using the terminal service name prefix (Global or Local) as the parameter.<p>At the command prompt, you can supply a list of objects to modify, separating the values by a double backslash (). Or, you can choose not to include any parameters, so that all of the objects are modified.<p>**Important:** Users can't sign in as Session 0 (Global Session) in Windows Vista and later. Therefore, applications that require access to Session 0 automatically fail.<div class="alert">**Note:** For more detailed information about this application fix, see [Using the SessionShim Fix](/previous-versions/windows/it-pro/windows-7/cc722085(v=ws.10)).</div>|
|SetProtocolHandler|The fix registers an application as a protocol handler.<p>You can control this fix further by typing the following command at the command prompt:`Client;Protocol;App`<br>Where the Client is the name of the email protocol, Protocol is mailto, and App is the name of the application.<div class="alert">**Note:** Only the mail client and the mailto protocol are supported. You can separate multiple clients by using a backslash ().</div>|
|SetupCommitFileQueueIgnoreWow|The problem occurs when a 32-bit setup program fails to install because it requires 64-bit drivers.<p>The fix disables the Wow64 file system that is used by the 64-bit editions of Windows, to prevent 32-bit applications from accessing 64-bit file systems during the application setup.|
|SharePointDesigner2007|The fix resolves an application bug that severely slows the application when it runs in DWM.|
|ShimViaEAT|The problem occurs when an application fails, even after applying a compatibility fix that is known to fix an issue. Applications that use unicows.dll or copy protection often present this issue.<p>The fix applies the specified compatibility fixes by modifying the export table and by nullifying the use of module inclusion and exclusion.<div class="alert">**Note:** For more information about this application fix, see [Using the ShimViaEAT Fix](/previous-versions/windows/it-pro/windows-7/cc766286(v=ws.10)).</div>|
|ShowWindowIE|The problem occurs when a web application experiences navigation and display issues because of the tabbing feature.<p>The fix intercepts the ShowWindow API call to address the issues that can occur when a web application determines that it is in a child window. This fix calls the real ShowWindow API on the top-level parent window.|
|SierraWirelessHideCDROM|The fix repairs the Sierra Wireless Driver installation preventing bugcheck.|
|Sonique2|The application uses an invalid window style, which breaks in DWM. This fix replaces the window style with a valid value.|
|SpecificInstaller|The problem occurs when the GenericInstaller function fails to pick up an application installation file.<p>The fix flags the application as being an installer file (for example, setup.exe), and then prompts for elevation.<div class="alert">**Note:** For more detailed information about this application fix, see [Using the SpecificInstaller Fix](/previous-versions/windows/it-pro/windows-7/dd638397(v=ws.10)).</div>|
|SpecificNonInstaller|The problem occurs when an application that isn't an installer (and has sufficient privileges) generates a false positive from the GenericInstaller function.<p>The fix flags the application to exclude it from detection by the GenericInstaller function.<div class="alert">**Note:** For more detailed information about this application fix, see [Using the SpecificNonInstaller Fix](/previous-versions/windows/it-pro/windows-7/dd638326(v=ws.10)).</div>|
|SystemMetricsLie|The fix replaces SystemMetrics values and SystemParametersInfo values with the values of previous Windows versions.|
|TextArt|The application receives different mouse coordinates with DWM ON versus DWM OFF, which causes the application to hang. This fix resolves the issue.|
|TrimDisplayDeviceNames|The fix trims the names returned by the EnumDisplayDevices API of the display devices.|
|UIPICompatLogging|The fix enables the logging of Windows messages from Internet Explorer and other processes.|
|UIPIEnableCustomMsgs|The problem occurs when an application doesn't properly communicate with other processes because customized Windows messages aren't delivered.<p>The fix enables customized Windows messages to pass through to the current process from a lower Desktop integrity level. This fix is the equivalent of calling the RegisterWindowMessage function, followed by the ChangeWindowMessageFilter function in the code.<p>You can control this fix further by typing the following command at the command prompt:<p>`MessageString1 MessageString2`<br>Where MessageString1 and MessageString2 reflect the message strings that can pass.<div class="alert">**Note:** You must separate multiple message strings by spaces. For more detailed information about this application fix, see [Using the UIPIEnableCustomMsgs Fix](/previous-versions/windows/it-pro/windows-7/dd638320(v=ws.10)).</div>|
|UIPIEnableStandardMsgs|The problem occurs when an application doesn't communicate properly with other processes because standard Windows messages aren't delivered.<p>The fix enables standard Windows messages to pass through to the current process from a lower Desktop integrity level. This fix is the equivalent of calling the ChangeWindowMessageFilter function in the code.<p>You can control this fix further by typing the following command at the command prompt:<p>`1055 1056 1069`<p>Where 1055 reflects the first message ID, 1056 reflects the second message ID, and 1069 reflects the third message ID that can pass.<div class="alert">**Note:** You can separate multiple messages with spaces. For more detailed information about this application fix, see [Using the UIPIEnableStandardMsgs Fix [act]](/previous-versions/windows/it-pro/windows-7/dd638361(v=ws.10)).</div>|
|VirtualizeDeleteFileLayer|The fix virtualizes DeleteFile operations for applications that try to delete protected files.|
|VirtualizeDesktopPainting|This fix improves the performance of several operations on the Desktop DC while using DWM.|
|VirtualRegistry|The problem is indicated when a Component failed to be located error message displays when an application is started.<p>The fix enables the registry functions to allow for virtualization, redirection, expansion values, version spoofing, the simulation of performance data counters, and so on.<p>For more detailed information about this application fix, see [Using the VirtualRegistry Fix](/previous-versions/windows/it-pro/windows-7/cc749368(v=ws.10)).|
|VirtualizeDeleteFile|The problem occurs when several error messages display and the application can't delete files.<p>The fix makes the application's DeleteFile function call a virtual call to remedy the UAC and file virtualization issues that were introduced with Windows Vista. This fix also links other file APIs (for example, GetFileAttributes) to ensure that the virtualization of the file is deleted.<div class="alert">**Note:** For more detailed information about this application fix, see [Using the VirtualizeDeleteFile Fix](/previous-versions/windows/it-pro/windows-7/dd638360(v=ws.10)).</div>|
|VirtualizeHKCRLite|The problem occurs when an application fails to register COM components at runtime.<p>The fix redirects the HKCR write calls (HKLM) to the HKCU hive for a per-user COM registration. This fix operates much like the VirtualRegistry fix when you use the VirtualizeHKCR parameter; however, VirtualizeHKCRLite provides better performance.<p>HKCR is a virtual merge of the HKCU\Software\Classes and HKLM\Software\Classes directories. The use of HKCU is preferred if an application isn't elevated and is ignored if the application is elevated.<p>You typically use this compatibility fix with the VirtualizeRegisterTypeLib fix.<br>For more detailed information about this application fix, see [Using the VirtualizeHKCRLite Fix](/previous-versions/windows/it-pro/windows-7/dd638327(v=ws.10)).|
|VirtualizeRegisterTypeLib|The fix when used with the VirtualizeHKCRLite fix, ensures that the type library and the COM class registration happen simultaneously. This fix functions much like the RegistryTypeLib fix when the RegisterTypeLibForUser parameter is used.<div class="alert">**Note:** For more detailed information about this application fix, see [Using the VirtualizeRegisterTypelib Fix](/previous-versions/windows/it-pro/windows-7/dd638385(v=ws.10)).</div>|
|WaveOutIgnoreBadFormat|When this problem occurs when an Unable to initialize sound device from your audio driver error occurs; the application then closes.<p>The fix enables the application to ignore the format error and continue to function properly.|
|WerDisableReportException|The fix turns off the silent reporting of exceptions, including those exceptions reported by Object Linking and Embedding-Database (OLE DB), to the Windows Error Reporting tool. The fix intercepts the RtlReportException API and returns a STATUS_NOT_SUPPORTED error message.|
|Win7RTM/Win8RTM|The layer provides the application with Windows 7/Windows 8 compatibility mode.|
|WinxxRTMVersionLie|The problem occurs when an application fails because it doesn't find the correct version number for the required Windows operating system.<p>All version lie compatibility fixes address the issue whereby an application fails to function because it's checking for, but not finding, a specific version of the operating system. The version lie fix returns the appropriate operating system version information. For example, the VistaRTMVersionLie returns the Windows Vista version information to the application, regardless of the actual operating system version that is running on the computer.|
|Wing32SystoSys32|The problem occurs when an error message that states that the WinG library wasn't properly installed.<p>The fix detects whether the WinG32 library exists in the correct directory. If the library is located in the wrong location, this fix copies the information (typically during the runtime of the application) into the %WINDIR% \system32 directory.<p>**Important:** The application must have Administrator privileges for this fix to work.|
|WinSrv08R2RTM||
|WinXPSP2VersionLie|The problem occurs when an application experiences issues because of a VB runtime DLL.<p>The fix forces the application to follow these steps:<li>Open the Compatibility Administrator, and then select None for Operating System Mode.<li>On the Compatibility Fixes page, select WinXPSP2VersionLie, and then select Parameters.<li>The Options for /<fix_name/>; dialog box appears.<li>Type vbrun60.dll into the Module Name box, select Include, and then select Add.<li>Save the custom database.<div class="alert">**Note:** For more information about the WinXPSP2VersionLie application fix, see [Using the WinXPSP2VersionLie Fix](/previous-versions/windows/it-pro/windows-7/cc749518(v=ws.10)).</div>|
|WRPDllRegister|The application fails when it tries to register a COM component that is released together with Windows Vista and later.<p>The fix skips the processes of registering and unregistering WRP-protected COM components when calling the DLLRegisterServer and DLLUnregisterServer functions.<p>You can control this fix further by typing the following command at the command prompt:<p>`Component1.dll;Component2.dll`<br>Where Component1.dll and Component2.dll reflect the components to be skipped.<div class="alert">**Note:** For more detailed information about this application fix, see [Using the WRPDllRegister Fix](/previous-versions/windows/it-pro/windows-7/dd638345(v=ws.10)).</div>|
|WRPMitigation|The problem is indicated when an access denied error message displays when the application tries to access a protected operating system resource by using more than read-only access.<p>The fix emulates the successful authentication and modification of file and registry APIs, so that the application can continue.<div class="alert">**Note:** For more detailed information about WRPMitigation, see [Using the WRPMitigation Fix](/previous-versions/windows/it-pro/windows-7/dd638325(v=ws.10)).</div>|
|WRPRegDeleteKey|The problem occurs when an access denied error message that displays when the application tries to delete a registry key.<p>The fix verifies whether the registry key is WRP-protected. If the key is protected, this fix emulates the deletion process.|
|XPAfxIsValidAddress|The fix emulates the behavior of Windows XP for MFC42!AfxIsValidAddress.|
## Compatibility Modes
The following table lists the known compatibility modes.
|Compatibility Mode Name|Description|Included Compatibility Fixes|
|--- |--- |--- |
|WinSrv03|Emulates the Windows Server 2003 operating system.|<li>Win2k3RTMVersionLie<li>VirtualRegistry<li>ElevateCreateProcess<li>EmulateSorting<li>FailObsoleteShellAPIs<li>LoadLibraryCWD<li>HandleBadPtr<li>GlobalMemoryStatus2 GB<li>RedirectMP3Codec<li>EnableLegacyExceptionHandlinginOLE<li>NoGhost<li>HardwareAudioMixer|
|WinSrv03Sp1|Emulates the Windows Server 2003 with Service Pack 1 (SP1) operating system.|<li>Win2K3SP1VersionLie<li>VirtualRegistry<li>ElevateCreateProcess<li>EmulateSorting<li>FailObsoleteShellAPIs<li>LoadLibraryCWD<li>HandleBadPtr<li>EnableLegacyExceptionHandlinginOLE<li>RedirectMP3Codec<li>HardwareAudioMixer|

61
windows/deployment/planning/creating-a-custom-compatibility-fix-in-compatibility-administrator.md
View File

@ -1,61 +0,0 @@
---
title: Creating a Custom Compatibility Fix in Compatibility Administrator (Windows 10)
description: The Compatibility Administrator tool uses the term fix to describe the combination of compatibility information added to a customized database for a specific application.
manager: aaroncz
ms.author: frankroj
ms.service: windows-client
author: frankroj
ms.topic: conceptual
ms.subservice: itpro-deploy
ms.date: 10/28/2022
---
# Creating a Custom Compatibility Fix in Compatibility Administrator
**Applies to**
- Windows 10
- Windows 8.1
- Windows 8
- Windows 7
- Windows Server 2012
- Windows Server 2008 R2
The Compatibility Administrator tool uses the term *fix* to describe the combination of compatibility information added to a customized database for a specific application. This combination can include single application fixes, groups of fixes that work together as a compatibility mode, and blocking and non-blocking AppHelp messages.
> [!IMPORTANT]
> Fixes apply to a single application only; therefore, you must create multiple fixes if you need to fix the same issue in multiple applications.
## What is a Compatibility Fix?
A compatibility fix, previously known as a shim, is a small piece of code that intercepts API calls from applications. The fix transforms the API calls so that the current version of the operating system supports the application in the same way as previous versions of the operating system. This can mean anything from disabling a new feature in the current version of the operating system to emulating a particular behavior of an older version of the Windows API.
## Searching for Existing Compatibility Fixes
The Compatibility Administrator tool has preloaded fixes for many common applications, including known compatibility fixes, compatibility modes, and AppHelp messages. Before you create a new compatibility fix, you can search for an existing application and then copy and paste the known fixes into your customized database.
> [!IMPORTANT]
> Application Compatibility Toolkit (ACT) installs a 32-bit and a 64-bit version of the Compatibility Administrator tool. You must use the 32-bit version to create custom databases for 32-bit applications and the 64-bit version to create custom databases for 64-bit applications.
**To search for an existing application**
1. In the left-side pane of Compatibility Administrator, expand the **Applications** folder and search for your application name.
2. Click the application name to view the preloaded compatibility fixes, compatibility modes, or AppHelp messages.
## Creating a New Compatibility Fix
If you are unable to find a preloaded compatibility fix for your application, you can create a new one for use by your customized database.
**To create a new compatibility fix**
1. In the left-side pane of Compatibility Administrator underneath the **Custom Databases** heading, right-click the name of the database to which you want to apply the compatibility fix, click **Create New**, and then click **Application Fix**.
2. Type the name of the application to which the compatibility fix applies, type the name of the application vendor, browse to the location of the application file (.exe) on your computer, and then click **Next**.
3. Select the operating system for which your compatibility fix applies, click any applicable compatibility modes to apply to your compatibility fix, and then click **Next**.
4. Select any additional compatibility fixes to apply to your compatibility fix, and then click **Next**.
5. Select any additional criteria to use to match your applications to the AppHelp message, and then click **Finish**.
By default, Compatibility Administrator selects the basic matching criteria for your application. As a best practice, use a limited set of matching information to represent your application, because it reduces the size of the database. However, make sure you have enough information to correctly identify your application.
## Related topics
[Compatibility Administrator User's Guide](compatibility-administrator-users-guide.md)

67
windows/deployment/planning/creating-a-custom-compatibility-mode-in-compatibility-administrator.md
View File

