diff --git a/.acrolinx-config.edn b/.acrolinx-config.edn
index a3a07ef4f2..64354d7a64 100644
--- a/.acrolinx-config.edn
+++ b/.acrolinx-config.edn
@@ -1,4 +1,4 @@
-{:allowed-branchname-matches ["master"]
+{:allowed-branchname-matches ["master" "main"]
:allowed-filename-matches ["windows/"]
:targets
@@ -47,12 +47,12 @@ For more information about the exception criteria and exception process, see [Mi
Click the scorecard links for each article to review the Acrolinx feedback on grammar, spelling, punctuation, writing style, and terminology:
-| Article | Score | Issues | Scorecard | Processed |
-| ------- | ----- | ------ | --------- | --------- |
+| Article | Score | Issues | Spelling issues | Scorecard | Processed |
+| ------- | ----- | ------ | ------ | --------- | --------- |
"
:template-change
- "| ${s/file} | ${acrolinx/qualityscore} | ${acrolinx/flags/issues} | [link](${acrolinx/scorecard}) | ${s/status} |
+ "| ${s/file} | ${acrolinx/qualityscore} | ${acrolinx/flags/issues} | ${acrolinx/flags/spelling} | [link](${acrolinx/scorecard}) | ${s/status} |
"
:template-footer
diff --git a/.openpublishing.redirection.json b/.openpublishing.redirection.json
index 359a00110d..acb9196fbb 100644
--- a/.openpublishing.redirection.json
+++ b/.openpublishing.redirection.json
@@ -1,5 +1,60 @@
{
"redirections": [
+ {
+ "source_path": "windows/client-management/mdm/maps-ddf-file.md",
+ "redirect_url": "https://support.microsoft.com/windows/windows-10-mobile-end-of-support-faq-8c2dd1cf-a571-00f0-0881-bb83926d05c5",
+ "redirect_document_id": false
+ },
+ {
+ "source_path": "windows/client-management/mdm/maps-csp.md",
+ "redirect_url": "https://support.microsoft.com/windows/windows-10-mobile-end-of-support-faq-8c2dd1cf-a571-00f0-0881-bb83926d05c5",
+ "redirect_document_id": false
+ },
+ {
+ "source_path": "windows/client-management/mdm/hotspot-csp.md",
+ "redirect_url": "https://support.microsoft.com/windows/windows-10-mobile-end-of-support-faq-8c2dd1cf-a571-00f0-0881-bb83926d05c5",
+ "redirect_document_id": false
+ },
+ {
+ "source_path": "windows/client-management/mdm/filesystem-csp.md",
+ "redirect_url": "https://support.microsoft.com/windows/windows-10-mobile-end-of-support-faq-8c2dd1cf-a571-00f0-0881-bb83926d05c5",
+ "redirect_document_id": false
+ },
+ {
+ "source_path": "windows/client-management/mdm/EnterpriseExtFileSystem-ddf.md",
+ "redirect_url": "https://support.microsoft.com/windows/windows-10-mobile-end-of-support-faq-8c2dd1cf-a571-00f0-0881-bb83926d05c5",
+ "redirect_document_id": false
+ },
+ {
+ "source_path": "windows/client-management/mdm/EnterpriseExtFileSystem-csp.md",
+ "redirect_url": "https://support.microsoft.com/windows/windows-10-mobile-end-of-support-faq-8c2dd1cf-a571-00f0-0881-bb83926d05c5",
+ "redirect_document_id": false
+ },
+ {
+ "source_path": "windows/client-management/mdm/enterpriseext-ddf.md",
+ "redirect_url": "https://support.microsoft.com/windows/windows-10-mobile-end-of-support-faq-8c2dd1cf-a571-00f0-0881-bb83926d05c5",
+ "redirect_document_id": false
+ },
+ {
+ "source_path": "windows/client-management/mdm/enterpriseext-csp.md",
+ "redirect_url": "https://support.microsoft.com/windows/windows-10-mobile-end-of-support-faq-8c2dd1cf-a571-00f0-0881-bb83926d05c5",
+ "redirect_document_id": false
+ },
+ {
+ "source_path": "windows/client-management/mdm/enterpriseassignedaccess-xsd.md",
+ "redirect_url": "https://support.microsoft.com/windows/windows-10-mobile-end-of-support-faq-8c2dd1cf-a571-00f0-0881-bb83926d05c5",
+ "redirect_document_id": false
+ },
+ {
+ "source_path": "windows/client-management/mdm/enterpriseassignedaccess-ddf.md",
+ "redirect_url": "https://support.microsoft.com/windows/windows-10-mobile-end-of-support-faq-8c2dd1cf-a571-00f0-0881-bb83926d05c5",
+ "redirect_document_id": false
+ },
+ {
+ "source_path": "windows/client-management/mdm/enterpriseassignedaccess-csp.md",
+ "redirect_url": "https://support.microsoft.com/windows/windows-10-mobile-end-of-support-faq-8c2dd1cf-a571-00f0-0881-bb83926d05c5",
+ "redirect_document_id": false
+ },
{
"source_path": "windows/client-management/mdm/enable-offline-updates-for-windows-embedded-8-1-handheld-devices-to-windows-10.md",
"redirect_url": "https://support.microsoft.com/windows/windows-phone-8-1-end-of-support-faq-7f1ef0aa-0aaf-0747-3724-5c44456778a3",
@@ -16411,7 +16466,7 @@
"redirect_document_id": false
},
{
- "source_path": "windows/security/threat-protection/microsoft-defender-atp/commercial-gov.md.md",
+ "source_path": "windows/security/threat-protection/microsoft-defender-atp/commercial-gov.md",
"redirect_url": "/microsoft-365/security/defender-endpoint/gov",
"redirect_document_id": false
},
@@ -19114,46 +19169,6 @@
"source_path": "windows/security/identity-protection/change-history-for-access-protection.md",
"redirect_url": "/windows/security/",
"redirect_document_id": false
- },
- {
- "source_path": "windows/deployment/deploy-windows-mdt/build-a-distributed-environment-for-windows-10-deployment.md",
- "redirect_url": "/windows/deployment/deploy-windows-mdt/build-a-distributed-environment-for-windows-deployment",
- "redirect_document_id": false
- },
- {
- "source_path": "windows/deployment/deploy-windows-mdt/create-a-windows-10-reference-image.md",
- "redirect_url": "/windows/deployment/deploy-windows-mdt/create-a-windows-11-reference-image",
- "redirect_document_id": false
- },
- {
- "source_path": "windows/deployment/deploy-windows-mdt/deploy-a-windows-10-image-using-mdt.md",
- "redirect_url": "/windows/deployment/deploy-windows-mdt/deploy-a-windows-11-image-using-mdt",
- "redirect_document_id": false
- },
- {
- "source_path": "windows/deployment/deploy-windows-mdt/refresh-a-windows-7-computer-with-windows-10.md",
- "redirect_url": "/windows/deployment/deploy-windows-mdt/refresh-a-windows-10-computer-with-windows-11",
- "redirect_document_id": false
- },
- {
- "source_path": "windows/deployment/deploy-windows-mdt/replace-a-windows-7-computer-with-a-windows-10-computer.md",
- "redirect_url": "/windows/deployment/deploy-windows-mdt/replace-a-windows-10-computer-with-a-windows-11-computer",
- "redirect_document_id": false
- },
- {
- "source_path": "windows/deployment/deploy-windows-mdt/simulate-a-windows-10-deployment-in-a-test-environment.md",
- "redirect_url": "/windows/deployment/deploy-windows-mdt/simulate-a-windows-11-deployment-in-a-test-environment",
- "redirect_document_id": false
- },
- {
- "source_path": "windows/deployment/deploy-windows-mdt/upgrade-to-windows-10-with-the-microsoft-deployment-toolkit.md",
- "redirect_url": "/windows/deployment/deploy-windows-mdt/upgrade-to-windows-11-with-the-microsoft-deployment-toolkit",
- "redirect_document_id": false
- },
- {
- "source_path": "windows/deployment/deploy-windows-mdt/use-the-mdt-database-to-stage-windows-10-deployment-information.md",
- "redirect_url": "/windows/deployment/deploy-windows-mdt/use-the-mdt-database-to-stage-windows-11-deployment-information",
- "redirect_document_id": false
},
{
"source_path": "windows/deploy-windows-cm/upgrade-to-windows-with-configuraton-manager.md",
diff --git a/browsers/edge/group-policies/index.yml b/browsers/edge/group-policies/index.yml
index 0b2aef014b..0f970282ed 100644
--- a/browsers/edge/group-policies/index.yml
+++ b/browsers/edge/group-policies/index.yml
@@ -9,7 +9,7 @@ metadata:
keywords: Microsoft Edge Legacy, Windows 10
ms.localizationpriority: medium
ms.prod: edge
- author: shortpatti
+ author: dougeby
ms.author: pashort
ms.topic: landing-page
ms.devlang: na
diff --git a/browsers/edge/index.yml b/browsers/edge/index.yml
index 04b23cd56e..accbb0e679 100644
--- a/browsers/edge/index.yml
+++ b/browsers/edge/index.yml
@@ -11,7 +11,7 @@ metadata:
ms.localizationpriority: medium
ms.topic: landing-page # Required
ms.collection: collection # Optional; Remove if no collection is used.
- author: shortpatti #Required; your GitHub user alias, with correct capitalization.
+ author: dougeby #Required; your GitHub user alias, with correct capitalization.
ms.author: pashort #Required; microsoft alias of author; optional team alias.
ms.date: 07/07/2020 #Required; mm/dd/yyyy format.
diff --git a/browsers/edge/microsoft-edge-faq.yml b/browsers/edge/microsoft-edge-faq.yml
index 96038bd4ce..bfb48a3544 100644
--- a/browsers/edge/microsoft-edge-faq.yml
+++ b/browsers/edge/microsoft-edge-faq.yml
@@ -62,7 +62,7 @@ sections:
- question: Will Internet Explorer 11 continue to receive updates?
answer: |
- We're committed to keeping Internet Explorer a supported, reliable, and safe browser. Internet Explorer is still a component of Windows and follows the support lifecycle of the OS on which it's installed. For details, see [Lifecycle FAQ - Internet Explorer](https://support.microsoft.com/help/17454/). While we continue to support and update Internet Explorer, the latest features and platform updates will only be available in Microsoft Edge.
+ We're committed to keeping Internet Explorer a supported, reliable, and safe browser. Internet Explorer is still a component of Windows and follows the support lifecycle of the OS on which it's installed. For details, see [Lifecycle FAQ - Internet Explorer](/lifecycle/faq/internet-explorer-microsoft-edge). While we continue to support and update Internet Explorer, the latest features and platform updates will only be available in Microsoft Edge.
- question: How do I find out which version of Microsoft Edge I have?
answer: |
diff --git a/browsers/enterprise-mode/collect-data-using-enterprise-site-discovery.md b/browsers/enterprise-mode/collect-data-using-enterprise-site-discovery.md
index d4f9600d8b..10d59733dd 100644
--- a/browsers/enterprise-mode/collect-data-using-enterprise-site-discovery.md
+++ b/browsers/enterprise-mode/collect-data-using-enterprise-site-discovery.md
@@ -201,68 +201,32 @@ You can use Group Policy to finish setting up Enterprise Site Discovery. If you
You can use both the WMI and XML settings individually or together:
**To turn off Enterprise Site Discovery**
-
-
-
Setting name
-
Option
-
-
-
Turn on Site Discovery WMI output
-
Off
-
-
-
Turn on Site Discovery XML output
-
Blank
-
-
+
+|Setting name |Option |
+|---------|---------|
+|Turn on Site Discovery WMI output | Off |
+|Turn on Site Discovery XML output | Blank |
**Turn on WMI recording only**
-
-
-
Setting name
-
Option
-
-
-
Turn on Site Discovery WMI output
-
On
-
-
-
Turn on Site Discovery XML output
-
Blank
-
-
+
+|Setting name |Option |
+|---------|---------|
+|Turn on Site Discovery WMI output | On |
+|Turn on Site Discovery XML output | Blank |
**To turn on XML recording only**
-
-
-
Setting name
-
Option
-
-
-
Turn on Site Discovery WMI output
-
Off
-
-
-
Turn on Site Discovery XML output
-
XML file path
-
-
+
+|Setting name |Option |
+|---------|---------|
+|Turn on Site Discovery WMI output | Off |
+|Turn on Site Discovery XML output | XML file path |
**To turn on both WMI and XML recording**
-
-
-
Setting name
-
Option
-
-
-
Turn on Site Discovery WMI output
-
On
-
-
-
Turn on Site Discovery XML output
-
XML file path
-
-
+
+|Setting name |Option |
+|---------|---------|
+|Turn on Site Discovery WMI output | On |
+|Turn on Site Discovery XML output | XML file path |
## Use Configuration Manager to collect your data
After you’ve collected your data, you’ll need to get the local files off of your employee’s computers. To do this, use the hardware inventory process in Configuration Manager, using one of these options:
diff --git a/browsers/enterprise-mode/enterprise-mode-schema-version-1-guidance.md b/browsers/enterprise-mode/enterprise-mode-schema-version-1-guidance.md
index 634fd7cd91..d04fbf79b9 100644
--- a/browsers/enterprise-mode/enterprise-mode-schema-version-1-guidance.md
+++ b/browsers/enterprise-mode/enterprise-mode-schema-version-1-guidance.md
@@ -60,132 +60,21 @@ Make sure that you don't specify a protocol when adding your URLs. Using a URL l
### Schema elements
This table includes the elements used by the Enterprise Mode schema.
-
-
The parent node for the Enterprise Mode section of the schema. All <domain> entries will have either IE8 Enterprise Mode or IE7 Enterprise Mode applied.
-
The parent node for the document mode section of the section. All <domain> entries will get IE5 - IE11 document modes applied. If there's a <domain> element in the <docMode> section that uses the same value as a <domain> element in the <emie> section, the <emie> element is applied.
-
A unique entry added for each site you want to put on the Enterprise Mode site list. The first <domain> element will overrule any additional <domain> elements that use the same value for the section. You can use port numbers for this element.
-
A unique entry added for each path under a domain you want to put on the Enterprise Mode site list. The <path> element is a child of the <domain> element. Additionally, the first <path> element will overrule any additional <path> elements in the schema section.
-
-Where https://fabrikam.com doesn't use IE8 Enterprise Mode, but https://fabrikam.com/products does.
-
Internet Explorer 11 and Microsoft Edge
-
-
+|Element |Description |Supported browser |
+|---------|---------|---------|
+|<rules> | Root node for the schema. **Example**
<rules version="205"> <emie> <domain>contoso.com</domain> </emie> </rules> |Internet Explorer 11 and Microsoft Edge |
+|<emie> |The parent node for the Enterprise Mode section of the schema. All <domain> entries will have either IE8 Enterprise Mode or IE7 Enterprise Mode applied. **Example**
<rules version="205"> <emie> <domain>[10.122.34.99]:8080</domain> </emie> </rules> | Internet Explorer 11 and Microsoft Edge |
+|<docMode> |The parent node for the document mode section of the section. All <domain> entries will get IE5 - IE11 document modes applied. If there's a <domain> element in the docMode section that uses the same value as a <domain> element in the emie section, the emie element is applied. **Example**
<rules version="205"> <docmode> <domain docMode="7">contoso.com</domain> </docmode> </rules> |Internet Explorer 11 |
+|<domain> |A unique entry added for each site you want to put on the Enterprise Mode site list. The first <domain> element will overrule any additional <domain> elements that use the same value for the section. You can use port numbers for this element. **Example**
<emie> <domain>contoso.com:8080</domain> </emie> |Internet Explorer 11 and Microsoft Edge |
+|<path> |A unique entry added for each path under a domain you want to put on the Enterprise Mode site list. The <path> element is a child of the <domain> element. Additionally, the first <path> element will overrule any additional <path> elements in the schema section. **Example**
Where [https://fabrikam.com](https://fabrikam.com) doesn't use IE8 Enterprise Mode, but [https://fabrikam.com/products](https://fabrikam.com/products) does. |Internet Explorer 11 and Microsoft Edge |
### Schema attributes
This table includes the attributes used by the Enterprise Mode schema.
-
-
-
-
-
Attribute
-
Description
-
Supported browser
-
-
-
-
-
<version>
-
Specifies the version of the Enterprise Mode Site List. This attribute is supported for the <rules> element.
-
Internet Explorer 11 and Microsoft Edge
-
-
-
<exclude>
-
Specifies the domain or path that is excluded from getting the behavior applied. This attribute is supported on the <domain> and <path> elements.
-
+|Attribute|Description|Supported browser|
+|--- |--- |--- |
+|<version>|Specifies the version of the Enterprise Mode Site List. This attribute is supported for the <rules> element.|Internet Explorer 11 and Microsoft Edge|
+|<exclude>|Specifies the domain or path that is excluded from getting the behavior applied. This attribute is supported on the and elements. **Example**
Where [https://fabrikam.com](https://fabrikam.com) doesn't use IE8 Enterprise Mode, but [https://fabrikam.com/products](https://fabrikam.com/products) does.|Internet Explorer 11 and Microsoft Edge|
+|<docMode>|Specifies the document mode to apply. This attribute is only supported on <domain> or <path>elements in the <docMode> section. **Example**
<docMode> <domain exclude="false">fabrikam.com <path docMode="7">/products</path> </domain> </docMode>|Internet Explorer 11|
### Using Enterprise Mode and document mode together
If you want to use both Enterprise Mode and document mode together, you need to be aware that <emie> entries override <docMode> entries for the same domain.
diff --git a/browsers/enterprise-mode/enterprise-mode-schema-version-2-guidance.md b/browsers/enterprise-mode/enterprise-mode-schema-version-2-guidance.md
index 70694a3df2..fcdaa18eee 100644
--- a/browsers/enterprise-mode/enterprise-mode-schema-version-2-guidance.md
+++ b/browsers/enterprise-mode/enterprise-mode-schema-version-2-guidance.md
@@ -92,194 +92,32 @@ Make sure that you don't specify a protocol when adding your URLs. Using a URL l
### Updated schema elements
This table includes the elements used by the v.2 version of the Enterprise Mode schema.
-
-
-
-
Element
-
Description
-
Supported browser
-
-
-
-
-
<site-list>
-
A new root node with this text is using the updated v.2 version of the schema. It replaces <rules>.
-
A unique entry added for each site you want to put on the Enterprise Mode site list. The first <site> element will overrule any additional <site> elements that use the same value for the <url> element.
-
IE8Enterprise. Loads the site in IE8 Enterprise Mode. This element is required for sites included in the EmIE section of the v.1 schema and is needed to load in IE8 Enterprise Mode.
-
IE7Enterprise. Loads the site in IE7 Enterprise Mode. This element is required for sites included in the EmIE section of the v.1 schema and is needed to load in IE7 Enterprise Mode.
Important This tag replaces the combination of the `"forceCompatView"="true"` attribute and the list of sites specified in the EmIE section of the v.1 version of the schema.
-
IE[x]. Where [x] is the document mode number into which the site loads.
-
Default or not specified. Loads the site using the default compatibility mode for the page. In this situation, X-UA-compatible meta tags or HTTP headers are honored.
-
-
Internet Explorer 11
-
-
-
<open-in>
-
A child element that controls what browser is used for sites. This element supports the Open in IE11 or Open in Microsoft Edge experiences, for devices running Windows 10.
-
IE11. Opens the site in IE11, regardless of which browser is opened by the employee.
-
MSEdge. Opens the site in Microsoft Edge, regardless of which browser is opened by the employee.
-
None or not specified. Opens in whatever browser the employee chooses.
-
-
Internet Explorer 11 and Microsoft Edge
-
-
+
+|Element |Description |Supported browser |
+|---------|---------|---------|
+|<site-list> |A new root node with this text is using the updated v.2 version of the schema. It replaces <rules>. **Example**
| Internet Explorer 11 and Microsoft Edge |
+|<site> |A unique entry added for each site you want to put on the Enterprise Mode site list. The first <site> element will overrule any additional <site> elements that use the same value for the <url> element. **Example**
You can also use the self-closing version, <url="contoso.com" />, which also sets:
<compat-mode>default</compat-mode>
<open-in>none</open-in>
| Internet Explorer 11 and Microsoft Edge |
+|<compat-mode> |A child element that controls what compatibility setting is used for specific sites or domains. This element is only supported in IE11. **Example**
**IE8Enterprise.** Loads the site in IE8 Enterprise Mode. This element is required for sites included in the **EmIE** section of the v.1 schema and is needed to load in IE8 Enterprise Mode.
**IE7Enterprise.** Loads the site in IE7 Enterprise Mode. This element is required for sites included in the **EmIE** section of the v.1 schema and is needed to load in IE7 Enterprise Mode
**Important** This tag replaces the combination of the `"forceCompatView"="true"` attribute and the list of sites specified in the EmIE section of the v.1 version of the schema.
**IE[x]**. Where [x] is the document mode number into which the site loads.
**Default or not specified.** Loads the site using the default compatibility mode for the page. In this situation, X-UA-compatible meta tags or HTTP headers are honored.
|Internet Explorer 11 |
+|<open-in> |A child element that controls what browser is used for sites. This element supports the **Open in IE11** or **Open in Microsoft Edge** experiences, for devices running Windows 10. **Examples**
IE11. Opens the site in IE11, regardless of which browser is opened by the employee.
MSEdge. Opens the site in Microsoft Edge, regardless of which browser is opened by the employee.
None or not specified. Opens in whatever browser the employee chooses.
| Internet Explorer 11 and Microsoft Edge |
### Updated schema attributes
The <url> attribute, as part of the <site> element in the v.2 version of the schema, replaces the <domain> element from the v.1 version of the schema.
-
-
-
-
Attribute
-
Description
-
Supported browser
-
-
-
-
-
allow-redirect
-
A boolean attribute of the <open-in> element that controls the behavior for redirected sites. Setting this attribute to "true" indicates that the site will open in IE11 or Microsoft Edge even if the site is navigated to as part of a HTTP or meta refresh redirection chain. Omitting the attribute is equivalent to "false" (sites in redirect chain will not open in another browser).
-
-In this example, if https://contoso.com/travel is encountered in a redirect chain in Microsoft Edge, it will be opened in Internet Explorer.
-
Internet Explorer 11 and Microsoft Edge
-
-
-
version
-
Specifies the version of the Enterprise Mode Site List. This attribute is supported for the <site-list> element.
-
Internet Explorer 11 and Microsoft Edge
-
-
-
url
-
Specifies the URL (and port number using standard port conventions) to which the child elements apply. The URL can be a domain, sub-domain, or any path URL.
- Note
-Make sure that you don't specify a protocol. Using <site url="contoso.com"> applies to both https://contoso.com and https://contoso.com.
-
-In this example, going to https://contoso.com:8080 using Microsoft Edge, causes the site to open in IE11 and load in IE8 Enterprise Mode.
-
Internet Explorer 11 and Microsoft Edge
-
-
+|Attribute|Description|Supported browser|
+|---------|---------|---------|
+|allow-redirect|A boolean attribute of the element that controls the behavior for redirected sites. Setting this attribute to "true" indicates that the site will open in IE11 or Microsoft Edge even if the site is navigated to as part of a HTTP or meta refresh redirection chain. Omitting the attribute is equivalent to "false" (sites in redirect chain will not open in another browser). **Example**
In this example, if [https://contoso.com/travel](https://contoso.com/travel) is encountered in a redirect chain in Microsoft Edge, it will be opened in Internet Explorer.| Internet Explorer 11 and Microsoft Edge|
+|version |Specifies the version of the Enterprise Mode Site List. This attribute is supported for the <site-list> element. | Internet Explorer 11 and Microsoft Edge|
+|url|Specifies the URL (and port number using standard port conventions) to which the child elements apply. The URL can be a domain, sub-domain, or any path URL. **Note** Make sure that you don't specify a protocol. Using <site url="contoso.com"> applies to both [https://contoso.com](https://contoso.com) and [https://contoso.com](https://contoso.com). **Example**
In this example, going to [https://contoso.com:8080](https://contoso.com:8080) using Microsoft Edge, causes the site to open in IE11 and load in IE8 Enterprise Mode. | Internet Explorer 11 and Microsoft Edge|
### Deprecated attributes
These v.1 version schema attributes have been deprecated in the v.2 version of the schema:
-
-
-
-
Deprecated attribute
-
New attribute
-
Replacement example
-
-
-
-
-
<forceCompatView>
-
<compat-mode>
-
Replace <forceCompatView="true"> with <compat-mode>IE7Enterprise</compat-mode>
-
-
-
<docMode>
-
<compat-mode>
-
Replace <docMode="IE5"> with <compat-mode>IE5</compat-mode>
-
-
-
<doNotTransition>
-
<open-in>
-
Replace <doNotTransition="true"> with <open-in>none</open-in>
<site url="contoso.com/about"> <compat-mode>IE7Enterprise</compat-mode> </site>|
While the old, replaced attributes aren't supported in the v.2 version of the schema, they'll continue to work in the v.1 version of the schema. If, however, you're using the v.2 version of the schema and these attributes are still there, the v.2 version schema takes precedence. We don’t recommend combining the two schemas, and instead recommend that you move to the v.2 version of the schema to take advantage of the new features.
diff --git a/browsers/internet-explorer/ie11-deploy-guide/collect-data-using-enterprise-site-discovery.md b/browsers/internet-explorer/ie11-deploy-guide/collect-data-using-enterprise-site-discovery.md
index 65fbb8eaaf..8cef068687 100644
--- a/browsers/internet-explorer/ie11-deploy-guide/collect-data-using-enterprise-site-discovery.md
+++ b/browsers/internet-explorer/ie11-deploy-guide/collect-data-using-enterprise-site-discovery.md
@@ -63,17 +63,17 @@ Data is collected on the configuration characteristics of IE and the sites it br
|Data point |IE11 |IE10 |IE9 |IE8 |Description |
|------------------------|-----|-----|-----|-----|------------------------------------------------------------------------|
-|URL | X | X | X | X |URL of the browsed site, including any parameters included in the URL. |
-|Domain | X | X | X | X |Top-level domain of the browsed site. |
-|ActiveX GUID | X | X | X | X |GUID of the ActiveX controls loaded by the site. |
-|Document mode | X | X | X | X |Document mode used by IE for a site, based on page characteristics. |
-|Document mode reason | X | X | | |The reason why a document mode was set by IE. |
-|Browser state reason | X | X | | |Additional information about why the browser is in its current state. Also called, browser mode. |
-|Hang count | X | X | X | X |Number of visits to the URL when the browser hung. |
-|Crash count | X | X | X | X |Number of visits to the URL when the browser crashed. |
-|Most recent navigation failure (and count) | X | X | X | X |Description of the most recent navigation failure (like, a 404 bad request or 500 internal server error) and the number of times it happened. |
-|Number of visits | X | X | X | X |Number of times a site has been visited. |
-|Zone | X | X | X | X |Zone used by IE to browse sites, based on browser settings. |
+|URL | ✔️ | ✔️ | ✔️ | ✔️ |URL of the browsed site, including any parameters included in the URL. |
+|Domain | ✔️ | ✔️ | ✔️ | ✔️ |Top-level domain of the browsed site. |
+|ActiveX GUID | ✔️ | ✔️ | ✔️ | ✔️ |GUID of the ActiveX controls loaded by the site. |
+|Document mode | ✔️ | ✔️ | ✔️ | ✔️ |Document mode used by IE for a site, based on page characteristics. |
+|Document mode reason | ✔️ | ✔️ | | |The reason why a document mode was set by IE. |
+|Browser state reason | ✔️ | ✔️ | | |Additional information about why the browser is in its current state. Also called, browser mode. |
+|Hang count | ✔️ | ✔️ | ✔️ | ✔️ |Number of visits to the URL when the browser hung. |
+|Crash count | ✔️ | ✔️ | ✔️ | ✔️ |Number of visits to the URL when the browser crashed. |
+|Most recent navigation failure (and count) | ✔️ | ✔️ | ✔️ | ✔️ |Description of the most recent navigation failure (like, a 404 bad request or 500 internal server error) and the number of times it happened. |
+|Number of visits | ✔️ | ✔️ | ✔️ | ✔️ |Number of times a site has been visited. |
+|Zone | ✔️ | ✔️ | ✔️ | ✔️ |Zone used by IE to browse sites, based on browser settings. |
>**Important** By default, IE doesn’t collect this data; you have to turn this feature on if you want to use it. After you turn on this feature, data is collected on all sites visited by IE, except during InPrivate sessions. Additionally, the data collection process is silent, so there’s no notification to the employee. Therefore, you must get consent from the employee before you start collecting info. You must also make sure that using this feature complies with all applicable local laws and regulatory requirements.
@@ -205,68 +205,32 @@ You can use Group Policy to finish setting up Enterprise Site Discovery. If you
You can use both the WMI and XML settings individually or together:
**To turn off Enterprise Site Discovery**
-
-
-
Setting name
-
Option
-
-
-
Turn on Site Discovery WMI output
-
Off
-
-
-
Turn on Site Discovery XML output
-
Blank
-
-
+
+|Setting name|Option|
+|--- |--- |
+|Turn on Site Discovery WMI output|Off|
+|Turn on Site Discovery XML output|Blank|
**Turn on WMI recording only**
-
-
-
Setting name
-
Option
-
-
-
Turn on Site Discovery WMI output
-
On
-
-
-
Turn on Site Discovery XML output
-
Blank
-
-
+
+|Setting name|Option|
+|--- |--- |
+|Turn on Site Discovery WMI output|On|
+|Turn on Site Discovery XML output|Blank|
**To turn on XML recording only**
-
-
-
Setting name
-
Option
-
-
-
Turn on Site Discovery WMI output
-
Off
-
-
-
Turn on Site Discovery XML output
-
XML file path
-
-
+
+|Setting name|Option|
+|--- |--- |
+|Turn on Site Discovery WMI output|Off|
+|Turn on Site Discovery XML output|XML file path|
-To turn on both WMI and XML recording
-
-
-
Setting name
-
Option
-
-
-
Turn on Site Discovery WMI output
-
On
-
-
-
Turn on Site Discovery XML output
-
XML file path
-
-
+**To turn on both WMI and XML recording**
+
+|Setting name|Option|
+|--- |--- |
+|Turn on Site Discovery WMI output|On|
+|Turn on Site Discovery XML output|XML file path|
## Use Configuration Manager to collect your data
After you’ve collected your data, you’ll need to get the local files off of your employee’s computers. To do this, use the hardware inventory process in Configuration Manager, using one of these options:
diff --git a/browsers/internet-explorer/ie11-deploy-guide/enterprise-mode-schema-version-1-guidance.md b/browsers/internet-explorer/ie11-deploy-guide/enterprise-mode-schema-version-1-guidance.md
index 6832c2797b..8ee8fbf055 100644
--- a/browsers/internet-explorer/ie11-deploy-guide/enterprise-mode-schema-version-1-guidance.md
+++ b/browsers/internet-explorer/ie11-deploy-guide/enterprise-mode-schema-version-1-guidance.md
@@ -65,162 +65,24 @@ The following is an example of the Enterprise Mode schema v.1. This schema can r
### Schema elements
This table includes the elements used by the Enterprise Mode schema.
-
The parent node for the Enterprise Mode section of the schema. All <domain> entries will have either IE8 Enterprise Mode or IE7 Enterprise Mode applied.
-
The parent node for the document mode section of the section. All <domain> entries will get IE5 - IE11 document modes applied. If there's a <domain> element in the <docMode> section that uses the same value as a <domain> element in the <emie> section, the <emie> element is applied.
-
A unique entry added for each site you want to put on the Enterprise Mode site list. The first <domain> element will overrule any additional <domain> elements that use the same value for the section. You can use port numbers for this element.
-
A unique entry added for each path under a domain you want to put on the Enterprise Mode site list. The <path> element is a child of the <domain> element. Additionally, the first <path> element will overrule any additional <path> elements in the schema section.
-
+|Element |Description |Supported browser |
+|---------|---------|---------|
+|<rules> | Root node for the schema. **Example**
<rules version="205"> <emie> <domain>contoso.com</domain> </emie> </rules> |Internet Explorer 11 and Microsoft Edge |
+|<emie> |The parent node for the Enterprise Mode section of the schema. All <domain> entries will have either IE8 Enterprise Mode or IE7 Enterprise Mode applied. **Example**
<rules version="205"> <emie> <domain>[10.122.34.99]:8080</domain> </emie> </rules> | Internet Explorer 11 and Microsoft Edge |
+|<docMode> |The parent node for the document mode section of the section. All <domain> entries will get IE5 - IE11 document modes applied. If there's a <domain> element in the docMode section that uses the same value as a <domain> element in the emie section, the emie element is applied. **Example**
<rules version="205"> <docmode> <domain docMode="7">contoso.com</domain> </docmode> </rules> |Internet Explorer 11 |
+|<domain> |A unique entry added for each site you want to put on the Enterprise Mode site list. The first <domain> element will overrule any additional <domain> elements that use the same value for the section. You can use port numbers for this element. **Example**
<emie> <domain>contoso.com:8080</domain> </emie> |Internet Explorer 11 and Microsoft Edge |
+|<path> |A unique entry added for each path under a domain you want to put on the Enterprise Mode site list. The <path> element is a child of the <domain> element. Additionally, the first <path> element will overrule any additional <path> elements in the schema section. **Example**
Where [https://fabrikam.com](https://fabrikam.com) doesn't use IE8 Enterprise Mode, but [https://fabrikam.com/products](https://fabrikam.com/products) does. |Internet Explorer 11 and Microsoft Edge |
### Schema attributes
This table includes the attributes used by the Enterprise Mode schema.
-
-
-
-
Attribute
-
Description
-
Supported browser
-
-
-
-
-
version
-
Specifies the version of the Enterprise Mode Site List. This attribute is supported for the <rules> element.
-
Internet Explorer 11 and Microsoft Edge
-
-
-
exclude
-
Specifies the domain or path excluded from applying Enterprise Mode. This attribute is only supported on the <domain> and <path> elements in the <emie> section. If this attribute is absent, it defaults to false.
-
-
Specifies that the page should load in the current browser, otherwise it will open in IE11. This attribute is supported on all <domain> or <path> elements. If this attribute is absent, it defaults to false.
-
-
Specifies that the page should load in IE7 document mode (Compat View). This attribute is only supported on <domain> or <path> elements in the <emie> section. If the page is also configured to load in Enterprise Mode, it will load in IE7 Enterprise Mode. Otherwise (exclude="true"), it will load in IE11's IE7 document mode. If this attribute is absent, it defaults to false.
-
-
+|Attribute|Description|Supported browser|
+|--- |--- |--- |
+|version|Specifies the version of the Enterprise Mode Site List. This attribute is supported for the <rules> element.|Internet Explorer 11 and Microsoft Edge|
+|exclude|Specifies the domain or path that is excluded from getting the behavior applied. This attribute is supported on the <domain> and <path> elements. **Example**
Where [https://fabrikam.com](https://fabrikam.com) doesn't use IE8 Enterprise Mode, but [https://fabrikam.com/products](https://fabrikam.com/products) does.|Internet Explorer 11 and Microsoft Edge|
+|docMode|Specifies the document mode to apply. This attribute is only supported on <domain> or <path>elements in the <docMode> section. **Example**
<docMode> <domain exclude="false">fabrikam.com <path docMode="9">/products</path> </domain> </docMode>|Internet Explorer 11|
+|doNotTransition| Specifies that the page should load in the current browser, otherwise it will open in IE11. This attribute is supported on all <domain> or <path> elements. If this attribute is absent, it defaults to false. **Example**
Where [https://fabrikam.com](https://fabrikam.com) opens in the IE11 browser, but [https://fabrikam.com/products](https://fabrikam.com/products) loads in the current browser (eg. Microsoft Edge)|Internet Explorer 11 and Microsoft Edge|
+|forceCompatView|Specifies that the page should load in IE7 document mode (Compat View). This attribute is only supported on <domain> or <path> elements in the <emie> section. If the page is also configured to load in Enterprise Mode, it will load in IE7 Enterprise Mode. Otherwise (exclude="true"), it will load in IE11's IE7 document mode. If this attribute is absent, it defaults to false. **Example**
Where [https://fabrikam.com](https://fabrikam.com) does not use Enterprise Mode, but [https://fabrikam.com/products](https://fabrikam.com/products) uses IE7 Enterprise Mode.|Internet Explorer 11|
### Using Enterprise Mode and document mode together
If you want to use both Enterprise Mode and document mode together, you need to be aware that <emie> entries override <docMode> entries for the same domain.
diff --git a/browsers/internet-explorer/ie11-deploy-guide/enterprise-mode-schema-version-2-guidance.md b/browsers/internet-explorer/ie11-deploy-guide/enterprise-mode-schema-version-2-guidance.md
index 299c6c093f..825646b237 100644
--- a/browsers/internet-explorer/ie11-deploy-guide/enterprise-mode-schema-version-2-guidance.md
+++ b/browsers/internet-explorer/ie11-deploy-guide/enterprise-mode-schema-version-2-guidance.md
@@ -97,197 +97,31 @@ The following is an example of the v.2 version of the Enterprise Mode schema.
### Updated schema elements
This table includes the elements used by the v.2 version of the Enterprise Mode schema.
-
-
-
-
Element
-
Description
-
Supported browser
-
-
-
-
-
<site-list>
-
A new root node with this text is using the updated v.2 version of the schema. It replaces <rules>.
-
A unique entry added for each site you want to put on the Enterprise Mode site list. The first <site> element will overrule any additional <site> elements that use the same value for the <url> element.
-
IE8Enterprise. Loads the site in IE8 Enterprise Mode. This element is required for sites included in the EmIE section of the v.1 schema and is needed to load in IE8 Enterprise Mode.
-
IE7Enterprise. Loads the site in IE7 Enterprise Mode. This element is required for sites included in the EmIE section of the v.1 schema and is needed to load in IE7 Enterprise Mode.
Important This tag replaces the combination of the "forceCompatView"="true" attribute and the list of sites specified in the EmIE section of the v.1 version of the schema.
-
IE[x]. Where [x] is the document mode number into which the site loads.
-
Default or not specified. Loads the site using the default compatibility mode for the page. In this situation, X-UA-compatible meta tags or HTTP headers are honored.
-
-
Internet Explorer 11
-
-
-
<open-in>
-
A child element that controls what browser is used for sites. This element supports the Open in IE11 or Open in Microsoft Edge experiences, for devices running Windows 10.
-
IE11. Opens the site in IE11, regardless of which browser is opened by the employee.
-
MSEdge. Opens the site in Microsoft Edge, regardless of which browser is opened by the employee.
-
None or not specified. Opens in whatever browser the employee chooses.
-
-
Internet Explorer 11 and Microsoft Edge
-
-
+|Element |Description |Supported browser |
+|---------|---------|---------|
+|<site-list> |A new root node with this text is using the updated v.2 version of the schema. It replaces <rules>. **Example**
| Internet Explorer 11 and Microsoft Edge |
+|<site> |A unique entry added for each site you want to put on the Enterprise Mode site list. The first <site> element will overrule any additional <site> elements that use the same value for the <url> element. **Example**
You can also use the self-closing version, <url="contoso.com" />, which also sets:
<compat-mode>default</compat-mode>
<open-in>none</open-in>
| Internet Explorer 11 and Microsoft Edge |
+|<compat-mode> |A child element that controls what compatibility setting is used for specific sites or domains. This element is only supported in IE11. **Example**
**IE8Enterprise.** Loads the site in IE8 Enterprise Mode. This element is required for sites included in the **EmIE** section of the v.1 schema and is needed to load in IE8 Enterprise Mode.
**IE7Enterprise.** Loads the site in IE7 Enterprise Mode. This element is required for sites included in the **EmIE** section of the v.1 schema and is needed to load in IE7 Enterprise Mode
**Important** This tag replaces the combination of the `"forceCompatView"="true"` attribute and the list of sites specified in the EmIE section of the v.1 version of the schema.
**IE[x]**. Where [x] is the document mode number into which the site loads.
**Default or not specified.** Loads the site using the default compatibility mode for the page. In this situation, X-UA-compatible meta tags or HTTP headers are honored.
|Internet Explorer 11 |
+|<open-in> |A child element that controls what browser is used for sites. This element supports the **Open in IE11** or **Open in Microsoft Edge** experiences, for devices running Windows 10. **Examples**
IE11. Opens the site in IE11, regardless of which browser is opened by the employee.
MSEdge. Opens the site in Microsoft Edge, regardless of which browser is opened by the employee.
None or not specified. Opens in whatever browser the employee chooses.
| Internet Explorer 11 and Microsoft Edge |
### Updated schema attributes
The <url> attribute, as part of the <site> element in the v.2 version of the schema, replaces the <domain> element from the v.1 version of the schema.
-
-
-
-
Attribute
-
Description
-
Supported browser
-
-
-
-
-
allow-redirect
-
A boolean attribute of the <open-in> element that controls the behavior for redirected sites. Setting this attribute to "true" indicates that the site will open in IE11 or Microsoft Edge even if the site is navigated to as part of a HTTP or meta refresh redirection chain. Omitting the attribute is equivalent to "false" (sites in redirect chain will not open in another browser).
-
-In this example, if https://contoso.com/travel is encountered in a redirect chain in Microsoft Edge, it will be opened in Internet Explorer.
-
Internet Explorer 11 and Microsoft Edge
-
-
-
version
-
Specifies the version of the Enterprise Mode Site List. This attribute is supported for the <site-list> element.
-
Internet Explorer 11 and Microsoft Edge
-
-
-
url
-
Specifies the URL (and port number using standard port conventions) to which the child elements apply. The URL can be a domain, sub-domain, or any path URL.
- Note
-Make sure that you don't specify a protocol. Using <site url="contoso.com"> applies to both http://contoso.com and https://contoso.com.
-
-In this example, going to https://contoso.com:8080 using Microsoft Edge, causes the site to open in IE11 and load in IE8 Enterprise Mode.
-
Internet Explorer 11 and Microsoft Edge
-
-
+|Attribute|Description|Supported browser|
+|---------|---------|---------|
+|allow-redirect|A boolean attribute of the <open-in> element that controls the behavior for redirected sites. Setting this attribute to "true" indicates that the site will open in IE11 or Microsoft Edge even if the site is navigated to as part of a HTTP or meta refresh redirection chain. Omitting the attribute is equivalent to "false" (sites in redirect chain will not open in another browser). **Example**
In this example, if [https://contoso.com/travel](https://contoso.com/travel) is encountered in a redirect chain in Microsoft Edge, it will be opened in Internet Explorer.
| Internet Explorer 11 and Microsoft Edge|
+|version |Specifies the version of the Enterprise Mode Site List. This attribute is supported for the <site-list> element. | Internet Explorer 11 and Microsoft Edge|
+|url|Specifies the URL (and port number using standard port conventions) to which the child elements apply. The URL can be a domain, sub-domain, or any path URL. **Note** Make sure that you don't specify a protocol. Using <site url="contoso.com"> applies to both [https://contoso.com](https://contoso.com) and [https://contoso.com](https://contoso.com). **Example**
In this example, going to [https://contoso.com:8080](https://contoso.com:8080) using Microsoft Edge, causes the site to open in IE11 and load in IE8 Enterprise Mode. | Internet Explorer 11 and Microsoft Edge|
### Deprecated attributes
These v.1 version schema attributes have been deprecated in the v.2 version of the schema:
-
-
-
-
Deprecated element/attribute
-
New element
-
Replacement example
-
-
-
-
-
forceCompatView
-
<compat-mode>
-
Replace forceCompatView="true" with <compat-mode>IE7Enterprise</compat-mode>
-
-
-
docMode
-
<compat-mode>
-
Replace docMode="IE5" with <compat-mode>IE5</compat-mode>
-
-
-
doNotTransition
-
<open-in>
-
Replace doNotTransition="true" with <open-in>none</open-in>
<site url="contoso.com/about"> <compat-mode>IE7Enterprise</compat-mode> <open-in>IE11</open-in> </site>|
While the old, replaced attributes aren't supported in the v.2 version of the schema, they'll continue to work in the v.1 version of the schema. If, however, you're using the v.2 version of the schema and these attributes are still there, the v.2 version schema takes precedence. We don’t recommend combining the two schemas, and instead recommend that you move to the v.2 version of the schema to take advantage of the new features.
diff --git a/browsers/internet-explorer/ie11-deploy-guide/img-ie11-docmode-lg.md b/browsers/internet-explorer/ie11-deploy-guide/img-ie11-docmode-lg.md
index a285c99103..ca1542a952 100644
--- a/browsers/internet-explorer/ie11-deploy-guide/img-ie11-docmode-lg.md
+++ b/browsers/internet-explorer/ie11-deploy-guide/img-ie11-docmode-lg.md
@@ -14,9 +14,7 @@ ms.author: dansimp
[!INCLUDE [Microsoft 365 workloads end of support for IE11](../includes/microsoft-365-ie-end-of-support.md)]
-Return to: [Deprecated document modes and Internet Explorer 11](deprecated-document-modes.md)
+Return to: [Deprecated document modes and Internet Explorer 11](deprecated-document-modes.md)
-
-
-
+:::image type="content" source="images/docmode-decisions-lg.png" alt-text="Full-sized flowchart detailing how document modes are chosen in IE11" lightbox="images/docmode-decisions-lg.png":::
diff --git a/browsers/internet-explorer/ie11-deploy-guide/manage-ie11-overview.md b/browsers/internet-explorer/ie11-deploy-guide/manage-ie11-overview.md
index 66b29a20c4..58a2d5298b 100644
--- a/browsers/internet-explorer/ie11-deploy-guide/manage-ie11-overview.md
+++ b/browsers/internet-explorer/ie11-deploy-guide/manage-ie11-overview.md
@@ -36,11 +36,4 @@ Use the topics in this section to learn about how to auto detect your settings,
|------|------------|
|[Auto detect settings Internet Explorer 11](auto-detect-settings-for-ie11.md) |Guidance about how to update your automatic detection of DHCP and DNS servers. |
|[Auto configuration settings for Internet Explorer 11](auto-configuration-settings-for-ie11.md) |Guidance about how to add, update and lock your auto configuration settings. |
-|[Auto proxy configuration settings for Internet Explorer 11](auto-proxy-configuration-settings-for-ie11.md) |Guidance about how to add, update, and lock your auto-proxy settings. |
-
-
-
-
-
-
-
+|[Auto proxy configuration settings for Internet Explorer 11](auto-proxy-configuration-settings-for-ie11.md) |Guidance about how to add, update, and lock your auto-proxy settings. |
diff --git a/browsers/internet-explorer/ie11-faq/faq-for-it-pros-ie11.yml b/browsers/internet-explorer/ie11-faq/faq-for-it-pros-ie11.yml
index b025aa3409..4f545f92d9 100644
--- a/browsers/internet-explorer/ie11-faq/faq-for-it-pros-ie11.yml
+++ b/browsers/internet-explorer/ie11-faq/faq-for-it-pros-ie11.yml
@@ -24,9 +24,6 @@ summary: |
sections:
- name: Ignored
questions:
- - question: |
- Frequently Asked Questions
- answer: |
- question: |
What operating system does IE11 run on?
answer: |
@@ -250,4 +247,4 @@ additionalContent: |
- [Microsoft Edge - Deployment Guide for IT Pros](/microsoft-edge/deploy/)
- [Internet Explorer 11 (IE11) - Deployment Guide for IT Pros](../ie11-deploy-guide/index.md)
- - [Internet Explorer Administration Kit 11 (IEAK 11) - Administrator's Guide](../ie11-ieak/index.md)
\ No newline at end of file
+ - [Internet Explorer Administration Kit 11 (IEAK 11) - Administrator's Guide](../ie11-ieak/index.md)
diff --git a/browsers/internet-explorer/internet-explorer.yml b/browsers/internet-explorer/internet-explorer.yml
index 6aa0242523..68b6be4505 100644
--- a/browsers/internet-explorer/internet-explorer.yml
+++ b/browsers/internet-explorer/internet-explorer.yml
@@ -31,7 +31,7 @@ landingContent:
- text: Use Enterprise Mode to improve compatibility
url: /microsoft-edge/deploy/emie-to-improve-compatibility
- text: Lifecycle FAQ - Internet Explorer
- url: https://support.microsoft.com/help/17454/lifecycle-faq-internet-explorer
+ url: /lifecycle/faq/internet-explorer-microsoft-edge
- linkListType: download
links:
- text: Download IE11 with Windows 10
@@ -123,7 +123,7 @@ landingContent:
- text: Group Policy preferences for IE11
url: ./ie11-deploy-guide/group-policy-preferences-and-ie11.md
- text: Configure Group Policy preferences
- url: https://support.microsoft.com/help/2898604/how-to-configure-group-policy-preference-settings-for-internet-explorer-11-in-windows-8.1-or-windows-server-2012-r2
+ url: /troubleshoot/browsers/how-to-configure-group-policy-preference-settings
- text: Blocked out-of-date ActiveX controls
url: ./ie11-deploy-guide/blocked-out-of-date-activex-controls.md
- text: Out-of-date ActiveX control blocking
diff --git a/browsers/internet-explorer/kb-support/ie-edge-faqs.yml b/browsers/internet-explorer/kb-support/ie-edge-faqs.yml
index 50862d688d..f7f8874d78 100644
--- a/browsers/internet-explorer/kb-support/ie-edge-faqs.yml
+++ b/browsers/internet-explorer/kb-support/ie-edge-faqs.yml
@@ -148,7 +148,7 @@ sections:
- question: |
Where to find Internet Explorer security zones registry entries
answer: |
- Most of the Internet Zone entries can be found in [Internet Explorer security zones registry entries for advanced users](https://support.microsoft.com/help/182569/internet-explorer-security-zones-registry-entries-for-advanced-users).
+ Most of the Internet Zone entries can be found in [Internet Explorer security zones registry entries for advanced users](/troubleshoot/browsers/ie-security-zones-registry-entries).
This article was written for Internet Explorer 6 but is still applicable to Internet Explorer 11.
@@ -193,7 +193,7 @@ sections:
answer: |
Internet Explorer 11 is the last major version of Internet Explorer. Internet Explorer 11 will continue receiving security updates and technical support for the lifecycle of the version of Windows on which it is installed.
- For more information, see [Lifecycle FAQ — Internet Explorer and Edge](https://support.microsoft.com/help/17454/lifecycle-faq-internet-explorer).
+ For more information, see [Lifecycle FAQ — Internet Explorer and Edge](/lifecycle/faq/internet-explorer-microsoft-edge).
