mirror of
https://github.com/MicrosoftDocs/windows-itpro-docs.git
synced 2025-05-12 13:27:23 +00:00
Merge branch 'master' of https://cpubwin.visualstudio.com/_git/it-client into microsoft-edge-preview
This commit is contained in:
Patti Short
commit
28ab330a3b
@ -17,7 +17,7 @@ You can use the Group Policy setting, **Set a default associations configuration
|
|||||||
|
|
||||||
**To set the default browser as Internet Explorer 11**
|
**To set the default browser as Internet Explorer 11**
|
||||||
|
|
||||||
1. Open your Group Policy editor and go to the **Computer Configuration\\Policies\\Administrative Templates\\Windows Components\\File Explorer\\Set a default associations configuration file** setting.<p>
|
1. Open your Group Policy editor and go to the **Administrative Templates\\Windows Components\\File Explorer\\Set a default associations configuration file** setting.<p>
|
||||||
Turning this setting on also requires you to create and store a default associations configuration file, locally or on a network share. For more information about creating this file, see [Export or Import Default Application Associations]( https://go.microsoft.com/fwlink/p/?LinkId=618268).
|
Turning this setting on also requires you to create and store a default associations configuration file, locally or on a network share. For more information about creating this file, see [Export or Import Default Application Associations]( https://go.microsoft.com/fwlink/p/?LinkId=618268).
|
||||||
|
|
||||||
|
|
||||||
|
|||||||
@ -1,5 +1,6 @@
|
|||||||
# [Microsoft HoloLens](index.md)
|
# [Microsoft HoloLens](index.md)
|
||||||
## [What's new in Microsoft HoloLens](hololens-whats-new.md)
|
## [What's new in Microsoft HoloLens](hololens-whats-new.md)
|
||||||
|
## [Insider preview for Microsoft HoloLens](hololens-insider.md)
|
||||||
## [HoloLens in the enterprise: requirements and FAQ](hololens-requirements.md)
|
## [HoloLens in the enterprise: requirements and FAQ](hololens-requirements.md)
|
||||||
## [Set up HoloLens](hololens-setup.md)
|
## [Set up HoloLens](hololens-setup.md)
|
||||||
## [Unlock Windows Holographic for Business features](hololens-upgrade-enterprise.md)
|
## [Unlock Windows Holographic for Business features](hololens-upgrade-enterprise.md)
|
||||||
|
|||||||
@ -9,13 +9,19 @@ author: jdeckerms
|
|||||||
ms.author: jdecker
|
ms.author: jdecker
|
||||||
ms.topic: article
|
ms.topic: article
|
||||||
ms.localizationpriority: medium
|
ms.localizationpriority: medium
|
||||||
ms.date: 06/04/2018
|
ms.date: 07/27/2018
|
||||||
---
|
---
|
||||||
|
|
||||||
# Change history for Microsoft HoloLens documentation
|
# Change history for Microsoft HoloLens documentation
|
||||||
|
|
||||||
This topic lists new and updated topics in the [Microsoft HoloLens documentation](index.md).
|
This topic lists new and updated topics in the [Microsoft HoloLens documentation](index.md).
|
||||||
|
|
||||||
|
## July 2018
|
||||||
|
|
||||||
|
New or changed topic | Description
|
||||||
|
--- | ---
|
||||||
|
[Insider preview for Microsoft HoloLens](hololens-insider.md) | New
|
||||||
|
|
||||||
## June 2018
|
## June 2018
|
||||||
|
|
||||||
New or changed topic | Description
|
New or changed topic | Description
|
||||||
|
|||||||
176
devices/hololens/hololens-insider.md
Normal file
176
devices/hololens/hololens-insider.md
Normal file
@ -0,0 +1,176 @@
|
|||||||
|
---
|
||||||
|
title: Insider preview for Microsoft HoloLens (HoloLens)
|
||||||
|
description: It’s simple to get started with Insider builds and to provide valuable feedback for our next major operating system update for HoloLens.
|
||||||
|
ms.prod: hololens
|
||||||
|
ms.sitesec: library
|
||||||
|
author: jdeckerms
|
||||||
|
ms.author: jdecker
|
||||||
|
ms.topic: article
|
||||||
|
ms.localizationpriority: medium
|
||||||
|
ms.date: 07/27/2018
|
||||||
|
---
|
||||||
|
|
||||||
|
# Insider preview for Microsoft HoloLens
|
||||||
|
|
||||||
|
Welcome to the latest Insider Preview builds for HoloLens! It’s simple to get started and provide valuable feedback for our next major operating system update for HoloLens.
|
||||||
|
|
||||||
|
>Latest insider version: 10.0.17720.1000
|
||||||
|
|
||||||
|
<span id="get-insider" />
|
||||||
|
## How do I install the Insider builds?
|
||||||
|
|
||||||
|
On a device running the Windows 10 April 2018 Update, go to **Settings -> Update & Security -> Windows Insider Program** and select **Get started**. Link the account you used to register as a Windows Insider.
|
||||||
|
|
||||||
|
Then, select **Active development of Windows**, choose whether you’d like to receive **Fast** or **Slow** builds, and review the program terms.
|
||||||
|
|
||||||
|
Select **Confirm -> Restart Now** to finish up. After your device has rebooted, go to **Settings -> Update & Security -> Check for updates** to get the latest build.
|
||||||
|
|
||||||
|
## New features for HoloLens
|
||||||
|
|
||||||
|
The latest Insider Preview (RS5) has arrived for all HoloLens customers! This latest flight is packed with improvements that have been introduced since the [last major release of HoloLens software in May 2018](https://docs.microsoft.com/windows/mixed-reality/release-notes).
|
||||||
|
|
||||||
|
### For everyone
|
||||||
|
|
||||||
|
|
||||||
|
Feature | Details | Instructions
|
||||||
|
--- | --- | ---
|
||||||
|
Stop video capture from the Start or quick actions menu | If you start video capture from the Start menu or quick actions menu, you’ll be able to stop recording from the same place. (Don’t forget, you can always do this with voice commands too.) | To start recording, select **Start > Video**. To stop recording, select **Start > Stop video**.
|
||||||
|
Project to a Miracast-enabled device | Project your HoloLens content to a nearby Surface device or TV/Monitor if using Microsoft Display adapter | On **Start**, select **Connect**. Select the device you want to project to.
|
||||||
|
New notifications | View and respond to notification toasts on HoloLens, just like you do on a PC. | You’ll now see notifications from apps that provide them. Gaze to respond to or dismiss them (or if you’re in an immersive experience, use the bloom gesture).
|
||||||
|
HoloLens overlays (file picker, keyboard, dialogs, etc.) | You’ll now see overlays such as the keyboard, dialogs, file picker, etc. when using immersive apps. | When you’re using an immersive app, input text, select a file from the file picker, or interact with dialogs without leaving the app.
|
||||||
|
Visual feedback overlay UI for volume change | When you use the volume up/down buttons on your HoloLens you’ll see a visual display of the volume level. | Adjust the device volume using the volume up/down buttons located on the right arm of the HoloLens. Use the visual display to track the volume level.
|
||||||
|
New UI for device boot | A loading indicator was added during the boot process to provide visual feedback that the system is loading. | Reboot your device to see the new loading indicator—it’s between the "Hello" message and the Windows boot logo.
|
||||||
|
Share UX: Nearby Sharing | Addition of the Windows Nearby Sharing experience, allowing you to share a capture with a nearby Windows device. | Capture a photo or video on HoloLens (or use the share button from an app such as Microsoft Edge). Select a nearby Windows device to share with.
|
||||||
|
Share from Microsoft Edge | Share button is now available on Microsoft Edge windows on HoloLens. | In Microsoft Edge, select **Share**. Use the HoloLens share picker to share web content.
|
||||||
|
|
||||||
|
### For developers
|
||||||
|
|
||||||
|
- Support for Holographic [Camera Capture UI API](https://docs.microsoft.com/windows/uwp/audio-video-camera/capture-photos-and-video-with-cameracaptureui), which will let developers expose a way for users to seamlessly invoke camera or video capture from within their applications. For example, users can now capture and insert photo or video content directly within apps like Word.
|
||||||
|
- Mixed Reality Capture has been improved to exclude hidden mesh from captures, which means videos captures by apps will no longer contain black corners around the content.
|
||||||
|
|
||||||
|
### For commercial customers
|
||||||
|
|
||||||
|
|
||||||
|
Feature | Details | Instructions
|
||||||
|
--- | --- | ---
|
||||||
|
Enable post-setup provisioning | Can now apply a runtime provisioning package at any time using **Settings**. | On your PC:<br><br>1. Create a provisioning package as described at [Create a provisioning package for HoloLens using the HoloLens wizard](hololens-provisioning.md). <br>2. Connect the HoloLens device via USB to a PC. HoloLens will show up as a device in File Explorer on the PC. <br>3. Drag and drop the provisioning package to the Documents folder on the HoloLens. <br><br>On your HoloLens: <br><br>1. Go to **Settings > Accounts > Access work or school**. <br>2. In **Related Settings**, select **Add or remove a provisioning package**.<br>3. On the next page, select **Add a package** to launch the file picker and select your provisioning package. <br>**Note:** if the folder is empty, make sure you select **This Device** and select **Documents**.<br>After your package has been applied, it will show in the list of Installed packages. To view package details or to remove the package from the device, select the listed package.
|
||||||
|
Assigned access with Azure AD groups | Flexibility to use Azure AD groups for configuration of Windows assigned access to set up single or multi-app kiosk configuration. | Prepare XML file to configure Assigned Access on PC:<br><br>1. In a text editor, open [the provided file AssignedAccessHoloLensConfiguration_AzureADGroup.xml](#xml).<br>2. Change the group ID to one available in your Azure AD tenant. You can find the group ID of an Azure Active Directory Group by either :<br>- following the steps at [Azure Active Directory version 2 cmdlets for group management](https://docs.microsoft.com/azure/active-directory/active-directory-accessmanagement-groups-settings-v2-cmdlets),<br>OR<br>- in the Azure portal, with the steps at [Manage the settings for a group in Azure Active Directory](https://docs.microsoft.com/azure/active-directory/active-directory-groups-settings-azure-portal).<br><br>**Note:** The sample configures the following apps: Skype, Learning, Feedback Hub, Flow, Camera, and Calibration. <br><br>Create provisioning package with WCD:<br><br>1. On a PC, follow the steps at [Create a provisioning package for HoloLens using the HoloLens wizard](hololens-provisioning.md) to create a provisioning package.<br>2. Ensure that you include the license file in **Set up device**.<br>3. Select **Switch to advanced editor** (bottom left), and **Yes** for warning prompt.<br>4. Expand the runtime settings selection in the **Available customizations** panel and select **AssignedAccess > MultiAppAssignedAccessSettings**.<br>5. In the middle panel, you should now see the setting displayed with documentation in the panel below. Browse to the XML you modified for Assigned Access.<br>6. On the **Export** menu, select **Provisioning package**. <br>**Warning:** If you encrypt the provisioning package, provisioning the HoloLens device will fail.<br>7. Select **Next** to specify the output location where you want the provisioning package to go once it's built.<br>8. Select **Next**, and then select **Build** to start building the package.<br>9. When the build completes, select **Finish**. <br><br>Apply the package to HoloLens: <br><br>1. Connect HoloLens via USB to a PC and start the device, but do not continue past the **Fit** page of OOBE (the first page with the blue box). HoloLens will show up as a device in File Explorer on the PC. <br>2. In File Explorer, drag and drop the provisioning package (.ppkg) onto the device storage.<br>3. Briefly press and release the **Volume Down** and **Power** buttons simultaneously again while on the fit page. <br>4. The device will ask you if you trust the package and would like to apply it. Confirm that you trust the package.<br>5. You will see whether the package was applied successfully or not. If it failed, you can fix your package and try again. If it succeeded, proceed with OOBE.<br><br>Enable assigned access on HoloLens: <br><br>1. After applying the provisioning package, during the **Account Setup** flows in OOBE, select **My work or school owns this** to set up your device with an Azure AD account. <br>**Note:** This account must not be in the group chosen for Assigned Access.<br>2. Once you reach the Shell, ensure the Skype app is installed either via your MDM environment or from the Store. <br>3. After the Skype app is installed, sign out. <br>4. On the sign-in screen, select the **Other User** option and enter an Azure AD account email address that belongs to the group chosen for Assigned Access. Then enter the password to sign in. You should now see this user with only the apps configured in the Assigned Access profile.
|
||||||
|
PIN sign-in on profile switch from sign-in screen | PIN sign-in is now available for **Other User**. | When signing in as **Other User**, the PIN option is now available under **Sign-In options**.
|
||||||
|
Sign in with Web Cred Provider using password | You can now select the Globe sign-in option to launch web sign-in with your password. Look for additional web sign-in methods coming in the future. | From the sign-in screen, select **Sign-In options** and select the Globe option to launch web sign-in. Enter your user name if needed, then your password. <br>**Note:** You can choose to bypass any PIN/Smartcard options when prompted during web sign-in.
|
||||||
|
Read device hardware info through MDM so devices can be tracked by serial # | IT administrators can see and track HoloLens by device serial number in their MDM console. | Refer to your MDM documentation for feature availability, and for how to use your MDM console to view HoloLens device serial number.
|
||||||
|
Set HoloLens device name through MDM (rename) | IT administrators can see and rename HoloLens devices in their MDM console. | Refer to your MDM documentation for feature availability, and for how to use your MDM console to view and set your HoloLens device name (rename).
|
||||||
|
|
||||||
|
### For international customers
|
||||||
|
|
||||||
|
|
||||||
|
Feature | Details | Instructions
|
||||||
|
--- | --- | ---
|
||||||
|
Localized Chinese and Japanese builds | Use HoloLens with localized user interface for Simplified Chinese or Japanese, including localized Pinyin keyboard, dictation, and voice commands. | See below.
|
||||||
|
|
||||||
|
#### Installing the Chinese or Japanese versions of the Insider builds
|
||||||
|
|
||||||
|
In order to switch to the Chinese or Japanese version of HoloLens, you’ll need to download the build for the language on a PC and then install it on your HoloLens using the Windows Device Recovery Tool (WDRT).
|
||||||
|
|
||||||
|
>[!IMPORTANT]
|
||||||
|
>Installing the Chinese or Japanese builds of HoloLens using WDRT will delete existing data, like personal files and settings, from your HoloLens.
|
||||||
|
|
||||||
|
1. On a retail HoloLens device, [opt in to Insider Preview builds](#get-insider) to prepare your device for the RS5 Preview.
|
||||||
|
2. On your PC, download and install [the Windows Device Recovery Tool (WDRT)](https://support.microsoft.com/help/12379).
|
||||||
|
3. Download the package for the language you want to your PC: [Simplified Chinese](https://aka.ms/hololenspreviewdownload-ch) or [Japanese](https://aka.ms/hololenspreviewdownload-jp).
|
||||||
|
4. When the download is finished, select **File Explorer > Downloads**. Right-click the zipped folder you just downloaded, and select **Extract all... > Extract** to unzip it.
|
||||||
|
5. Connect your HoloLens to your PC using the micro-USB cable it came with. (Even if you've been using other cables to connect your HoloLens, this one works best.)
|
||||||
|
6. The tool will automatically detect your HoloLens. Select the Microsoft HoloLens tile.
|
||||||
|
7. On the next screen, select **Manual package selection** and choose the installation file contained in the folder you unzipped in step 4. (Look for a file with the extension “.ffu”.)
|
||||||
|
8. Select **Install software** and follow the instructions to finish installing.
|
||||||
|
9. Once the build is installed, HoloLens setup will start automatically. Put on the device and follow the setup directions.
|
||||||
|
|
||||||
|
When you’re done with setup, go to **Settings -> Update & Security -> Windows Insider Program** and check that you’re configured to receive the latest preview builds. The Chinese/Japanese version of HoloLens will be kept up-to-date with the latest preview builds via the Windows Insider Program the same way the English version is.
|
||||||
|
|
||||||
|
## Note for language support
|
||||||
|
|
||||||
|
- You can’t change the system language between English, Japanese, and Chinese using the Settings app. Flashing a new build is the only supported way to change the device system language.
|
||||||
|
- While you can enter Simplified Chinese / Japanese text using the on-screen Pinyin keyboard, typing in Simplified Chinese / Japanese using a Bluetooth hardware keyboard is not supported at this time. However, on Chinese/Japanese HoloLens, you can continue to use a BT keyboard to type in English (the ~ key on a hardware keyboard toggles the keyboard to type in English).
|
||||||
|
|
||||||
|
## Note for developers
|
||||||
|
|
||||||
|
You are welcome and encouraged to try developing your applications using this build of HoloLens. Check out the [HoloLens Developer Documentation](https://developer.microsoft.com/windows/mixed-reality/development) to get started. Those same instructions work with this latest build of HoloLens. You can use the same builds of Unity and Visual Studio that you're already using for HoloLens development.
|
||||||
|
|
||||||
|
## Provide feedback and report issues
|
||||||
|
|
||||||
|
Please use [the Feedback Hub app](https://docs.microsoft.com/windows/mixed-reality/give-us-feedback) on your HoloLens or Windows 10 PC to provide feedback and report issues. Using Feedback Hub ensures that all necessary diagnostics information is included to help our engineers quickly debug and resolve the problem. Issues with the Chinese and Japanese version of HoloLens should be reported the same way.