@ -1,67 +0,0 @@
---
title: Create a Custom Compatibility Mode (Windows 10)
description: Windows® provides several compatibility modes, groups of compatibility fixes found to resolve many common application-compatibility issues.
manager: aaroncz
ms.author: frankroj
ms.service: windows-client
author: frankroj
ms.date: 10/28/2022
ms.topic: conceptual
ms.subservice: itpro-deploy
---
# Creating a Custom Compatibility Mode in Compatibility Administrator
**Applies to**
- Windows 10
- Windows 8.1
- Windows 8
- Windows 7
- Windows Server 2012
- Windows Server 2008 R2
Windows® provides several *compatibility modes*, groups of compatibility fixes found to resolve many common application-compatibility issues. While working with Compatibility Administrator, you might decide to group some of your individual compatibility fixes into a custom-compatibility mode, which you can then deploy and use on any of your compatibility databases.
## What Is a Compatibility Mode?
A compatibility mode is a group of compatibility fixes. A compatibility fix, previously known as a shim, is a small piece of code that intercepts API calls from applications. The fix transforms the API calls so that the current version of the operating system supports the application in the same way as previous versions of the operating system. This can be anything from disabling a new feature in Windows to emulating a particular behavior of an older version of the Windows API.
## Searching for Existing Compatibility Modes
The Compatibility Administrator tool has preloaded fixes for many common applications, including known compatibility fixes, compatibility modes, and AppHelp messages. Before you create a new compatibility mode, you can search for an existing application and then copy and paste the known fixes into your custom database.
> [!IMPORTANT]
> Application Compatibility Toolkit (ACT) installs a 32-bit and a 64-bit version of the Compatibility Administrator tool. You must use the 32-bit version to create custom databases for 32-bit applications and the 64-bit version to create custom databases for 64-bit applications.
**To search for an existing application**
1. In the left-side pane of Compatibility Administrator, expand the **Applications** folder and search for your application name.
2. Click the application name to view the preloaded compatibility modes, compatibility fixes, or AppHelp messages.
## Creating a New Compatibility Mode
If you are unable to find a preloaded compatibility mode for your application, you can create a new one for use by your custom database.
> [!IMPORTANT]
> A compatibility mode includes a set of compatibility fixes and must be deployed as a group. Therefore, you should include only fixes that you intend to deploy together to the database.
**To create a new compatibility mode**
1. In the left-side pane of Compatibility Administrator, underneath the **Custom Databases** heading, right-click the name of the database to which you will apply the compatibility mode, click **Create New**, and then click **Compatibility Mode**.
2. Type the name of your custom-compatibility mode into the **Name of the compatibility mode** text box.
3. Select each of the available compatibility fixes to include in your custom-compatibility mode and then click **&gt;**.
> [!IMPORTANT]
> If you are unsure which compatibility fixes to add, you can click **Copy Mode**. The **Select Compatibility Mode** dialog box appears and enables you to select from the preloaded compatibility modes. After you select a compatibility mode and click **OK**, any compatibility fixes that are included in the preloaded compatibility mode will be automatically added to your custom-compatibility mode.
> If you have any compatibility fixes that require additional parameters, you can select the fix, and then click **Parameters**. The **Options for &lt;Compatibility\_Fix\_Name&gt;** dialog box appears, enabling you to update the parameter fields.
4. After you are done selecting the compatibility fixes to include, click **OK**.
The compatibility mode is added to your custom database.
## Related topics
[Compatibility Administrator User's Guide](compatibility-administrator-users-guide.md)

86
windows/deployment/planning/creating-an-apphelp-message-in-compatibility-administrator.md
View File

@ -1,86 +0,0 @@
---
title: Create AppHelp Message in Compatibility Administrator (Windows 10)
description: Create an AppHelp text message with Compatibility Administrator; a message that appears upon starting an app with major issues on the Windows® operating system.
manager: aaroncz
ms.author: frankroj
ms.service: windows-client
author: frankroj
ms.date: 10/28/2022
ms.topic: conceptual
ms.subservice: itpro-deploy
---
# Creating an AppHelp Message in Compatibility Administrator
**Applies to**
- Windows 10
- Windows 8.1
- Windows 8
- Windows 7
- Windows Server 2012
- Windows Server 2008 R2
The Compatibility Administrator tool enables you to create an AppHelp text message. This is a blocking or non-blocking message that appears when a user starts an application that you know has major functionality issues on the Windows® operating system.
## Blocking Versus Non-Blocking AppHelp Messages
A blocking AppHelp message prevents the application from starting and displays a message to the user. You can define a specific URL where the user can download an updated driver or other fix to resolve the issue. When using a blocking AppHelp message, you must also define the file-matching information to identify the version of the application and enable the corrected version to continue.
A non-blocking AppHelp message doesn't prevent the application from starting, but provides a message to the user that includes information such as security issues, updates to the application, or changes to the location of network resources.
## Searching for Existing Compatibility Fixes
The Compatibility Administrator tool has preloaded fixes for many common applications, including known compatibility fixes, compatibility modes, and AppHelp messages. Before you create a new AppHelp message, you can search for an existing application and then copy and paste the known fixes into your custom database.
> [!IMPORTANT]
> Application Compatibility Toolkit (ACT) installs a 32-bit and a 64-bit version of the Compatibility Administrator tool. You must use the 32-bit version to create custom databases for 32-bit applications and the 64-bit version to create custom databases for 64-bit applications.
**To search for an existing application**
1. In the left-side pane of Compatibility Administrator, expand the **Applications** folder and search for your application name.
2. Click the application name to view the preloaded AppHelp messages, compatibility fixes, and compatibility modes.
## Creating a New AppHelp Message
If you're unable to find a preloaded AppHelp message for your application, you can create a new one for use by your custom database.
**To create a new AppHelp message**
1. In the left-side pane of Compatibility Administrator, below the **Custom Databases** heading, right-click the name of the database to which you'll apply the AppHelp message, click **Create New**, and then click **AppHelp Message**.
2. Type the name of the application to which this AppHelp message applies, type the name of the application vendor, browse to the location of the application file (.exe) on your computer, and then click **Next**.
The wizard shows the known **Matching Information**, which is used for program identification.
3. Select any other criteria to use to match your applications to the AppHelp message, and then click **Next**.
By default, Compatibility Administrator selects the basic matching criteria for your application.
The wizard shows the **Enter Message Type** options.
4. Click one of the following options:
- **Display a message and allow this program to run**. This message is non-blocking, which means that you can alert the user that there might be a problem, but the application isn't prevented from starting.
- **Display a message and do not allow this program to run**. This message is blocking, which means that the application won't start. Instead, this message points the user to a location that provides more information about fixing the issue.
5. Click **Next**.
The wizard then shows the **Enter Message Information** fields.
6. Type the website URL and the message text to appear when the user starts the application, and then click **Finish**.
## Issues with AppHelp Messages and Computers Running Windows 2000
The following issues might occur with computers running Windows 2000:
- You might be unable to create a custom AppHelp message.
- The AppHelp message text used for system database entries might not appear.
- Copying an AppHelp entry for a system database or a custom-compatibility fix from a system database might cause Compatibility Administrator to hide the descriptive text.
## Related topics
[Compatibility Administrator User's Guide](compatibility-administrator-users-guide.md)

58
windows/deployment/planning/enabling-and-disabling-compatibility-fixes-in-compatibility-administrator.md
View File

@ -1,58 +0,0 @@
---
title: Enabling and Disabling Compatibility Fixes in Compatibility Administrator
description: You can disable and enable individual compatibility fixes in your customized databases for testing and troubleshooting purposes.
manager: aaroncz
ms.author: frankroj
ms.service: windows-client
author: frankroj
ms.topic: conceptual
ms.subservice: itpro-deploy
ms.date: 10/28/2022
---
# Enabling and Disabling Compatibility Fixes in Compatibility Administrator
**Applies to**
- Windows 10
- Windows 8.1
- Windows 8
- Windows 7
- Windows Server 2012
- Windows Server 2008 R2
You can disable and enable individual compatibility fixes in your customized databases for testing and troubleshooting purposes.
## Disabling Compatibility Fixes
Customized compatibility databases can become quite complex as you add your fixes for the multiple applications found in your organization. Over time, you may find you need to disable a particular fix in your customized database. For example, if a software vendor releases a fix for an issue addressed in one of your compatibility fixes, you must validate that the vendor's fix is correct and that it resolves your issue. To do this, you must temporarily disable the compatibility fix and then test your application.
>[!IMPORTANT]
>Application Compatibility Toolkit (ACT) installs a 32-bit and a 64-bit version of the Compatibility Administrator tool. You must use the 32-bit version to work with custom databases for 32-bit applications and the 64-bit version to work with custom databases for 64-bit applications.
**To disable a compatibility fix within a database**
1. In the left-sde pane of Compatibility Administrator, expand the custom database that includes the compatibility fix that you want to disable, and then select the specific compatibility fix.
The compatibility fix details appear in the right-hand pane.
2. On the **Database** menu, click **Disable Entry**.
**Important**
When you disable an entry, it will remain disabled even if you do not save the database file.
## Enabling Compatibility Fixes
You can enable your disabled compatibility fixes at any time.
**To enable a compatibility fix within a database**
1. In the left-side pane of Compatibility Administrator, expand the custom database that includes the compatibility fix that you want to enable, and then select the specific compatibility fix.
The compatibility fix details appear in the right-side pane.
2. On the **Database** menu, click **Enable Entry**.
## Related topics
[Compatibility Administrator User's Guide](compatibility-administrator-users-guide.md)

38
windows/deployment/planning/fixing-applications-by-using-the-sua-tool.md
View File

@ -1,38 +0,0 @@
---
title: Fixing Applications by Using the SUA Tool (Windows 10)
description: On the user interface for the Standard User Analyzer (SUA) tool, you can apply fixes to an application.
manager: aaroncz
ms.author: frankroj
ms.service: windows-client
author: frankroj
ms.date: 10/28/2022
ms.topic: conceptual
ms.subservice: itpro-deploy
---
# Fixing Applications by Using the SUA Tool
**Applies to**
- Windows 10
- Windows 8.1
- Windows 8
- Windows 7
- Windows Server 2012
- Windows Server 2008 R2
On the user interface for the Standard User Analyzer (SUA) tool, you can apply fixes to an application.
**To fix an application by using the SUA tool**
1. Use the SUA tool to test an application. For more information, see [Using the SUA Tool](using-the-sua-tool.md).
2. After you finish testing, open the SUA tool.
3. On the **Mitigation** menu, click the command that corresponds to the action that you want to take. The following table describes the commands.
|Mitigation menu command|Description|
|--- |--- |
|**Apply Mitigations**|Opens the **Mitigate AppCompat Issues** dialog box, in which you can select the fixes that you intend to apply to the application.|
|**Undo Mitigations**|Removes the application fixes that you just applied.<p>This option is available only after you apply an application fix and before you close the SUA tool. Alternatively, you can manually remove application fixes by using **Programs and Features** in Control Panel.|
|**Export Mitigations as Windows Installer file**|Exports your application fixes as a Windows® Installer (.msi) file, which can then be deployed to other computers that are running the application.|

BIN
windows/deployment/planning/images/dep-win8-l-act-appcallosthroughiat.jpg
View File

Binary file not shown.
Side by Side

Before

Width:  |  Height:  |  Size: 79 KiB

BIN
windows/deployment/planning/images/dep-win8-l-act-appredirectwithcompatfix.jpg
View File

Binary file not shown.
Side by Side

Before

Width:  |  Height:  |  Size: 90 KiB

BIN
windows/deployment/planning/images/dep-win8-l-act-compatadminflowchart.jpg
View File

Binary file not shown.
Side by Side

Before

Width:  |  Height:  |  Size: 103 KiB

BIN
windows/deployment/planning/images/dep-win8-l-act-suaflowchart.jpg
View File

Binary file not shown.
Side by Side

Before

Width:  |  Height:  |  Size: 101 KiB

BIN
windows/deployment/planning/images/dep-win8-l-act-suawizardflowchart.jpg
View File

Binary file not shown.
Side by Side

Before

Width:  |  Height:  |  Size: 91 KiB

63
windows/deployment/planning/installing-and-uninstalling-custom-compatibility-databases-in-compatibility-administrator.md
View File

@ -1,63 +0,0 @@
---
title: Install/Uninstall Custom Databases (Windows 10)
description: The Compatibility Administrator tool enables the creation and the use of custom-compatibility and standard-compatibility databases.
manager: aaroncz
ms.author: frankroj
ms.service: windows-client
author: frankroj
ms.date: 10/28/2022
ms.topic: conceptual
ms.subservice: itpro-deploy
---
# Installing and Uninstalling Custom Compatibility Databases in Compatibility Administrator
**Applies to**
- Windows 10
- Windows 8.1
- Windows 8
- Windows 7
- Windows Server 2012
- Windows Server 2008 R2
The Compatibility Administrator tool enables the creation and the use of custom-compatibility and standard-compatibility databases. Both the custom databases and the standard databases store the known compatibility fixes, compatibility modes, and AppHelp messages. They also store the required application-matching information for installation on your local computers.
By default, the Windows® operating system installs a System Application Fix database for use with the Compatibility Administrator. This database can be updated through Windows Update, and is stored in the %WINDIR% \\AppPatch directory. Your custom databases are automatically stored in the %WINDIR% \\AppPatch\\Custom directory and are installed by using the Sdbinst.exe tool provided with the Compatibility Administrator.
> [!IMPORTANT]
> Application Compatibility Toolkit (ACT) installs a 32-bit and a 64-bit version of the Compatibility Administrator tool. You must use the 32-bit version to work with custom databases for 32-bit applications and the 64-bit version to work with custom databases for 64-bit applications.
In addition, you must deploy your databases to your organization's computers before the included fixes will have any effect on the application issue. For more information about deploying your database, see [Using the Sdbinst.exe Command-Line Tool](using-the-sdbinstexe-command-line-tool.md).
## Installing a Custom Database
Installing your custom-compatibility database enables you to fix issues with your installed applications.
**To install a custom database**
1. In the left-side pane of Compatibility Administrator, click the custom database to install to your local computers.
2. On the **File** menu, click **Install**.
The Compatibility Administrator installs the database, which appears in the **Installed Databases** list.
The relationship between your database file and an included application occurs in the registry. Every time you start an application, the operating system checks the registry for compatibility-fix information and, if found, retrieves the information from your customized database file.
## Uninstalling a Custom Database
When a custom database is no longer necessary, either because the applications are no longer used or because the vendor has provided a fix that resolves the compatibility issues, you can uninstall the custom database.
**To uninstall a custom database**
1. In the **Installed Databases** list, which appears in the left-side pane of Compatibility Administrator, click the database to uninstall from your local computers.
2. On the **File** menu, click **Uninstall**.
## Related topics
[Compatibility Administrator User's Guide](compatibility-administrator-users-guide.md)

38
windows/deployment/planning/managing-application-compatibility-fixes-and-custom-fix-databases.md
View File

@ -1,38 +0,0 @@
---
title: Managing Application-Compatibility Fixes and Custom Fix Databases (Windows 10)
description: Learn why you should use compatibility fixes, and how to deploy and manage custom-compatibility fix databases.
manager: aaroncz
ms.author: frankroj
ms.service: windows-client
author: frankroj
ms.date: 10/28/2022
ms.topic: conceptual
ms.subservice: itpro-deploy
---
# Managing Application-Compatibility Fixes and Custom Fix Databases
**Applies to**
- Windows 10
- Windows 8.1
- Windows 8
- Windows 7
- Windows Server 2012
- Windows Server 2008 R2
This section provides information about managing your application-compatibility fixes and custom-compatibility fix databases. This section explains the reasons for using compatibility fixes and how to deploy custom-compatibility fix databases.
## In this section
|Topic|Description|
|--- |--- |
|[Understanding and Using Compatibility Fixes](understanding-and-using-compatibility-fixes.md)|As the Windows operating system evolves to support new technology and functionality, the implementations of some functions may change. This can cause problems for applications that relied upon the original implementation. You can avoid compatibility issues by using the Microsoft Windows Application Compatibility (Compatibility Fix) infrastructure to create a specific application fix for a particular version of an application.|
|[Compatibility Fix Database Management Strategies and Deployment](compatibility-fix-database-management-strategies-and-deployment.md)|After you determine that you will use compatibility fixes in your application-compatibility mitigation strategy, you must define a strategy to manage your custom compatibility-fix database. Typically, you can use one of two approaches:|
|[Testing Your Application Mitigation Packages](testing-your-application-mitigation-packages.md)|This topic provides details about testing your application-mitigation packages, including recommendations about how to report your information and how to resolve any outstanding issues.|
## Related topics
[Compatibility Administrator User's Guide](compatibility-administrator-users-guide.md)
[Using the Compatibility Administrator Tool](using-the-compatibility-administrator-tool.md)

60
windows/deployment/planning/searching-for-fixed-applications-in-compatibility-administrator.md
View File