- question: |
How to configure TLS (SSL) for Internet Explorer
diff --git a/education/includes/education-content-updates.md b/education/includes/education-content-updates.md
index 226a90d32e..ba848193c2 100644
--- a/education/includes/education-content-updates.md
+++ b/education/includes/education-content-updates.md
@@ -2,11 +2,22 @@
-## Week of October 25, 2021
+## Week of November 29, 2021
| Published On |Topic title | Change |
|------|------------|--------|
-| 10/28/2021 | [Deploy Windows 10 in a school district (Windows 10)](/education/windows/deploy-windows-10-in-a-school-district) | modified |
-| 10/28/2021 | [Deploy Windows 10 in a school (Windows 10)](/education/windows/deploy-windows-10-in-a-school) | modified |
-| 10/28/2021 | [Windows 10 for Education (Windows 10)](/education/windows/index) | modified |
+| 11/29/2021 | [What is Windows 11 SE](/education/windows/windows-11-se-overview) | added |
+| 11/29/2021 | [Windows 11 SE settings list](/education/windows/windows-11-se-settings-list) | added |
+
+
+## Week of November 15, 2021
+
+
+| Published On |Topic title | Change |
+|------|------------|--------|
+| 11/16/2021 | [Chromebook migration guide (Windows 10)](/education/windows/chromebook-migration-guide) | modified |
+| 11/16/2021 | [Deploy Windows 10 in a school district (Windows 10)](/education/windows/deploy-windows-10-in-a-school-district) | modified |
+| 11/18/2021 | [Deploy Windows 10 in a school district (Windows 10)](/education/windows/deploy-windows-10-in-a-school-district) | modified |
+| 11/18/2021 | [Deploy Windows 10 in a school (Windows 10)](/education/windows/deploy-windows-10-in-a-school) | modified |
+| 11/18/2021 | [For IT administrators get Minecraft Education Edition](/education/windows/school-get-minecraft) | modified |
diff --git a/education/itadmins.yml b/education/itadmins.yml
index 849c8bb478..2847e59b71 100644
--- a/education/itadmins.yml
+++ b/education/itadmins.yml
@@ -79,7 +79,7 @@ productDirectory:
- url: https://techcommunity.microsoft.com/t5/Azure-Information-Protection/Azure-Information-Protection-Deployment-Acceleration-Guide/ba-p/334423
text: Azure information protection deployment acceleration guide
- url: /cloud-app-security/getting-started-with-cloud-app-security
- text: Microsoft Cloud app security
+ text: Microsoft Defender for Cloud Apps
- url: /microsoft-365/compliance/create-test-tune-dlp-policy
text: Office 365 data loss prevention
- url: /microsoft-365/compliance/
@@ -117,4 +117,4 @@ productDirectory:
- url: https://support.office.com/en-us/education
text: Education help center
- url: https://support.office.com/en-us/article/teacher-training-packs-7a9ee74a-8fe5-43d3-bc23-a55185896921
- text: Teacher training packs
\ No newline at end of file
+ text: Teacher training packs
diff --git a/education/windows/TOC.yml b/education/windows/TOC.yml
index 6571e40f23..3a592b8263 100644
--- a/education/windows/TOC.yml
+++ b/education/windows/TOC.yml
@@ -1,3 +1,9 @@
+- name: Windows 11 SE for Education
+ items:
+ - name: Overview
+ href: windows-11-se-overview.md
+ - name: Settings and CSP list
+ href: windows-11-se-settings-list.md
- name: Windows 10 for Education
href: index.md
items:
diff --git a/education/windows/chromebook-migration-guide.md b/education/windows/chromebook-migration-guide.md
index 2fb2324ddc..66569c4674 100644
--- a/education/windows/chromebook-migration-guide.md
+++ b/education/windows/chromebook-migration-guide.md
@@ -126,96 +126,23 @@ Table 2 lists the settings in the Device Management node in the Google Admin Con
Table 2. Settings in the Device Management node in the Google Admin Console
-
-
-
-
-
-
-
-
Section
-
Settings
-
-
-
-
-
Network
-
These settings configure the network connections for Chromebook devices and include the following settings categories:
-
-
Wi-Fi. Configures the Wi-Fi connections that are available. The Windows devices will need these configuration settings to connect to the same Wi-Fi networks.
-
Ethernet. Configures authentication for secured, wired Ethernet connections (802.1x). The Windows devices will need these configuration settings to connect to the network.
-
VPN. Specifies the VPN network connections used by devices when not directly connected to your intranet. The Windows devices will need the same VPN network connections for users to remotely connect to your intranet.
-
Certificates. Contains the certificates used for network authentication. The Windows devices will need these certificates to connect to the network.
-
-
-
-
Mobile
-
These settings configure and manage companion devices (such as smartphones or tablets) that are used in conjunction with the Chromebook devices and include the following settings categories:
-
-
Device management settings. Configures settings for mobile (companion) devices, such as device synchronization, password settings, auditing, enable remote wipe, and other settings. Record these settings so that you can ensure the same settings are applied when the devices are being managed by Microsoft Intune or another mobile device management (MDM) provider.
-
Device activation. Contains a list of mobile (companion) devices that need to be approved for management by using the Google Admin Console. Approve or block any devices in this list so that the list of managed devices accurately reflects active managed devices.
-
Managed devices. Performs management tasks on mobile (companion) devices that are managed by the Google Admin Console. Record the list of companion devices on this page so that you can ensure the same devices are managed by Intune or another MDM provider.
-
Set Up Apple Push Certificate. Configures the certificate that is essentially the digital signature that lets the Google Admin Console manage iOS devices. You will need this certificate if you plan to manage iOS devices by using Intune or another MDM provider.
-
Set Up Android for Work. Authorizes the Google Admin Console to be the MDM provider for Android devices by providing an Enterprise Mobility Management (EMM) token. You will need this token if you plan to manage Android devices by using another MDM provider.
-
-
-
-
Chrome management
-
These settings configure and manage companion devices (such as smartphones or tablets) that are used in conjunction with the Chromebook devices and include the following settings categories:
-
-
User settings. Configures user-based settings for the Chrome browser and Chromebook devices. Most of these Chromebook user-based settings can be mapped to a corresponding setting in Windows. Record the settings and then map them to settings in Group Policy or Intune.
-
Public session settings. Configures Public Sessions for Chrome devices that are used as kiosks, loaner devices, shared computers, or for any other work or school-related purpose for which users don't need to sign in with their credentials. You can configure Windows devices similarly by using Assigned Access. Record the settings and apps that are available in Public Sessions so that you can provide similar configuration in Assigned Access.
-
Device settings. Configures device-based settings for the Chrome browser and Chromebook devices. You can map most of these Chromebook device-based settings to a corresponding setting in Windows. Record the settings and then map them to settings in Group Policy or Intune.
-
Devices. Manages Chrome device management licenses. The number of licenses recorded here should correspond to the number of licenses you will need for your new management system, such as Intune. Record the number of licenses and use those to determine how many licenses you will need to manage your Windows devices.
-
App Management. Provides configuration settings for Chrome apps. Record the settings for any apps that you have identified that will run on Windows devices.
These settings configure the network connections for Chromebook devices and include the following settings categories:
**Wi-Fi.** Configures the Wi-Fi connections that are available. The Windows devices will need these configuration settings to connect to the same Wi-Fi networks.
**Ethernet.** Configures authentication for secured, wired Ethernet connections (802.1x). The Windows devices will need these configuration settings to connect to the network.
**VPN.** Specifies the VPN network connections used by devices when not directly connected to your intranet. The Windows devices will need the same VPN network connections for users to remotely connect to your intranet.
**Certificates.** Contains the certificates used for network authentication. The Windows devices will need these certificates to connect to the network. |
+|Mobile |These settings configure and manage companion devices (such as smartphones or tablets) that are used in conjunction with the Chromebook devices and include the following settings categories:
**Device management settings.** Configures settings for mobile (companion) devices, such as device synchronization, password settings, auditing, enable remote wipe, and other settings. Record these settings so that you can ensure the same settings are applied when the devices are being managed by Microsoft Intune or another mobile device management (MDM) provider.
**Device activation.** Contains a list of mobile (companion) devices that need to be approved for management by using the Google Admin Console. Approve or block any devices in this list so that the list of managed devices accurately reflects active managed devices.
**Managed devices.** Performs management tasks on mobile (companion) devices that are managed by the Google Admin Console. Record the list of companion devices on this page so that you can ensure the same devices are managed by Intune or another MDM provider.
**Set Up Apple Push Certificate.** Configures the certificate that is essentially the digital signature that lets the Google Admin Console manage iOS devices. You will need this certificate if you plan to manage iOS devices by using Intune or another MDM provider.
**Set Up Android for Work.** Authorizes the Google Admin Console to be the MDM provider for Android devices by providing an Enterprise Mobility Management (EMM) token. You will need this token if you plan to manage Android devices by using another MDM provider. |
+|Chrome management |These settings configure and manage companion devices (such as smartphones or tablets) that are used in conjunction with the Chromebook devices and include the following settings categories:
**User settings.** Configures user-based settings for the Chrome browser and Chromebook devices. Most of these Chromebook user-based settings can be mapped to a corresponding setting in Windows. Record the settings and then map them to settings in Group Policy or Intune.
**Public session settings.** Configures Public Sessions for Chrome devices that are used as kiosks, loaner devices, shared computers, or for any other work or school-related purpose for which users don't need to sign in with their credentials. You can configure Windows devices similarly by using Assigned Access. Record the settings and apps that are available in Public Sessions so that you can provide similar configuration in Assigned Access.
**Device settings.** Configures device-based settings for the Chrome browser and Chromebook devices. You can map most of these Chromebook device-based settings to a corresponding setting in Windows. Record the settings and then map them to settings in Group Policy or Intune.
**Devices.** Manages Chrome device management licenses. The number of licenses recorded here should correspond to the number of licenses you will need for your new management system, such as Intune. Record the number of licenses and use those to determine how many licenses you will need to manage your Windows devices
**App Management.** Provides configuration settings for Chrome apps. Record the settings for any apps that you have identified that will run on Windows devices. |
Table 3 lists the settings in the Security node in the Google Admin Console. Review the settings and determine which settings you will migrate to Windows.
Table 3. Settings in the Security node in the Google Admin Console
-
-
-
-
-
-
-
-
Section
-
Settings
-
-
-
-
-
Basic settings
-
These settings configure password management and whether or not two-factor authentication (2FA) is configured. You can set the minimum password length, the maximum password length, if non-admin users can recover their own passwords, and enable 2FA.
-
Record these settings and use them to help configure your on-premises Active Directory or Azure Active Directory (Azure AD) to mirror the current behavior of your Chromebook environment.
-
-
-
Password monitoring
-
This section is used to monitor the strength of user passwords. You don’t need to migrate any settings in this section.
-
-
-
API reference
-
This section is used to enable access to various Google Apps Administrative APIs. You don’t need to migrate any settings in this section.
-
-
-
Set up single sign-on (SSO)
-
This section is used to configure SSO for Google web-based apps (such as Google Apps Gmail or Google Apps Calendar). While you don’t need to migrate any settings in this section, you probably will want to configure Azure Active Directory synchronization to replace Google-based SSO.
-
-
-
Advanced settings
-
This section is used to configure administrative access to user data and to configure the Google Secure Data Connector (which allows Google Apps to access data on your local network). You don’t need to migrate any settings in this section.
-
-
-
-
-
+|Section|Settings|
+|--- |--- |
+|Basic settings|These settings configure password management and whether or not two-factor authentication (2FA) is configured. You can set the minimum password length, the maximum password length, if non-admin users can recover their own passwords, and enable 2FA. Record these settings and use them to help configure your on-premises Active Directory or Azure Active Directory (Azure AD) to mirror the current behavior of your Chromebook environment.|
+|Password monitoring|This section is used to monitor the strength of user passwords. You don’t need to migrate any settings in this section.|
+|API reference|This section is used to enable access to various Google Apps Administrative APIs. You don’t need to migrate any settings in this section.|
+|Set up single sign-on (SSO)|This section is used to configure SSO for Google web-based apps (such as Google Apps Gmail or Google Apps Calendar). While you don’t need to migrate any settings in this section, you probably will want to configure Azure Active Directory synchronization to replace Google-based SSO.|
+|Advanced settings|This section is used to configure administrative access to user data and to configure the Google Secure Data Connector (which allows Google Apps to access data on your local network). You don’t need to migrate any settings in this section.|
**Identify locally-configured settings to migrate**
@@ -428,62 +355,14 @@ Table 5 is a decision matrix that helps you decide if you can use only on-premis
Table 5. Select on-premises AD DS, Azure AD, or hybrid
-
-
-
-
-
-
-
-
-
-
If you plan to...
-
On-premises AD DS
-
Azure AD
-
Hybrid
-
-
-
-
-
Use Office 365
-
-
X
-
X
-
-
-
Use Intune for management
-
-
X
-
X
-
-
-
Use Microsoft Endpoint Manager for management
-
X
-
-
X
-
-
-
Use Group Policy for management
-
X
-
-
X
-
-
-
Have devices that are domain-joined
-
X
-
-
X
-
-
-
Allow faculty and students to Bring Your Own Device (BYOD) which are not domain-joined
-
-
X
-
X
-
-
-
-
-
+|If you plan to...|On-premises AD DS|Azure AD|Hybrid|
+|--- |--- |--- |--- |
+|Use Office 365||✔️|✔️|
+|Use Intune for management||✔️|✔️|
+|Use Microsoft Endpoint Manager for management|✔️||✔️|
+|Use Group Policy for management|✔️||✔️|
+|Have devices that are domain-joined|✔️||✔️|
+|Allow faculty and students to Bring Your Own Device (BYOD) which are not domain-joined||✔️|✔️|
###
@@ -497,113 +376,17 @@ Table 6 is a decision matrix that lists the device, user, and app management pro
Table 6. Device, user, and app management products and technologies
-
-
-
-
-
-
-
-
-
-
-
-
-
Desired feature
-
Windows provisioning packages
-
Group Policy
-
Configuration Manager
-
Intune
-
MDT
-
Windows Software Update Services
-
-
-
-
-
Deploy operating system images
-
X
-
-
X
-
-
X
-
-
-
-
Deploy apps during operating system deployment
-
X
-
-
X
-
-
X
-
-
-
-
Deploy apps after operating system deployment
-
X
-
X
-
X
-
-
-
-
-
-
Deploy software updates during operating system deployment
-
-
-
X
-
-
X
-
-
-
-
Deploy software updates after operating system deployment
-
X
-
X
-
X
-
X
-
-
X
-
-
-
Support devices that are domain-joined
-
X
-
X
-
X
-
X
-
X
-
-
-
-
Support devices that are not domain-joined
-
X
-
-
-
X
-
X
-
-
-
-
Use on-premises resources
-
X
-
X
-
X
-
-
X
-
-
-
-
Use cloud-based services
-
-
-
-
X
-
-
-
-
-
-
-
+|Desired feature|Windows provisioning packages|Group Policy|Configuration Manager|Intune|MDT|Windows Software Update Services|
+|--- |--- |--- |--- |--- |--- |--- |
+|Deploy operating system images|✔️||✔️||✔️||
+|Deploy apps during operating system deployment|✔️||✔️||✔️||
+|Deploy apps after operating system deployment|✔️|✔️|✔️||||
+|Deploy software updates during operating system deployment|||✔️||✔️||
+|Deploy software updates after operating system deployment|✔️|✔️|✔️|✔️||✔️|
+|Support devices that are domain-joined|✔️|✔️|✔️|✔️|✔️||
+|Support devices that are not domain-joined|✔️|||✔️|✔️||
+|Use on-premises resources|✔️|✔️|✔️||✔️||
+|Use cloud-based services||||✔️|||
You can use Configuration Manager and Intune in conjunction with each other to provide features from both products and technologies. In some instances you may need only one of these products or technologies. In other instances, you may need two or more to meet the device, user, and app management needs for your institution.
@@ -665,35 +448,10 @@ It is important that you perform any network infrastructure remediation first be
Table 7. Network infrastructure products and technologies and deployment resources
-
[Deploying Domain Name System (DNS)](/previous-versions/windows/it-pro/windows-server-2003/cc780661(v=ws.10))|
If you use network infrastructure products and technologies from other vendors, refer to the vendor documentation on how to perform the necessary remediation. If you determined that no remediation is necessary, you can skip this section.
@@ -707,37 +465,10 @@ In the [Plan for Active Directory services](#plan-adservices) section, you deter
Table 8. AD DS, Azure AD and deployment resources
-
[Azure Active Directory documentation](/azure/active-directory/)
[Manage and support Azure Active Directory Premium](https://go.microsoft.com/fwlink/p/?LinkId=690259)
[Guidelines for Deploying Windows Server Active Directory on Azure Virtual Machines](/windows-server/identity/ad-ds/introduction-to-active-directory-domain-services-ad-ds-virtualization-level-100)|
If you decided not to migrate to AD DS or Azure AD as a part of the migration, or if you determined that no remediation is necessary, you can skip this section. If you use identity products and technologies from another vendor, refer to the vendor documentation on how to perform the necessary steps.
@@ -750,59 +481,13 @@ Table 9 lists the Microsoft management systems and the deployment resources for
Table 9. Management systems and deployment resources
-
[Build and apply a provisioning package](/windows/configuration/provisioning-packages/provisioning-create-package)
[Windows Imaging and Configuration Designer](/windows/configuration/provisioning-packages/provisioning-install-icd)
[Step-By-Step: Building Windows 10 Provisioning Packages](/archive/blogs/canitpro/step-by-step-building-windows-10-provisioning-packages)|
+|Group Policy|
[Core Network Companion Guide: Group Policy Deployment](/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/jj899807(v=ws.11))
[Deploying Group Policy](/previous-versions/windows/it-pro/windows-server-2003/cc737330(v=ws.10))"|
+|Configuration Manager|
[Site Administration for System Center 2012 Configuration Manager](/previous-versions/system-center/system-center-2012-R2/gg681983(v=technet.10))
[Deploying Clients for System Center 2012 Configuration Manager](/previous-versions/system-center/system-center-2012-R2/gg699391(v=technet.10))|
+|Intune|
[Set up and manage devices with Microsoft Intune](https://go.microsoft.com/fwlink/p/?LinkId=690262)
[Smoother Management Of Office 365 Deployments with Windows Intune](https://go.microsoft.com/fwlink/p/?LinkId=690263)
[System Center 2012 R2 Configuration Manager & Windows Intune](/learn/?l=fCzIjVKy_6404984382)|
+|MDT|
[MDT documentation in the Microsoft Deployment Toolkit (MDT) 2013](https://go.microsoft.com/fwlink/p/?LinkId=690324)
[Step-By-Step: Installing Windows 8.1 From A USB Key](/archive/blogs/canitpro/step-by-step-installing-windows-8-1-from-a-usb-key)|
If you determined that no new management system or no remediation of existing systems is necessary, you can skip this section. If you use a management system from another vendor, refer to the vendor documentation on how to perform the necessary steps.
@@ -815,44 +500,11 @@ In this step, you need to configure your management system to deploy the apps to
Table 10. Management systems and app deployment resources
-
[Assigning and Publishing Software](/previous-versions/windows/it-pro/windows-server-2003/cc783635(v=ws.10))|
+|Configuration Manager|
[How to Deploy Applications in Configuration Manager](/previous-versions/system-center/system-center-2012-R2/gg682082(v=technet.10))
[Application Management in Configuration Manager](/previous-versions/system-center/system-center-2012-R2/gg699373(v=technet.10))|
+|Intune|
[Deploy apps to mobile devices in Microsoft Intune](https://go.microsoft.com/fwlink/p/?LinkId=733913)
[Manage apps with Microsoft Intune](/mem/intune/)|
If you determined that no deployment of apps is necessary, you can skip this section. If you use a management system from another vendor, refer to the vendor documentation on how to perform the necessary steps.
diff --git a/education/windows/deploy-windows-10-in-a-school-district.md b/education/windows/deploy-windows-10-in-a-school-district.md
index 09c8ad86fe..2c43aa28c6 100644
--- a/education/windows/deploy-windows-10-in-a-school-district.md
+++ b/education/windows/deploy-windows-10-in-a-school-district.md
@@ -83,7 +83,7 @@ This district configuration has the following characteristics:
* If you have on-premises AD DS, you can [integrate Azure AD with on-premises AD DS](/azure/active-directory/hybrid/whatis-hybrid-identity).
-* Use [Intune](/intune/), [Mobile Device Management for Office 365](https://support.office.com/en-us/article/Set-up-Mobile-Device-Management-MDM-in-Office-365-dd892318-bc44-4eb1-af00-9db5430be3cd?ui=en-US&rs=en-US&ad=US), or [Group Policy in AD DS](/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/cc725828(v=ws.10)) to manage devices.
+* Use [Intune](/intune/), [Mobile Device Management for Office 365](/microsoft-365/admin/basic-mobility-security/set-up), or [Group Policy in AD DS](/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/cc725828(v=ws.10)) to manage devices.
* Each device supports a one-student-per-device or multiple-students-per-device scenario.
@@ -128,7 +128,7 @@ Office 365 Education allows:
* Students and faculty to access classroom resources from anywhere on any device (including iOS and Android devices).
-For more information about Office 365 Education features and an FAQ, go to [Office 365 Education plans and pricing](https://products.office.com/en-us/academic).
+For more information about Office 365 Education features and an FAQ, go to [Office 365 Education plans and pricing](https://www.microsoft.com/microsoft-365/academic/compare-office-365-education-plans).
### How to configure a district
@@ -225,80 +225,10 @@ Use the cloud-centric scenario and on-premises and cloud scenario as a guide for
To deploy Windows 10 and your apps, you can use MDT by itself or Microsoft Endpoint Manager and MDT together. For a district, there are a few ways to deploy Windows 10 to devices. Table 2 lists the methods that this guide describes and recommends. Use this information to determine which combination of deployment methods is right for your institution.
-
-
-
-
-
-
-
-
Method
-
Description
-
-
-
-
-
-
MDT
-
MDT is an on-premises solution that supports initial operating system deployment and upgrade. You can use MDT to deploy and upgrade Windows 10. In addition, you can initially deploy Windows desktop and Microsoft Store apps and software updates.
-Select this method when you:
-
-
Want to deploy Windows 10 to institution-owned and personal devices. (Devices need not be domain joined.)
-
Don’t have an existing AD DS infrastructure.
-
Need to manage devices regardless of where they are (on or off premises).
-
-
-
The advantages of this method are that:
-
-
You can deploy Windows 10 operating systems.
-
You can manage device drivers during initial deployment.
-
You can deploy Windows desktop apps (during initial deployment)
-
It doesn’t require an AD DS infrastructure.
-
It doesn’t have additional infrastructure requirements.
-
MDT doesn’t incur additional cost: it’s a free tool.
-
You can deploy Windows 10 operating systems to institution-owned and personal devices.
-
-
-
The disadvantages of this method are that it:
-
-
-
Can’t manage applications throughout entire application life cycle (by itself).
-
Can’t manage software updates for Windows 10 and apps (by itself).
-
Doesn’t provide antivirus and malware protection (by itself).
-
Has limited scaling to large numbers of users and devices.
-
-
-
-
-
-
-
Microsoft Endpoint Configuration Manager
-
Configuration Manager is an on-premises solution that supports operating system management throughout the entire operating system life cycle. You can use Configuration Manager to deploy and upgrade Windows 10. In addition, you can manage Windows desktop and Microsoft Store apps and software updates as well as provide antivirus and antimalware protection.
-Select this method when you:
-
-
Want to deploy Windows 10 to institution-owned devices that are domain joined (personal devices are typically not domain joined).
-
Have an existing AD DS infrastructure (or plan to deploy an AD DS infrastructure).
-
Typically deploy Windows 10 to on-premises devices.
-
-
-
The advantages of this method are that:
-
-
You can deploy Windows 10 operating systems.
-
You can manage (deploy) Windows desktop and Microsoft Store apps throughout entire application life cycle.
-
You can manage software updates for Windows 10 and apps.
-
You can manage antivirus and malware protection.
-
It scales to large number of users and devices.
-
-
The disadvantages of this method are that it:
-
-
Carries an additional cost for Microsoft Endpoint Manager server licenses (if the institution does not have Configuration Manager already).
-
Can deploy Windows 10 only to domain-joined (institution-owned devices).
-
Requires an AD DS infrastructure (if the institution does not have AD DS already).
-
-
-
-
-
+|Method|Description|
+|--- |--- |
+|MDT|MDT is an on-premises solution that supports initial operating system deployment and upgrade. You can use MDT to deploy and upgrade Windows 10. In addition, you can initially deploy Windows desktop and Microsoft Store apps and software updates. Select this method when you:
Want to deploy Windows 10 to institution-owned and personal devices. (Devices need not be domain joined.)
Don’t have an existing AD DS infrastructure.
Need to manage devices regardless of where they are (on or off premises). The advantages of this method are that:
You can deploy Windows 10 operating systems
You can manage device drivers during initial deployment.
You can deploy Windows desktop apps (during initial deployment)
It doesn’t require an AD DS infrastructure.
It doesn’t have additional infrastructure requirements.
MDT doesn’t incur additional cost: it’s a free tool.
You can deploy Windows 10 operating systems to institution-owned and personal devices. The disadvantages of this method are that it:
Can’t manage applications throughout entire application life cycle (by itself).
Can’t manage software updates for Windows 10 and apps (by itself).
Doesn’t provide antivirus and malware protection (by itself).
Has limited scaling to large numbers of users and devices.|
+|Microsoft Endpoint Configuration Manager|
Configuration Manager is an on-premises solution that supports operating system management throughout the entire operating system life cycle
You can use Configuration Manager to deploy and upgrade Windows 10. In addition, you can manage Windows desktop and Microsoft Store apps and software updates as well as provide antivirus and antimalware protection. Select this method when you:
Want to deploy Windows 10 to institution-owned devices that are domain joined (personal devices are typically not domain joined).
Have an existing AD DS infrastructure (or plan to deploy an AD DS infrastructure).
Typically deploy Windows 10 to on-premises devices. The advantages of this method are that:
You can deploy Windows 10 operating systems.
You can manage (deploy) Windows desktop and Microsoft Store apps throughout entire application life cycle.
You can manage software updates for Windows 10 and apps.
You can manage antivirus and malware protection.
It scales to large number of users and devices. The disadvantages of this method are that it:
Carries an additional cost for Microsoft Endpoint Manager server licenses (if the institution does not have Configuration Manager already).
Can deploy Windows 10 only to domain-joined (institution-owned devices).
Requires an AD DS infrastructure (if the institution does not have AD DS already).|
*Table 2. Deployment methods*
@@ -317,81 +247,10 @@ If you have only one device to configure, manually configuring that one device i
For a district, there are many ways to manage the configuration setting for users and devices. Table 4 lists the methods that this guide describes and recommends. Use this information to determine which combination of configuration setting management methods is right for your institution.
-
-
-
-
-
-
-
-
Method
-
Description
-
-
-
-
-
-
Group Policy
-
Group Policy is an integral part of AD DS and allows you to specify configuration settings for Windows 10 and previous versions of Windows.
-Select this method when you:
-
-
-
Want to manage institution-owned devices that are domain joined (personal devices are typically not domain joined).
-
Want more granular control of device and user settings.
-
Have an existing AD DS infrastructure.
-
Typically manage on-premises devices.
-
Can manage a required setting only by using Group Policy.
-
-
-
The advantages of this method include:
-
-
No cost beyond the AD DS infrastructure.
-
A larger number of settings (compared to Intune).
-
-
-
The disadvantages of this method are that it:
-
-
Can only manage domain-joined (institution-owned devices).
-
Requires an AD DS infrastructure (if the institution does not have AD DS already).
-
Typically manages on-premises devices (unless devices use a virtual private network [VPN] or Microsoft DirectAccess to connect).
-
Has rudimentary app management capabilities.
-
Cannot deploy Windows 10 operating systems.
-
-
-
-
-
Intune
-
Intune is a cloud-based management system that allows you to specify configuration settings for Windows 10, previous versions of Windows, and other operating systems (such as iOS or Android). Intune is a subscription-based cloud service that integrates with Office 365 and Azure AD.
-Intune is the cloud-based management system described in this guide, but you can use other MDM providers. If you use an MDM provider other than Intune, integration with Configuration Manager is unavailable.
-Select this method when you:
-
-
-
Want to manage institution-owned and personal devices (does not require that the device be domain joined).
-
Don’t need granular control over device and user settings (compared to Group Policy).
-
Don’t have an existing AD DS infrastructure.
-
Need to manage devices regardless of where they are (on or off premises).
-
Want to provide application management for the entire application life cycle.
-
Can manage a required setting only by using Intune.
-
-
-
The advantages of this method are that:
-
-
You can manage institution-owned and personal devices.
-
It doesn’t require that devices be domain joined.
-
It doesn’t require any on-premises infrastructure.
-
It can manage devices regardless of their location (on or off premises).
-
-
The disadvantages of this method are that it:
-
-
Carries an additional cost for Intune subscription licenses.
-
Doesn’t offer granular control over device and user settings (compared to Group Policy).
-
Cannot deploy Windows 10 operating systems.
-
-
-
-
-
-
+|Method|Description|
+|--- |--- |
+|Group Policy|Group Policy is an integral part of AD DS and allows you to specify configuration settings for Windows 10 and previous versions of Windows. Select this method when you
Want to manage institution-owned devices that are domain joined (personal devices are typically not domain joined).
Want more granular control of device and user settings.
Have an existing AD DS infrastructure.
Typically manage on-premises devices.
Can manage a required setting only by using Group Policy. The advantages of this method include:
No cost beyond the AD DS infrastructure.
A larger number of settings (compared to Intune). The disadvantages of this method are that it:
Can only manage domain-joined (institution-owned devices).
Requires an AD DS infrastructure (if the institution does not have AD DS already).
Typically manages on-premises devices (unless devices use a virtual private network [VPN] or Microsoft DirectAccess to connect).
Has rudimentary app management capabilities.
Cannot deploy Windows 10 operating systems.|
+|Intune|Intune is a cloud-based management system that allows you to specify configuration settings for Windows 10, previous versions of Windows, and other operating systems (such as iOS or Android). Intune is a subscription-based cloud service that integrates with Office 365 and Azure AD. Intune is the cloud-based management system described in this guide, but you can use other MDM providers. If you use an MDM provider other than Intune, integration with Configuration Manager is unavailable. Select this method when you:
Want to manage institution-owned and personal devices (does not require that the device be domain joined).
Don’t need granular control over device and user settings (compared to Group Policy).
Don’t have an existing AD DS infrastructure.
Need to manage devices regardless of where they are (on or off premises).
Want to provide application management for the entire application life cycle.
Can manage a required setting only by using Intune. The advantages of this method are that:
You can manage institution-owned and personal devices.
It doesn’t require that devices be domain joined.
It doesn’t require any on-premises infrastructure.
It can manage devices regardless of their location (on or off premises). The disadvantages of this method are that it:
Carries an additional cost for Intune subscription licenses.
Doesn’t offer granular control over device and user settings (compared to Group Policy).
Cannot deploy Windows 10 operating systems.|
*Table 4. Configuration setting management methods*
@@ -410,114 +269,11 @@ For a district, there are many ways to manage apps and software updates. Table 6
Use the information in Table 6 to determine which combination of app and update management products is right for your district.
-
-
-
-
-
-
-
-
Selection
-
Management method
-
-
-
-
-
-
Microsoft Endpoint Configuration Manager
-
Configuration Manager is an on-premises solution that allows you to specify configuration settings for Windows 10; previous versions of Windows; and other operating systems, such as iOS or Android, through integration with Intune.
Configuration Manager supports application management throughout the entire application life cycle. You can deploy, upgrade, manage multiple versions, and retire applications by using Configuration Manager. You can also manage Windows desktop and Microsoft Store applications.
Select this method when you:
-
-
Selected Configuration Manager to deploy Windows 10.
-
Want to manage institution-owned devices that are domain joined (personally owned devices are typically not domain joined).
-
Want to manage AD DS domain-joined devices.
-
Have an existing AD DS infrastructure.
-
Typically manage on-premises devices.
-
Want to deploy operating systems.
-
Want to provide application management for the entire application life cycle.
-
-
-
The advantages of this method are that:
-
-
You can deploy Windows 10 operating systems.
-
You can manage applications throughout the entire application life cycle.
-
You can manage software updates for Windows 10 and apps.
-
You can manage antivirus and malware protection.
-
It scales to large numbers of users and devices.
-
-
The disadvantages of this method are that it:
-
-
Carries an additional cost for Configuration Manager server licenses (if the institution does not have Configuration Manager already).
-
Carries an additional cost for Windows Server licenses and the corresponding server hardware.
-
Can only manage domain-joined (institution-owned devices).
-
Requires an AD DS infrastructure (if the institution does not have AD DS already).
-
Typically manages on-premises devices (unless devices through VPN or DirectAccess).
-
-
-
-
-
-
Intune
-
Intune is a cloud-based solution that allows you to manage apps and software updates for Windows 10, previous versions of Windows, and other operating systems (such as iOS or Android). Intune is a subscription-based cloud service that integrates with Office 365 and Azure AD.
-Select this method when you:
-
-
Selected MDT only to deploy Windows 10.
-
Want to manage institution-owned and personal devices that are not domain joined.
-
Want to manage Azure AD domain-joined devices.
-
Need to manage devices regardless of where they are (on or off premises).
-
Want to provide application management for the entire application life cycle.
-
-
The advantages of this method are that:
-
-
You can manage institution-owned and personal devices.
-
It doesn’t require that devices be domain joined.
-
It doesn’t require on-premises infrastructure.
-
It can manage devices regardless of their location (on or off premises).
-
You can deploy keys to perform in-place Windows 10 upgrades (such as upgrading from Windows 10 Pro to Windows 10 Education edition).
-
-
The disadvantages of this method are that it:
-
-
Carries an additional cost for Intune subscription licenses.
-
Cannot deploy Windows 10 operating systems.
-
-
-
-
-
-
Microsoft Endpoint Manager and Intune (hybrid)
-
Configuration Manager and Intune together extend Configuration Manager from an on-premises management system for domain-joined devices to a solution that can manage devices regardless of their location and connectivity options. This hybrid option provides the benefits of both Configuration Manager and Intune.
-Configuration Manager and Intune in the hybrid configuration allow you to support application management throughout the entire application life cycle. You can deploy, upgrade, manage multiple versions, and retire applications by using Configuration Manager, and you can manage Windows desktop and Microsoft Store applications for both institution-owned and personal devices.
-Select this method when you:
-
-
Selected Microsoft Endpoint Manager to deploy Windows 10.
-
Want to manage institution-owned and personal devices (does not require that the device be domain joined).
-
Want to manage domain-joined devices.
-
Want to manage Azure AD domain-joined devices.
-
Have an existing AD DS infrastructure.
-
Want to manage devices regardless of their connectivity.
-
Want to deploy operating systems.
-
Want to provide application management for the entire application life cycle.
-
-
The advantages of this method are that:
-
-
You can deploy operating systems.
-
You can manage applications throughout the entire application life cycle.
-
You can scale to large numbers of users and devices.
-
You can support institution-owned and personal devices.
-
It doesn’t require that devices be domain joined.
-
It can manage devices regardless of their location (on or off premises).
-
-
The disadvantages of this method are that it:
-
-
Carries an additional cost for Configuration Manager server licenses (if the institution does not have Configuration Manager already).
-
Carries an additional cost for Windows Server licenses and the corresponding server hardware.
-
Carries an additional cost for Intune subscription licenses.
-
Requires an AD DS infrastructure (if the institution does not have AD DS already).
-
-
-
-
-
-
+|Selection|Management method|
+|--- |--- |
+|Microsoft Endpoint Configuration Manager|Configuration Manager is an on-premises solution that allows you to specify configuration settings for Windows 10; previous versions of Windows; and other operating systems, such as iOS or Android, through integration with Intune.Configuration Manager supports application management throughout the entire application life cycle. You can deploy, upgrade, manage multiple versions, and retire applications by using Configuration Manager. You can also manage Windows desktop and Microsoft Store applications. Select this method when you:
Selected Configuration Manager to deploy Windows 10.
Want to manage institution-owned devices that are domain joined (personally owned devices are typically not domain joined).
Want to manage AD DS domain-joined devices.
Have an existing AD DS infrastructure.
Typically manage on-premises devices.
Want to deploy operating systems.
Want to provide application management for the entire application life cycle. The advantages of this method are that:
You can deploy Windows 10 operating systems.
You can manage applications throughout the entire application life cycle.
You can manage software updates for Windows 10 and apps.
You can manage antivirus and malware protection.
It scales to large numbers of users and devices. The disadvantages of this method are that it:
Carries an additional cost for Configuration Manager server licenses (if the institution does not have Configuration Manager already).
Carries an additional cost for Windows Server licenses and the corresponding server hardware.
Can only manage domain-joined (institution-owned devices).
Requires an AD DS infrastructure (if the institution does not have AD DS already).
Typically manages on-premises devices (unless devices through VPN or DirectAccess).|
+|Intune|Intune is a cloud-based solution that allows you to manage apps and software updates for Windows 10, previous versions of Windows, and other operating systems (such as iOS or Android). Intune is a subscription-based cloud service that integrates with Office 365 and Azure AD. Select this method when you:
Selected MDT only to deploy Windows 10.
Want to manage institution-owned and personal devices that are not domain joined.
Want to manage Azure AD domain-joined devices.
Need to manage devices regardless of where they are (on or off premises).
Want to provide application management for the entire application life cycle. The advantages of this method are that:
You can manage institution-owned and personal devices.
It doesn’t require that devices be domain joined.
It doesn’t require on-premises infrastructure.vIt can manage devices regardless of their location (on or off premises).
You can deploy keys to perform in-place Windows 10 upgrades (such as upgrading from Windows 10 Pro to Windows 10 Education edition). The disadvantages of this method are that it:
Carries an additional cost for Intune subscription licenses.
Cannot deploy Windows 10 operating systems.|
+|Microsoft Endpoint Manager and Intune (hybrid)|Configuration Manager and Intune together extend Configuration Manager from an on-premises management system for domain-joined devices to a solution that can manage devices regardless of their location and connectivity options. This hybrid option provides the benefits of both Configuration Manager and Intune. Configuration Manager and Intune in the hybrid configuration allow you to support application management throughout the entire application life cycle. You can deploy, upgrade, manage multiple versions, and retire applications by using Configuration Manager, and you can manage Windows desktop and Microsoft Store applications for both institution-owned and personal devices. Select this method when you:
Selected Microsoft Endpoint Manager to deploy Windows 10.
Want to manage institution-owned and personal devices (does not require that the device be domain joined).
Want to manage domain-joined devices.
Want to manage Azure AD domain-joined devices.
Have an existing AD DS infrastructure.
Want to manage devices regardless of their connectivity.vWant to deploy operating systems.
Want to provide application management for the entire application life cycle. The advantages of this method are that:
You can deploy operating systems.
You can manage applications throughout the entire application life cycle.
You can scale to large numbers of users and devices.
You can support institution-owned and personal devices.
It doesn’t require that devices be domain joined.
It can manage devices regardless of their location (on or off premises). The disadvantages of this method are that it:
Carries an additional cost for Configuration Manager server licenses (if the institution does not have Configuration Manager already).
Carries an additional cost for Windows Server licenses and the corresponding server hardware.
Carries an additional cost for Intune subscription licenses.
Requires an AD DS infrastructure (if the institution does not have AD DS already).|
*Table 6. App and update management products*
@@ -683,7 +439,7 @@ Now that you have created your new Office 365 Education subscription, add the do
To make it easier for faculty and students to join your Office 365 Education subscription (or *tenant*), allow them to automatically sign up to your tenant (*automatic tenant join*). In automatic tenant join, when a faculty member or student signs up for Office 365, Office 365 automatically adds (joins) the user to your Office 365 tenant.
> [!NOTE]
-> By default, automatic tenant join is enabled in Office 365 Education, with the exception of certain areas in Europe, the Middle East, and Africa. These countries/regions require opt-in steps to add new users to existing Office 365 tenants. Check your country/region requirements to determine the automatic tenant join default configuration. Also, if you use Azure AD Connect, then automatic tenant join is disabled. For more information, see [Office 365 Education Self-Sign up: Technical FAQ](https://support.office.com/en-us/article/Office-365-Education-Self-Sign-up-Technical-FAQ-7fb1b2f9-94c2-4cbb-b01e-a6eca34261d6?ui=en-US&rs=en-US&ad=US&WT.mc_id=eml_CXM__33537_MOD_EDU_Student_Advantage_Rush).
+> By default, automatic tenant join is enabled in Office 365 Education, with the exception of certain areas in Europe, the Middle East, and Africa. These countries/regions require opt-in steps to add new users to existing Office 365 tenants. Check your country/region requirements to determine the automatic tenant join default configuration. Also, if you use Azure AD Connect, then automatic tenant join is disabled. For more information, see [Office 365 Education Self-Sign up FAQ](/microsoft-365/education/deploy/office-365-education-self-sign-up).
Office 365 uses the domain portion of the user’s email address to know which Office 365 tenant to join. For example, if a faculty member or student provides an email address of user@contoso.edu, then Office 365 automatically performs one of the following tasks:
@@ -695,7 +451,7 @@ You will always want faculty and students to join the Office 365 tenant that you
> [!NOTE]
> You cannot merge multiple tenants, so any faculty or students who create their own tenant will need to abandon their existing tenant and join yours.
-By default, all new Office 365 Education subscriptions have automatic tenant join enabled, but you can enable or disable automatic tenant join by using the Windows PowerShell commands in Table 10. For more information about how to run these commands, see [How can I prevent students from joining my existing Office 365 tenant](https://support.office.com/en-us/article/Office-365-Education-Self-Sign-up-Technical-FAQ-7fb1b2f9-94c2-4cbb-b01e-a6eca34261d6?ui=en-US&rs=en-US&ad=US#BKMK_PreventJoins).
+By default, all new Office 365 Education subscriptions have automatic tenant join enabled, but you can enable or disable automatic tenant join by using the Windows PowerShell commands in Table 10. For more information about how to run these commands, see [How can I prevent students from joining my existing Office 365 tenant](/microsoft-365/education/deploy/office-365-education-self-sign-up).
|Action |Windows PowerShell command|
|-------|--------------------------|
@@ -714,7 +470,7 @@ To reduce your administrative effort, automatically assign Office 365 Education
> [!NOTE]
> By default, automatic licensing is enabled in Office 365 Education. If you want to use automatic licensing, then skip this section and go to the next section.
-Although all new Office 365 Education subscriptions have automatic licensing enabled by default, you can enable or disable it for your Office 365 tenant by using the Windows PowerShell commands in Table 11. For more information about how to run these commands, see [How can I prevent students from joining my existing Office 365 tenant](https://support.office.com/en-us/article/Office-365-Education-Self-Sign-up-Technical-FAQ-7fb1b2f9-94c2-4cbb-b01e-a6eca34261d6?ui=en-US&rs=en-US&ad=US#BKMK_PreventJoins).
+Although all new Office 365 Education subscriptions have automatic licensing enabled by default, you can enable or disable it for your Office 365 tenant by using the Windows PowerShell commands in Table 11. For more information about how to run these commands, see [How can I prevent students from joining my existing Office 365 tenant](/microsoft-365/education/deploy/office-365-education-self-sign-up).
|Action |Windows PowerShell command|
|-------|--------------------------|
@@ -887,7 +643,7 @@ Several methods are available to bulk-import user accounts into AD DS domains. T
|-------|---------------------------------------------|
|Ldifde.exe|This command-line tool allows you to import and export objects (such as user accounts) from AD DS. Select this method if you aren't comfortable with Microsoft Visual Basic Scripting Edition (VBScript), Windows PowerShell, or other scripting languages. For more information about using Ldifde.exe, see [Step-by-Step Guide to Bulk Import and Export to Active Directory](/previous-versions/windows/it-pro/windows-2000-server/bb727091(v=technet.10)), [LDIFDE—Export/Import data from Active Directory—LDIFDE commands](https://support.microsoft.com/kb/555636), [Import or Export Directory Objects Using Ldifde](/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/cc816781(v=ws.10)), and [LDIFDE](/previous-versions/orphan-topics/ws.10/cc755456(v=ws.10)).|
|VBScript|This scripting language uses the Active Directory Services Interfaces (ADSI) Component Object Model interface to manage AD DS objects, including user and group objects. Select this method if you’re comfortable with VBScript. For more information about using VBScript and ADSI, see [Step-by-Step Guide to Bulk Import and Export to Active Directory](/previous-versions/windows/it-pro/windows-2000-server/bb727091(v=technet.10)) and [ADSI Scriptomatic](https://technet.microsoft.com/scriptcenter/dd939958.aspx).|
-|Windows PowerShell|This scripting language natively supports cmdlets to manage AD DS objects, including user and group objects. Select this method if you’re comfortable with Window PowerShell scripting. For more information about using Windows PowerShell, see [Import Bulk Users to Active Directory](/archive/blogs/technet/bettertogether/import-bulk-users-to-active-directory) and [PowerShell: Bulk create AD Users from CSV file](https://social.technet.microsoft.com/wiki/contents/articles/24541.powershell-bulk-create-ad-users-from-csv-file.aspx).|
+|Windows PowerShell|This scripting language natively supports cmdlets to manage AD DS objects, including user and group objects. Select this method if you’re comfortable with Windows PowerShell scripting. For more information about using Windows PowerShell, see [Import Bulk Users to Active Directory](/archive/blogs/technet/bettertogether/import-bulk-users-to-active-directory) and [PowerShell: Bulk create AD Users from CSV file](https://social.technet.microsoft.com/wiki/contents/articles/24541.powershell-bulk-create-ad-users-from-csv-file.aspx).|
*Table 12. AD DS bulk-import account methods*
@@ -935,7 +691,7 @@ You can use the Microsoft 365 admin center to add individual Office 365 accounts
The bulk-add process assigns the same Office 365 Education license plan to all users on the list. Therefore, you must create a separate list for each license plan you recorded in Table 9. Depending on the number of faculty members who need to use the classroom, you may want to add the faculty Office 365 accounts manually; however, use the bulk-add process to add student accounts.
-For more information about how to bulk-add users to Office 365, see [Add several users at the same time to Office 365 - Admin help](https://support.office.com/en-us/article/Add-several-users-at-the-same-time-to-Office-365-Admin-Help-1f5767ed-e717-4f24-969c-6ea9d412ca88?ui=en-US&rs=en-US&ad=US).
+For more information about how to bulk-add users to Office 365, see [Add several users at the same time to Microsoft 365](/microsoft-365/enterprise/add-several-users-at-the-same-time).
> [!NOTE]
> If you encountered errors during bulk add, resolve them before you continue the bulk-add process. You can view the log file to see which users caused the errors, and then modify the .csv file to correct the problems. Click **Back** to retry the verification process.
@@ -949,7 +705,7 @@ Assign SharePoint Online resource permissions to Office 365 security groups, not
> [!NOTE]
> If your institution has AD DS, don’t create security accounts in Office 365. Instead, create the security groups in AD DS, and then use Azure AD integration to synchronize the security groups with your Office 365 tenant.
-For information about creating security groups, see [Create an Office 365 Group in the admin center](https://support.office.com/en-us/article/Create-an-Office-365-Group-in-the-admin-center-74a1ef8b-3844-4d08-9980-9f8f7a36000f?ui=en-US&rs=en-001&ad=US).
+For information about creating security groups, see [Create an Office 365 Group in the admin center](/microsoft-365/admin/create-groups/create-groups).
You can add and remove users from security groups at any time.
@@ -966,7 +722,7 @@ You can create email distribution groups based on job role (such as teacher, adm
> Office 365 can take some time to complete the Exchange Online creation process. You will have to wait until the creation process ends before you can perform the following steps.
-For information about creating email distribution groups, see [Create an Office 365 Group in the admin center](https://support.office.com/en-us/article/Create-an-Office-365-Group-in-the-admin-center-74a1ef8b-3844-4d08-9980-9f8f7a36000f?ui=en-US&rs=en-001&ad=US).
+For information about creating email distribution groups, see [Create a Microsoft 365 group in the admin center](/microsoft-365/admin/create-groups/create-groups).
#### Summary
@@ -1083,63 +839,11 @@ This guide discusses thick image deployment. For information about thin image de
### Select a method to initiate deployment
The LTI deployment process is highly automated: it requires minimal information to deploy or upgrade Windows 10. The ZTI deployment process is fully automated, but you must manually initiate it. To do so, use the method listed in Table 15 that best meets the needs of your institution.
-
-
-
-
-
-
-
-
-
Method
-
Description and reason to select this method
-
-
-
-
-
-
-
Windows Deployment Services
-
This method:
-
-
Uses diskless booting to initiate LTI and ZTI deployments.
-
Works only with devices that support PXE boot.
-
Deploys Windows 10 over the network, which consumes more network bandwidth than deployment from local media.
-
Deploys images more slowly than when you use local media.
-
Requires that you deploy a Windows Deployment Services server.
-
- Select this method when you want to deploy Windows over-the-network and perform diskless booting. The advantage of this method is that the diskless media are generic and typically don’t require updates after you create them (LTI and ZTI access the centrally located deployment content over the network). The disadvantage of this method is that over-the-network deployments are slower than deployments from local media, and you must deploy a Windows Deployment Services server.
-
-
-
-
-
Bootable media
-
This method:
-
-
Initiates LTI or ZTI deployment by booting from local media, including from USB drives, DVD, or CD.
-
Deploys Windows 10 over the network, which consumes more network bandwidth than deployment from local media.
-
Deploys images more slowly than when using local media.
-
Requires no additional infrastructure.
-
- Select this method when you want to deploy Windows over the network and are willing to boot the target device from local media. The advantage of this method is that the media are generic and typically don’t require updates after you create them (LTI and ZTI access the centrally located deployment content over the network). The disadvantage of this method is that over-the-network deployments are slower than deployment from local media.
-
-
-
-
-
Deployment media
-
This method:
-
-
Initiates LTI or ZTI deployment by booting from a local USB hard disk.
-
Deploys Windows 10 from local media, which consumes less network bandwidth than over-the-network methods.
-
Deploys images more quickly than network-based methods do.
-
Requires a USB hard disk because of the deployment share’s storage requirements (up to 100 GB).
-
- Select this method when you want to perform local deployments and are willing to boot the target device from a local USB hard disk. The advantage of this method is that local deployments are faster than over-the-network deployments. The disadvantage of this method is that each time you change the deployment share or distribution point content, you must regenerate the deployment media and update the USB hard disk.
-
-
-
-
-
+|Method|Description and reason to select this method|
+|--- |--- |
+|Windows Deployment Services|This method:
Uses diskless booting to initiate LTI and ZTI deployments.
Works only with devices that support PXE boot.
Deploys Windows 10 over the network, which consumes more network bandwidth than deployment from local media.
Deploys images more slowly than when you use local media.
Requires that you deploy a Windows Deployment Services server.