|
||||||
|
|
||||||
|
>[!NOTE]
|
||||||
|
>Be sure to accept the prompt that asks whether you’d like Feedback Hub to access your Documents folder (select **Yes** when prompted).
|
||||||
|
|
||||||
|
<span id="xml" />
|
||||||
|
## AssignedAccessHoloLensConfiguration_AzureADGroup.xml
|
||||||
|
|
||||||
|
Copy this sample XML to use for the [**Assigned access with Azure AD groups** feature](#for-commercial-customers).
|
||||||
|
|
||||||
|
```xml
|
||||||
|
<?xml version="1.0" encoding="utf-8" ?>
|
||||||
|
<!--
|
||||||
|
This is a sample Assigned Access XML file. The Profile specifies which apps are allowed
|
||||||
|
and their app IDs. An Assigned Access Config specifies the accounts or groups to which
|
||||||
|
a Profile is applicable.
|
||||||
|
|
||||||
|
!!! NOTE: Change the Name of the AzureActiveDirectoryGroup below to a valid object ID for a group in the tenant being tested. !!!
|
||||||
|
|
||||||
|
You can find the object ID of an Azure Active Directory Group by following the steps at
|
||||||
|
https://docs.microsoft.com/en-us/azure/active-directory/active-directory-accessmanagement-groups-settings-v2-cmdlets
|
||||||
|
|
||||||
|
OR in the Azure portal with the steps at
|
||||||
|
https://docs.microsoft.com/en-us/azure/active-directory/active-directory-groups-settings-azure-portal
|
||||||
|
|
||||||
|
-->
|
||||||
|
<AssignedAccessConfiguration xmlns="http://schemas.microsoft.com/AssignedAccess/2017/config">
|
||||||
|
<Profiles>
|
||||||
|
<Profile Id="{9A2A490F-10F6-4764-974A-43B19E722C23}">
|
||||||
|
<AllAppsList>
|
||||||
|
<AllowedApps>
|
||||||
|
<!-- Learning app -->
|
||||||
|
<App AppUserModelId="GGVLearning_cw5n1h2txyewy!GGVLearning" />
|
||||||
|
<!-- Calibration app -->
|
||||||
|
<App AppUserModelId="ViewCalibrationApp_cw5n1h2txyewy!ViewCalibrationApp" />
|
||||||
|
<!-- Feedback Hub -->
|
||||||
|
<App AppUserModelId="Microsoft.WindowsFeedbackHub_8wekyb3d8bbwe!App" />
|
||||||
|
<!-- HoloSkype -->
|
||||||
|
<App AppUserModelId="Microsoft.SkypeApp_kzf8qxf38zg5c!App" />
|
||||||
|
<!-- HoloCamera -->
|
||||||
|
<App AppUserModelId="HoloCamera_cw5n1h2txyewy!App" />
|
||||||
|
<!-- HoloDevicesFlow -->
|
||||||
|
<App AppUserModelId="HoloDevicesFlow_cw5n1h2txyewy!App" />
|
||||||
|
</AllowedApps>
|
||||||
|
</AllAppsList>
|
||||||
|
<!-- This section is required for parity with Desktop Assigned Access. It is not currently used on HoloLens -->
|
||||||
|
<StartLayout>
|
||||||
|
<![CDATA[<LayoutModificationTemplate xmlns:defaultlayout="http://schemas.microsoft.com/Start/2014/FullDefaultLayout" xmlns:start="http://schemas.microsoft.com/Start/2014/StartLayout" Version="1" xmlns="http://schemas.microsoft.com/Start/2014/LayoutModification">
|
||||||
|
<LayoutOptions StartTileGroupCellWidth="6" />
|
||||||
|
<DefaultLayoutOverride>
|
||||||
|
<StartLayoutCollection>
|
||||||
|
<defaultlayout:StartLayout GroupCellWidth="6">
|
||||||
|
<start:Group Name="Life at a glance">
|
||||||
|
<start:Tile Size="2x2" Column="0" Row="0" AppUserModelID="Microsoft.SkypeApp_kzf8qxf38zg5c!App" />
|
||||||
|
</start:Group>
|
||||||
|
</defaultlayout:StartLayout>
|
||||||
|
</StartLayoutCollection>
|
||||||
|
</DefaultLayoutOverride>
|
||||||
|
</LayoutModificationTemplate>
|
||||||
|
]]>
|
||||||
|
</StartLayout>
|
||||||
|
<!-- This section is required for parity with Desktop Assigned Access. It is not currently used on HoloLens -->
|
||||||
|
<Taskbar ShowTaskbar="true"/>
|
||||||
|
</Profile>
|
||||||
|
</Profiles>
|
||||||
|
<Configs>
|
||||||
|
<!-- IMPORTANT: Replace the group ID here with a valid object ID for a group in the tenant being tested that you want to
|
||||||
|
be enabled for assigned access. Refer to https://docs.microsoft.com/en-us/azure/active-directory/users-groups-roles/groups-settings-v2-cmdlets on how to determine Object-Id for a AzureActiveDirectoryGroup. -->
|
||||||
|
<Config>
|
||||||
|
<UserGroup Type="AzureActiveDirectoryGroup" Name="ade2d5d2-1c86-4303-888e-80f323c33c61" /> <!-- All Intune Licensed Users -->
|
||||||
|
<DefaultProfile Id="{9A2A490F-10F6-4764-974A-43B19E722C23}"/>
|
||||||
|
</Config>
|
||||||
|
</Configs>
|
||||||
|
</AssignedAccessConfiguration>
|
||||||
|
|
||||||
|
```
|
||||||
|
|
||||||
@ -7,7 +7,7 @@ author: jdeckerms
|
|||||||
ms.author: jdecker
|
ms.author: jdecker
|
||||||
ms.topic: article
|
ms.topic: article
|
||||||
ms.localizationpriority: medium
|
ms.localizationpriority: medium
|
||||||
ms.date: 05/21/2018
|
ms.date: 07/27/2018
|
||||||
---
|
---
|
||||||
|
|
||||||
# Microsoft HoloLens
|
# Microsoft HoloLens
|
||||||
@ -22,6 +22,7 @@ ms.date: 05/21/2018
|
|||||||
| Topic | Description |
|
| Topic | Description |
|
||||||
| --- | --- |
|
| --- | --- |
|
||||||
| [What's new in Microsoft HoloLens](hololens-whats-new.md) | Discover the new features in the latest update. |
|
| [What's new in Microsoft HoloLens](hololens-whats-new.md) | Discover the new features in the latest update. |
|
||||||
|
[Insider preview for Microsoft HoloLens](hololens-insider.md) | Learn about new HoloLens features available in the latest Insider Preview build.
|
||||||
| [HoloLens in the enterprise: requirements](hololens-requirements.md) | Lists requirements for general use, Wi-Fi, and device management |
|
| [HoloLens in the enterprise: requirements](hololens-requirements.md) | Lists requirements for general use, Wi-Fi, and device management |
|
||||||
| [Set up HoloLens](hololens-setup.md) | How to set up HoloLens for the first time |
|
| [Set up HoloLens](hololens-setup.md) | How to set up HoloLens for the first time |
|
||||||
| [Unlock Windows Holographic for Business features](hololens-upgrade-enterprise.md) | How to upgrade your Development Edition HoloLens to Windows Holographic for Business |
|
| [Unlock Windows Holographic for Business features](hololens-upgrade-enterprise.md) | How to upgrade your Development Edition HoloLens to Windows Holographic for Business |
|
||||||
|
|||||||
@ -117,6 +117,12 @@ Microsoft periodically updates Surface Dock Updater. To learn more about the app
|
|||||||
>[!Note]
|
>[!Note]
|
||||||
>Each update to Surface Dock firmware is included in a new version of Surface Dock Updater. To update a Surface Dock to the latest firmware, you must use the latest version of Surface Dock Updater.
|
>Each update to Surface Dock firmware is included in a new version of Surface Dock Updater. To update a Surface Dock to the latest firmware, you must use the latest version of Surface Dock Updater.
|
||||||
|
|
||||||
|
### Version 2.22.139.0
|
||||||
|
*Release Date: 26 July 2018*
|
||||||
|
|
||||||
|
This version of Surface Dock Updater adds support for the following:
|
||||||
|
t.b.d.
|
||||||
|
|
||||||
### Version 2.12.136.0
|
### Version 2.12.136.0
|
||||||
*Release Date: 29 January 2018*
|
*Release Date: 29 January 2018*
|
||||||
|
|
||||||
|
|||||||
@ -15,7 +15,7 @@ ms.date: 07/11/2018
|
|||||||
|
|
||||||
# Use the Set up School PCs app
|
# Use the Set up School PCs app
|
||||||
|
|
||||||
IT administrators and technical teachers can use the **Set up School PCs** app to quickly set up Windows 10 PCs for students. The app configures PCs with the apps and features students need, and it removes the ones they don't need. During setup, if licensed in your tenant, the app anrolls each student PC into a mobile device management (MDM) provider, such as Intune for Education. You can then manage all the settings Set up School PCs configures through the MDM.
|
IT administrators and technical teachers can use the **Set up School PCs** app to quickly set up Windows 10 PCs for students. The app configures PCs with the apps and features students need, and it removes the ones they don't need. During setup, if licensed in your tenant, the app enrolls each student PC into a mobile device management (MDM) provider, such as Intune for Education. You can then manage all the settings Set up School PCs configures through the MDM.
|
||||||
|
|
||||||
Set up School PCs also:
|
Set up School PCs also:
|
||||||
* Joins each student PC to your organization's Office 365 and Azure Active Directory tenant.
|
* Joins each student PC to your organization's Office 365 and Azure Active Directory tenant.
|
||||||
|
|||||||
@ -365,7 +365,7 @@ https://www.microsoft.com/en-us/download/details.aspx?id=54967<td align="left"><
|
|||||||
</table>
|
</table>
|
||||||
|
|
||||||
**Note**
|
**Note**
|
||||||
In order to support SQL 2016 you must install the March 2017 Servicing Release for MDOP https://www.microsoft.com/en-us/download/details.aspx?id=54967 . In general stay current by always using the most recent servicing update as it also includes all bugfixes and new features.
|
In order to support SQL 2016 you must install the March 2017 Servicing Release for MDOP https://www.microsoft.com/en-us/download/details.aspx?id=54967 and to support SQL 2017 you must install the July 2018 Servicing Release for MDOP https://www.microsoft.com/en-us/download/details.aspx?id=57157. In general stay current by always using the most recent servicing update as it also includes all bugfixes and new features.
|
||||||
|
|
||||||
|
|
||||||
### <a href="" id="bkmk-sql-stand-alone-ramreqs"></a>SQL Server processor, RAM, and disk space requirements – Stand-alone topology
|
### <a href="" id="bkmk-sql-stand-alone-ramreqs"></a>SQL Server processor, RAM, and disk space requirements – Stand-alone topology
|
||||||
|
|||||||
@ -7,7 +7,7 @@ ms.topic: article
|
|||||||
ms.prod: w10
|
ms.prod: w10
|
||||||
ms.technology: windows
|
ms.technology: windows
|
||||||
author: MariciaAlforque
|
author: MariciaAlforque
|
||||||
ms.date: 04/24/2018
|
ms.date: 07/27/2018
|
||||||
---
|
---
|
||||||
|
|
||||||
# Configuration service provider reference
|
# Configuration service provider reference
|
||||||
@ -2660,6 +2660,7 @@ The following list shows the configuration service providers supported in Window
|
|||||||
| [NodeCache CSP](nodecache-csp.md) |  |  |
|
| [NodeCache CSP](nodecache-csp.md) |  |  |
|
||||||
[PassportForWork CSP](passportforwork-csp.md) |  |  |
|
[PassportForWork CSP](passportforwork-csp.md) |  |  |
|
||||||
| [Policy CSP](policy-configuration-service-provider.md) |  |  |
|
| [Policy CSP](policy-configuration-service-provider.md) |  |  |
|
||||||
|
| [RemoteFind CSP](remotefind-csp.md) |  | 4 |
|
||||||
| [RemoteWipe CSP](remotewipe-csp.md) |  | 4 |
|
| [RemoteWipe CSP](remotewipe-csp.md) |  | 4 |
|
||||||
| [RootCATrustedCertificates CSP](rootcacertificates-csp.md) |  |  |
|
| [RootCATrustedCertificates CSP](rootcacertificates-csp.md) |  |  |
|
||||||
| [Update CSP](update-csp.md) |  |  |
|
| [Update CSP](update-csp.md) |  |  |
|
||||||
|
|||||||
@ -7,7 +7,7 @@ ms.topic: article
|
|||||||
ms.prod: w10
|
ms.prod: w10
|
||||||
ms.technology: windows
|
ms.technology: windows
|
||||||
author: MariciaAlforque
|
author: MariciaAlforque
|
||||||
ms.date: 03/12/2018
|
ms.date: 07/26/2018
|
||||||
---
|
---
|
||||||
|
|
||||||
# DeviceStatus CSP
|
# DeviceStatus CSP
|
||||||
@ -178,11 +178,24 @@ Supported operation is Get.
|
|||||||
<a href="" id="devicestatus-antispyware-signaturestatus"></a>**DeviceStatus/Antispyware/SignatureStatus**
|
<a href="" id="devicestatus-antispyware-signaturestatus"></a>**DeviceStatus/Antispyware/SignatureStatus**
|
||||||
Added in Windows, version 1607. Integer that specifies the status of the antispyware signature.
|
Added in Windows, version 1607. Integer that specifies the status of the antispyware signature.
|
||||||
|
|
||||||
|
Valid values:
|
||||||
|
|
||||||
|
- 0 - The security software reports that it is not the most recent version.
|
||||||
|
- 1 - The security software reports that it is the most recent version.
|
||||||
|
- 2 - Not applicable. This is returned for devices like the phone that do not have an antivirus (where the API doesn’t exist.)
|
||||||
|
|
||||||
Supported operation is Get.
|
Supported operation is Get.
|
||||||
|
|
||||||
<a href="" id="devicestatus-antispyware-status"></a>**DeviceStatus/Antispyware/Status**
|
<a href="" id="devicestatus-antispyware-status"></a>**DeviceStatus/Antispyware/Status**
|
||||||
Added in Windows, version 1607. Integer that specifies the status of the antispyware.
|
Added in Windows, version 1607. Integer that specifies the status of the antispyware.
|
||||||
|
|
||||||
|
Valid values:
|
||||||
|
|
||||||
|
- 0 - The status of the security provider category is good and does not need user attention.
|
||||||
|
- 1 - The status of the security provider category is not monitored by Windows Security Center (WSC).
|
||||||
|
- 2 - The status of the security provider category is poor and the computer may be at risk.
|
||||||
|
- 3 - The security provider category is in snooze state. Snooze indicates that WSC is not actively protecting the computer.
|
||||||
|
|
||||||
Supported operation is Get.
|
Supported operation is Get.
|
||||||
|
|
||||||
<a href="" id="devicestatus-firewall"></a>**DeviceStatus/Firewall**
|
<a href="" id="devicestatus-firewall"></a>**DeviceStatus/Firewall**
|
||||||
|
|||||||
@ -14,7 +14,7 @@ ms.date: 01/26/2018
|
|||||||
|
|
||||||
The Firewall configuration service provider (CSP) allows the mobile device management (MDM) server to configure the Windows Defender Firewall global settings, per profile settings, as well as the desired set of custom rules to be enforced on the device. Using the Firewall CSP the IT admin can now manage non-domain devices, and reduce the risk of network security threats across all systems connecting to the corporate network. This CSP was added Windows 10, version 1709.
|
The Firewall configuration service provider (CSP) allows the mobile device management (MDM) server to configure the Windows Defender Firewall global settings, per profile settings, as well as the desired set of custom rules to be enforced on the device. Using the Firewall CSP the IT admin can now manage non-domain devices, and reduce the risk of network security threats across all systems connecting to the corporate network. This CSP was added Windows 10, version 1709.
|
||||||
|
|
||||||
Each of the Firewall rules in the FirewallRules section must be wrapped in an Atomic block in SyncML.
|
Firewall rules in the FirewallRules section must be wrapped in an Atomic block in SyncML, either individually or collectively.
|
||||||
|
|
||||||
For detailed information on some of the fields below see [[MS-FASP]: Firewall and Advanced Security Protocol documentation](https://msdn.microsoft.com/en-us/library/mt620101.aspx).
|
For detailed information on some of the fields below see [[MS-FASP]: Firewall and Advanced Security Protocol documentation](https://msdn.microsoft.com/en-us/library/mt620101.aspx).
|
||||||
|
|
||||||
@ -331,7 +331,7 @@ Sample syncxml to provision the firewall settings to evaluate
|
|||||||
<p style="margin-left: 20px">New rules have the EdgeTraversal property disabled by default.</p>
|
<p style="margin-left: 20px">New rules have the EdgeTraversal property disabled by default.</p>
|
||||||
<p style="margin-left: 20px">Value type is bool. Supported operations are Add, Get, Replace, and Delete.</p>
|
<p style="margin-left: 20px">Value type is bool. Supported operations are Add, Get, Replace, and Delete.</p>
|
||||||
|
|
||||||
<a href="" id="localuserauthorizedlist"></a>**FirewallRules/_FirewallRuleName_/LocalUserAuthorizedList**
|
<a href="" id="localuserauthorizedlist"></a>**FirewallRules/_FirewallRuleName_/LocalUserAuthorizationList**
|
||||||
<p style="margin-left: 20px">Specifies the list of authorized local users for the app container. This is a string in Security Descriptor Definition Language (SDDL) format.</p>
|
<p style="margin-left: 20px">Specifies the list of authorized local users for the app container. This is a string in Security Descriptor Definition Language (SDDL) format.</p>
|
||||||
<p style="margin-left: 20px">Value type is string. Supported operations are Add, Get, Replace, and Delete.</p>
|
<p style="margin-left: 20px">Value type is string. Supported operations are Add, Get, Replace, and Delete.</p>
|
||||||
|
|
||||||
|
|||||||
Binary file not shown.