@ -1,60 +0,0 @@
---
title: Searching for Fixed Applications in Compatibility Administrator (Windows 10)
description: Compatibility Administrator can locate specific executable (.exe) files with previously applied compatibility fixes, compatibility modes, or AppHelp messages.
manager: aaroncz
ms.author: frankroj
ms.service: windows-client
author: frankroj
ms.date: 10/28/2022
ms.topic: conceptual
ms.subservice: itpro-deploy
---
# Searching for Fixed Applications in Compatibility Administrator
**Applies to**
- Windows 10
- Windows 8.1
- Windows 8
- Windows 7
- Windows Server 2012
- Windows Server 2008 R2
With the search functionality in Compatibility Administrator, you can locate specific executable (.exe) files with previously applied compatibility fixes, compatibility modes, or AppHelp messages. This is particularly useful if you are trying to identify applications with a specific compatibility fix or identifying which fixes are applied to a specific application.
The **Query Compatibility Databases** tool provides additional search options. For more information, see [Searching for Installed Compatibility Fixes with the Query Tool in Compatibility Administrator](searching-for-installed-compatibility-fixes-with-the-query-tool-in-compatibility-administrator.md).
## Searching for Previously Applied Compatibility Fixes
> [!IMPORTANT]
> You must perform your search with the correct version of the Compatibility Administrator tool. If you are searching for a 32-bit custom database, you must use the 32-bit version of Compatibility Administrator. If you are searching for a 64-bit custom database, you must use the 64-bit version of Compatibility Administrator.
**To search for previous fixes**
1. On the Compatibility Administrator toolbar, click **Search**.
2. Click **Browse** to locate the directory location to search for .exe files.
3. Select at least one check box from **Entries with Compatibility Fixes**, **Entries with Compatibility Modes**, or **Entries with AppHelp**.
4. Click **Find Now**.
The query runs, returning your results in the lower pane.
## Viewing Your Query Results
Your query results display the affected files, the application location, the application name, the type of compatibility fix, and the custom database that provided the fix.
## Exporting Your Query Results
You can export your search results to a text (.txt) file for later review or archival.
**To export your search results**
1. In the **Search for Fixes** dialog box, click **Export**.
2. Browse to the location where you want to store your search result file, and then click **Save**.
## Related topics
[Compatibility Administrator User's Guide](compatibility-administrator-users-guide.md)

143
windows/deployment/planning/searching-for-installed-compatibility-fixes-with-the-query-tool-in-compatibility-administrator.md
View File

@ -1,143 +0,0 @@
---
title: Searching for Installed Compatibility Fixes with the Query Tool in Compatibility Administrator (Windows 10)
description: You can access the Query tool from within Compatibility Administrator. The Query tool provides the same functionality as using the Search feature.
manager: aaroncz
ms.author: frankroj
ms.service: windows-client
author: frankroj
ms.topic: conceptual
ms.subservice: itpro-deploy
ms.date: 10/28/2022
---
# Searching for Installed Compatibility Fixes with the Query Tool in Compatibility Administrator
**Applies to**
- Windows 10
- Windows 8.1
- Windows 8
- Windows 7
- Windows Server 2012
- Windows Server 2008 R2
You can access the Query tool from within Compatibility Administrator. The Query tool provides the same functionality as using the Search feature.
For information about the Search feature, see [Searching for Fixed Applications in Compatibility Administrator](searching-for-fixed-applications-in-compatibility-administrator.md). However, the Query tool provides more detailed search criteria, including tabs that enable you to search the program properties, the compatibility fix properties, and the fix description. You can perform a search by using SQL SELECT and WHERE clauses, in addition to searching specific types of databases.
> [!IMPORTANT]
> You must perform your search with the correct version of the Compatibility Administrator tool. To use the Query tool to search for a 32-bit custom database, you must use the 32-bit version of Compatibility Administrator. To use the Query tool to search for a 64-bit custom database, you must use the 64-bit version of Compatibility Administrator.
## Querying by Using the Program Properties Tab
You can use the **Program Properties** tab of the Query tool to search for any compatibility fix, compatibility mode, or AppHelp for a specific application.
**To query by using the Program Properties tab**
1. On the Compatibility Administrator toolbar, click **Query**.
2. In the **Look in** drop-down list, select the appropriate database type to search.
3. Type the location of the application you are searching for into the **Search for the Application** field.
This name should be the same as the name in the **Applications** area (left pane) of Compatibility Administrator.
4. Type the application executable (.exe) file name into the **Search for the File** box. If you leave this box blank, the percent (%) sign appears as a wildcard to search for any file.
You must designate the executable name that was given when the compatibility fix was added to the database.
5. Optionally, select the check box for one of the following types of compatibility fix:
- **Compatibility Modes**
- **Compatibility Fixes**
- **Application Helps**
> [!IMPORTANT]
> If you do not select any of the check boxes, the search will look for all types of compatibility fixes. Do not select multiple check boxes because only applications that match all of the requirements will appear.
6. Click **Find Now**.
The query runs and the results of the query are displayed in the lower pane.
## Querying by Using the Fix Properties Tab
You can use the **Fix Properties** tab of the Query tool to search for any application affected by a specific compatibility fix or a compatibility mode. For example, you can search for any application affected by the ProfilesSetup compatibility mode.
**To query by using the Fix Properties tab**
1. On the Compatibility Administrator toolbar, click **Query**.
2. Click the **Fix Properties** tab.
3. In the **Look in** drop-down list, select the appropriate database type to search.
4. Type the name of the compatibility fix or compatibility mode into the **Search for programs fixed using** field.
>[!NOTE]
>You can use the percent (%) symbol as a wildcard in your fix-properties query, as a substitute for any string of zero or more characters
5. Select the check box for either **Search in Compatibility Fixes** or **Search in Compatibility Modes**.
>[!IMPORTANT]
>Your text must match the type of compatibility fix or mode for which you are performing the query. For example, entering the name of a compatibility fix and selecting the compatibility mode check box will not return any results. Additionally, if you select both check boxes, the query will search for the fix by compatibility mode and compatibility fix. Only applications that match both requirements appear.
6. Click **Find Now**.
The query runs and the results of the query are displayed in the lower pane.
## Querying by Using the Fix Description Tab
You can use the **Fix Description** tab of the Query tool to add parameters that enable you to search your compatibility databases by application title or solution description text.
**To query by using the Fix Description tab**
1. On the Compatibility Administrator toolbar, click **Query**.
2. Click the **Fix Description** tab.
3. In the **Look in** drop-down list, select the appropriate database type to search.
4. Type your search keywords into the box **Words to look for**. Use commas to separate multiple keywords.
>[!IMPORTANT]
>You cannot use wildcards as part of the Fix Description search query because the default behavior is to search for any entry that meets your search criteria.
5. Refine your search by selecting **Match any word** or **Match all words** from the drop-down list.
6. Click **Find Now**.
The query runs and the results of the query are displayed in the lower pane.
## Querying by Using the Advanced Tab
You can use the **Fix Description** tab of the Query tool to add additional SQL Server SELECT and WHERE clauses to your search criteria.
**To query by using the Advanced tab**
1. On the Compatibility Administrator toolbar, click **Query**.
2. Click the **Advanced** tab.
3. In the **Look in** drop-down list, select the appropriate database type to search.
4. Select the appropriate SELECT clause for your search from the **Select clauses** box. For example, **APP\_NAME**.
The **APP\_NAME** clause appears in the **SELECT** field. You can add as many additional clauses as you require. They will appear as columns in your search results.
5. Select the appropriate WHERE clause for your search from the **Where clauses** box. For example, **DATABASE\_NAME**.
The **DATABASE\_NAME =** clause appears in the **WHERE** box.
6. Type the appropriate clause criteria after the equal (=) sign in the **WHERE** box. For example, **DATABASE\_NAME = "Custom\_Database"**.
You must surround your clause criteria text with quotation marks (") for the clause to function properly.
7. Click **Find Now**.
The query runs and the results of the query are displayed in the lower pane.
## Exporting Your Search Results
You can export any of your search results into a tab-delimited text (.txt) file for later review or for archival purposes.
**To export your results**
1. After you have completed your search by using the Query tool, click **Export**.
The **Save results to a file** dialog box appears.
2. Browse to the location where you intend to store the search results file, and then click **Save**.
## Related topics
[Compatibility Administrator User's Guide](compatibility-administrator-users-guide.md)

39
windows/deployment/planning/showing-messages-generated-by-the-sua-tool.md
View File

@ -1,39 +0,0 @@
---
title: Showing Messages Generated by the SUA Tool (Windows 10)
description: On the user interface for the Standard User Analyzer (SUA) tool, you can show the messages that the tool has generated.
manager: aaroncz
ms.author: frankroj
ms.service: windows-client
author: frankroj
ms.date: 10/28/2022
ms.topic: conceptual
ms.subservice: itpro-deploy
---
# Showing Messages Generated by the SUA Tool
**Applies to**
- Windows 10
- Windows 8.1
- Windows 8
- Windows 7
- Windows Server 2012
- Windows Server 2008 R2
On the user interface for the Standard User Analyzer (SUA) tool, you can show the messages that the tool has generated.
**To show the messages that the SUA tool has generated**
1. Use the SUA tool to test an application. For more information, see [Using the SUA Tool](using-the-sua-tool.md).
2. After you finish testing, in the SUA tool, click the **App Info** tab.
3. On the **View** menu, click the command that corresponds to the messages that you want to see. The following table describes the commands.
|View menu command|Description|
|--- |--- |
|**Error Messages**|When this command is selected, the user interface shows error messages that the SUA tool has generated. Error messages are highlighted in pink.<p>This command is selected by default.|
|**Warning Messages**|When this command is selected, the user interface shows warning messages that the SUA tool has generated. Warning messages are highlighted in yellow.|
|**Information Messages**|When this command is selected, the user interface shows informational messages that the SUA tool has generated. Informational messages are highlighted in green.|
|**Detailed Information**|When this command is selected, the user interface shows information that the SUA tool has generated, such as debug, stack trace, stop code, and severity information.|

37
windows/deployment/planning/sua-users-guide.md
View File

@ -1,37 +0,0 @@
---
title: SUA User's Guide (Windows 10)
description: Learn how to use Standard User Analyzer (SUA). SUA can test your apps and monitor API calls to detect compatibility issues related to the Windows User Account Control (UAC) feature.
manager: aaroncz
ms.author: frankroj
ms.service: windows-client
author: frankroj
ms.date: 10/28/2022
ms.topic: conceptual
ms.subservice: itpro-deploy
---
# SUA User's Guide
**Applies to**
- Windows 10
- Windows 8.1
- Windows 8
- Windows 7
- Windows Server 2012
- Windows Server 2008 R2
You can use Standard User Analyzer (SUA) to test your applications and monitor API calls to detect compatibility issues related to the User Account Control (UAC) feature in Windows.
You can use SUA in either of the following ways:
- **Standard User Analyzer Wizard.** A wizard that guides you through a step-by-step process to locate and fix issues, without options for more analysis.
- **Standard User Analyzer Tool.** A full-function tool in which you can perform in-depth analysis and fix issues.
## In this section
|Topic|Description|
|--- |--- |
|[Using the SUA wizard](using-the-sua-wizard.md)|The Standard User Analyzer (SUA) wizard works much like the SUA tool to evaluate User Account Control (UAC) issues. However, the SUA wizard doesn't offer detailed analysis, and it can't disable virtualization or elevate your permissions.|
|[Using the SUA Tool](using-the-sua-tool.md)|By using the Standard User Analyzer (SUA) tool, you can test your applications and monitor API calls to detect compatibility issues with the User Account Control (UAC) feature.|

39
windows/deployment/planning/tabs-on-the-sua-tool-interface.md
View File

@ -1,39 +0,0 @@
---
title: Tabs on the SUA Tool Interface (Windows 10)
description: The tabs in the Standard User Analyzer (SUA) tool show the User Account Control (UAC) issues for the applications that you analyze.
manager: aaroncz
ms.author: frankroj
ms.service: windows-client
author: frankroj
ms.date: 10/28/2022
ms.topic: conceptual
ms.subservice: itpro-deploy
---
# Tabs on the SUA Tool Interface
**Applies to**
- Windows 10
- Windows 8.1
- Windows 8
- Windows 7
- Windows Server 2012
- Windows Server 2008 R2
The tabs in the Standard User Analyzer (SUA) tool show the User Account Control (UAC) issues for the applications that you analyze.
The following table provides a description of each tab on the user interface for the SUA tool.
|Tab name|Description|
|--- |--- |
|App Info|Provides the following information for the selected application:<li>Debugging information<li>Error, warning, and informational messages (if they are enabled)<li>Options for running the application|
|File|Provides information about access to the file system.<p>For example, this tab might show an attempt to write to a file that only administrators can typically access.|
|Registry|Provides information about access to the system registry.<p>For example, this tab might show an attempt to write to a registry key that only administrators can typically access.|
|INI|Provides information about WriteProfile API issues.<p>For example, in the Calculator tool (Calc.exe) in Windows® XP, when you change the view from **Standard** to **Scientific**, Calc.exe calls the WriteProfile API to write to the Windows\Win.ini file. The Win.ini file is writable only for administrators.|
|Token|Provides information about access-token checking.<p>For example, this tab might show an explicit check for the Builtin\Administrators security identifier (SID) in the user's access token. This operation may not work for a standard user.|
|Privilege|Provides information about permissions.<p>For example, this tab might show an attempt to explicitly enable permissions that do not work for a standard user.|
|Name Space|Provides information about creation of system objects.<p>For example, this tab might show an attempt to create a new system object, such as an event or a memory map, in a restricted namespace. Applications that attempt this kind of operation do not function for a standard user.|
|Other Objects|Provides information related to applications accessing objects other than files and registry keys.|
|Process|Provides information about process elevation.<p>For example, this tab might show the use of the CreateProcess API to open an executable (.exe) file that, in turn, requires process elevation that will not function for a standard user.|

82
windows/deployment/planning/testing-your-application-mitigation-packages.md
View File

@ -1,82 +0,0 @@
---
title: Testing Your Application Mitigation Packages (Windows 10)
description: Learn how to test your application-mitigation packages, including how to report your information and how to resolve any outstanding issues.
manager: aaroncz
ms.author: frankroj
ms.service: windows-client
author: frankroj
ms.date: 10/28/2022
ms.topic: conceptual
ms.subservice: itpro-deploy
---
# Testing Your Application Mitigation Packages
**Applies to**
- Windows 10
- Windows 8.1
- Windows 8
- Windows 7
- Windows Server 2012
- Windows Server 2008 R2
This topic provides details about testing your application-mitigation packages, including recommendations about how to report your information and how to resolve any outstanding issues.
## Testing Your Application Mitigation Packages
Testing your application mitigation package strategies is an iterative process, whereby the mitigation strategies that prove unsuccessful will need to be revised and retested. The testing process includes a series of tests in the test environment and one or more pilot deployments in the production environment.
**To test your mitigation strategies**
1. Perform the following steps for each of the applications for which you have developed mitigations.
1. Test the mitigation strategy in your test environment.
2. If the mitigation strategy is unsuccessful, revise the mitigation strategy and perform step 1 again.
At the end of this step, you will have successfully tested all of your mitigation strategies in your test environment and can move to your pilot deployment environment.
2. Perform the following steps in the pilot deployments for each of the applications for which you have developed mitigations.
1. Test the mitigation strategy in your pilot deployment.
2. If the mitigation strategy is unsuccessful, revise the mitigation strategy and perform Step 2 again.
At the end of this step, you will have successfully tested all of your mitigation strategies in your pilot environment.
## Reporting the Compatibility Mitigation Status to Stakeholders
After testing your application mitigation package, you must communicate your status to the appropriate stakeholders before deployment begins. We recommend that you perform this communication by using the following status ratings.
- **Resolved application compatibility issues**. This status indicates that the application compatibility issues are resolved and that these applications represent no risk to your environment.
- **Unresolved application compatibility issues**. This status indicates that there are unresolved issues for the specifically defined applications. Because these applications are a risk to your environment, more discussion is required before you can resolve the compatibility issues.
- **Changes to user experience**. This status indicates that the fix will change the user experience for the defined applications, possibly requiring your staff to receive further training. More investigation is required before you can resolve the compatibility issues.
- **Changes in help desk procedures and processes**. This status indicates that the fix will require changes to your help desk's procedures and processes, possibly requiring your support staff to receive further training. More investigation is required before you can resolve the compatibility issues.
## Resolving Outstanding Compatibility Issues
At this point, you probably cannot resolve any unresolved application compatibility issues by automated mitigation methods or by modifying the application. Resolve any outstanding application compatibility issues by using one of the following methods.
- Apply specific compatibility modes, or run the program as an Administrator, by using the Compatibility Administrator tool.
> [!NOTE]
> For more information about using Compatibility Administrator to apply compatibility fixes and compatibility modes, see [Using the Compatibility Administrator Tool](using-the-compatibility-administrator-tool.md).
- Run the application in a virtual environment.
Run the application in a version of Windows supported by the application in a virtualized environment. This method ensures application compatibility, because the application is running on a supported operating system.
- Resolve application compatibility by using non-Microsoft tools.
If the application was developed in an environment other than Microsoft Visual Studio®, you must use non-Microsoft debugging and analysis tools to help resolve the remaining application compatibility issues.
- Outsource the application compatibility mitigation.
If your developers have insufficient resources to resolve the application compatibility issues, outsource the mitigation effort to another organization within your company.
## Related topics
[Managing Application-Compatibility Fixes and Custom Fix Databases](managing-application-compatibility-fixes-and-custom-fix-databases.md)

88
windows/deployment/planning/understanding-and-using-compatibility-fixes.md
View File