Select this method when you want to deploy Windows over-the-network and perform diskless booting. The advantage of this method is that the diskless media are generic and typically don’t require updates after you create them (LTI and ZTI access the centrally located deployment content over the network). The disadvantage of this method is that over-the-network deployments are slower than deployments from local media, and you must deploy a Windows Deployment Services server.|
+|Bootable media|This method:
Initiates LTI or ZTI deployment by booting from local media, including from USB drives, DVD, or CD.
Deploys Windows 10 over the network, which consumes more network bandwidth than deployment from local media.
Deploys images more slowly than when using local media.
Requires no additional infrastructure.
Select this method when you want to deploy Windows over the network and are willing to boot the target device from local media. The advantage of this method is that the media are generic and typically don’t require updates after you create them (LTI and ZTI access the centrally located deployment content over the network). The disadvantage of this method is that over-the-network deployments are slower than deployment from local media.|
+|Deployment media|This method:
Initiates LTI or ZTI deployment by booting from a local USB hard disk.
Deploys Windows 10 from local media, which consumes less network bandwidth than over-the-network methods.
Deploys images more quickly than network-based methods do.
Requires a USB hard disk because of the deployment share’s storage requirements (up to 100 GB).
Select this method when you want to perform local deployments and are willing to boot the target device from a local USB hard disk. The advantage of this method is that local deployments are faster than over-the-network deployments. The disadvantage of this method is that each time you change the deployment share or distribution point content, you must regenerate the deployment media and update the USB hard disk.
*Table 15. Methods to initiate LTI and ZTI deployments*
@@ -1154,91 +858,14 @@ Before you can deploy Windows 10 and your apps to devices, you need to prepare y
The first step in preparing for Windows 10 deployment is to configure—that is, *populate*—the MDT deployment share. Table 16 lists the MDT deployment share configuration tasks that you must perform. Perform the tasks in the order represented in Table 16.
-
Device drivers allow Windows 10 to know a device’s hardware resources and connected hardware accessories. Without the proper device drivers, certain features may be unavailable. For example, without the proper audio driver, a device cannot play sounds; without the proper camera driver, the device cannot take photos or use video chat.
3. Create MDT applications for Microsoft Store apps
-
Create an MDT application for each Microsoft Store app you want to deploy. You can deploy Microsoft Store apps by using sideloading, which allows you to use the Add-AppxPackage Windows PowerShell cmdlet to deploy the .appx files associated with the app (called provisioned apps). Use this method to deploy up to 24 apps to Windows 10.
-
Prior to sideloading the .appx files, obtain the Microsoft Store .appx files that you will use to deploy (sideload) the apps in your provisioning package. For apps in Microsoft Store, you will need to obtain the .appx files by performing one of the following tasks:
-
-
For offline-licensed apps, download the .appx files from the Microsoft Store for Business.
-
For apps that are not offline licensed, obtain the .appx files from the app software vendor directly.
-
- If you are unable to obtain the .appx files from the app software vendor, then you or the students will need to install the apps on the student devices directly from Microsoft Store or Microsoft Store for Business.
-If you have Intune or Microsoft Endpoint Configuration Manager, you can deploy Microsoft Store apps after you deploy Windows 10, as described in the Deploy and manage apps by using Intune and Deploy and manage apps by using Microsoft Endpoint Configuration Manager sections. This method provides granular deployment of Microsoft Store apps, and you can use it for ongoing management of Microsoft Store apps. This is the preferred method of deploying and managing Microsoft Store apps.
-In addition, you must prepare your environment for sideloading Microsoft Store apps. For more information about how to:
4. Create MDT applications for Windows desktop apps
-
You need to create an MDT application for each Windows desktop app you want to deploy. You can obtain the Windows desktop apps from any source, but ensure that you have sufficient licenses for them.
-If you have Intune, you can deploy Windows desktop apps after you deploy Windows 10, as described in the Deploy and manage apps by using Intune section. This method provides granular deployment of Windows desktop apps, and you can use it for ongoing management of the apps. This is the preferred method for deploying and managing Windows desktop apps.
-
-Note You can also deploy Windows desktop apps after you deploy Windows 10, as described in the Deploy and manage apps by using Intune section.
-
-For more information about how to create an MDT application for Window desktop apps, see [Create a New Application in the Deployment Workbench](/mem/configmgr/mdt/use-the-mdt).
-
-
-
-
-
-
5. Create task sequences
-
You must create separate task sequences for each Windows 10 edition, processor architecture, operating system upgrade process, and new operating system deployment process. Minimally, create a task sequence for each Windows 10 operating system you imported in step 1—for example, (1) if you want to deploy Windows 10 Education to new devices or refresh existing devices with a new deployment of Windows 10 Education, (2) if you want to upgrade existing devices running Windows 8.1 or Windows 7 to Windows 10 Education, or (3) if you want to run deployments and upgrades for both 32-bit and 64-bit versions of Windows 10. To do so, you must create task sequences that will:
-
-
Deploy 64-bit Windows 10 Education to devices.
-
Deploy 32-bit Windows 10 Education to devices.
-
Upgrade existing devices to 64-bit Windows 10 Education.
-
Upgrade existing devices to 32-bit Windows 10 Education.
-
- Again, you will create the task sequences based on the operating systems that you imported in step 1. For more information about how to create a task sequence, see Create a New Task Sequence in the Deployment Workbench.
-
-
-
-
-
-
6. Update the deployment share
-
Updating a deployment share generates the MDT boot images you use to initiate the Windows 10 deployment process. You can configure the process to create 32-bit and 64-bit versions of the .iso and .wim files you can use to create bootable media or in Windows Deployment Services.
+|Task|Description|
+|--- |--- |
+|1. Import operating systems|Import the operating systems that you selected in the [Select the operating systems](#select-the-operating-systems) section into the deployment share. For more information about how to import operating systems, see [Import Device Drivers into the Deployment Workbench](/mem/configmgr/mdt/use-the-mdt#ImportDeviceDriversintotheDeploymentWorkbench)|
+|2. Import device drivers|Device drivers allow Windows 10 to know a device’s hardware resources and connected hardware accessories. Without the proper device drivers, certain features may be unavailable. For example, without the proper audio driver, a device cannot play sounds; without the proper camera driver, the device cannot take photos or use video chat. Import device drivers for each device in your institution. For more information about how to import device drivers, see [Import Device Drivers into the Deployment Workbench](/mem/configmgr/mdt/use-the-mdt#ImportDeviceDriversintotheDeploymentWorkbench)|
+|3. Create MDT applications for Microsoft Store apps|Create an MDT application for each Microsoft Store app you want to deploy. You can deploy Microsoft Store apps by using sideloading, which allows you to use the **Add-AppxPackage** Windows PowerShell cmdlet to deploy the .appx files associated with the app (called provisioned apps). Use this method to deploy up to 24 apps to Windows 10. Prior to sideloading the .appx files, obtain the Microsoft Store .appx files that you will use to deploy (sideload) the apps in your provisioning package. For apps in Microsoft Store, you will need to obtain the .appx files by performing one of the following tasks:
For offline-licensed apps, download the .appx files from the Microsoft Store for Business.
For apps that are not offline licensed, obtain the .appx files from the app software vendor directly.
If you are unable to obtain the .appx files from the app software vendor, then you or the students will need to install the apps on the student devices directly from Microsoft Store or Microsoft Store for Business. If you have Intune or Microsoft Endpoint Configuration Manager, you can deploy Microsoft Store apps after you deploy Windows 10, as described in the [Deploy and manage apps by using Intune](#deploy-and-manage-apps-by-using-intune) and [Deploy and manage apps by using Microsoft Endpoint Configuration Manager](#deploy-and-manage-apps-by-using-microsoft-endpoint-configuration-manager). This method provides granular deployment of Microsoft Store apps, and you can use it for ongoing management of Microsoft Store apps. This is the preferred method of deploying and managing Microsoft Store apps. In addition, you must prepare your environment for sideloading Microsoft Store apps. For more information about how to:
Prepare your environment for sideloading, see [Try it out: sideload Microsoft Store apps](/previous-versions/windows/).
Create an MDT application, see [Create a New Application in the Deployment Workbench](/mem/configmgr/mdt/use-the-mdt#CreateaNewApplicationintheDeploymentWorkbench).|
+|4. Create MDT applications for Windows desktop apps|You need to create an MDT application for each Windows desktop app you want to deploy. You can obtain the Windows desktop apps from any source, but ensure that you have sufficient licenses for them. To help reduce the effort needed to deploy Microsoft Office 2016 desktop apps, use the Office Deployment Tool, as described in[Deploy Click-to-Run for Office 365 products by using the Office Deployment Tool](/deployoffice/deploy-microsoft-365-apps-local-source). If you have Intune, you can [Deploy and manage apps by using Intune](#deploy-and-manage-apps-by-using-intune), as described in the Deploy and manage apps by using Intune section. This method provides granular deployment of Windows desktop apps, and you can use it for ongoing management of the apps. This is the preferred method for deploying and managing Windows desktop apps. **Note:** You can also deploy Windows desktop apps after you deploy Windows 10, as described in the [Deploy and manage apps by using Intune](#deploy-and-manage-apps-by-using-intune) For more information about how to create an MDT application for Windows desktop apps, see [Create a New Application in the Deployment Workbench](/mem/configmgr/mdt/use-the-mdt).|
+|5. Create task sequences|You must create separate task sequences for each Windows 10 edition, processor architecture, operating system upgrade process, and new operating system deployment process. Minimally, create a task sequence for each Windows 10 operating system you imported in step 1—for example, (1) if you want to deploy Windows 10 Education to new devices or refresh existing devices with a new deployment of Windows 10 Education, (2) if you want to upgrade existing devices running Windows 8.1 or Windows 7 to Windows 10 Education, or (3) if you want to run deployments and upgrades for both 32-bit and 64-bit versions of Windows 10. To do so, you must create task sequences that will:
Deploy 64-bit Windows 10 Education to devices.
Deploy 32-bit Windows 10 Education to devices.
Upgrade existing devices to 64-bit Windows 10 Education.
Upgrade existing devices to 32-bit Windows 10 Education.
Again, you will create the task sequences based on the operating systems that you imported in step 1. For more information about how to create a task sequence, see [Create a New Task Sequence in the Deployment Workbench](/mem/configmgr/mdt/use-the-mdt#CreateaNewTaskSequenceintheDeploymentWorkbench).|
+|6. Update the deployment share|Updating a deployment share generates the MDT boot images you use to initiate the Windows 10 deployment process. You can configure the process to create 32-bit and 64-bit versions of the .iso and .wim files you can use to create bootable media or in Windows Deployment Services. For more information about how to update a deployment share, see [Update a Deployment Share in the Deployment Workbench](/mem/configmgr/mdt/use-the-mdt#UpdateaDeploymentShareintheDeploymentWorkbench).|
*Table 16. Tasks to configure the MDT deployment share*
@@ -1276,7 +903,7 @@ Deploying a new Configuration Manager infrastructure is beyond the scope of this
Create a Configuration Manager application for each Windows desktop or Microsoft Store app that you want to deploy after you apply the reference image to a device. For more information, see [Deploy and manage applications with Configuration Manager](/mem/configmgr/apps/deploy-use/deploy-applications).
-### Configure Window Deployment Services for MDT
+### Configure Windows Deployment Services for MDT
You can use Windows Deployment Services in conjunction with MDT to automatically initiate boot images on target devices. These boot images can be Windows PE images (which you generated in step 6 in Table 16) or custom images that can deploy operating systems directly to the target devices.
@@ -1298,7 +925,7 @@ You can use Windows Deployment Services in conjunction with MDT to automatically
For more information about how to perform this step, see [Add LTI Boot Images to Windows Deployment Services](/mem/configmgr/mdt/use-the-mdt#AddLTIBootImagestoWindowsDeploymentServices).
-### Configure Window Deployment Services for Microsoft Endpoint Configuration Manager
+### Configure Windows Deployment Services for Microsoft Endpoint Configuration Manager
> [!NOTE]
> If you have already configured your Microsoft Endpoint Manager infrastructure to support PXE boot or selected to deploy Windows 10 by using MDT only, then skip this section and continue to the next.
@@ -1430,116 +1057,20 @@ Microsoft has several recommended settings for educational institutions. Table 1
Use the information in Table 17 to help you determine whether you need to configure the setting and which method you will use to do so. At the end, you will have a list of settings that you want to apply to the Windows 10 devices and know which management method you will use to configure the settings.
-
-
-
-
-
-
-
-
-
Recommendation
-
Description
-
-
-
-
-
-
-
Use of Microsoft accounts
-
You want faculty and students to use only Azure AD accounts for institution-owned devices. For these devices, do not use Microsoft accounts or associate a Microsoft account with the Azure AD accounts.
-
-**Note** Personal devices typically use Microsoft accounts. Faculty and students can associate their Microsoft account with their Azure AD account on these devices.
-**Group Policy.** Configure the [Accounts: Block Microsoft accounts](/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/jj966262(v=ws.11)) Group Policy setting to use the **Users can’t add Microsoft accounts** setting option.
-**Intune.** To enable or disable the use of Microsoft accounts, use the **Allow Microsoft account**, **Allow adding non-Microsoft accounts manually**, and **Allow settings synchronization for Microsoft accounts** policy settings under the **Accounts and Synchronization** section of a **Windows 10 General Configuration** policy.
-
-
-
-
-
-
Restrict the local administrator accounts on the devices
-
Ensure that only authorized users are local administrators on institution-owned devices. Typically, you don’t want students to be administrators on instruction-owned devices. Explicitly specify the users who will be local administrators on a group of devices.
-Group Policy. Create a Local Group Group Policy preference to limit the local administrators group membership. Select the Delete all member users and Delete all member groups check boxes to remove any existing members. For more information about how to configure Local Group preferences, see Configure a Local Group Item.
-Intune. Not available.
-
-
-
-
-
-
Manage the built-in administrator account created during device deployment
-
When you use MDT to deploy Windows 10, the MDT deployment process automatically creates a local Administrator account with the password you specified. As a security best practice, rename the built-in Administrator account and (optionally) disable it.
-Group Policy. To rename the built-in Administrator account, use the Accounts: Rename administrator account Group Policy setting. For more information about how to rename the built-in Administrator account, see To rename the Administrator account using the Group Policy Management Console. You specify the new name for the Administrator account. To disable the built-in Administrator account, use the Accounts: Administrator account status Group Policy setting. For more information about how to disable the built-in Administrator account, see Accounts: Administrator account status.
-Intune. Not available.
-
-
-
-
-
-
Control Microsoft Store access
-
You can control access to Microsoft Store and whether existing Microsoft Store apps receive updates. You can only disable the Microsoft Store app in Windows 10 Education and Windows 10 Enterprise.
-Group Policy. To disable the Microsoft Store app, use the Turn off the Store Application group policy setting. To prevent Microsoft Store apps from receiving updates, use the Turn off Automatic Download and Install of updates Group Policy setting. For more information about configuring these settings, see Can I use Group Policy to control the Microsoft Store in my enterprise environment?.
-Intune. To enable or disable Microsoft Store access, use the Allow application store policy setting in the Apps section of a Windows 10 General Configuration policy.
-
-
-
-
-
-
Use of Remote Desktop connections to devices
-
Remote Desktop connections could allow unauthorized access to the device. Depending on your institution’s policies, you may want to disable Remote Desktop connections on your devices.
-Group Policy. To enable or disable Remote Desktop connections to devices, use the Allow Users to connect remotely using Remote Desktop setting in Computer Configuration\Policies\Administrative Templates\Windows Components\Remote Desktop Services\Remote Desktop Session Host\Connections.
-Intune. Not available.
-
-
-
+|Recommendation|Description|
+|--- |--- |
+|Use of Microsoft accounts|You want faculty and students to use only Azure AD accounts for institution-owned devices. For these devices, do not use Microsoft accounts or associate a Microsoft account with the Azure AD accounts. **Note** Personal devices typically use Microsoft accounts. Faculty and students can associate their Microsoft account with their Azure AD account on these devices. **Group Policy.** Configure the [Accounts: Block Microsoft accounts](/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/jj966262(v=ws.11)) Group Policy setting to use the **Users can’t add Microsoft accounts** setting option. ****Intune**.** To enable or disable the use of Microsoft accounts, use the **Allow Microsoft account**, **Allow adding non-Microsoft accounts manually**, and **Allow settings synchronization for Microsoft accounts** policy settings under the **Accounts and Synchronization** section of a **Windows 10 General Configuration** policy.|
+|Restrict the local administrator accounts on the devices|Ensure that only authorized users are local administrators on institution-owned devices. Typically, you don’t want students to be administrators on instruction-owned devices. Explicitly specify the users who will be local administrators on a group of devices. **Group Policy**. Create a Local Group Group Policy preference to limit the local administrators group membership. Select the Delete all member users and Delete all member groups check boxes to remove any existing members. For more information about how to configure Local Group preferences, see Configure a Local Group Item. **Intune**. Not available.|
+|Manage the built-in administrator account created during device deployment|When you use MDT to deploy Windows 10, the MDT deployment process automatically creates a local Administrator account with the password you specified. As a security best practice, rename the built-in Administrator account and (optionally) disable it. **Group Policy**. To rename the built-in Administrator account, use the Accounts: Rename administrator account Group policy setting. For more information about how to rename the built-in Administrator account, see [To rename the Administrator account using the Group Policy Management Console](/previous-versions/windows/it-pro/windows-server-essentials-sbs/cc747484(v=ws.10)). You specify the new name for the Administrator account. To disable the built-in Administrator account, use the Accounts: Administrator account status Group policy setting. For more information about how to disable the built-in Administrator account, see [Accounts: Administrator account status](/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/jj852165(v=ws.11)). **Intune**. Not available.|
+|Control Microsoft Store access|You can control access to Microsoft Store and whether existing Microsoft Store apps receive updates. You can only disable the Microsoft Store app in Windows 10 Education and Windows 10 Enterprise. **Group policy**. To disable the Microsoft Store app, use the Turn off the Store Application group policy setting. To prevent Microsoft Store apps from receiving updates, use the Turn off Automatic Download and Install of updates Group Policy setting. For more information about configuring these settings, see Can I use Group Policy to control the Microsoft Store in my enterprise environment? **Intune**. To enable or disable Microsoft Store access, use the Allow application store policy setting in the Apps section of a Windows 10 General Configuration policy.|
+|Use of Remote Desktop connections to devices|Remote Desktop connections could allow unauthorized access to the device. Depending on your institution’s policies, you may want to disable Remote Desktop connections on your devices. **Group policy**. To enable or disable Remote Desktop connections to devices, use the Allow Users to connect remotely using Remote Desktop setting in Computer Configuration\Policies\Administrative Templates\Windows Components\Remote Desktop Services\Remote Desktop Session Host\Connections. **Intune**. Not available.|
+|Use of camera|A device’s camera can be a source of disclosure or privacy issues in an education environment. Depending on your institution’s policies, you may want to disable the camera on your devices. **Group policy**. Not available. **Intune**. To enable or disable the camera, use the Allow camera policy setting in the Hardware section of a Windows 10 General Configuration policy.|
+|Use of audio recording|Audio recording (by using the Sound Recorder app) can be a source of disclosure or privacy issues in an education environment. Depending on your institution’s policies, you may want to disable the Sound Recorder app on your devices. **Group policy**. To disable the Sound Recorder app, use the Do not allow Sound Recorder to run Group Policy setting. You can disable other audio recording apps by using AppLocker policies. To create AppLocker policies, use the information in [Editing an AppLocker Policy](/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/ee791894(v=ws.10)) and [Create Your AppLocker Policies](/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/ee791899(v=ws.11)). **Intune**. To enable or disable audio recording, use the Allow voice recording policy setting in the Features section of a Windows 10 General Configuration policy.|
+|Use of screen capture|Screen captures can be a source of disclosure or privacy issues in an education environment. Depending on your institution’s policies, you may want to disable the ability to perform screen captures on your devices. **Group policy**. Not available. **Intune**. To enable or disable screen capture, use the Allow screen capture policy setting in the System section of a Windows 10 General Configuration policy.|
+|Use of location services|Providing a device’s location can be a source of disclosure or privacy issues in an education environment. Depending on your institution’s policies, you may want to disable the location service on your devices. **Group policy**. To enable or disable location services, use the Turn off location group policy setting in User Configuration\Windows Components\Location and Sensors. **Intune**. To enable or disable location services, use the Allow geolocation policy setting in the Hardware section of a Windows 10 General Configuration policy.|
+|Changing wallpaper|Custom wallpapers can be a source of disclosure or privacy issues in an education environment (if the wallpaper displays information about the user or device). Depending on your institution’s policies, you may want to prevent users from changing the wallpaper on institution-owned devices. **Group policy**. To configure the wallpaper, use the Desktop WallPaper setting in User Configuration\Administrative Templates\Desktop\Desktop. **Intune**. Not available.|
-
-
Use of camera
-
A device’s camera can be a source of disclosure or privacy issues in an education environment. Depending on your institution’s policies, you may want to disable the camera on your devices.
-Group Policy. Not available.
-Intune. To enable or disable the camera, use the Allow camera policy setting in the Hardware section of a Windows 10 General Configuration policy.
-
-
-
-
-
-
Use of audio recording
-
Audio recording (by using the Sound Recorder app) can be a source of disclosure or privacy issues in an education environment. Depending on your institution’s policies, you may want to disable the Sound Recorder app on your devices.
-Group Policy. To disable the Sound Recorder app, use the Do not allow Sound Recorder to run Group Policy setting. You can disable other audio recording apps by using AppLocker policies. To create AppLocker policies, use the information in Editing an AppLocker Policy and Create Your AppLocker Policies.
-Intune. To enable or disable audio recording, use the Allow voice recording policy setting in the Features section of a Windows 10 General Configuration policy.
-
-
-
-
-
-
Use of screen capture
-
Screen captures can be a source of disclosure or privacy issues in an education environment. Depending on your institution’s policies, you may want to disable the ability to perform screen captures on your devices.
-Group Policy. Not available.
-Intune. To enable or disable screen capture, use the Allow screen capture policy setting in the System section of a Windows 10 General Configuration policy.
-
-
-
-
-
-
Use of location services
-
Providing a device’s location can be a source of disclosure or privacy issues in an education environment. Depending on your institution’s policies, you may want to disable the location service on your devices.
-Group Policy. To enable or disable location services, use the Turn off location group policy setting in User Configuration\Windows Components\Location and Sensors.
-Intune. To enable or disable location services, use the Allow geolocation policy setting in the Hardware section of a Windows 10 General Configuration policy.
-
-
-
-
-
-
Changing wallpaper
-
Custom wallpapers can be a source of disclosure or privacy issues in an education environment (if the wallpaper displays information about the user or device). Depending on your institution’s policies, you may want to prevent users from changing the wallpaper on institution-owned devices.
-Group Policy. To configure the wallpaper, use the Desktop WallPaper setting in User Configuration\Administrative Templates\Desktop\Desktop.
-Intune. Not available.
-
-
-
-
-
-
Table 17. Recommended settings for educational institutions
@@ -1719,205 +1250,23 @@ After the initial deployment, you need to perform certain tasks to maintain the
Table 19 lists the school and individual classroom maintenance tasks, the resources for performing the tasks, and the schedule (or frequency) on which you should perform the tasks.
-
-
-
-
-
-
-
-
-
-
Task and resources
-
Monthly
-
New semester or academic year
-
As required
-
-
-
-
-
Verify that Windows Update is active and current with operating system and software updates.
-For more information about completing this task when you have:
-
Verify that you’re using the appropriate Windows 10 servicing options for updates and upgrades (such as selecting whether you want to use Current Branch or Current Branch for Business).
-For more information about Windows 10 servicing options for updates and upgrades, see Windows 10 servicing options.
-
-
-
x
-
x
-
-
-
-
Refresh the operating system and apps on devices.
-For more information about completing this task, see the following resources:
-
Install new or update existing Microsoft Store apps used in the curriculum.
-Microsoft Store apps are automatically updated from Microsoft Store. The menu bar in the Microsoft Store app shows whether any Microsoft Store app updates are available for download.
-You can also deploy Microsoft Store apps directly to devices by using Intune, Microsoft Endpoint Configuration Manager, or both in a hybrid configuration. For more information, see:
-
-
+|Task and resources|Monthly|New semester or academic year|As required|
+|--- |--- |--- |--- |
+|Verify that Windows Update is active and current with operating system and software updates. For more information about completing this task when you have:
Intune, see [Keep Windows PCs up to date with software updates in Microsoft Intune](/intune/deploy-use/keep-windows-pcs-up-to-date-with-software-updates-in-microsoft-intune)
Group Policy, see [Windows Update for Business](/windows/deployment/update/waas-manage-updates-wufb).
WSUS, see [Windows Server Update Services](/windows/deployment/deploy-whats-new). Neither Intune, Group Policy, nor WSUS, see “Install, upgrade, & activate” in Windows 10 help.|✔️|✔️|✔️|
+|Verify that Windows Defender is active and current with malware Security intelligence. For more information about completing this task, see [Turn Windows Defender on or off](https://support.microsoft.com/instantanswers/742778f2-6aad-4a8d-8f5d-db59cebc4f24/how-to-protect-your-windows-10-pc#v1h=tab02)and [Updating Windows Defender](https://support.microsoft.com/instantanswers/742778f2-6aad-4a8d-8f5d-db59cebc4f24/how-to-protect-your-windows-10-pc#v1h=tab03).|✔️|✔️|✔️|
+|Verify that Windows Defender has run a scan in the past week and that no viruses or malware were found. For more information about completing this task, see the “How do I find and remove a virus?” topic in [Protect my PC from viruses](https://support.microsoft.com/help/17228/windows-protect-my-pc-from-viruses).|✔️|✔️|✔️|
+|Download and approve updates for Windows 10, apps, device driver, and other software. For more information, see:
[Manage updates by using Intune](#manage-updates-by-using-intune)
[Manage updates by using Microsoft Endpoint Configuration Manager](#manage-updates-by-using-microsoft-endpoint-configuration-manager)|✔️|✔️|✔️|
+|Verify that you’re using the appropriate Windows 10 servicing options for updates and upgrades (such as selecting whether you want to use Current Branch or Current Branch for Business). For more information about Windows 10 servicing options for updates and upgrades, see [Windows 10 servicing options](/windows/deployment/update/).||✔️|✔️|
+|Refresh the operating system and apps on devices. For more information about completing this task, see the following resources:
[Prepare for deployment](#prepare-for-deployment)
[Capture the reference image](#capture-the-reference-image)
[Deploy Windows 10 to devices](#deploy-windows-10-to-devices)||✔️|✔️|
+|Install any new Windows desktop apps, or update any Windows desktop apps used in the curriculum. For more information, see:
[Deploy and manage apps by using Intune](#deploy-and-manage-apps-by-using-intune)
[Deploy and manage apps by using Microsoft Endpoint Configuration Manager](#deploy-and-manage-apps-by-using-microsoft-endpoint-configuration-manager)||✔️|✔️|
+|Install new or update existing Microsoft Store apps used in the curriculum. Microsoft Store apps are automatically updated from Microsoft Store. The menu bar in the Microsoft Store app shows whether any Microsoft Store app updates are available for download. You can also deploy Microsoft Store apps directly to devices by using Intune, Microsoft Endpoint Configuration Manager, or both in a hybrid configuration. For more information, see:
[Deploy and manage apps by using Intune](#deploy-and-manage-apps-by-using-intune)
[Deploy and manage apps by using Microsoft Endpoint Configuration Manager](#deploy-and-manage-apps-by-using-microsoft-endpoint-configuration-manager)||✔️|✔️|
+|Remove unnecessary user accounts (and corresponding licenses) from AD DS and Office 365 (if you have an on-premises AD DS infrastructure). For more information about how to:
Remove unnecessary user accounts, see [Active Directory Administrative Center](/windows-server/identity/ad-ds/get-started/adac/active-directory-administrative-center)
Remove licenses, see [Add users and assign licenses](/microsoft-365/admin/add-users/add-users)||✔️|✔️|
+|Add new accounts (and corresponding licenses) to AD DS (if you have an on-premises AD DS infrastructure). For more information about how to:
Add user accounts, see [Bulk-import user and group accounts into AD DS](#bulk-import-user-and-group-accounts-into-ad-ds)
Assign licenses, see [Add users and assign licenses](/microsoft-365/admin/add-users/add-users)||✔️|✔️|
+|Remove unnecessary user accounts (and corresponding licenses) from Office 365 (if you do not have an on-premises AD DS infrastructure). For more information about how to:
Remove unnecessary user accounts, see [Delete or restore users](/microsoft-365/admin/add-users/delete-a-user)
Remove licenses, [Assign or remove licenses for Microsoft 365](/microsoft-365/admin/add-users/add-users).||✔️|✔️|
+|Add new accounts (and corresponding licenses) to Office 365 (if you don’t have an on-premises AD DS infrastructure). For more information about how to:
Add user accounts, see [Add users to Microsoft 365](/microsoft-365/admin/add-users/add-users) and [Add users individually or in bulk to Office 365](https://www.youtube.com/watch?v=zDs3VltTJps).
Assign licenses, see [Add users to Microsoft 365](/microsoft-365/admin/add-users/add-users).||✔️|✔️|
+|Create or modify security groups, and manage group membership in Office 365. For more information about how to:
Create or modify security groups, see [Create a Microsoft 365 group](/microsoft-365/admin/create-groups/create-groups)
Manage group membership, see [Manage Group membership](/microsoft-365/admin/create-groups/add-or-remove-members-from-groups).||✔️|✔️|
+|Create or modify Exchange Online or Microsoft Exchange Server distribution lists in Office 365. For more information about how to create or modify Exchange Online or Exchange Server distribution lists in Office 365, see [Create and manage distribution groups](/exchange/recipients-in-exchange-online/manage-distribution-groups/manage-distribution-groups) and [Create, edit, or delete a security group](/microsoft-365/admin/email/create-edit-or-delete-a-security-group).||✔️|✔️|
+|Install new student devices. Follow the same steps you followed in the[Deploy Windows 10 to devices](#deploy-windows-10-to-devices) section.|||✔️|
*Table 19. School and individual classroom maintenance tasks, with resources and the schedule for performing them*
@@ -1936,4 +1285,4 @@ You have now identified the tasks you need to perform monthly, at the end of an
* [Manage Windows 10 updates and upgrades in a school environment (video)](./index.md)
* [Reprovision devices at the end of the school year (video)](./index.md)
* [Use MDT to deploy Windows 10 in a school (video)](./index.md)
-* [Use Microsoft Store for Business in a school environment (video)](./index.md)
\ No newline at end of file
+* [Use Microsoft Store for Business in a school environment (video)](./index.md)
diff --git a/education/windows/deploy-windows-10-in-a-school.md b/education/windows/deploy-windows-10-in-a-school.md
index d06c0039c5..c0e52a36d6 100644
--- a/education/windows/deploy-windows-10-in-a-school.md
+++ b/education/windows/deploy-windows-10-in-a-school.md
@@ -441,7 +441,7 @@ Several methods are available to bulk-import user accounts into AD DS domains. T
|---|---|
| **Ldifde.exe** | This command-line tool allows you to import and export objects (such as user accounts) from AD DS. Select this method if you aren’t comfortable with Microsoft Visual Basic Scripting Edition (VBScript), Windows PowerShell, or other scripting languages. For more information about using Ldifde.exe, see [Step-by-Step Guide to Bulk Import and Export to Active Directory](https://social.technet.microsoft.com/wiki/contents/articles/116.active-directory-step-by-step-guide-bulk-import-and-export.aspx), [LDIFDE—Export/Import data from Active Directory—LDIFDE commands](https://support.microsoft.com/kb/555636), [Import or Export Directory Objects Using Ldifde](/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/cc816781(v=ws.10)), and [LDIFDE](/previous-versions/orphan-topics/ws.10/cc755456(v=ws.10)). |
| **VBScript** | This scripting language uses the Active Directory Services Interfaces (ADSI) Component Object Model interface to manage AD DS objects, including user and group objects. Select this method if you’re comfortable with VBScript. For more information about using VBScript and ADSI, see [Step-by-Step Guide to Bulk Import and Export to Active Directory](https://social.technet.microsoft.com/wiki/contents/articles/116.active-directory-step-by-step-guide-bulk-import-and-export.aspx). |
-| **Windows PowerShell** | This scripting language natively supports cmdlets to manage AD DS objects, including user and group objects. Select this method if you’re comfortable with Window PowerShell scripting. For more information about using Windows PowerShell, see [Import Bulk Users to Active Directory](/archive/blogs/technet/bettertogether/import-bulk-users-to-active-directory) and [PowerShell: Bulk create AD Users from CSV file](https://social.technet.microsoft.com/wiki/contents/articles/24541.powershell-bulk-create-ad-users-from-csv-file.aspx). |
+| **Windows PowerShell** | This scripting language natively supports cmdlets to manage AD DS objects, including user and group objects. Select this method if you’re comfortable with Windows PowerShell scripting. For more information about using Windows PowerShell, see [Import Bulk Users to Active Directory](/archive/blogs/technet/bettertogether/import-bulk-users-to-active-directory) and [PowerShell: Bulk create AD Users from CSV file](https://social.technet.microsoft.com/wiki/contents/articles/24541.powershell-bulk-create-ad-users-from-csv-file.aspx). |
---
@@ -670,13 +670,13 @@ The first step in preparation for Windows 10 deployment is to configure—that i
| **1. Import operating systems** | Import the operating systems that you selected in the [Select operating systems](#select-the-operating-systems) section into the deployment share. For more information about how to import operating systems, see [Import an Operating System into the Deployment Workbench](/mem/configmgr/mdt/use-the-mdt#ImportanOperatingSystemintotheDeploymentWorkbench). |
| **2. Import device drives** | Device drivers allow Windows 10 to know a device’s hardware resources and connected hardware accessories. Without the proper device drivers, certain features may be unavailable. For example, without the proper audio driver, a device cannot play sounds; without the proper camera driver, the device cannot take photos or use video chat.
Import device drivers for each device in your institution. For more information about how to import device drivers, see [Import Device Drivers into the Deployment Workbench](/mem/configmgr/mdt/use-the-mdt#ImportDeviceDriversintotheDeploymentWorkbench). |
| **3. Create MDT applications for Microsoft Store apps** | Create an MDT application for each Microsoft Store app you want to deploy. You can deploy Microsoft Store apps by using sideloading, which allows you to use the Add-AppxPackage Windows PowerShell cmdlet to deploy the .appx files associated with the app (called provisioned apps). Use this method to deploy up to 24 apps to Windows 10.
Prior to sideloading the .appx files, obtain the Microsoft Store .appx files that you will use to deploy (sideload) the apps in your provisioning package. For apps in Microsoft Store, you will need to obtain the .appx files from the app software vendor directly. If you are unable to obtain the .appx files from the app software vendor, then you or the students will need to install the apps on the student devices directly from Microsoft Store or Microsoft Store for Business.
If you have Intune, you can deploy Microsoft Store apps after you deploy Windows 10, as described in the [Deploy apps by using Intune](#deploy-apps-by-using-intune) section. This method provides granular deployment of Microsoft Store apps, and you can use it for ongoing management of Microsoft Store apps. This is the preferred method of deploying and managing Microsoft Store apps.
In addition, you must prepare your environment for sideloading (deploying) Microsoft Store apps. For more information about how to:
- Prepare your environment for sideloading, see [Sideload LOB apps in Windows 10](/windows/application-management/sideload-apps-in-windows-10). - Create an MDT application, see [Create a New Application in the Deployment Workbench](/mem/configmgr/mdt/use-the-mdt#CreateaNewApplicationintheDeploymentWorkbench). |
-| **4. Create MDT applications for Windows desktop apps** | You need to create an MDT application for each Windows desktop app you want to deploy. You can obtain the Windows desktop apps from any source, but ensure that you have sufficient licenses for them.
To help reduce the effort needed to deploy Microsoft Office 2016 desktop apps, use the Office Deployment Tool, as described in [Deploy Click-to-Run for Office 365 products by using the Office Deployment Tool](/deployoffice/deploy-microsoft-365-apps-local-source?f=255&MSPPError=-2147217396).
If you have Intune, you can deploy Windows desktop apps after you deploy Windows 10, as described in the [Deploy apps by using Intune](#deploy-apps-by-using-intune) section. This method provides granular deployment of Windows desktop apps, and you can use it for ongoing management of the apps. This is the preferred method for deploying and managing Windows desktop apps.
You can also deploy Windows desktop apps after you deploy Windows 10, as described in the [Deploy apps by using Intune](#deploy-apps-by-using-intune) section.
For more information about how to create an MDT application for Window desktop apps, see [Create a New Application in the Deployment Workbench](/mem/configmgr/mdt/use-the-mdt#CreateaNewApplicationintheDeploymentWorkbench). |
+| **4. Create MDT applications for Windows desktop apps** | You need to create an MDT application for each Windows desktop app you want to deploy. You can obtain the Windows desktop apps from any source, but ensure that you have sufficient licenses for them.
To help reduce the effort needed to deploy Microsoft Office 2016 desktop apps, use the Office Deployment Tool, as described in [Deploy Click-to-Run for Office 365 products by using the Office Deployment Tool](/deployoffice/deploy-microsoft-365-apps-local-source?f=255&MSPPError=-2147217396).
If you have Intune, you can deploy Windows desktop apps after you deploy Windows 10, as described in the [Deploy apps by using Intune](#deploy-apps-by-using-intune) section. This method provides granular deployment of Windows desktop apps, and you can use it for ongoing management of the apps. This is the preferred method for deploying and managing Windows desktop apps.
You can also deploy Windows desktop apps after you deploy Windows 10, as described in the [Deploy apps by using Intune](#deploy-apps-by-using-intune) section.
For more information about how to create an MDT application for Windows desktop apps, see [Create a New Application in the Deployment Workbench](/mem/configmgr/mdt/use-the-mdt#CreateaNewApplicationintheDeploymentWorkbench). |
| **5. Create task sequences.** | You must create a separate task sequence for each Windows 10 edition, processor architecture, operating system upgrade process, and new operating system deployment process. Minimally, create a task sequence for each Windows 10 operating system you imported in Step 1—for example, (1) if you want to deploy Windows 10 Education to new devices or refresh existing devices with a new deployment of Windows 10 Education; (2) if you want to upgrade existing devices running Windows 8.1 or Windows 7 to Windows 10 Education; or (3) if you want to run deployments and upgrades for both 32 bit and 64-bit versions of Windows 10. To do so, you must create task sequences that will:
- Deploy Windows 10 Education 64-bit to devices. - Deploy Windows 10 Education 32-bit to devices. - Upgrade existing devices to Windows 10 Education 64-bit. - Upgrade existing devices to Windows 10 Education 32-bit.
Again, you will create the task sequences based on the operating systems that you imported in Step 1. For more information about how to create a task sequence, see [Create a New Task Sequence in the Deployment Workbench](/mem/configmgr/mdt/use-the-mdt#CreateaNewTaskSequenceintheDeploymentWorkbench). |
| **6. Update the deployment share.** | Updating a deployment share generates the MDT boot images you use to initiate the Windows 10 deployment process. You can configure the process to create 32 bit and 64-bit versions of the .iso and .wim files you can use to create bootable media or in Windows Deployment Services.
For more information about how to update a deployment share, see [Update a Deployment Share in the Deployment Workbench](/mem/configmgr/mdt/use-the-mdt#UpdateaDeploymentShareintheDeploymentWorkbench).|
---
-### Configure Window Deployment Services for MDT
+### Configure Windows Deployment Services for MDT
You can use Windows Deployment Services with MDT to automatically initiate boot images on target computers. These boot images can be Windows PE images (which you generated in Step 6 in Table 9) or custom images that can deploy operating systems directly to the target computers.
diff --git a/education/windows/school-get-minecraft.md b/education/windows/school-get-minecraft.md
index a728b75a41..38b068d300 100644
--- a/education/windows/school-get-minecraft.md
+++ b/education/windows/school-get-minecraft.md
@@ -250,7 +250,7 @@ You'll download a .zip file, extract the files, and then use one of the files to
Ihv_Configuring --> Configuring --> Associating --> Authenticating --> Connected
+ Reset --> Ihv_Configuring --> Configuring --> Associating --> Authenticating --> Connected
-**Disconnecting**
+- Disconnecting
-Connected --> Roaming --> Wait_For_Disconnected --> Disconnected --> Reset
+ Connected --> Roaming --> Wait_For_Disconnected --> Disconnected --> Reset
->Filtering the ETW trace with the [TextAnalysisTool](https://github.com/TextAnalysisTool/Releases) (TAT) is an easy first step to determine where a failed connection setup is breaking down. A useful [wifi filter file](#wifi-filter-file) is included at the bottom of this article.
+Filtering the ETW trace with the [TextAnalysisTool](https://github.com/TextAnalysisTool/Releases) (TAT) is an easy first step to determine where a failed connection setup is breaking down. A useful [wifi filter file](#wifi-filter-file) is included at the bottom of this article.
Use the **FSM transition** trace filter to see the connection state machine. You can see [an example](#textanalysistool-example) of this filter applied in the TAT at the bottom of this page.
The following is an example of a good connection setup:
-
+```console
44676 [2]0F24.1020::2018-09-17 10:22:14.658 [Microsoft-Windows-WLAN-AutoConfig]FSM Transition from State: Disconnected to State: Reset
45473 [1]0F24.1020::2018-09-17 10:22:14.667 [Microsoft-Windows-WLAN-AutoConfig]FSM Transition from State: Reset to State: Ihv_Configuring
45597 [3]0F24.1020::2018-09-17 10:22:14.708 [Microsoft-Windows-WLAN-AutoConfig]FSM Transition from State: Ihv_Configuring to State: Configuring
46085 [2]0F24.17E0::2018-09-17 10:22:14.710 [Microsoft-Windows-WLAN-AutoConfig]FSM Transition from State: Configuring to State: Associating
47393 [1]0F24.1020::2018-09-17 10:22:14.879 [Microsoft-Windows-WLAN-AutoConfig]FSM Transition from State: Associating to State: Authenticating
49465 [2]0F24.17E0::2018-09-17 10:22:14.990 [Microsoft-Windows-WLAN-AutoConfig]FSM Transition from State: Authenticating to State: Connected
-
+```
The following is an example of a failed connection setup:
-
+```console
44676 [2]0F24.1020::2018-09-17 10:22:14.658 [Microsoft-Windows-WLAN-AutoConfig]FSM Transition from State: Disconnected to State: Reset
45473 [1]0F24.1020::2018-09-17 10:22:14.667 [Microsoft-Windows-WLAN-AutoConfig]FSM Transition from State: Reset to State: Ihv_Configuring
45597 [3]0F24.1020::2018-09-17 10:22:14.708 [Microsoft-Windows-WLAN-AutoConfig]FSM Transition from State: Ihv_Configuring to State: Configuring
46085 [2]0F24.17E0::2018-09-17 10:22:14.710 [Microsoft-Windows-WLAN-AutoConfig]FSM Transition from State: Configuring to State: Associating
47393 [1]0F24.1020::2018-09-17 10:22:14.879 [Microsoft-Windows-WLAN-AutoConfig]FSM Transition from State: Associating to State: Authenticating
49465 [2]0F24.17E0::2018-09-17 10:22:14.990 [Microsoft-Windows-WLAN-AutoConfig]FSM Transition from State: Authenticating to State: Roaming
-
+```
By identifying the state at which the connection fails, one can focus more specifically in the trace on logs just prior to the last known good state.
@@ -159,7 +154,7 @@ Enable the **FSM transition, SecMgr Transition,** and **AuthMgr Transition** fil
Continuing with the example above, the combined filters look like this:
-
+```console
[2] 0C34.2FF0::08/28/17-13:24:28.693 [Microsoft-Windows-WLAN-AutoConfig]FSM Transition from State:
Reset to State: Ihv_Configuring
[2] 0C34.2FF0::08/28/17-13:24:28.693 [Microsoft-Windows-WLAN-AutoConfig]FSM Transition from State:
@@ -177,7 +172,7 @@ Associating to State: Authenticating
[2] 0C34.2FF0::08/28/17-13:24:29.7512788 [Microsoft-Windows-WLAN-AutoConfig]Port[13] Peer 8A:15:14:B6:25:10 SecMgr Transition DEACTIVATE (11) --> INACTIVE (1)
[2] 0C34.2FF0::08/28/17-13:24:29.7513404 [Microsoft-Windows-WLAN-AutoConfig]FSM Transition from State:
Authenticating to State: Roaming
-
+```
> [!NOTE]
> In the next to last line the SecMgr transition is suddenly deactivating:
@@ -186,7 +181,7 @@ Authenticating to State: Roaming
Enabling the **Microsoft-Windows-WLAN-AutoConfig** filter will show more detail leading to the DEACTIVATE transition:
-
+```console
[3] 0C34.2FE8::08/28/17-13:24:28.902 [Microsoft-Windows-WLAN-AutoConfig]FSM Transition from State:
Associating to State: Authenticating
[1] 0C34.275C::08/28/17-13:24:28.960 [Microsoft-Windows-WLAN-AutoConfig]Port[13] Peer 8A:15:14:B6:25:10 SecMgr Transition START AUTH (3) --> WAIT FOR AUTH SUCCESS (4)
@@ -200,7 +195,7 @@ Associating to State: Authenticating
[2] 0C34.2FF0::08/28/17-13:24:29.7512788 [Microsoft-Windows-WLAN-AutoConfig]Port[13] Peer 8A:15:14:B6:25:10 SecMgr Transition DEACTIVATE (11) --> INACTIVE (1)
[2] 0C34.2FF0::08/28/17-13:24:29.7513404 [Microsoft-Windows-WLAN-AutoConfig]FSM Transition from State:
Authenticating to State: Roaming
-
+```
The trail backwards reveals a **Port Down** notification:
@@ -212,7 +207,7 @@ Below, the MSM is the native wifi stack. These are Windows native wifi drivers w
Enable trace filter for **[Microsoft-Windows-NWifi]:**
-
+```console
+[0]0000.0000::08/28/17-13:24:29.127 [Microsoft-Windows-NWiFi]DisAssoc: 0x8A1514B62510 Reason: 0x4
+```
This is followed by **PHY_STATE_CHANGE** and **PORT_DOWN** events due to a disassociate coming from the Access Point (AP), as an indication to deny the connection. This could be due to invalid credentials, connection parameters, loss of signal/roaming, and various other reasons for aborting a connection. The action here would be to examine the reason for the disassociate sent from the indicated AP MAC (8A:15:14:B6:25:10). This would be done by examining internal logging/tracing from the AP.
@@ -242,7 +239,7 @@ This is followed by **PHY_STATE_CHANGE** and **PORT_DOWN** events due to a disas
## Example ETW capture
-
+```
## Wifi filter file
Copy and paste all the lines below and save them into a text file named "wifi.tat." Load the filter file into the TextAnalysisTool by clicking **File > Load Filters**.
-```
+```xml
@@ -327,4 +324,4 @@ Copy and paste all the lines below and save them into a text file named "wifi.ta
In the following example, the **View** settings are configured to **Show Only Filtered Lines**.
-
\ No newline at end of file
+
diff --git a/windows/client-management/change-default-removal-policy-external-storage-media.md b/windows/client-management/change-default-removal-policy-external-storage-media.md
index d59710d70b..8b0e587b74 100644
--- a/windows/client-management/change-default-removal-policy-external-storage-media.md
+++ b/windows/client-management/change-default-removal-policy-external-storage-media.md
@@ -3,7 +3,7 @@ title: Windows 10 default media removal policy
description: In Windows 10, version 1809, the default removal policy for external storage media changed from "Better performance" to "Quick removal."
ms.prod: w10
author: Teresa-Motiv
-ms.author: v-tea
+ms.author: dougeby
ms.date: 11/25/2020
ms.topic: article
ms.custom:
diff --git a/windows/client-management/connect-to-remote-aadj-pc.md b/windows/client-management/connect-to-remote-aadj-pc.md
index 87a70ff761..5c5047248c 100644
--- a/windows/client-management/connect-to-remote-aadj-pc.md
+++ b/windows/client-management/connect-to-remote-aadj-pc.md
@@ -13,6 +13,7 @@ ms.date: 09/14/2021
ms.reviewer:
manager: dansimp
ms.topic: article
+ms.collection: highpri
---
# Connect to remote Azure Active Directory-joined PC
@@ -20,7 +21,7 @@ ms.topic: article
**Applies to**
-- Windows 10
+- Windows 10
- Windows 11
@@ -72,7 +73,7 @@ Ensure [Remote Credential Guard](/windows/access-protection/remote-credential-gu
> When you connect to the remote PC, enter your account name in this format: AzureAD\yourloginid@domain.com.
> [!NOTE]
- > If you cannot connect using Remote Desktop Connection 6.0, you must turn off the new features of RDP 6.0 and revert back to RDP 5.0 by making a few changes in the RDP file. See the details in this [support article](https://support.microsoft.com/help/941641/remote-desktop-connection-6-0-prompts-you-for-credentials-before-you-e).
+ > If you cannot connect using Remote Desktop Connection 6.0, you must turn off the new features of RDP 6.0 and revert back to RDP 5.0 by making a few changes in the RDP file. See the details in this [support article](/troubleshoot/windows-server/remote/remote-desktop-connection-6-prompts-credentials).
## Supported configurations
diff --git a/windows/client-management/determine-appropriate-page-file-size.md b/windows/client-management/determine-appropriate-page-file-size.md
index da6bb869ab..be28170923 100644
--- a/windows/client-management/determine-appropriate-page-file-size.md
+++ b/windows/client-management/determine-appropriate-page-file-size.md
@@ -10,6 +10,7 @@ ms.author: delhan
ms.date: 8/28/2019
ms.reviewer: dcscontentpm
manager: dansimp
+ms.collection: highpri
---
# How to determine the appropriate page file size for 64-bit versions of Windows
@@ -66,7 +67,7 @@ Kernel memory crash dumps require enough page file space or dedicated dump file
Computers that are running Microsoft Windows or Microsoft Windows Server usually must have a page file to support a system crash dump. System administrators now have the option to create a dedicated dump file instead.
-A dedicated dump file is a page file that is not used for paging. Instead, it is “dedicated” to back a system crash dump file (Memory.dmp) when a system crash occurs. Dedicated dump files can be put on any disk volume that can support a page file. We recommend that you use a dedicated dump file if you want a system crash dump but you do not want a page file.
+A dedicated dump file is a page file that is not used for paging. Instead, it is “dedicated” to back a system crash dump file (Memory.dmp) when a system crash occurs. Dedicated dump files can be put on any disk volume that can support a page file. We recommend that you use a dedicated dump file if you want a system crash dump but you do not want a page file. To learn how to create it, see [Overview of memory dump file options for Windows](/troubleshoot/windows-server/performance/memory-dump-file-options).