|
Before Width: | Height: | Size: 33 KiB After Width: | Height: | Size: 44 KiB |
@ -10,7 +10,7 @@ ms.topic: article
|
|||||||
ms.prod: w10
|
ms.prod: w10
|
||||||
ms.technology: windows
|
ms.technology: windows
|
||||||
author: MariciaAlforque
|
author: MariciaAlforque
|
||||||
ms.date: 07/23 /2018
|
ms.date: 07/27/2018
|
||||||
---
|
---
|
||||||
|
|
||||||
# What's new in MDM enrollment and management
|
# What's new in MDM enrollment and management
|
||||||
@ -1638,28 +1638,36 @@ The DM agent for [push-button reset](https://msdn.microsoft.com/windows/hardware
|
|||||||
</thead>
|
</thead>
|
||||||
<tbody>
|
<tbody>
|
||||||
<tr>
|
<tr>
|
||||||
|
<td style="vertical-align:top">[PassportForWork CSP](passportforwork-csp.md)</td>
|
||||||
|
<td style="vertical-align:top"><p>Added new settings in Windows 10, next major version.</p>
|
||||||
|
</td></tr>
|
||||||
|
<tr>
|
||||||
|
<td style="vertical-align:top">[EnterpriseModernAppManagement CSP](enterprisemodernappmanagement-csp.md)</td>
|
||||||
|
<td style="vertical-align:top"><p>Added NonRemovable setting under AppManagement node in Windows 10, next major version.</p>
|
||||||
|
</td></tr>
|
||||||
|
<tr>
|
||||||
<td style="vertical-align:top">[Win32CompatibilityAppraiser CSP](win32compatibilityappraiser-csp.md)</td>
|
<td style="vertical-align:top">[Win32CompatibilityAppraiser CSP](win32compatibilityappraiser-csp.md)</td>
|
||||||
<td style="vertical-align:top"><p>Added new configuration service provider.</p>
|
<td style="vertical-align:top"><p>Added new configuration service provider in Windows 10, next major version.</p>
|
||||||
</td></tr>
|
</td></tr>
|
||||||
<tr>
|
<tr>
|
||||||
<td style="vertical-align:top">[WindowsLicensing CSP](windowslicensing-csp.md)</td>
|
<td style="vertical-align:top">[WindowsLicensing CSP](windowslicensing-csp.md)</td>
|
||||||
<td style="vertical-align:top"><p>Added S mode settings.</p>
|
<td style="vertical-align:top"><p>Added S mode settings and SyncML examples in Windows 10, next major version.</p>
|
||||||
</td></tr>
|
</td></tr>
|
||||||
<tr>
|
<tr>
|
||||||
<td style="vertical-align:top">[SUPL CSP](supl-csp.md)</td>
|
<td style="vertical-align:top">[SUPL CSP](supl-csp.md)</td>
|
||||||
<td style="vertical-align:top"><p>Added 3 new certificate nodes.</p>
|
<td style="vertical-align:top"><p>Added 3 new certificate nodes in Windows 10, next major version.</p>
|
||||||
</td></tr>
|
</td></tr>
|
||||||
<tr>
|
<tr>
|
||||||
<td style="vertical-align:top">[Defender CSP](defender-csp.md)</td>
|
<td style="vertical-align:top">[Defender CSP](defender-csp.md)</td>
|
||||||
<td style="vertical-align:top"><p>Added a new node Health/ProductStatus.</p>
|
<td style="vertical-align:top"><p>Added a new node Health/ProductStatus in Windows 10, next major version.</p>
|
||||||
</td></tr>
|
</td></tr>
|
||||||
<tr>
|
<tr>
|
||||||
<td style="vertical-align:top">[BitLocker CSP](bitlocker-csp.md)</td>
|
<td style="vertical-align:top">[BitLocker CSP](bitlocker-csp.md)</td>
|
||||||
<td style="vertical-align:top"><p>Added a new node AllowStandardUserEncryption.</p>
|
<td style="vertical-align:top"><p>Added a new node AllowStandardUserEncryption in Windows 10, next major version.</p>
|
||||||
</td></tr>
|
</td></tr>
|
||||||
<tr>
|
<tr>
|
||||||
<td style="vertical-align:top">[DevDetail CSP](devdetail-csp.md)</td>
|
<td style="vertical-align:top">[DevDetail CSP](devdetail-csp.md)</td>
|
||||||
<td style="vertical-align:top"><p>Added a new node SMBIOSSerialNumber.</p>
|
<td style="vertical-align:top"><p>Added a new node SMBIOSSerialNumber in Windows 10, next major version.</p>
|
||||||
</td></tr>
|
</td></tr>
|
||||||
<tr>
|
<tr>
|
||||||
<td style="vertical-align:top">[Policy CSP](policy-configuration-service-provider.md)</td>
|
<td style="vertical-align:top">[Policy CSP](policy-configuration-service-provider.md)</td>
|
||||||
@ -1687,7 +1695,7 @@ The DM agent for [push-button reset](https://msdn.microsoft.com/windows/hardware
|
|||||||
</ul>
|
</ul>
|
||||||
<p>Recent changes:</p>
|
<p>Recent changes:</p>
|
||||||
<ul>
|
<ul>
|
||||||
<li>DataUsage/SetCost3G - deprecated in RS5.</li>
|
<li>DataUsage/SetCost3G - deprecated in Windows 10, next major version.</li>
|
||||||
</ul>
|
</ul>
|
||||||
</td></tr>
|
</td></tr>
|
||||||
</tbody>
|
</tbody>
|
||||||
|
|||||||
@ -7,11 +7,14 @@ ms.topic: article
|
|||||||
ms.prod: w10
|
ms.prod: w10
|
||||||
ms.technology: windows
|
ms.technology: windows
|
||||||
author: MariciaAlforque
|
author: MariciaAlforque
|
||||||
ms.date: 06/26/2017
|
ms.date: 07/26/2018
|
||||||
---
|
---
|
||||||
|
|
||||||
# PassportForWork CSP
|
# PassportForWork CSP
|
||||||
|
|
||||||
|
> [!WARNING]
|
||||||
|
> Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.
|
||||||
|
|
||||||
The PassportForWork configuration service provider is used to provision Windows Hello for Business (formerly Microsoft Passport for Work). It allows you to login to Windows using your Active Directory or Azure Active Directory account and replace passwords, smartcards, and virtual smart cards.
|
The PassportForWork configuration service provider is used to provision Windows Hello for Business (formerly Microsoft Passport for Work). It allows you to login to Windows using your Active Directory or Azure Active Directory account and replace passwords, smartcards, and virtual smart cards.
|
||||||
|
|
||||||
> [!IMPORTANT]
|
> [!IMPORTANT]
|
||||||
@ -30,204 +33,243 @@ The following diagram shows the PassportForWork configuration service provider i
|
|||||||
|
|
||||||
|
|
||||||
<a href="" id="passportforwork"></a>**PassportForWork**
|
<a href="" id="passportforwork"></a>**PassportForWork**
|
||||||
<p style="margin-left: 20px">Root node for PassportForWork configuration service provider.
|
Root node for PassportForWork configuration service provider.
|
||||||
|
|
||||||
<a href="" id="tenantid"></a>***TenantId***
|
<a href="" id="tenantid"></a>***TenantId***
|
||||||
<p style="margin-left: 20px">A globally unique identifier (GUID), without curly braces ( { , } ), that is used as part of Windows Hello for Business provisioning and management.
|
A globally unique identifier (GUID), without curly braces ( { , } ), that is used as part of Windows Hello for Business provisioning and management.
|
||||||
|
|
||||||
<a href="" id="tenantid-policies"></a>***TenantId*/Policies**
|
<a href="" id="tenantid-policies"></a>***TenantId*/Policies**
|
||||||
<p style="margin-left: 20px">Node for defining the Windows Hello for Business policy settings.
|
Node for defining the Windows Hello for Business policy settings.
|
||||||
|
|
||||||
<a href="" id="tenantid-policies-usepassportforwork"></a>***TenantId*/Policies/UsePassportForWork**
|
<a href="" id="tenantid-policies-usepassportforwork"></a>***TenantId*/Policies/UsePassportForWork**
|
||||||
<p style="margin-left: 20px">Boolean value that sets Windows Hello for Business as a method for signing into Windows.
|
Boolean value that sets Windows Hello for Business as a method for signing into Windows.
|
||||||
|
|
||||||
<p style="margin-left: 20px">Default value is true. If you set this policy to false, the user cannot provision Windows Hello for Business except on Azure Active Directory joined mobile phones where provisioning is required.
|
Default value is true. If you set this policy to false, the user cannot provision Windows Hello for Business except on Azure Active Directory joined mobile phones where provisioning is required.
|
||||||
|
|
||||||
<p style="margin-left: 20px">Supported operations are Add, Get, Delete, and Replace.
|
Supported operations are Add, Get, Delete, and Replace.
|
||||||
|
|
||||||
<a href="" id="tenantid-policies-requiresecuritydevice"></a>***TenantId*/Policies/RequireSecurityDevice**
|
<a href="" id="tenantid-policies-requiresecuritydevice"></a>***TenantId*/Policies/RequireSecurityDevice**
|
||||||
<p style="margin-left: 20px">Boolean value that requires a Trusted Platform Module (TPM) for Windows Hello for Business. TPM provides an additional security benefit over software so that data stored in it cannot be used on other devices.
|
Boolean value that requires a Trusted Platform Module (TPM) for Windows Hello for Business. TPM provides an additional security benefit over software so that data stored in it cannot be used on other devices.
|
||||||
|
|
||||||
<p style="margin-left: 20px">Default value is false. If you set this policy to true, only devices with a usable TPM can provision Windows Hello for Business. If you set this policy to false, all devices can provision Windows Hello for Business using software even if there is not a usable TPM. If you do not configure this setting, all devices can provision Windows Hello for Business using software if the TPM is non-functional or unavailable.
|
Default value is false. If you set this policy to true, only devices with a usable TPM can provision Windows Hello for Business. If you set this policy to false, all devices can provision Windows Hello for Business using software even if there is not a usable TPM. If you do not configure this setting, all devices can provision Windows Hello for Business using software if the TPM is non-functional or unavailable.
|
||||||
|
|
||||||
<p style="margin-left: 20px">Supported operations are Add, Get, Delete, and Replace.
|
Supported operations are Add, Get, Delete, and Replace.
|
||||||
|
|
||||||
<a href="" id="tenantid-policies-excludesecuritydevices--only-for---device-vendor-msft-"></a>***TenantId*/Policies/ExcludeSecurityDevices** (only for ./Device/Vendor/MSFT)
|
<a href="" id="tenantid-policies-excludesecuritydevices--only-for---device-vendor-msft-"></a>***TenantId*/Policies/ExcludeSecurityDevices** (only for ./Device/Vendor/MSFT)
|
||||||
<p style="margin-left: 20px">Added in Windows 10, version 1703. Root node for excluded security devices.
|
Added in Windows 10, version 1703. Root node for excluded security devices.
|
||||||
<p style="margin-left: 20px">*Not supported on Windows Holographic and Windows Holographic for Business.*
|
*Not supported on Windows Holographic and Windows Holographic for Business.*
|
||||||
|
|
||||||
<a href="" id="tenantid-policies-excludesecuritydevices-tpm12--only-for---device-vendor-msft-"></a>***TenantId*/Policies/ExcludeSecurityDevices/TPM12** (only for ./Device/Vendor/MSFT)
|
<a href="" id="tenantid-policies-excludesecuritydevices-tpm12--only-for---device-vendor-msft-"></a>***TenantId*/Policies/ExcludeSecurityDevices/TPM12** (only for ./Device/Vendor/MSFT)
|
||||||
<p style="margin-left: 20px">Added in Windows 10, version 1703. Some Trusted Platform Modules (TPMs) are compliant only with the older 1.2 revision of the TPM specification defined by the Trusted Computing Group (TCG).
|
Added in Windows 10, version 1703. Some Trusted Platform Modules (TPMs) are compliant only with the older 1.2 revision of the TPM specification defined by the Trusted Computing Group (TCG).
|
||||||
|
|
||||||
<p style="margin-left: 20px">Default value is false. If you enable this policy setting, TPM revision 1.2 modules will be disallowed from being used with Windows Hello for Business.
|
Default value is false. If you enable this policy setting, TPM revision 1.2 modules will be disallowed from being used with Windows Hello for Business.
|
||||||
|
|
||||||
<p style="margin-left: 20px">If you disable or do not configure this policy setting, TPM revision 1.2 modules will be allowed to be used with Windows Hello for Business.
|
If you disable or do not configure this policy setting, TPM revision 1.2 modules will be allowed to be used with Windows Hello for Business.
|
||||||
|
|
||||||
<p style="margin-left: 20px">Supported operations are Add, Get, Delete, and Replace.
|
Supported operations are Add, Get, Delete, and Replace.
|
||||||
|
|
||||||
<a href="" id="tenantid-policies-enablepinrecovery"></a>***TenantId*/Policies/EnablePinRecovery**
|
<a href="" id="tenantid-policies-enablepinrecovery"></a>***TenantId*/Policies/EnablePinRecovery**
|
||||||
<p style="margin-left: 20px">Added in Windows 10, version 1703. Boolean value that enables a user to change their PIN by using the Windows Hello for Business PIN recovery service.
|
Added in Windows 10, version 1703. Boolean value that enables a user to change their PIN by using the Windows Hello for Business PIN recovery service.
|
||||||
This cloud service encrypts a recovery secret, which is stored locally on the client, and can be decrypted only by the cloud service.
|
This cloud service encrypts a recovery secret, which is stored locally on the client, and can be decrypted only by the cloud service.
|
||||||
|
|
||||||
<p style="margin-left: 20px">Default value is false. If you enable this policy setting, the PIN recovery secret will be stored on the device and the user can change their PIN if needed.
|
Default value is false. If you enable this policy setting, the PIN recovery secret will be stored on the device and the user can change their PIN if needed.
|
||||||
|
|
||||||
<p style="margin-left: 20px">If you disable or do not configure this policy setting, the PIN recovery secret will not be created or stored. If the user's PIN is forgotten, the only way to get a new PIN is by deleting the existing PIN and creating a new one, which will require the user to re-register with any services the old PIN provided access to.
|
If you disable or do not configure this policy setting, the PIN recovery secret will not be created or stored. If the user's PIN is forgotten, the only way to get a new PIN is by deleting the existing PIN and creating a new one, which will require the user to re-register with any services the old PIN provided access to.
|
||||||
|
|
||||||
<p style="margin-left: 20px">Supported operations are Add, Get, Delete, and Replace.
|
Supported operations are Add, Get, Delete, and Replace.
|
||||||
|
|
||||||
<a href="" id="tenantid-policies-usecertificateforonpremauth--only-for---device-vendor-msft-"></a>***TenantId*/Policies/UseCertificateForOnPremAuth** (only for ./Device/Vendor/MSFT)
|
<a href="" id="tenantid-policies-usecertificateforonpremauth--only-for---device-vendor-msft-"></a>***TenantId*/Policies/UseCertificateForOnPremAuth** (only for ./Device/Vendor/MSFT)
|
||||||
<p style="margin-left: 20px">Boolean value that enables Windows Hello for Business to use certificates to authenticate on-premises resources.
|
Boolean value that enables Windows Hello for Business to use certificates to authenticate on-premises resources.
|
||||||
|
|
||||||
<p style="margin-left: 20px">If you enable this policy setting, Windows Hello for Business will wait until the device has received a certificate payload from the mobile device management server before provisioning a PIN.
|
If you enable this policy setting, Windows Hello for Business will wait until the device has received a certificate payload from the mobile device management server before provisioning a PIN.
|
||||||
|
|
||||||
<p style="margin-left: 20px">If you disable or do not configure this policy setting, the PIN will be provisioned when the user logs in, without waiting for a certificate payload.
|
If you disable or do not configure this policy setting, the PIN will be provisioned when the user logs in, without waiting for a certificate payload.
|
||||||
|
|
||||||
<p style="margin-left: 20px">Supported operations are Add, Get, Delete, and Replace.
|
Supported operations are Add, Get, Delete, and Replace.
|
||||||
|
|
||||||
<a href="" id="tenantid-policies-pincomplexity"></a>***TenantId*/Policies/PINComplexity**
|
<a href="" id="tenantid-policies-pincomplexity"></a>***TenantId*/Policies/PINComplexity**
|
||||||
<p style="margin-left: 20px">Node for defining PIN settings.
|
Node for defining PIN settings.
|
||||||
|
|
||||||
<a href="" id="tenantid-policies-pincomplexity-minimumpinlength"></a>***TenantId*/Policies/PINComplexity/MinimumPINLength**
|
<a href="" id="tenantid-policies-pincomplexity-minimumpinlength"></a>***TenantId*/Policies/PINComplexity/MinimumPINLength**
|
||||||
<p style="margin-left: 20px">Integer value that sets the minimum number of characters required for the PIN. Default value is 4. The lowest number you can configure for this policy setting is 4. The largest number you can configure must be less than the number configured in the Maximum PIN length policy setting or the number 127, whichever is the lowest.