@ -1,88 +0,0 @@
---
title: Understanding and Using Compatibility Fixes (Windows 10)
description: As the Windows operating system evolves to support new technology and functionality, the implementations of some functions may change.
manager: aaroncz
ms.author: frankroj
ms.service: windows-client
author: frankroj
ms.topic: conceptual
ms.subservice: itpro-deploy
ms.date: 10/28/2022
---
# Understanding and Using Compatibility Fixes
**Applies to**
- Windows 10
- Windows 8.1
- Windows 8
- Windows 7
- Windows Server 2012
- Windows Server 2008 R2
As the Windows operating system evolves to support new technology and functionality, the implementations of some functions may change. This can cause problems for applications that relied upon the original implementation. You can avoid compatibility issues by using the Microsoft Windows Application Compatibility (Compatibility Fix) infrastructure to create a specific application fix for a particular version of an application.
## How the Compatibility Fix Infrastructure Works
The Compatibility Fix infrastructure uses the linking ability of APIs to redirect an application from Windows code directly to alternative code that implements the compatibility fix.
The Windows Portable Executable File Format includes headers that contain the data directories that are used to provide a layer of indirection between the application and the linked file. API calls to the external binary files take place through the Import Address Table (IAT), which then directly calls the Windows operating system, as shown in the following figure.
![act app calls operating system through iat.](images/dep-win8-l-act-appcallosthroughiat.jpg)
Specifically, the process modifies the address of the affected Windows function in the IAT to point to the compatibility fix code, as shown in the following figure.
![act app redirect with compatibility fix.](images/dep-win8-l-act-appredirectwithcompatfix.jpg)
>[!NOTE]
>For statically linked DLLs, the code redirection occurs as the application loads. You can also fix dynamically linked DLLs by hooking into the GetProcAddress API.
## Design Implications of the Compatibility Fix Infrastructure
There are important considerations to keep in mind when determining your application fix strategy, due to certain characteristics of the Compatibility Fix infrastructure.
- The compatibility fix is not part of the Windows operating system (as shown in the previous figure). Therefore, the same security restrictions apply to the compatibility fix as apply to the application code, which means that you cannot use compatibility fixes to bypass any of the security mechanisms of the operating system. Therefore, compatibility fixes do not increase your security exposure, nor do you need to lower your security settings to accommodate compatibility fixes.
- The Compatibility Fix infrastructure injects additional code into the application before it calls the operating system. This means that any remedy that can be accomplished by a compatibility fix can also be addressed by fixing the application code.
- The compatibility fixes run as user-mode code inside of a user-mode application process. This means that you cannot use a compatibility fix to fix kernel-mode code issues. For example, you cannot use a compatibility fix to resolve device-driver issues.
> [!NOTE]
> Some antivirus, firewall, and anti-spyware code runs in kernel mode.
## Determining When to Use a Compatibility Fix
The decision to use compatibility fixes to remedy your compatibility issues may involve more than just technical issues. The following scenarios reflect other common reasons for using a compatibility fix.
### Scenario 1
**The compatibility issue exists on an application which is no longer supported by the vendor.**
As in many companies, you may run applications for which the vendor has ended support. In this situation, you cannot have the vendor make the fix, nor can you access the source code to modify the issue yourself. However, it is possible that the use of a compatibility fix might resolve the compatibility issue.
### Scenario 2
**The compatibility issue exists on an internally created application.**
While it is preferable to fix the application code to resolve the issue, this is not always possible. Your internal team might not be able to fix all of the issues prior to the deployment of the new operating system. Instead, they might choose to employ a compatibility fix anywhere that it is possible. They can then fix the code only for issues that cannot be resolved in this manner. Through this method, your team can modify the application as time permits, without delaying the deployment of the new operating system into your environment.
### Scenario 3
**The compatibility issue exists on an application for which a compatible version is to be released in the near future, or an application that is not critical to the organization, regardless of its version.**
In the situation where an application is either unimportant to your organization, or for which a newer, compatible version is to be released shortly, you can use a compatibility fix as a temporary solution. This means that you can continue to use the application without delaying the deployment of a new operating system, with the intention of updating your configuration as soon as the new version is released.
## Determining Which Version of an Application to Fix
You can apply a compatibility fix to a particular version of an application, either by using the "up to or including" clause or by selecting that specific version. This means that the next version of the application will not have the compatibility fix automatically applied. This is important, because it allows you to continue to use your application, but it also encourages the vendor to fix the application.
## Support for Compatibility Fixes
Compatibility fixes are shipped as part of the Windows operating system and are updated by using Windows Update. Therefore, they receive the same level of support as Windows itself.
You can apply the compatibility fixes to any of your applications. However, Microsoft does not provide the tools to use the Compatibility Fix infrastructure to create your own custom fixes.
## Related topics
[Managing Application-Compatibility Fixes and Custom Fix Databases](managing-application-compatibility-fixes-and-custom-fix-databases.md)

38
windows/deployment/planning/using-the-compatibility-administrator-tool.md
View File

@ -1,38 +0,0 @@
---
title: Using the Compatibility Administrator Tool (Windows 10)
description: This section provides information about using the Compatibility Administrator tool.
manager: aaroncz
ms.author: frankroj
ms.service: windows-client
author: frankroj
ms.date: 10/28/2022
ms.topic: conceptual
ms.subservice: itpro-deploy
---
# Using the Compatibility Administrator Tool
**Applies to**
- Windows 10
- Windows 8.1
- Windows 8
- Windows 7
- Windows Server 2012
- Windows Server 2008 R2
This section provides information about using the Compatibility Administrator tool.
## In this section
|Topic|Description|
|--- |--- |
|[Available Data Types and Operators in Compatibility Administrator](available-data-types-and-operators-in-compatibility-administrator.md)|The Compatibility Administrator tool provides a way to query your custom-compatibility databases.|
|[Searching for Fixed Applications in Compatibility Administrator](searching-for-fixed-applications-in-compatibility-administrator.md)|With the search functionality in Compatibility Administrator, you can locate specific executable (.exe) files with previously applied compatibility fixes, compatibility modes, or AppHelp messages. This is particularly useful if you are trying to identify applications with a specific compatibility fix or identifying which fixes are applied to a specific application.|
|[Searching for Installed Compatibility Fixes with the Query Tool in Compatibility Administrator](searching-for-installed-compatibility-fixes-with-the-query-tool-in-compatibility-administrator.md)|You can access the Query tool from within Compatibility Administrator. The Query tool provides the same functionality as using the Search feature.|
|[Creating a Custom Compatibility Fix in Compatibility Administrator](creating-a-custom-compatibility-fix-in-compatibility-administrator.md)|The Compatibility Administrator tool uses the term fix to describe the combination of compatibility information added to a customized database for a specific application. This combination can include single application fixes, groups of fixes that work together as a compatibility mode, and blocking and non-blocking AppHelp messages.|
|[Creating a Custom Compatibility Mode in Compatibility Administrator](creating-a-custom-compatibility-mode-in-compatibility-administrator.md)|Windows® provides several compatibility modes, groups of compatibility fixes found to resolve many common application-compatibility issues. While working with Compatibility Administrator, you might decide to group some of your individual compatibility fixes into a custom-compatibility mode, which you can then deploy and use on any of your compatibility databases.|
|[Creating an AppHelp Message in Compatibility Administrator](creating-an-apphelp-message-in-compatibility-administrator.md)|The Compatibility Administrator tool enables you to create an AppHelp text message. This is a blocking or non-blocking message that appears when a user starts an application that you know has major functionality issues on the Windows® operating system.|
|[Viewing the Events Screen in Compatibility Administrator](viewing-the-events-screen-in-compatibility-administrator.md)|The **Events** screen enables you to record and to view your activities in the Compatibility Administrator tool, provided that the screen is open while you perform the activities.|
|[Enabling and Disabling Compatibility Fixes in Compatibility Administrator](enabling-and-disabling-compatibility-fixes-in-compatibility-administrator.md)|You can disable and enable individual compatibility fixes in your customized databases for testing and troubleshooting purposes.|
|[Installing and Uninstalling Custom Compatibility Databases in Compatibility Administrator](installing-and-uninstalling-custom-compatibility-databases-in-compatibility-administrator.md)|The Compatibility Administrator tool enables the creation and the use of custom-compatibility and standard-compatibility databases. Both the custom databases and the standard databases store the known compatibility fixes, compatibility modes, and AppHelp messages. They also store the required application-matching information for installation on your local computers.|

68
windows/deployment/planning/using-the-sdbinstexe-command-line-tool.md
View File

@ -1,68 +0,0 @@
---
title: Using the Sdbinst.exe Command-Line Tool (Windows 10)
description: Learn how to deploy customized database (.sdb) files using the Sdbinst.exe Command-Line Tool. Review a list of command-line options.
manager: aaroncz
ms.author: frankroj
ms.service: windows-client
author: frankroj
ms.date: 10/28/2022
ms.topic: conceptual
ms.subservice: itpro-deploy
---
# Using the Sdbinst.exe Command-Line Tool
**Applies to**
- Windows 10
- Windows 8.1
- Windows 8
- Windows 7
- Windows Server 2016
- Windows Server 2012
- Windows Server 2008 R2
Deploy your customized database (.sdb) files to other computers in your organization. That is, before your compatibility fixes, compatibility modes, and AppHelp messages are applied. You can deploy your customized database files in several ways. By using a logon script, by using Group Policy, or by performing file copy operations.
After you deploy and store the customized databases on each of your local computers, you must register the database files.
Until you register the database files, the operating system is unable to identify the available compatibility fixes when starting an application.
## Command-Line Options for Deploying Customized Database Files
Sample output from the command `Sdbinst.exe /?` in an elevated CMD window:
```console
Microsoft Windows [Version 10.0.14393]
(c) 2016 Microsoft Corporation. All rights reserved.
C:\Windows\system32>Sdbinst.exe /?
Usage: Sdbinst.exe [-?] [-q] [-u] [-g] [-p] [-n[:WIN32|WIN64]] myfile.sdb | {guid} | "name"
-? - print this help text.
-p - Allow SDBs containing patches.
-q - Quiet mode: prompts are auto-accepted.
-u - Uninstall.
-g {guid} - GUID of file (uninstall only).
-n "name" - Internal name of file (uninstall only).
C:\Windows\system32>_
```
The command-line options use the following conventions:
Sdbinst.exe \[-?\] \[-p\] \[-q\] \[-u\] \[-g\] \[-u filepath\] \[-g *GUID*\] \[-n *"name"*\]
The following table describes the available command-line options.
|Option|Description|
|--- |--- |
|-?|Displays the Help for the Sdbinst.exe tool.<p>For example,<br>`sdbinst.exe -?`|
|-p|Allows SDBs' installation with Patches.<p>For example,<br>`sdbinst.exe -p C:\Windows\AppPatch\Myapp.sdb`|
|-q|Does a silent installation with no visible window, status, or warning information. Fatal errors appear only in Event Viewer (Eventvwr.exe).<p>For example,<br>`sdbinst.exe -q`|
|-u *filepath*|Does an uninstallation of the specified database.<p>For example,<br>`sdbinst.exe -u C:\example.sdb`|
|-g *GUID*|Specifies the customized database to uninstall by a globally unique identifier (GUID).<p>For example,<br>`sdbinst.exe -g 6586cd8f-edc9-4ea8-ad94-afabea7f62e3`|
|-n *"name"*|Specifies the customized database to uninstall by file name.<p>For example,<br>`sdbinst.exe -n "My_Database"`|
## Related articles
[Compatibility Administrator User's Guide](compatibility-administrator-users-guide.md)

77
windows/deployment/planning/using-the-sua-tool.md
View File

@ -1,77 +0,0 @@
---
title: Using the SUA Tool (Windows 10)
description: The Standard User Analyzer (SUA) tool can test applications and monitor API calls to detect compatibility issues with the User Account Control (UAC) feature.
manager: aaroncz
ms.author: frankroj
ms.service: windows-client
author: frankroj
ms.date: 10/28/2022
ms.topic: conceptual
ms.subservice: itpro-deploy
---
# Using the SUA Tool
**Applies to**
- Windows 10
- Windows 8.1
- Windows 8
- Windows 7
- Windows Server 2012
- Windows Server 2008 R2
By using the Standard User Analyzer (SUA) tool, you can test your applications and monitor API calls to detect compatibility issues with the User Account Control (UAC) feature.
The SUA Wizard also addresses UAC-related issues. In contrast to the SUA tool, the SUA Wizard guides you through the process step by step, without the in-depth analysis of the SUA tool. For information about the SUA Wizard, see [Using the SUA Wizard](using-the-sua-wizard.md).
In the SUA tool, you can turn virtualization on and off. When you turn virtualization off, the tested application may function more like the way it does in earlier versions of Windows®.
In the SUA tool, you can choose to run the application as **Administrator** or as **Standard User**. Depending on your selection, you may locate different types of UAC-related issues.
## Testing an Application by Using the SUA Tool
Before you can use the SUA tool, you must install Application Verifier. You must also install the Microsoft® .NET Framework 3.5 or later.
The following flowchart shows the process of using the SUA tool.
![act sua flowchart.](images/dep-win8-l-act-suaflowchart.jpg)
**To collect UAC-related issues by using the SUA tool**
1. Close any open instance of the SUA tool or SUA Wizard on your computer.
If there is an existing SUA instance on the computer, the SUA tool opens in log viewer mode instead of normal mode. In log viewer mode, you cannot start applications, which prevents you from collecting UAC issues.
2. Run the Standard User Analyzer.
3. In the **Target Application** box, browse to the executable file for the application that you want to analyze, and then double-click to select it.
4. Clear the **Elevate** check box, and then click **Launch**.
If a **Permission denied** dialog box appears, click **OK**. The application starts, despite the warning.
5. Exercise the aspects of the application for which you want to gather information about UAC issues.
6. Exit the application.
7. Review the information from the various tabs in the SUA tool. For information about each tab, see [Tabs on the SUA Tool Interface](tabs-on-the-sua-tool-interface.md).
**To review and apply the recommended mitigations**
1. In the SUA tool, on the **Mitigation** menu, click **Apply Mitigations**.
2. Review the recommended compatibility fixes.
3. Click **Apply**.
The SUA tool generates a custom compatibility-fix database and automatically applies it to the local computer, so that you can test the fixes to see whether they worked.
## Related topics
[Tabs on the SUA Tool Interface](tabs-on-the-sua-tool-interface.md)
[Showing Messages Generated by the SUA Tool](showing-messages-generated-by-the-sua-tool.md)
[Applying Filters to Data in the SUA Tool](applying-filters-to-data-in-the-sua-tool.md)
[Fixing Applications by Using the SUA Tool](fixing-applications-by-using-the-sua-tool.md)

75
windows/deployment/planning/using-the-sua-wizard.md
View File

@ -1,75 +0,0 @@
---
title: Using the SUA wizard (Windows 10)
description: The Standard User Analyzer (SUA) wizard, although it doesn't offer deep analysis, works much like the SUA tool to test for User Account Control (UAC) issues.
manager: aaroncz
ms.author: frankroj
ms.service: windows-client
author: frankroj
ms.date: 10/28/2022
ms.topic: conceptual
ms.subservice: itpro-deploy
---
# Using the SUA wizard
**Applies to**
- Windows 10
- Windows 8.1
- Windows 8
- Windows 7
- Windows Server 2012
- Windows Server 2008 R2
The Standard User Analyzer (SUA) wizard works much like the SUA tool to evaluate User Account Control (UAC) issues. However, the SUA wizard doesn't offer detailed analysis, and it can't disable virtualization or elevate your permissions.
For information about the SUA tool, see [Using the SUA Tool](using-the-sua-tool.md).
## Testing an Application by Using the SUA wizard
Install Application Verifier before you can use the SUA wizard. If Application Verifier isn't installed on the computer that is running the SUA wizard, the SUA wizard notifies you. In addition, install the Microsoft® .NET Framework 3.5 or later before you can use the SUA wizard.
The following flowchart shows the process of using the SUA wizard.
![act sua wizard flowchart.](images/dep-win8-l-act-suawizardflowchart.jpg)
**To test an application by using the SUA wizard**
1. On the computer where the SUA wizard is installed, sign in by using a non-administrator account.
2. Run the Standard User Analyzer wizard.
3. Click **Browse for Application**, browse to the folder that contains the application that you want to test, and then double-click the executable file for the application.
4. Click **Launch**.
If you're prompted, elevate your permissions. The SUA wizard may require elevation of permissions to correctly diagnose the application.
If a **Permission denied** dialog box appears, click **OK**. The application starts, despite the warning.
5. In the application, exercise the functionality that you want to test.
6. After you finish testing, exit the application.
The SUA wizard displays a message that asks whether the application ran without any issues.
7. Click **No**.
The SUA wizard shows a list of potential remedies that you might use to fix the application.
8. Select the fixes that you want to apply, and then click **Launch**.
The application appears again, with the fixes applied.
9. Test the application again, and after you finish testing, exit the application.
The SUA wizard displays a message that asks whether the application ran without any issues.
10. If the application ran correctly, click **Yes**.
The SUA wizard closes the issue as resolved on the local computer.
If the remedies don't fix the issue with the application, click **No** again, and the wizard may offer another remedies. If the other remedies don't fix the issue, the wizard informs you that there are no more remedies available. For information about how to run the SUA tool for more investigation, see [Using the SUA Tool](using-the-sua-tool.md).
## Related articles
[SUA User's Guide](sua-users-guide.md)