## System-managed page files
diff --git a/windows/client-management/generate-kernel-or-complete-crash-dump.md b/windows/client-management/generate-kernel-or-complete-crash-dump.md
index e0a26c9402..12bd194bc7 100644
--- a/windows/client-management/generate-kernel-or-complete-crash-dump.md
+++ b/windows/client-management/generate-kernel-or-complete-crash-dump.md
@@ -10,6 +10,7 @@ ms.author: delhan
ms.date: 8/28/2019
ms.reviewer:
manager: willchen
+ms.collection: highpri
---
# Generate a kernel or complete crash dump
diff --git a/windows/client-management/group-policies-for-enterprise-and-education-editions.md b/windows/client-management/group-policies-for-enterprise-and-education-editions.md
index c9150ce005..3d50f1d30a 100644
--- a/windows/client-management/group-policies-for-enterprise-and-education-editions.md
+++ b/windows/client-management/group-policies-for-enterprise-and-education-editions.md
@@ -32,7 +32,7 @@ In Windows 10, version 1607, the following Group Policy settings apply only to W
| **Do not show Windows Tips** | Computer Configuration > Administrative Templates > Windows Components > Cloud Content | For more info, see [Windows spotlight on the lock screen](/windows/configuration/windows-spotlight) |
| **Force a specific default lock screen image** | Computer Configuration > Administrative Templates > Control Panel > Personalization | For more info, see [Windows spotlight on the lock screen](/windows/configuration/windows-spotlight) |
| **Start layout** | User Configuration\Administrative Templates\Start Menu and Taskbar | In Windows 10, version 1703, this policy setting can be applied to Windows 10 Pro. For more info, see [Manage Windows 10 Start layout options and policies](/windows/configuration/windows-10-start-layout-options-and-policies) |
-| **Turn off the Store application** | Computer Configuration > Administrative Templates > Windows Components > Store > Turn off the Store application
User Configuration > Administrative Templates > Windows Components > Store > Turn off the Store application | For more info, see [Knowledge Base article# 3135657](https://support.microsoft.com/kb/3135657). |
+| **Turn off the Store application** | Computer Configuration > Administrative Templates > Windows Components > Store > Turn off the Store application
User Configuration > Administrative Templates > Windows Components > Store > Turn off the Store application | For more info, see [Knowledge Base article# 3135657](/troubleshoot/windows-client/group-policy/cannot-disable-microsoft-store). |
| **Only display the private store within the Microsoft Store app** | Computer Configuration > Administrative Templates > Windows Components > Store > Only display the private store within the Microsoft Store app
User Configuration > Administrative Templates > Windows Components > Store > Only display the private store within the Microsoft Store app | For more info, see [Manage access to private store](/microsoft-store/manage-access-to-private-store) |
| **Don't search the web or display web results** | Computer Configuration\Administrative Templates\Windows Components\Search\Don't search the web or display web results | For more info, see [Cortana integration in your enterprise](/windows/configuration/cortana-at-work/cortana-at-work-overview) |
diff --git a/windows/client-management/index.yml b/windows/client-management/index.yml
index e5ae09ccb3..f12a0ac603 100644
--- a/windows/client-management/index.yml
+++ b/windows/client-management/index.yml
@@ -10,7 +10,9 @@ metadata:
ms.service: windows-10 #Required; service per approved list. service slug assigned to your service by ACOM.
ms.subservice: subservice
ms.topic: landing-page # Required
- ms.collection: windows-10
+ ms.collection:
+ - windows-10
+ - highpri
author: greg-lindsay #Required; your GitHub user alias, with correct capitalization.
ms.author: greglin #Required; microsoft alias of author; optional team alias.
ms.date: 08/05/2021 #Required; mm/dd/yyyy format.
diff --git a/windows/client-management/introduction-page-file.md b/windows/client-management/introduction-page-file.md
index 9354d9c8c9..329d185fad 100644
--- a/windows/client-management/introduction-page-file.md
+++ b/windows/client-management/introduction-page-file.md
@@ -9,6 +9,7 @@ ms.localizationpriority: medium
ms.author: delhan
ms.reviewer: dcscontentpm
manager: dansimp
+ms.collection: highpri
---
# Introduction to page files
@@ -27,20 +28,20 @@ Page files enable the system to remove infrequently accessed modified pages from
Some products or services require a page file for various reasons. For specific information, check the product documentation.
-For example, the following Windows servers requires page files:
+For example, the following Windows servers require page files:
- Windows Server domain controllers (DCs)
- DFS Replication (DFS-R) servers
- Certificate servers
- ADAM/LDS servers
-This is because the algorithm of the database cache for Extensible Storage Engine (ESENT, or ESE in Microsoft Exchange Server) depends on the "\Memory\Transition Pages RePurposed/sec" performance monitor counter. A page file is required to make sure that the database cache can release memory if other services or applications request memory.
+This is because the algorithm of the database cache for Extensible Storage Engine (ESENT, or ESE for Microsoft Exchange Server) depends on the "\Memory\Transition Pages RePurposed/sec" performance monitor counter. A page file is required to make sure that the database cache can release memory if other services or applications request memory.
-For Windows Server 2012 Hyper-V and Windows Server 2012 R2 Hyper-V, the page file of the management OS (commonly called the host OS) should be left at the default of setting of "System Managed" .
+For Windows Server 2012 Hyper-V and Windows Server 2012 R2 Hyper-V, the page file of the management OS (commonly called the host OS) should be left at the default of setting of "System Managed".
### Support for system crash dumps
-Page files can be used to "back" (or support) system crash dumps and extend how much system-committed memory (also known as “virtual memory”) a system can support.
+Page files can be used to "back" (or support) system crash dumps and extend how much system-committed memory (also known as "virtual memory") a system can support.
For more information about system crash dumps, see [system crash dump options](system-failure-recovery-options.md#under-write-debugging-information).
@@ -48,7 +49,7 @@ For more information about system crash dumps, see [system crash dump options](s
When large physical memory is installed, a page file might not be required to support the system commit charge during peak usage. For example, 64-bit versions of Windows and Windows Server support more physical memory (RAM) than 32-bit versions support. The available physical memory alone might be large enough.
-However, the reason to configure the page file size has not changed. It has always been about supporting a system crash dump, if it is necessary, or extending the system commit limit, if it is necessary. For example, when a lot of physical memory is installed, a page file might not be required to back the system commit charge during peak usage. The available physical memory alone might be large enough to do this. However, a page file or a dedicated dump file might still be required to back a system crash dump.
+However, the reason to configure the page file size hasn't changed. It has always been about supporting a system crash dump, if it's necessary, or extending the system commit limit, if it's necessary. For example, when a lot of physical memory is installed, a page file might not be required to back the system commit charge during peak usage. The available physical memory alone might be large enough to do this. However, a page file or a dedicated dump file might still be required to back a system crash dump.
## System committed memory
@@ -64,7 +65,7 @@ The system commit charge is the total committed or "promised" memory of all comm
-The system committed charge and system committed limit can be measured on the **Performance** tab in Task Manager or by using the "\Memory\Committed Bytes" and "\Memory\Commit Limit" performance counters. The \Memory\% Committed Bytes In Use counter is a ratio of \Memory\Committed Bytes to \Memory\Commit Limit values.
+The system committed charge and system committed limit can be measured on the **Performance** tab in Task Manager or by using the "\Memory\Committed Bytes" and "\Memory\Commit Limit" performance counters. The **\Memory\% Committed Bytes In Use** counter is a ratio of \Memory\Committed Bytes to \Memory\Commit Limit values.
> [!NOTE]
> System-managed page files automatically grow up to three times the physical memory or 4 GB (whichever is larger, but no more than one-eighth of the volume size) when the system commit charge reaches 90 percent of the system commit limit. This assumes that enough free disk space is available to accommodate the growth.
diff --git a/windows/client-management/manage-device-installation-with-group-policy.md b/windows/client-management/manage-device-installation-with-group-policy.md
index 4088d331ab..8155a9f26b 100644
--- a/windows/client-management/manage-device-installation-with-group-policy.md
+++ b/windows/client-management/manage-device-installation-with-group-policy.md
@@ -69,7 +69,7 @@ The scenarios presented in this guide illustrate how you can control device inst
Group Policy guides:
-- [Create a Group Policy Object (Windows 10) - Windows security](/windows/security/threat-protection/windows-firewall/create-a-group-policy-object)
+- [Create a Group Policy Object (Windows 10) - Windows Security](/windows/security/threat-protection/windows-firewall/create-a-group-policy-object)
- [Advanced Group Policy Management - Microsoft Desktop Optimization Pack](/microsoft-desktop-optimization-pack/agpm)
### Scenario #1: Prevent installation of all printers
diff --git a/windows/client-management/manage-settings-app-with-group-policy.md b/windows/client-management/manage-settings-app-with-group-policy.md
index 4e6bcdad77..56a3adc040 100644
--- a/windows/client-management/manage-settings-app-with-group-policy.md
+++ b/windows/client-management/manage-settings-app-with-group-policy.md
@@ -26,7 +26,7 @@ To make use of the Settings App group policies on Windows server 2016, install f
>[!Note]
>Each server that you want to manage access to the Settings App must be patched.
-If your company uses one or the PolicyDefinitions folder of the Domain Controllers used for Group Policy management, to centrally manage the new policies, copy the ControlPanel.admx and ControlPanel.adml file to [Central Store](https://support.microsoft.com/help/3087759/how-to-create-and-manage-the-central-store-for-group-policy-administra).
+If your company uses one or the PolicyDefinitions folder of the Domain Controllers used for Group Policy management, to centrally manage the new policies, copy the ControlPanel.admx and ControlPanel.adml file to [Central Store](/troubleshoot/windows-client/group-policy/create-and-manage-central-store).
This policy is available for both User and Computer depending on the version of the OS. Windows Server 2016 with KB 4457127 applied will have both User and Computer policy. Windows 10, version 1703, added Computer policy for the Settings app. Windows 10, version 1809, added User policy for the Settings app.
diff --git a/windows/client-management/mandatory-user-profile.md b/windows/client-management/mandatory-user-profile.md
index 25245fa812..d45e85d719 100644
--- a/windows/client-management/mandatory-user-profile.md
+++ b/windows/client-management/mandatory-user-profile.md
@@ -11,6 +11,7 @@ ms.date: 09/14/2021
ms.reviewer:
manager: dansimp
ms.topic: article
+ms.collection: highpri
---
# Create mandatory user profiles
@@ -41,7 +42,7 @@ The name of the folder in which you store the mandatory profile must use the cor
| Windows 10, versions 1507 and 1511 | N/A | v5 |
| Windows 10, versions 1607, 1703, 1709, 1803, 1809, 1903 and 1909 | Windows Server 2016 and Windows Server 2019 | v6 |
-For more information, see [Deploy Roaming User Profiles, Appendix B](/windows-server/storage/folder-redirection/deploy-roaming-user-profiles#appendix-b-profile-version-reference-information) and [Roaming user profiles versioning in Windows 10 and Windows Server Technical Preview](https://support.microsoft.com/kb/3056198).
+For more information, see [Deploy Roaming User Profiles, Appendix B](/windows-server/storage/folder-redirection/deploy-roaming-user-profiles#appendix-b-profile-version-reference-information) and [Roaming user profiles versioning in Windows 10 and Windows Server Technical Preview](/troubleshoot/windows-server/user-profiles-and-logon/roaming-user-profiles-versioning).
## Mandatory user profile
diff --git a/windows/client-management/mdm/add-an-azure-ad-tenant-and-azure-ad-subscription.md b/windows/client-management/mdm/add-an-azure-ad-tenant-and-azure-ad-subscription.md
index 64394a6989..740ad8289d 100644
--- a/windows/client-management/mdm/add-an-azure-ad-tenant-and-azure-ad-subscription.md
+++ b/windows/client-management/mdm/add-an-azure-ad-tenant-and-azure-ad-subscription.md
@@ -39,11 +39,11 @@ Here's a step-by-step guide to adding an Azure Active Directory tenant, adding a
If you don't have a paid subscription to any Microsoft service, you can purchase an Azure AD premium subscription. Go to the Office 356 portal at https://portal.office.com/, and then sign in using the admin account that you created in Step 4 (for example, user1@contosoltd.onmicrosoftcom).
- 
+ 
6. Select **Install software**.
- 
+ 
7. In the Microsoft 365 admin center, select **Purchase Services** from the left navigation.
@@ -69,27 +69,27 @@ If you have paid subscriptions to Office 365, Microsoft Dynamics CRM Online, Ent
1. Sign in to the Microsoft 365 admin center at using your organization's account.
- 
+ 
2. On the **Home** page, select on the Admin tools icon.
- 
+ 
3. On the **Admin center** page, hover your mouse over the Admin tools icon on the left and then click **Azure AD**. This will take you to the Azure Active Directory sign-up page and brings up your existing Office 365 organization account information.
- 
+ 
4. On the **Sign up** page, make sure to enter a valid phone number and then click **Sign up**.
- 
+ 
5. It may take a few minutes to process the request.
- 
+ 
6. You will see a welcome page when the process completes.
- 
+ 
diff --git a/windows/client-management/mdm/applicationcontrol-csp-ddf.md b/windows/client-management/mdm/applicationcontrol-csp-ddf.md
index f6d3ef7a2f..5c44ba2dc1 100644
--- a/windows/client-management/mdm/applicationcontrol-csp-ddf.md
+++ b/windows/client-management/mdm/applicationcontrol-csp-ddf.md
@@ -5,7 +5,7 @@ ms.author: dansimp
ms.topic: article
ms.prod: w10
ms.technology: windows
-author: ManikaDhiman
+author: dansimp
ms.date: 07/10/2019
---
diff --git a/windows/client-management/mdm/applicationcontrol-csp.md b/windows/client-management/mdm/applicationcontrol-csp.md
index 4a4b41b531..648d9c245f 100644
--- a/windows/client-management/mdm/applicationcontrol-csp.md
+++ b/windows/client-management/mdm/applicationcontrol-csp.md
@@ -6,7 +6,7 @@ ms.author: dansimp
ms.topic: article
ms.prod: w10
ms.technology: windows
-author: ManikaDhiman
+author: dansimp
ms.reviewer: jsuther1974
ms.date: 09/10/2020
---
diff --git a/windows/client-management/mdm/applocker-csp.md b/windows/client-management/mdm/applocker-csp.md
index 5669fcf0f8..61070859fe 100644
--- a/windows/client-management/mdm/applocker-csp.md
+++ b/windows/client-management/mdm/applocker-csp.md
@@ -18,7 +18,8 @@ ms.date: 11/19/2019
The AppLocker configuration service provider is used to specify which applications are allowed or disallowed. There is no user interface shown for apps that are blocked.
The following shows the AppLocker configuration service provider in tree format.
-```
+
+```console
./Vendor/MSFT
AppLocker
----ApplicationLaunchRestrictions
@@ -258,54 +259,29 @@ Data type is string.
Supported operations are Get, Add, Delete, and Replace.
-6. On your phone under **Device discovery**, tap **Pair**. You will get a code (case sensitive).
-7. On the browser on the **Set up access page**, enter the code (case sensitive) into the text box and click **Submit**.
+1. On your phone under **Device discovery**, tap **Pair**. You will get a code (case sensitive).
+2. On the browser on the **Set up access page**, enter the code (case sensitive) into the text box and click **Submit**.
The **Device Portal** page opens on your browser.
-8. On the desktop **Device Portal** page, click **Apps** to open the **App Manager**.
-9. On the **App Manager** page under **Running apps**, you will see the **Publisher** and **PackageFullName** of apps.
+3. On the desktop **Device Portal** page, click **Apps** to open the **App Manager**.
+4. On the **App Manager** page under **Running apps**, you will see the **Publisher** and **PackageFullName** of apps.
-10. If you do not see the app that you want, look under **Installed apps**. Using the drop- down menu, click on the application and you get the Version, Publisher, and PackageFullName displayed.
+5. If you do not see the app that you want, look under **Installed apps**. Using the drop- down menu, click on the application and you get the Version, Publisher, and PackageFullName displayed.
The following table shows the mapping of information to the AppLocker publisher rule field.
-
-
-
-
-
-
-
-
Device portal data
-
AppLocker publisher rule field
-
-
-
-
-
PackageFullName
-
ProductName
-
The product name is first part of the PackageFullName followed by the version number. In the Windows Camera example, the ProductName is Microsoft.WindowsCamera.
-
-
-
Publisher
-
Publisher
-
-
-
Version
-
Version
-
This can be used either in the HighSection or LowSection of the BinaryVersionRange.
-
HighSection defines the highest version number and LowSection defines the lowest version number that should be trusted. You can use a wildcard for both versions to make a version- independent rule. Using a wildcard for one of the values will provide higher than or lower than a specific version semantics.
The product name is first part of the PackageFullName followed by the version number. In the Windows Camera example, the ProductName is Microsoft.WindowsCamera.|
+|Publisher|Publisher|
+|Version|Version
This can be used either in the HighSection or LowSection of the BinaryVersionRange.
HighSection defines the highest version number and LowSection defines the lowest version number that should be trusted. You can use a wildcard for both versions to make a version- independent rule. Using a wildcard for one of the values will provide higher than or lower than a specific version semantics.|
Here is an example AppLocker publisher rule:
@@ -325,21 +301,11 @@ You can get the publisher name and product name of apps using a web API.
3. In your browser, run the Store for Business portal web API, to return a JavaScript Object Notation (JSON) file that includes the publisher and product name values.
-
+Request URI:
+
+```http
+https://bspmts.mp.microsoft.com/v1/public/catalog/Retail/Products/{app ID}/applockerdata
+```
Here is the example for Microsoft OneNote:
@@ -360,35 +326,11 @@ Result
}
```
-
-
-
-
-
-
-
-
Result data
-
AppLocker publisher rule field
-
-
-
-
-
packageIdentityName
-
ProductName
-
-
-
publisherCertificateName
-
Publisher
-
-
-
windowsPhoneLegacyId
-
Same value maps to the ProductName and Publisher name
-
This value will only be present if there is a XAP package associated with the app in the Store.
-
If this value is populated then the simple thing to do to cover both the AppX and XAP package would be to create two rules for the app. One rule for AppX using the packageIdentityName and publisherCertificateName value and another one using the windowsPhoneLegacyId value.
-
-
-
-
+|Result data|AppLocker publisher rule field|
+|--- |--- |
+|packageIdentityName|ProductName|
+|publisherCertificateName|Publisher|
+|windowsPhoneLegacyId|Same value maps to the ProductName and Publisher name.
This value will only be present if there is a XAP package associated with the app in the Store.
If this value is populated then the simple thing to do to cover both the AppX and XAP package would be to create two rules for the app. One rule for AppX using the packageIdentityName and publisherCertificateName value and another one using the windowsPhoneLegacyId value.|
## Settings apps that rely on splash apps
@@ -428,464 +370,96 @@ The following list shows the apps that may be included in the inbox.
-
+**POST:**
+
+```http
+https://bspmts.mp.microsoft.com/V1/Inventory/{productId}/{skuId}/Seats/{username}
+```
-
### URI parameters
The following parameters may be specified in the request URI.
-
-
-
-
-
-
-
-
-
Parameter
-
Type
-
Description
-
-
-
-
-
productId
-
string
-
Required. Product identifier for an application that is used by the Store for Business.
-
-
-
skuId
-
string
-
Required. Product identifier that specifies a specific SKU of an application.
-
-
-
username
-
string
-
Requires UserPrincipalName (UPN). User name of the target user account.
-
-
-
-
+|Parameter|Type|Description|
+|--- |--- |--- |
+|productId|string|Required. Product identifier for an application that is used by the Store for Business.|
+|skuId|string|Required. Product identifier that specifies a specific SKU of an application.|
+|username|string|Requires UserPrincipalName (UPN). User name of the target user account.|
## Response
@@ -81,58 +40,9 @@ The following parameters may be specified in the request URI.
The response body contains [SeatDetails](data-structures-windows-store-for-business.md#seatdetails).
-
-
-
-
-
-
-
-
-
-
+|Error code|Description|Retry|Data field|Details|
+|--- |--- |--- |--- |--- |
+|400|Invalid parameters|No|Parameter name Reason: Invalid parameter Details: String|Invalid can include productId, skuId or userName|
+|404|Not found||Item type: Inventory, User, Seat
Values: ProductId/SkuId, UserName, ProductId/SkuId/UserName|ItemType: Inventory User Seat
Values: ProductId/SkuId UserName ProductId/SkuId/UserName|
+|409|Conflict||Reason: Not online||
diff --git a/windows/client-management/mdm/azure-active-directory-integration-with-mdm.md b/windows/client-management/mdm/azure-active-directory-integration-with-mdm.md
index c0db9e8151..634025c4b9 100644
--- a/windows/client-management/mdm/azure-active-directory-integration-with-mdm.md
+++ b/windows/client-management/mdm/azure-active-directory-integration-with-mdm.md
@@ -9,6 +9,7 @@ ms.topic: article
ms.prod: w10
ms.technology: windows
author: dansimp
+ms.collection: highpri
---
# Azure Active Directory integration with MDM
@@ -135,7 +136,7 @@ Use the following steps to register a cloud-based MDM application with Azure AD.
8. Enter the login URL for your MDM service.
-9. For the App ID, enter **https://<your\_tenant\_name>/ContosoMDM**, then select OK.
+9. For the App ID, enter `https:///ContosoMDM`, then select OK.
10. While still in the Azure portal, select the **Configure** tab of your application.
@@ -187,40 +188,14 @@ The following image show how MDM applications show up in the Azure app gallery.
The following table shows the required information to create an entry in the Azure AD app gallery.
-
-
-
-
-
-
-
-
Item
-
Description
-
-
-
-
-
Application ID
-
The client ID of your MDM app that is configured within your tenant. This ID is the unique identifier for your multi-tenant app.
-
-
-
Publisher
-
A string that identifies the publisher of the app.
-
-
-
Application URL
-
A URL to the landing page of your app where your administrators can get more information about the MDM app and contains a link to the landing page of your app. This URL isn't used for the actual enrollment.
-
-
-
Description
-
A brief description of your MDM app, which must be under 255 characters.
-
-
-
Icons
-
A set of logo icons for the MDM app. Dimensions: 45 X 45, 150 X 122, 214 X 215
-
-
-
+|Item|Description|
+|--- |--- |
+|**Application ID**|The client ID of your MDM app that is configured within your tenant. This ID is the unique identifier for your multi-tenant app.|
+|**Publisher**|A string that identifies the publisher of the app.|
+|**Application URL**|A URL to the landing page of your app where your administrators can get more information about the MDM app and contains a link to the landing page of your app. This URL isn't used for the actual enrollment.|
+|**Description**|A brief description of your MDM app, which must be under 255 characters.|
+|**Icons**|A set of logo icons for the MDM app. Dimensions: 45 X 45, 150 X 122, 214 X 215|
+
### Add on-premises MDM to the app gallery
@@ -250,42 +225,10 @@ The CSS files provided by Microsoft contain version information and we recommend
An MDM page must adhere to a predefined theme depending on the scenario that is displayed. For example, if the CXH-HOSTHTTP header is FRX, which is the OOBE scenario, then the page must support a dark theme with blue background color, which uses WinJS file Ui-dark.css ver 4.0 and oobe-desktop.css ver 1.0.4.
-
-
-
-
-
-
-
-
-
-
-
CXH-HOST (HTTP HEADER)
-
Scenario
-
Background Theme
-
WinJS
-
Scenario CSS
-
-
-
-
-
FRX
-
OOBE
-
Dark theme + blue background color
-
Filename: Ui-dark.css
-
Filename: oobe-dekstop.css
-
-
-
MOSET
-
Settings/
-
Post OOBE
-
Light theme
-
Filename: Ui-light.css
-
Filename: settings-desktop.css
-
-
-
-
+|CXH-HOST (HTTP HEADER)|Scenario|Background Theme|WinJS|Scenario CSS|
+|--- |--- |--- |--- |--- |
+|FRX|OOBE|Dark theme + blue background color|Filename: Ui-dark.css|Filename: oobe-dekstop.css|
+|MOSET|Settings/Post OOBE|Light theme|Filename: Ui-light.css|Filename: settings-desktop.css|
## Terms of Use protocol semantics
@@ -293,40 +236,16 @@ The Terms of Use endpoint is hosted by the MDM server. During the Azure AD Join
### Redirect to the Terms of Use endpoint
-This redirect is a full page redirect to the Terms of User endpoint hosted by the MDM. Here's an example URL, https://fabrikam.contosomdm.com/TermsOfUse.
+This redirect is a full page redirect to the Terms of User endpoint hosted by the MDM. Here's an example URL, `https://fabrikam.contosomdm.com/TermsOfUse`.
The following parameters are passed in the query string:
-
-
-
-
-
-
-
-
Item
-
Description
-
-
-
-
-
redirect_uri
-
After the user accepts or rejects the Terms of Use, the user is redirected to this URL.
-
-
-
client-request-id
-
A GUID that is used to correlate logs for diagnostic and debugging purposes. Use this parameter to log or trace the state of the enrollment request to help find the root cause of failures.
-
-
-
api-version
-
Specifies the version of the protocol requested by the client. This value provides a mechanism to support version revisions of the protocol.
-
-
-
mode
-
Specifies that the device is organization owned when mode=azureadjoin. This parameter isn't present for BYOD devices.
-
-
-
+|Item|Description|
+|--- |--- |
+|redirect_uri|After the user accepts or rejects the Terms of Use, the user is redirected to this URL.|
+|client-request-id|A GUID that is used to correlate logs for diagnostic and debugging purposes. Use this parameter to log or trace the state of the enrollment request to help find the root cause of failures.|
+|api-version|Specifies the version of the protocol requested by the client. This value provides a mechanism to support version revisions of the protocol.|
+|mode|Specifies that the device is organization owned when mode=azureadjoin. This parameter isn't present for BYOD devices.|
### Access token
@@ -337,37 +256,13 @@ Azure AD issues a bearer access token. The token is passed in the authorization
The following claims are expected in the access token passed by Windows to the Terms of Use endpoint:
-
-
-
-
-
-
-
-
Item
-
Description
-
-
-
-
-
Object ID
-
Identifier of the user object corresponding to the authenticated user.
-
-
-
UPN
-
A claim containing the user principal name (UPN) of the authenticated user.
-
-
-
TID
-
A claim representing the tenant ID of the tenant. In the example above, it's Fabrikam.
-
-
-
Resource
-
A sanitized URL representing the MDM application. Example, https://fabrikam.contosomdm.com.
-
-
-
-
+|Item|Description|
+|--- |--- |
+|Object ID|Identifier of the user object corresponding to the authenticated user.|
+|UPN|A claim containing the user principal name (UPN) of the authenticated user.|
+|TID|A claim representing the tenant ID of the tenant. In the example above, it's Fabrikam.|
+|Resource|A sanitized URL representing the MDM application. Example: `https://fabrikam.contosomdm.com` |
+
> [!NOTE]
> There's no device ID claim in the access token because the device may not yet be enrolled at this time.
@@ -428,184 +323,35 @@ Location: ms-appx-web://App1/ToUResponse?error=access_denied&error_description=A
The following table shows the error codes.
-
-
-
-
-
-
-
-
-
-
Cause
-
HTTP status
-
Error
-
Description
-
-
-
-
-
api-version
-
302
-
invalid_request
-
unsupported version
-
-
-
Tenant or user data are missing or other required prerequisites for device enrollment are not met
-
302
-
unauthorized_client
-
unauthorized user or tenant
-
-
-
Azure AD token validation failed
-
302
-
unauthorized_client
-
unauthorized_client
-
-
-
internal service error
-
302
-
server_error
-
internal service error
-
-
-
+|Cause|HTTP status|Error|Description|
+|--- |--- |--- |--- |
+|api-version|302|invalid_request|unsupported version|
+|Tenant or user data are missing or other required prerequisites for device enrollment are not met|302|unauthorized_client|unauthorized user or tenant|
+|Azure AD token validation failed|302|unauthorized_client|unauthorized_client|
+|internal service error|302|server_error|internal service error|
## Enrollment protocol with Azure AD
With Azure integrated MDM enrollment, there's no discovery phase and the discovery URL is directly passed down to the system from Azure. The following table shows the comparison between the traditional and Azure enrollments.
-
-
-
-
-
-
-
-
-
-
Detail
-
Traditional MDM enrollment
-
Azure AD Join (organization-owned device)
-
Azure AD adds a work account (user-owned device)
-
-
-
-
-
MDM auto-discovery using email address to retrieve MDM discovery URL
-
Enrollment
-
Not applicable
-
Discovery URL provisioned in Azure
-
-
-
-
Uses MDM discovery URL
-
Enrollment
-
Enrollment renewal
-
ROBO
-
Enrollment
-
Enrollment renewal
-
ROBO
-
Enrollment
-
Enrollment renewal
-
ROBO
-
-
-
Is MDM enrollment required?
-
Yes
-
Yes
-
No
-
User can decline.
-
-
-
Authentication type
-
OnPremise
-
Federated
-
Certificate
-
Federated
-
Federated
-
-
-
EnrollmentPolicyServiceURL
-
Optional (all auth)
-
Optional (all auth)
-
-
Optional (all auth)
-
-
-
-
EnrollmentServiceURL
-
Required (all auth)
-
Used (all auth)
-
Used (all auth)
-
-
-
EnrollmentServiceURL includes OS Version, OS Platform, and other attributes provided by MDM discovery URL
-
Highly recommended
-
Highly recommended
-
Highly recommended
-
-
-
AuthenticationServiceURL used
-
Used (Federated auth)
-
Skipped
-
Skipped
-
-
-
BinarySecurityToken
-
Custom per MDM
-
Azure AD issued token
-
Azure AD issued token
-
-
-
EnrollmentType
-
Full
-
Device
-
Full
-
-
-
Enrolled certificate type
-
User certificate
-
Device certificate
-
User certificate
-
-
-
Enrolled certificate store
-
My/User
-
My/System
-
My/User
-
-
-
CSR subject name
-
User Principal Name
-
Device ID
-
User Principal Name
-
-
-
EnrollmentData Terms of Use binary blob as AdditionalContext for EnrollmentServiceURL
-
Not supported
-
Supported
-
Supported
-
-
-
CSPs accessible during enrollment
-
Windows 10 support:
-
-
DMClient
-
CertificateStore
-
RootCATrustedCertificates
-
ClientCertificateInstall
-
EnterpriseModernAppManagement
-
PassportForWork
-
Policy
-
w7 APPLICATION
-
-
-
-
-
-
+|Detail|Traditional MDM enrollment|Azure AD Join (organization-owned device)|Azure AD adds a work account (user-owned device)|
+|--- |--- |--- |--- |
+|MDM auto-discovery using email address to retrieve MDM discovery URL|Enrollment|Not applicable Discovery URL provisioned in Azure||
+|Uses MDM discovery URL|Enrollment Enrollment renewal ROBO|Enrollment Enrollment renewal ROBO|Enrollment Enrollment renewal ROBO|
+|Is MDM enrollment required?|Yes|Yes|No User can decline.|
+|Authentication type|OnPremise Federated Certificate|Federated|Federated|
+|EnrollmentPolicyServiceURL|Optional (all auth)|Optional (all auth)|Optional (all auth)|
+|EnrollmentServiceURL|Required (all auth)|Used (all auth)|Used (all auth)|
+|EnrollmentServiceURL includes OS Version, OS Platform, and other attributes provided by MDM discovery URL|Highly recommended|Highly recommended|Highly recommended|
+|AuthenticationServiceURL used|Used (Federated auth)|Skipped|Skipped|
+|BinarySecurityToken|Custom per MDM|Azure AD issued token|Azure AD issued token|
+|EnrollmentType|Full|Device|Full|
+|Enrolled certificate type|User certificate|Device certificate|User certificate|
+|Enrolled certificate store|My/User|My/System|My/User|
+|CSR subject name|User Principal Name|Device ID|User Principal Name|
+|EnrollmentData Terms of Use binary blob as AdditionalContext for EnrollmentServiceURL|Not supported|Supported|Supported|
+|CSPs accessible during enrollment|Windows 10 support: - DMClient - CertificateStore - RootCATrustedCertificates - ClientCertificateInstall - EnterpriseModernAppManagement - PassportForWork - Policy - w7 APPLICATION|||
## Management protocol with Azure AD
@@ -737,202 +483,41 @@ When a user is enrolled into MDM through Azure Active Directory Join and then di
## Error codes
-
There was a problem authenticating your account or device. You can try to do this again or contact your system administrator with the error code {0}.
-
-
-
-
-
-
+|Code|ID|Error message|
+|--- |--- |--- |
+|0x80180001|"idErrorServerConnectivity", // MENROLL_E_DEVICE_MESSAGE_FORMAT_ERROR|There was an error communicating with the server. You can try to do this again or contact your system administrator with the error code {0}|
+|0x80180002|"idErrorAuthenticationFailure", // MENROLL_E_DEVICE_AUTHENTICATION_ERROR|There was a problem authenticating your account or device. You can try to do this again or contact your system administrator with the error code {0}.|
+|0x80180003|"idErrorAuthorizationFailure", // MENROLL_E_DEVICE_AUTHORIZATION_ERROR|This user isn't authorized to enroll. You can try to do this again or contact your system administrator with the error code {0}.|
+|0x80180004|"idErrorMDMCertificateError", // MENROLL_E_DEVICE_CERTIFCATEREQUEST_ERROR|There was a certificate error. You can try to do this again or contact your system administrator with the error code {0}.|
+|0x80180005|"idErrorServerConnectivity", // MENROLL_E_DEVICE_CONFIGMGRSERVER_ERROR|There was an error communicating with the server. You can try to do this again or contact your system administrator with the error code {0}|
+|0x80180006|"idErrorServerConnectivity", // MENROLL_E_DEVICE_CONFIGMGRSERVER_ERROR|There was an error communicating with the server. You can try to do this again or contact your system administrator with the error code {0}|
+|0x80180007|"idErrorAuthenticationFailure", // MENROLL_E_DEVICE_INVALIDSECURITY_ERROR|There was a problem authenticating your account or device. You can try to do this again or contact your system administrator with the error code {0}.|
+|0x80180008|"idErrorServerConnectivity", // MENROLL_E_DEVICE_UNKNOWN_ERROR|There was an error communicating with the server. You can try to do this again or contact your system administrator with the error code {0}|
+|0x80180009|"idErrorAlreadyInProgress", // MENROLL_E_ENROLLMENT_IN_PROGRESS|Another enrollment is in progress. You can try to do this again or contact your system administrator with the error code {0}.|
+|0x8018000A|"idErrorMDMAlreadyEnrolled", // MENROLL_E_DEVICE_ALREADY_ENROLLED|This device is already enrolled. You can contact your system administrator with the error code {0}.|
+|0x8018000D|"idErrorMDMCertificateError", // MENROLL_E_DISCOVERY_SEC_CERT_DATE_INVALID|There was a certificate error. You can try to do this again or contact your system administrator with the error code {0}.|
+|0x8018000E|"idErrorAuthenticationFailure", // MENROLL_E_PASSWORD_NEEDED|There was a problem authenticating your account or device. You can try to do this again or contact your system administrator with the error code {0}.|
+|0x8018000F|"idErrorAuthenticationFailure", // MENROLL_E_WAB_ERROR|There was a problem authenticating your account or device. You can try to do this again or contact your system administrator with the error code {0}.|
+|0x80180010|"idErrorServerConnectivity", // MENROLL_E_CONNECTIVITY|There was an error communicating with the server. You can try to do this again or contact your system administrator with the error code {0}|
+|0x80180012|"idErrorMDMCertificateError", // MENROLL_E_INVALIDSSLCERT|There was a certificate error. You can try to do this again or contact your system administrator with the error code {0}.|
+|0x80180013|"idErrorDeviceLimit", // MENROLL_E_DEVICECAPREACHED|Looks like there are too many devices or users for this account. Contact your system administrator with the error code {0}.|
+|0x80180014|"idErrorMDMNotSupported", // MENROLL_E_DEVICENOTSUPPORTED|This feature isn't supported. Contact your system administrator with the error code {0}.|
+|0x80180015|"idErrorMDMNotSupported", // MENROLL_E_NOTSUPPORTED|This feature isn't supported. Contact your system administrator with the error code {0}.|
+|0x80180016|"idErrorMDMRenewalRejected", // MENROLL_E_NOTELIGIBLETORENEW|The server did not accept the request. You can try to do this again or contact your system administrator with the error code {0}.|
+|0x80180017|"idErrorMDMAccountMaintenance", // MENROLL_E_INMAINTENANCE|The service is in maintenance. You can try to do this again later or contact your system administrator with the error code {0}.|
+|0x80180018|"idErrorMDMLicenseError", // MENROLL_E_USERLICENSE|There was an error with your license. You can try to do this again or contact your system administrator with the error code {0}.|
+|0x80180019|"idErrorInvalidServerConfig", // MENROLL_E_ENROLLMENTDATAINVALID|Looks like the server isn't correctly configured. You can try to do this again or contact your system administrator with the error code {0}.|
+|"rejectedTermsOfUse"|"idErrorRejectedTermsOfUse"|Your organization requires that you agree to the Terms of Use. Please try again or ask your support person for more information.|
+|0x801c0001|"idErrorServerConnectivity", // DSREG_E_DEVICE_MESSAGE_FORMAT_ERROR|There was an error communicating with the server. You can try to do this again or contact your system administrator with the error code {0}|
+|0x801c0002|"idErrorAuthenticationFailure", // DSREG_E_DEVICE_AUTHENTICATION_ERROR|There was a problem authenticating your account or device. You can try to do this again or contact your system administrator with the error code {0}.|
+|0x801c0003|"idErrorAuthorizationFailure", // DSREG_E_DEVICE_AUTHORIZATION_ERROR|This user isn't authorized to enroll. You can try to do this again or contact your system administrator with the error code {0}.|
+|0x801c0006|"idErrorServerConnectivity", // DSREG_E_DEVICE_INTERNALSERVICE_ERROR|There was an error communicating with the server. You can try to do this again or contact your system administrator with the error code {0}|
+|0x801c000B|"idErrorUntrustedServer", // DSREG_E_DISCOVERY_REDIRECTION_NOT_TRUSTED|The server being contacted isn't trusted. Contact your system administrator with the error code {0}.|
+|0x801c000C|"idErrorServerConnectivity", // DSREG_E_DISCOVERY_FAILED|There was an error communicating with the server. You can try to do this again or contact your system administrator with the error code {0}|
+|0x801c000E|"idErrorDeviceLimit", // DSREG_E_DEVICE_REGISTRATION_QUOTA_EXCCEEDED|Looks like there are too many devices or users for this account. Contact your system administrator with the error code {0}.|
+|0x801c000F|"idErrorDeviceRequiresReboot", // DSREG_E_DEVICE_REQUIRES_REBOOT|A reboot is required to complete device registration.|
+|0x801c0010|"idErrorInvalidCertificate", // DSREG_E_DEVICE_AIK_VALIDATION_ERROR|Looks like you have an invalid certificate. Contact your system administrator with the error code {0}.|
+|0x801c0011|"idErrorAuthenticationFailure", // DSREG_E_DEVICE_ATTESTATION_ERROR|There was a problem authenticating your account or device. You can try to do this again or contact your system administrator with the error code {0}.|
+|0x801c0012|"idErrorServerConnectivity", // DSREG_E_DISCOVERY_BAD_MESSAGE_ERROR|There was an error communicating with the server. You can try to do this again or contact your system administrator with the error code {0}|
+|0x801c0013|"idErrorAuthenticationFailure", // DSREG_E_TENANTID_NOT_FOUND|There was a problem authenticating your account or device. You can try to do this again or contact your system administrator with the error code {0}.|
+|0x801c0014|"idErrorAuthenticationFailure", // DSREG_E_USERSID_NOT_FOUND|There was a problem authenticating your account or device. You can try to do this again or contact your system administrator with the error code {0}.|
diff --git a/windows/client-management/mdm/bitlocker-csp.md b/windows/client-management/mdm/bitlocker-csp.md
index e3f6b2bd85..96b516b939 100644
--- a/windows/client-management/mdm/bitlocker-csp.md
+++ b/windows/client-management/mdm/bitlocker-csp.md
@@ -10,6 +10,7 @@ ms.localizationpriority: medium
ms.date: 04/16/2020
ms.reviewer:
manager: dansimp
+ms.collection: highpri
---
# BitLocker CSP
@@ -26,19 +27,29 @@ the setting configured by the admin.
For RequireDeviceEncryption and RequireStorageCardEncryption, the Get operation returns the actual status of enforcement to the admin, such as if Trusted Platform Module (TPM) protection is required and if encryption is required. And if the device has BitLocker enabled but with password protector, the status reported is 0. A Get operation on RequireDeviceEncryption does not verify that a minimum PIN length is enforced (SystemDrivesMinimumPINLength).
The following shows the BitLocker configuration service provider in tree format.
-```
+
+```console
./Device/Vendor/MSFT
BitLocker
----RequireStorageCardEncryption
----RequireDeviceEncryption
----EncryptionMethodByDriveType
+----IdentificationField
+----SystemDrivesEnablePreBootPinExceptionOnDECapableDevice
+----SystemDrivesEnhancedPIN
+----SystemDrivesDisallowStandardUsersCanChangePIN
+----SystemDrivesEnablePrebootInputProtectorsOnSlates
+----SystemDrivesEncryptionType
----SystemDrivesRequireStartupAuthentication
----SystemDrivesMinimumPINLength
----SystemDrivesRecoveryMessage
----SystemDrivesRecoveryOptions
----FixedDrivesRecoveryOptions
----FixedDrivesRequireEncryption
+----FixedDrivesEncryptionType
----RemovableDrivesRequireEncryption
+----RemovableDrivesEncryptionType
+----RemovableDrivesConfigureBDE
----AllowWarningForOtherDiskEncryption
----AllowStandardUserEncryption
----ConfigureRecoveryPasswordRotation
@@ -48,90 +59,25 @@ BitLocker
--------RotateRecoveryPasswordsStatus
--------RotateRecoveryPasswordsRequestID
```
+
**./Device/Vendor/MSFT/BitLocker**
Defines the root node for the BitLocker configuration service provider.
-**RequireStorageCardEncryption**
-
-Allows the administrator to require storage card encryption on the device. This policy is valid only for a mobile SKU.
-
-
-
-
-
Home
-
Pro
-
Business
-
Enterprise
-
Education
-
Mobile
-
-
-
-
-
-
-
-
-
-
-
-
-Data type is integer. Sample value for this node to enable this policy: 1. Disabling this policy will not turn off the encryption on the storage card, but the user will no longer be prompted to turn it on.
-
-- 0 (default) – Storage cards do not need to be encrypted.
-- 1 – Require storage cards to be encrypted.
-
-Disabling this policy will not turn off the encryption on the system card, but the user will no longer be prompted to turn it on.
-
-If you want to disable this policy use the following SyncML:
-
-```xml
-
-
-
- $CmdID$
-
-
- ./Device/Vendor/MSFT/BitLocker/RequireStorageCardEncryption
-
-
- int
-
- 0
-
-
-
-
-```
-
-Data type is integer. Supported operations are Add, Get, Replace, and Delete.
-
-
**RequireDeviceEncryption**
Allows the administrator to require encryption to be turned on by using BitLocker\Device Encryption.
-
-
-
Home
-
Pro
-
Business
-
Enterprise
-
Education
-
Mobile
-
-
-
-
-
-
-
-
-
-
-
+
+|Edition|Windows 10|Windows 11|
+|--- |--- |--- |
+|Home|No|No|
+|Pro|Yes|Yes|
+|Business|Yes|Yes|
+|Enterprise|Yes|Yes|
+|Education|Yes|Yes|
+
Data type is integer. Sample value for this node to enable this policy: 1.
Supported operations are Add, Get, Replace, and Delete.
@@ -149,7 +95,7 @@ Encryptable fixed data volumes are treated similarly to OS volumes. However, fix
The following list shows the supported values:
-- 0 (default) — Disable. If the policy setting is not set or is set to 0, the device's enforcement status is not checked. The policy does not enforce encryption and it does not decrypt encrypted volumes.
+- 0 (default) —Disable. If the policy setting is not set or is set to 0, the device's enforcement status is not checked. The policy does not enforce encryption and it does not decrypt encrypted volumes.
- 1 – Enable. The device's enforcement status is checked. Setting this policy to 1 triggers encryption of all drives (silently or non-silently based on [AllowWarningForOtherDiskEncryption](#allowwarningforotherdiskencryption) policy).
If you want to disable this policy, use the following SyncML:
@@ -183,25 +129,15 @@ If you want to disable this policy, use the following SyncML:
Allows you to set the default encryption method for each of the different drive types: operating system drives, fixed data drives, and removable data drives. Hidden, system, and recovery partitions are skipped from encryption. This setting is a direct mapping to the BitLocker Group Policy "Choose drive encryption method and cipher strength (Windows 10 [Version 1511] and later)".
-
-
-
Home
-
Pro
-
Business
-
Enterprise
-
Education
-
Mobile
-
-
-
-
-
-
-
-
-
-
-
+
+|Edition|Windows 10|Windows 11|
+|--- |--- |--- |
+|Home|No|No|
+|Pro|Yes|Yes|
+|Business|Yes|Yes|
+|Enterprise|Yes|Yes|
+|Education|Yes|Yes|
+
ADMX Info:
@@ -214,7 +150,7 @@ ADMX Info:
> [!TIP]
-> For a step-by-step guide to enable ADMX-backed policies, see [Enable ADMX-backed policies in MDM](enable-admx-backed-policies-in-mdm.md). For additional information, see [Understanding ADMX-backed policies](understanding-admx-backed-policies.md).
+> For a step-by-step guide to enable ADMX-backed policies, see [Enable ADMX-backed policies in MDM](enable-admx-backed-policies-in-mdm.md). For more information, see [Understanding ADMX-backed policies](understanding-admx-backed-policies.md).
This setting allows you to configure the algorithm and cipher strength used by BitLocker Drive Encryption. This setting is applied when you turn on BitLocker. Changing the encryption method has no effect if the drive is already encrypted, or if encryption is in progress.
@@ -260,6 +196,297 @@ EncryptionMethodWithXtsRdvDropDown_Name = Select the encryption method for remov
```
Data type is string. Supported operations are Add, Get, Replace, and Delete.
+
+
+**IdentificationField**
+
+Allows you to associate unique organizational identifiers to a new drive that is enabled with BitLocker.
+
+
+
+|Edition|Windows 10|Windows 11|
+|--- |--- |--- |
+|Home|No|No|
+|Pro|Yes|Yes|
+|Business|Yes|Yes|
+|Enterprise|Yes|Yes|
+|Education|Yes|Yes|
+
+
+
+ADMX Info:
+
+
GP English name: Provide the unique identifiers for your organization
+
GP name: IdentificationField_Name
+
GP path: Windows Components/BitLocker Drive Encryption
+
GP ADMX file name: VolumeEncryption.admx
+
+
+
+> [!TIP]
+> For a step-by-step guide to enable ADMX-backed policies, see [Enable ADMX-backed policies in MDM](enable-admx-backed-policies-in-mdm.md). For more information, see [Understanding ADMX-backed policies](understanding-admx-backed-policies.md).
+
+This setting is used to establish an identifier that is applied to all drives that are encrypted in your organization.
+
+Identifiers are usually stored as the identification field and the allowed identification field. You can configure the following identification fields on existing drives by using the [Manage-bde](/windows-server/administration/windows-commands/manage-bde):
+
+- **BitLocker identification field**: It allows you to associate unique organizational identifiers to a new drive that is enabled with BitLocker. This identifier is automatically added to new BitLocker-protected drives, and it can be updated on existing BitLocker-protected drives by using the Manage-bde command-line tool. For more information about the tool to manage BitLocker, see [Manage-bde](/windows-server/administration/windows-commands/manage-bde). An identification field is required to manage certificate-based data recovery agents on BitLocker-protected drives and for potential updates to the BitLocker To Go Reader. BitLocker manages and updates data recovery agents only when the identification field on the drive matches the value that is configured in the identification field. In a similar manner, BitLocker updates the BitLocker To Go Reader only when the identification field on the drive matches the value that is configured for the identification field.
+
+- **Allowed BitLocker identification field**: The allowed identification field is used in combination with the 'Deny write access to removable drives not protected by BitLocker' policy setting to help control the use of removable drives in your organization. It is a comma-separated list of identification fields from your organization or external organizations.
+
+>[!Note]
+>When a BitLocker-protected drive is mounted on another BitLocker-enabled computer, the identification field and the allowed identification field are used to determine whether the drive is from an outside organization.
+
+If you enable this policy setting, you can configure the identification field on the BitLocker-protected drive and any allowed identification field that is used by your organization.
+
+Sample value for this node to enable this policy is:
+
+```xml
+
+```
+
+Data Id:
+
+- IdentificationField: BitLocker identification field
+- SecIdentificationField: Allowed BitLocker identification field
+
+If you disable or do not configure this setting, the identification field is not required.
+
+>[!Note]
+>Multiple values separated by commas can be entered in the identification and allowed identification fields. The identification field can be any value up to 260 characters.
+
+
+
+
+**SystemDrivesEnablePreBootPinExceptionOnDECapableDevice**
+
+Allows users on devices that are compliant with InstantGo or the Microsoft Hardware Security Test Interface (HSTI) to not have a PIN for preboot authentication.
+
+
+
+|Edition|Windows 10|Windows 11|
+|--- |--- |--- |
+|Home|No|No|
+|Pro|Yes|Yes|
+|Business|Yes|Yes|
+|Enterprise|Yes|Yes|
+|Education|Yes|Yes|
+
+
+
+ADMX Info:
+
+
GP English name: Allow devices compliant with InstantGo or HSTI to opt out of pre-boot PIN
+
GP name: EnablePreBootPinExceptionOnDECapableDevice_Name
+
GP path: Windows Components/BitLocker Drive Encryption/Operating System Drives
+
GP ADMX file name: VolumeEncryption.admx
+
+
+
+> [!TIP]
+> For a step-by-step guide to enable ADMX-backed policies, see [Enable ADMX-backed policies in MDM](enable-admx-backed-policies-in-mdm.md). For more information, see [Understanding ADMX-backed policies](understanding-admx-backed-policies.md).
+
+This setting allows users on devices that are compliant with InstantGo or Microsoft Hardware Security Test Interface (HSTI) to not have a PIN for pre-boot authentication. This overrides the "Require startup PIN with TPM" option of the "Require additional authentication at startup" policy on compliant hardware.
+
+If you enable this policy setting, users on InstantGo and HSTI compliant devices will have the choice to turn on BitLocker without pre-boot authentication.
+
+Sample value for this node to enable this policy is:
+
+```xml
+
+```
+
+If this policy is disabled, the options of "Require additional authentication at startup" policy apply.