|
Integer value that sets the minimum number of characters required for the PIN. Default value is 4. The lowest number you can configure for this policy setting is 4. The largest number you can configure must be less than the number configured in the Maximum PIN length policy setting or the number 127, whichever is the lowest.
|
||||||
|
|
||||||
<p style="margin-left: 20px">If you configure this policy setting, the PIN length must be greater than or equal to this number. If you disable or do not configure this policy setting, the PIN length must be greater than or equal to 4.
|
If you configure this policy setting, the PIN length must be greater than or equal to this number. If you disable or do not configure this policy setting, the PIN length must be greater than or equal to 4.
|
||||||
|
|
||||||
> [!NOTE]
|
> [!NOTE]
|
||||||
> If the conditions specified above for the minimum PIN length are not met, default values will be used for both the maximum and minimum PIN lengths.
|
> If the conditions specified above for the minimum PIN length are not met, default values will be used for both the maximum and minimum PIN lengths.
|
||||||
|
|
||||||
|
|
||||||
<p style="margin-left: 20px">Value type is int. Supported operations are Add, Get, Delete, and Replace.
|
Value type is int. Supported operations are Add, Get, Delete, and Replace.
|
||||||
|
|
||||||
<a href="" id="tenantid-policies-pincomplexity-maximumpinlength"></a>***TenantId*/Policies/PINComplexity/MaximumPINLength**
|
<a href="" id="tenantid-policies-pincomplexity-maximumpinlength"></a>***TenantId*/Policies/PINComplexity/MaximumPINLength**
|
||||||
<p style="margin-left: 20px">Integer value that sets the maximum number of characters allowed for the PIN. Default value is 127. The largest number you can configure for this policy setting is 127. The lowest number you can configure must be larger than the number configured in the Minimum PIN length policy setting or the number 4, whichever is greater.
|
Integer value that sets the maximum number of characters allowed for the PIN. Default value is 127. The largest number you can configure for this policy setting is 127. The lowest number you can configure must be larger than the number configured in the Minimum PIN length policy setting or the number 4, whichever is greater.
|
||||||
|
|
||||||
<p style="margin-left: 20px">If you configure this policy setting, the PIN length must be less than or equal to this number. If you disable or do not configure this policy setting, the PIN length must be less than or equal to 127.
|
If you configure this policy setting, the PIN length must be less than or equal to this number. If you disable or do not configure this policy setting, the PIN length must be less than or equal to 127.
|
||||||
|
|
||||||
> [!NOTE]
|
> [!NOTE]
|
||||||
> If the conditions specified above for the maximum PIN length are not met, default values will be used for both the maximum and minimum PIN lengths.
|
> If the conditions specified above for the maximum PIN length are not met, default values will be used for both the maximum and minimum PIN lengths.
|
||||||
|
|
||||||
|
|
||||||
<p style="margin-left: 20px">Supported operations are Add, Get, Delete, and Replace.
|
Supported operations are Add, Get, Delete, and Replace.
|
||||||
|
|
||||||
<a href="" id="tenantid-policies-pincomplexity-uppercaseletters"></a>***TenantId*/Policies/PINComplexity/UppercaseLetters**
|
<a href="" id="tenantid-policies-pincomplexity-uppercaseletters"></a>***TenantId*/Policies/PINComplexity/UppercaseLetters**
|
||||||
<p style="margin-left: 20px">Integer value that configures the use of uppercase letters in the Windows Hello for Business PIN.
|
Integer value that configures the use of uppercase letters in the Windows Hello for Business PIN.
|
||||||
|
|
||||||
<p style="margin-left: 20px">Valid values:
|
Valid values:
|
||||||
|
|
||||||
- 0 - Allows the use of uppercase letters in PIN.
|
- 0 - Allows the use of uppercase letters in PIN.
|
||||||
- 1 - Requires the use of at least one uppercase letters in PIN.
|
- 1 - Requires the use of at least one uppercase letters in PIN.
|
||||||
- 2 - Does not allow the use of uppercase letters in PIN.
|
- 2 - Does not allow the use of uppercase letters in PIN.
|
||||||
|
|
||||||
<p style="margin-left: 20px">Default value is 2. Default PIN complexity behavior is that digits are required and all other character sets are not allowed. If all character sets are allowed but none are explicitly required, then the default PIN complexity behavior will apply.
|
Default value is 2. Default PIN complexity behavior is that digits are required and all other character sets are not allowed. If all character sets are allowed but none are explicitly required, then the default PIN complexity behavior will apply.
|
||||||
|
|
||||||
<p style="margin-left: 20px">Supported operations are Add, Get, Delete, and Replace.
|
Supported operations are Add, Get, Delete, and Replace.
|
||||||
|
|
||||||
<a href="" id="tenantid-policies-pincomplexity-lowercaseletters"></a>***TenantId*/Policies/PINComplexity/LowercaseLetters**
|
<a href="" id="tenantid-policies-pincomplexity-lowercaseletters"></a>***TenantId*/Policies/PINComplexity/LowercaseLetters**
|
||||||
<p style="margin-left: 20px">Integer value that configures the use of lowercase letters in the Windows Hello for Business PIN.
|
Integer value that configures the use of lowercase letters in the Windows Hello for Business PIN.
|
||||||
|
|
||||||
<p style="margin-left: 20px">Valid values:
|
Valid values:
|
||||||
|
|
||||||
- 0 - Allows the use of lowercase letters in PIN.
|
- 0 - Allows the use of lowercase letters in PIN.
|
||||||
- 1 - Requires the use of at least one lowercase letters in PIN.
|
- 1 - Requires the use of at least one lowercase letters in PIN.
|
||||||
- 2 - Does not allow the use of lowercase letters in PIN.
|
- 2 - Does not allow the use of lowercase letters in PIN.
|
||||||
|
|
||||||
<p style="margin-left: 20px">Default value is 2. Default PIN complexity behavior is that digits are required and all other character sets are not allowed. If all character sets are allowed but none are explicitly required, then the default PIN complexity behavior will apply.
|
Default value is 2. Default PIN complexity behavior is that digits are required and all other character sets are not allowed. If all character sets are allowed but none are explicitly required, then the default PIN complexity behavior will apply.
|
||||||
|
|
||||||
<p style="margin-left: 20px">Supported operations are Add, Get, Delete, and Replace.
|
Supported operations are Add, Get, Delete, and Replace.
|
||||||
|
|
||||||
<a href="" id="tenantid-policies-pincomplexity-specialcharacters"></a>***TenantId*/Policies/PINComplexity/SpecialCharacters**
|
<a href="" id="tenantid-policies-pincomplexity-specialcharacters"></a>***TenantId*/Policies/PINComplexity/SpecialCharacters**
|
||||||
<p style="margin-left: 20px">Integer value that configures the use of special characters in the Windows Hello for Business PIN. Valid special characters for Windows Hello for Business PIN gestures include: ! " \# $ % & ' ( ) \* + , - . / : ; < = > ? @ \[ \\ \] ^ \_ \` { | } ~ .
|
Integer value that configures the use of special characters in the Windows Hello for Business PIN. Valid special characters for Windows Hello for Business PIN gestures include: ! " \# $ % & ' ( ) \* + , - . / : ; < = > ? @ \[ \\ \] ^ \_ \` { | } ~ .
|
||||||
|
|
||||||
<p style="margin-left: 20px">Valid values:
|
Valid values:
|
||||||
|
|
||||||
- 0 - Allows the use of special characters in PIN.
|
- 0 - Allows the use of special characters in PIN.
|
||||||
- 1 - Requires the use of at least one special character in PIN.
|
- 1 - Requires the use of at least one special character in PIN.
|
||||||
- 2 - Does not allow the use of special characters in PIN.
|
- 2 - Does not allow the use of special characters in PIN.
|
||||||
|
|
||||||
<p style="margin-left: 20px">Default value is 2. Default PIN complexity behavior is that digits are required and all other character sets are not allowed. If all character sets are allowed but none are explicitly required, then the default PIN complexity behavior will apply.
|
Default value is 2. Default PIN complexity behavior is that digits are required and all other character sets are not allowed. If all character sets are allowed but none are explicitly required, then the default PIN complexity behavior will apply.
|
||||||
|
|
||||||
<p style="margin-left: 20px">Supported operations are Add, Get, Delete, and Replace.
|
Supported operations are Add, Get, Delete, and Replace.
|
||||||
|
|
||||||
<a href="" id="tenantid-policies-pincomplexity-digits"></a>***TenantId*/Policies/PINComplexity/Digits**
|
<a href="" id="tenantid-policies-pincomplexity-digits"></a>***TenantId*/Policies/PINComplexity/Digits**
|
||||||
<p style="margin-left: 20px">Integer value that configures the use of digits in the Windows Hello for Business PIN.
|
Integer value that configures the use of digits in the Windows Hello for Business PIN.
|
||||||
|
|
||||||
<p style="margin-left: 20px">Valid values:
|
Valid values:
|
||||||
|
|
||||||
- 0 - Allows the use of digits in PIN.
|
- 0 - Allows the use of digits in PIN.
|
||||||
- 1 - Requires the use of at least one digit in PIN.
|
- 1 - Requires the use of at least one digit in PIN.
|
||||||
- 2 - Does not allow the use of digits in PIN.
|
- 2 - Does not allow the use of digits in PIN.
|
||||||
|
|
||||||
<p style="margin-left: 20px">Default value is 1. Default PIN complexity behavior is that digits are required and all other character sets are not allowed. If all character sets are allowed but none are explicitly required, then the default PIN complexity behavior will apply.
|
Default value is 1. Default PIN complexity behavior is that digits are required and all other character sets are not allowed. If all character sets are allowed but none are explicitly required, then the default PIN complexity behavior will apply.
|
||||||
|
|
||||||
<p style="margin-left: 20px">Supported operations are Add, Get, Delete, and Replace.
|
Supported operations are Add, Get, Delete, and Replace.
|
||||||
|
|
||||||
<a href="" id="tenantid-policies-pincomplexity-history"></a>***TenantId*/Policies/PINComplexity/History**
|
<a href="" id="tenantid-policies-pincomplexity-history"></a>***TenantId*/Policies/PINComplexity/History**
|
||||||
<p style="margin-left: 20px">Integer value that specifies the number of past PINs that can be associated to a user account that can’t be reused. The largest number you can configure for this policy setting is 50. The lowest number you can configure for this policy setting is 0. If this policy is set to 0, then storage of previous PINs is not required. This node was added in Windows 10, version 1511.
|
Integer value that specifies the number of past PINs that can be associated to a user account that can’t be reused. The largest number you can configure for this policy setting is 50. The lowest number you can configure for this policy setting is 0. If this policy is set to 0, then storage of previous PINs is not required. This node was added in Windows 10, version 1511.
|
||||||
|
|
||||||
<p style="margin-left: 20px">The current PIN of the user is included in the set of PINs associated with the user account. PIN history is not preserved through a PIN reset.
|
The current PIN of the user is included in the set of PINs associated with the user account. PIN history is not preserved through a PIN reset.
|
||||||
|
|
||||||
<p style="margin-left: 20px">Default value is 0.
|
Default value is 0.
|
||||||
|
|
||||||
<p style="margin-left: 20px">Supported operations are Add, Get, Delete, and Replace.
|
Supported operations are Add, Get, Delete, and Replace.
|
||||||
|
|
||||||
<a href="" id="tenantid-policies-pincomplexity-expiration"></a>***TenantId*/Policies/PINComplexity/Expiration**
|
<a href="" id="tenantid-policies-pincomplexity-expiration"></a>***TenantId*/Policies/PINComplexity/Expiration**
|
||||||
<p style="margin-left: 20px">Integer value specifies the period of time (in days) that a PIN can be used before the system requires the user to change it. The largest number you can configure for this policy setting is 730. The lowest number you can configure for this policy setting is 0. If this policy is set to 0, then the user’s PIN will never expire. This node was added in Windows 10, version 1511.
|
Integer value specifies the period of time (in days) that a PIN can be used before the system requires the user to change it. The largest number you can configure for this policy setting is 730. The lowest number you can configure for this policy setting is 0. If this policy is set to 0, then the user’s PIN will never expire. This node was added in Windows 10, version 1511.
|
||||||
|
|
||||||
<p style="margin-left: 20px">Default is 0.
|
Default is 0.
|
||||||
|
|
||||||
<p style="margin-left: 20px">Supported operations are Add, Get, Delete, and Replace.
|
Supported operations are Add, Get, Delete, and Replace.
|
||||||
|
|
||||||
<a href="" id="tenantid-policies-remote--only-for---device-vendor-msft-"></a>***TenantId*/Policies/Remote** (only for ./Device/Vendor/MSFT)
|
<a href="" id="tenantid-policies-remote--only-for---device-vendor-msft-"></a>***TenantId*/Policies/Remote** (only for ./Device/Vendor/MSFT)
|
||||||
<p style="margin-left: 20px">Interior node for defining remote Windows Hello for Business policies. This node was added in Windows 10, version 1511.
|
Interior node for defining remote Windows Hello for Business policies. This node was added in Windows 10, version 1511.
|
||||||
<p style="margin-left: 20px">*Not supported on Windows Holographic and Windows Holographic for Business.*
|
*Not supported on Windows Holographic and Windows Holographic for Business.*
|
||||||
|
|
||||||
<a href="" id="tenantid-policies-remote-useremotepassport--only-for---device-vendor-msft-"></a>***TenantId*/Policies/Remote/UseRemotePassport** (only for ./Device/Vendor/MSFT)
|
<a href="" id="tenantid-policies-remote-useremotepassport--only-for---device-vendor-msft-"></a>***TenantId*/Policies/Remote/UseRemotePassport** (only for ./Device/Vendor/MSFT)
|
||||||
<p style="margin-left: 20px">Boolean value used to enable or disable the use of remote Windows Hello for Business. Remote Windows Hello for Business provides the ability for a portable, registered device to be usable as a companion device for desktop authentication. Remote Windows Hello for Business requires that the desktop be Azure AD joined and that the companion device has a Windows Hello for Business PIN. This node was added in Windows 10, version 1511.
|
Boolean value used to enable or disable the use of remote Windows Hello for Business. Remote Windows Hello for Business provides the ability for a portable, registered device to be usable as a companion device for desktop authentication. Remote Windows Hello for Business requires that the desktop be Azure AD joined and that the companion device has a Windows Hello for Business PIN. This node was added in Windows 10, version 1511.
|
||||||
|
|
||||||
<p style="margin-left: 20px">Default value is false. If you set this policy to true, Remote Windows Hello for Business will be enabled and a portable, registered device can be used as a companion device for desktop authentication. If you set this policy to false, Remote Windows Hello for Business will be disabled.
|
Default value is false. If you set this policy to true, Remote Windows Hello for Business will be enabled and a portable, registered device can be used as a companion device for desktop authentication. If you set this policy to false, Remote Windows Hello for Business will be disabled.
|
||||||
|
|
||||||
|
Supported operations are Add, Get, Delete, and Replace.
|
||||||
|
|
||||||
|
*Not supported on Windows Holographic and Windows Holographic for Business.*
|
||||||
|
|
||||||
<p style="margin-left: 20px">Supported operations are Add, Get, Delete, and Replace.
|
<a href="" id="tenantid-policies-usehellocertificatesassmartcardcertificates"></a>***TenantId*/Policies/UseHelloCertificatesAsSmartCardCertificates** (only for ./Device/Vendor/MSFT)
|
||||||
|
Added in Windows 10, next major version. If you enable this policy setting, applications use Windows Hello for Business certificates as smart card certificates. Biometric factors are unavailable when a user is asked to authorize the use of the certificate's private key. This policy setting is designed to allow compatibility with applications that rely exclusively on smart card certificates.
|
||||||
|
|
||||||
<p style="margin-left: 20px">*Not supported on Windows Holographic and Windows Holographic for Business.*
|
If you disable or do not configure this policy setting, applications do not use Windows Hello for Business certificates as smart card certificates, and biometric factors are available when a user is asked to authorize the use of the certificate's private key.
|
||||||
|
|
||||||
|
Windows requires a user to lock and unlock their session after changing this setting if the user is currently signed in.
|
||||||
|
|
||||||
|
Value type is bool. Supported operations are Add, Get, Replace, and Delete.
|
||||||
|
|
||||||
<a href="" id="usebiometrics"></a>**UseBiometrics**
|
<a href="" id="usebiometrics"></a>**UseBiometrics**
|
||||||
<p style="margin-left: 20px">This node is deprecated. Use **Biometrics/UseBiometrics** node instead.
|
This node is deprecated. Use **Biometrics/UseBiometrics** node instead.
|
||||||
|
|
||||||
<a href="" id="biometrics--only-for---device-vendor-msft-"></a>**Biometrics** (only for ./Device/Vendor/MSFT)
|
<a href="" id="biometrics--only-for---device-vendor-msft-"></a>**Biometrics** (only for ./Device/Vendor/MSFT)
|
||||||
<p style="margin-left: 20px">Node for defining biometric settings. This node was added in Windows 10, version 1511.
|
Node for defining biometric settings. This node was added in Windows 10, version 1511.
|
||||||
<p style="margin-left: 20px">*Not supported on Windows Holographic and Windows Holographic for Business.*
|
*Not supported on Windows Holographic and Windows Holographic for Business.*
|
||||||
|
|
||||||
<a href="" id="biometrics-usebiometrics--only-for---device-vendor-msft-"></a>**Biometrics/UseBiometrics** (only for ./Device/Vendor/MSFT)
|
<a href="" id="biometrics-usebiometrics--only-for---device-vendor-msft-"></a>**Biometrics/UseBiometrics** (only for ./Device/Vendor/MSFT)
|
||||||
<p style="margin-left: 20px">Boolean value used to enable or disable the use of biometric gestures, such as face and fingerprint, as an alternative to the PIN gesture for Windows Hello for Business. Users must still configure a PIN if they configure biometric gestures to use in case of failures. This node was added in Windows 10, version 1511.
|
Boolean value used to enable or disable the use of biometric gestures, such as face and fingerprint, as an alternative to the PIN gesture for Windows Hello for Business. Users must still configure a PIN if they configure biometric gestures to use in case of failures. This node was added in Windows 10, version 1511.
|
||||||
|
|
||||||
<p style="margin-left: 20px">Default value is false. If you set this policy to true, biometric gestures are enabled for use with Windows Hello for Business. If you set this policy to false, biometric gestures are disabled for use with Windows Hello for Business.
|
Default value is false. If you set this policy to true, biometric gestures are enabled for use with Windows Hello for Business. If you set this policy to false, biometric gestures are disabled for use with Windows Hello for Business.