41
windows/deployment/planning/viewing-the-events-screen-in-compatibility-administrator.md
View File

@ -1,41 +0,0 @@
---
title: Viewing the Events Screen in Compatibility Administrator (Windows 10)
description: You can use the Events screen to record and view activities in the Compatibility Administrator tool.
manager: aaroncz
ms.author: frankroj
ms.service: windows-client
author: frankroj
ms.topic: conceptual
ms.subservice: itpro-deploy
ms.date: 10/28/2022
---
# Viewing the Events Screen in Compatibility Administrator
**Applies to**
- Windows 10
- Windows 8.1
- Windows 8
- Windows 7
- Windows Server 2012
- Windows Server 2008 R2
The **Events** screen enables you to record and to view your activities in the Compatibility Administrator tool, provided that the screen is open while you perform the activities.
>[!IMPORTANT]
>The **Events** screen only records your activities when the screen is open. If you perform an action before opening the **Events** screen, the action will not appear in the list.
**To open the Events screen**
- On the **View** menu, click **Events**.
## Handling Multiple Copies of Compatibility Fixes
Compatibility Administrator enables you to copy your compatibility fixes from one database to another, which can become confusing after adding multiple fixes, compatibility modes, and databases. For example, you can copy a fix called MyFix from Database 1 to Database 2. However, if there is already a fix called MyFix in Database 2, Compatibility Administrator renames the fix as MyFix (1) to avoid duplicate names.
If you open the **Events** screen and then perform the copy operation, you can see a description of the action, along with the time stamp, which enables you to view your fix information without confusion.
## Related topics
[Creating a Custom Compatibility Mode in Compatibility Administrator](creating-a-custom-compatibility-mode-in-compatibility-administrator.md)<br>
[Compatibility Administrator User's Guide](compatibility-administrator-users-guide.md)

57
windows/deployment/s-mode.md
View File

@ -1,57 +0,0 @@
---
title: Windows Pro in S mode
description: Overview of Windows Pro and Enterprise in S mode.
ms.localizationpriority: high
ms.service: windows-client
manager: aaroncz
author: frankroj
ms.author: frankroj
ms.topic: conceptual
ms.date: 04/26/2023
ms.subservice: itpro-deploy
---
# Windows Pro in S mode
S mode is a configuration that's available on all Windows Editions, and it's enabled at the time of manufacturing. Windows can be switched out of S mode at any time, as shown in the picture below. However, the switch is a one-time operation, and can only be undone by a wipe and reload of the operating system.
:::image type="content" source="images/smodeconfig.png" alt-text="Table listing the capabilities of S mode across the different Windows editions.":::
## S mode key features
### Microsoft-verified security
With Windows in S mode, you'll find your favorite applications in the Microsoft Store, where they're Microsoft-verified for security. You can also feel secure when you're online. Microsoft Edge, your default browser, gives you protection against phishing and socially-engineered malware.
### Performance that lasts
Start-ups are quick, and S mode is built to keep them that way. With Microsoft Edge as your browser, your online experience is fast and secure. You'll enjoy a smooth, responsive experience, whether you're streaming videos, opening apps, or being productive on the go.
### Choice and flexibility
Save your files to your favorite cloud, like OneDrive or Dropbox, and access them from any device you choose. Browse the Microsoft Store for thousands of apps, and if you don't find exactly what you want, you can easily [switch out of S mode](./windows-10-pro-in-s-mode.md) to Windows Home, Pro, or Enterprise editions at any time and search the web for more choices, as shown below.
:::image type="content" source="images/s-mode-flow-chart.png" alt-text="Switching out of S mode flow chart.":::
## Deployment
Windows in S mode is built for [modern management](/windows/client-management/manage-windows-10-in-your-organization-modern-management), which means using [Windows Autopilot](/mem/autopilot/windows-autopilot) for deployment, and a Mobile Device Management (MDM) solution for management, like Microsoft Intune.
Windows Autopilot lets you deploy the device directly to a user without IT having to touch the physical device. Instead of manually deploying a custom image, Windows Autopilot will start with a generic device that can only be used to join the company Microsoft Entra tenant or Active Directory domain. Policies are then deployed automatically through MDM, to customize the device to the user and the desired environment.
For the devices that are shipped in S mode, you can either keep them in S mode, use Windows Autopilot to switch them out of S mode during the first run process, or later using MDM, if desired.
## Keep line of business apps functioning with Desktop Bridge
[Desktop Bridge](/windows/uwp/porting/desktop-to-uwp-root) enables you to convert your line of business apps to a packaged app with UWP manifest. After testing and validating the apps, you can distribute them through an MDM solution like Microsoft Intune.
## Repackage Win32 apps into the MSIX format
The [MSIX Packaging Tool](/windows/application-management/msix-app-packaging-tool), available from the Microsoft Store, enables you to repackage existing Win32 applications to the MSIX format. You can run your desktop installers through the MSIX Packaging Tool interactively, and obtain an MSIX package that you can deploy through and MDM solution like Microsoft Intune. The MSIX Packaging Tool is another way to get your apps ready to run on Windows in S mode.
## Related links
- [Consumer applications for S mode](https://www.microsoft.com/windows/s-mode)
- [S mode devices](https://www.microsoft.com/windows/view-all-devices)
- [Windows Defender Application Control deployment guide](/windows/security/threat-protection/windows-defender-application-control/windows-defender-application-control-deployment-guide)
- [Microsoft Defender for Endpoint documentation](/microsoft-365/security/defender-endpoint/)

85
windows/deployment/windows-10-pro-in-s-mode.md
View File

@ -1,85 +0,0 @@
---
title: Switch to Windows 10 Pro/Enterprise from S mode
description: Overview of Windows 10 Pro/Enterprise in S mode. S mode switch options are also outlined in this document. Switching out of S mode is optional.
author: frankroj
ms.author: frankroj
manager: aaroncz
ms.localizationpriority: medium
ms.service: windows-client
ms.topic: conceptual
ms.date: 11/23/2022
ms.subservice: itpro-deploy
---
# Switch to Windows 10 Pro or Enterprise from S mode
We recommend staying in S mode. However, in some limited scenarios, you might need to switch to Windows 10 Pro, Home, or Enterprise (not in S mode). You can switch devices running Windows 10, version 1709 or later.
Many other transformations are possible depending on which version and edition of Windows 10 you're starting with. Depending on the details, you might *switch* between S mode and the ordinary version or *convert* between different editions while staying in or out of S mode. The following quick reference table summarizes all of the switches or conversions that are supported by various means:
| If a device is running this version of Windows 10 | and this edition of Windows 10 | then you can switch or convert it to this edition of Windows 10 by these methods: | &nbsp; | &nbsp;|
|-------------|---------------------|-----------------------------------|-------------------------------|--------------------------------------------|
| | | **Store for Education** (switch/convert all devices in your tenant) | **Microsoft Store** (switch/convert one device at a time) | **Intune** (switch/convert any number of devices selected by admin) |
| **Windows 10, version 1709** | Pro in S mode | Pro EDU | Pro | Not by this method |
| | Pro | Pro EDU | Not by any method | Not by any method |
| | Home | Not by any method | Not by any method | Not by any method |
| | | | | |
| **Windows 10, version 1803** | Pro in S mode | Pro EDU in S mode | Pro | Not by this method |
| | Pro | Pro EDU | Not by any method | Not by any method |
| | Home in S mode | Not by any method | Home | Not by this method |
| | Home | Not by any method | Not by any method | Not by any method |
| | | | | |
| **Windows 10, version 1809** | Pro in S mode | Pro EDU in S mode | Pro | Pro |
| | Pro | Pro EDU | Not by any method | Not by any method |
| | Home in S mode | Not by any method | Home | Home |
| | Home | Not by any method | Not by any method | Not by any method |
Use the following information to switch to Windows 10 Pro through the Microsoft Store.
> [!IMPORTANT]
> While it's free to switch to Windows 10 Pro, it's not reversible. The only way to rollback this kind of switch is through a [bare-metal recovery (BMR)](/windows-hardware/manufacture/desktop/create-media-to-run-push-button-reset-features-s14) reset. This restores a Windows device to the factory state, even if the user needs to replace the hard drive or completely wipe the drive clean. If a device is switched out of S mode via the Microsoft Store, it will remain out of S mode even after the device is reset.
## Switch one device through the Microsoft Store
Use the following information to switch to Windows 10 Pro through the Microsoft Store or by navigating to **Settings** and then **Activation** on the device.
Note these differences affecting switching modes in various releases of Windows 10:
- In Windows 10, version 1709, you can switch devices one at a time from Windows 10 Pro in S mode to Windows 10 Pro by using the Microsoft Store or **Settings**. No other switches are possible.
- In Windows 10, version 1803, you can switch devices running any S mode edition to the equivalent non-S mode edition one at a time by using the Microsoft Store or **Settings**.
- Windows 10, version 1809, you can switch devices running any S mode edition to the equivalent non-S mode edition one at a time by using the Microsoft Store, **Settings**, or you can switch multiple devices in bulk by using Intune. You can also block users from switching devices themselves.
1. Sign into the Microsoft Store using your Microsoft account.
2. Search for "S mode".
3. In the offer, select **Buy**, **Get**, or **Learn more.**
You'll be prompted to save your files before the switch starts. Follow the prompts to switch to Windows 10 Pro.
## Switch one or more devices by using Microsoft Intune
Starting with Windows 10, version 1809, if you need to switch multiple devices in your environment from Windows 10 Pro in S mode to Windows 10 Pro, you can use Microsoft Intune or any other supported mobile device management software. You can configure devices to switch out of S mode during OOBE or post-OOBE. Switching out of S mode gives you flexibility to manage Windows 10 in S mode devices at any point during the device lifecycle.
1. Start Microsoft Intune.
2. Navigate to **Device configuration** > **Profiles** > **Windows 10 and later** > **Edition upgrade and mode switch**.
3. Follow the instructions to complete the switch.
## Block users from switching
You can control which devices or users can use the Microsoft Store to switch out of S mode in Windows 10. To set this policy, go to **Device configuration** > **Profiles** > **Windows 10 and later** > **Edition upgrade and mode switch in Microsoft Intune**, and then choose **Keep in S mode**.
## S mode management with CSPs
In addition to using Microsoft Intune or another modern device management tool to manage S mode, you can also use the [WindowsLicensing](/windows/client-management/mdm/windowslicensing-csp) configuration service provider (CSP). In Windows 10, version 1809, we added S mode functionality that lets you switch devices, block devices from switching, and check the status (whether a device is in S mode).
## Related articles
[FAQs](https://support.microsoft.com/help/4020089/windows-10-in-s-mode-faq)<br>
[Compare Windows 10 editions](https://www.microsoft.com/WindowsForBusiness/Compare)<BR>
[Windows 10 Pro Education](/education/windows/test-windows10s-for-edu)<BR>
[Introduction to Microsoft Intune in the Azure portal](/intune/what-is-intune)

5
windows/deployment/windows-autopatch/TOC.yml
View File

@ -42,14 +42,13 @@
href: deploy/windows-autopatch-register-devices.md
- name: Windows Autopatch groups overview
href: deploy/windows-autopatch-groups-overview.md
items:
- name: Manage Windows Autopatch groups
href: deploy/windows-autopatch-groups-manage-autopatch-groups.md
- name: Post-device registration readiness checks
href: deploy/windows-autopatch-post-reg-readiness-checks.md
- name: Manage
href:
items:
- name: Manage Windows Autopatch groups
href: manage/windows-autopatch-manage-autopatch-groups.md
- name: Customize Windows Update settings
href: manage/windows-autopatch-customize-windows-update-settings.md
- name: Windows feature updates

2
windows/deployment/windows-autopatch/deploy/windows-autopatch-device-registration-overview.md
View File

@ -46,7 +46,7 @@ See the following detailed workflow diagram. The diagram covers the Windows Auto
| Step | Description |
| ----- | ----- |
| **Step 1: Identify devices** | IT admin identifies devices to be managed by the Windows Autopatch service. |
| **Step 2: Add devices** | IT admin adds devices through Direct membership or nests other Microsoft Entra ID assigned or dynamic groups into the **Windows Autopatch Device Registration** Microsoft Entra ID assigned group when using adding existing device-based Microsoft Entra groups while [creating](../deploy/windows-autopatch-groups-manage-autopatch-groups.md#create-a-custom-autopatch-group)/[editing](../deploy/windows-autopatch-groups-manage-autopatch-groups.md#edit-the-default-or-a-custom-autopatch-group) Custom Autopatch groups, or [editing](../deploy/windows-autopatch-groups-manage-autopatch-groups.md#edit-the-default-or-a-custom-autopatch-group) the Default Autopatch group</li></ul> |
| **Step 2: Add devices** | IT admin adds devices through Direct membership or nests other Microsoft Entra ID assigned or dynamic groups into the **Windows Autopatch Device Registration** Microsoft Entra ID assigned group when using adding existing device-based Microsoft Entra groups while [creating](../manage/windows-autopatch-manage-autopatch-groups.md#create-a-custom-autopatch-group)/[editing](../manage/windows-autopatch-manage-autopatch-groups.md#edit-the-default-or-a-custom-autopatch-group) Custom Autopatch groups, or [editing](../manage/windows-autopatch-manage-autopatch-groups.md#edit-the-default-or-a-custom-autopatch-group) the Default Autopatch group</li></ul> |
| **Step 3: Discover devices** | The Windows Autopatch Discover Devices function discovers devices (hourly) that were previously added by the IT admin into the **Windows Autopatch Device Registration** Microsoft Entra ID assigned group or from Microsoft Entra groups used with Autopatch groups in **step #2**. The Microsoft Entra device ID is used by Windows Autopatch to query device attributes in both Microsoft Intune and Microsoft Entra ID when registering devices into its service.<ol><li>Once devices are discovered from the Microsoft Entra group, the same function gathers additional device attributes and saves it into its memory during the discovery operation. The following device attributes are gathered from Microsoft Entra ID in this step:</li><ol><li>**AzureADDeviceID**</li><li>**OperatingSystem**</li><li>**DisplayName (Device name)**</li><li>**AccountEnabled**</li><li>**RegistrationDateTime**</li><li>**ApproximateLastSignInDateTime**</li></ol><li>In this same step, the Windows Autopatch discover devices function calls another function, the device prerequisite check function. The device prerequisite check function evaluates software-based device-level prerequisites to comply with Windows Autopatch device readiness requirements before registration.</li></ol> |
| **Step 4: Check prerequisites** | The Windows Autopatch prerequisite function makes an Intune Graph API call to sequentially validate device readiness attributes required for the registration process. For detailed information, see the [Detailed prerequisite check workflow diagram](#detailed-prerequisite-check-workflow-diagram) section. The service checks the following device readiness attributes, and/or prerequisites:<ol><li>**If the device is Intune-managed or not.**</li><ol><li>Windows Autopatch looks to see **if the Microsoft Entra device ID has an Intune device ID associated with it**.</li><ol><li>If **yes**, it means this device is enrolled into Intune.</li><li>If **not**, it means the device isn't enrolled into Intune, hence it can't be managed by the Windows Autopatch service.</li></ol><li>**If the device is not managed by Intune**, the Windows Autopatch service can't gather device attributes such as operating system version, Intune enrollment date, device name and other attributes. When this happens, the Windows Autopatch service uses the Microsoft Entra device attributes gathered and saved to its memory in **step 3a**.</li><ol><li>Once it has the device attributes gathered from Microsoft Entra ID in **step 3a**, the device is flagged with the **Prerequisite failed** status, then added to the **Not registered** tab so the IT admin can review the reason(s) the device wasn't registered into Windows Autopatch. The IT admin will remediate these devices. In this case, the IT admin should check why the device wasn't enrolled into Intune.</li><li>A common reason is when the Microsoft Entra device ID is stale, it doesn't have an Intune device ID associated with it anymore. To remediate, [clean up any stale Microsoft Entra device records from your tenant](windows-autopatch-register-devices.md#clean-up-dual-state-of-hybrid-azure-ad-joined-and-azure-registered-devices-in-your-azure-ad-tenant).</li></ol><li>**If the device is managed by Intune**, the Windows Autopatch prerequisite check function continues to the next prerequisite check, which evaluates whether the device has checked into Intune in the last 28 days.</li></ol><li>**If the device is a Windows device or not.**</li><ol><li>Windows Autopatch looks to see if the device is a Windows and corporate-owned device.</li><ol><li>**If yes**, it means this device can be registered with the service because it's a Windows corporate-owned device.</li><li>**If not**, it means the device is a non-Windows device, or it's a Windows device but it's a personal device.</li></ol></ol><li>**Windows Autopatch checks the Windows SKU family**. The SKU must be either:</li><ol><li>**Enterprise**</li><li>**Pro**</li><li>**Pro Workstation**</li></ol><li>**If the device meets the operating system requirements**, Windows Autopatch checks whether the device is either:</li><ol><li>**Only managed by Intune.**</li><ol><li>If the device is only managed by Intune, the device is marked as Passed all prerequisites.</li></ol><li>**Co-managed by both Configuration Manager and Intune.**</li><ol><li>If the device is co-managed by both Configuration Manager and Intune, an additional prerequisite check is evaluated to determine if the device satisfies the co-management-enabled workloads required by Windows Autopatch to manage devices in a co-managed state. The required co-management workloads evaluated in this step are:</li><ol><li>**Windows Updates Policies**</li><li>**Device Configuration**</li><li>**Office Click to Run**</li></ol><li>If Windows Autopatch determines that one of these workloads isn't enabled on the device, the service marks the device as **Prerequisite failed** and moves the device to the **Not registered** tab.</li></ol></ol></ol>|
| **Step 5: Calculate deployment ring assignment** | Once the device passes all prerequisites described in **step #4**, Windows Autopatch starts its deployment ring assignment calculation. The following logic is used to calculate the Windows Autopatch deployment ring assignment:<ol><li>If the Windows Autopatch tenant's existing managed device size is **≤ 200**, the deployment ring assignment is **First (5%)**, **Fast (15%)**, remaining devices go to the **Broad ring (80%)**.</li><li>If the Windows Autopatch tenant's existing managed device size is **>200**, the deployment ring assignment will be **First (1%)**, **Fast (9%)**, remaining devices go to the **Broad ring (90%)**.</li></ol> |