+
+
+
+**SystemDrivesEnhancedPIN**
+
+Allows users to configure whether or not enhanced startup PINs are used with BitLocker.
+
+
+
+|Edition|Windows 10|Windows 11|
+|--- |--- |--- |
+|Home|No|No|
+|Pro|Yes|Yes|
+|Business|Yes|Yes|
+|Enterprise|Yes|Yes|
+|Education|Yes|Yes|
+
+
+
+ADMX Info:
+
+
GP English name: Allow enhanced PINs for startup
+
GP name: EnhancedPIN_Name
+
GP path: Windows Components/BitLocker Drive Encryption/Operating System Drives
+
GP ADMX file name: VolumeEncryption.admx
+
+
+
+> [!TIP]
+> For a step-by-step guide to enable ADMX-backed policies, see [Enable ADMX-backed policies in MDM](enable-admx-backed-policies-in-mdm.md). For more information, see [Understanding ADMX-backed policies](understanding-admx-backed-policies.md).
+
+This setting permits the use of enhanced PINs when you use an unlock method that includes a PIN. Enhanced startup PINs permit the usage of characters (including uppercase and lowercase letters, symbols, numbers, and spaces). This policy setting is applied when you turn on BitLocker.
+
+>[!Note]
+>Not all computers support enhanced PIN characters in the preboot environment. It is strongly recommended that users perform a system check during the BitLocker setup to verify that enhanced PIN characters can be used.
+
+If you enable this policy setting, all new BitLocker startup PINs that are set will be enhanced PINs. Existing drives that were protected by using standard startup PINs are not affected.
+
+Sample value for this node to enable this policy is:
+
+```xml
+
+```
+
+If you disable or do not configure this policy setting, enhanced PINs will not be used.
+
+
+
+**SystemDrivesDisallowStandardUsersCanChangePIN**
+
+Allows you to configure whether standard users are allowed to change BitLocker PIN or password that is used to protect the operating system drive.
+
+
+
+|Edition|Windows 10|Windows 11|
+|--- |--- |--- |
+|Home|No|No|
+|Pro|Yes|Yes|
+|Business|Yes|Yes|
+|Enterprise|Yes|Yes|
+|Education|Yes|Yes|
+
+
+
+ADMX Info:
+
+
GP English name: Disallow standard users from changing the PIN or password
+
GP name: DisallowStandardUsersCanChangePIN_Name
+
GP path: Windows Components/BitLocker Drive Encryption/Operating System Drives
+
GP ADMX file name: VolumeEncryption.admx
+
+
+
+> [!TIP]
+> For a step-by-step guide to enable ADMX-backed policies, see [Enable ADMX-backed policies in MDM](enable-admx-backed-policies-in-mdm.md). For more information, see [Understanding ADMX-backed policies](understanding-admx-backed-policies.md).
+
+This policy setting allows you to configure whether or not standard users are allowed to change the PIN or password, that is used to protect the operating system drive.
+
+>[!Note]
+>To change the PIN or password, the user must be able to provide the current PIN or password. This policy setting is applied when you turn on BitLocker.
+
+If you enable this policy setting, standard users will not be allowed to change BitLocker PINs or passwords.
+
+If you disable or do not configure this policy setting, standard users will be permitted to change BitLocker PINs or passwords.
+
+Sample value for this node to disable this policy is:
+
+```xml
+
+```
+
+
+
+**SystemDrivesEnablePrebootInputProtectorsOnSlates**
+
+Allows users to enable authentication options that require user input from the preboot environment, even if the platform indicates a lack of preboot input capability.
+
+
+
+|Edition|Windows 10|Windows 11|
+|--- |--- |--- |
+|Home|No|No|
+|Pro|Yes|Yes|
+|Business|Yes|Yes|
+|Enterprise|Yes|Yes|
+|Education|Yes|Yes|
+
+
+
+ADMX Info:
+
+
GP English name: Enable use of BitLocker authentication requiring preboot keyboard input on slates
+
GP name: EnablePrebootInputProtectorsOnSlates_Name
+
GP path: Windows Components/BitLocker Drive Encryption/Operating System Drives
+
GP ADMX file name: VolumeEncryption.admx
+
+
+
+> [!TIP]
+> For a step-by-step guide to enable ADMX-backed policies, see [Enable ADMX-backed policies in MDM](enable-admx-backed-policies-in-mdm.md). For more information, see [Understanding ADMX-backed policies](understanding-admx-backed-policies.md).
+
+The Windows touch keyboard (such as used by tablets) is not available in the preboot environment where BitLocker requires additional information, such as a PIN or password.
+
+It is recommended that administrators enable this policy only for devices that are verified to have an alternative means of preboot input, such as attaching a USB keyboard.
+
+Sample value for this node to enable this policy is:
+
+```xml
+
+```
+
+If this policy is disabled, the Windows Recovery Environment must be enabled on tablets to support entering the BitLocker recovery password.
+When the Windows Recovery Environment is not enabled and this policy is not enabled, you cannot turn on BitLocker on a device that uses the Windows touch keyboard.
+
+>[!Note]
+>If you do not enable this policy setting, the following options in the **Require additional authentication at startup policy** might not be available:
+>
+>- Configure TPM startup PIN: Required and Allowed
+>- Configure TPM startup key and PIN: Required and Allowed
+>- Configure use of passwords for operating system drives
+
+
+
+
+**SystemDrivesEncryptionType**
+
+Allows you to configure the encryption type that is used by BitLocker.
+
+
+
+|Edition|Windows 10|Windows 11|
+|--- |--- |--- |
+|Home|No|No|
+|Pro|Yes|Yes|
+|Business|Yes|Yes|
+|Enterprise|Yes|Yes|
+|Education|Yes|Yes|
+
+
+
+ADMX Info:
+
+
GP English name: Enforce drive encryption type on operating system drives
+
GP name: OSEncryptionType_Name
+
GP path: Windows Components/BitLocker Drive Encryption/Operating System Drives
+
GP ADMX file name: VolumeEncryption.admx
+
+
+
+> [!TIP]
+> For a step-by-step guide to enable ADMX-backed policies, see [Enable ADMX-backed policies in MDM](enable-admx-backed-policies-in-mdm.md). For more information, see [Understanding ADMX-backed policies](understanding-admx-backed-policies.md).
+
+This policy setting is applied when you turn on BitLocker. Changing the encryption type has no effect if the drive is already encrypted or if encryption is in progress. Choose Full encryption to require that the entire drive be encrypted when BitLocker is turned on. Choose Used Space Only encryption to require that only the portion of the drive that is used to store data is encrypted when BitLocker is turned on.
+
+If you enable this policy setting, the encryption type that BitLocker uses to encrypt drives is defined by this policy, and the encryption type option is not presented in the BitLocker Setup Wizard.
+
+Sample value for this node to enable this policy is:
+
+```xml
+
+```
+
+If this policy is disabled, the BitLocker Setup Wizard asks the user to select the encryption type before turning on BitLocker.
+
+>[!Note]
+>This policy is ignored when shrinking or expanding a volume, and the BitLocker driver uses the current encryption method.
+>For example, when a drive that is using Used Space Only encryption is expanded, the new free space is not wiped as it would be for a drive that uses Full encryption. The user could wipe the free space on a Used Space Only drive by using the following command: manage-bde -w. If the volume is shrunk, no action is taken for the new free space.
+
+For more information about the tool to manage BitLocker, see [Manage-bde](/windows-server/administration/windows-commands/manage-bde).
+
**SystemDrivesRequireStartupAuthentication**
@@ -267,26 +494,15 @@ Data type is string. Supported operations are Add, Get, Replace, and Delete.
This setting is a direct mapping to the BitLocker Group Policy "Require additional authentication at startup".
-
-
-
Home
-
Pro
-
Business
-
Enterprise
-
Education
-
Mobile
-
-
-
-
-
-
-
-
-
-
-
-
+
+|Edition|Windows 10|Windows 11|
+|--- |--- |--- |
+|Home|No|No|
+|Pro|Yes|Yes|
+|Business|Yes|Yes|
+|Enterprise|Yes|Yes|
+|Education|Yes|Yes|
+
ADMX Info:
@@ -299,7 +515,7 @@ ADMX Info:
> [!TIP]
-> For a step-by-step guide to enable ADMX-backed policies, see [Enable ADMX-backed policies in MDM](enable-admx-backed-policies-in-mdm.md). For additional information, see [Understanding ADMX-backed policies](understanding-admx-backed-policies.md).
+> For a step-by-step guide to enable ADMX-backed policies, see [Enable ADMX-backed policies in MDM](enable-admx-backed-policies-in-mdm.md). For more information, see [Understanding ADMX-backed policies](understanding-admx-backed-policies.md).
This setting allows you to configure whether BitLocker requires additional authentication each time the computer starts and whether you are using BitLocker with or without a TPM. This setting is applied when you turn on BitLocker.
@@ -375,26 +591,15 @@ Data type is string. Supported operations are Add, Get, Replace, and Delete.
This setting is a direct mapping to the BitLocker Group Policy "Configure minimum PIN length for startup".
-
-
-
Home
-
Pro
-
Business
-
Enterprise
-
Education
-
Mobile
-
-
-
-
-
-
-
-
-
-
-
-
+
+|Edition|Windows 10|Windows 11|
+|--- |--- |--- |
+|Home|No|No|
+|Pro|Yes|Yes|
+|Business|Yes|Yes|
+|Enterprise|Yes|Yes|
+|Education|Yes|Yes|
+
ADMX Info:
@@ -407,7 +612,7 @@ ADMX Info:
> [!TIP]
-> For a step-by-step guide to enable ADMX-backed policies, see [Enable ADMX-backed policies in MDM](enable-admx-backed-policies-in-mdm.md). For additional information, see [Understanding ADMX-backed policies](understanding-admx-backed-policies.md).
+> For a step-by-step guide to enable ADMX-backed policies, see [Enable ADMX-backed policies in MDM](enable-admx-backed-policies-in-mdm.md). For more information, see [Understanding ADMX-backed policies](understanding-admx-backed-policies.md).
This setting allows you to configure a minimum length for a Trusted Platform Module (TPM) startup PIN. This setting is applied when you turn on BitLocker. The startup PIN must have a minimum length of 6 digits and can have a maximum length of 20 digits.
@@ -452,26 +657,15 @@ This setting is a direct mapping to the BitLocker Group Policy "Configure pre-bo
(PrebootRecoveryInfo_Name).
-
-
-
Home
-
Pro
-
Business
-
Enterprise
-
Education
-
Mobile
-
-
-
-
-
-
-
-
-
-
-
-
+
+|Edition|Windows 10|Windows 11|
+|--- |--- |--- |
+|Home|No|No|
+|Pro|Yes|Yes|
+|Business|Yes|Yes|
+|Enterprise|Yes|Yes|
+|Education|Yes|Yes|
+
ADMX Info:
@@ -484,7 +678,7 @@ ADMX Info:
> [!TIP]
-> For a step-by-step guide to enable ADMX-backed policies, see [Enable ADMX-backed policies in MDM](enable-admx-backed-policies-in-mdm.md). For additional information, see [Understanding ADMX-backed policies](understanding-admx-backed-policies.md).
+> For a step-by-step guide to enable ADMX-backed policies, see [Enable ADMX-backed policies in MDM](enable-admx-backed-policies-in-mdm.md). For more information, see [Understanding ADMX-backed policies](understanding-admx-backed-policies.md).
This setting lets you configure the entire recovery message or replace the existing URL that is displayed on the pre-boot key recovery screen when the OS drive is locked.
@@ -541,26 +735,15 @@ Data type is string. Supported operations are Add, Get, Replace, and Delete.
This setting is a direct mapping to the BitLocker Group Policy "Choose how BitLocker-protected operating system drives can be recovered" (OSRecoveryUsage_Name).
-
-
-
Home
-
Pro
-
Business
-
Enterprise
-
Education
-
Mobile
-
-
-
-
-
-
-
-
-
-
-
-
+
+|Edition|Windows 10|Windows 11|
+|--- |--- |--- |
+|Home|No|No|
+|Pro|Yes|Yes|
+|Business|Yes|Yes|
+|Enterprise|Yes|Yes|
+|Education|Yes|Yes|
+
ADMX Info:
@@ -573,7 +756,7 @@ ADMX Info:
> [!TIP]
-> For a step-by-step guide to enable ADMX-backed policies, see [Enable ADMX-backed policies in MDM](enable-admx-backed-policies-in-mdm.md). For additional information, see [Understanding ADMX-backed policies](understanding-admx-backed-policies.md).
+> For a step-by-step guide to enable ADMX-backed policies, see [Enable ADMX-backed policies in MDM](enable-admx-backed-policies-in-mdm.md). For more information, see [Understanding ADMX-backed policies](understanding-admx-backed-policies.md).
This setting allows you to control how BitLocker-protected operating system drives are recovered in the absence of the required startup key information. This setting is applied when you turn on BitLocker.
@@ -638,26 +821,15 @@ Data type is string. Supported operations are Add, Get, Replace, and Delete.
This setting is a direct mapping to the BitLocker Group Policy "Choose how BitLocker-protected fixed drives can be recovered" ().
-
-
-
Home
-
Pro
-
Business
-
Enterprise
-
Education
-
Mobile
-
-
-
-
-
-
-
-
-
-
-
-
+
+|Edition|Windows 10|Windows 11|
+|--- |--- |--- |
+|Home|No|No|
+|Pro|Yes|Yes|
+|Business|Yes|Yes|
+|Enterprise|Yes|Yes|
+|Education|Yes|Yes|
+
ADMX Info:
@@ -670,7 +842,7 @@ ADMX Info:
> [!TIP]
-> For a step-by-step guide to enable ADMX-backed policies, see [Enable ADMX-backed policies in MDM](enable-admx-backed-policies-in-mdm.md). For additional information, see [Understanding ADMX-backed policies](understanding-admx-backed-policies.md).
+> For a step-by-step guide to enable ADMX-backed policies, see [Enable ADMX-backed policies in MDM](enable-admx-backed-policies-in-mdm.md). For more information, see [Understanding ADMX-backed policies](understanding-admx-backed-policies.md).
This setting allows you to control how BitLocker-protected fixed data drives are recovered in the absence of the required credentials. This setting is applied when you turn on BitLocker.
@@ -744,26 +916,15 @@ Data type is string. Supported operations are Add, Get, Replace, and Delete.
This setting is a direct mapping to the BitLocker Group Policy "Deny write access to fixed drives not protected by BitLocker" (FDVDenyWriteAccess_Name).
-
-
-
Home
-
Pro
-
Business
-
Enterprise
-
Education
-
Mobile
-
-
-
-
-
-
-
-
-
-
-
-
+
+|Edition|Windows 10|Windows 11|
+|--- |--- |--- |
+|Home|No|No|
+|Pro|Yes|Yes|
+|Business|Yes|Yes|
+|Enterprise|Yes|Yes|
+|Education|Yes|Yes|
+
ADMX Info:
@@ -776,7 +937,7 @@ ADMX Info:
> [!TIP]
-> For a step-by-step guide to enable ADMX-backed policies, see [Enable ADMX-backed policies in MDM](enable-admx-backed-policies-in-mdm.md). For additional information, see [Understanding ADMX-backed policies](understanding-admx-backed-policies.md).
+> For a step-by-step guide to enable ADMX-backed policies, see [Enable ADMX-backed policies in MDM](enable-admx-backed-policies-in-mdm.md). For more information, see [Understanding ADMX-backed policies](understanding-admx-backed-policies.md).
This setting determines whether BitLocker protection is required for fixed data drives to be writable on a computer.
@@ -806,6 +967,56 @@ If you disable or do not configure this setting, all fixed data drives on the co
```
Data type is string. Supported operations are Add, Get, Replace, and Delete.
+
+
+**FixedDrivesEncryptionType**
+
+Allows you to configure the encryption type on fixed data drives that is used by BitLocker.
+
+
+
+|Edition|Windows 10|Windows 11|
+|--- |--- |--- |
+|Home|No|No|
+|Pro|Yes|Yes|
+|Business|Yes|Yes|
+|Enterprise|Yes|Yes|
+|Education|Yes|Yes|
+
+
+
+ADMX Info:
+
+
GP English name: Enforce drive encryption type on fixed data drives
+
GP name: FDVEncryptionType_Name
+
GP path: Windows Components/BitLocker Drive Encryption/Fixed Data Drives
+
GP ADMX file name: VolumeEncryption.admx
+
+
+
+> [!TIP]
+> For a step-by-step guide to enable ADMX-backed policies, see [Enable ADMX-backed policies in MDM](enable-admx-backed-policies-in-mdm.md). For more information, see [Understanding ADMX-backed policies](understanding-admx-backed-policies.md).
+
+This policy setting is applied when you turn on BitLocker and controls whether fixed data drives utilize Used Space Only encryption or Full encryption. Setting this policy also causes the BitLocker Setup Wizard to skip the encryption options page so no encryption selection displays to the user.
+
+Changing the encryption type has no effect if the drive is already encrypted or if encryption is in progress. Choose Full encryption to require that the entire drive be encrypted when BitLocker is turned on. Choose Used Space Only encryption to require that only the portion of the drive that is used to store data is encrypted when BitLocker is turned on.
+
+If you enable this policy setting, the encryption type that BitLocker uses to encrypt drives, and the encryption type option is not presented in the BitLocker Setup Wizard.
+
+Sample value for this node to enable this policy is:
+
+```xml
+
+```
+
+If this policy is disabled, the BitLocker Setup Wizard asks the user to select the encryption type before turning on BitLocker.
+
+>[!Note]
+>This policy is ignored when you are shrinking or expanding a volume and the BitLocker driver uses the current encryption method.
+>For example, when a drive that is using Used Space Only encryption is expanded, the new free space is not wiped as it would be for a drive that is using Full encryption. The user could wipe the free space on a Used Space Only drive by using the following command: manage-bde -w. If the volume is shrunk, no action is taken for the new free space.
+
+For more information about the tool to manage BitLocker, see [Manage-bde](/windows-server/administration/windows-commands/manage-bde).
+
**RemovableDrivesRequireEncryption**
@@ -813,26 +1024,15 @@ Data type is string. Supported operations are Add, Get, Replace, and Delete.
This setting is a direct mapping to the BitLocker Group Policy "Deny write access to removable drives not protected by BitLocker" (RDVDenyWriteAccess_Name).
-
-
-
Home
-
Pro
-
Business
-
Enterprise
-
Education
-
Mobile
-
-
-
-
-
-
-
-
-
-
-
-
+
+|Edition|Windows 10|Windows 11|
+|--- |--- |--- |
+|Home|No|No|
+|Pro|Yes|Yes|
+|Business|Yes|Yes|
+|Enterprise|Yes|Yes|
+|Education|Yes|Yes|
+
ADMX Info:
@@ -845,7 +1045,7 @@ ADMX Info:
> [!TIP]
-> For a step-by-step guide to enable ADMX-backed policies, see [Enable ADMX-backed policies in MDM](enable-admx-backed-policies-in-mdm.md). For additional information, see [Understanding ADMX-backed policies](understanding-admx-backed-policies.md).
+> For a step-by-step guide to enable ADMX-backed policies, see [Enable ADMX-backed policies in MDM](enable-admx-backed-policies-in-mdm.md). For more information, see [Understanding ADMX-backed policies](understanding-admx-backed-policies.md).
This setting configures whether BitLocker protection is required for a computer to be able to write data to a removable data drive.
@@ -886,6 +1086,104 @@ Disabling the policy will let the system choose the default behaviors. If you wa
```
+
+
+**RemovableDrivesEncryptionType**
+
+Allows you to configure the encryption type that is used by BitLocker.
+
+
+
+|Edition|Windows 10|Windows 11|
+|--- |--- |--- |
+|Home|No|No|
+|Pro|Yes|Yes|
+|Business|Yes|Yes|
+|Enterprise|Yes|Yes|
+|Education|Yes|Yes|
+
+
+
+ADMX Info:
+
+
GP English name: Enforce drive encryption type on removable data drives
+
GP name: RDVEncryptionType_Name
+
GP path: Windows Components/BitLocker Drive Encryption/Removable Data Drives
+
GP ADMX file name: VolumeEncryption.admx
+
+
+
+> [!TIP]
+> For a step-by-step guide to enable ADMX-backed policies, see [Enable ADMX-backed policies in MDM](enable-admx-backed-policies-in-mdm.md). For more information, see [Understanding ADMX-backed policies](understanding-admx-backed-policies.md).
+
+This policy controls whether removed data drives utilize Full encryption or Used Space Only encryption, and is applied when you turn on BitLocker. Setting this policy also causes the BitLocker Setup Wizard to skip the encryption options page, so no encryption selection displays to the user.
+
+Changing the encryption type has no effect if the drive is already encrypted or if encryption is in progress. Choose Full encryption to require that the entire drive be encrypted when BitLocker is turned on. Choose Used Space Only encryption to require that only the portion of the drive that is used to store data is encrypted when BitLocker is turned on.
+
+If you enable this policy setting, the encryption type that BitLocker uses to encrypt drives is defined by this policy, and the encryption type option is not presented in the BitLocker Setup Wizard.
+
+Sample value for this node to enable this policy is:
+
+```xml
+
+```
+
+If this policy is disabled or not configured, the BitLocker Setup Wizard asks the user to select the encryption type before turning on BitLocker.
+
+
+
+**RemovableDrivesConfigureBDE**
+
+Allows you to control the use of BitLocker on removable data drives.
+
+
+
+|Edition|Windows 10|Windows 11|
+|--- |--- |--- |
+|Home|No|No|
+|Pro|Yes|Yes|
+|Business|Yes|Yes|
+|Enterprise|Yes|Yes|
+|Education|Yes|Yes|
+
+
+
+ADMX Info:
+
+
GP English name: Control use of BitLocker on removable drives
+
GP name: RDVConfigureBDE_Name
+
GP path: Windows Components/BitLocker Drive Encryption/Removable Data Drives
+
GP ADMX file name: VolumeEncryption.admx
+
+
+
+> [!TIP]
+> For a step-by-step guide to enable ADMX-backed policies, see [Enable ADMX-backed policies in MDM](enable-admx-backed-policies-in-mdm.md). For more information, see [Understanding ADMX-backed policies](understanding-admx-backed-policies.md).
+
+This policy setting is used to prevent users from turning BitLocker on or off on removable data drives, and is applied when you turn on BitLocker.
+
+For information about suspending BitLocker protection, see [BitLocker Basic Deployment](/windows/security/information-protection/bitlocker/bitlocker-basic-deployment) .
+
+The options for choosing property settings that control how users can configure BitLocker are:
+
+- **Allow users to apply BitLocker protection on removable data drives**: Enables the user to enable BitLocker on a removable data drives.
+- **Allow users to suspend and decrypt BitLocker on removable data drives**: Enables the user to remove BitLocker from the drive or to suspend the encryption while performing maintenance.
+
+If you enable this policy setting, you can select property settings that control how users can configure BitLocker.
+
+Sample value for this node to enable this policy is:
+
+```xml
+
+```
+Data id:
+- RDVAllowBDE_Name: Allow users to apply BitLocker protection on removable data drives
+- RDVDisableBDE_Name: Allow users to suspend and decrypt BitLocker on removable data drives
+
+If this policy is disabled,users cannot use BitLocker on removable disk drives.
+
+If you do not configure this policy setting, users can use BitLocker on removable disk drives.
+
**AllowWarningForOtherDiskEncryption**
@@ -898,26 +1196,15 @@ Allows the admin to disable the warning prompt for other disk encryption on the
> [!Warning]
> When you enable BitLocker on a device with third-party encryption, it may render the device unusable and require you to reinstall Windows.
-
-
-
Home
-
Pro
-
Business
-
Enterprise
-
Education
-
Mobile
-
-
-
-
-
-
-
-
-
-
-
-
+
+|Edition|Windows 10|Windows 11|
+|--- |--- |--- |
+|Home|No|No|
+|Pro|Yes|Yes|
+|Business|Yes|Yes|
+|Enterprise|Yes|Yes|
+|Education|Yes|Yes|
+
The following list shows the supported values:
@@ -962,26 +1249,15 @@ Allows Admin to enforce "RequireDeviceEncryption" policy for scenarios where pol
If "AllowWarningForOtherDiskEncryption" is not set, or is set to "1", "RequireDeviceEncryption" policy will not try to encrypt drive(s) if a standard user is the current logged on user in the system.
-
-
-
Home
-
Pro
-
Business
-
Enterprise
-
Education
-
Mobile
-
-
-
-
-
-
-
-
-
-
-
-
+
+|Edition|Windows 10|Windows 11|
+|--- |--- |--- |
+|Home|No|No|
+|Pro|Yes|Yes|
+|Business|Yes|Yes|
+|Enterprise|Yes|Yes|
+|Education|Yes|Yes|
+
The expected values for this policy are:
@@ -1017,26 +1293,15 @@ This setting initiates a client-driven recovery password refresh after an OS dri
-
-
-
Home
-
Pro
-
Business
-
Enterprise
-
Education
-
Mobile
-
-
-
-
-
-
-
-
-
-
-
-
+
+|Edition|Windows 10|Windows 11|
+|--- |--- |--- |
+|Home|No|No|
+|Pro|Yes|Yes|
+|Business|Yes|Yes|
+|Enterprise|Yes|Yes|
+|Education|Yes|Yes|
+
Value type is int. Supported operations are Add, Delete, Get, and Replace.
@@ -1072,26 +1337,15 @@ Each server-side recovery key rotation is represented by a request ID. The serve
- RotateRecoveryPasswordsRequestID: Returns request ID of last request processed.
- RotateRecoveryPasswordsRotationStatus: Returns status of last request processed.
-
-
-
Home
-
Pro
-
Business
-
Enterprise
-
Education
-
Mobile
-
-
-
-
-
-
-
-
-
-
-
-
+
+|Edition|Windows 10|Windows 11|
+|--- |--- |--- |
+|Home|No|No|
+|Pro|Yes|Yes|
+|Business|Yes|Yes|
+|Enterprise|Yes|Yes|
+|Education|Yes|Yes|
+
Value type is string. Supported operation is Execute. Request ID is expected as a parameter.
@@ -1117,26 +1371,15 @@ Interior node. Supported operation is Get.
This node reports compliance state of device encryption on the system.
-
-
-
Home
-
Pro
-
Business
-
Enterprise
-
Education
-
Mobile
-
-
-
-
-
-
-
-
-
-
-
-
+
+|Edition|Windows 10|Windows 11|
+|--- |--- |--- |
+|Home|No|No|
+|Pro|Yes|Yes|
+|Business|Yes|Yes|
+|Enterprise|Yes|Yes|
+|Education|Yes|Yes|
+
@@ -1185,26 +1428,15 @@ Status code can be one of the following:
- 0 - Pass
- Any other code - Failure HRESULT
-
-
-
Home
-
Pro
-
Business
-
Enterprise
-
Education
-
Mobile
-
-
-
-
-
-
-
-
-
-
-
-
+
+|Edition|Windows 10|Windows 11|
+|--- |--- |--- |
+|Home|No|No|
+|Pro|Yes|Yes|
+|Business|Yes|Yes|
+|Enterprise|Yes|Yes|
+|Education|Yes|Yes|
+
Value type is int. Supported operation is Get.
@@ -1220,26 +1452,14 @@ This node reports the RequestID corresponding to RotateRecoveryPasswordsStatus.
This node needs to be queried in synchronization with RotateRecoveryPasswordsStatus to ensure the status is correctly matched to the request ID.
-
-
-
Home
-
Pro
-
Business
-
Enterprise
-
Education
-
Mobile
-
-
-
-
-
-
-
-
-
-
-
-
+
+|Edition|Windows 10|Windows 11|
+|--- |--- |--- |
+|Home|No|No|
+|Pro|Yes|Yes|
+|Business|Yes|Yes|
+|Enterprise|Yes|Yes|
+|Education|Yes|Yes|
diff --git a/windows/client-management/mdm/browserfavorite-csp.md b/windows/client-management/mdm/browserfavorite-csp.md
index bf703c3671..fa29e87d8d 100644
--- a/windows/client-management/mdm/browserfavorite-csp.md
+++ b/windows/client-management/mdm/browserfavorite-csp.md
@@ -9,7 +9,7 @@ ms.topic: article
ms.prod: w10
ms.technology: windows
author: dansimp
-ms.date: 06/26/2017
+ms.date: 10/25/2021
---
# BrowserFavorite CSP
@@ -17,14 +17,15 @@ ms.date: 06/26/2017
The BrowserFavorite configuration service provider is used to add and remove URLs from the favorites list on a device.
-> **Note** BrowserFavorite CSP is only supported in Windows Phone 8.1.
+> [!Note]
+> BrowserFavorite CSP is only supported in Windows Phone 8.1.
The BrowserFavorite configuration service provider manages only the favorites at the root favorite folder level. It does not manage subfolders under the root favorite folder nor does it manage favorites under a subfolder.
-> **Note**
-This configuration service provider requires the ID\_CAP\_CSP\_FOUNDATION and ID\_CAP\_INTERNET\_EXPLORER\_FAVORITES capabilities to be accessed from a network configuration application.
+> [!Note]
+> This configuration service provider requires the ID\_CAP\_CSP\_FOUNDATION and ID\_CAP\_INTERNET\_EXPLORER\_FAVORITES capabilities to be accessed from a network configuration application.
@@ -39,7 +40,8 @@ favorite name
***favorite name***
Required. Specifies the user-friendly name of the favorite URL that is displayed in the Favorites list of Internet Explorer.
-> **Note** The *favorite name* should contain only characters that are valid in the Windows file system. The invalid characters are: \\ / : \* ? " < > |
+> [!Note]
+> The *favorite name* should contain only characters that are valid in the Windows file system. The invalid characters are: \\ / : \* ? " < > |
@@ -69,40 +71,12 @@ Adding a new browser favorite.
The following table shows the Microsoft custom elements that this configuration service provider supports for OMA Client Provisioning.
-
+**POST**:
+```http
+https://bspmts.mp.microsoft.com/V1/Inventory/{productId}/{skuId}/Seats
+```
### URI parameters
The following parameters may be specified in the request URI.
-
-
-
-
-
-
-
-
-
Parameter
-
Type
-
Description
-
-
-
-
-
productId
-
string
-
Required. Product identifier for an application that is used by the Store for Business.
-
-
-
skuId
-
string
-
Required. Product identifier that specifies a specific SKU of an application.
-
-
-
username
-
string
-
Requires UserPrincipalName (UPN). User name of the target user account.
+|Parameter|Type|Description|
+|--- |--- |--- |
+|productId|string|Required. Product identifier for an application that is used by the Store for Business.|
+|skuId|string|Required. Product identifier that specifies a specific SKU of an application.|
+|username|string|Requires UserPrincipalName (UPN). User name of the target user account.|
+|seatAction|[SeatAction](data-structures-windows-store-for-business.md#seataction) ||
## Response
@@ -86,37 +42,8 @@ The following parameters may be specified in the request URI.
The response body contains [BulkSeatOperationResultSet](data-structures-windows-store-for-business.md#bulkseatoperationresultset).
-
Start/DisableContextMenus - added in Windows 10, version 1803.
-
RestrictedGroups/ConfigureGroupMembership - added new schema to apply and retrieve the policy.
-
-
-
+|New or updated article|Description|
+|--- |--- |
+|[BitLocker CSP](bitlocker-csp.md)|Added support for Windows 10 Pro starting in the version 1809.|
+|[Office CSP](office-csp.md)|Added FinalStatus setting in Windows 10, version 1809.|
+|[RemoteWipe CSP](remotewipe-csp.md)|Added new settings in Windows 10, version 1809.|
+|[TenantLockdown CSP](tenantlockdown-csp.md)|Added new CSP in Windows 10, version 1809.|
+|[WindowsDefenderApplicationGuard CSP](windowsdefenderapplicationguard-csp.md)|Added new settings in Windows 10, version 1809.|
+|[Policy DDF file](policy-ddf-file.md)|Posted an updated version of the Policy DDF for Windows 10, version 1809.|
+|[Policy CSP](policy-configuration-service-provider.md)|Added the following new policies in Windows 10, version 1809:
DataUsage/SetCost3G - deprecated in Windows 10, version 1809.
-
-
-
-
+|New or updated article|Description|
+|--- |--- |
+|[AssignedAccess CSP](assignedaccess-csp.md)|Added the following note:
You can only assign one single app kiosk profile to an individual user account on a device. The single app profile does not support domain groups.|
+|[PassportForWork CSP](passportforwork-csp.md)|Added new settings in Windows 10, version 1809.|
+|[EnterpriseModernAppManagement CSP](enterprisemodernappmanagement-csp.md)|Added NonRemovable setting under AppManagement node in Windows 10, version 1809.|
+|[Win32CompatibilityAppraiser CSP](win32compatibilityappraiser-csp.md)|Added new configuration service provider in Windows 10, version 1809.|
+|[WindowsLicensing CSP](windowslicensing-csp.md)|Added S mode settings and SyncML examples in Windows 10, version 1809.|
+|[SUPL CSP](supl-csp.md)|Added 3 new certificate nodes in Windows 10, version 1809.|
+|[Defender CSP](defender-csp.md)|Added a new node Health/ProductStatus in Windows 10, version 1809.|
+|[BitLocker CSP](bitlocker-csp.md)|Added a new node AllowStandardUserEncryption in Windows 10, version 1809.|
+|[DevDetail CSP](devdetail-csp.md)|Added a new node SMBIOSSerialNumber in Windows 10, version 1809.|
+|[Policy CSP](policy-configuration-service-provider.md)|Added the following new policies in Windows 10, version 1809:
+|New or updated article|Description|
+|--- |--- |
+|[Wifi CSP](wifi-csp.md)|Added a new node WifiCost in Windows 10, version 1809.|
+|[Diagnose MDM failures in Windows 10](diagnose-mdm-failures-in-windows-10.md)|Recent changes:
Added procedure for collecting logs remotely from Windows 10 Holographic.
Added procedure for downloading the MDM Diagnostic Information log.|
+|[BitLocker CSP](bitlocker-csp.md)|Added new node AllowStandardUserEncryption in Windows 10, version 1809.|
+|[Policy CSP](policy-configuration-service-provider.md)|Recent changes:
AccountPoliciesAccountLockoutPolicy
AccountLockoutDuration - removed from docs. Not supported.
AccountPoliciesAccountLockoutPolicy/AccountLockoutThreshold - removed from docs. Not supported.
AccountPoliciesAccountLockoutPolicy/ResetAccountLockoutCounterAfter - removed from docs. Not supported.
LocalPoliciesSecurityOptions/NetworkAccess_LetEveryonePermissionsApplyToAnonymousUsers - removed from docs. Not supported.
System/AllowFontProviders is not supported in HoloLens (1st gen) Commercial Suite.
Security/RequireDeviceEncryption is supported in the Home SKU.
Start/StartLayout - added a table of SKU support information.
Start/ImportEdgeAssets - added a table of SKU support information.
Added the following new policies in Windows 10, version 1809:
+|New or updated article|Description|
+|--- |--- |
+|[Policy DDF file](policy-ddf-file.md)|Updated the DDF files in the Windows 10 version 1703 and 1709.
[Download the Policy DDF file for Windows 10, version 1709](https://download.microsoft.com/download/8/C/4/8C43C116-62CB-470B-9B69-76A3E2BC32A8/PolicyDDF_all.xml)
[Download the Policy DDF file for Windows 10, version 1703](https://download.microsoft.com/download/7/2/C/72C36C37-20F9-41BF-8E23-721F6FFC253E/PolicyDDF_all.xml)|
## April 2018
-
Updated version available. MMAT is a tool you can use to determine which Group Policies are set on a target user/computer and cross-reference them against the list of supported MDM policies.
+|New or updated article|Description|
+|--- |--- |
+|[WindowsDefenderApplicationGuard CSP](windowsdefenderapplicationguard-csp.md)|Added the following node in Windows 10, version 1803:
Settings/AllowVirtualGPU
Settings/SaveFilesToHost|
+|[NetworkProxy CSP](\networkproxy--csp.md)|Added the following node in Windows 10, version 1803:
ProxySettingsPerUser|
+|[Accounts CSP](accounts-csp.md)|Added a new CSP in Windows 10, version 1803.|
+|[MDM Migration Analysis Tool (MMAT)](https://aka.ms/mmat)|Updated version available. MMAT is a tool you can use to determine which Group Policies are set on a target user/computer and cross-reference them against the list of supported MDM policies.|
+|[CSP DDF files download](configuration-service-provider-reference.md#csp-ddf-files-download)|Added the DDF download of Windows 10, version 1803 configuration service providers.|
+|[Policy CSP](policy-configuration-service-provider.md)|Added the following new policies for Windows 10, version 1803:
Browser/AllowCookies - updated the supported values. There are 3 values - 0, 1, 2.
-
InternetExplorer/AllowSiteToZoneAssignmentList - updated the description and added an example SyncML
-
TextInput/AllowIMENetworkAccess - introduced new suggestion services in Japanese IME in addition to cloud suggestion.
-
-
Added a new section:
-
-
[Policies in Policy CSP supported by Group Policy - list of policies in Policy CSP that has corresponding Group Policy. The policy description contains the GP information, such as GP policy name and variable name.
Reverted back to Windows 10, version 1709. Removed previous draft documentation for version 1803.
-
-
-
+|New or updated article|Description|
+|--- |--- |
+|[eUICCs CSP](euiccs-csp.md)|Added the following node in Windows 10, version 1803:
IsEnabled|
+|[DeviceStatus CSP](devicestatus-csp.md)|Added the following node in Windows 10, version 1803:
OS/Mode|
+|[Understanding ADMX-backed policies](understanding-admx-backed-policies.md)|Added the following videos:
[How to create a custom xml to enable an ADMX-backed policy and deploy the XML in Intune](https://www.microsoft.com/showcase/video.aspx?uuid=bdc9b54b-11b0-4bdb-a022-c339d16e7121)
[How to import a custom ADMX file to a device using Intune](https://www.microsoft.com/showcase/video.aspx?uuid=a59888b1-429f-4a49-8570-c39a143d9a73)|
+|[AccountManagement CSP](accountmanagement-csp.md)|Added a new CSP in Windows 10, version 1803.|
+|[RootCATrustedCertificates CSP](rootcacertificates-csp.md)|Added the following node in Windows 10, version 1803:
UntrustedCertificates|
+|[Policy CSP](policy-configuration-service-provider.md)|Added the following new policies for Windows 10, version 1803:
Browser/AllowCookies - updated the supported values. There are 3 values - 0, 1, 2.
InternetExplorer/AllowSiteToZoneAssignmentList - updated the description and added an example SyncML
TextInput/AllowIMENetworkAccess - introduced new suggestion services in Japanese IME in addition to cloud suggestion.
Added a new section:
[[Policies in Policy CSP supported by Group Policy](/windows/client-management/mdm/policies-in-policy-csp-supported-by-group-policy) - list of policies in Policy CSP that has corresponding Group Policy. The policy description contains the GP information, such as GP policy name and variable name.|
+|[Policy CSP - Bluetooth](policy-csp-bluetooth.md)|Added new section [ServicesAllowedList usage guide](policy-csp-bluetooth.md#servicesallowedlist-usage-guide).|
+|[MultiSIM CSP](multisim-csp.md)|Added SyncML examples and updated the settings descriptions.|
+|[RemoteWipe CSP](remotewipe-csp.md)|Reverted back to Windows 10, version 1709. Removed previous draft documentation for version 1803.|
## February 2018
-
Added the following nodes in Windows 10, version 1803:
-
-
Status
-
ShellLauncher
-
StatusConfiguration
-
-
Updated the AssigneAccessConfiguration schema. Starting in Windows 10, version 1803 AssignedAccess CSP is supported in HoloLens (1st gen) Commercial Suite. Added example for HoloLens (1st gen) Commercial Suite.
Added the following node in Windows 10, version 1803:
-
-
MaintainProcessorArchitectureOnUpdate
-
-
-
-
+|New or updated article|Description|
+|--- |--- |
+|[Policy CSP](policy-configuration-service-provider.md)|Added the following new policies for Windows 10, version 1803:
TextInput/TouchKeyboardWideModeAvailability|
+|[VPNv2 ProfileXML XSD](vpnv2-profile-xsd.md)|Updated the XSD and Plug-in profile example for VPNv2 CSP.|
+|[AssignedAccess CSP](assignedaccess-csp.md)|Added the following nodes in Windows 10, version 1803:
Status
ShellLauncher
StatusConfiguration
Updated the AssigneAccessConfiguration schema. Starting in Windows 10, version 1803 AssignedAccess CSP is supported in HoloLens (1st gen) Commercial Suite. Added example for HoloLens (1st gen) Commercial Suite.|
+|[MultiSIM CSP](multisim-csp.md)|Added a new CSP in Windows 10, version 1803.|
+|[EnterpriseModernAppManagement CSP](enterprisemodernappmanagement-csp.md)|Added the following node in Windows 10, version 1803:
MaintainProcessorArchitectureOnUpdate|
## January 2018
-
Added the following nodes in Windows 10, version 1803:
-
-
Rollback
-
Rollback/FeatureUpdate
-
Rollback/QualityUpdateStatus
-
Rollback/FeatureUpdateStatus
-
-
-
-
+|New or updated article|Description|
+|--- |--- |
+|[Policy CSP](policy-configuration-service-provider.md)|Added the following new policies for Windows 10, version 1803:
Added the following policies the were added in Windows 10, version 1709
DeviceLock/MinimumPasswordAge
Settings/AllowOnlineTips
System/DisableEnterpriseAuthProxy
Security/RequireDeviceEncryption - updated to show it is supported in desktop.|
+|[BitLocker CSP](bitlocker-csp.md)|Updated the description for AllowWarningForOtherDiskEncryption to describe changes added in Windows 10, version 1803.|
+|[EnterpriseModernAppManagement CSP](enterprisemodernappmanagement-csp.md)|Added new node MaintainProcessorArchitectureOnUpdate in Windows 10, next major update.|
+|[DMClient CSP](dmclient-csp.md)|Added ./User/Vendor/MSFT/DMClient/Provider/[ProviderID]/FirstSyncStatus node. Also added the following nodes in Windows 10, version 1803:
AADSendDeviceToken
BlockInStatusPage
AllowCollectLogsButton
CustomErrorText
SkipDeviceStatusPage
SkipUserStatusPage|
+|[Defender CSP](defender-csp.md)|Added new node (OfflineScan) in Windows 10, version 1803.|
+|[UEFI CSP](uefi-csp.md)|Added a new CSP in Windows 10, version 1803.|
+|[Update CSP](update-csp.md)|Added the following nodes in Windows 10, version 1803:
+|New or updated article|Description|
+|--- |--- |
+|[Policy CSP](policy-configuration-service-provider.md)|Added the following policies for Windows 10, version 1709:
Added new nodes to the DMClient CSP in Windows 10, version 1709. Updated the CSP and DDF topics.
-
-
-
+| New or updated article | Description |
+| --- | --- |
+| [Policy DDF file](policy-ddf-file.md) | Updated the DDF content for Windows 10 version 1709. Added a link to the download of Policy DDF for Windows 10, version 1709. |
+| [Policy CSP](policy-configuration-service-provider.md) | Updated the following policies:
- Defender/ControlledFolderAccessAllowedApplications - string separator is `|` - Defender/ControlledFolderAccessProtectedFolders - string separator is `|` |
+| [eUICCs CSP](euiccs-csp.md) | Added new CSP in Windows 10, version 1709. |
+| [AssignedAccess CSP](assignedaccess-csp.md) | Added SyncML examples for the new Configuration node. |
+| [DMClient CSP](dmclient-csp.md) | Added new nodes to the DMClient CSP in Windows 10, version 1709. Updated the CSP and DDF topics. |
## September 2017
-
+|New or updated article|Description|
+|--- |--- |
+|[Policy CSP](policy-configuration-service-provider.md)|Added the following new policies for Windows 10, version 1709:
Added new settings to Update/BranchReadinessLevel policy in Windows 10 version 1709.|
+|[AssignedAccess CSP](assignedaccess-csp.md)|Starting in Windows 10, version 1709, AssignedAccess CSP is also supported in Windows 10 Pro.|
+|Microsoft Store for Business and Microsoft Store|Windows Store for Business name changed to Microsoft Store for Business. Windows Store name changed to Microsoft Store.|
+|The [[MS-MDE2]: Mobile Device Enrollment Protocol Version 2](/openspecs/windows_protocols/ms-mde2/4d7eadd5-3951-4f1c-8159-c39e07cbe692)|The Windows 10 enrollment protocol was updated. The following elements were added to the RequestSecurityToken message:
UXInitiated - boolean value that indicates whether the enrollment is user initiated from the Settings page.
ExternalMgmtAgentHint - a string the agent uses to give hints the enrollment server may need.
DomainName - fully qualified domain name if the device is domain-joined.
For examples, see section 4.3.1 RequestSecurityToken of the MS-MDE2 protocol documentation.|
+|[EnterpriseAPN CSP](enterpriseapn-csp.md)|Added a SyncML example.|
+|[VPNv2 CSP](vpnv2-csp.md)|Added RegisterDNS setting in Windows 10, version 1709.|
+|[Enroll a Windows 10 device automatically using Group Policy](enroll-a-windows-10-device-automatically-using-group-policy.md)|Added new topic to introduce a new Group Policy for automatic MDM enrollment.|
+|[MDM enrollment of Windows-based devices](mdm-enrollment-of-windows-devices.md)|New features in the Settings app:
User sees installation progress of critical policies during MDM enrollment.
User knows what policies, profiles, apps MDM has configured
IT helpdesk can get detailed MDM diagnostic information using client tools
For details, see [Managing connections](mdm-enrollment-of-windows-devices.md#manage-connections) and [Collecting diagnostic logs](mdm-enrollment-of-windows-devices.md#collecting-diagnostic-logs)|
## August 2017
-
Devices that are joined to an on-premises Active Directory can enroll into MDM via the Work access page in Settings. However, the enrollment can only target the user enrolled with user-specific policies. Device targeted policies will continue to impact all users of the device.
Added information to the ADMX-backed policies. Changed the minimum personal identification number (PIN) length to 4 digits in SystemDrivesRequireStartupAuthentication and SystemDrivesMinimumPINLength in Windows 10, version 1709.
-
Changed the name of new policy to CredentialProviders/DisableAutomaticReDeploymentCredentials from CredentialProviders/EnableWindowsAutopilotResetCredentials.
-
Changed the names of the following policies:
-
-
Defender/GuardedFoldersAllowedApplications to Defender/ControlledFolderAccessAllowedApplications
-
Defender/GuardedFoldersList to Defender/ControlledFolderAccessProtectedFolders
-
Defender/EnableGuardMyFolders to Defender/EnableControlledFolderAccess
\ No newline at end of file
+|New or updated article|Description|
+|--- |--- |
+|[Enable ADMX-backed policies in MDM](enable-admx-backed-policies-in-mdm.md)|Added new step-by-step guide to enable ADMX-backed policies.|
+|[Mobile device enrollment](mobile-device-enrollment.md)|Added the following statement:
Devices that are joined to an on-premises Active Directory can enroll into MDM via the Work access page in Settings. However, the enrollment can only target the user enrolled with user-specific policies. Device targeted policies will continue to impact all users of the device.|
+|[CM_CellularEntries CSP](cm-cellularentries-csp.md)|Updated the description of the PuposeGroups node to add the GUID for applications. This node is required instead of optional.|
+|[EnterpriseDataProtection CSP](enterprisedataprotection-csp.md)|Updated the Settings/EDPEnforcementLevel values to the following:
0 (default) – Off / No protection (decrypts previously protected data).
1 – Silent mode (encrypt and audit only).
2 – Allow override mode (encrypt, prompt and allow overrides, and audit).
3 – Hides overrides (encrypt, prompt but hide overrides, and audit).|
+|[AppLocker CSP](applocker-csp.md)|Added two new SyncML examples (to disable the calendar app and to block usage of the map app) in [Allow list examples](applocker-csp.md#allow-list-examples).|
+|[DeviceManageability CSP](devicemanageability-csp.md)|Added the following settings in Windows 10, version 1709:
Provider/ProviderID/ConfigInfo
Provider/ProviderID/EnrollmentInfo|
+|[Office CSP](office-csp.md)|Added the following setting in Windows 10, version 1709:
Installation/CurrentStatus|
+|[BitLocker CSP](bitlocker-csp.md)|Added information to the ADMX-backed policies. Changed the minimum personal identification number (PIN) length to 4 digits in SystemDrivesRequireStartupAuthentication and SystemDrivesMinimumPINLength in Windows 10, version 1709.|
+|[Firewall CSP](firewall-csp.md)|Updated the CSP and DDF topics. Here are the changes:
Removed the two settings - FirewallRules/FirewallRuleName/FriendlyName and FirewallRules/FirewallRuleName/IcmpTypesAndCodes.
Changed some data types from integer to bool.
Updated the list of supported operations for some settings.
Added default values.|
+|[Policy DDF file](policy-ddf-file.md)|Added another Policy DDF file [download](https://download.microsoft.com/download/6/1/C/61C022FD-6F5D-4F73-9047-17F630899DC4/PolicyDDF_all_version1607_8C.xml) for the 8C release of Windows 10, version 1607, which added the following policies:
Browser/AllowMicrosoftCompatibilityList
Update/DisableDualScan
Update/FillEmptyContentUrls|
+|[Policy CSP](policy-configuration-service-provider.md)|Added the following new policies for Windows 10, version 1709:
Changed the name of new policy to CredentialProviders/DisableAutomaticReDeploymentCredentials from CredentialProviders/EnableWindowsAutopilotResetCredentials.
Changed the names of the following policies:
Defender/GuardedFoldersAllowedApplications to Defender/ControlledFolderAccessAllowedApplications
Defender/GuardedFoldersList to Defender/ControlledFolderAccessProtectedFolders
Defender/EnableGuardMyFolders to Defender/EnableControlledFolderAccess
Added links to the additional [ADMX-backed BitLocker policies](policy-csp-bitlocker.md).
There were issues reported with the previous release of the following policies. These issues were fixed in Windows 10, version 1709:
Optional. Type: String. Specifies the type of connection used for the APN. The following connection types are available:
-
-
-
-
-
-
-
-
Gprs
-
Default. Used for GPRS type connections (GPRS + GSM + EDGE + UMTS + LTE).
-
-
-
Cdma
-
Used for CDMA type connections (1XRTT + EVDO).
-
-
-
Lte
-
Used for LTE type connections (eHRPD + LTE) when the device is registered HOME.
-
-
-
Legacy
-
Used for GPRS + GSM + EDGE + UMTS connections.