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
<p style="margin-left: 20px">Supported operations are Add, Get, Delete, and Replace.
|
Supported operations are Add, Get, Delete, and Replace.
|
||||||
|
|
||||||
<p style="margin-left: 20px">*Not supported on Windows Holographic and Windows Holographic for Business.*
|
*Not supported on Windows Holographic and Windows Holographic for Business.*
|
||||||
|
|
||||||
<a href="" id="biometrics-facialfeaturesuseenhancedantispoofing--only-for---device-vendor-msft-"></a>**Biometrics/FacialFeaturesUseEnhancedAntiSpoofing** (only for ./Device/Vendor/MSFT)
|
<a href="" id="biometrics-facialfeaturesuseenhancedantispoofing--only-for---device-vendor-msft-"></a>**Biometrics/FacialFeaturesUseEnhancedAntiSpoofing** (only for ./Device/Vendor/MSFT)
|
||||||
<p style="margin-left: 20px">Boolean value used to enable or disable enhanced anti-spoofing for facial feature recognition on Windows Hello face authentication. This node was added in Windows 10, version 1511.
|
Boolean value used to enable or disable enhanced anti-spoofing for facial feature recognition on Windows Hello face authentication. This node was added in Windows 10, version 1511.
|
||||||
|
|
||||||
<p style="margin-left: 20px">Default value is false. If you set this policy to false or don't configure this setting, Windows doesn't require enhanced anti-spoofing for Windows Hello face authentication.
|
Default value is false. If you set this policy to false or don't configure this setting, Windows doesn't require enhanced anti-spoofing for Windows Hello face authentication.
|
||||||
|
|
||||||
<p style="margin-left: 20px">If you set this policy to true, Windows requires all users on managed devices to use enhanced anti-spoofing for Windows Hello face authentication. Windows Hello face authentication is disabled on devices that do not support enhanced anti-spoofing.
|
If you set this policy to true, Windows requires all users on managed devices to use enhanced anti-spoofing for Windows Hello face authentication. Windows Hello face authentication is disabled on devices that do not support enhanced anti-spoofing.
|
||||||
|
|
||||||
<p style="margin-left: 20px">Note that enhanced anti-spoofing for Windows Hello face authentication is not required on unmanaged devices.
|
Note that enhanced anti-spoofing for Windows Hello face authentication is not required on unmanaged devices.
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
<p style="margin-left: 20px">Supported operations are Add, Get, Delete, and Replace.
|
Supported operations are Add, Get, Delete, and Replace.
|
||||||
|
|
||||||
<p style="margin-left: 20px">*Not supported on Windows Holographic and Windows Holographic for Business.*
|
*Not supported on Windows Holographic and Windows Holographic for Business.*
|
||||||
|
|
||||||
|
<a href="" id="deviceunlock"></a>**DeviceUnlock** (only for ./Device/Vendor/MSFT)
|
||||||
|
Added in Windows 10, version 1803. Interior node.
|
||||||
|
|
||||||
|
<a href="" id="deviceunlock"></a>**DeviceUnlock/GroupA** (only for ./Device/Vendor/MSFT)
|
||||||
|
Added in Windows 10, version 1803. Contains a list of credential providers by GUID (comma separated) that are the first step of authentication.
|
||||||
|
|
||||||
|
Value type is string. Supported operations are Add, Get, Replace, and Delete.
|
||||||
|
|
||||||
|
<a href="" id="deviceunlock-groupb"></a>**DeviceUnlock/GroupB** (only for ./Device/Vendor/MSFT)
|
||||||
|
Added in Windows 10, version 1803. Contains a list of credential providers by GUID (comma separated) that are the second step of authentication.
|
||||||
|
|
||||||
|
Value type is string. Supported operations are Add, Get, Replace, and Delete.
|
||||||
|
|
||||||
|
<a href="" id="deviceunlock-plugins"></a>**DeviceUnlock/Plugins** (only for ./Device/Vendor/MSFT)
|
||||||
|
Added in Windows 10, version 1803. List of plugins (comma separated) that the passive provider monitors to detect user presence.
|
||||||
|
|
||||||
|
Value type is string. Supported operations are Add, Get, Replace, and Delete.
|
||||||
|
|
||||||
|
<a href="" id="dynamiclock"></a>**DynamicLock** (only for ./Device/Vendor/MSFT)
|
||||||
|
Added in Windows 10, version 1803. Interior node.
|
||||||
|
|
||||||
|
|
||||||
|
<a href="" id="dynamiclock-dynamiclock"></a>**DynamicLock/DynamicLock** (only for ./Device/Vendor/MSFT)
|
||||||
|
Added in Windows 10, version 1803. Enables the dynamic lock.
|
||||||
|
|
||||||
|
Value type is bool. Supported operations are Add, Get, Replace, and Delete.
|
||||||
|
|
||||||
|
<a href="" id="dynamiclock-plugins"></a>**DynamicLock/Plugins** (only for ./Device/Vendor/MSFT)
|
||||||
|
Added in Windows 10, version 1803. List of plugins (comma separated) that the passive provider monitors to detect user absence.
|
||||||
|
|
||||||
|
Value type is string. Supported operations are Add, Get, Replace, and Delete.
|
||||||
|
|
||||||
## Examples
|
## Examples
|
||||||
|
|
||||||
<p style="margin-left: 20px">Here's an example for setting Windows Hello for Business and setting the PIN policies. It also turns on the use of biometrics and TPM.
|
Here's an example for setting Windows Hello for Business and setting the PIN policies. It also turns on the use of biometrics and TPM.
|
||||||
|
|
||||||
``` syntax
|
``` syntax
|
||||||
<SyncML xmlns="SYNCML:SYNCML1.2">
|
<SyncML xmlns="SYNCML:SYNCML1.2">
|
||||||
|
|||||||
@ -7,16 +7,19 @@ ms.topic: article
|
|||||||
ms.prod: w10
|
ms.prod: w10
|
||||||
ms.technology: windows
|
ms.technology: windows
|
||||||
author: MariciaAlforque
|
author: MariciaAlforque
|
||||||
ms.date: 12/05/2017
|
ms.date: 07/26/2017
|
||||||
---
|
---
|
||||||
|
|
||||||
# PassportForWork DDF
|
# PassportForWork DDF
|
||||||
|
|
||||||
|
> [!WARNING]
|
||||||
|
> Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.
|
||||||
|
|
||||||
This topic shows the OMA DM device description framework (DDF) for the **PassportForWork** configuration service provider. DDF files are used only with OMA DM provisioning XML.
|
This topic shows the OMA DM device description framework (DDF) for the **PassportForWork** configuration service provider. DDF files are used only with OMA DM provisioning XML.
|
||||||
|
|
||||||
Looking for the DDF XML files? See [CSP DDF files download](configuration-service-provider-reference.md#csp-ddf-files-download).
|
Looking for the DDF XML files? See [CSP DDF files download](configuration-service-provider-reference.md#csp-ddf-files-download).
|
||||||
|
|
||||||
The XML below is the current version for this CSP.
|
The XML below is for Windows 10, next major version.
|
||||||
|
|
||||||
``` syntax
|
``` syntax
|
||||||
<?xml version="1.0" encoding="UTF-8"?>
|
<?xml version="1.0" encoding="UTF-8"?>
|
||||||
@ -42,7 +45,7 @@ The XML below is the current version for this CSP.
|
|||||||
<Permanent />
|
<Permanent />
|
||||||
</Scope>
|
</Scope>
|
||||||
<DFType>
|
<DFType>
|
||||||
<MIME>com.microsoft/1.3/MDM/PassportForWork</MIME>
|
<MIME>com.microsoft/1.5/MDM/PassportForWork</MIME>
|
||||||
</DFType>
|
</DFType>
|
||||||
</DFProperties>
|
</DFProperties>
|
||||||
<Node>
|
<Node>
|
||||||
@ -657,7 +660,7 @@ If you disable or do not configure this policy setting, the PIN recovery secret
|
|||||||
<Replace />
|
<Replace />
|
||||||
</AccessType>
|
</AccessType>
|
||||||
<DefaultValue>False</DefaultValue>
|
<DefaultValue>False</DefaultValue>
|
||||||
<Description>Windows Hello for Business can use certificates to authenticate to on-premises resources.
|
<Description>Windows Hello for Business can use certificates to authenticate to on-premise resources.
|
||||||
|
|
||||||
If you enable this policy setting, Windows Hello for Business will wait until the device has received a certificate payload from the mobile device management server before provisioning a PIN.
|
If you enable this policy setting, Windows Hello for Business will wait until the device has received a certificate payload from the mobile device management server before provisioning a PIN.
|
||||||
|
|
||||||
@ -985,6 +988,35 @@ Default value is false. If you enable this setting, a desktop device will allow
|
|||||||
</DFProperties>
|
</DFProperties>
|
||||||
</Node>
|
</Node>
|
||||||
</Node>
|
</Node>
|
||||||
|
<Node>
|
||||||
|
<NodeName>UseHelloCertificatesAsSmartCardCertificates</NodeName>
|
||||||
|
<DFProperties>
|
||||||
|
<AccessType>
|
||||||
|
<Get />
|
||||||
|
<Add />
|
||||||
|
<Delete />
|
||||||
|
<Replace />
|
||||||
|
</AccessType>
|
||||||
|
<DefaultValue>False</DefaultValue>
|
||||||
|
<Description>If you enable this policy setting, applications use Windows Hello for Business certificates as smart card certificates. Biometric factors are unavailable when a user is asked to authorize the use of the certificate's private key. This policy setting is designed to allow compatibility with applications that rely exclusively on smart card certificates.
|
||||||
|
|
||||||
|
If you disable or do not configure this policy setting, applications do not use Windows Hello for Business certificates as smart card certificates, and biometric factors are available when a user is asked to authorize the use of the certificate's private key.
|
||||||
|
|
||||||
|
Windows requires a user to lock and unlock their session after changing this setting if the user is currently signed in.</Description>
|
||||||
|
<DFFormat>
|
||||||
|
<bool />
|
||||||
|
</DFFormat>
|
||||||
|
<Occurrence>
|
||||||
|
<ZeroOrOne />
|
||||||
|
</Occurrence>
|
||||||
|
<Scope>
|
||||||
|
<Dynamic />
|
||||||
|
</Scope>
|
||||||
|
<DFType>
|
||||||
|
<MIME>text/plain</MIME>
|
||||||
|
</DFType>
|
||||||
|
</DFProperties>
|
||||||
|
</Node>
|
||||||
</Node>
|
</Node>
|
||||||
</Node>
|
</Node>
|
||||||
<Node>
|
<Node>
|
||||||
@ -1083,9 +1115,9 @@ NOTE: Disabling this policy prevents the use of biometric gestures on the device
|
|||||||
<DefaultValue>False</DefaultValue>
|
<DefaultValue>False</DefaultValue>
|
||||||
<Description>This setting determines whether enhanced anti-spoofing is required for Windows Hello face authentication.
|
<Description>This setting determines whether enhanced anti-spoofing is required for Windows Hello face authentication.
|
||||||
|
|
||||||
If you enable or don't configure this setting, Windows requires all users on managed devices to use enhanced anti-spoofing for Windows Hello face authentication. This disables Windows Hello face authentication on devices that do not support enhanced anti-spoofing.
|
If you enable this setting, Windows requires all users on managed devices to use enhanced anti-spoofing for Windows Hello face authentication. This disables Windows Hello face authentication on devices that do not support enhanced anti-spoofing.
|
||||||
|
|
||||||
If you disable this setting, Windows doesn't require enhanced anti-spoofing for Windows Hello face authentication.
|
If you disable or do not configure this setting, Windows doesn't require enhanced anti-spoofing for Windows Hello face authentication.