2
windows/deployment/windows-autopatch/deploy/windows-autopatch-groups-overview.md
View File

@ -190,7 +190,7 @@ The following are the Microsoft Entra ID assigned groups that represent the soft
### About device registration
Autopatch groups register devices with the Windows Autopatch service when you either [create](../deploy/windows-autopatch-groups-manage-autopatch-groups.md#create-a-custom-autopatch-group) or [edit a Custom Autopatch group](../deploy/windows-autopatch-groups-manage-autopatch-groups.md#edit-the-default-or-a-custom-autopatch-group), and/or when you [edit the Default Autopatch group](../deploy/windows-autopatch-groups-manage-autopatch-groups.md#edit-the-default-or-a-custom-autopatch-group) to use your existing Microsoft Entra groups instead of the Windows Autopatch Device Registration group provided by the service.
Autopatch groups register devices with the Windows Autopatch service when you either [create](../manage/windows-autopatch-manage-autopatch-groups.md#create-a-custom-autopatch-group) or [edit a Custom Autopatch group](../manage/windows-autopatch-manage-autopatch-groups.md#edit-the-default-or-a-custom-autopatch-group), and/or when you [edit the Default Autopatch group](../manage/windows-autopatch-manage-autopatch-groups.md#edit-the-default-or-a-custom-autopatch-group) to use your existing Microsoft Entra groups instead of the Windows Autopatch Device Registration group provided by the service.
## Common ways to use Autopatch groups

2
windows/deployment/windows-autopatch/deploy/windows-autopatch-register-devices.md
View File

@ -35,7 +35,7 @@ When you either create/edit a [Custom Autopatch group](../deploy/windows-autopat
If devices aren't registered, Autopatch groups starts the device registration process by using your existing device-based Microsoft Entra groups instead of the Windows Autopatch Device Registration group.
For more information, see [create Custom Autopatch groups](../deploy/windows-autopatch-groups-manage-autopatch-groups.md#create-a-custom-autopatch-group) and [edit Autopatch group](../deploy/windows-autopatch-groups-manage-autopatch-groups.md#edit-the-default-or-a-custom-autopatch-group) to register devices using the Autopatch groups device registration method.
For more information, see [create Custom Autopatch groups](../manage/windows-autopatch-manage-autopatch-groups.md#create-a-custom-autopatch-group) and [edit Autopatch group](../manage/windows-autopatch-manage-autopatch-groups.md#edit-the-default-or-a-custom-autopatch-group) to register devices using the Autopatch groups device registration method.
<a name='supported-scenarios-when-nesting-other-azure-ad-groups'></a>

2
windows/deployment/windows-autopatch/deploy/windows-autopatch-groups-manage-autopatch-groups.md → windows/deployment/windows-autopatch/manage/windows-autopatch-manage-autopatch-groups.md
View File

@ -180,4 +180,4 @@ When you create or edit the Custom or Default Autopatch group, Windows Autopatch
#### Device conflict post device registration
Autopatch groups will keep monitoring for all device conflict scenarios listed in the [Manage device conflict scenarios when using Autopatch groups](../deploy/windows-autopatch-groups-manage-autopatch-groups.md#manage-device-conflict-scenarios-when-using-autopatch-groups) section even after devices were successfully registered with the service.
Autopatch groups will keep monitoring for all device conflict scenarios listed in the [Manage device conflict scenarios when using Autopatch groups](../manage/windows-autopatch-manage-autopatch-groups.md#manage-device-conflict-scenarios-when-using-autopatch-groups) section even after devices were successfully registered with the service.

6
windows/deployment/windows-autopatch/manage/windows-autopatch-windows-feature-update-overview.md
View File

@ -98,8 +98,8 @@ There are two scenarios that the Global release is used:
| Scenario | Description |
| ----- | ----- |
| Scenario #1 | You assign Microsoft Entra groups to be used with the deployment ring (Last) or you add additional deployment rings when you customize the [Default Autopatch group](../deploy/windows-autopatch-groups-manage-autopatch-groups.md#edit-the-default-or-a-custom-autopatch-group).<p>A global Windows feature update policy is automatically assigned behind the scenes to the newly added deployment rings or when you assigned Microsoft Entra groups to the deployment ring (Last) in the Default Autopatch group.</p> |
| Scenario #2 | You create new [Custom Autopatch groups](../deploy/windows-autopatch-groups-manage-autopatch-groups.md#create-a-custom-autopatch-group).<p>The global Windows feature policy is automatically assigned behind the scenes to all deployment rings as part of the Custom Autopatch groups you create.</p> |
| Scenario #1 | You assign Microsoft Entra groups to be used with the deployment ring (Last) or you add additional deployment rings when you customize the [Default Autopatch group](../manage/windows-autopatch-manage-autopatch-groups.md#edit-the-default-or-a-custom-autopatch-group).<p>A global Windows feature update policy is automatically assigned behind the scenes to the newly added deployment rings or when you assigned Microsoft Entra groups to the deployment ring (Last) in the Default Autopatch group.</p> |
| Scenario #2 | You create new [Custom Autopatch groups](../manage/windows-autopatch-manage-autopatch-groups.md#create-a-custom-autopatch-group).<p>The global Windows feature policy is automatically assigned behind the scenes to all deployment rings as part of the Custom Autopatch groups you create.</p> |
> [!NOTE]
> Global releases don't show up in the Windows feature updates release management blade.
@ -124,7 +124,7 @@ The differences in between the global and the default Windows feature update pol
| Default Windows feature update policy | Global Windows feature update policy |
| ----- | ----- |
| <ul><li>Set by default with the Default Autopatch group and assigned to Test, Ring1, Ring2, Ring3. The default policy isn't automatically assigned to the Last ring in the Default Autopatch group.</li><li>The Windows Autopatch service keeps its minimum Windows OS version updated following the recommendation of minimum Windows OS version [currently serviced by the Windows servicing channels](/windows/release-health/release-information?msclkid=ee885719baa511ecb838e1a689da96d2).</li></ul> | <ul><li>Set by default and assigned to all new deployment rings added as part of the Default Autopatch group customization.</li><li>Set by default and assigned to all deployment rings created as part of Custom Autopatch groups.</li></ul>
| <ul><li>Set by default with the Default Autopatch group and assigned to Test, Ring1, Ring2, Ring3. The default policy isn't automatically assigned to the Last ring in the Default Autopatch group.</li><li>The Windows Autopatch service keeps its minimum Windows OS version updated following the recommendation of minimum Windows OS version [currently serviced by the Windows servicing channels](/windows/release-health/release-information?msclkid=ee885719baa511ecb838e1a689da96d2).</li></ul> | <ul><li>Set by default and assigned to all new deployment rings added as part of the Default Autopatch group customization.</li><li>Set by default and assigned to all deployment rings created as part of Custom Autopatch groups.</li></ul> |
### Custom release

2
windows/deployment/windows-autopatch/overview/windows-autopatch-faq.yml
View File

@ -79,7 +79,7 @@ sections:
No. Don't change, edit, add to, or remove any of the configurations. Doing so might cause unintended configuration conflicts and impact the Windows Autopatch service. For more information about policies and configurations, see [Changes made at tenant enrollment](/windows/deployment/windows-autopatch/references/windows-autopatch-changes-to-tenant).
- question: How can I represent our organizational structure with our own deployment cadence?
answer: |
[Windows Autopatch groups](../deploy/windows-autopatch-groups-overview.md) helps you manage updates in a way that makes sense for your businesses. For more information, see [Windows Autopatch groups overview](../deploy/windows-autopatch-groups-overview.md) and [Manage Windows Autopatch groups](../deploy/windows-autopatch-groups-manage-autopatch-groups.md).
[Windows Autopatch groups](../deploy/windows-autopatch-groups-overview.md) helps you manage updates in a way that makes sense for your businesses. For more information, see [Windows Autopatch groups overview](../deploy/windows-autopatch-groups-overview.md) and [Manage Windows Autopatch groups](../manage/windows-autopatch-manage-autopatch-groups.md).
- name: Update management
questions:
- question: What systems does Windows Autopatch update?

2
windows/deployment/windows-autopatch/overview/windows-autopatch-overview.md
View File

@ -63,7 +63,7 @@ Microsoft remains committed to the security of your data and the [accessibility]
| Area | Description |
| ----- | ----- |
| Prepare | The following articles describe the mandatory steps to prepare and enroll your tenant into Windows Autopatch:<ul><li>[Prerequisites](../prepare/windows-autopatch-prerequisites.md)</li><li>[Configure your network](../prepare/windows-autopatch-configure-network.md)</li><li>[Enroll your tenant](../prepare/windows-autopatch-enroll-tenant.md)</li><li>[Fix issues found by the Readiness assessment tool](../prepare/windows-autopatch-fix-issues.md)</li><li>[Roles and responsibilities](../overview/windows-autopatch-roles-responsibilities.md)</ul> |
| Deploy | Once you've enrolled your tenant, this section instructs you to:<ul><li>[Add and verify admin contacts](../deploy/windows-autopatch-admin-contacts.md)</li><li>[Register your devices](../deploy/windows-autopatch-register-devices.md)</li><li>[Manage Windows Autopatch groups](../deploy/windows-autopatch-groups-manage-autopatch-groups.md)</li></ul> |
| Deploy | Once you've enrolled your tenant, this section instructs you to:<ul><li>[Add and verify admin contacts](../deploy/windows-autopatch-admin-contacts.md)</li><li>[Register your devices](../deploy/windows-autopatch-register-devices.md)</li><li>[Manage Windows Autopatch groups](../manage/windows-autopatch-manage-autopatch-groups.md)</li></ul> |
| Operate | This section includes the following information about your day-to-day life with the service:<ul><li>[Update management](../operate/windows-autopatch-groups-update-management.md)</li><li>[Windows quality and feature update reports](../operate/windows-autopatch-groups-windows-quality-and-feature-update-reports-overview.md)</li><li>[Maintain your Windows Autopatch environment](../operate/windows-autopatch-maintain-environment.md)</li><li>[Submit a support request](../operate/windows-autopatch-support-request.md)</li><li>[Exclude a device](../operate/windows-autopatch-exclude-device.md)</li></ul>
| References | This section includes the following articles:<ul><li>[Changes made at tenant enrollment](../references/windows-autopatch-changes-to-tenant.md)<li>[Windows update policies](../references/windows-autopatch-windows-update-unsupported-policies.md)</li><li>[Microsoft 365 Apps for enterprise update policies](../references/windows-autopatch-microsoft-365-policies.md)</li></ul> |

6
windows/deployment/windows-autopatch/overview/windows-autopatch-roles-responsibilities.md
View File

@ -58,7 +58,7 @@ For more information and assistance with preparing for your Windows Autopatch de
| Remediate registration issues<ul><li>[For devices displayed in the **Not ready** tab](../deploy/windows-autopatch-post-reg-readiness-checks.md#about-the-three-tabs-in-the-devices-blade)</li><li>[For devices displayed in the **Not registered** tab](../deploy/windows-autopatch-post-reg-readiness-checks.md#about-the-three-tabs-in-the-devices-blade)</li><li>[For devices with conflicting configurations](../references/windows-autopatch-conflicting-configurations.md)</li></ul> | :heavy_check_mark: | :x: |
| Populate the Test and Last deployment ring membership<ul><li>[Default Windows Autopatch group deployment rings](../deploy/windows-autopatch-groups-overview.md#about-the-default-autopatch-group)</li><li>[Custom Windows Autopatch group deployment rings](../deploy/windows-autopatch-groups-overview.md#about-custom-autopatch-groups)</li></ul> | :heavy_check_mark: | :x: |
| [Manually override device assignments to deployment rings](../operate/windows-autopatch-update-management.md#moving-devices-in-between-deployment-rings) | :heavy_check_mark: | :x: |
| Review device conflict scenarios<ul><li>[Device conflict in deployment rings within an Autopatch group](../deploy/windows-autopatch-groups-manage-autopatch-groups.md#device-conflict-in-deployment-rings-within-an-autopatch-group)</li><li>[Device conflict across different Autopatch groups](../deploy/windows-autopatch-groups-manage-autopatch-groups.md#device-conflict-across-different-autopatch-groups)</li></ul> | :heavy_check_mark: | :x: |
| Review device conflict scenarios<ul><li>[Device conflict in deployment rings within an Autopatch group](../manage/windows-autopatch-manage-autopatch-groups.md#device-conflict-in-deployment-rings-within-an-autopatch-group)</li><li>[Device conflict across different Autopatch groups](../manage/windows-autopatch-manage-autopatch-groups.md#device-conflict-across-different-autopatch-groups)</li></ul> | :heavy_check_mark: | :x: |
| Communicate to end-users, help desk and stakeholders | :heavy_check_mark: | :x: |
## Manage
@ -68,8 +68,8 @@ For more information and assistance with preparing for your Windows Autopatch de
| [Maintain contacts in the Microsoft Intune admin center](../deploy/windows-autopatch-admin-contacts.md) | :heavy_check_mark: | :x: |
| [Maintain and manage the Windows Autopatch service configuration](../monitor/windows-autopatch-maintain-environment.md) | :x: | :heavy_check_mark: |
| [Maintain customer configuration to align with the Windows Autopatch service configuration](../monitor/windows-autopatch-maintain-environment.md) | :heavy_check_mark: | :x: |
| Resolve service remediated device conflict scenarios<ul><li>[Device conflict in deployment rings within an Autopatch group](../deploy/windows-autopatch-groups-manage-autopatch-groups.md#device-conflict-in-deployment-rings-within-an-autopatch-group)</li><li>[Default to Custom Autopatch group device conflict](../deploy/windows-autopatch-groups-manage-autopatch-groups.md#default-to-custom-autopatch-group-device-conflict)</li></ul> | :x: | :heavy_check_mark: |
| Resolve remediated device conflict scenarios<ul><li>[Custom to Custom Autopatch group device conflict](../deploy/windows-autopatch-groups-manage-autopatch-groups.md#custom-to-custom-autopatch-group-device-conflict)</li><li>[Device conflict prior to device registration](../deploy/windows-autopatch-groups-manage-autopatch-groups.md#device-conflict-prior-to-device-registration)</li></ul> | :heavy_check_mark: | :x: |
| Resolve service remediated device conflict scenarios<ul><li>[Device conflict in deployment rings within an Autopatch group](../manage/windows-autopatch-manage-autopatch-groups.md#device-conflict-in-deployment-rings-within-an-autopatch-group)</li><li>[Default to Custom Autopatch group device conflict](../manage/windows-autopatch-manage-autopatch-groups.md#default-to-custom-autopatch-group-device-conflict)</li></ul> | :x: | :heavy_check_mark: |
| Resolve remediated device conflict scenarios<ul><li>[Custom to Custom Autopatch group device conflict](../manage/windows-autopatch-manage-autopatch-groups.md#custom-to-custom-autopatch-group-device-conflict)</li><li>[Device conflict prior to device registration](../manage/windows-autopatch-manage-autopatch-groups.md#device-conflict-prior-to-device-registration)</li></ul> | :heavy_check_mark: | :x: |
| Maintain the Test and Last deployment ring membership<ul><li>[Default Windows Autopatch deployment rings](../deploy/windows-autopatch-groups-overview.md#about-the-default-autopatch-group)</li><li>[Custom Windows Autopatch group deployment rings](../deploy/windows-autopatch-groups-overview.md#about-custom-autopatch-groups)</li></ul> | :heavy_check_mark: | :x: |
| Monitor [Windows update signals](../manage/windows-autopatch-windows-quality-update-signals.md) for safe update release<ul><li>[Pre-release signals](../manage/windows-autopatch-windows-quality-update-signals.md#pre-release-signals)</li><li>[Early signals](../manage/windows-autopatch-windows-quality-update-signals.md#early-signals)</li><li>[Device reliability signals](../manage/windows-autopatch-windows-quality-update-signals.md#device-reliability-signals)</li></ul> | :x: | :heavy_check_mark: |
| Test specific [business update scenarios](../manage/windows-autopatch-windows-quality-update-signals.md) | :heavy_check_mark: | :x: |