-
-
-
Lte_iwlan
-
Used for GPRS type connections that may be offloaded over WiFi
-
-
-
Iwlan
-
Used for connections that are implemented over WiFi offload only
-
-
-
+|Connection type|Usage|
+|--- |--- |
+|Gprs|Default. Used for GPRS type connections (GPRS + GSM + EDGE + UMTS + LTE).|
+|Cdma|Used for CDMA type connections (1XRTT + EVDO).|
+|Lte|Used for LTE type connections (eHRPD + LTE) when the device is registered HOME.|
+|Legacy|Used for GPRS + GSM + EDGE + UMTS connections.|
+|Lte_iwlan|Used for GPRS type connections that may be offloaded over WiFi|
+|Iwlan|Used for connections that are implemented over WiFi offload only|
@@ -295,37 +271,14 @@ Configuring a CDMA connection:
## Microsoft Custom Elements
-
The following table shows the Microsoft custom elements that this configuration service provider supports for OMA Client Provisioning.
-
-
-
-
-
-
-
-
Element
-
Available
-
-
-
-
-
Nocharacteristic
-
Yes
-
-
-
Characteristic-query
-
Yes
-
-
-
Parm-query
-
Yes
-
-
-
+|Element|Available|
+|--- |--- |
+|Nocharacteristic|Yes|
+|Characteristic-query|Yes|
+|Parm-query|Yes|
-
## Related topics
diff --git a/windows/client-management/mdm/cmpolicy-csp.md b/windows/client-management/mdm/cmpolicy-csp.md
index 1cac56d2f6..a9652c71d0 100644
--- a/windows/client-management/mdm/cmpolicy-csp.md
+++ b/windows/client-management/mdm/cmpolicy-csp.md
@@ -8,7 +8,7 @@ ms.author: dansimp
ms.topic: article
ms.prod: w10
ms.technology: windows
-author: manikadhiman
+author: dansimp
ms.date: 06/26/2017
---
@@ -29,7 +29,7 @@ Each policy entry identifies one or more applications in combination with a host
The following shows the CMPolicy configuration service provider management object in tree format as used by both Open Mobile Alliance (OMA) Client Provisioning and OMA Device Management.
-```
+```console
./Vendor/MSFT
CMPolicy
----PolicyName
@@ -42,6 +42,7 @@ CMPolicy
----------------ConnectionID
----------------Type
```
+
***policyName***
Defines the name of the policy.
@@ -83,154 +84,44 @@ For `CMST_CONNECTION_NAME`, specify the connection name. For example, if you hav
For `CMST_CONNECTION_TYPE`, specify the GUID for the desired connection type. The curly brackets {} around the GUID are required. The following connection types are available:
-
-
-
-
-
-
-
-
Connection type
-
GUID
-
-
-
-
-
GSM
-
{A05DC613-E393-40ad-AA89-CCCE04277CD9}
-
-
-
CDMA
-
{274AD55A-4A70-4E35-93B3-AE2D2E6727FC}
-
-
-
Legacy 3GPP
-
{6DE4C04B-B74E-47FA-99E5-8F2097C06A92}
-
-
-
LTE
-
{2378E547-8312-46A5-905E-5C581E92693B}
-
-
-
Wi-Fi
-
{8568B401-858E-4B7B-B3DF-0FD4927F131B}
-
-
-
Wi-Fi hotspot
-
{072FC7DC-1D93-40D1-9BB0-2114D7D73434}
-
-
-
+|Connection type|GUID|
+|--- |--- |
+|GSM|{A05DC613-E393-40ad-AA89-CCCE04277CD9}|
+|CDMA|{274AD55A-4A70-4E35-93B3-AE2D2E6727FC}|
+|Legacy 3GPP|{6DE4C04B-B74E-47FA-99E5-8F2097C06A92}|
+|LTE|{2378E547-8312-46A5-905E-5C581E92693B}|
+|Wi-Fi|{8568B401-858E-4B7B-B3DF-0FD4927F131B}|
+|Wi-Fi hotspot|{072FC7DC-1D93-40D1-9BB0-2114D7D73434}|
-
For `CMST_CONNECTION_NETWORK_TYPE`, specify the GUID for the desired network type. The curly brackets {} around the GUID are required. The following network types are available:
-
-
-
-
-
-
-
-
Network type
-
GUID
-
-
-
-
-
GPRS
-
{AFB7D659-FC1F-4EA5-BDD0-0FDA62676D96}
-
-
-
1XRTT
-
{B1E700AE-A62F-49FF-9BBE-B880C995F27D}
-
-
-
EDGE
-
{C347F8EC-7095-423D-B838-7C7A7F38CD03}
-
-
-
WCDMA UMTS
-
{A72F04C6-9BE6-4151-B5EF-15A53E12C482}
-
-
-
WCDMA FOMA
-
{B8326098-F845-42F3-804E-8CC3FF7B50B4}
-
-
-
1XEVDO
-
{DD42DF39-EBDF-407C-8146-1685416401B2}
-
-
-
1XEVDV
-
{61BF1BFD-5218-4CD4-949C-241CA3F326F6}
-
-
-
HSPA HSDPA
-
{047F7282-BABD-4893-AA77-B8B312657F8C}
-
-
-
HSPA HSUPA
-
{1536A1C6-A4AF-423C-8884-6BDDA3656F84}
-
-
-
LTE
-
{B41CBF43-6994-46FF-9C2F-D6CA6D45889B}
-
-
-
EHRPD
-
{7CFA04A5-0F3F-445C-88A4-C86ED2AD94EA}
-
-
-
Ethernet 10 Mbps
-
{97D3D1B3-854A-4C32-BD1C-C13069078370}
-
-
-
Ethernet 100 Mbps
-
{A8F4FE66-8D04-43F5-9DD2-2A85BD21029B}
-
-
-
Ethernet Gbps
-
{556C1E6B-B8D4-448E-836D-9451BA4CCE75}
-
-
-
-
+|Network type|GUID|
+|--- |--- |
+|GPRS|{AFB7D659-FC1F-4EA5-BDD0-0FDA62676D96}|
+|1XRTT|{B1E700AE-A62F-49FF-9BBE-B880C995F27D}|
+|EDGE|{C347F8EC-7095-423D-B838-7C7A7F38CD03}|
+|WCDMA UMTS|{A72F04C6-9BE6-4151-B5EF-15A53E12C482}|
+|WCDMA FOMA|{B8326098-F845-42F3-804E-8CC3FF7B50B4}|
+|1XEVDO|{DD42DF39-EBDF-407C-8146-1685416401B2}|
+|1XEVDV|{61BF1BFD-5218-4CD4-949C-241CA3F326F6}|
+|HSPA HSDPA|{047F7282-BABD-4893-AA77-B8B312657F8C}|
+|HSPA HSUPA|{1536A1C6-A4AF-423C-8884-6BDDA3656F84}|
+|LTE|{B41CBF43-6994-46FF-9C2F-D6CA6D45889B}|
+|EHRPD|{7CFA04A5-0F3F-445C-88A4-C86ED2AD94EA}|
+|Ethernet 10 Mbps|{97D3D1B3-854A-4C32-BD1C-C13069078370}|
+|Ethernet 100 Mbps|{A8F4FE66-8D04-43F5-9DD2-2A85BD21029B}|
+|Ethernet Gbps|{556C1E6B-B8D4-448E-836D-9451BA4CCE75}|
For `CMST_CONNECTION_DEVICE_TYPE`, specify the GUID for the desired device type. The curly brackets {} around the GUID are required. The following device types are available:
-
-
-
-
-
-
-
-
Device type
-
GUID
-
-
-
-
-
Cellular device
-
{F9A53167-4016-4198-9B41-86D9522DC019}
-
-
-
Ethernet
-
{97844272-00C7-4572-B20A-D8D861C095F2}
-
-
-
Bluetooth
-
{1D793123-701A-4fd0-B6AE-9C3C57E99C2C}
-
-
-
Virtual
-
{EAA02CE5-9C70-4E87-97FE-55C9DEC847D4}
-
-
-
+|Device type|GUID|
+|--- |--- |
+|Cellular device|{F9A53167-4016-4198-9B41-86D9522DC019}|
+|Ethernet|{97844272-00C7-4572-B20A-D8D861C095F2}|
+|Bluetooth|{1D793123-701A-4fd0-B6AE-9C3C57E99C2C}|
+|Virtual|{EAA02CE5-9C70-4E87-97FE-55C9DEC847D4}|
@@ -479,36 +370,11 @@ Adding a host-based mapping policy:
## Microsoft Custom Elements
-
Top-level query: Yes|
## Related topics
diff --git a/windows/client-management/mdm/cmpolicyenterprise-csp.md b/windows/client-management/mdm/cmpolicyenterprise-csp.md
index 3a5cc913a6..d843207762 100644
--- a/windows/client-management/mdm/cmpolicyenterprise-csp.md
+++ b/windows/client-management/mdm/cmpolicyenterprise-csp.md
@@ -8,7 +8,7 @@ ms.author: dansimp
ms.topic: article
ms.prod: w10
ms.technology: windows
-author: manikadhiman
+author: dansimp
ms.date: 06/26/2017
---
@@ -29,7 +29,8 @@ Each policy entry identifies one or more applications in combination with a host
**Default Policies**: Policies are applied in order of their scope with the most specific policies considered before the more general policies. The phone’s default behavior applies to all applications and all domains and is only used when no other, more specific policy is available. The default policy is to use any available Wi-Fi network first and then any available APN.
The following shows the CMPolicyEnterprise configuration service provider management object in tree format as used by both Open Mobile Alliance (OMA) Client Provisioning and OMA Device Management.
-```
+
+```console
./Vendor/MSFT
CMPolicy
----PolicyName
@@ -83,156 +84,44 @@ For `CMST_CONNECTION_NAME`, specify the connection name. For example, if you hav
For `CMST_CONNECTION_TYPE`, specify the GUID for the desired connection type. The curly brackets {} around the GUID are required. The following connection types are available:
-
-
-
-
-
-
-
-
Connection type
-
GUID
-
-
-
-
-
GSM
-
{A05DC613-E393-40ad-AA89-CCCE04277CD9}
-
-
-
CDMA
-
{274AD55A-4A70-4E35-93B3-AE2D2E6727FC}
-
-
-
Legacy 3GPP
-
{6DE4C04B-B74E-47FA-99E5-8F2097C06A92}
-
-
-
LTE
-
{2378E547-8312-46A5-905E-5C581E92693B}
-
-
-
Wi-Fi
-
{8568B401-858E-4B7B-B3DF-0FD4927F131B}
-
-
-
Wi-Fi hotspot
-
{072FC7DC-1D93-40D1-9BB0-2114D7D73434}
-
-
-
+|Connection type|GUID|
+|--- |--- |
+|GSM|{A05DC613-E393-40ad-AA89-CCCE04277CD9}|
+|CDMA|{274AD55A-4A70-4E35-93B3-AE2D2E6727FC}|
+|Legacy 3GPP|{6DE4C04B-B74E-47FA-99E5-8F2097C06A92}|
+|LTE|{2378E547-8312-46A5-905E-5C581E92693B}|
+|Wi-Fi|{8568B401-858E-4B7B-B3DF-0FD4927F131B}|
+|Wi-Fi hotspot|{072FC7DC-1D93-40D1-9BB0-2114D7D73434}|
For `CMST_CONNECTION_NETWORK_TYPE`, specify the GUID for the desired network type. The curly brackets {} around the GUID are required. The following network types are available:
-
-
-
-
-
-
-
-
Network type
-
GUID
-
-
-
-
-
GPRS
-
{AFB7D659-FC1F-4EA5-BDD0-0FDA62676D96}
-
-
-
1XRTT
-
{B1E700AE-A62F-49FF-9BBE-B880C995F27D}
-
-
-
EDGE
-
{C347F8EC-7095-423D-B838-7C7A7F38CD03}
-
-
-
WCDMA UMTS
-
{A72F04C6-9BE6-4151-B5EF-15A53E12C482}
-
-
-
WCDMA FOMA
-
{B8326098-F845-42F3-804E-8CC3FF7B50B4}
-
-
-
1XEVDO
-
{DD42DF39-EBDF-407C-8146-1685416401B2}
-
-
-
1XEVDV
-
{61BF1BFD-5218-4CD4-949C-241CA3F326F6}
-
-
-
HSPA HSDPA
-
{047F7282-BABD-4893-AA77-B8B312657F8C}
-
-
-
HSPA HSUPA
-
{1536A1C6-A4AF-423C-8884-6BDDA3656F84}
-
-
-
LTE
-
{B41CBF43-6994-46FF-9C2F-D6CA6D45889B}
-
-
-
EHRPD
-
{7CFA04A5-0F3F-445C-88A4-C86ED2AD94EA}
-
-
-
Ethernet 10Mbps
-
{97D3D1B3-854A-4C32-BD1C-C13069078370}
-
-
-
Ethernet 100Mbps
-
{A8F4FE66-8D04-43F5-9DD2-2A85BD21029B}
-
-
-
Ethernet Gbps
-
{556C1E6B-B8D4-448E-836D-9451BA4CCE75}
-
-
-
-
-
+|Network type|GUID|
+|--- |--- |
+|GPRS|{AFB7D659-FC1F-4EA5-BDD0-0FDA62676D96}|
+|1XRTT|{B1E700AE-A62F-49FF-9BBE-B880C995F27D}|
+|EDGE|{C347F8EC-7095-423D-B838-7C7A7F38CD03}|
+|WCDMA UMTS|{A72F04C6-9BE6-4151-B5EF-15A53E12C482}|
+|WCDMA FOMA|{B8326098-F845-42F3-804E-8CC3FF7B50B4}|
+|1XEVDO|{DD42DF39-EBDF-407C-8146-1685416401B2}|
+|1XEVDV|{61BF1BFD-5218-4CD4-949C-241CA3F326F6}|
+|HSPA HSDPA|{047F7282-BABD-4893-AA77-B8B312657F8C}|
+|HSPA HSUPA|{1536A1C6-A4AF-423C-8884-6BDDA3656F84}|
+|LTE|{B41CBF43-6994-46FF-9C2F-D6CA6D45889B}|
+|EHRPD|{7CFA04A5-0F3F-445C-88A4-C86ED2AD94EA}|
+|Ethernet 10Mbps|{97D3D1B3-854A-4C32-BD1C-C13069078370}|
+|Ethernet 100Mbps|{A8F4FE66-8D04-43F5-9DD2-2A85BD21029B}|
+|Ethernet Gbps|{556C1E6B-B8D4-448E-836D-9451BA4CCE75}|
For `CMST_CONNECTION_DEVICE_TYPE`, specify the GUID for the desired device type. The curly brackets {} around the GUID are required. The following device types are available:
-
-
-
-
-
-
-
-
Device type
-
GUID
-
-
-
-
-
Cellular device
-
{F9A53167-4016-4198-9B41-86D9522DC019}
-
-
-
Ethernet
-
{97844272-00C7-4572-B20A-D8D861C095F2}
-
-
-
Bluetooth
-
{1D793123-701A-4fd0-B6AE-9C3C57E99C2C}
-
-
-
Virtual
-
{EAA02CE5-9C70-4E87-97FE-55C9DEC847D4}
-
-
-
-
-
+|Device type|GUID|
+|--- |--- |
+|Cellular device|{F9A53167-4016-4198-9B41-86D9522DC019}|
+|Ethernet|{97844272-00C7-4572-B20A-D8D861C095F2}|
+|Bluetooth|{1D793123-701A-4fd0-B6AE-9C3C57E99C2C}|
+|Virtual|{EAA02CE5-9C70-4E87-97FE-55C9DEC847D4}|
**Type**
Specifies the type of connection being referenced. The following list describes the available connection types:
@@ -479,36 +368,11 @@ Adding a host-based mapping policy:
## Microsoft Custom Elements
-
+
+|Home|Pro|Business|Enterprise|Education|
+|--- |--- |--- |--- |--- |
+||||||
@@ -2555,32 +1131,32 @@ The following list shows the CSPs supported in HoloLens devices:
| Configuration service provider | HoloLens (1st gen) Development Edition | HoloLens (1st gen) Commercial Suite | HoloLens 2 |
|------|--------|--------|--------|
-| [AccountManagement CSP](accountmanagement-csp.md) | No | Yes 4 | Yes
+| [AccountManagement CSP](accountmanagement-csp.md) | No | Yes | Yes
| [Accounts CSP](accounts-csp.md) | Yes | Yes | Yes |
| [ApplicationControl CSP](applicationcontrol-csp.md) | No | No | Yes |
| [AppLocker CSP](applocker-csp.md) | No | Yes | No |
-| [AssignedAccess CSP](assignedaccess-csp.md) | No | Yes 4 | Yes |
+| [AssignedAccess CSP](assignedaccess-csp.md) | No | Yes | Yes |
| [CertificateStore CSP](certificatestore-csp.md) | Yes | Yes| Yes |
| [ClientCertificateInstall CSP](clientcertificateinstall-csp.md) | No | Yes | Yes |
| [DevDetail CSP](devdetail-csp.md) | Yes | Yes | Yes |
-| [DeveloperSetup CSP](developersetup-csp.md) | No | Yes 2 (runtime provisioning via provisioning packages only; no MDM support)| Yes |
+| [DeveloperSetup CSP](developersetup-csp.md) | No | Yes (runtime provisioning via provisioning packages only; no MDM support)| Yes |
| [DeviceManageability CSP](devicemanageability-csp.md) | No | No | Yes |
| [DeviceStatus CSP](devicestatus-csp.md) | No | Yes | Yes |
| [DevInfo CSP](devinfo-csp.md) | Yes | Yes | Yes |
| [DiagnosticLog CSP](diagnosticlog-csp.md) | No | Yes | Yes |
| [DMAcc CSP](dmacc-csp.md) | Yes | Yes | Yes |
| [DMClient CSP](dmclient-csp.md) | Yes | Yes | Yes |
-| [EnrollmentStatusTracking CSP](enrollmentstatustracking-csp.md) | No | No | Yes 10 |
+| [EnrollmentStatusTracking CSP](enrollmentstatustracking-csp.md) | No | No | Yes |
| [EnterpriseModernAppManagement CSP](enterprisemodernappmanagement-csp.md) | No | Yes | Yes |
| [NetworkProxy CSP](networkproxy-csp.md) | No | No | Yes |
-| [NetworkQoSPolicy CSP](networkqospolicy-csp.md) | No | No | Yes 8|
+| [NetworkQoSPolicy CSP](networkqospolicy-csp.md) | No | No | Yes |
| [NodeCache CSP](nodecache-csp.md) | Yes | Yes | Yes |
[PassportForWork CSP](passportforwork-csp.md) | No | Yes | Yes |
| [Policy CSP](policy-configuration-service-provider.md) | No | Yes | Yes |
-| [RemoteFind CSP](remotefind-csp.md) | No | Yes 4 | Yes |
-| [RemoteWipe CSP](remotewipe-csp.md) (**doWipe** and **doWipePersistProvisionedData** nodes only) | No | Yes 4 | Yes |
+| [RemoteFind CSP](remotefind-csp.md) | No | Yes | Yes |
+| [RemoteWipe CSP](remotewipe-csp.md) (**doWipe** and **doWipePersistProvisionedData** nodes only) | No | Yes | Yes |
| [RootCATrustedCertificates CSP](rootcacertificates-csp.md) | No | Yes | Yes |
-| [TenantLockdown CSP](tenantlockdown-csp.md) | No | No | Yes 10 |
+| [TenantLockdown CSP](tenantlockdown-csp.md) | No | No | Yes |
| [Update CSP](update-csp.md) | No | Yes | Yes |
| [VPNv2 CSP](vpnv2-csp.md) | No | Yes | Yes |
| [WiFi CSP](wifi-csp.md) | No | Yes | Yes |
@@ -2589,11 +1165,11 @@ The following list shows the CSPs supported in HoloLens devices:
## CSPs supported in Microsoft Surface Hub
-- [Accounts CSP](accounts-csp.md)9
+- [Accounts CSP](accounts-csp.md)
> [!NOTE]
> Support in Surface Hub is limited to **Domain\ComputerName**.
- [AccountManagement CSP](accountmanagement-csp.md)
-- [APPLICATION CSP](application-csp.md)
+- [Application CSP](application-csp.md)
- [CertificateStore CSP](certificatestore-csp.md)
- [ClientCertificateInstall CSP](clientcertificateinstall-csp.md)
- [Defender CSP](defender-csp.md)
@@ -2605,27 +1181,27 @@ The following list shows the CSPs supported in HoloLens devices:
- [DMAcc CSP](dmacc-csp.md)
- [DMClient CSP](dmclient-csp.md)
- [EnterpriseModernAppManagement CSP](enterprisemodernappmanagement-csp.md)
-- [Firewall-CSP](firewall-csp.md)9
+- [Firewall-CSP](firewall-csp.md)
- [HealthAttestation CSP](healthattestation-csp.md)
- [NetworkQoSPolicy CSP](networkqospolicy-csp.md)
- [NodeCache CSP](nodecache-csp.md)
- [PassportForWork CSP](passportforwork-csp.md)
- [Policy CSP](policy-configuration-service-provider.md)
- [Reboot CSP](reboot-csp.md)
-- [RemoteWipe CSP](remotewipe-csp.md)9
+- [RemoteWipe CSP](remotewipe-csp.md)
- [Reporting CSP](reporting-csp.md)
- [RootCATrustedCertificates CSP](rootcacertificates-csp.md)
- [SurfaceHub CSP](surfacehub-csp.md)
- [UEFI CSP](uefi-csp.md)
-- [Wifi-CSP](wifi-csp.md)9
+- [Wifi-CSP](wifi-csp.md)
- [WindowsAdvancedThreatProtection CSP](windowsadvancedthreatprotection-csp.md)
-- [Wirednetwork-CSP](wirednetwork-csp.md)9
+- [Wirednetwork-CSP](wirednetwork-csp.md)
## CSPs supported in Windows 10 IoT Core
- [AllJoynManagement CSP](alljoynmanagement-csp.md)
-- [APPLICATION CSP](application-csp.md)
+- [Application CSP](application-csp.md)
- [CertificateStore CSP](certificatestore-csp.md)
- [ClientCertificateInstall CSP](clientcertificateinstall-csp.md)
- [CustomDeviceUI CSP](customdeviceui-csp.md)
@@ -2640,7 +1216,7 @@ The following list shows the CSPs supported in HoloLens devices:
- [Policy CSP](policy-configuration-service-provider.md)
- [Provisioning CSP (Provisioning only)](provisioning-csp.md)
- [Reboot CSP](reboot-csp.md)
-- [RemoteWipe CSP](remotewipe-csp.md)5
+- [RemoteWipe CSP](remotewipe-csp.md)
- [RootCATrustedCertificates CSP](rootcacertificates-csp.md)
- [UnifiedWriteFilter CSP](unifiedwritefilter-csp.md)
- [Update CSP](update-csp.md)
diff --git a/windows/client-management/mdm/customdeviceui-csp.md b/windows/client-management/mdm/customdeviceui-csp.md
index 2645a75e3f..7a4eb3b5e1 100644
--- a/windows/client-management/mdm/customdeviceui-csp.md
+++ b/windows/client-management/mdm/customdeviceui-csp.md
@@ -8,7 +8,7 @@ ms.author: dansimp
ms.topic: article
ms.prod: w10
ms.technology: windows
-author: manikadhiman
+author: dansimp
ms.date: 06/26/2017
---
diff --git a/windows/client-management/mdm/customdeviceui-ddf.md b/windows/client-management/mdm/customdeviceui-ddf.md
index 7623b155f2..40621f8a86 100644
--- a/windows/client-management/mdm/customdeviceui-ddf.md
+++ b/windows/client-management/mdm/customdeviceui-ddf.md
@@ -8,7 +8,7 @@ ms.author: dansimp
ms.topic: article
ms.prod: w10
ms.technology: windows
-author: manikadhiman
+author: dansimp
ms.date: 12/05/2017
---
diff --git a/windows/client-management/mdm/data-structures-windows-store-for-business.md b/windows/client-management/mdm/data-structures-windows-store-for-business.md
index b20c4ce200..4621e9a56d 100644
--- a/windows/client-management/mdm/data-structures-windows-store-for-business.md
+++ b/windows/client-management/mdm/data-structures-windows-store-for-business.md
@@ -1,17 +1,17 @@
---
title: Data structures for Microsoft Store for Business
+description: Learn about the various data structures for Microsoft Store for Business.
MS-HAID:
- 'p\_phdevicemgmt.business\_store\_data\_structures'
- 'p\_phDeviceMgmt.data\_structures\_windows\_store\_for\_business'
ms.assetid: ABE44EC8-CBE5-4775-BA8A-4564CB73531B
ms.reviewer:
manager: dansimp
-description: Learn about data structures for Microsoft Store for Business.
ms.author: dansimp
ms.topic: article
ms.prod: w10
ms.technology: windows
-author: manikadhiman
+author: dansimp
ms.date: 09/18/2017
---
@@ -105,7 +105,7 @@ Specifies the properties of the alternate identifier.
|lastModified|dateTime|Specifies the last modified date for an application. Modifications for an application include updated product details, updates to an application, and updates to the quantity of an application.|
|licenseType|[LicenseType](#licensetype)|Indicates whether the set of seats for a given application supports online or offline licensing.|
|distributionPolicy|[InventoryDistributionPolicy](#inventorydistributionpolicy)||
-|Status|[InventoryStatus](#inventorystatus)||
+|status|[InventoryStatus](#inventorystatus)||
## InventoryResultSet
@@ -191,20 +191,19 @@ Specifies the properties of the localized product.
|packageFamilyName|String||
|supportedPlatforms|Collection of [ProductPlatform](#productplatform)||
-
## ProductImage
Specifies the properties of the product image.
|Name|Type|Description|
|--- |--- |--- |
-|Location|URI|Location of the download image.|
-|Purpose|String|Tag for the purpose of the image, for example "screenshot" or "logo".|
-|Height|String|Height of the image in pixels.|
-|Width|String|Width of the image in pixels.|
-|Caption|String|Unlimited length.|
-|backgroundColor|String|Format "#RRGGBB"|
-|foregroundColor|String|Format "#RRGGBB"|
+|location|URI|Location of the download image.|
+|purpose|string|Tag for the image, for example "screenshot" or "logo".|
+|height|string|Height of the image in pixels.|
+|width|string|Width of the image in pixels.|
+|caption|string|Unlimited length.|
+|backgroundColor|string|Format "#RRGGBB"|
+|foregroundColor|string|Format "#RRGGBB"|
|fileSize|integer-64|Size of the file.|
## ProductKey
diff --git a/windows/client-management/mdm/defender-csp.md b/windows/client-management/mdm/defender-csp.md
index 88a8764d74..6f404d4e29 100644
--- a/windows/client-management/mdm/defender-csp.md
+++ b/windows/client-management/mdm/defender-csp.md
@@ -625,7 +625,7 @@ This policy setting controls whether or not exclusions are visible to Local Admi
If you disable or do not configure this setting, Local Admins will be able to see exclusions in the Windows Security App and via PowerShell.
-If you enable this setting, Local Admins will no longer be able to see the exclusion list in Windows Security App or via PowerShell.
+If you enable this setting, Local Admins will no longer be able to see the exclusion list in the Windows Security app or via PowerShell.
> [!NOTE]
> Applying this setting will not remove exclusions, it will only prevent them from being visible to Local Admins. This is reflected in **Get-MpPreference**.
diff --git a/windows/client-management/mdm/defender-ddf.md b/windows/client-management/mdm/defender-ddf.md
index e5da0cdb7b..fe6514f5c2 100644
--- a/windows/client-management/mdm/defender-ddf.md
+++ b/windows/client-management/mdm/defender-ddf.md
@@ -8,14 +8,14 @@ ms.author: dansimp
ms.topic: article
ms.prod: w10
ms.technology: windows
-author: manikadhiman
+author: dansimp
ms.localizationpriority: medium
ms.date: 07/23/2021
---
# Defender DDF file
-This article shows the OMA DM device description framework (DDF) for the **Defender** configuration service provider. DDF files are used only with OMA DM provisioning XML.
+This article shows the OMA DM device description framework (DDF) for the Defender configuration service provider. DDF files are used only with OMA DM provisioning XML.
Looking for the DDF XML files? See [CSP DDF files download](configuration-service-provider-reference.md#csp-ddf-files-download).
@@ -1007,5 +1007,4 @@ The XML below is the current version for this CSP.
## See also
-
-[Defender configuration service provider](defender-csp.md)
\ No newline at end of file
+[Defender configuration service provider](defender-csp.md)
diff --git a/windows/client-management/mdm/devdetail-csp.md b/windows/client-management/mdm/devdetail-csp.md
index 9466edec32..7a1c219d01 100644
--- a/windows/client-management/mdm/devdetail-csp.md
+++ b/windows/client-management/mdm/devdetail-csp.md
@@ -8,7 +8,7 @@ ms.author: dansimp
ms.topic: article
ms.prod: w10
ms.technology: windows
-author: manikadhiman
+author: dansimp
ms.date: 03/27/2020
---
@@ -77,7 +77,7 @@ For Windows 10 for desktop editions (Home, Pro, Enterprise, and Education), it r
Supported operation is Get.
**SwV**
-Required. Returns the Windows 10 OS software version in the format MajorVersion.MinorVersion.BuildNumber.QFEnumber. Currently the BuildNumber returns the build number on the desktop and mobile build number on the phone. In the future, the build numbers may converge.
+Required. Returns the Windows 10 OS software version in the format MajorVersion.MinorVersion.BuildNumber.QFEnumber. Currently the BuildNumber returns the build number on the client device. In the future, the build numbers may converge.
Supported operation is Get.
@@ -114,6 +114,8 @@ Supported operation is Get.
This value is the largest number of characters that the device can support in a single URI segment. The default value zero (0) indicates that the device supports URI segment of unlimited length.
+
+
**Ext/Microsoft/RadioSwV**
Required. Returns the radio stack software version number.
diff --git a/windows/client-management/mdm/devdetail-ddf-file.md b/windows/client-management/mdm/devdetail-ddf-file.md
index de26ad8620..29a697c6d8 100644
--- a/windows/client-management/mdm/devdetail-ddf-file.md
+++ b/windows/client-management/mdm/devdetail-ddf-file.md
@@ -8,7 +8,7 @@ ms.author: dansimp
ms.topic: article
ms.prod: w10
ms.technology: windows
-author: manikadhiman
+author: dansimp
ms.date: 06/03/2020
---
diff --git a/windows/client-management/mdm/developersetup-csp.md b/windows/client-management/mdm/developersetup-csp.md
index f36f744684..b27c178d3c 100644
--- a/windows/client-management/mdm/developersetup-csp.md
+++ b/windows/client-management/mdm/developersetup-csp.md
@@ -8,7 +8,7 @@ ms.author: dansimp
ms.topic: article
ms.prod: w10
ms.technology: windows
-author: manikadhiman
+author: dansimp
ms.date: 06/26/2018
---
diff --git a/windows/client-management/mdm/developersetup-ddf.md b/windows/client-management/mdm/developersetup-ddf.md
index 21afb0f2a6..13d4a19b6a 100644
--- a/windows/client-management/mdm/developersetup-ddf.md
+++ b/windows/client-management/mdm/developersetup-ddf.md
@@ -8,7 +8,7 @@ ms.author: dansimp
ms.topic: article
ms.prod: w10
ms.technology: windows
-author: manikadhiman
+author: dansimp
ms.date: 12/05/2017
---
diff --git a/windows/client-management/mdm/device-update-management.md b/windows/client-management/mdm/device-update-management.md
index b1d7b62247..22f1b88991 100644
--- a/windows/client-management/mdm/device-update-management.md
+++ b/windows/client-management/mdm/device-update-management.md
@@ -9,8 +9,9 @@ ms.author: dansimp
ms.topic: article
ms.prod: w10
ms.technology: windows
-author: manikadhiman
+author: dansimp
ms.date: 11/15/2017
+ms.collection: highpri
---
diff --git a/windows/client-management/mdm/devicelock-csp.md b/windows/client-management/mdm/devicelock-csp.md
index ac6286d7d6..48dcb6b5da 100644
--- a/windows/client-management/mdm/devicelock-csp.md
+++ b/windows/client-management/mdm/devicelock-csp.md
@@ -8,7 +8,7 @@ ms.author: dansimp
ms.topic: article
ms.prod: w10
ms.technology: windows
-author: manikadhiman
+author: dansimp
ms.date: 06/26/2017
---
diff --git a/windows/client-management/mdm/devicelock-ddf-file.md b/windows/client-management/mdm/devicelock-ddf-file.md
index eb63ef11fe..32da74c5a2 100644
--- a/windows/client-management/mdm/devicelock-ddf-file.md
+++ b/windows/client-management/mdm/devicelock-ddf-file.md
@@ -8,7 +8,7 @@ ms.author: dansimp
ms.topic: article
ms.prod: w10
ms.technology: windows
-author: manikadhiman
+author: dansimp
ms.date: 06/26/2017
---
diff --git a/windows/client-management/mdm/devicemanageability-csp.md b/windows/client-management/mdm/devicemanageability-csp.md
index 99d2930eff..c964ed065c 100644
--- a/windows/client-management/mdm/devicemanageability-csp.md
+++ b/windows/client-management/mdm/devicemanageability-csp.md
@@ -8,7 +8,7 @@ ms.author: dansimp
ms.topic: article
ms.prod: w10
ms.technology: windows
-author: manikadhiman
+author: dansimp
ms.date: 11/01/2017
---
diff --git a/windows/client-management/mdm/devicemanageability-ddf.md b/windows/client-management/mdm/devicemanageability-ddf.md
index 4cb0c7f58b..ca69075d3a 100644
--- a/windows/client-management/mdm/devicemanageability-ddf.md
+++ b/windows/client-management/mdm/devicemanageability-ddf.md
@@ -8,7 +8,7 @@ ms.author: dansimp
ms.topic: article
ms.prod: w10
ms.technology: windows
-author: manikadhiman
+author: dansimp
ms.date: 12/05/2017
---
diff --git a/windows/client-management/mdm/devicestatus-csp.md b/windows/client-management/mdm/devicestatus-csp.md
index f861b2d2e4..f87acbed2e 100644
--- a/windows/client-management/mdm/devicestatus-csp.md
+++ b/windows/client-management/mdm/devicestatus-csp.md
@@ -8,7 +8,7 @@ ms.author: dansimp
ms.topic: article
ms.prod: w10
ms.technology: windows
-author: manikadhiman
+author: dansimp
ms.date: 06/25/2021
---
@@ -246,10 +246,10 @@ Added in Windows, version 1607. Integer that specifies the status of the antisp
Valid values:
-- 0 - The status of the security provider category is good and does not need user attention.
-- 1 - The status of the security provider category is not monitored by Windows Security Center (WSC).
-- 2 - The status of the security provider category is poor and the computer may be at risk.
-- 3 - The security provider category is in snooze state. Snooze indicates that WSC is not actively protecting the computer.
+- 0 - The status of the security provider category is good and does not need user attention.
+- 1 - The status of the security provider category is not monitored by Windows Security.
+- 2 - The status of the security provider category is poor and the computer may be at risk.
+- 3 - The security provider category is in snooze state. Snooze indicates that the Windows Security Service is not actively protecting the computer.
Supported operation is Get.
diff --git a/windows/client-management/mdm/devicestatus-ddf.md b/windows/client-management/mdm/devicestatus-ddf.md
index fbdf08a6d0..4b820066f6 100644
--- a/windows/client-management/mdm/devicestatus-ddf.md
+++ b/windows/client-management/mdm/devicestatus-ddf.md
@@ -8,7 +8,7 @@ ms.author: dansimp
ms.topic: article
ms.prod: w10
ms.technology: windows
-author: manikadhiman
+author: dansimp
ms.date: 03/12/2018
---
diff --git a/windows/client-management/mdm/devinfo-csp.md b/windows/client-management/mdm/devinfo-csp.md
index e9c0979c67..670c0d736e 100644
--- a/windows/client-management/mdm/devinfo-csp.md
+++ b/windows/client-management/mdm/devinfo-csp.md
@@ -8,7 +8,7 @@ ms.author: dansimp
ms.topic: article
ms.prod: w10
ms.technology: windows
-author: manikadhiman
+author: dansimp
ms.date: 06/26/2017
---
diff --git a/windows/client-management/mdm/devinfo-ddf-file.md b/windows/client-management/mdm/devinfo-ddf-file.md
index aec2b4cc91..3cf4154682 100644
--- a/windows/client-management/mdm/devinfo-ddf-file.md
+++ b/windows/client-management/mdm/devinfo-ddf-file.md
@@ -8,7 +8,7 @@ ms.author: dansimp
ms.topic: article
ms.prod: w10
ms.technology: windows
-author: manikadhiman
+author: dansimp
ms.date: 12/05/2017
---
diff --git a/windows/client-management/mdm/diagnose-mdm-failures-in-windows-10.md b/windows/client-management/mdm/diagnose-mdm-failures-in-windows-10.md
index 92ed52968c..5dc126771b 100644
--- a/windows/client-management/mdm/diagnose-mdm-failures-in-windows-10.md
+++ b/windows/client-management/mdm/diagnose-mdm-failures-in-windows-10.md
@@ -8,8 +8,9 @@ ms.author: dansimp
ms.topic: article
ms.prod: w10
ms.technology: windows
-author: manikadhiman
+author: dansimp
ms.date: 06/25/2018
+ms.collection: highpri
---
# Diagnose MDM failures in Windows 10
@@ -35,12 +36,12 @@ To help diagnose enrollment or device management issues in Windows 10 devices m
You can also collect the MDM Diagnostic Information logs using the following command:
```xml
-mdmdiagnosticstool.exe -area DeviceEnrollment;DeviceProvisioning;Autopilot -cab c:\users\public\documents\MDMDiagReport.cab
+mdmdiagnosticstool.exe -area DeviceEnrollment;DeviceProvisioning;Autopilot -zip c:\users\public\documents\MDMDiagReport.zip
```
- In File Explorer, navigate to c:\Users\Public\Documents\MDMDiagnostics to see the report.
-### Understanding cab structure
-The cab file will have logs according to the areas that were used in the command. This explanation is based on DeviceEnrollment, DeviceProvisioning and Autopilot areas. It applies to the cab files collected via command line or Feedback Hub
+### Understanding zip structure
+The zip file will have logs according to the areas that were used in the command. This explanation is based on DeviceEnrollment, DeviceProvisioning and Autopilot areas. It applies to the zip files collected via command line or Feedback Hub
- DiagnosticLogCSP_Collector_Autopilot_*: Autopilot etls
- DiagnosticLogCSP_Collector_DeviceProvisioning_*: Provisioning etls (Microsoft-Windows-Provisioning-Diagnostics-Provider)
diff --git a/windows/client-management/mdm/diagnosticlog-csp.md b/windows/client-management/mdm/diagnosticlog-csp.md
index d232842e12..fb9c555681 100644
--- a/windows/client-management/mdm/diagnosticlog-csp.md
+++ b/windows/client-management/mdm/diagnosticlog-csp.md
@@ -8,7 +8,7 @@ ms.author: dansimp
ms.topic: article
ms.prod: w10
ms.technology: windows
-author: manikadhiman
+author: dansimp
ms.date: 11/19/2019
---
@@ -246,7 +246,15 @@ la--- 1/4/2021 2:45 PM 1
la--- 1/4/2021 2:45 PM 2
la--- 12/2/2020 6:27 PM 2701 results.xml
```
-Each data gathering directive from the original `Collection` XML corresponds to a folder in the output. For example, if the first directive was HKLM\Software\Policies then folder `1` will contain the corresponding `export.reg` file.
+Each data gathering directive from the original `Collection` XML corresponds to a folder in the output.
+For example, the first directive was:
+
+```xml
+
+ HKLM\Software\Policies
+
+```
+then folder `1` will contain the corresponding `export.reg` file.
The `results.xml` file is the authoritative map to the output. It includes a status code for each directive. The order of the directives in the file corresponds to the order of the output folders. Using `results.xml` the administrator can see what data was gathered, what failures may have occurred, and which folders contain which output. For example, the following `results.xml` content indicates that registry export of HKLM\Software\Policies was successful and the data can be found in folder `1`. It also indicates that `netsh.exe wlan show profiles` command failed.
diff --git a/windows/client-management/mdm/diagnosticlog-ddf.md b/windows/client-management/mdm/diagnosticlog-ddf.md
index f635ed44c6..0f25053a37 100644
--- a/windows/client-management/mdm/diagnosticlog-ddf.md
+++ b/windows/client-management/mdm/diagnosticlog-ddf.md
@@ -8,7 +8,7 @@ ms.author: dansimp
ms.topic: article
ms.prod: w10
ms.technology: windows
-author: manikadhiman
+author: dansimp
ms.date: 12/05/2017
---
diff --git a/windows/client-management/mdm/disconnecting-from-mdm-unenrollment.md b/windows/client-management/mdm/disconnecting-from-mdm-unenrollment.md
index 5f48d033a0..a9e4996ee9 100644
--- a/windows/client-management/mdm/disconnecting-from-mdm-unenrollment.md
+++ b/windows/client-management/mdm/disconnecting-from-mdm-unenrollment.md
@@ -11,7 +11,7 @@ ms.author: dansimp
ms.topic: article
ms.prod: w10
ms.technology: windows
-author: manikadhiman
+author: dansimp
ms.date: 06/26/2017
---
diff --git a/windows/client-management/mdm/dmacc-csp.md b/windows/client-management/mdm/dmacc-csp.md
index e7e340552c..9b4f0785ff 100644
--- a/windows/client-management/mdm/dmacc-csp.md
+++ b/windows/client-management/mdm/dmacc-csp.md
@@ -8,7 +8,7 @@ ms.author: dansimp
ms.topic: article
ms.prod: w10
ms.technology: windows
-author: manikadhiman
+author: dansimp
ms.date: 06/26/2017
---
diff --git a/windows/client-management/mdm/dmacc-ddf-file.md b/windows/client-management/mdm/dmacc-ddf-file.md
index b10dcad38a..2d1d256133 100644
--- a/windows/client-management/mdm/dmacc-ddf-file.md
+++ b/windows/client-management/mdm/dmacc-ddf-file.md
@@ -8,7 +8,7 @@ ms.author: dansimp
ms.topic: article
ms.prod: w10
ms.technology: windows
-author: manikadhiman
+author: dansimp
ms.date: 12/05/2017
---
diff --git a/windows/client-management/mdm/dmclient-csp.md b/windows/client-management/mdm/dmclient-csp.md
index 592daf59ec..7731b4fe08 100644
--- a/windows/client-management/mdm/dmclient-csp.md
+++ b/windows/client-management/mdm/dmclient-csp.md
@@ -8,7 +8,7 @@ ms.author: dansimp
ms.topic: article
ms.prod: w10
ms.technology: windows
-author: manikadhiman
+author: dansimp
ms.date: 11/01/2017
---
diff --git a/windows/client-management/mdm/dmclient-ddf-file.md b/windows/client-management/mdm/dmclient-ddf-file.md
index c5ba87da90..9121cdc2b4 100644
--- a/windows/client-management/mdm/dmclient-ddf-file.md
+++ b/windows/client-management/mdm/dmclient-ddf-file.md
@@ -8,7 +8,7 @@ ms.author: dansimp
ms.topic: article
ms.prod: w10
ms.technology: windows
-author: manikadhiman
+author: dansimp
ms.date: 12/05/2017
---
diff --git a/windows/client-management/mdm/dmprocessconfigxmlfiltered.md b/windows/client-management/mdm/dmprocessconfigxmlfiltered.md
index 1dbe4932a9..a13b3a0c7d 100644
--- a/windows/client-management/mdm/dmprocessconfigxmlfiltered.md
+++ b/windows/client-management/mdm/dmprocessconfigxmlfiltered.md
@@ -18,7 +18,7 @@ ms.author: dansimp
ms.topic: article
ms.prod: w10
ms.technology: windows
-author: manikadhiman
+author: dansimp
ms.date: 06/26/2017
---
diff --git a/windows/client-management/mdm/dmsessionactions-csp.md b/windows/client-management/mdm/dmsessionactions-csp.md
index ffdfc3e2b7..e37075e180 100644
--- a/windows/client-management/mdm/dmsessionactions-csp.md
+++ b/windows/client-management/mdm/dmsessionactions-csp.md
@@ -5,7 +5,7 @@ ms.author: dansimp
ms.topic: article
ms.prod: w10
ms.technology: windows
-author: manikadhiman
+author: dansimp
ms.date: 06/26/2017
ms.reviewer:
manager: dansimp
diff --git a/windows/client-management/mdm/dmsessionactions-ddf.md b/windows/client-management/mdm/dmsessionactions-ddf.md
index 61b4b4754a..7cebc030ce 100644
--- a/windows/client-management/mdm/dmsessionactions-ddf.md
+++ b/windows/client-management/mdm/dmsessionactions-ddf.md
@@ -5,7 +5,7 @@ ms.author: dansimp
ms.topic: article
ms.prod: w10
ms.technology: windows
-author: manikadhiman
+author: dansimp
ms.date: 12/05/2017
ms.reviewer:
manager: dansimp
diff --git a/windows/client-management/mdm/dynamicmanagement-csp.md b/windows/client-management/mdm/dynamicmanagement-csp.md
index 3b59ea0c12..37a56ed643 100644
--- a/windows/client-management/mdm/dynamicmanagement-csp.md
+++ b/windows/client-management/mdm/dynamicmanagement-csp.md
@@ -5,10 +5,11 @@ ms.author: dansimp
ms.topic: article
ms.prod: w10
ms.technology: windows
-author: manikadhiman
+author: dansimp
ms.date: 06/26/2017
ms.reviewer:
manager: dansimp
+ms.collection: highpri
---
# DynamicManagement CSP
diff --git a/windows/client-management/mdm/dynamicmanagement-ddf.md b/windows/client-management/mdm/dynamicmanagement-ddf.md
index 2690fa4e23..5bf20a535b 100644
--- a/windows/client-management/mdm/dynamicmanagement-ddf.md
+++ b/windows/client-management/mdm/dynamicmanagement-ddf.md
@@ -8,7 +8,7 @@ ms.author: dansimp
ms.topic: article
ms.prod: w10
ms.technology: windows
-author: manikadhiman
+author: dansimp
ms.date: 12/05/2017
---
diff --git a/windows/client-management/mdm/eap-configuration.md b/windows/client-management/mdm/eap-configuration.md
index 2ef69ad6c3..37f0269edb 100644
--- a/windows/client-management/mdm/eap-configuration.md
+++ b/windows/client-management/mdm/eap-configuration.md
@@ -8,7 +8,7 @@ ms.author: dansimp
ms.topic: article
ms.prod: w10
ms.technology: windows
-author: manikadhiman
+author: dansimp
ms.date: 06/26/2017
---
diff --git a/windows/client-management/mdm/email2-csp.md b/windows/client-management/mdm/email2-csp.md
index de7b12c65f..d84509518f 100644
--- a/windows/client-management/mdm/email2-csp.md
+++ b/windows/client-management/mdm/email2-csp.md
@@ -8,7 +8,7 @@ ms.author: dansimp
ms.topic: article
ms.prod: w10
ms.technology: windows
-author: manikadhiman
+author: dansimp
ms.date: 06/26/2017
---
diff --git a/windows/client-management/mdm/email2-ddf-file.md b/windows/client-management/mdm/email2-ddf-file.md
index 4f11b5b64d..11c6ba0946 100644
--- a/windows/client-management/mdm/email2-ddf-file.md
+++ b/windows/client-management/mdm/email2-ddf-file.md
@@ -8,7 +8,7 @@ ms.author: dansimp
ms.topic: article
ms.prod: w10
ms.technology: windows
-author: manikadhiman
+author: dansimp
ms.date: 12/05/2017
---
diff --git a/windows/client-management/mdm/enable-admx-backed-policies-in-mdm.md b/windows/client-management/mdm/enable-admx-backed-policies-in-mdm.md
index bf6cf8cc1e..2ab4830667 100644
--- a/windows/client-management/mdm/enable-admx-backed-policies-in-mdm.md
+++ b/windows/client-management/mdm/enable-admx-backed-policies-in-mdm.md
@@ -5,7 +5,7 @@ ms.author: dansimp
ms.topic: article
ms.prod: w10
ms.technology: windows
-author: manikadhiman
+author: dansimp
ms.localizationpriority: medium
ms.date: 11/01/2017
ms.reviewer:
diff --git a/windows/client-management/mdm/enroll-a-windows-10-device-automatically-using-group-policy.md b/windows/client-management/mdm/enroll-a-windows-10-device-automatically-using-group-policy.md
index 4dfc661666..c77b8f6df6 100644
--- a/windows/client-management/mdm/enroll-a-windows-10-device-automatically-using-group-policy.md
+++ b/windows/client-management/mdm/enroll-a-windows-10-device-automatically-using-group-policy.md
@@ -6,13 +6,18 @@ ms.topic: article
ms.prod: w10
ms.technology: windows
author: dansimp
-ms.date: 10/14/2021
+ms.date: 12/03/2021
ms.reviewer:
manager: dansimp
+ms.collection: highpri
---
# Enroll a Windows 10 device automatically using Group Policy
+**Applies to:**
+
+- Windows 10
+
Starting in Windows 10, version 1709, you can use a Group Policy to trigger auto-enrollment to MDM for Active Directory (AD) domain-joined devices.
The enrollment into Intune is triggered by a group policy created on your local AD and happens without any user interaction. This means you can automatically mass-enroll a large number of domain-joined corporate devices into Microsoft Intune. The enrollment process starts in the background once you sign in to the device with your Azure AD account.
@@ -44,9 +49,10 @@ For this policy to work, you must verify that the MDM service provider allows th
## Verify auto-enrollment requirements and settings
To ensure that the auto-enrollment feature is working as expected, you must verify that various requirements and settings are configured correctly.
The following steps demonstrate required settings using the Intune service:
+
1. Verify that the user who is going to enroll the device has a valid Intune license.
- 
+ :::image type="content" alt-text="Intune license verification." source="images/auto-enrollment-intune-license-verification.png" lightbox="images/auto-enrollment-intune-license-verification.png":::
2. Verify that auto-enrollment is activated for those users who are going to enroll the devices into Intune. For additional details, see [Azure AD and Microsoft Intune: Automatic MDM enrollment in the new Portal](./azure-ad-and-microsoft-intune-automatic-mdm-enrollment-in-the-new-portal.md).
@@ -78,7 +84,7 @@ The following steps demonstrate required settings using the Intune service:
6. Some tenants might have both **Microsoft Intune** and **Microsoft Intune Enrollment** under **Mobility**. Make sure that your auto-enrollment settings are configured under **Microsoft Intune** instead of **Microsoft Intune Enrollment**.