|
||||||
|
|
||||||
Note that enhanced anti-spoofing for Windows Hello face authentication is not required on unmanaged devices.</Description>
|
Note that enhanced anti-spoofing for Windows Hello face authentication is not required on unmanaged devices.</Description>
|
||||||
<DFFormat>
|
<DFFormat>
|
||||||
@ -1100,19 +1132,176 @@ Note that enhanced anti-spoofing for Windows Hello face authentication is not re
|
|||||||
<DFType>
|
<DFType>
|
||||||
<MIME>text/plain</MIME>
|
<MIME>text/plain</MIME>
|
||||||
</DFType>
|
</DFType>
|
||||||
|
<MSFT:SupportedValues AllowedValues="true,false">
|
||||||
|
<MSFT:SupportedValue value="true" description="Windows will require all users on managed devices to use enhanced anti-spoofing for Windows Hello face authentication. This disables Windows Hello face authentication on devices that do not support enhanced anti-spoofing."/>
|
||||||
|
<MSFT:SupportedValue value="false" description="Enhanced anti-spoofing is not required for Windows Hello face authentication."/>
|
||||||
|
</MSFT:SupportedValues>
|
||||||
|
</DFProperties>
|
||||||
|
</Node>
|
||||||
|
</Node>
|
||||||
|
<Node>
|
||||||
|
<NodeName>DeviceUnlock</NodeName>
|
||||||
|
<DFProperties>
|
||||||
|
<AccessType>
|
||||||
|
<Get />
|
||||||
|
</AccessType>
|
||||||
|
<Description>Device Unlock</Description>
|
||||||
|
<DFFormat>
|
||||||
|
<node />
|
||||||
|
</DFFormat>
|
||||||
|
<Occurrence>
|
||||||
|
<One />
|
||||||
|
</Occurrence>
|
||||||
|
<Scope>
|
||||||
|
<Permanent />
|
||||||
|
</Scope>
|
||||||
|
<DFType>
|
||||||
|
<DDFName></DDFName>
|
||||||
|
</DFType>
|
||||||
|
</DFProperties>
|
||||||
|
<Node>
|
||||||
|
<NodeName>GroupA</NodeName>
|
||||||
|
<DFProperties>
|
||||||
|
<AccessType>
|
||||||
|
<Get />
|
||||||
|
<Add />
|
||||||
|
<Delete />
|
||||||
|
<Replace />
|
||||||
|
</AccessType>
|
||||||
|
<Description>Contains a list of providers by GUID that are to be considered for the first step of authentication</Description>
|
||||||
|
<DFFormat>
|
||||||
|
<chr />
|
||||||
|
</DFFormat>
|
||||||
|
<Occurrence>
|
||||||
|
<ZeroOrOne />
|
||||||
|
</Occurrence>
|
||||||
|
<Scope>
|
||||||
|
<Dynamic />
|
||||||
|
</Scope>
|
||||||
|
<DFType>
|
||||||
|
<MIME>text/plain</MIME>
|
||||||
|
</DFType>
|
||||||
|
</DFProperties>
|
||||||
|
</Node>
|
||||||
|
<Node>
|
||||||
|
<NodeName>GroupB</NodeName>
|
||||||
|
<DFProperties>
|
||||||
|
<AccessType>
|
||||||
|
<Get />
|
||||||
|
<Add />
|
||||||
|
<Delete />
|
||||||
|
<Replace />
|
||||||
|
</AccessType>
|
||||||
|
<Description>Contains a list of providers by GUID that are to be considered for the second step of authentication</Description>
|
||||||
|
<DFFormat>
|
||||||
|
<chr />
|
||||||
|
</DFFormat>
|
||||||
|
<Occurrence>
|
||||||
|
<ZeroOrOne />
|
||||||
|
</Occurrence>
|
||||||
|
<Scope>
|
||||||
|
<Dynamic />
|
||||||
|
</Scope>
|
||||||
|
<DFType>
|
||||||
|
<MIME>text/plain</MIME>
|
||||||
|
</DFType>
|
||||||
|
</DFProperties>
|
||||||
|
</Node>
|
||||||
|
<Node>
|
||||||
|
<NodeName>Plugins</NodeName>
|
||||||
|
<DFProperties>
|
||||||
|
<AccessType>
|
||||||
|
<Get />
|
||||||
|
<Add />
|
||||||
|
<Delete />
|
||||||
|
<Replace />
|
||||||
|
</AccessType>
|
||||||
|
<Description>List of plugins that the passive provider monitors to detect user presence</Description>
|
||||||
|
<DFFormat>
|
||||||
|
<chr />
|
||||||
|
</DFFormat>
|
||||||
|
<Occurrence>
|
||||||
|
<ZeroOrOne />
|
||||||
|
</Occurrence>
|
||||||
|
<Scope>
|
||||||
|
<Dynamic />
|
||||||
|
</Scope>
|
||||||
|
<DFType>
|
||||||
|
<MIME>text/plain</MIME>
|
||||||
|
</DFType>
|
||||||
|
</DFProperties>
|
||||||
|
</Node>
|
||||||
|
</Node>
|
||||||
|
<Node>
|
||||||
|
<NodeName>DynamicLock</NodeName>
|
||||||
|
<DFProperties>
|
||||||
|
<AccessType>
|
||||||
|
<Get />
|
||||||
|
</AccessType>
|
||||||
|
<Description>Dynamic Lock</Description>
|
||||||
|
<DFFormat>
|
||||||
|
<node />
|
||||||
|
</DFFormat>
|
||||||
|
<Occurrence>
|
||||||
|
<One />
|
||||||
|
</Occurrence>
|
||||||
|
<Scope>
|
||||||
|
<Permanent />
|
||||||
|
</Scope>
|
||||||
|
<DFType>
|
||||||
|
<DDFName></DDFName>
|
||||||
|
</DFType>
|
||||||
|
</DFProperties>
|
||||||
|
<Node>
|
||||||
|
<NodeName>DynamicLock</NodeName>
|
||||||
|
<DFProperties>
|
||||||
|
<AccessType>
|
||||||
|
<Get />
|
||||||
|
<Add />
|
||||||
|
<Delete />
|
||||||
|
<Replace />
|
||||||
|
</AccessType>
|
||||||
|
<DefaultValue>False</DefaultValue>
|
||||||
|
<Description>Enables/Disables Dyanamic Lock</Description>
|
||||||
|
<DFFormat>
|
||||||
|
<bool />
|
||||||
|
</DFFormat>
|
||||||
|
<Occurrence>
|
||||||
|
<ZeroOrOne />
|
||||||
|
</Occurrence>
|
||||||
|
<Scope>
|
||||||
|
<Dynamic />
|
||||||
|
</Scope>
|
||||||
|
<DFType>
|
||||||
|
<MIME>text/plain</MIME>
|
||||||
|
</DFType>
|
||||||
|
</DFProperties>
|
||||||
|
</Node>
|
||||||
|
<Node>
|
||||||
|
<NodeName>Plugins</NodeName>
|
||||||
|
<DFProperties>
|
||||||
|
<AccessType>
|
||||||
|
<Get />
|
||||||
|
<Add />
|
||||||
|
<Delete />
|
||||||
|
<Replace />
|
||||||
|
</AccessType>
|
||||||
|
<Description>List of plugins that the passive provider monitors to detect user absence</Description>
|
||||||
|
<DFFormat>
|
||||||
|
<chr />
|
||||||
|
</DFFormat>
|
||||||
|
<Occurrence>
|
||||||
|
<ZeroOrOne />
|
||||||
|
</Occurrence>
|
||||||
|
<Scope>
|
||||||
|
<Dynamic />
|
||||||
|
</Scope>
|
||||||
|
<DFType>
|
||||||
|
<MIME>text/plain</MIME>
|
||||||
|
</DFType>
|
||||||
</DFProperties>
|
</DFProperties>
|
||||||
</Node>
|
</Node>
|
||||||
</Node>
|
</Node>
|
||||||
</Node>
|
</Node>
|
||||||
</MgmtTree>
|
</MgmtTree>
|
||||||
```
|
```
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|||||||
@ -1246,6 +1246,12 @@ The following diagram shows the Policy configuration service provider in tree fo
|
|||||||
<dd>
|
<dd>
|
||||||
<a href="./policy-csp-experience.md#experience-donotshowfeedbacknotifications" id="experience-donotshowfeedbacknotifications">Experience/DoNotShowFeedbackNotifications</a>
|
<a href="./policy-csp-experience.md#experience-donotshowfeedbacknotifications" id="experience-donotshowfeedbacknotifications">Experience/DoNotShowFeedbackNotifications</a>
|
||||||
</dd>
|
</dd>
|
||||||
|
<dd>
|
||||||
|
<a href="./policy-csp-experience.md#experience-donotsyncbrowsersetting" id="experience-donotsyncbrowsersetting">Experience/DoNotSyncBrowserSetting</a>
|
||||||
|
</dd>
|
||||||
|
<dd>
|
||||||
|
<a href="./policy-csp-experience.md#experience-preventusersfromturningonbrowsersyncing" id="experience-preventusersfromturningonbrowsersyncing">Experience/PreventUsersFromTurningOnBrowserSyncing</a>
|
||||||
|
</dd>
|
||||||
</dl>
|
</dl>
|
||||||
|
|
||||||
### ExploitGuard policies
|
### ExploitGuard policies
|
||||||
@ -4319,6 +4325,8 @@ The following diagram shows the Policy configuration service provider in tree fo
|
|||||||
- [Experience/AllowWindowsTips](./policy-csp-experience.md#experience-allowwindowstips)
|
- [Experience/AllowWindowsTips](./policy-csp-experience.md#experience-allowwindowstips)
|
||||||
- [Experience/ConfigureWindowsSpotlightOnLockScreen](./policy-csp-experience.md#experience-configurewindowsspotlightonlockscreen)
|
- [Experience/ConfigureWindowsSpotlightOnLockScreen](./policy-csp-experience.md#experience-configurewindowsspotlightonlockscreen)
|
||||||
- [Experience/DoNotShowFeedbackNotifications](./policy-csp-experience.md#experience-donotshowfeedbacknotifications)
|
- [Experience/DoNotShowFeedbackNotifications](./policy-csp-experience.md#experience-donotshowfeedbacknotifications)
|
||||||
|
- [Experience/DoNotSyncBrowserSetting](./policy-csp-experience.md#experience-donotsyncbrowsersetting)
|
||||||
|
- [Experience/PreventUsersFromTurningOnBrowserSyncing](./policy-csp-experience.md#experience-preventusersfromturningonbrowsersyncing)
|
||||||
- [ExploitGuard/ExploitProtectionSettings](./policy-csp-exploitguard.md#exploitguard-exploitprotectionsettings)
|
- [ExploitGuard/ExploitProtectionSettings](./policy-csp-exploitguard.md#exploitguard-exploitprotectionsettings)
|
||||||
- [FileExplorer/TurnOffDataExecutionPreventionForExplorer](./policy-csp-fileexplorer.md#fileexplorer-turnoffdataexecutionpreventionforexplorer)
|
- [FileExplorer/TurnOffDataExecutionPreventionForExplorer](./policy-csp-fileexplorer.md#fileexplorer-turnoffdataexecutionpreventionforexplorer)
|
||||||
- [FileExplorer/TurnOffHeapTerminationOnCorruption](./policy-csp-fileexplorer.md#fileexplorer-turnoffheapterminationoncorruption)
|
- [FileExplorer/TurnOffHeapTerminationOnCorruption](./policy-csp-fileexplorer.md#fileexplorer-turnoffheapterminationoncorruption)
|
||||||
|
|||||||
@ -90,6 +90,12 @@ ms.date: 07/13/2018
|
|||||||
<dd>
|
<dd>
|
||||||
<a href="#experience-donotshowfeedbacknotifications">Experience/DoNotShowFeedbackNotifications</a>
|
<a href="#experience-donotshowfeedbacknotifications">Experience/DoNotShowFeedbackNotifications</a>
|
||||||
</dd>
|
</dd>
|
||||||
|
<dd>
|
||||||
|
<a href="#experience-donotsyncbrowsersetting">Experience/DoNotSyncBrowserSetting</a>
|
||||||
|
</dd>
|
||||||
|
<dd>
|
||||||
|
<a href="#experience-preventusersfromturningonbrowsersyncing">Experience/PreventUsersFromTurningOnBrowserSyncing</a>
|
||||||
|
</dd>
|
||||||
</dl>
|
</dl>
|
||||||
|
|
||||||
|
|
||||||
@ -1390,6 +1396,158 @@ The following list shows the supported values:
|
|||||||
<!--/SupportedValues-->
|
<!--/SupportedValues-->
|
||||||
<!--/Policy-->
|
<!--/Policy-->
|
||||||
|
|
||||||
|
<<<<<<< HEAD
|
||||||
|
<hr/>
|
||||||
|
|
||||||
|
<!--Policy-->
|
||||||
|
<a href="" id="experience-donotsyncbrowsersetting"></a>**Experience/DoNotSyncBrowserSetting**
|
||||||
|
|
||||||
|
<!--SupportedSKUs-->
|
||||||
|
<table>
|
||||||
|
<tr>
|
||||||
|
<th>Home</th>
|
||||||
|
<th>Pro</th>
|
||||||
|
<th>Business</th>
|
||||||
|
<th>Enterprise</th>
|
||||||
|
<th>Education</th>
|
||||||
|
<th>Mobile</th>
|
||||||
|
<th>Mobile Enterprise</th>
|
||||||
|
</tr>
|
||||||
|
<tr>
|
||||||
|
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||||
|
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||||
|
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||||
|
<td><img src="images/checkmark.png" alt="check mark" /><sup>5</sup></td>
|
||||||
|
<td><img src="images/checkmark.png" alt="check mark" /><sup>5</sup></td>
|
||||||
|
<td></td>
|
||||||
|
<td></td>
|
||||||
|
</tr>
|
||||||
|
</table>
|
||||||
|
|
||||||
|
<!--/SupportedSKUs-->
|
||||||
|
<!--Scope-->
|
||||||
|
[Scope](./policy-configuration-service-provider.md#policy-scope):
|
||||||
|
|
||||||
|
> [!div class = "checklist"]
|
||||||
|
> * Device
|
||||||
|
|
||||||
|
<hr/>
|
||||||
|
|
||||||
|
<!--/Scope-->
|
||||||
|
<!--Description-->
|
||||||
|
By default, the "browser" group syncs automatically between user’s devices and allowing users to choose to make changes. The "browser" group uses the **Sync your Settings** option in Settings to sync information like history and favorites. Enabling this policy prevents the "browser" group from using the **Sync your Settings** option. If you want syncing turned off by default but not disabled, select the Allow users to turn "browser" syncing option.
|
||||||
|
|
||||||
|
Related policy: PreventUsersFromTurningOnBrowserSyncing.
|
||||||
|
|
||||||
|
Value type is integer. Supported values:
|
||||||
|
|
||||||
|
- 0 (default) - Allowed/turned on. The "browser" group syncs automatically between user’s devices and lets users to make changes.
|
||||||
|
- 2 - Prevented/turned off. The "browser" group does not use the **Sync your Settings** option.
|
||||||
|
|
||||||
|
<!--/Description-->
|
||||||
|
<!--ADMXMapped-->
|
||||||
|
ADMX Info:
|
||||||
|
- GP English name: *Do not sync browser settings*
|
||||||
|
- GP name: *DisableWebBrowserSettingSync*
|
||||||
|
- GP path: *Windows Components/Sync your settings*
|
||||||
|
- GP ADMX file name: *SettingSync.admx*
|
||||||
|
|
||||||
|
<!--/ADMXMapped-->
|
||||||
|
<!--SupportedValues-->
|
||||||
|
|
||||||
|
<!--/SupportedValues-->
|
||||||
|
<!--Example-->
|
||||||
|
|
||||||
|
<!--/Example-->
|
||||||
|
<!--Validation-->
|
||||||
|
|
||||||
|
<!--/Validation-->
|
||||||
|
<!--/Policy-->
|
||||||
|
|
||||||
|
<hr/>
|
||||||
|
|
||||||
|
<!--Policy-->
|
||||||
|
<a href="" id="experience-preventusersfromturningonbrowsersyncing"></a>**Experience/PreventUsersFromTurningOnBrowserSyncing**
|
||||||
|
|
||||||
|
<!--SupportedSKUs-->
|
||||||
|
<table>
|
||||||
|
<tr>
|
||||||
|
<th>Home</th>
|
||||||
|
<th>Pro</th>
|
||||||
|
<th>Business</th>
|
||||||
|
<th>Enterprise</th>
|
||||||
|
<th>Education</th>
|
||||||
|
<th>Mobile</th>
|
||||||
|
<th>Mobile Enterprise</th>
|
||||||
|
</tr>
|
||||||
|
<tr>
|
||||||
|
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||||
|
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||||
|
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||||
|
<td><img src="images/checkmark.png" alt="check mark" /><sup>5</sup></td>
|
||||||
|
<td><img src="images/checkmark.png" alt="check mark" /><sup>5</sup></td>
|
||||||
|
<td></td>
|
||||||
|
<td></td>
|
||||||
|
</tr>
|
||||||
|
</table>
|
||||||
|
|
||||||
|
<!--/SupportedSKUs-->
|
||||||
|
<!--Scope-->
|
||||||
|
[Scope](./policy-configuration-service-provider.md#policy-scope):
|
||||||
|
|
||||||
|
> [!div class = "checklist"]
|
||||||
|
> * Device
|
||||||
|
|
||||||
|
<hr/>
|
||||||
|
|
||||||
|
<!--/Scope-->
|
||||||
|
<!--Description-->
|
||||||
|
By default, the "browser" group syncs automatically between the user’s devices, letting users make changes. With this policy, though, you can prevent the "browser" group from syncing and prevent users from turning on the Sync your Settings toggle in Settings. If you want syncing turned off by default but not disabled, select the Allow users to turn "browser" syncing option in the Do not sync browser policy. For this policy to work correctly, you must enable the Do not sync browser policy.
|
||||||
|
|
||||||
|
Related policy: DoNotSyncBrowserSetting
|
||||||
|
|
||||||
|
Value type is integer. Supported values:
|
||||||
|
|
||||||
|
- 0 - Allowed/turned on. Users can sync the browser settings.
|
||||||
|
- 1 (default) - Prevented/turned off.
|
||||||
|
|
||||||
|
This policy only works with the Experience/DoNotSyncBrowserSetting policy, and for this policy to work correctly, you must set Experience/DoNotSynBrowserSettings to 2 (enabled). By default, when you set this policy and the Experience/DoNotSyncBrowserSetting policy to 0 (disabled or not configured), the browser settings sync automatically. However, with this policy, you can prevent the syncing of browser settings and prevent users from turning on the Sync your Settings option. Additionally, you can prevent syncing the browser settings but give users a choice to turn on syncing.
|
||||||
|
|
||||||
|
If you want to prevent syncing of browser settings and prevent users from turning it on:
|
||||||
|
1. Set Experience/DoNotSyncBrowserSetting to 2 (enabled).
|
||||||
|
1. Set this policy (Experience/PreventUsersFromTurningOnBrowserSyncing) to 1 (enabled or not configured).
|
||||||
|
|
||||||
|
If you want to prevent syncing of browser settings but give users a choice to turn on syncing:
|
||||||
|
1. Set Experience/DoNotSyncBrowserSetting to 2 (enabled).
|
||||||
|
1. Set this policy (Experience/PreventUsersFromTurningOnBrowserSyncing) to 0 (disabled).
|
||||||
|
|
||||||
|
<!--/Description-->
|
||||||
|
<!--ADMXMapped-->
|
||||||
|
ADMX Info:
|
||||||
|
- GP English name: *Do not sync browser settings*
|
||||||
|
- GP name: *DisableWebBrowserSettingSync*
|
||||||
|
- GP element: *CheckBox_UserOverride*
|
||||||
|
- GP path: *Windows Components/Sync your settings*
|
||||||
|
- GP ADMX file name: *SettingSync.admx*
|
||||||
|
|
||||||
|
<!--/ADMXMapped-->
|
||||||
|
<!--SupportedValues-->
|
||||||
|
|
||||||
|
<!--/SupportedValues-->
|
||||||
|
<!--Example-->
|
||||||
|
|
||||||
|
<!--/Example-->
|
||||||
|
<!--Validation-->
|
||||||
|
**Validation procedure:**
|
||||||
|
|
||||||
|
Microsoft Edge on your PC:
|
||||||
|
1. Select More > Settings.
|
||||||
|
1. See if the setting is enabled or disabled based on your setting.
|
||||||
|
|
||||||
|
<!--/Validation-->
|
||||||
|
<!--/Policy-->
|
||||||
|
=======
|
||||||
|
>>>>>>> 785954ffa54220bce4c3bdaef580253b43197a5a
|
||||||
<hr/>
|
<hr/>
|
||||||
|
|
||||||
Footnote:
|
Footnote:
|
||||||
|
|||||||
@ -255,7 +255,14 @@ An optional flag to enable Always On mode. This will automatically connect the V
|
|||||||
|
|
||||||
> **Note** Always On only works for the active profile. The first profile provisioned that can be auto triggered will automatically be set as active.
|
> **Note** Always On only works for the active profile. The first profile provisioned that can be auto triggered will automatically be set as active.
|
||||||
|
|
||||||
|
Preserving user Always On preference
|
||||||
|
|
||||||
|
Windows has a feature to preserve a user’s AlwaysOn preference. In the event that a user manually unchecks the “Connect automatically” checkbox, Windows will remember this user preference for this profile name by adding the profile name to the value AutoTriggerDisabledProfilesList.
|
||||||
|
Should a management tool remove/add the same profile name back and set AlwaysOn to true, Windows will not check the box if the profile name exists in the below registry value in order to preserve user preference.