2
windows/deployment/windows-autopatch/whats-new/windows-autopatch-whats-new-2023.md
View File

@ -100,7 +100,7 @@ Minor corrections such as typos, style, or formatting issues aren't listed.
| ----- | ----- |
| [Roles and responsibilities](../overview/windows-autopatch-roles-responsibilities.md) | Updated article to include Windows Autopatch groups |
| [Windows Autopatch groups overview](../deploy/windows-autopatch-groups-overview.md) | General Availability<ul><li>[MC628172](https://admin.microsoft.com/adminportal/home#/MessageCenter)</li></ul> |
| [Manage Windows Autopatch groups](../deploy/windows-autopatch-groups-manage-autopatch-groups.md) | General Availability<ul><li>[MC628172](https://admin.microsoft.com/adminportal/home#/MessageCenter)</li></ul> |
| [Manage Windows Autopatch groups](../manage/windows-autopatch-manage-autopatch-groups.md) | General Availability<ul><li>[MC628172](https://admin.microsoft.com/adminportal/home#/MessageCenter)</li></ul> |
| [Customize Windows Update settings](../operate/windows-autopatch-groups-windows-update.md) | General Availability<ul><li>[MC628172](https://admin.microsoft.com/adminportal/home#/MessageCenter)</li></ul> |
| [Windows quality updates](../operate/windows-autopatch-groups-windows-quality-update-overview.md) | General Availability<ul><li>[MC628172](https://admin.microsoft.com/adminportal/home#/MessageCenter)</li></ul> |
| [Windows feature updates](../operate/windows-autopatch-groups-windows-feature-update-overview.md) | General Availability<ul><li>[MC628172](https://admin.microsoft.com/adminportal/home#/MessageCenter)</li></ul> |

2
windows/security/application-security/application-control/windows-defender-application-control/TOC.yml
View File

@ -100,8 +100,6 @@
href: deployment/create-code-signing-cert-for-wdac.md
- name: Disable WDAC policies
href: deployment/disable-wdac-policies.md
- name: LOB Win32 Apps on S Mode
href: deployment/LOB-win32-apps-on-s.md
- name: WDAC operational guide
href: operations/wdac-operational-guide.md
items:

252
windows/security/application-security/application-control/windows-defender-application-control/deployment/LOB-win32-apps-on-s.md
View File

@ -1,252 +0,0 @@
---
title: Allow LOB Win32 apps on Intune-managed S Mode devices
description: Using Windows Defender Application Control (WDAC) supplemental policies, you can expand the S Mode base policy on your Intune-managed devices.
ms.localizationpriority: medium
ms.date: 04/05/2023
ms.topic: how-to
---
# Allow line-of-business Win32 apps on Intune-managed S Mode devices
> [!NOTE]
> Some capabilities of Windows Defender Application Control (WDAC) are only available on specific Windows versions. For more information, see [Windows Defender Application Control feature availability](../feature-availability.md).
You can use Microsoft Intune to deploy and run critical Win32 applications, and Windows components that are normally blocked in S mode, on your Intune-managed Windows 10 in S mode devices. For example, PowerShell.exe.
With Intune, you can configure managed S mode devices using a Windows Defender Application Control (WDAC) supplemental policy that expands the S mode base policy to authorize the apps your organization uses. This feature changes the S mode security posture from "Microsoft has verified every app" to "Microsoft or your organization has verified every app".
For an overview and brief demo of this feature, see this video:
> [!VIDEO https://www.microsoft.com/videoplayer/embed/RE4mlcp]
## Policy authorization process
![Basic diagram of the policy authorization flow.](../images/wdac-intune-policy-authorization.png)
The general steps for expanding the S mode base policy on your Intune-managed Windows 10 in S mode devices are to generate a supplemental policy, sign that policy, upload the signed policy to Intune, and assign it to user or device groups. Because you need access to PowerShell cmdlets to generate your supplemental policy, you should create and manage your policies on a non-S mode device. Once the policy has been uploaded to Intune, before deploying the policy more broadly, assign it to a single test Windows 10 in S mode device to verify expected functioning.
1. Generate a supplemental policy with WDAC tooling.
This policy expands the S mode base policy to authorize more applications. Anything authorized by either the S mode base policy or your supplemental policy is allowed to run. Your supplemental policies can specify filepath rules, trusted publishers, and more.
For more information on creating supplemental policies, see [Deploy multiple WDAC policies](../design/deploy-multiple-wdac-policies.md). For more information on the right type of rules to create for your policy, see [Deploy WDAC policy rules and file rules](../design/select-types-of-rules-to-create.md).
The following instructions are a basic set for creating an S mode supplemental policy:
- Create a new base policy using [New-CIPolicy](/powershell/module/configci/new-cipolicy?view=win10-ps&preserve-view=true).
```powershell
New-CIPolicy -MultiplePolicyFormat -ScanPath <path> -UserPEs -FilePath "<path>\SupplementalPolicy.xml" -Level FilePublisher -Fallback SignedVersion,Publisher,Hash
```
- Change it to a supplemental policy using [Set-CIPolicyIdInfo](/powershell/module/configci/set-cipolicyidinfo?view=win10-ps&preserve-view=true).
```powershell
Set-CIPolicyIdInfo -SupplementsBasePolicyID 5951A96A-E0B5-4D3D-8FB8-3E5B61030784 -FilePath "<path>\SupplementalPolicy.xml"
```
For policies that supplement the S mode base policy, use `-SupplementsBasePolicyID 5951A96A-E0B5-4D3D-8FB8-3E5B61030784`. This ID is the S mode policy ID.
- Put the policy in enforce mode using [Set-RuleOption](/powershell/module/configci/set-ruleoption?view=win10-ps&preserve-view=true).
```powershell
Set-RuleOption -FilePath "<path>\SupplementalPolicy.xml>" -Option 3 -Delete
```
This command deletes the 'audit mode' qualifier.
- Since you're signing your policy, you must authorize the signing certificate you use to sign the policy. Optionally, also authorize one or more extra signers that can be used to sign updates to the policy in the future. The next step in the overall process, **Sign the policy**, describes it in more detail.
To add the signing certificate to the WDAC policy, use [Add-SignerRule](/powershell/module/configci/add-signerrule?view=win10-ps&preserve-view=true).
```powershell
Add-SignerRule -FilePath <policypath> -CertificatePath <certpath> -User -Update
```
- Convert to `.bin` using [ConvertFrom-CIPolicy](/powershell/module/configci/convertfrom-cipolicy?view=win10-ps&preserve-view=true).
```powershell
ConvertFrom-CIPolicy -XmlFilePath "<path>\SupplementalPolicy.xml" -BinaryFilePath "<path>\SupplementalPolicy.bin>
```
2. Sign the policy.
Supplemental S mode policies must be digitally signed. To sign your policy, use your organization's custom Public Key Infrastructure (PKI). For more information on signing using an internal CA, see [Create a code signing cert for WDAC](create-code-signing-cert-for-wdac.md).
> [!TIP]
> For more information, see [Azure Code Signing, democratizing trust for developers and consumers](https://techcommunity.microsoft.com/t5/security-compliance-and-identity/azure-code-signing-democratizing-trust-for-developers-and/ba-p/3604669).
After you've signed it, rename your policy to `{PolicyID}.p7b`. Get the **PolicyID** from the supplemental policy XML.
3. Deploy the signed supplemental policy using Microsoft Intune.
Go to the Microsoft Intune portal, go to the Client apps page, and select **S mode supplemental policies**. Upload the signed policy to Intune and assign it to user or device groups. Intune generates authorization tokens for the tenant and specific devices. Intune then deploys the corresponding authorization token and supplemental policy to each device in the assigned group. Together, these tokens and policies expand the S mode base policy on the device.
> [!NOTE]
> When you update your supplemental policy, make sure that the new version number is strictly greater than the previous one. Intune doesn't allow using the same version number. For more information on setting the version number, see [Set-CIPolicyVersion](/powershell/module/configci/set-cipolicyversion?view=win10-ps&preserve-view=true).
## Standard process for deploying apps through Intune
![Basic diagram for deploying apps through Intune.](../images/wdac-intune-app-deployment.png)
For more information on the existing procedure of packaging signed catalogs and app deployment, see [Win32 app management in Microsoft Intune](/mem/intune/apps/apps-win32-app-management).
## Optional: Process for deploying apps using catalogs
![Basic diagram for deploying Apps using catalogs.](../images/wdac-intune-app-catalogs.png)
Your supplemental policy can be used to significantly relax the S mode base policy, but there are security trade-offs you must consider in doing so. For example, you can use a signer rule to trust an external signer, but that authorizes all apps signed by that certificate, which may include apps you don't want to allow as well.
Instead of authorizing signers external to your organization, Intune has functionality to make it easier to authorize existing applications by using signed catalogs. This feature doesn't require repackaging or access to the source code. It works for apps that may be unsigned or even signed apps when you don't want to trust all apps that may share the same signing certificate.
The basic process is to generate a catalog file for each app using Package Inspector, then sign the catalog files using a custom PKI. To authorize the catalog signing certificate in the supplemental policy, use the **Add-SignerRule** PowerShell cmdlet as shown earlier in step 1 of the [Policy authorization process](#policy-authorization-process). After that, use the [Standard process for deploying apps through Intune](#standard-process-for-deploying-apps-through-intune) outlined earlier. For more information on generating catalogs, see [Deploy catalog files to support WDAC](deploy-catalog-files-to-support-wdac.md).
> [!NOTE]
> Every time an app updates, you need to deploy an updated catalog. Try to avoid using catalog files for applications that auto-update, and direct users not to update applications on their own.
## Sample policy
The following policy is a sample that allows kernel debuggers, PowerShell ISE, and Registry Editor. It also demonstrates how to specify your organization's code signing and policy signing certificates.
```xml
<?xml version="1.0" encoding="utf-8"?>
<SiPolicy xmlns="urn:schemas-microsoft-com:sipolicy" PolicyType="Supplemental Policy">
<VersionEx>10.0.0.0</VersionEx>
<PlatformID>{2E07F7E4-194C-4D20-B7C9-6F44A6C5A234}</PlatformID>
<!--Standard S mode GUID-->
<BasePolicyID>{5951A96A-E0B5-4D3D-8FB8-3E5B61030784}</BasePolicyID>
<!--Unique policy GUID-->
<PolicyID>{52671094-ACC6-43CF-AAF1-096DC69C1345}</PolicyID>
<!--EKUS-->
<EKUs />
<!--File Rules-->
<FileRules>
<!--Allow kernel debuggers-->
<Allow ID="ID_ALLOW_CBD_0" FriendlyName="cdb.exe" FileName="CDB.Exe" />
<Allow ID="ID_ALLOW_KD_0" FriendlyName="kd.exe" FileName="kd.Exe" />
<Allow ID="ID_ALLOW_WINDBG_0" FriendlyName="windbg.exe" FileName="windbg.Exe" />
<Allow ID="ID_ALLOW_MSBUILD_0" FriendlyName="MSBuild.exe" FileName="MSBuild.Exe" />
<Allow ID="ID_ALLOW_NTSD_0" FriendlyName="ntsd.exe" FileName="ntsd.Exe" />
<!--Allow PowerShell ISE and Registry Editor-->
<Allow ID="ID_ALLOW_POWERSHELLISE_0" FriendlyName="powershell_ise.exe" FileName="powershell_ise.exe" />
<Allow ID="ID_ALLOW_REGEDIT_0" FriendlyName="regedit.exe" FileName="regedit.exe" />
</FileRules>
<!--Signers-->
<Signers>
<!--info of the certificate you will use to do any code/catalog signing-->
<Signer ID="EXAMPLE_ID_SIGNER_CODE" Name="Example Code Signing Certificate Friendly Name">
<CertRoot Type="TBS" Value="<value>" />
</Signer>
<!--info of the certificate you will use to sign your policy-->
<Signer ID="EXAMPLE_ID_SIGNER_POLICY" Name="Example Policy Signing Certificate Friendly Name">
<CertRoot Type="TBS" Value="<value>" />
</Signer>
</Signers>
<!--Driver Signing Scenarios-->
<SigningScenarios>
<SigningScenario Value="131" ID="ID_SIGNINGSCENARIO_KMCI" FriendlyName="Example Name">
<ProductSigners />
</SigningScenario>
<SigningScenario Value="12" ID="ID_SIGNINGSCENARIO_UMCI" FriendlyName="Example Name">
<ProductSigners>
<AllowedSigners>
<AllowedSigner SignerId="EXAMPLE_ID_SIGNER_CODE" />
</AllowedSigners>
<FileRulesRef>
<FileRuleRef RuleID="ID_ALLOW_CBD_0" />
<FileRuleRef RuleID="ID_ALLOW_KD_0" />
<FileRuleRef RuleID="ID_ALLOW_WINDBG_0" />
<FileRuleRef RuleID="ID_ALLOW_MSBUILD_0" />
<FileRuleRef RuleID="ID_ALLOW_NTSD_0" />
<FileRuleRef RuleID="ID_ALLOW_POWERSHELLISE_0" />
<FileRuleRef RuleID="ID_ALLOW_REGEDIT_0" />
</FileRulesRef>
</ProductSigners>
</SigningScenario>
</SigningScenarios>
<!--Specify one or more certificates that can be used to sign updated policy-->
<UpdatePolicySigners>
<UpdatePolicySigner SignerId="EXAMPLE_ID_SIGNER_POLICY" />
</UpdatePolicySigners>
<!--Specify one or more codesigning certificates to trust-->
<CiSigners>
<CiSigner SignerId="EXAMPLE_ID_SIGNER_CODE" />
</CiSigners>
<!-- example remove core isolation a.k.a. Hypervisor Enforced Code Integrity (HVCI) options, consider enabling if your system supports it-->
<HvciOptions>0</HvciOptions>
<Settings>
<Setting Provider="PolicyInfo" Key="Information" ValueName="Name">
<Value>
<String>Example Policy Name</String>
</Value>
</Setting>
<Setting Provider="PolicyInfo" Key="Information" ValueName="Id">
<Value>
<String>Example-Policy-10.0.0.0</String>
</Value>
</Setting>
</Settings>
</SiPolicy>
```
## Policy removal
In order to revert users to an unmodified S mode policy, remove a user or users from the targeted Intune group that received the policy. This action triggers a removal of both the policy and the authorization token from the device.
You can also delete a supplemental policy through Intune.
```xml
<?xml version="1.0" encoding="utf-8"?>
<SiPolicy xmlns="urn:schemas-microsoft-com:sipolicy" PolicyType="Supplemental Policy">
<VersionEx>10.0.0.1</VersionEx>
<PlatformID>{2E07F7E4-194C-4D20-B7C9-6F44A6C5A234}</PlatformID>
<BasePolicyID>{5951A96A-E0B5-4D3D-8FB8-3E5B61030784}</BasePolicyID>
<PolicyID>{52671094-ACC6-43CF-AAF1-096DC69C1345}</PolicyID>
<Rules>
</Rules>
<!--EKUS-->
<EKUs />
<!--File Rules-->
<!--Signers-->
<Signers>
<!--info of the certificate you will use to sign your policy-->
<Signer ID="EXAMPLE_ID_SIGNER_POLICY" Name="Example Policy Signing Certificate Friendly Name">
<CertRoot Type="TBS" Value="<value>" />
</Signer>
</Signers>
<!--Driver Signing Scenarios-->
<SigningScenarios>
<SigningScenario Value="131" ID="ID_SIGNINGSCENARIO_KMCI" FriendlyName="KMCI">
<ProductSigners>
</ProductSigners>
</SigningScenario>
<SigningScenario Value="12" ID="ID_SIGNINGSCENARIO_UMCI" FriendlyName="UMCI">
<ProductSigners>
</ProductSigners>
</SigningScenario>
</SigningScenarios>
<UpdatePolicySigners>
<UpdatePolicySigner SignerId="EXAMPLE_ID_SIGNER_POLICY" />
</UpdatePolicySigners>
<!-- example remove core isolation a.k.a. Hypervisor Enforced Code Integrity (HVCI) options, consider enabling if your system is supported-->
<HvciOptions>0</HvciOptions>
<Settings>
<Setting Provider="PolicyInfo" Key="Information" ValueName="Name">
<Value>
<String>Example Policy Name - Empty</String>
</Value>
</Setting>
<Setting Provider="PolicyInfo" Key="Information" ValueName="Id">
<Value>
<String>Example-Policy-Empty-10.0.0.1</String>
</Value>
</Setting>
</Settings>
</SiPolicy>
```
## Errata
If a Windows 10 in S mode device with a policy authorization token and supplemental policy is rolled back from the 1909 update to the 1903 build, it will not revert to locked-down S mode until the next policy refresh. To achieve an immediate change to a locked-down S mode state, IT Pros should delete any tokens in %SystemRoot%\System32\CI\Tokens\Active.