- 
+ :::image type="content" alt-text="Mobility setting MDM intune." source="images/auto-enrollment-microsoft-intune-setting.png" lightbox="images/auto-enrollment-microsoft-intune-setting.png":::
7. Verify that the *Enable Automatic MDM enrollment using default Azure AD credentials* group policy (**Local Group Policy Editor > Computer Configuration > Policies > Administrative Templates > Windows Components > MDM**) is properly deployed to all devices which should be enrolled into Intune.
You may contact your domain administrators to verify if the group policy has been deployed successfully.
@@ -87,7 +93,7 @@ You may contact your domain administrators to verify if the group policy has bee
9. Verify that Microsoft Intune should allow enrollment of Windows devices.
- 
+ :::image type="content" alt-text="Enrollment of Windows devices." source="images/auto-enrollment-enrollment-of-windows-devices.png" lightbox="images/auto-enrollment-enrollment-of-windows-devices.png":::
## Configure the auto-enrollment Group Policy for a single PC
@@ -108,12 +114,11 @@ Requirements:
3. In **Local Computer Policy**, click **Administrative Templates** > **Windows Components** > **MDM**.
- > [!div class="mx-imgBorder"]
- > 
+ :::image type="content" alt-text="MDM policies." source="images/autoenrollment-mdm-policies.png" lightbox="images/autoenrollment-mdm-policies.png":::
4. Double-click **Enable automatic MDM enrollment using default Azure AD credentials** (previously called **Auto MDM Enrollment with AAD Token** in Windows 10, version 1709). For ADMX files in Windows 10, version 1903 and later, select **User Credential** as the Selected Credential Type to use.
- 
+ :::image type="content" alt-text="MDM autoenrollment policy." source="images/autoenrollment-policy.png" lightbox="images/autoenrollment-policy.png":::
5. Click **Enable**, and select **User Credential** from the dropdown **Select Credential Type to Use**, then click **OK**.
@@ -154,7 +159,7 @@ Requirements:
3. In **Task Scheduler Library**, open **Microsoft > Windows** , then click **EnterpriseMgmt**.
- 
+ :::image type="content" alt-text="Auto-enrollment scheduled task." source="images/autoenrollment-scheduled-task.png" lightbox="images/autoenrollment-scheduled-task.png":::
To see the result of the task, move the scroll bar to the right to see the **Last Run Result**. Note that **0x80180026** is a failure message (MENROLL\_E_DEVICE\_MANAGEMENT_BLOCKED). You can see the logs in the **History** tab.
@@ -190,6 +195,9 @@ Requirements:
- 21H1 --> [Administrative Templates (.admx) for Windows 10 May 2021 Update (21H1)](https://www.microsoft.com/download/details.aspx?id=103124)
+ - 21H2 --> [Administrative Templates (.admx) for Windows 10 November 2021 Update (21H2)](https://www.microsoft.com/download/103667)
+
+
2. Install the package on the Domain Controller.
3. Navigate, depending on the version to the folder:
@@ -208,11 +216,13 @@ Requirements:
- 21H1 --> **C:\Program Files (x86)\Microsoft Group Policy\Windows 10 May 2021 Update (21H1)**
+ - 21H2 --> **C:\Program Files (x86)\Microsoft Group Policy\Windows 10 November 2021 Update (21H2)**
+
4. Rename the extracted Policy Definitions folder to **PolicyDefinitions**.
-5. Copy PolicyDefinitions folder to **\\contoso.com\SYSVOL\contoso.com\policies\PolicyDefinitions**.
+5. Copy PolicyDefinitions folder to **\\SYSVOL\contoso.com\policies\PolicyDefinitions**.
- If this folder does not exist, then be aware that you will be switching to a [central policy store](https://support.microsoft.com/help/3087759/how-to-create-and-manage-the-central-store-for-group-policy-administra) for your entire domain.
+ If this folder does not exist, then be aware that you will be switching to a [central policy store](/troubleshoot/windows-client/group-policy/create-and-manage-central-store) for your entire domain.
6. Wait for the SYSVOL DFSR replication to be completed for the policy to be available.
@@ -239,21 +249,21 @@ To collect Event Viewer logs:
3. Search for event ID 75, which represents a successful auto-enrollment. Here is an example screenshot that shows the auto-enrollment completed successfully:
- 
+ :::image type="content" alt-text="Event ID 75." source="images/auto-enrollment-troubleshooting-event-id-75.png" lightbox="images/auto-enrollment-troubleshooting-event-id-75.png":::
If you cannot find event ID 75 in the logs, it indicates that the auto-enrollment failed. This can happen because of the following reasons:
- The enrollment failed with error. In this case, search for event ID 76, which represents failed auto-enrollment. Here is an example screenshot that shows that the auto-enrollment failed:
- 
+ :::image type="content" alt-text="Event ID 76." source="images/auto-enrollment-troubleshooting-event-id-76.png" lightbox="images/auto-enrollment-troubleshooting-event-id-76.png":::
- To troubleshoot, check the error code that appears in the event. See [Troubleshooting Windows device enrollment problems in Microsoft Intune](https://support.microsoft.com/en-ph/help/4469913/troubleshooting-windows-device-enrollment-problems-in-microsoft-intune) for more information.
+ To troubleshoot, check the error code that appears in the event. See [Troubleshooting Windows device enrollment problems in Microsoft Intune](/troubleshoot/mem/intune/troubleshoot-windows-enrollment-errors) for more information.
- The auto-enrollment did not trigger at all. In this case, you will not find either event ID 75 or event ID 76. To know the reason, you must understand the internal mechanisms happening on the device as described in the following section.
The auto-enrollment process is triggered by a task (**Microsoft > Windows > EnterpriseMgmt**) within the task-scheduler. This task appears if the *Enable automatic MDM enrollment using default Azure AD credentials* group policy (**Computer Configuration > Policies > Administrative Templates > Windows Components > MDM**) is successfully deployed to the target machine as shown in the following screenshot:
- 
+ :::image type="content" alt-text="Task scheduler." source="images/auto-enrollment-task-scheduler.png" lightbox="images/auto-enrollment-task-scheduler.png":::
> [!Note]
> This task isn't visible to standard users - run Scheduled Tasks with administrative credentials to find the task.
@@ -262,24 +272,24 @@ To collect Event Viewer logs:
**Applications and Services Logs > Microsoft > Windows > Task Scheduler > Operational**.
Look for an entry where the task scheduler created by enrollment client for automatically enrolling in MDM from AAD is triggered by event ID 107.
- 
+ :::image type="content" alt-text="Event ID 107." source="images/auto-enrollment-event-id-107.png" lightbox="images/auto-enrollment-event-id-107.png":::
When the task is completed, a new event ID 102 is logged.
- 
+ :::image type="content" alt-text="Event ID 102." source="images/auto-enrollment-event-id-102.png" lightbox="images/auto-enrollment-event-id-102.png":::
Note that the task scheduler log displays event ID 102 (task completed) regardless of the auto-enrollment success or failure. This means that the task scheduler log is only useful to confirm if the auto-enrollment task is triggered or not. It does not indicate the success or failure of auto-enrollment.
If you cannot see from the log that task Schedule created by enrollment client for automatically enrolling in MDM from AAD is initiated, there is possibly issue with the group policy. Immediately run the command `gpupdate /force` in command prompt to get the GPO applied. If this still does not help, further troubleshooting on the Active Directory is required.
One frequently seen error is related to some outdated enrollment entries in the registry on the target client device (**HKLM > Software > Microsoft > Enrollments**). If a device has been enrolled (can be any MDM solution and not only Intune), some enrollment information added into the registry is seen:
- 
+ :::image type="content" alt-text="Outdated enrollment entries." source="images/auto-enrollment-outdated-enrollment-entries.png" lightbox="images/auto-enrollment-outdated-enrollment-entries.png":::
By default, these entries are removed when the device is un-enrolled, but occasionally the registry key remains even after un-enrollment. In this case, `gpupdate /force` fails to initiate the auto-enrollment task and error code 2149056522 is displayed in the **Applications and Services Logs > Microsoft > Windows > Task Scheduler > Operational** event log file under event ID 7016.
A resolution to this issue is to remove the registry key manually. If you do not know which registry key to remove, go for the key which displays most entries as the screenshot above. All other keys will display fewer entries as shown in the following screenshot:
- 
+ :::image type="content" alt-text="Manually deleted entries." source="images/auto-enrollment-activation-verification-less-entries.png" lightbox="images/auto-enrollment-activation-verification-less-entries.png":::
### Related topics
@@ -288,13 +298,14 @@ To collect Event Viewer logs:
- [Link a Group Policy Object](/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/cc732979(v=ws.11))
- [Filter Using Security Groups](/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/cc752992(v=ws.11))
- [Enforce a Group Policy Object Link](/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/cc753909(v=ws.11))
-- [Group Policy Central Store](https://support.microsoft.com/help/3087759/how-to-create-and-manage-the-central-store-for-group-policy-administra)
-- [Getting started with Cloud Native Windows Endpoints](https://docs.microsoft.com/mem/cloud-native-windows-endpoints)
+- [Group Policy Central Store](/troubleshoot/windows-client/group-policy/create-and-manage-central-store)
+- [Getting started with Cloud Native Windows Endpoints](/mem/cloud-native-windows-endpoints)
- [A Framework for Windows endpoint management transformation](https://techcommunity.microsoft.com/t5/windows-it-pro-blog/a-framework-for-windows-endpoint-management-transformation/ba-p/2460684)
- [Success with remote Windows Autopilot and Hybrid Azure Active Director join](https://techcommunity.microsoft.com/t5/intune-customer-success/success-with-remote-windows-autopilot-and-hybrid-azure-active/ba-p/2749353)
### Useful Links
+- [Windows 10 Administrative Templates for Windows 10 November 2021 Update 21H2](https://www.microsoft.com/download/103667)
- [Windows 10 Administrative Templates for Windows 10 May 2021 Update 21H1](https://www.microsoft.com/download/details.aspx?id=103124)
- [Windows 10 Administrative Templates for Windows 10 November 2019 Update 1909](https://www.microsoft.com/download/details.aspx?id=100591)
- [Windows 10 Administrative Templates for Windows 10 May 2019 Update 1903](https://www.microsoft.com/download/details.aspx?id=58495)
diff --git a/windows/client-management/mdm/enrollmentstatustracking-csp-ddf.md b/windows/client-management/mdm/enrollmentstatustracking-csp-ddf.md
index 98739efcb1..75870e43e0 100644
--- a/windows/client-management/mdm/enrollmentstatustracking-csp-ddf.md
+++ b/windows/client-management/mdm/enrollmentstatustracking-csp-ddf.md
@@ -5,7 +5,7 @@ ms.author: dansimp
ms.topic: article
ms.prod: w10
ms.technology: windows
-author: ManikaDhiman
+author: dansimp
ms.date: 05/17/2019
---
diff --git a/windows/client-management/mdm/enrollmentstatustracking-csp.md b/windows/client-management/mdm/enrollmentstatustracking-csp.md
index 54e9da339c..3b4e865ccb 100644
--- a/windows/client-management/mdm/enrollmentstatustracking-csp.md
+++ b/windows/client-management/mdm/enrollmentstatustracking-csp.md
@@ -5,7 +5,7 @@ ms.author: dansimp
ms.topic: article
ms.prod: w10
ms.technology: windows
-author: ManikaDhiman
+author: dansimp
ms.date: 05/21/2019
---
diff --git a/windows/client-management/mdm/enterpriseapn-csp.md b/windows/client-management/mdm/enterpriseapn-csp.md
index f82e763f75..2b50af966e 100644
--- a/windows/client-management/mdm/enterpriseapn-csp.md
+++ b/windows/client-management/mdm/enterpriseapn-csp.md
@@ -8,7 +8,7 @@ ms.author: dansimp
ms.topic: article
ms.prod: w10
ms.technology: windows
-author: manikadhiman
+author: dansimp
ms.date: 09/22/2017
---
diff --git a/windows/client-management/mdm/enterpriseapn-ddf.md b/windows/client-management/mdm/enterpriseapn-ddf.md
index 5e7af9b60d..60e6f5ba4a 100644
--- a/windows/client-management/mdm/enterpriseapn-ddf.md
+++ b/windows/client-management/mdm/enterpriseapn-ddf.md
@@ -8,7 +8,7 @@ ms.author: dansimp
ms.topic: article
ms.prod: w10
ms.technology: windows
-author: manikadhiman
+author: dansimp
ms.date: 12/05/2017
---
diff --git a/windows/client-management/mdm/enterpriseappmanagement-csp.md b/windows/client-management/mdm/enterpriseappmanagement-csp.md
index 1910df9821..4192b8bdcc 100644
--- a/windows/client-management/mdm/enterpriseappmanagement-csp.md
+++ b/windows/client-management/mdm/enterpriseappmanagement-csp.md
@@ -8,7 +8,7 @@ ms.author: dansimp
ms.topic: article
ms.prod: w10
ms.technology: windows
-author: manikadhiman
+author: dansimp
ms.date: 06/26/2017
---
@@ -18,8 +18,7 @@ ms.date: 06/26/2017
The EnterpriseAppManagement enterprise configuration service provider is used to handle enterprise application management tasks such as installing an enterprise application token, the first auto-downloadable app link, querying installed enterprise applications (name and version), auto updating already installed enterprise applications, and removing all installed enterprise apps (including the enterprise app token) during unenrollment.
> [!NOTE]
-> The EnterpriseAppManagement CSP is only supported in Windows 10 Mobile.
-
+> The EnterpriseAppManagement CSP is only supported in Windows 10 IoT Core.
The following shows the EnterpriseAppManagement configuration service provider in tree format.
diff --git a/windows/client-management/mdm/enterpriseappvmanagement-csp.md b/windows/client-management/mdm/enterpriseappvmanagement-csp.md
index cb948488da..5833aa9062 100644
--- a/windows/client-management/mdm/enterpriseappvmanagement-csp.md
+++ b/windows/client-management/mdm/enterpriseappvmanagement-csp.md
@@ -5,7 +5,7 @@ ms.author: dansimp
ms.topic: article
ms.prod: w10
ms.technology: windows
-author: manikadhiman
+author: dansimp
ms.date: 06/26/2017
ms.reviewer:
manager: dansimp
diff --git a/windows/client-management/mdm/enterpriseappvmanagement-ddf.md b/windows/client-management/mdm/enterpriseappvmanagement-ddf.md
index 8cf951cf55..1c18aff981 100644
--- a/windows/client-management/mdm/enterpriseappvmanagement-ddf.md
+++ b/windows/client-management/mdm/enterpriseappvmanagement-ddf.md
@@ -5,7 +5,7 @@ ms.author: dansimp
ms.topic: article
ms.prod: w10
ms.technology: windows
-author: manikadhiman
+author: dansimp
ms.date: 12/05/2017
ms.reviewer:
manager: dansimp
diff --git a/windows/client-management/mdm/enterpriseassignedaccess-csp.md b/windows/client-management/mdm/enterpriseassignedaccess-csp.md
deleted file mode 100644
index db8f48e055..0000000000
--- a/windows/client-management/mdm/enterpriseassignedaccess-csp.md
+++ /dev/null
@@ -1,1116 +0,0 @@
----
-title: EnterpriseAssignedAccess CSP
-description: Use the EnterpriseAssignedAccess configuration service provider (CSP) to configure custom layouts on a device.
-ms.assetid: 5F88E567-77AA-4822-A0BC-3B31100639AA
-ms.reviewer:
-manager: dansimp
-ms.author: dansimp
-ms.topic: article
-ms.prod: w10
-ms.technology: windows
-author: manikadhiman
-ms.date: 07/12/2017
----
-
-# EnterpriseAssignedAccess CSP
-
-
-The EnterpriseAssignedAccess configuration service provider allows IT administrators to configure settings, such as language and themes, lock down a device, and configure custom layouts on a device. For example, the administrator can lock down a device so that only applications specified in an Allow list are available. Apps not on the Allow list remain installed on the device, but are hidden from view and blocked from launching.
-
-> [!NOTE]
-> The EnterpriseAssignedAccess CSP is only supported in Windows 10 Mobile.
-
-For more information about how to interact with the lockdown XML at runtime, see [**DeviceLockdownProfile class**](/uwp/api/Windows.Embedded.DeviceLockdown.DeviceLockdownProfile).
-
-The following shows the EnterpriseAssignedAccess configuration service provider in tree format as used by both the Open Mobile Alliance (OMA) Device Management (DM) and OMA Client Provisioning.
-
-```console
-./Vendor/MSFT
-EnterpriseAssignedAccess
-----AssignedAccess
---------AssignedAccessXml
-----LockScreenWallpaper
---------BGFileName
-----Theme
---------ThemeBackground
---------ThemeAccentColorID
---------ThemeAccentColorValue
-----Clock
---------TimeZone
-----Locale
---------Language
-```
-
-The following list shows the characteristics and parameters.
-
-**./Vendor/MSFT/EnterpriseAssignedAccess/**
-The root node for the EnterpriseAssignedAccess configuration service provider. Supported operations are Add, Delete, Get and Replace.
-
-**AssignedAccess/**
-The parent node of assigned access XML.
-
-**AssignedAccess/AssignedAccessXml**
-The XML code that controls the assigned access settings that will be applied to the device.
-
-Supported operations are Add, Delete, Get and Replace.
-
-The Apps and Settings sections of lockdown XML constitute an Allow list. Any app or setting that is not specified in AssignedAccessXML will not be available on the device to users. The following table describes the entries in lockdown XML.
-
-> [!IMPORTANT]
-> When using the AssignedAccessXml in the EnterpriseAssignedAccess CSP through an MDM, the XML must use escaped characters, such as \< instead of < because it is embedded in an XML. The examples provided in the topic are formatted for readability.
-
-When using the AssignedAccessXml in a provisioning package using the Windows Configuration Designer tool, do not use escaped characters.
-
-Entry | Description
------------ | ------------
-ActionCenter | You can enable or disable the Action Center (formerly known as Notification Center) on the device. Set to true to enable the Action Center, or set to false to disable the Action Center.
-ActionCenter | Example: ``
-ActionCenter | In Windows 10, when the Action Center is disabled, Above Lock notifications and toasts are also disabled. When the Action Center is enabled, the following policies are also enabled; **AboveLock/AllowActionCenterNotifications** and **AboveLock/AllowToasts**. For more information about these policies, see [Policy CSP](policy-configuration-service-provider.md)
-ActionCenter | You can also add the following optional attributes to the ActionCenter element to override the default behavior: **aboveLockToastEnabled** and **actionCenterNotificationEnabled**. Valid values are 0 (policy disabled), 1 (policy enabled), and -1 (not set, policy enabled). In this example, the Action Center is enabled and both policies are disabled.: ``
-ActionCenter | These optional attributes are independent of each other. In this example, Action Center is enabled, the notifications policy is disabled, and the toast policy is enabled by default because it is not set. ``
-StartScreenSize | Specify the size of the Start screen. In addition to 4/6 columns, you can also use 4/6/8 depending on screen resolutions. Valid values: **Small** - sets the width to 4 columns on device with short axis <400epx or 6 columns on devices with short axis >=400epx. **Large** - sets the width to 6 columns on devices with short axis <400epx or 8 columns on devices with short axis >=400epx.
-StartScreenSize | If you have existing lockdown XML, you must update it if your device has >=400epx on its short axis so that tiles on Start can fill all 8 columns if you want to use all 8 columns instead of 6, or use 6 columns instead of 4. Example: `Large`
-Application | Provide the product ID for each app that will be available on the device. You can find the product ID for a locally developed app in the AppManifest.xml file of the app.
-Application | To turn on the notification for a Windows app, you must include the application's AUMID in the lockdown XML. However, the user can change the setting at any time from user interface. Example: ``
-Application |
-Application | Include PinToStart to display an app on the Start screen. For apps pinned to the Start screen, identify a tile size (small, medium, or large), and a location. The size of a small tile is 1 column x 1 row, a medium tile is 2 x 2, and a large tile is 4 x 2. For the tile location, the first value indicates the column and the second value indicates the row. A value of 0 (zero) indicates the first column, a value of 1 indicates the second column, and so on. Include autoRun as an attribute to configure the application to run automatically.
-
-Application example:
-```xml
-
-
- Large
-
- 0
- 2
-
-
-
-```
-
-Entry | Description
------------ | ------------
-Application | Multiple App Packages enable multiple apps to exist inside the same package. Since ProductIds identify packages and not applications, specifying a ProductId is not enough to distinguish between individual apps inside a multiple app package. Trying to include application from a multiple app package with just a ProductId can result in unexpected behavior. To support pinning applications in multiple app packages, use an AUMID parameter in lockdown XML. The following example shows how to pin both Outlook mail and Outlook calendar.
-
-Application example:
-```xml
-
-
-
-
- Large
-
- 1
- 4
-
-
-
-
-
-
- Large
-
- 1
- 6
-
-
-
-
-```
-
-Entry | Description
------------ | ------------
-Folder | A folder should be contained in `` node among with other `` nodes, it shares most grammar with the Application Node, **folderId** is mandatory, **folderName** is optional, which is the folder name displayed on Start. **folderId** is a unique unsigned integer for each folder.
-
-Folder example:
-```xml
-
-
- Large
-
- 0
- 2
-
-
-
-```
-An application that belongs in the folder would add an optional attribute **ParentFolderId**, which maps to **folderId** of the folder. In this case, the location of this application will be located inside the folder.
-
-```xml
-
-
- Medium
-
- 0
- 0
-
- 2
-
-
-```
-
-Entry | Description
------------ | ------------
-Settings | Starting in Windows 10, version 1511, you can specify the following settings pages in the lockdown XML file. For Windows 10, version 1703, see the instructions below for the new way to specify the settings pages.
-
-
-
-Entry | Description
------------ | ------------
-Settings | Starting in Windows 10, version 1703, you can specify the settings pages using the settings URI.
-
-For example, in place of SettingPageDisplay, you would use ms-settings:display. See [ms-settings: URI scheme reference](/windows/uwp/launch-resume/launch-settings-app#ms-settings-uri-scheme-reference) to find the URI for each settings page.
-
-Here is an example for Windows 10, version 1703.
-
-```xml
-
-
-
-
-
-
-
-
-
-```
-
-**Quick action settings**
-
-Starting in Windows 10, version 1511, you can specify the following quick action settings in the lockdown XML file. The following list shows the quick action settings and settings page dependencies (group and page).
-
-> [!NOTE]
-> Only Windows 10, versions 1511 and 1607, the dependent settings group and pages are automatically added when the quick action item is specified in the lockdown XML. In Windows 10, version 1703, Quick action settings no longer require any dependencies from related group or page.
-
-
-
-Starting in Windows 10, version 1703, Quick action settings no longer require any dependencies from related group or page. Here is the list:
-- QuickActions_Launcher_AllSettings
-- QuickActions_Launcher_DeviceDiscovery
-- SystemSettings_BatterySaver_LandingPage_OverrideControl
-- SystemSettings_Device_BluetoothQuickAction
-- SystemSettings_Flashlight_Toggle
-- SystemSettings_Launcher_QuickNote
-- SystemSettings_Network_VPN_QuickAction
-- SystemSettings_Privacy_LocationEnabledUserPhone
-- SystemSettings_QuickAction_AirplaneMode
-- SystemSettings_QuickAction_Camera
-- SystemSettings_QuickAction_CellularData
-- SystemSettings_QuickAction_InternetSharing
-- SystemSettings_QuickAction_QuietHours
-- SystemSettings_QuickAction_WiFi
-- SystemSettings_System_Display_Internal_Rotation
-- SystemSettings_System_Display_QuickAction_Brightness
-
-
-In this example, all settings pages and quick action settings are allowed. An empty \ node indicates that none of the settings are blocked.
-
-```xml
-
-
-```
-
-In this example for Windows 10, version 1511, all System setting pages are enabled. Note that the System page group is added as well as all of the System subpage names.
-
-```xml
-
-
-
-
-
-
-
-
-
-
-
-
-```
-Here is an example for Windows 10, version 1703.
-
-```xml
-
-
-
-
-
-
-
-
-
-```
-
-Entry | Description
------------ | ------------
-Buttons | The following list identifies the hardware buttons on the device that you can lock down in ButtonLockdownList. When a user taps a button that is in the lockdown list, nothing will happen.
-
-
-
Start
-
Back
-
Search
-
Camera
-
Custom1
-
Custom2
-
Custom3
-
-
-> [!NOTE]
-> Lock down of the Start button only prevents the press and hold event.
->
-> Custom buttons are hardware buttons that can be added to devices by OEMs.
-
-Buttons example:
-```xml
-
-
-
-
-
-
-
-
-
-```
-The Search and custom buttons can be remapped or configured to open a specific application. Button remapping takes effect for the device and applies to all users.
-
-> [!NOTE]
-> The lockdown settings for a button, per user role, will apply regardless of the button mapping.
->
-> Button remapping can enable a user to open an application that is not in the Allow list. Use button lock down to prevent application access for a user role.
-
-To remap a button in lockdown XML, you supply the button name, the button event (typically "press"), and the product ID for the application the button will open.
-
-```xml
-
-
-
-```
-**Disabling navigation buttons**
-To disable navigation buttons (such as Home or Back) in lockdown XML, you supply the name (for example, Start) and button event (typically "press").
-
-The following section contains a sample lockdown XML file that shows how to disable navigation buttons.
-
-```xml
-
-
-
-
-
-
-
-
- Large
-
- 0
- 0
-
-
-
-
-
-
-
- Small
-
- 2
- 2
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- Small
-
-
-```
-
-Entry | Description
------------ | ------------
-MenuItems | Use **DisableMenuItems** to prevent use of the context menu, which is displayed when a user presses and holds an application in the All Programs list. You can include this entry in the default profile and in any additional user role profiles that you create.
-
-> [!IMPORTANT]
-> If **DisableMenuItems** is not included in a profile, users of that profile can uninstall apps.
-
-MenuItems example:
-
-```xml
-
-
-
-```
-
-Entry | Description
------------ | ------------
-Tiles | **Turning-on tile manipulation** - By default, under Assigned Access, tile manipulation is turned off (blocked) and only available if enabled in the user’s profile. If tile manipulation is enabled in the user’s profile, they can pin/unpin, move, and resize tiles based on their preferences. When multiple people use one device and you want to enable tile manipulation for multiple users, you must enable it for each user in their user profile.
-
-> [!IMPORTANT]
-> If a device is turned off then back on, the tiles reset to their predefined layout. If a device has only one profile, the only way to reset the tiles is to turn off then turn on the device. If a device has multiple profiles, the device resets the tiles to the predefined layout based on the logged-in user’s profile.
-
-The following sample file contains configuration for enabling tile manipulation.
-
-> [!NOTE]
-> Tile manipulation is disabled when you don’t have a `` node in lockdown XML, or if you have a `` node but don’t have the `` node.
-
-```xml
-
-
-
-
-
-
-
-
- Large
-
- 0
- 0
-
-
-
-
-
-
-
- Small
-
- 2
- 2
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- Small
-
-
-```
-
-Entry | Description
------------ | ------------
-CSP Runner | Allows CSPs to be executed on the device per user role. You can use this to implement role specific policies, such as changing the color scheme when an admin logs on the device, or to set configurations per role.
-
-
-**LockscreenWallpaper/**
-The parent node of the lock screen-related parameters that let administrators query and manage the lock screen image on devices. Supported operations are Add, Delete, Get and Replace.
-
-**LockscreenWallpaper/BGFileName**
-The file name of the lock screen. The image file for the lock screen can be in .jpg or .png format and must not exceed 2 MB. The file name can also be in the Universal Naming Convention (UNC) format, in which case the device downloads it from the shared network and then sets it as the lock screen wallpaper.
-
-Supported operations are Add, Get, and Replace.
-
-**Theme/**
-The parent node of theme-related parameters.
-
-Supported operations are Add, Delete, Get and Replace.
-
-**Theme/ThemeBackground**
-Indicates whether the background color is light or dark. Set to **0** for light; set to **1** for dark.
-
-Supported operations are Get and Replace.
-
-**Theme/ThemeAccentColorID**
-The accent color to apply as the foreground color for tiles, controls, and other visual elements on the device. The following table shows the possible values.
-
-|Value|Description|
-|--- |--- |
-|0|Lime|
-|1|Green|
-|2|Emerald|
-|3|Teal (Viridian)|
-|4|Cyan (Blue)|
-|5|Cobalt|
-|6|Indigo|
-|7|Violet (Purple)|
-|8|Pink|
-|9|Magenta|
-|10|Crimson|
-|11|Red|
-|12|Orange (Mango)|
-|13|Amber|
-|14|Yellow|
-|15|Brown|
-|16|Olive|
-|17|Steel|
-|18|Mauve|
-|19|Sienna|
-|101 through 104|Optional colors, as defined by the OEM|
-|151|Custom accent color for Enterprise|
-
-Supported operations are Get and Replace.
-
-**Theme/ThemeAccentColorValue**
-A 6-character string for the accent color to apply to controls and other visual elements.
-
-To use a custom accent color for Enterprise, enter **151** for *ThemeAccentColorID* before *ThemeAccentColorValue* in lockdown XML. *ThemeAccentColorValue* configures the custom accent color using hex values for red, green, and blue, in RRGGBB format. For example, enter FF0000 for red.
-
-Supported operations are Get and Replace.
-
-**PersistData**
-Not supported in Windows 10.
-
-The parent node of whether to persist data that has been provisioned on the device.
-
-**PersistData/PersistProvisionedData**
-Not supported in Windows 10. Use doWipePersistProvisionedData in [RemoteWipe CSP](remotewipe-csp.md) instead.
-
-**Clock/TimeZone/**
-An integer that specifies the time zone of the device. The following table shows the possible values.
-
-Supported operations are Get and Replace.
-
-|Value|Time zone|
-|--- |--- |
-|0|UTC-12 International Date Line West|
-|100|UTC+13 Samoa|
-|110|UTC-11 Coordinated Universal Time-11|
-|200|UTC-10 Hawaii|
-|300|UTC-09 Alaska|
-|400|UTC-08 Pacific Time (US & Canada)|
-|410|UTC-08 Baja California|
-|500|UTC-07 Mountain Time (US & Canada)|
-|510|UTC-07 Chihuahua, La Paz, Mazatlan|
-|520|UTC-07 Arizona|
-|600|UTC-06 Saskatchewan|
-|610|UTC-06 Central America|
-|620|UTC-06 Central Time (US & Canada)|
-|630|UTC-06 Guadalajara, Mexico City, Monterrey|
-|700|UTC-05 Eastern Time (US & Canada)|
-|710|UTC-05 Bogota, Lima, Quito|
-|720|UTC-05 Indiana (East)|
-|800|UTC-04 Atlantic Time (Canada)|
-|810|UTC-04 Cuiaba|
-|820|UTC-04 Santiago|
-|830|UTC-04 Georgetown, La Paz, Manaus, San Juan|
-|840|UTC-04 Caracas|
-|850|UTC-04 Asuncion|
-|900|UTC-03:30 Newfoundland|
-|910|UTC-03 Brasilia|
-|920|UTC-03 Greenland|
-|930|UTC-03 Montevideo|
-|940|UTC-03 Cayenne, Fortaleza|
-|950|UTC-03 Buenos Aires|
-|960|UTC-03 Salvador|
-|1000|UTC-02 Mid-Atlantic|
-|1010|UTC-02 Coordinated Universal Time-02|
-|1100|UTC-01 Azores|
-|1110|UTC-01 Cabo Verde|
-|1200|UTC Dublin, Edinburgh, Lisbon, London|
-|1210|UTC Monrovia, Reykjavik|
-|1220|UTC Casablanca|
-|1230|UTC Coordinated Universal Time|
-|1300|UTC+01 Belgrade, Bratislava, Budapest, Ljubljana, Prague|
-|1310|UTC+01 Sarajevo, Skopje, Warsaw, Zagreb|
-|1320|UTC+01 Brussels, Copenhagen, Madrid, Paris|
-|1330|UTC+01 West Central Africa|
-|1340|UTC+01 Amsterdam, Berlin, Bern, Rome, Stockholm, Vienna|
-|1350|UTC+01 Windhoek|
-|1360|UTC+01 Tripoli|
-|1400|UTC+02 E. Europe|
-|1410|UTC+02 Cairo|
-|1420|UTC+02 Helsinki, Kyiv, Riga, Sofia, Tallinn, Vilnius|
-|1430|UTC+02 Athens, Bucharest|
-|1440|UTC+02 Jerusalem|
-|1450|UTC+02 Amman|
-|1460|UTC+02 Beirut|
-|1470|UTC+02 Harare, Pretoria|
-|1480|UTC+02 Damascus|
-|1490|UTC+02 Istanbul|
-|1500|UTC+03 Kuwait, Riyadh|
-|1510|UTC+03 Baghdad|
-|1520|UTC+03 Nairobi|
-|1530|UTC+03 Kaliningrad, Minsk|
-|1540|UTC+04 Moscow, St. Petersburg, Volgograd|
-|1550|UTC+03 Tehran|
-|1600|UTC+04 Abu Dhabi, Muscat|
-|1610|UTC+04 Baku|
-|1620|UTC+04 Yerevan|
-|1630|UTC+04 Kabul|
-|1640|UTC+04 Tbilisi|
-|1650|UTC+04 Port Louis|
-|1700|UTC+06 Ekaterinburg|
-|1710|UTC+05 Tashkent|
-|1720|UTC+05 Chennai, Kolkata, Mumbai, New Delhi|
-|1730|UTC+05 Sri Jayawardenepura|
-|1740|UTC+05 Kathmandu|
-|1750|UTC+05 Islamabad, Karachi|
-|1800|UTC+06 Astana|
-|1810|UTC+07 Novosibirsk|
-|1820|UTC+06 Yangon (Rangoon)|
-|1830|UTC+06 Dhaka|
-|1900|UTC+08 Krasnoyarsk|
-|1910|UTC+07 Bangkok, Hanoi, Jakarta|
-|1900|UTC+08 Krasnoyarsk|
-|2000|UTC+08 Beijing, Chongqing, Hong Kong SAR, Urumqi|
-|2010|UTC+09 Irkutsk|
-|2020|UTC+08 Kuala Lumpur, Singapore|
-|2030|UTC+08 Taipei|
-|2040|UTC+08 Perth|
-|2050|UTC+08 Ulaanbaatar|
-|2100|UTC+09 Seoul|
-|2110|UTC+09 Osaka, Sapporo, Tokyo|
-|2120|UTC+10 Yakutsk|
-|2130|UTC+09 Darwin|
-|2140|UTC+09 Adelaide|
-|2200|UTC+10 Canberra, Melbourne, Sydney|
-|2210|UTC+10 Brisbane|
-|2220|UTC+10 Hobart|
-|2230|UTC+11 Vladivostok|
-|2240|UTC+10 Guam, Port Moresby|
-|2300|UTC+11 Solomon Is., New Caledonia|
-|2310|UTC+12 Magadan|
-|2400|UTC+12 Fiji|
-|2410|UTC+12 Auckland, Wellington|
-|2420|UTC+12 Petropavlovsk-Kamchatsky|
-|2430|UTC+12 Coordinated Universal Time +12|
-|2500|UTC+13 Nuku'alofa|
-
-**Locale/Language/**
-The culture code that identifies the language to display on a device, and specifies the formatting of numbers, currencies, time, and dates. For language values, see [Locale IDs Assigned by Microsoft](/openspecs/windows_protocols/ms-lcid/a9eac961-e77d-41a6-90a5-ce1a8b0cdb9c).
-
-The language setting is configured in the Default User profile only.
-
-> [!NOTE]
-> Apply the Locale ID only after the corresponding language packs are built into and supported for the OS image running on the device. The specified language will be applied as the phone language and a restart may be required.
-
-Supported operations are Get and Replace.
-
-## OMA client provisioning examples
-
-
-The XML examples in this section show how to perform various tasks by using OMA client provisioning.
-
-> [!NOTE]
-> These examples are XML snippets and do not include all sections that are required for a complete lockdown XML file.
-
-
-
-### Assigned Access settings
-
-The following example shows how to add a new policy.
-
-```xml
-
-
-
- "/>
-
-
-
-```
-
-### Language
-
-The following example shows how to specify the language to display on the device.
-
-```xml
-
-
-
-
-
-
-```
-
-## OMA DM examples
-
-
-These XML examples show how to perform various tasks using OMA DM.
-
-### Assigned access settings
-
-The following example shows how to lock down a device.
-
-```xml
-
-
-
- 2
-
-
- ./Vendor/MSFT/EnterpriseAssignedAccess/AssignedAccess/AssignedAccessXml
-
-
-
-
-
-
-
-```
-
-### Theme
-
-The following example shows how to change the accent color to one of the standard colors.
-
-```xml
-
-
-
- 1
-
-
- ./Vendor/MSFT/EnterpriseAssignedAccess/Theme/ThemeAccentColorID
-
-
- int
-
-
- 7
-
-
-
-
-
-```
-
-The following example shows how to change the theme.
-
-```xml
-
-
-
- 1
-
-
- ./Vendor/MSFT/EnterpriseAssignedAccess/Theme/ThemeBackground
-
-
- int
-
-
- 1
-
-
-
-
-
-```
-
-The following example shows how to set a custom theme accent color for the enterprise environment.
-
-```xml
-
-
- 1
-
-
- ./Vendor/MSFT/EnterpriseAssignedAccess/Theme/ThemeAccentColorID
-
-
- int
-
-
- 151
-
-
-
- 2
-
-
- ./Vendor/MSFT/EnterpriseAssignedAccess/Theme/ThemeAccentColorValue
-
-
- chr
-
-
- FF0000
-
-
-
-
-```
-
-### Lock screen
-
-Use the examples in this section to set a new lock screen and manage the lock screen features. If using a UNC path, format the LocURI as \\\\host\\share\\image.jpg.
-
-```xml
-
- 2
-
-
- ./Vendor/MSFT/EnterpriseAssignedAccess/LockScreenWallpaper/BGFileName
-
- chr
- text/plain
-
- c:\windows\system32\lockscreen\480x800\Wallpaper_015.jpg
-
-
-
-```
-
-The following example shows how to query the device for the file being used as the lock screen.
-
-```xml
-
- 2
-
-
- ./Vendor/MSFT/EnterpriseAssignedAccess/LockScreenWallpaper/BGFileName
-
-
-
-```
-
-The following example shows how to change the existing lock screen image to one of your choosing.
-
-```xml
-
-
-
- 2
-
-
- ./Vendor/MSFT/EnterpriseAssignedAccess/LockScreenWallpaper/BGFileName
-
-
- chr
- text/plain
-
- c:\windows\system32\lockscreen\480x800\Wallpaper_015.jpg
-
-
-
-
-
-```
-
-### Time zone
-
-The following example shows how to set the time zone to UTC-07 Mountain Time (US & Canada).
-
-```xml
-
-
-
- 2
-
-
- ./Vendor/MSFT/EnterpriseAssignedAccess/Clock/TimeZone
-
-
- int
-
- 500
-
-
-
-
-
-```
-
-The following example shows how to set the time zone to Pacific Standard Time (UTC-08:00) without observing daylight savings time (UTC+01:00).
-
-```xml
-
-
-
- 2
-
-
- ./Vendor/MSFT/EnterpriseAssignedAccess/Clock/TimeZone
-
-
- int
-
- 400
-
-
-
-
-
-```
-
-### Language
-
-The following example shows how to set the language.
-
-```xml
-
-
-
- 1
-
-
- ./Vendor/MSFT/EnterpriseAssignedAccess/Locale/Language
-
-
- int
-
- 1033
-
-
-
-
-
-```
-
-## Product IDs in Windows 10 Mobile
-
-The following table lists the product ID and AUMID for each app that is included in Windows 10 Mobile.
-
-|App|Product ID|AUMID|
-|--- |--- |--- |
-|Alarms and clock|44F7D2B4-553D-4BEC-A8B7-634CE897ED5F|Microsoft.WindowsAlarms_8wekyb3d8bbwe!App|
-|Calculator|B58171C6-C70C-4266-A2E8-8F9C994F4456|Microsoft.WindowsCalculator_8wekyb3d8bbwe!App|
-|Camera|F0D8FEFD-31CD-43A1-A45A-D0276DB069F1|Microsoft.WindowsCamera_8wekyb3d8bbwe!App|
-|Contact Support|0DB5FCFF-4544-458A-B320-E352DFD9CA2B|Windows.ContactSupport_cw5n1h2txyewy!App|
-|Cortana|FD68DCF4-166F-4C55-A4CA-348020F71B94|Microsoft.Windows.Cortana_cw5n1h2txyewy!CortanaUI|
-|Excel|EAD3E7C0-FAE6-4603-8699-6A448138F4DC|Microsoft.Office.Excel_8wekyb3d8bbwe!microsoft.excel|
-|Facebook|82A23635-5BD9-DF11-A844-00237DE2DB9E|Microsoft.MSFacebook_8wekyb3d8bbwe!x82a236355bd9df11a84400237de2db9e|
-|File Explorer|C5E2524A-EA46-4F67-841F-6A9465D9D515|c5e2524a-ea46-4f67-841f-6a9465d9d515_cw5n1h2txyewy!App|
-|FM Radio|F725010E-455D-4C09-AC48-BCDEF0D4B626|N/A|
-|Get Started|B3726308-3D74-4A14-A84C-867C8C735C3C|Microsoft.Getstarted_8wekyb3d8bbwe!App|
-|Groove Music|D2B6A184-DA39-4C9A-9E0A-8B589B03DEC0|Microsoft.ZuneMusic_8wekyb3d8bbwe!Microsoft.ZuneMusic|
-|Maps|ED27A07E-AF57-416B-BC0C-2596B622EF7D|Microsoft.WindowsMaps_8wekyb3d8bbwe!App|
-|Messaging|27E26F40-E031-48A6-B130-D1F20388991A|Microsoft.Messaging_8wekyb3d8bbwe!x27e26f40ye031y48a6yb130yd1f20388991ax|
-|Microsoft Edge|395589FB-5884-4709-B9DF-F7D558663FFD|Microsoft.MicrosoftEdge_8wekyb3d8bbwe!MicrosoftEdge|
-|Money|1E0440F1-7ABF-4B9A-863D-177970EEFB5E|Microsoft.BingFinance_8wekyb3d8bbwe!AppexFinance|
-|Movies and TV|6AFFE59E-0467-4701-851F-7AC026E21665|Microsoft.ZuneVideo_8wekyb3d8bbwe!Microsoft.ZuneVideo|
-|News|9C3E8CAD-6702-4842-8F61-B8B33CC9CAF1|Microsoft.BingNews_8wekyb3d8bbwe!AppexNews|
-|OneDrive|AD543082-80EC-45BB-AA02-FFE7F4182BA8|Microsoft.MicrosoftSkydrive_8wekyb3d8bbwe!App|
-|OneNote|CA05B3AB-F157-450C-8C49-A1F127F5E71D|Microsoft.Office.OneNote_8wekyb3d8bbwe!microsoft.onenoteim|
-|Outlook Calendar|A558FEBA-85D7-4665-B5D8-A2FF9C19799B|Microsoft.WindowsCommunicationsApps_8wekyb3d8bbwe!Microsoft.WindowsLive.Calendar|
-|Outlook Mail|A558FEBA-85D7-4665-B5D8-A2FF9C19799B|Microsoft.WindowsCommunicationsApps_8wekyb3d8bbwe!Microsoft.WindowsLive.Mail|
-|People|60BE1FB8-3291-4B21-BD39-2221AB166481|Microsoft.People_8wekyb3d8bbwe!xb94d6231y84ddy49a8yace3ybc955e769e85x|
-|Phone (dialer)|F41B5D0E-EE94-4F47-9CFE-3D3934C5A2C7|Microsoft.CommsPhone_8wekyb3d8bbwe!App|
-|Photos|FCA55E1B-B9A4-4289-882F-084EF4145005|Microsoft.Windows.Photos_8wekyb3d8bbwe!App|
-|Podcasts|C3215724-B279-4206-8C3E-61D1A9D63ED3|Microsoft.MSPodcast_8wekyb3d8bbwe!xc3215724yb279y4206y8c3ey61d1a9d63ed3x|
-|PowerPoint|B50483C4-8046-4E1B-81BA-590B24935798|Microsoft.Office.PowerPoint_8wekyb3d8bbwe!microsoft.pptim|
-|Settings|2A4E62D8-8809-4787-89F8-69D0F01654FB|2a4e62d8-8809-4787-89f8-69d0f01654fb_8wekyb3d8bbwe!App|
-|Skype|C3F8E570-68B3-4D6A-BDBB-C0A3F4360A51|Microsoft.SkypeApp_kzf8qxf38zg5c!Skype.AppId|
-|Skype Video|27E26F40-E031-48A6-B130-D1F20388991A|Microsoft.Messaging_8wekyb3d8bbwe!App|
-|Sports|0F4C8C7E-7114-4E1E-A84C-50664DB13B17|Microsoft.BingSports_8wekyb3d8bbwe!AppexSports|
-|Storage|5B04B775-356B-4AA0-AAF8-6491FFEA564D|N/A|
-|Store|7D47D89A-7900-47C5-93F2-46EB6D94C159|Microsoft.WindowsStore_8wekyb3d8bbwe!App|
-|Voice recorder|7311B9C5-A4E9-4C74-BC3C-55B06BA95AD0|Microsoft.WindowsSoundRecorder_8wekyb3d8bbwe!App|
-|Wallet|587A4577-7868-4745-A29E-F996203F1462|Microsoft.MicrosoftWallet_8wekyb3d8bbwe!App|
-|Weather|63C2A117-8604-44E7-8CEF-DF10BE3A57C8|Microsoft.BingWeather_8wekyb3d8bbwe!App|
-|Windows Feedback|7604089D-D13F-4A2D-9998-33FC02B63CE3|Microsoft.WindowsFeedback_8wekyb3d8bbwe!App|
-|Word|258F115C-48F4-4ADB-9A68-1387E634459B|Microsoft.Office.Word_8wekyb3d8bbwe!microsoft.word|
-|Xbox|B806836F-EEBE-41C9-8669-19E243B81B83|Microsoft.XboxApp_8wekyb3d8bbwe!Microsoft.XboxApp|
diff --git a/windows/client-management/mdm/enterpriseassignedaccess-ddf.md b/windows/client-management/mdm/enterpriseassignedaccess-ddf.md
deleted file mode 100644
index 5d0a19de74..0000000000
--- a/windows/client-management/mdm/enterpriseassignedaccess-ddf.md
+++ /dev/null
@@ -1,328 +0,0 @@
----
-title: EnterpriseAssignedAccess DDF
-description: Utilize the OMA DM device description framework (DDF) for the EnterpriseAssignedAccess configuration service provider.
-ms.assetid: 8BD6FB05-E643-4695-99A2-633995884B37
-ms.reviewer:
-manager: dansimp
-ms.author: dansimp
-ms.topic: article
-ms.prod: w10
-ms.technology: windows
-author: manikadhiman
-ms.date: 12/05/2017
----
-
-# EnterpriseAssignedAccess DDF
-
-
-This topic shows the OMA DM device description framework (DDF) for the **EnterpriseAssignedAccess** configuration service provider. DDF files are used only with OMA DM provisioning XML.
-
-Looking for the DDF XML files? See [CSP DDF files download](configuration-service-provider-reference.md#csp-ddf-files-download).
-
-```xml
-
-]>
-
- 1.2
-
- EnterpriseAssignedAccess
- ./Vendor/MSFT
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- com.microsoft/1.1/MDM/EnterpriseAssignedAccess
-
-
-
- AssignedAccess
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- AssignedAccessXml
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- text/plain
-
-
-
-
-
- LockScreenWallpaper
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- BGFileName
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- text/plain
-
-
-
-
-
- Theme
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- ThemeBackground
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- text/plain
-
-
-
-
- ThemeAccentColorID
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- text/plain
-
-
-
-
- ThemeAccentColorValue
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- text/plain
-
-
-
-
-
- Clock
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- TimeZone
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- text/plain
-
-
-
-
-
- Locale
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- Language
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- text/plain
-
-
-
-
-
-
-```
-
-
-
-
-
-
-
-
-
-
-
-
diff --git a/windows/client-management/mdm/enterpriseassignedaccess-xsd.md b/windows/client-management/mdm/enterpriseassignedaccess-xsd.md
deleted file mode 100644
index 3ee96832c7..0000000000
--- a/windows/client-management/mdm/enterpriseassignedaccess-xsd.md
+++ /dev/null
@@ -1,270 +0,0 @@
----
-title: EnterpriseAssignedAccess XSD
-description: This XSD can be used to validate that the lockdown XML in the \ block of the AssignedAccessXML node.
-ms.assetid: BB3B633E-E361-4B95-9D4A-CE6E08D67ADA
-ms.reviewer:
-manager: dansimp
-ms.author: dansimp
-ms.topic: article
-ms.prod: w10
-ms.technology: windows
-author: manikadhiman
-ms.date: 06/26/2017
----
-
-# EnterpriseAssignedAccess XSD
-
-
-This XSD can be used to validate that the lockdown XML in the \ block of the AssignedAccessXML node.
-
-```xml
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-```
-
-
-
-
-
-
-
-
-
-
diff --git a/windows/client-management/mdm/enterprisedataprotection-csp.md b/windows/client-management/mdm/enterprisedataprotection-csp.md
index 07388f0b79..e406d98d74 100644
--- a/windows/client-management/mdm/enterprisedataprotection-csp.md
+++ b/windows/client-management/mdm/enterprisedataprotection-csp.md
@@ -8,7 +8,7 @@ ms.author: dansimp
ms.topic: article
ms.prod: w10
ms.technology: windows
-author: manikadhiman
+author: dansimp
ms.date: 08/09/2017
---
@@ -38,7 +38,6 @@ EnterpriseDataProtection
--------EDPEnforcementLevel
--------EnterpriseProtectedDomainNames
--------AllowUserDecryption
---------RequireProtectionUnderLockConfig
--------DataRecoveryCertificate
--------RevokeOnUnenroll
--------RMSTemplateIDForEDP
@@ -95,24 +94,6 @@ The following list shows the supported values:
Most restricted value is 0.
-Supported operations are Add, Get, Replace, and Delete. Value type is integer.
-
-**Settings/RequireProtectionUnderLockConfig**
-Specifies whether the protection under lock feature (also known as encrypt under pin) should be configured. A PIN must be configured on the device before you can apply this policy.
-
-The following list shows the supported values:
-
-- 0 (default) – Not required.
-- 1 – Required.
-
-Most restricted value is 1.
-
-The CSP checks the current edition and hardware support (TPM), and returns an error message if the device does not have the required hardware.
-
-> [!Note]
-> This setting is only supported in Windows 10 Mobile.
-
-
Supported operations are Add, Get, Replace, and Delete. Value type is integer.