|
||||||
|
Key: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RasMan\Config
|
||||||
|
Value: AutoTriggerDisabledProfilesList
|
||||||
|
Type: REG_MULTI_SZ
|
||||||
|
|
||||||
|
|
||||||
Valid values:
|
Valid values:
|
||||||
|
|
||||||
|
|||||||
@ -7,7 +7,7 @@ ms.topic: article
|
|||||||
ms.prod: w10
|
ms.prod: w10
|
||||||
ms.technology: windows
|
ms.technology: windows
|
||||||
author: MariciaAlforque
|
author: MariciaAlforque
|
||||||
ms.date: 07/16/2018
|
ms.date: 07/25/2018
|
||||||
---
|
---
|
||||||
|
|
||||||
# WindowsLicensing CSP
|
# WindowsLicensing CSP
|
||||||
@ -164,7 +164,7 @@ The supported operation is Get.
|
|||||||
Interior node for managing S mode.
|
Interior node for managing S mode.
|
||||||
|
|
||||||
<a href="" id="smode-switchingpolicy"></a>**SMode/SwitchingPolicy**
|
<a href="" id="smode-switchingpolicy"></a>**SMode/SwitchingPolicy**
|
||||||
Added in Windows 10, next major version. Determines whether a consumer can switch the device out of S mode. This setting is only applicable to devices available in S mode.
|
Added in Windows 10, next major version. Determines whether a consumer can switch the device out of S mode. This setting is only applicable to devices available in S mode. For examples, see [Add S mode SwitchingPolicy](#smode-switchingpolicy-add), [Get S mode SwitchingPolicy](#smode-switchingpolicy-get), [Replace S mode SwitchingPolicy](#smode-switchingpolicy-replace) and [Delete S mode SwitchingPolicy](#smode-switchingpolicy-delete)
|
||||||
|
|
||||||
Value type is integer. Supported operations are Add, Get, Replace, and Delete.
|
Value type is integer. Supported operations are Add, Get, Replace, and Delete.
|
||||||
|
|
||||||
@ -173,12 +173,12 @@ Supported values:
|
|||||||
- 1 - User Blocked: The admin has blocked the user from switching their device out of S mode. Only the admin can switch the device out of S mode through the SMode/SwitchFromSMode node.
|
- 1 - User Blocked: The admin has blocked the user from switching their device out of S mode. Only the admin can switch the device out of S mode through the SMode/SwitchFromSMode node.
|
||||||
|
|
||||||
<a href="" id="smode-switchfromsmode"></a>**SMode/SwitchFromSMode**
|
<a href="" id="smode-switchfromsmode"></a>**SMode/SwitchFromSMode**
|
||||||
Added in Windows 10, next major version. Switches a device out of S mode if possible. Does not reboot.
|
Added in Windows 10, next major version. Switches a device out of S mode if possible. Does not reboot. For an example, see [Execute SwitchFromSMode](#smode-switchfromsmode-execute)
|
||||||
|
|
||||||
Supported operation is Execute.
|
Supported operation is Execute.
|
||||||
|
|
||||||
<a href="" id="smode-status"></a>**SMode/Status**
|
<a href="" id="smode-status"></a>**SMode/Status**
|
||||||
Added in Windows 10, next major version. Returns the status of the latest SwitchFromSMode set request.
|
Added in Windows 10, next major version. Returns the status of the latest SwitchFromSMode set request. For an example, see [Get S mode status](#smode-status-example)
|
||||||
|
|
||||||
Value type is integer. Supported operation is Get.
|
Value type is integer. Supported operation is Get.
|
||||||
|
|
||||||
@ -315,6 +315,140 @@ Value type is integer. Supported operation is Get.
|
|||||||
</SyncML>
|
</SyncML>
|
||||||
```
|
```
|
||||||
|
|
||||||
|
<a href="" id="smode-status-example"></a>**Get S mode status**
|
||||||
|
|
||||||
|
```
|
||||||
|
<SyncML xmlns="SYNCML:SYNCML1.2">
|
||||||
|
<SyncBody>
|
||||||
|
<Get>
|
||||||
|
<CmdID>6</CmdID>
|
||||||
|
<Item>
|
||||||
|
<Target>
|
||||||
|
<LocURI>
|
||||||
|
./Vendor/MSFT/WindowsLicensing/SMode/Status
|
||||||
|
</LocURI>
|
||||||
|
</Target>
|
||||||
|
</Item>
|
||||||
|
</Get>
|
||||||
|
<Final/>
|
||||||
|
</SyncBody>
|
||||||
|
</SyncML>
|
||||||
|
```
|
||||||
|
|
||||||
|
<a href="" id="smode-switchfromsmode-execute"></a>**Execute SwitchFromSMode**
|
||||||
|
|
||||||
|
```
|
||||||
|
<SyncML xmlns="SYNCML:SYNCML1.2">
|
||||||
|
<SyncBody>
|
||||||
|
<Exec>
|
||||||
|
<CmdID>5</CmdID>
|
||||||
|
<Item>
|
||||||
|
<Target>
|
||||||
|
<LocURI>
|
||||||
|
./Vendor/MSFT/WindowsLicensing/SMode/SwitchFromSMode
|
||||||
|
</LocURI>
|
||||||
|
</Target>
|
||||||
|
<Meta>
|
||||||
|
<Format xmlns="syncml:metinf">null</Format>
|
||||||
|
<Type>text/plain</Type>
|
||||||
|
</Meta>
|
||||||
|
<Data></Data>
|
||||||
|
</Item>
|
||||||
|
</Exec>
|
||||||
|
<Final/>
|
||||||
|
</SyncBody>
|
||||||
|
</SyncML>
|
||||||
|
```
|
||||||
|
|
||||||
|
<a href="" id="smode-switchingpolicy-add"></a>**Add S mode SwitchingPolicy**
|
||||||
|
|
||||||
|
```
|
||||||
|
<SyncML xmlns="SYNCML:SYNCML1.2">
|
||||||
|
<SyncBody>
|
||||||
|
<Add>
|
||||||
|
<CmdID>4</CmdID>
|
||||||
|
<Item>
|
||||||
|
<Target>
|
||||||
|
<LocURI>
|
||||||
|
./Vendor/MSFT/WindowsLicensing/SMode/SwitchingPolicy
|
||||||
|
</LocURI>
|
||||||
|
</Target>
|
||||||
|
<Meta>
|
||||||
|
<Format xmlns="syncml:metinf">int</Format>
|
||||||
|
<Type>text/plain</Type>
|
||||||
|
</Meta>
|
||||||
|
<Data>1</Data>
|
||||||
|
</Item>
|
||||||
|
</Add>
|
||||||
|
<Final/>
|
||||||
|
</SyncBody>
|
||||||
|
</SyncML>
|
||||||
|
```
|
||||||
|
|
||||||
|
<a href="" id="smode-switchingpolicy-get"></a>**Get S mode SwitchingPolicy**
|
||||||
|
|
||||||
|
```
|
||||||
|
<SyncML xmlns="SYNCML:SYNCML1.2">
|
||||||
|
<SyncBody>
|
||||||
|
<Get>
|
||||||
|
<CmdID>2</CmdID>
|
||||||
|
<Item>
|
||||||
|
<Target>
|
||||||
|
<LocURI>
|
||||||
|
./Vendor/MSFT/WindowsLicensing/SMode/SwitchingPolicy
|
||||||
|
</LocURI>
|
||||||
|
</Target>
|
||||||
|
</Item>
|
||||||
|
</Get>
|
||||||
|
<Final/>
|
||||||
|
</SyncBody>
|
||||||
|
</SyncML>
|
||||||
|
```
|
||||||
|
|
||||||
|
<a href="" id="smode-switchingpolicy-replace"></a>**Replace S mode SwitchingPolicy**
|
||||||
|
|
||||||
|
```
|
||||||
|
<SyncML xmlns="SYNCML:SYNCML1.2">
|
||||||
|
<SyncBody>
|
||||||
|
<Replace>
|
||||||
|
<CmdID>1</CmdID>
|
||||||
|
<Item>
|
||||||
|
<Target>
|
||||||
|
<LocURI>
|
||||||
|
./Vendor/MSFT/WindowsLicensing/SMode/SwitchingPolicy
|
||||||
|
</LocURI>
|
||||||
|
</Target>
|
||||||
|
<Meta>
|
||||||
|
<Format xmlns="syncml:metinf">int</Format>
|
||||||
|
<Type>text/plain</Type>
|
||||||
|
</Meta>
|
||||||
|
<Data>1</Data>
|
||||||
|
</Item>
|
||||||
|
</Replace>
|
||||||
|
<Final/>
|
||||||
|
</SyncBody>
|
||||||
|
</SyncML>
|
||||||
|
```
|
||||||
|
|
||||||
|
<a href="" id="smode-switchingpolicy-delete"></a>**Delete S mode SwitchingPolicy**
|
||||||
|
|
||||||
|
```
|
||||||
|
<SyncML xmlns="SYNCML:SYNCML1.2">
|
||||||
|
<SyncBody>
|
||||||
|
<Delete>
|
||||||
|
<CmdID>3</CmdID>
|
||||||
|
<Item>
|
||||||
|
<Target>
|
||||||
|
<LocURI>
|
||||||
|
./Vendor/MSFT/WindowsLicensing/SMode/SwitchingPolicy
|
||||||
|
</LocURI>
|
||||||
|
</Target>
|
||||||
|
</Item>
|
||||||
|
</Delete>
|
||||||
|
<Final/>
|
||||||
|
</SyncBody>
|
||||||
|
</SyncML>
|
||||||
|
```
|
||||||
## Related topics
|
## Related topics
|
||||||
|
|
||||||
|
|
||||||
|
|||||||
@ -70,7 +70,7 @@ To align with this new update delivery model, Windows 10 has three servicing cha
|
|||||||
### Naming changes
|
### Naming changes
|
||||||
|
|
||||||
As part of the alignment with Windows 10 and Office 365 ProPlus, we are adopting common terminology to make it as easy as possible to understand the servicing process. Going forward, these are the new terms we will be using:
|
As part of the alignment with Windows 10 and Office 365 ProPlus, we are adopting common terminology to make it as easy as possible to understand the servicing process. Going forward, these are the new terms we will be using:
|
||||||
* Semi-Annual Channel - We will be referreing to Current Branch (CB) as "Semi-Annual Channel (Targeted)", while Current Branch for Business (CBB) will simply be referred to as "Semi-Annual Channel".
|
* Semi-Annual Channel - We will be referring to Current Branch (CB) as "Semi-Annual Channel (Targeted)", while Current Branch for Business (CBB) will simply be referred to as "Semi-Annual Channel".
|
||||||
* Long-Term Servicing Channel - The Long-Term Servicing Branch (LTSB) will be referred to as Long-Term Servicing Channel (LTSC).
|
* Long-Term Servicing Channel - The Long-Term Servicing Branch (LTSB) will be referred to as Long-Term Servicing Channel (LTSC).
|
||||||
|
|
||||||
>[!IMPORTANT]
|
>[!IMPORTANT]
|
||||||
|
|||||||
@ -45,7 +45,7 @@ To change to a new TPM owner password, in TPM.msc, click **Change Owner Password
|
|||||||
|
|
||||||
## Use the TPM cmdlets
|
## Use the TPM cmdlets
|
||||||
|
|
||||||
You can manage the TPM using Windows PowerShell. For details, see [TPM Cmdlets in Windows PowerShell](http://technet.microsoft.com/library/jj603116.aspx).
|
You can manage the TPM using Windows PowerShell. For details, see [TPM Cmdlets in Windows PowerShell](https://docs.microsoft.com/en-us/powershell/module/trustedplatformmodule).
|
||||||
|
|
||||||
## Related topics
|
## Related topics
|
||||||
|
|
||||||
|
|||||||
@ -68,7 +68,7 @@ Some things that you can check on the device are:
|
|||||||
- Is SecureBoot supported and enabled?
|
- Is SecureBoot supported and enabled?
|
||||||
|
|
||||||
> [!NOTE]
|
> [!NOTE]
|
||||||
> The device must be running Windows 10 and it must support at least TPM 2.0.
|
> The device must be running Windows 10 and it must support at least TPM 2.0 in order to utilize Device Health Attestation.
|
||||||
|
|
||||||
## Supported versions
|
## Supported versions
|
||||||
|
|
||||||
|
|||||||
@ -58,6 +58,15 @@ When the trigger occurs, VPN tries to connect. If an error occurs or any user in
|
|||||||
|
|
||||||
When a device has multiple profiles with Always On triggers, the user can specify the active profile in **Settings** > **Network & Internet** > **VPN** > *VPN profile* by selecting the **Let apps automatically use this VPN connection** checkbox. By default, the first MDM-configured profile is marked as **Active**.
|
When a device has multiple profiles with Always On triggers, the user can specify the active profile in **Settings** > **Network & Internet** > **VPN** > *VPN profile* by selecting the **Let apps automatically use this VPN connection** checkbox. By default, the first MDM-configured profile is marked as **Active**.
|
||||||
|
|
||||||
|
Preserving user Always On preference
|
||||||
|
|
||||||
|
Windows has a feature to preserve a user’s AlwaysOn preference. In the event that a user manually unchecks the “Connect automatically” checkbox, Windows will remember this user preference for this profile name by adding the profile name to the value AutoTriggerDisabledProfilesList.
|
||||||
|
Should a management tool remove/add the same profile name back and set AlwaysOn to true, Windows will not check the box if the profile name exists in the below registry value in order to preserve user preference.
|
||||||
|
Key: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RasMan\Config
|
||||||
|
Value: AutoTriggerDisabledProfilesList
|
||||||
|
Type: REG_MULTI_SZ
|
||||||
|
|
||||||
|
|
||||||
## Trusted network detection
|
## Trusted network detection
|
||||||
|
|
||||||
This feature configures the VPN such that it would not get triggered if a user is on a trusted corporate network. The value of this setting is a list of DNS suffices. The VPN stack will look at the DNS suffix on the physical interface and if it matches any in the configured list and the network is private or provisioned by MDM, then VPN will not get triggered.
|
This feature configures the VPN such that it would not get triggered if a user is on a trusted corporate network. The value of this setting is a list of DNS suffices. The VPN stack will look at the DNS suffix on the physical interface and if it matches any in the configured list and the network is private or provisioned by MDM, then VPN will not get triggered.
|
||||||
|
|||||||
@ -8,7 +8,7 @@ ms.sitesec: library
|
|||||||
ms.pagetype: security
|
ms.pagetype: security
|
||||||
ms.localizationpriority: medium
|
ms.localizationpriority: medium
|
||||||
author: brianlic-msft
|
author: brianlic-msft
|
||||||
ms.date: 07/18/2018
|
ms.date: 07/27/2018
|
||||||
---
|
---
|
||||||
|
|
||||||
# BitLocker Management for Enterprises
|
# BitLocker Management for Enterprises
|
||||||
@ -21,19 +21,11 @@ Though much Windows BitLocker [documentation](bitlocker-overview.md) has been pu
|
|||||||
|
|
||||||
Companies that image their own computers using Microsoft System Center 2012 Configuration Manager SP1 (SCCM) or later can use an existing task sequence to [pre-provision BitLocker](https://technet.microsoft.com/library/hh846237.aspx#BKMK_PreProvisionBitLocker) encryption while in Windows Preinstallation Environment (WinPE) and can then [enable protection](https://technet.microsoft.com/library/hh846237.aspx#BKMK_EnableBitLocker). This can help ensure that computers are encrypted from the start, even before users receive them. As part of the imaging process, a company could also decide to use SCCM to pre-set any desired [BitLocker Group Policy](https://technet.microsoft.com/library/ee706521(v=ws.10).aspx).
|
Companies that image their own computers using Microsoft System Center 2012 Configuration Manager SP1 (SCCM) or later can use an existing task sequence to [pre-provision BitLocker](https://technet.microsoft.com/library/hh846237.aspx#BKMK_PreProvisionBitLocker) encryption while in Windows Preinstallation Environment (WinPE) and can then [enable protection](https://technet.microsoft.com/library/hh846237.aspx#BKMK_EnableBitLocker). This can help ensure that computers are encrypted from the start, even before users receive them. As part of the imaging process, a company could also decide to use SCCM to pre-set any desired [BitLocker Group Policy](https://technet.microsoft.com/library/ee706521(v=ws.10).aspx).
|
||||||
|
|
||||||
Enterprises can use [Microsoft BitLocker Administration and Management (MBAM)](https://docs.microsoft.com/microsoft-desktop-optimization-pack/mbam-v25/) to manage client computers with BitLocker that are domain-joined on-premises until [mainstream support ends in July 2019](https://support.microsoft.com/en-us/lifecycle/search?alpha=Microsoft%20BitLocker%20Administration%20and%20Monitoring%202.5%20Service%20Pack%201) or they can receive extended support until July 2024. Thus, over the next few years, a good strategy for enterprises will be to plan and move to cloud-based management for BitLocker. When moving to cloud-based management, following these steps could be helpful:
|
Enterprises can use [Microsoft BitLocker Administration and Management (MBAM)](https://docs.microsoft.com/microsoft-desktop-optimization-pack/mbam-v25/) to manage client computers with BitLocker that are domain-joined on-premises until [mainstream support ends in July 2019](https://support.microsoft.com/en-us/lifecycle/search?alpha=Microsoft%20BitLocker%20Administration%20and%20Monitoring%202.5%20Service%20Pack%201) or they can receive extended support until July 2024. Thus, over the next few years, a good strategy for enterprises will be to plan and move to cloud-based management for BitLocker. Refer to the [PowerShell examples](#powershell-examples) to see how to store recovery keys in Azure Active Directory (Azure AD).