BIN
windows/security/application-security/application-control/windows-defender-application-control/images/wdac-intune-app-catalogs.png
View File

Binary file not shown.
Side by Side

Before

Width:  |  Height:  |  Size: 24 KiB

BIN
windows/security/application-security/application-control/windows-defender-application-control/images/wdac-intune-app-deployment.png
View File

Binary file not shown.
Side by Side

Before

Width:  |  Height:  |  Size: 15 KiB

BIN
windows/security/application-security/application-control/windows-defender-application-control/images/wdac-intune-policy-authorization.png
View File

Binary file not shown.
Side by Side

Before

Width:  |  Height:  |  Size: 24 KiB

8
windows/security/application-security/application-control/windows-defender-application-control/index.yml
View File

@ -8,7 +8,7 @@ metadata:
author: vinaypamnani-msft
ms.author: vinpa
manager: aaroncz
ms.date: 04/05/2023
ms.date: 08/14/2024
# linkListType: overview | how-to-guide | tutorial | video
landingContent:
# Cards and links should be based on top customer tasks or top subjects
@ -39,8 +39,6 @@ landingContent:
url: design/microsoft-recommended-driver-block-rules.md
- text: Example WDAC policies
url: design/example-wdac-base-policies.md
- text: LOB Win32 apps on S Mode
url: deployment/LOB-win32-apps-on-s.md
- text: Managing multiple policies
url: design/deploy-multiple-wdac-policies.md
- linkListType: how-to-guide
@ -51,7 +49,7 @@ landingContent:
url: design/create-wdac-policy-for-fully-managed-devices.md
- text: Create a WDAC policy for a fixed-workload
url: design/create-wdac-policy-using-reference-computer.md
- text: Create a WDAC deny list policy
- text: Create a WDAC blocklist policy
url: design/create-wdac-deny-policy.md
- text: Deploying catalog files for WDAC management
url: deployment/deploy-catalog-files-to-support-wdac.md
@ -82,7 +80,7 @@ landingContent:
url: design/manage-packaged-apps-with-wdac.md
- text: Allow com object registration
url: design/allow-com-object-registration-in-wdac-policy.md
- text: Manage plug-ins, add-ins and modules
- text: Manage plug-ins, add-ins, and modules
url: design/use-wdac-policy-to-control-specific-plug-ins-add-ins-and-modules.md
# Card
- title: Learn how to deploy WDAC Policies

12
windows/security/docfx.json
View File

@ -99,7 +99,9 @@
"operating-system-security/data-protection/**/*.md": "paolomatarazzo",
"operating-system-security/data-protection/**/*.yml": "paolomatarazzo",
"operating-system-security/network-security/**/*.md": "paolomatarazzo",
"operating-system-security/network-security/**/*.yml": "paolomatarazzo"
"operating-system-security/network-security/**/*.yml": "paolomatarazzo",
"security-foundations/certification/**/*.md": "mike-grimm",
"security-foundations/certification/**/*.yml": "mike-grimm"
},
"ms.author": {
"application-security//**/*.md": "vinpa",
@ -119,7 +121,9 @@
"operating-system-security/data-protection/**/*.md": "paoloma",
"operating-system-security/data-protection/**/*.yml": "paoloma",
"operating-system-security/network-security/**/*.md": "paoloma",
"operating-system-security/network-security/**/*.yml": "paoloma"
"operating-system-security/network-security/**/*.yml": "paoloma",
"security-foundations/certification/**/*.md": "mgrimm",
"security-foundations/certification/**/*.yml": "mgrimm"
},
"appliesto": {
"application-security//**/*.md": [
@ -233,7 +237,8 @@
"operating-system-security/data-protection/personal-data-encryption/*.md": "rhonnegowda",
"operating-system-security/device-management/windows-security-configuration-framework/*.md": "jmunck",
"operating-system-security/network-security/vpn/*.md": "pesmith",
"operating-system-security/network-security/windows-firewall/*.md": "nganguly"
"operating-system-security/network-security/windows-firewall/*.md": "nganguly",
"security-foundations/certification/**/*.md": "paoloma"
},
"ms.collection": {
"book/*.md": "tier3",
@ -242,6 +247,7 @@
"information-protection/tpm/*.md": "tier1",
"operating-system-security/data-protection/bitlocker/*.md": "tier1",
"operating-system-security/data-protection/personal-data-encryption/*.md": "tier1",
"security-foundations/certification/**/*.md": "tier3",
"threat-protection/auditing/*.md": "tier3"
},
"ROBOTS": {

4
windows/security/security-foundations/certification/fips-140-validation.md
View File

@ -3,10 +3,6 @@ title: Windows FIPS 140 validation
description: Learn how Microsoft products and cryptographic modules follow the U.S. Federal government standard FIPS 140.
ms.date: 2/1/2024
ms.topic: reference
ms.author: v-rodurff
author: msrobertd
ms.reviewer: paoloma
ms.collection: tier3
---
# Windows FIPS 140 validation

4
windows/security/security-foundations/certification/validations/cc-windows-previous.md
View File

@ -3,10 +3,6 @@ title: Common Criteria certifications for previous Windows releases
description: Learn about the completed Common Criteria certifications for previous Windows releases.
ms.date: 2/1/2024
ms.topic: reference
ms.author: v-rodurff
author: msrobertd
ms.reviewer: paoloma
ms.collection: tier3
---
# Common Criteria certifications for previous Windows releases

4
windows/security/security-foundations/certification/validations/cc-windows-server-2022-2019-2016.md
View File

@ -3,10 +3,6 @@ title: Common Criteria certifications for Windows Server 2022, 2019, and 2016
description: Learn about the completed Common Criteria certifications for Windows Server 2022, 2019, and 2016.
ms.date: 2/1/2024
ms.topic: reference
ms.author: v-rodurff
author: msrobertd
ms.reviewer: paoloma
ms.collection: tier3
---
# Windows Server 2022, 2019, and 2016 Common Criteria certifications

4
windows/security/security-foundations/certification/validations/cc-windows-server-previous.md
View File

@ -3,10 +3,6 @@ title: Common Criteria certifications for previous Windows Server releases
description: Learn about the completed Common Criteria certifications for previous Windows Server releases.
ms.date: 2/1/2024
ms.topic: reference
ms.author: v-rodurff
author: msrobertd
ms.reviewer: paoloma
ms.collection: tier3
---
# Common Criteria certifications for previous Windows Server releases

4
windows/security/security-foundations/certification/validations/cc-windows-server-semi-annual.md
View File

@ -3,10 +3,6 @@ title: Common Criteria certifications for Windows Server semi-annual releases
description: Learn about the completed Common Criteria certifications for Windows Server semi-annual releases.
ms.date: 2/1/2024
ms.topic: reference
ms.author: v-rodurff
author: msrobertd
ms.reviewer: paoloma
ms.collection: tier3
---
# Windows Server semi-annual Common Criteria certifications

4
windows/security/security-foundations/certification/validations/cc-windows10.md
View File

@ -3,10 +3,6 @@ title: Common Criteria certifications for Windows 10
description: Learn about the completed Common Criteria certifications for Windows 10.
ms.date: 2/1/2024
ms.topic: reference
ms.author: v-rodurff
author: msrobertd
ms.reviewer: paoloma
ms.collection: tier3
---
# Windows 10 Common Criteria certifications

4
windows/security/security-foundations/certification/validations/cc-windows11.md
View File

@ -3,10 +3,6 @@ title: Common Criteria certifications for Windows 11
description: Learn about the completed Common Criteria certifications for Windows 11.
ms.date: 2/1/2024
ms.topic: reference
ms.author: v-rodurff
author: msrobertd
ms.reviewer: paoloma
ms.collection: tier3
---
# Windows 11 Common Criteria certifications

5
windows/security/security-foundations/certification/validations/fips-140-other-products.md
View File

@ -3,11 +3,8 @@ title: FIPS 140 validated modules for other products
description: This topic lists the completed FIPS 140 cryptographic module validations for products other than Windows and Windows Server that leverage the Windows cryptographic modules.
ms.date: 2/1/2024
ms.topic: reference
ms.author: v-rodurff
author: msrobertd
ms.reviewer: paoloma
ms.collection: tier3
---
# FIPS 140 validated modules in other products
The following tables list the completed FIPS 140 validations in products other than Windows and Windows Server that leverage the Windows cryptographic modules. The linked Security Policy document for each module provides details on the module capabilities and the policies the operator must follow to use the module in its FIPS approved mode of operation. For details on the FIPS approved algorithms used by each module, including CAVP algorithm certificates, see the module's linked Security Policy document or CMVP module certificate.

5
windows/security/security-foundations/certification/validations/fips-140-windows-previous.md
View File

@ -3,11 +3,8 @@ title: FIPS 140 validated modules for previous Windows versions
description: This topic lists the completed FIPS 140 cryptographic module validations for versions of Windows prior to Windows 10.
ms.date: 2/1/2024
ms.topic: reference
ms.author: v-rodurff
author: msrobertd
ms.reviewer: paoloma
ms.collection: tier3
---
# FIPS 140 validated modules in previous Windows versions
The following tables list the completed FIPS 140 validations of cryptographic modules used in versions of Windows prior to Windows 10, organized by major release of the operating system. The linked Security Policy document for each module provides details on the module capabilities and the policies the operator must follow to use the module in its FIPS approved mode of operation. For information on using the overall operating system in its FIPS approved mode, see [Use Windows in a FIPS approved mode of operation](../fips-140-validation.md#use-windows-in-a-fips-approved-mode-of-operation). For details on the FIPS approved algorithms used by each module, including CAVP algorithm certificates, see the module's linked Security Policy document or CMVP module certificate.

4
windows/security/security-foundations/certification/validations/fips-140-windows-server-2016.md
View File

@ -3,10 +3,6 @@ title: FIPS 140 validated modules for Windows Server 2016
description: This topic lists the completed FIPS 140 cryptographic module validations for Windows Server 2016.
ms.date: 2/1/2024
ms.topic: reference
ms.author: v-rodurff
author: msrobertd
ms.reviewer: paoloma
ms.collection: tier3
---
# FIPS 140 validated modules in Windows Server 2016

5
windows/security/security-foundations/certification/validations/fips-140-windows-server-2019.md
View File

@ -3,11 +3,8 @@ title: FIPS 140 validated modules for Windows Server 2019
description: This topic lists the completed FIPS 140 cryptographic module validations for Windows Server 2019.
ms.date: 4/5/2024
ms.topic: reference
ms.author: v-rodurff
author: msrobertd
ms.reviewer: paoloma
ms.collection: tier3
---
# FIPS 140 validated modules in Windows Server 2019
The following tables list the completed FIPS 140 validations of cryptographic modules used in Windows Server 2019, organized by major release of the operating system. The linked Security Policy document for each module provides details on the module capabilities and the policies the operator must follow to use the module in its FIPS approved mode of operation. For information on using the overall operating system in its FIPS approved mode, see [Use Windows in a FIPS approved mode of operation](../fips-140-validation.md#use-windows-in-a-fips-approved-mode-of-operation). For details on the FIPS approved algorithms used by each module, see its linked Security Policy document or module certificate.

4
windows/security/security-foundations/certification/validations/fips-140-windows-server-previous.md
View File

@ -3,10 +3,6 @@ title: FIPS 140 validated modules for previous Windows Server versions
description: This topic lists the completed FIPS 140 cryptographic module validations for versions of Windows Server prior to Windows Server 2016.
ms.date: 2/1/2024
ms.topic: reference
ms.author: v-rodurff
author: msrobertd
ms.reviewer: paoloma
ms.collection: tier3
---
# FIPS 140 validated modules in previous Windows Server versions

4
windows/security/security-foundations/certification/validations/fips-140-windows-server-semi-annual.md
View File

@ -3,10 +3,6 @@ title: FIPS 140 validated modules for Windows Server Semi-Annual Releases
description: This topic lists the completed FIPS 140 cryptographic module validations for Windows Server semi-annual releases.
ms.date: 2/1/2024
ms.topic: reference
ms.author: v-rodurff
author: msrobertd
ms.reviewer: paoloma
ms.collection: tier3
---
# FIPS 140 validated modules in Windows Server semi-annual releases

4
windows/security/security-foundations/certification/validations/fips-140-windows10.md
View File

@ -3,10 +3,6 @@ title: FIPS 140 validated modules for Windows 10
description: This topic lists the completed FIPS 140 cryptographic module validations for Windows 10.
ms.date: 2/1/2024
ms.topic: reference
ms.author: v-rodurff
author: msrobertd
ms.reviewer: paoloma
ms.collection: tier3
---
# FIPS 140 validated modules for Windows 10

4
windows/security/security-foundations/certification/validations/fips-140-windows11.md
View File

@ -3,10 +3,6 @@ title: FIPS 140 validated modules for Windows 11
description: This topic lists the completed FIPS 140 cryptographic module validations for Windows 11.
ms.date: 2/1/2024
ms.topic: reference
ms.author: v-rodurff
author: msrobertd
ms.reviewer: paoloma
ms.collection: tier3
---
# FIPS 140 validated modules for Windows 11

4
windows/security/security-foundations/certification/windows-platform-common-criteria.md
View File

@ -3,10 +3,6 @@ title: Windows Common Criteria certifications
description: Learn how Microsoft products are certified under the Common Criteria for Information Technology Security Evaluation program.
ms.date: 2/1/2024
ms.topic: reference
ms.author: v-rodurff
author: msrobertd
ms.reviewer: paoloma
ms.collection: tier3
---
# Common Criteria certifications

2
windows/whats-new/windows-11-requirements.md
View File

@ -60,7 +60,7 @@ To upgrade directly to Windows 11, eligible Windows 10 devices must meet both of
> [!NOTE]
>
> - S mode is only supported on the Home edition of Windows 11.
> - If you're running a different edition of Windows in S mode, before upgrading to Windows 11, first [switch out of S mode](/windows/deployment/windows-10-pro-in-s-mode).
> - If you're running a different edition of Windows in S mode, before upgrading to Windows 11, first [switch out of S mode](/previous-versions/windows/it-pro/windows-10/deployment/s-mode/switch-edition-from-s-mode).
> - To switch a device out of Windows 10 in S mode also requires internet connectivity. If you switch out of S mode, you can't switch back to S mode later.
## Feature-specific requirements