|
||||||
|
|
||||||
1. Disable MBAM management and leave MBAM as only a database backup for the recovery key.
|
|
||||||
2. Join the computers to Azure Active Directory (Azure AD).
|
|
||||||
3. Use `Manage-bde -protectors -aadbackup` to backup the recovery key to Azure AD.
|
|
||||||
|
|
||||||
BitLocker recovery keys can be managed from Azure AD thereafter. The MBAM database does not need to be migrated.
|
|
||||||
|
|
||||||
Enterprises that choose to continue managing BitLocker on-premises after MBAM support ends can use the [BitLocker WMI provider class](https://msdn.microsoft.com/library/windows/desktop/aa376483) to create a custom management solution.
|
|
||||||
|
|
||||||
## Managing devices joined to Azure Active Directory
|
## Managing devices joined to Azure Active Directory
|
||||||
|
|
||||||
Devices joined to Azure Active Directory (Azure AD) are managed using Mobile Device Management (MDM) policy from an MDM solution such as [Microsoft Intune](https://www.microsoft.com/cloud-platform/microsoft-intune). BitLocker Device Encryption status can be queried from managed machines via the [Policy Configuration Settings Provider (CSP)](https://docs.microsoft.com/windows/client-management/mdm/policy-configuration-service-provider), which reports on whether BitLocker Device Encryption is enabled on the device. Compliance with BitLocker Device Encryption policy can be a requirement for [Conditional Access](https://www.microsoft.com/cloud-platform/conditional-access) to services like Exchange Online and SharePoint Online.
|
Devices joined to Azure AD are managed using Mobile Device Management (MDM) policy from an MDM solution such as [Microsoft Intune](https://www.microsoft.com/cloud-platform/microsoft-intune). BitLocker Device Encryption status can be queried from managed machines via the [Policy Configuration Settings Provider (CSP)](https://docs.microsoft.com/windows/client-management/mdm/policy-configuration-service-provider), which reports on whether BitLocker Device Encryption is enabled on the device. Compliance with BitLocker Device Encryption policy can be a requirement for [Conditional Access](https://www.microsoft.com/cloud-platform/conditional-access) to services like Exchange Online and SharePoint Online.
|
||||||
|
|
||||||
Starting with Windows 10 version 1703 (also known as the Windows Creators Update), the enablement of BitLocker can be triggered over MDM either by the [Policy CSP](https://docs.microsoft.com/windows/client-management/mdm/policy-configuration-service-provider) or the [BitLocker CSP](https://docs.microsoft.com/windows/client-management/mdm/bitlocker-csp). The BitLocker CSP adds policy options that go beyond ensuring that encryption has occurred, and is available on computers that run Windows 10 Business or Enterprise editions and on Windows Phones.
|
Starting with Windows 10 version 1703 (also known as the Windows Creators Update), the enablement of BitLocker can be triggered over MDM either by the [Policy CSP](https://docs.microsoft.com/windows/client-management/mdm/policy-configuration-service-provider) or the [BitLocker CSP](https://docs.microsoft.com/windows/client-management/mdm/bitlocker-csp). The BitLocker CSP adds policy options that go beyond ensuring that encryption has occurred, and is available on computers that run Windows 10 Business or Enterprise editions and on Windows Phones.
|
||||||
|
|
||||||
|
|||||||
@ -11,7 +11,7 @@ ms.pagetype: security
|
|||||||
ms.localizationpriority: medium
|
ms.localizationpriority: medium
|
||||||
author: andreabichsel
|
author: andreabichsel
|
||||||
ms.author: v-anbic
|
ms.author: v-anbic
|
||||||
ms.date: 07/10/2018
|
ms.date: 07/26/2018
|
||||||
---
|
---
|
||||||
|
|
||||||
|
|
||||||
@ -83,8 +83,8 @@ Location | Setting | Description | Default setting (if not configured)
|
|||||||
---|---|---|---
|
---|---|---|---
|
||||||
Scan | Specify the scan type to use for a scheduled scan | Quick scan
|
Scan | Specify the scan type to use for a scheduled scan | Quick scan
|
||||||
Scan | Specify the day of the week to run a scheduled scan | Specify the day (or never) to run a scan. | Never
|
Scan | Specify the day of the week to run a scheduled scan | Specify the day (or never) to run a scan. | Never
|
||||||
Scan | Specify the time of day to run a scheduled scan | Specify the number of minutes after midnight (for example, enter **60** for 1 am) | 2 am
|
Scan | Specify the time of day to run a scheduled scan | Specify the number of minutes after midnight (for example, enter **60** for 1 am). | 2 am
|
||||||
Root | Randomize scheduled task times | Randomize the start time of the scan to any interval plus or minus 30 minutes. This can be useful in VM or VDI deployments | Enabled
|
Root | Randomize scheduled task times | Randomize the start time of the scan to any interval from 0 to 4 hours, or to any interval plus or minus 30 minutes for non-Windows Defender scans. This can be useful in VM or VDI deployments. | Enabled
|
||||||
|
|
||||||
**Use PowerShell cmdlets to schedule scans:**
|
**Use PowerShell cmdlets to schedule scans:**
|
||||||
|
|
||||||
|
|||||||
@ -655,32 +655,32 @@ Microsoft recommends that you block the following Microsoft-signed applications
|
|||||||
<Deny ID="ID_DENY_D_554" FriendlyName="PowerShellShell 554" Hash="CBD19FDB6338DB02299A3F3FFBBEBF216B18013B3377D1D31E51491C0C5F074C"/>
|
<Deny ID="ID_DENY_D_554" FriendlyName="PowerShellShell 554" Hash="CBD19FDB6338DB02299A3F3FFBBEBF216B18013B3377D1D31E51491C0C5F074C"/>
|
||||||
<Deny ID="ID_DENY_D_555" FriendlyName="PowerShellShell 555" Hash="3A316A0A470744EB7D18339B76E786564D1E96130766A9895B2222C4066CE820"/>
|
<Deny ID="ID_DENY_D_555" FriendlyName="PowerShellShell 555" Hash="3A316A0A470744EB7D18339B76E786564D1E96130766A9895B2222C4066CE820"/>
|
||||||
<Deny ID="ID_DENY_D_556" FriendlyName="PowerShellShell 556" Hash="68A4A1E8F4E1B903408ECD24608659B390B9E7154EB380D94ADE7FEB5EA470E7"/>
|
<Deny ID="ID_DENY_D_556" FriendlyName="PowerShellShell 556" Hash="68A4A1E8F4E1B903408ECD24608659B390B9E7154EB380D94ADE7FEB5EA470E7"/>
|
||||||
<Deny ID="ID_DENY_D_557" FriendlyName="PowerShellShell 556" Hash="45F948AF27F4E698A8546027717901B5F70368EE"/>
|
<Deny ID="ID_DENY_D_557" FriendlyName="PowerShellShell 557" Hash="45F948AF27F4E698A8546027717901B5F70368EE"/>
|
||||||
<Deny ID="ID_DENY_D_558" FriendlyName="PowerShellShell 556" Hash="2D63C337961C6CF2660C5DB906D9070CA38BCE828584874680EC4F5097B82E30"/>
|
<Deny ID="ID_DENY_D_558" FriendlyName="PowerShellShell 558" Hash="2D63C337961C6CF2660C5DB906D9070CA38BCE828584874680EC4F5097B82E30"/>
|
||||||
<Deny ID="ID_DENY_D_559" FriendlyName="PowerShellShell 556" Hash="DA4CD4B0158B774CE55721718F77ED91E3A42EB3"/>
|
<Deny ID="ID_DENY_D_559" FriendlyName="PowerShellShell 559" Hash="DA4CD4B0158B774CE55721718F77ED91E3A42EB3"/>
|
||||||
<Deny ID="ID_DENY_D_560" FriendlyName="PowerShellShell 556" Hash="7D181BB7A4A0755FF687CCE34949FC6BD6FBC377E6D4883698E8B45DCCBEA140"/>
|
<Deny ID="ID_DENY_D_560" FriendlyName="PowerShellShell 560" Hash="7D181BB7A4A0755FF687CCE34949FC6BD6FBC377E6D4883698E8B45DCCBEA140"/>
|
||||||
<Deny ID="ID_DENY_D_561" FriendlyName="PowerShellShell 556" Hash="C67D7B12BBFFD5FBD15FBD892955EA48E6F4B408"/>
|
<Deny ID="ID_DENY_D_561" FriendlyName="PowerShellShell 561" Hash="C67D7B12BBFFD5FBD15FBD892955EA48E6F4B408"/>
|
||||||
<Deny ID="ID_DENY_D_562" FriendlyName="PowerShellShell 556" Hash="1DCAD0BBCC036B85875CC0BAF1B65027933624C1A29BE336C79BCDB00FD5467A"/>
|
<Deny ID="ID_DENY_D_562" FriendlyName="PowerShellShell 562" Hash="1DCAD0BBCC036B85875CC0BAF1B65027933624C1A29BE336C79BCDB00FD5467A"/>
|
||||||
<Deny ID="ID_DENY_D_563" FriendlyName="PowerShellShell 556" Hash="7D8CAB8D9663926E29CB810B42C5152E8A1E947E"/>
|
<Deny ID="ID_DENY_D_563" FriendlyName="PowerShellShell 563" Hash="7D8CAB8D9663926E29CB810B42C5152E8A1E947E"/>
|
||||||
<Deny ID="ID_DENY_D_564" FriendlyName="PowerShellShell 556" Hash="2E0203370E6E5437CE2CE1C20895919F806B4E5FEBCBE31F16CB06FC5934F010"/>
|
<Deny ID="ID_DENY_D_564" FriendlyName="PowerShellShell 564" Hash="2E0203370E6E5437CE2CE1C20895919F806B4E5FEBCBE31F16CB06FC5934F010"/>
|
||||||
<Deny ID="ID_DENY_D_565" FriendlyName="PowerShellShell 556" Hash="20E7156E348912C20D35BD4BE2D52C996BF5535E"/>
|
<Deny ID="ID_DENY_D_565" FriendlyName="PowerShellShell 565" Hash="20E7156E348912C20D35BD4BE2D52C996BF5535E"/>
|
||||||
<Deny ID="ID_DENY_D_566" FriendlyName="PowerShellShell 556" Hash="EB26078544BDAA34733AA660A1A2ADE98523DAFD9D58B3995919C0E524F2FFC3"/>
|
<Deny ID="ID_DENY_D_566" FriendlyName="PowerShellShell 566" Hash="EB26078544BDAA34733AA660A1A2ADE98523DAFD9D58B3995919C0E524F2FFC3"/>
|
||||||
<Deny ID="ID_DENY_D_567" FriendlyName="PowerShellShell 556" Hash="B9DD16FC0D02EA34613B086307C9DBEAC30546AF"/>
|
<Deny ID="ID_DENY_D_567" FriendlyName="PowerShellShell 567" Hash="B9DD16FC0D02EA34613B086307C9DBEAC30546AF"/>
|
||||||
<Deny ID="ID_DENY_D_568" FriendlyName="PowerShellShell 556" Hash="DE5B012C4DC3FE3DD432AF9339C36EFB8D54E8864493EA2BA151F0ADBF3E338C"/>
|
<Deny ID="ID_DENY_D_568" FriendlyName="PowerShellShell 568" Hash="DE5B012C4DC3FE3DD432AF9339C36EFB8D54E8864493EA2BA151F0ADBF3E338C"/>
|
||||||
<Deny ID="ID_DENY_D_569" FriendlyName="PowerShellShell 556" Hash="6397AB5D664CDB84A867BC7E22ED0789060C6276"/>
|
<Deny ID="ID_DENY_D_569" FriendlyName="PowerShellShell 569" Hash="6397AB5D664CDB84A867BC7E22ED0789060C6276"/>
|
||||||
<Deny ID="ID_DENY_D_570" FriendlyName="PowerShellShell 556" Hash="B660F6CA0788DA18375602537095C378990E8229B11B57B092AC8A550E9C61E8"/>
|
<Deny ID="ID_DENY_D_570" FriendlyName="PowerShellShell 570" Hash="B660F6CA0788DA18375602537095C378990E8229B11B57B092AC8A550E9C61E8"/>
|
||||||
<Deny ID="ID_DENY_D_571" FriendlyName="PowerShellShell 556" Hash="3BF717645AC3986AAD0B4EA9D196B18D05199DA9"/>
|
<Deny ID="ID_DENY_D_571" FriendlyName="PowerShellShell 571" Hash="3BF717645AC3986AAD0B4EA9D196B18D05199DA9"/>
|
||||||
<Deny ID="ID_DENY_D_572" FriendlyName="PowerShellShell 556" Hash="364C227F9E57C72F9BFA652B8C1DE738AB4747D0DB68A7B899CA3EE51D802439"/>
|
<Deny ID="ID_DENY_D_572" FriendlyName="PowerShellShell 572" Hash="364C227F9E57C72F9BFA652B8C1DE738AB4747D0DB68A7B899CA3EE51D802439"/>
|
||||||
<Deny ID="ID_DENY_D_573" FriendlyName="PowerShellShell 556" Hash="3A1B06680F119C03C60D12BAC682853ABE430D21"/>
|
<Deny ID="ID_DENY_D_573" FriendlyName="PowerShellShell 573" Hash="3A1B06680F119C03C60D12BAC682853ABE430D21"/>
|
||||||
<Deny ID="ID_DENY_D_574" FriendlyName="PowerShellShell 556" Hash="850759BCE4B66997CF84E84683A2C1980D4B498821A8AB9C3568EB298B824AE3"/>
|
<Deny ID="ID_DENY_D_574" FriendlyName="PowerShellShell 574" Hash="850759BCE4B66997CF84E84683A2C1980D4B498821A8AB9C3568EB298B824AE3"/>
|
||||||
<Deny ID="ID_DENY_D_575" FriendlyName="PowerShellShell 556" Hash="654C54AA3F2C74FBEB55B961FB1924A7B2737E61"/>
|
<Deny ID="ID_DENY_D_575" FriendlyName="PowerShellShell 575" Hash="654C54AA3F2C74FBEB55B961FB1924A7B2737E61"/>
|
||||||
<Deny ID="ID_DENY_D_576" FriendlyName="PowerShellShell 556" Hash="B7EA81960C6EECFD2FF385890F158F5B1CB3D1E100C7157AB161B3D23DCA0389"/>
|
<Deny ID="ID_DENY_D_576" FriendlyName="PowerShellShell 576" Hash="B7EA81960C6EECFD2FF385890F158F5B1CB3D1E100C7157AB161B3D23DCA0389"/>
|
||||||
<Deny ID="ID_DENY_D_577" FriendlyName="PowerShellShell 556" Hash="496F793112B6BCF4B6EA16E8B2F8C3F5C1FEEB52"/>
|
<Deny ID="ID_DENY_D_577" FriendlyName="PowerShellShell 577" Hash="496F793112B6BCF4B6EA16E8B2F8C3F5C1FEEB52"/>
|
||||||
<Deny ID="ID_DENY_D_578" FriendlyName="PowerShellShell 556" Hash="E430485B577774825CEF53E5125B618A2608F7BE3657BB28383E9A34FCA162FA"/>
|
<Deny ID="ID_DENY_D_578" FriendlyName="PowerShellShell 578" Hash="E430485B577774825CEF53E5125B618A2608F7BE3657BB28383E9A34FCA162FA"/>
|
||||||
<Deny ID="ID_DENY_D_579" FriendlyName="PowerShellShell 556" Hash="6EA8CEEA0D2879989854E8C86CECA26EF79F7B19"/>
|
<Deny ID="ID_DENY_D_579" FriendlyName="PowerShellShell 579" Hash="6EA8CEEA0D2879989854E8C86CECA26EF79F7B19"/>
|
||||||
<Deny ID="ID_DENY_D_580" FriendlyName="PowerShellShell 556" Hash="8838FE3D8E2505F3D3D8B98C64739115838A0B443BBBBFB487342F1EE7801360"/>
|
<Deny ID="ID_DENY_D_580" FriendlyName="PowerShellShell 580" Hash="8838FE3D8E2505F3D3D8B98C64739115838A0B443BBBBFB487342F1EE7801360"/>
|
||||||
<Deny ID="ID_DENY_D_581" FriendlyName="PowerShellShell 556" Hash="28C5E53DE197E872F7E4772BF40F728F56FE3ACC"/>
|
<Deny ID="ID_DENY_D_581" FriendlyName="PowerShellShell 581" Hash="28C5E53DE197E872F7E4772BF40F728F56FE3ACC"/>
|
||||||
<Deny ID="ID_DENY_D_582" FriendlyName="PowerShellShell 556" Hash="3493DAEC6EC03E56ECC4A15432C750735F75F9CB38D8779C7783B4DA956BF037"/>
|
<Deny ID="ID_DENY_D_582" FriendlyName="PowerShellShell 582" Hash="3493DAEC6EC03E56ECC4A15432C750735F75F9CB38D8779C7783B4DA956BF037"/>
|
||||||
|
|
||||||
<!-- pubprn.vbs
|
<!-- pubprn.vbs
|
||||||
-->
|
-->
|
||||||
|
|||||||
Loading…
x
Reference in New Issue
Block a user