**Settings/DataRecoveryCertificate**
@@ -250,7 +231,7 @@ For EFSCertificate KeyTag, it is expected to be a DER ENCODED binary certificate
Supported operations are Add, Get, Replace, and Delete. Value type is base-64 encoded certificate.
**Settings/RevokeOnUnenroll**
-This policy controls whether to revoke the WIP keys when a device unenrolls from the management service. If set to 0 (Don't revoke keys), the keys will not be revoked and the user will continue to have access to protected files after unenrollment. If the keys are not revoked, there will be no revoked file cleanup subsequently. Prior to sending the unenroll command, when you want a device to do a selective wipe when it is unenrolled, then you should explicitly set this policy to 1.
+This policy controls whether to revoke the WIP keys when a device unenrolls from the management service. If set to 0 (Don't revoke keys), the keys will not be revoked and the user will continue to have access to protected files after unenrollment. If the keys are not revoked, there will be no revoked file cleanup subsequently. Prior to sending the unenroll command, when you want a device to do a selective wipe when it is unenrolled, then you should explicitly set this policy to 1.
The following list shows the supported values:
@@ -260,7 +241,7 @@ The following list shows the supported values:
Supported operations are Add, Get, Replace, and Delete. Value type is integer.
**Settings/RevokeOnMDMHandoff**
-Added in Windows 10, version 1703. This policy controls whether to revoke the WIP keys when a device upgrades from mobile application management (MAM) to MDM. If set to 0 (Don't revoke keys), the keys will not be revoked and the user will continue to have access to protected files after upgrade. This is recommended if the MDM service is configured with the same WIP EnterpriseID as the MAM service.
+Added in Windows 10, version 1703. This policy controls whether to revoke the WIP keys when a device upgrades from mobile application management (MAM) to MDM. If set to 0 (Don't revoke keys), the keys will not be revoked and the user will continue to have access to protected files after upgrade. This is recommended if the MDM service is configured with the same WIP EnterpriseID as the MAM service.
- 0 - Don't revoke keys
- 1 (default) - Revoke keys
diff --git a/windows/client-management/mdm/enterprisedataprotection-ddf-file.md b/windows/client-management/mdm/enterprisedataprotection-ddf-file.md
index f7551ccabc..1b0ee74568 100644
--- a/windows/client-management/mdm/enterprisedataprotection-ddf-file.md
+++ b/windows/client-management/mdm/enterprisedataprotection-ddf-file.md
@@ -8,7 +8,7 @@ ms.author: dansimp
ms.topic: article
ms.prod: w10
ms.technology: windows
-author: manikadhiman
+author: dansimp
ms.date: 12/05/2017
---
@@ -141,29 +141,6 @@ The XML below is the current version for this CSP.
-
- RequireProtectionUnderLockConfig
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- text/plain
-
-
- DataRecoveryCertificate
diff --git a/windows/client-management/mdm/enterprisedesktopappmanagement-csp.md b/windows/client-management/mdm/enterprisedesktopappmanagement-csp.md
index 70beb72229..9be9cb8c8d 100644
--- a/windows/client-management/mdm/enterprisedesktopappmanagement-csp.md
+++ b/windows/client-management/mdm/enterprisedesktopappmanagement-csp.md
@@ -8,7 +8,7 @@ ms.author: dansimp
ms.topic: article
ms.prod: w10
ms.technology: windows
-author: manikadhiman
+author: dansimp
ms.date: 07/11/2017
---
diff --git a/windows/client-management/mdm/enterprisedesktopappmanagement-ddf-file.md b/windows/client-management/mdm/enterprisedesktopappmanagement-ddf-file.md
index f4bfca0010..329d5cb253 100644
--- a/windows/client-management/mdm/enterprisedesktopappmanagement-ddf-file.md
+++ b/windows/client-management/mdm/enterprisedesktopappmanagement-ddf-file.md
@@ -8,7 +8,7 @@ ms.author: dansimp
ms.topic: article
ms.prod: w10
ms.technology: windows
-author: manikadhiman
+author: dansimp
ms.date: 06/26/2017
---
diff --git a/windows/client-management/mdm/enterprisedesktopappmanagement2-xsd.md b/windows/client-management/mdm/enterprisedesktopappmanagement2-xsd.md
index 821ec27110..097a08b4f8 100644
--- a/windows/client-management/mdm/enterprisedesktopappmanagement2-xsd.md
+++ b/windows/client-management/mdm/enterprisedesktopappmanagement2-xsd.md
@@ -8,7 +8,7 @@ ms.author: dansimp
ms.topic: article
ms.prod: w10
ms.technology: windows
-author: manikadhiman
+author: dansimp
ms.date: 06/26/2017
---
diff --git a/windows/client-management/mdm/enterpriseext-csp.md b/windows/client-management/mdm/enterpriseext-csp.md
deleted file mode 100644
index 1cf7829f88..0000000000
--- a/windows/client-management/mdm/enterpriseext-csp.md
+++ /dev/null
@@ -1,386 +0,0 @@
----
-title: EnterpriseExt CSP
-description: Learn how the EnterpriseExt CSP allows OEMs to set their own unique ID for their devices, set display brightness values, and set the LED behavior.
-ms.assetid: ACA5CD79-BBD5-4DD1-86DA-0285B93982BD
-ms.reviewer:
-manager: dansimp
-ms.author: dansimp
-ms.topic: article
-ms.prod: w10
-ms.technology: windows
-author: manikadhiman
-ms.date: 06/26/2017
----
-
-# EnterpriseExt CSP
-
-
-The EnterpriseExt configuration service provider allows OEMs to set their own unique ID for their devices, set display brightness values, and set the LED behavior.
-
-> **Note** The EnterpriseExt CSP is only supported in Windows 10 Mobile.
-
-
-
-The following shows the EnterpriseExt configuration service provider in tree format as used by both the Open Mobile Alliance (OMA) Device Management (DM) and OMA Client Provisioning.
-```
-./Vendor/MSFT
-EnterpriseExt
-----DeviceCustomData
---------CustomID
---------CustomString
-----Brightness
---------Default
---------MaxAuto
-----LedAlertNotification
---------State
---------Intensity
---------Period
---------DutyCycle
---------Cyclecount
-```
-The following list shows the characteristics and parameters.
-
-**./Vendor/MSFT/EnterpriseExt**
-The root node for the EnterpriseExt configuration service provider. Supported operations is Get.
-
-**DeviceCustomData**
-Node for setting the custom device ID and string.
-
-**DeviceCustomData/CustomID**
-Any string value as the device ID. This value appears in **Settings** > **About** > **Info**.
-
-Here's an example for getting custom data.
-
-```xml
-
-
-
-
- 1
-
-
- ./Vendor/MSFT/EnterpriseExt/DeviceCustomData/CustomID
-
-
-
-
- ./Vendor/MSFT/EnterpriseExt/DeviceCustomData/CustomString
-
-
-
-
-
-
-```
-
-**DeviceCustomData/CustomString**
-Any string value that is associated with the device.
-
-Here's an example for setting custom data.
-
-```xml
-
-
-
-
- 1
-
-
- ./Vendor/MSFT/EnterpriseExt/DeviceCustomData/CustomID
-
- urn:uuid:130CCE0D-0187-5866-855A-DE7406F76046
-
-
-
- ./Vendor/MSFT/EnterpriseExt/DeviceCustomData/CustomString
-
- {"firstName":"John","lastName":"Doe"}
-
-
-
-
-
-```
-
-**Brightness**
-Node for setting device brightness values.
-
-**Brightness/Default**
-Default display brightness value. For example, you can maximize battery life by reducing the default value or set it to medium in a facility that is generally darker.
-
-The valid values are:
-
-- Automatic - the device determines the brightness
-- Low
-- Medium
-- High
-
-The supported operations are Get and Replace.
-
-Here's an example for getting the current default value.
-
-```xml
-
-
-
-
- 2
-
-
- ./Vendor/MSFT/EnterpriseExt/Brightness/Default
-
-
-
-
-
-
-```
-
-Here's an example for setting the default value to medium.
-
-```xml
-
-
-
-
- 2
-
-
- ./Vendor/MSFT/EnterpriseExt/Brightness/Default
-
- medium
-
-
-
-
-
-```
-
-**Brightness/MaxAuto**
-Maximum display brightness value when the device is set to automatic mode. The device brightness will never be higher than the MaxAuto value. The value values are:
-
-- Low
-- Medium
-- High
-
-The supported operations are Get and Replace.
-
-Here's an example for setting the maximum auto-brightness to medium.
-
-```xml
-
-
-
-
- 2
-
-
- ./Vendor/MSFT/EnterpriseExt/Brightness/MaxAuto
-
- medium
-
-
-
-
-
-```
-
-**LedAlertNotification**
-Node for setting LED behavior of the device.
-
-**LedAlertNotification/State**
-LED state. The valid values are:
-
-- 0 - off
-- 1 - on
-- 2 - blink
-
-Example: LED On
-
-```xml
-
-
-
-
- 3
-
-
- ./Vendor/MSFT/EnterpriseExt/LedAlertNotification/Intensity
-
-
- int
-
- 100
-
-
-
- ./Vendor/MSFT/EnterpriseExt/LedAlertNotification/State
-
-
- int
-
- 1
-
-
-
-
-
-```
-
-Example: LED Off
-
-```xml
-
-
-
-
- 3
-
-
- ./Vendor/MSFT/EnterpriseExt/LedAlertNotification/State
-
-
- int
-
- 0
-
-
-
-
-
-```
-
-**LedAlertNotification/Intensity**
-Intensity of the LED brightness. You can set the value between 1 - 100.
-
-Example: LED blink
-
-```xml
-
-
-
-
- 3
-
-
- ./Vendor/MSFT/EnterpriseExt/LedAlertNotification/Period
-
-
- int
-
- 500
-
-
-
- ./Vendor/MSFT/EnterpriseExt/LedAlertNotification/Dutycycle
-
-
- int
-
- 70
-
-
-
- ./Vendor/MSFT/EnterpriseExt/LedAlertNotification/Intensity
-
-
- int
-
- 100
-
-
-
- ./Vendor/MSFT/EnterpriseExt/LedAlertNotification/Cyclecount
-
-
- int
-
- 543210
-
-
-
- ./Vendor/MSFT/EnterpriseExt/LedAlertNotification/State
-
-
- int
-
- 2
-
-
-
-
-
-```
-
-**LedAlertNotification/Period**
-Duration of each blink, which is the time of ON + OFF. The value is in milliseconds. This is valid only for blink.
-
-**LedAlertNotification/DutyCycle**
-LED ON duration during one blink cycle. You can set the value between 1 - 100. This is valid only for blink.
-
-**LedAlertNotification/Cyclecount**
-Number of blink cycles. The data type is a 4-byte signed integer. Any negative value or zero results in an error. This node is only valid for blink.
-
-**DeviceReboot**
-Removed in Windows 10.
-
-**DeviceReboot/WaitTime**
-Removed in Windows 10.
-
-**MaintenanceWindow**
-Removed in Windows 10.
-
-**MaintenanceWindow/MaintenanceAllowed**
-Removed in Windows 10.
-
-**MaintenanceWindow/MWMandatory**
-Removed in Windows 10.
-
-**MaintenanceWindow/ScheduleXML**
-Removed in Windows 10.
-
-**MaintenanceWindow/MWNotificationDuration**
-Removed in Windows 10.
-
-**MaintenanceWindow/MWminimumDuration**
-Removed in Windows 10.
-
-**DeviceUpdate**
-Removed in Windows 10.
-
-**DeviceUpdate/DateTimeStamp**
-Removed in Windows 10.
-
-**DeviceUpdate/UpdateResultXml**
-Removed in Windows 10.
-
-**MDM**
-Removed in Windows 10.
-
-**MDM/Server**
-Removed in Windows 10.
-
-**MDM/Username**
-Removed in Windows 10.
-
-**MDM/Password**
-Removed in Windows 10.
-
-**MDM/EnableDeviceEnrollment**
-Removed in Windows 10.
-
-**Pfx**
-Removed in Windows 10.
-
-**DisableEnterpriseValidation**
-Removed in Windows 10.
-
-
-
-
-
-10/10/2016
-
-
-
-
diff --git a/windows/client-management/mdm/enterpriseext-ddf.md b/windows/client-management/mdm/enterpriseext-ddf.md
deleted file mode 100644
index 4b3d4b0afd..0000000000
--- a/windows/client-management/mdm/enterpriseext-ddf.md
+++ /dev/null
@@ -1,320 +0,0 @@
----
-title: EnterpriseExt DDF
-description: Learn about the OMA DM device description framework (DDF) for the EnterpriseExt configuration service provider (CSP).
-ms.assetid: 71BF81D4-FBEC-4B03-BF99-F7A5EDD4F91B
-ms.reviewer:
-manager: dansimp
-ms.author: dansimp
-ms.topic: article
-ms.prod: w10
-ms.technology: windows
-author: manikadhiman
-ms.date: 12/05/2017
----
-
-# EnterpriseExt DDF
-
-
-This topic shows the OMA DM device description framework (DDF) for the **EnterpriseExt** configuration service provider. DDF files are used only with OMA DM provisioning XML.
-
-Looking for the DDF XML files? See [CSP DDF files download](configuration-service-provider-reference.md#csp-ddf-files-download).
-
-```xml
-
-]>
-
- 1.2
-
- EnterpriseExt
- ./Vendor/MSFT
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- DeviceCustomData
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- CustomID
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- text/plain
-
-
-
-
- CustomString
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- text/plain
-
-
-
-
-
- Brightness
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- Default
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- text/plain
-
-
-
-
- MaxAuto
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- text/plain
-
-
-
-
-
- LedAlertNotification
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- State
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- text/plain
-
-
-
-
- Intensity
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- text/plain
-
-
-
-
- Period
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- text/plain
-
-
-
-
- DutyCycle
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- text/plain
-
-
-
-
- Cyclecount
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- text/plain
-
-
-
-
-
-
-```
-
-
-
-
-
-
-
-
-
-
-
diff --git a/windows/client-management/mdm/enterpriseextfilessystem-csp.md b/windows/client-management/mdm/enterpriseextfilessystem-csp.md
deleted file mode 100644
index 58fdde76ab..0000000000
--- a/windows/client-management/mdm/enterpriseextfilessystem-csp.md
+++ /dev/null
@@ -1,140 +0,0 @@
----
-title: EnterpriseExtFileSystem CSP
-description: Add, retrieve, or change files through the Mobile Device Management (MDM) service using the EnterpriseExtFileSystem CSP.
-ms.assetid: F773AD72-A800-481A-A9E2-899BA56F4426
-ms.reviewer:
-manager: dansimp
-ms.author: dansimp
-ms.topic: article
-ms.prod: w10
-ms.technology: windows
-author: manikadhiman
-ms.date: 06/26/2017
----
-
-# EnterpriseExtFileSystem CSP
-
-
-The EnterpriseExtFileSystem configuration service provider (CSP) allows IT administrators to add, retrieve, or change files in the file system through the Mobile Device Management (MDM) service. For example, you can use this configuration service provider to push a provisioning XML file or a new lock screen background image file to a device through the MDM service, and also retrieve logs from the device in the enterprise environment.
-
-> **Note** The EnterpriseExtFileSystem CSP is only supported in Windows 10 Mobile.
-
-
-
-File contents are embedded directly into the syncML message, so there is a limit to the size of the file that can be retrieved from the device. The default limit is 0x100000 (1 MB). You can configure this limit by using the following registry key: **Software\\Microsoft\\Provisioning\\CSPs\\.\\Vendor\\MSFT\\EnterpriseExtFileSystem\\MaxFileReadSize**.
-
-The following shows the EnterpriseExtFileSystem configuration service provider in tree format as used by the Open Mobile Alliance (OMA) Device Management (DM).
-```
-./Vendor/MSFT
-EnterpriseExtFileSystem
-----Persistent
---------Files_abc1
---------Directory_abc2
-----NonPersistent
---------Files_abc3
---------Directory_abc4
-----OemProfile
---------Directory_abc5
---------Files_abc6
-```
-The following list describes the characteristics and parameters.
-
-**./Vendor/MSFT/EnterpriseExtFileSystem**
-
The root node for the EnterpriseExtFileSystem configuration service provider. Supported operations are Add and Get.
-
-**Persistent**
-
The EnterpriseExtFileSystem CSP allows an enterprise to read, write, delete and list files in this folder. When an app writes data to the Persistent folder, it accesses that data from the EnterpriseExtFileSystem\Persistent node. Files written to the Persistent folder persists over ordinary power cycles.
-
-> **Important** There is a limit to the amount of data that can be persisted, which varies depending on how much disk space is available on one of the partitions. This data cap amount (that can be persisted) varies by manufacturer.
->
->
->
-> **Note** When the IT admin triggers a **doWipePersistProvisionedData** action using [RemoteWipe CSP](remotewipe-csp.md), items stored in the Persistent folder are persisted over wipe and restored when the device boots again. The contents are not persisted if a **doWipe** action is triggered.
-
-
-
-**NonPersistent**
-
The EnterpriseExtFileSystem CSP allows an enterprise to read, write, delete and list files in this folder. When an app writes data to the Non-Persistent folder, it accesses that data from the EnterpriseExtFileSystem\NonPersistent node. Files written to the NonPersistent folder will persist over ordinary power cycles.
-
-
When the device is wiped, any data stored in the NonPersistent folder is deleted.
-
-**OemProfile**
-
Added in Windows 10, version 1511. The EnterpriseExtFileSystem CSP allows an enterprise to deploy an OEM profile on the device, such as a barcode scanner profile then can be consumed by the OEM barcode scanner driver. The file is placed into the \data\shareddata\oem\public\profile\ folder of the device.
-
-***Directory***
-
The name of a directory in the device file system. Any Directory node can have directories and files as child nodes.
-
-
Use the Add command to create a new directory. You cannot use it to add a new directory under a file system root.
-
-
Use the Get command to return the list of child node names under Directory.
-
-
Use the Get command with ?List=Struct to recursively return all child node names, including subdirectory names, under Directory.
-
-***Filename***
-
The name of a file in the device file system.
-
-Supported operations is Get.
-
-## OMA DM examples
-
-
-The following example shows how to retrieve a file from the device.
-
-```xml
-
- 2
-
-
- ./Vendor/MSFT/EnterpriseExtFileSystem/Persistent/file.txt
-
-
-
-```
-
-The following example shows the file name that is returned in the body of the response syncML code. In this example, the full path of the file on the device is C:/data/test/bin/filename.txt.
-
-```xml
-
- 3
- 1
- 2
-
-
- ./Vendor/MSFT/EnterpriseExtFileSystem/Persistent/filename.txt
-
-
- b64
- application/octet-stream
-
- aGVsbG8gd29ybGQ=
-
-
-```
-
-The following example shows how to push a file to the device.
-
-```xml
-
- 2
-
-
- ./Vendor/MSFT/EnterpriseExtFileSystem/Persistent/new.txt
-
-
- b64
- application/octet-stream
-
- aGVsbG8gd29ybGQ=
-
-
-```
-
-
-
-
-
-
-
-
-
-
diff --git a/windows/client-management/mdm/enterpriseextfilesystem-ddf.md b/windows/client-management/mdm/enterpriseextfilesystem-ddf.md
deleted file mode 100644
index 7efb54af20..0000000000
--- a/windows/client-management/mdm/enterpriseextfilesystem-ddf.md
+++ /dev/null
@@ -1,273 +0,0 @@
----
-title: EnterpriseExtFileSystem DDF
-description: Learn about the OMA DM device description framework (DDF) for the EnterpriseExtFileSystem configuration service provider (CSP).
-ms.assetid: 2D292E4B-15EE-4AEB-8884-6FEE8B92D2D1
-ms.reviewer:
-manager: dansimp
-ms.author: dansimp
-ms.topic: article
-ms.prod: w10
-ms.technology: windows
-author: manikadhiman
-ms.date: 12/05/2017
----
-
-# EnterpriseExtFileSystem DDF
-
-
-This topic shows the OMA DM device description framework (DDF) for the **EnterpriseExtFileSystem** configuration service provider. DDF files are used only with OMA DM provisioning XML.
-
-Looking for the DDF XML files? See [CSP DDF files download](configuration-service-provider-reference.md#csp-ddf-files-download).
-
-```xml
-
-]>
-
- 1.2
-
- EnterpriseExtFileSystem
- ./Vendor/MSFT
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- Persistent
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- Files_abc1
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- Files
-
-
-
-
-
-
- Directory_abc2
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- Directory
-
- text/plain
-
-
-
-
-
- NonPersistent
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- Files_abc3
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- Files
-
- text/plain
-
-
-
-
- Directory_abc4
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- Directory
-
- text/plain
-
-
-
-
-
- OemProfile
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- Directory_abc5
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- Directory
-
- text/plain
-
-
-
-
- Files_abc6
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- Files
-
- text/plain
-
-
-
-
-
-
-```
-
-## Related topics
-
-
-[EnterpriseExtFileSystem configuration service provider](enterpriseextfilessystem-csp.md)
-
-
-
-
-
-
-
-
-
-
diff --git a/windows/client-management/mdm/enterprisemodernappmanagement-csp.md b/windows/client-management/mdm/enterprisemodernappmanagement-csp.md
index ee9026f5a7..107d0c3745 100644
--- a/windows/client-management/mdm/enterprisemodernappmanagement-csp.md
+++ b/windows/client-management/mdm/enterprisemodernappmanagement-csp.md
@@ -8,8 +8,8 @@ ms.author: dansimp
ms.topic: article
ms.prod: w10
ms.technology: windows
-author: manikadhiman
-ms.date: 09/27/2019
+author: dansimp
+ms.date: 11/19/2021
---
# EnterpriseModernAppManagement CSP
@@ -68,7 +68,7 @@ EnterpriseModernAppManagement
For user context, use **./User/Vendor/MSFT** path and for device context, use **./Device/Vendor/MSFT** path.
> [!Note]
-> Windows Holographic and Windows 10 Mobile only support per-user configuration of the EnterpriseModernAppManagement CSP.
+> Windows Holographic only supports per-user configuration of the EnterpriseModernAppManagement CSP.
**AppManagement**
Required. Used for inventory and app management (post-install).
@@ -120,7 +120,7 @@ Query parameters:
- Bundle - returns installed bundle packages.
- Framework - returns installed framework packages.
- Resource - returns installed resources packages. Resources are either language, scale, or DirectX resources. They are parts of a bundle.
- - XAP - returns XAP package types. This filter is not supported on devices other than Windows Mobile.
+ - XAP - returns XAP package types. This filter is only supported on Windows Mobile.
- All - returns all package types.
If no value is specified, the combination of Main, Bundle, and Framework are returned.
@@ -181,7 +181,7 @@ The following example removes a package for all users:
xml
-
+
diff --git a/windows/client-management/mdm/enterprisemodernappmanagement-ddf.md b/windows/client-management/mdm/enterprisemodernappmanagement-ddf.md
index 237000b2f0..4ffad48863 100644
--- a/windows/client-management/mdm/enterprisemodernappmanagement-ddf.md
+++ b/windows/client-management/mdm/enterprisemodernappmanagement-ddf.md
@@ -8,7 +8,7 @@ ms.author: dansimp
ms.topic: article
ms.prod: w10
ms.technology: windows
-author: manikadhiman
+author: dansimp
ms.date: 10/01/2019
---
diff --git a/windows/client-management/mdm/enterprisemodernappmanagement-xsd.md b/windows/client-management/mdm/enterprisemodernappmanagement-xsd.md
index f8b15504cc..53de7e899e 100644
--- a/windows/client-management/mdm/enterprisemodernappmanagement-xsd.md
+++ b/windows/client-management/mdm/enterprisemodernappmanagement-xsd.md
@@ -8,7 +8,7 @@ ms.author: dansimp
ms.topic: article
ms.prod: w10
ms.technology: windows
-author: manikadhiman
+author: dansimp
ms.date: 06/26/2017
---
diff --git a/windows/client-management/mdm/esim-enterprise-management.md b/windows/client-management/mdm/esim-enterprise-management.md
index 4f516e8c19..f1dd261229 100644
--- a/windows/client-management/mdm/esim-enterprise-management.md
+++ b/windows/client-management/mdm/esim-enterprise-management.md
@@ -15,7 +15,7 @@ ms.topic: conceptual
The eSIM Profile Management Solution puts the Mobile Device Management (MDM) Provider in the front and center. The whole idea is to use an already existing solution that customers are familiar with and that they use to manage devices. The expectations from an MDM are that it will use the same sync mechanism that it uses for device policies to push any policy to the eSIM profile, and be able to use Groups and Users the same way. This way, the eSIM profile download and the installation happen in the background without impacting the end user. Similarly, the IT admin would use the same method of managing the eSIM profiles (Assignment/de-assignment, etc.) the same way as they currently do device management.
If you are a Mobile Device Management (MDM) Provider and want to support eSIM Management on Windows, perform the following steps:
- Onboard to Azure Active Directory
-- Contact mobile operators directly or contact orchestrator providers. Windows provides the capability for eSIM profiles to be managed by MDM providers in the case of enterprise use cases. However, Windows does not limit how ecosystem partners might want to offer this to their own partners and/or customers. As such, the eSIM profile management capability is something that can be supported by integrating with the Window OMA-DM. This makes it possible to remotely manage the eSIM profiles according to the company policies. Contact mobile operators directly or contact orchestrator providers. Windows provides the capability for eSIM profiles to be managed by MDM providers in the case of enterprise use cases. However, Windows does not limit how ecosystem partners might want to offer this to their own partners and/or customers. As such, the eSIM profile management capability is something that can be supported by integrating with the Window OMA-DM. This makes it possible to remotely manage the eSIM profiles according to the company policies. As an MDM provider, if you are looking to integrate/onboard to a mobile operator on a 1:1 basis, contact them and learn more about their onboarding. If you would like to integrate and work with only one MDM provider, contact that provider directly. If you would like to offer eSIM management to customers using different MDM providers, contact an orchestrator provider. Orchestrator providers act as proxy handling MDM onboarding as well as mobile operator onboarding. Their role is to make the process as painless and scalable as possible for all parties. Potential orchestrator providers you could contact include:
+- Contact mobile operators directly or contact orchestrator providers. Windows provides the capability for eSIM profiles to be managed by MDM providers in the case of enterprise use cases. However, Windows does not limit how ecosystem partners might want to offer this to their own partners and/or customers. As such, the eSIM profile management capability is something that can be supported by integrating with the Windows OMA-DM. This makes it possible to remotely manage the eSIM profiles according to the company policies. Contact mobile operators directly or contact orchestrator providers. Windows provides the capability for eSIM profiles to be managed by MDM providers in the case of enterprise use cases. However, Windows does not limit how ecosystem partners might want to offer this to their own partners and/or customers. As such, the eSIM profile management capability is something that can be supported by integrating with the Windows OMA-DM. This makes it possible to remotely manage the eSIM profiles according to the company policies. As an MDM provider, if you are looking to integrate/onboard to a mobile operator on a 1:1 basis, contact them and learn more about their onboarding. If you would like to integrate and work with only one MDM provider, contact that provider directly. If you would like to offer eSIM management to customers using different MDM providers, contact an orchestrator provider. Orchestrator providers act as proxy handling MDM onboarding as well as mobile operator onboarding. Their role is to make the process as painless and scalable as possible for all parties. Potential orchestrator providers you could contact include:
- [HPE’s Device Entitlement Gateway](https://www.hpe.com/emea_europe/en/solutions/digital-communications-services.html)
- [IDEMIA’s The Smart Connect - Hub](https://www.idemia.com/smart-connect-hub)
- Assess solution type that you would like to provide your customers
diff --git a/windows/client-management/mdm/euiccs-csp.md b/windows/client-management/mdm/euiccs-csp.md
index c9219f4340..3ac910ac33 100644
--- a/windows/client-management/mdm/euiccs-csp.md
+++ b/windows/client-management/mdm/euiccs-csp.md
@@ -5,7 +5,7 @@ ms.author: dansimp
ms.topic: article
ms.prod: w10
ms.technology: windows
-author: manikadhiman
+author: dansimp
ms.date: 03/02/2018
ms.reviewer:
manager: dansimp
diff --git a/windows/client-management/mdm/euiccs-ddf-file.md b/windows/client-management/mdm/euiccs-ddf-file.md
index f7d0851746..1649e9b5ca 100644
--- a/windows/client-management/mdm/euiccs-ddf-file.md
+++ b/windows/client-management/mdm/euiccs-ddf-file.md
@@ -8,7 +8,7 @@ ms.author: dansimp
ms.topic: article
ms.prod: w10
ms.technology: windows
-author: manikadhiman
+author: dansimp
ms.date: 03/02/2018
---
diff --git a/windows/client-management/mdm/federated-authentication-device-enrollment.md b/windows/client-management/mdm/federated-authentication-device-enrollment.md
index 3a32b79699..f55e50ff03 100644
--- a/windows/client-management/mdm/federated-authentication-device-enrollment.md
+++ b/windows/client-management/mdm/federated-authentication-device-enrollment.md
@@ -8,7 +8,7 @@ ms.author: dansimp
ms.topic: article
ms.prod: w10
ms.technology: windows
-author: manikadhiman
+author: dansimp
ms.date: 07/28/2017
---
@@ -148,7 +148,7 @@ The following are the explicit requirements for the server.
- The <DiscoveryResponse><AuthenticationServiceUrl> element must support HTTPS.
- The authentication server must use a device trusted root certificate. Otherwise, the WAP call will fail.
-- WP doesn’t support Window Integrated Authentication (WIA) for ADFS during WAB authentication. ADFS 2012 R2 if used needs to be configured to not attempt WIA for Windows device.
+- WP doesn’t support Windows Integrated Authentication (WIA) for ADFS during WAB authentication. ADFS 2012 R2 if used needs to be configured to not attempt WIA for Windows device.
The enrollment client issues an HTTPS request as follows:
diff --git a/windows/client-management/mdm/filesystem-csp.md b/windows/client-management/mdm/filesystem-csp.md
deleted file mode 100644
index 0b5579a5a6..0000000000
--- a/windows/client-management/mdm/filesystem-csp.md
+++ /dev/null
@@ -1,107 +0,0 @@
----
-title: FileSystem CSP
-description: Learn how the FileSystem CSP is used to query, add, modify, and delete files, file directories, and file attributes on the mobile device.
-ms.assetid: 9117ee16-ca7a-4efa-9270-c9ac8547e541
-ms.reviewer:
-manager: dansimp
-ms.author: dansimp
-ms.topic: article
-ms.prod: w10
-ms.technology: windows
-author: manikadhiman
-ms.date: 06/26/2017
----
-
-# FileSystem CSP
-
-The FileSystem configuration service provider is used to query, add, modify, and delete files, file directories, and file attributes on the mobile device. It can retrieve information about or manage files in ROM, files in persistent store and files on any removable storage card that is present in the device. It works for files that are hidden from the user as well as those that are visible to the user.
-
-> [!NOTE]
-> FileSystem CSP is only supported in Windows 10 Mobile.
-
-> [!NOTE]
-> This configuration service provider requires the ID\_CAP\_CSP\_FOUNDATION and ID\_CAP\_CSP\_OEM capabilities to be accessed from a network configuration application.
-
-The following shows the FileSystem configuration service provider management object in tree format as used by OMA DM. The OMA Client Provisioning protocol is not supported by this configuration service provider.
-
-```console
-./Vendor/MSFT
-FileSystem
-----file name
-----file directory
---------file name
---------file directory
-```
-
-**FileSystem**
-Required. Defines the root of the file system management object. It functions as the root directory for file system queries.
-
-Recursive queries or deletes are not supported for this element. Add commands will add a new file or directory under the root path.
-
-The following properties are supported for the root node:
-
-- `Name`: The root node name. The Get command is the only supported command.
-
-- `Type`: The MIME type of the file, which is com.microsoft/windowsmobile/1.1/FileSystemMO. The Get command is the only supported command.
-
-- `Format`: The format, which is `node`. The Get command is the only supported command.
-
-- `TStamp`: A standard OMA property that indicates the last time the file directory was changed. The value is represented by a string containing a UTC based, ISO 8601 basic format, complete representation of a date and time value, e.g. 20010711T163817Z means July 11, 2001 at 16 hours, 38 minutes and 17 seconds. The Get command is the only supported command.
-
-- `Size`: Not supported.
-
-- `msft:SystemAttributes`: A custom property that contains file directory attributes. This value is an integer bit mask that corresponds to the FILE\_ATTRIBUTE values and flags defined in the header file winnt.h. This supports the Get command and the Replace command.
-
-***file directory***
-Optional. Returns the name of a directory in the device file system. Any *file directory* element can contain directories and files as child elements.
-
-The Get command returns the name of the file directory. The Get command with `?List=Struct` will recursively return all child element names (including sub-directory names). The Get command with `?list=StructData` query is not supported and returns a 406 error code.
-
-The Add command is used to create a new directory. Adding a new directory under the file system root is not supported and returns a 405 error code.
-
-The Replace command is not supported.
-
-The Delete command is used to delete all files and subfolders under this *file directory*.
-
-The following properties are supported for file directories:
-
-- `Name`: The file directory name. The Get command is the only supported command.
-
-- `Type`: The MIME type of the file, which is an empty string for directories that are not the root node. The Get command is the only supported command.
-
-- `Format`: The format, which is `node`. The Get command is the only supported command.
-
-- `TStamp`: A standard OMA property that indicates the last time the file directory was changed. The value is represented by a string containing a UTC based, ISO 8601 basic format, complete representation of a date and time value, e.g. 20010711T163817Z means July 11, 2001 at 16 hours, 38 minutes and 17 seconds. The Get command is the only supported command.
-
-- `Size`: Not supported.
-
-- `msft:SystemAttributes`: A custom property that contains file directory attributes. This value is an integer bit mask that corresponds to the FILE\_ATTRIBUTE values and flags defined in the header file `winnt.h`. This supports the Get command and the Replace command.
-
-***file name***
-Optional. Return a file in binary format. If the file is too large for the configuration service to return, it returns error code 413 (Request entity too large) instead.
-
-The Delete command deletes the file.
-
-The Replace command updates an entire file with new file contents.
-
-The Add command adds the file to the file directory
-
-The Get command is not supported on a *file name* element, only on the properties of the element.
-
-The following properties are supported for files:
-
-- `Name`: The file name. The Get command is the only supported command.
-
-- `Type`: The MIME type of the file. This value is always set to the generic MIME type: `application/octet-stream`. The Get command is the only supported command.
-
-- `Format`: The format, which is b64 encoded for binary data is sent over XML, and bin format for binary data sent over WBXML. The Get command is the only supported command.
-
-- `TStamp`: A standard OMA property that indicates the last time the file was changed. The value is represented by a string containing a UTC based, ISO 8601 basic format, complete representation of a date and time value, e.g. 20010711T163817Z means July 11, 2001 at 16 hours, 38 minutes and 17 seconds. The Get command is the only supported command.
-
-- `Size`: The unencoded file content size in bytes. The Get command is the only supported command.
-
-- `msft:SystemAttributes`: A custom property that contains file attributes. This value is an integer bit mask that corresponds to the FILE\_ATTRIBUTE values and flags defined in the header file winnt.h. This supports the Get command and the Replace command.
-
-## Related topics
-
-[Configuration service provider reference](configuration-service-provider-reference.md)
diff --git a/windows/client-management/mdm/firewall-csp.md b/windows/client-management/mdm/firewall-csp.md
index 2d9fbf4570..65b65a3326 100644
--- a/windows/client-management/mdm/firewall-csp.md
+++ b/windows/client-management/mdm/firewall-csp.md
@@ -6,7 +6,7 @@ ms.topic: article
ms.prod: w10
ms.technology: windows
author: manikadhiman
-ms.date: 01/26/2018
+ms.date: 11/29/2021
ms.reviewer:
manager: dansimp
---
@@ -98,7 +98,6 @@ Firewall
----------------EdgeTraversal
----------------LocalUserAuthorizationList
----------------FriendlyName
-----------------IcmpTypesAndCodes
----------------Status
----------------Name
```
diff --git a/windows/client-management/mdm/firewall-ddf-file.md b/windows/client-management/mdm/firewall-ddf-file.md
index 72829fc3a9..fa54a62a29 100644
--- a/windows/client-management/mdm/firewall-ddf-file.md
+++ b/windows/client-management/mdm/firewall-ddf-file.md
@@ -5,7 +5,7 @@ ms.author: dansimp
ms.topic: article
ms.prod: w10
ms.technology: windows
-author: manikadhiman
+author: dansimp
ms.date: 12/05/2017
ms.reviewer:
manager: dansimp
diff --git a/windows/client-management/mdm/get-inventory.md b/windows/client-management/mdm/get-inventory.md
index 4c01145bb3..1528b38039 100644
--- a/windows/client-management/mdm/get-inventory.md
+++ b/windows/client-management/mdm/get-inventory.md
@@ -11,7 +11,7 @@ ms.author: dansimp
ms.topic: article
ms.prod: w10
ms.technology: windows
-author: manikadhiman
+author: dansimp
ms.date: 09/18/2017
---
diff --git a/windows/client-management/mdm/get-localized-product-details.md b/windows/client-management/mdm/get-localized-product-details.md
index 3e13a8f8e4..42e72419df 100644
--- a/windows/client-management/mdm/get-localized-product-details.md
+++ b/windows/client-management/mdm/get-localized-product-details.md
@@ -8,7 +8,7 @@ ms.author: dansimp
ms.topic: article
ms.prod: w10
ms.technology: windows
-author: manikadhiman
+author: dansimp
ms.date: 12/07/2020
---
diff --git a/windows/client-management/mdm/get-offline-license.md b/windows/client-management/mdm/get-offline-license.md
index 0f60251a1c..b75fe48a08 100644
--- a/windows/client-management/mdm/get-offline-license.md
+++ b/windows/client-management/mdm/get-offline-license.md
@@ -8,7 +8,7 @@ ms.author: dansimp
ms.topic: article
ms.prod: w10
ms.technology: windows
-author: manikadhiman
+author: dansimp
ms.date: 09/18/2017
---
diff --git a/windows/client-management/mdm/get-product-details.md b/windows/client-management/mdm/get-product-details.md
index 9b32395cbd..091c5884ce 100644
--- a/windows/client-management/mdm/get-product-details.md
+++ b/windows/client-management/mdm/get-product-details.md
@@ -8,7 +8,7 @@ ms.author: dansimp
ms.topic: article
ms.prod: w10
ms.technology: windows
-author: manikadhiman
+author: dansimp
ms.date: 09/18/2017
---
diff --git a/windows/client-management/mdm/get-product-package.md b/windows/client-management/mdm/get-product-package.md
index d08a8b434a..42061b81b9 100644
--- a/windows/client-management/mdm/get-product-package.md
+++ b/windows/client-management/mdm/get-product-package.md
@@ -8,7 +8,7 @@ ms.author: dansimp
ms.topic: article
ms.prod: w10
ms.technology: windows
-author: manikadhiman
+author: dansimp
ms.date: 09/18/2017
---
diff --git a/windows/client-management/mdm/get-product-packages.md b/windows/client-management/mdm/get-product-packages.md
index 6dede5eb3e..3cb5f24efe 100644
--- a/windows/client-management/mdm/get-product-packages.md
+++ b/windows/client-management/mdm/get-product-packages.md
@@ -8,7 +8,7 @@ ms.author: dansimp
ms.topic: article
ms.prod: w10
ms.technology: windows
-author: manikadhiman
+author: dansimp
ms.date: 09/18/2017
---
diff --git a/windows/client-management/mdm/get-seat.md b/windows/client-management/mdm/get-seat.md
index 920c40c4e5..b8b6aa4fa6 100644
--- a/windows/client-management/mdm/get-seat.md
+++ b/windows/client-management/mdm/get-seat.md
@@ -8,7 +8,7 @@ ms.author: dansimp
ms.topic: article
ms.prod: w10
ms.technology: windows
-author: manikadhiman
+author: dansimp
ms.date: 09/18/2017
---
diff --git a/windows/client-management/mdm/get-seats-assigned-to-a-user.md b/windows/client-management/mdm/get-seats-assigned-to-a-user.md
index 099ad10917..d7167f4626 100644
--- a/windows/client-management/mdm/get-seats-assigned-to-a-user.md
+++ b/windows/client-management/mdm/get-seats-assigned-to-a-user.md
@@ -8,7 +8,7 @@ ms.author: dansimp
ms.topic: article
ms.prod: w10
ms.technology: windows
-author: manikadhiman
+author: dansimp
ms.date: 09/18/2017
---
diff --git a/windows/client-management/mdm/get-seats.md b/windows/client-management/mdm/get-seats.md
index a510b2460c..8872ddf1ec 100644
--- a/windows/client-management/mdm/get-seats.md
+++ b/windows/client-management/mdm/get-seats.md
@@ -1,6 +1,6 @@
---
title: Get seats
-description: The Get seats operation retrieves the information about active seats in the Micorsoft Store for Business.
+description: The Get seats operation retrieves the information about active seats in the Microsoft Store for Business.
ms.assetid: 32945788-47AC-4259-B616-F359D48F4F2F
ms.reviewer:
manager: dansimp
@@ -8,7 +8,7 @@ ms.author: dansimp
ms.topic: article
ms.prod: w10
ms.technology: windows
-author: manikadhiman
+author: dansimp
ms.date: 09/18/2017
---
@@ -18,118 +18,34 @@ The **Get seats** operation retrieves the information about active seats in the
## Request
-
+**GET:**
+
+```http
+https://bspmts.mp.microsoft.com/V1/Inventory/{productId}/{skuId}/Seats?continuationToken={ContinuationToken}&maxResults={MaxResults}
+```
-
### URI parameters
The following parameters may be specified in the request URI.
-
-
-
-
-
-
-
-
-
Parameter
-
Type
-
Description
-
-
-
-
-
productId
-
string
-
Required. Product identifier for an application that is used by the Store for Business.
-
-
-
skuId
-
string
-
Required. Product identifier that specifies a specific SKU of an application.
-
-
-
continuationToken
-
string
-
Optional.
-
-
-
maxResults
-
int32
-
Optional. Default = 25, Maximum = 100
-
-
-
+|Parameter|Type|Description|
+|--- |--- |--- |
+|productId|string|Required. Product identifier for an application that is used by the Store for Business.|
+|skuId|string|Required. Product identifier that specifies a specific SKU of an application.|
+|continuationToken|string|Optional.|
+|maxResults|int32|Optional. Default = 25, Maximum = 100|
-
## Response
### Response body
The response body contains [SeatDetailsResultSet](data-structures-windows-store-for-business.md#seatdetailsresultset).
-
-
-
-
-
-
-
-
-
-
Error code
-
Description
-
Retry
-
Data field
-
-
-
-
-
400
-
Invalid parameters
-
No
-
Parameter name
-
Reason: Missing parameter or invalid parameter
-
Details: String
-
-
-
404
-
Not found
-
-
-
-
-
409
-
Conflict
-
-
Reason: Not online
-
-
-
-
-
-
-
-
-
+|Error code|Description|Retry|Data field|
+|--- |--- |--- |--- |
+|400|Invalid parameters|No|Parameter name Reason: Missing parameter or invalid parameter Details: String|
+|404|Not found|||
+|409|Conflict||Reason: Not online|
diff --git a/windows/client-management/mdm/healthattestation-csp.md b/windows/client-management/mdm/healthattestation-csp.md
index 32bdbb1eca..2513599a28 100644
--- a/windows/client-management/mdm/healthattestation-csp.md
+++ b/windows/client-management/mdm/healthattestation-csp.md
@@ -30,48 +30,42 @@ Windows 11 introduces an update to the device health attestation feature. This h
The attestation report provides a health assessment of the boot-time properties of the device to ensure that the devices are automatically secure as soon as they power on. The health attestation result can then be used to allow or deny access to networks, apps, or services, depending on the health of the device.
### Terms
-**TPM (Trusted Platform Module)**
-
TPM is a specialized hardware-protected logic that performs a series of hardware protected security operations including providing protected storage, random number generation, encryption, and signing.
-**DHA (Device HealthAttestation) feature**
-
The Device HealthAttestation (DHA) feature enables enterprise IT administrators to monitor the security posture of managed devices remotely by using hardware (TPM) protected and attested data via a tamper-resistant and tamper-evident communication channel.
+- **TPM (Trusted Platform Module)**: TPM is a specialized hardware-protected logic that performs a series of hardware protected security operations including providing protected storage, random number generation, encryption, and signing.
-**MAA-Session (Microsoft Azure Attestation service based device HealthAttestation session)**
-
The Microsoft Azure Attestation service-based device HealthAttestation session (MAA-Session) describes the end-to-end communication flow that is performed in one device health attestation session.
+- **DHA (Device HealthAttestation) feature**: The Device HealthAttestation (DHA) feature enables enterprise IT administrators to monitor the security posture of managed devices remotely by using hardware (TPM) protected and attested data via a tamper-resistant and tamper-evident communication channel.
-**MAA-CSP Nodes (Microsoft Azure Attestation based Configuration Service Provider)**
-
The Configuration Service Provider nodes added to Windows 11 to integrate with Microsoft Azure Attestation Service.
-
The following list of operations is performed by MAA-CSP:
-
-
Receives attestation trigger requests from a HealthAttestation enabled MDM provider.
-
The device collects Attestation Evidence (device boot logs, TPM audit trails and the TPM certificate) from a managed device.
-
Forwards the Attestation Evidence to the Azure Attestation Service instance as configured by the MDM provider.
-
Receives a signed report from the Azure Attestation Service instance and stores it in a local cache on the device.
-
+- **MAA-Session (Microsoft Azure Attestation service based device HealthAttestation session)**: The Microsoft Azure Attestation service-based device HealthAttestation session (MAA-Session) describes the end-to-end communication flow that is performed in one device health attestation session.
-**MAA endpoint**
-Microsoft Azure attestation service is an Azure resource, and every instance of the service gets administrator configured URL. The URI generated is unique in nature and for the purposes of device health attestation is known as the MAA endpoint.
+- **MAA-CSP Nodes (Microsoft Azure Attestation based Configuration Service Provider)**: The Configuration Service Provider nodes added to Windows 11 to integrate with Microsoft Azure Attestation Service.
-**JWT (JSON Web Token)**
-JSON Web Token (JWT) is an open standard RFC7519 method for securely transmitting information between parties as a JavaScript Object Notation (JSON) object. This information can be verified and trusted because it is digitally signed. JWTs can be signed using a secret or a public/private key pair.
+ The following list of operations is performed by MAA-CSP:
+
+ - Receives attestation trigger requests from a HealthAttestation enabled MDM provider.
+ - The device collects Attestation Evidence (device boot logs, TPM audit trails and the TPM certificate) from a managed device.
+ - Forwards the Attestation Evidence to the Azure Attestation Service instance as configured by the MDM provider.
+ - Receives a signed report from the Azure Attestation Service instance and stores it in a local cache on the device.
+
+- **MAA endpoint**: Microsoft Azure attestation service is an Azure resource, and every instance of the service gets administrator configured URL. The URI generated is unique in nature and for the purposes of device health attestation is known as the MAA endpoint.
+
+- **JWT (JSON Web Token)**: JSON Web Token (JWT) is an open standard RFC7519 method for securely transmitting information between parties as a JavaScript Object Notation (JSON) object. This information can be verified and trusted because it is digitally signed. JWTs can be signed using a secret or a public/private key pair.
### Attestation Flow with Microsoft Azure Attestation Service
-
-
Attestation flow can be broadly in three main steps:
-
-
An instance of the Azure Attestation service is set up with an appropriate attestation policy. The attestation policy allows the MDM provider to attest to particular events in the boot as well security features.
-
The MDM provider triggers a call to the attestation service, the device then performs an attestation check keeping the report ready to be retrieved.
-
The MDM provider after verifying the token is coming from the attestation service it can parse the attestation token to reflect on the attested state of the device.
-
+Attestation flow can be broadly in three main steps:
-The protocol implemented can be found here: Attestation Protocol.
+- An instance of the Azure Attestation service is set up with an appropriate attestation policy. The attestation policy allows the MDM provider to attest to particular events in the boot as well security features.
+- The MDM provider triggers a call to the attestation service, the device then performs an attestation check keeping the report ready to be retrieved.
+- The MDM provider after verifying the token is coming from the attestation service it can parse the attestation token to reflect on the attested state of the device.
+
+For more information, see [Attestation Protocol](/azure/attestation/virtualization-based-security-protocol).
### Configuration Service Provider Nodes
Windows 11 introduces additions to the HealthAttestation CSP node to integrate with Microsoft Azure Attestation service.
-```
+
+```console
./Vendor/MSFT
HealthAttestation
----...
@@ -92,16 +86,17 @@ HealthAttestation
----MaxSupportedProtocolVersion
```
-
**./Vendor/MSFT/HealthAttestation**
-
The root node for the device HealthAttestation configuration service provider.
+
+The root node for the device HealthAttestation configuration service provider.
**TriggerAttestation** (Required)
-
Node type: EXECUTE
-This node will trigger attestation flow by launching an attestation process. If the attestation process is launched successfully, this node will return code 202 indicating the request is received and being processed. Otherwise, an error will be returned.
-
-
Templated SyncML Call:
+Node type: EXECUTE
+
+This node will trigger attestation flow by launching an attestation process. If the attestation process is launched successfully, this node will return code 202 indicating the request is received and being processed. Otherwise, an error will be returned.
+
+Templated SyncML Call:
```xml
@@ -116,8 +111,8 @@ This node will trigger attestation flow by launching an attestation process. If
{
- rpID : "rpID", serviceEndpoint : “MAA endpoint”,
- nonce : “nonce”, aadToken : “aadToken”, "cv" : "CorrelationVector"
+ rpID : "rpID", serviceEndpoint : "MAA endpoint",
+ nonce : "nonce", aadToken : "aadToken", "cv" : "CorrelationVector"
}
@@ -127,16 +122,15 @@ This node will trigger attestation flow by launching an attestation process. If
```
-
Data fields:
-
-
rpID (Relying Party Identifier): This field contains an identifier that can be used to help determine the caller.
-
serviceEndpoint : This field contains the complete URL of the Microsoft Azure Attestation provider instance to be used for evaluation.
-
nonce : This field contains an arbitrary number that can be used just once in a cryptographic communication. It is often a random or pseudo-random number issued in an authentication protocol to ensure that old communications cannot be reused in replay attacks.
-
aadToken: The AAD token to be used for authentication against the Microsoft Azure Attestation service.
-
cv: This field contains an identifier(Correlation Vector) that will passed in to the service call, that can be used for diagnostics purposes.
-
+Data fields:
-
Sample Data:
+- rpID (Relying Party Identifier): This field contains an identifier that can be used to help determine the caller.
+- serviceEndpoint : This field contains the complete URL of the Microsoft Azure Attestation provider instance to be used for evaluation.
+- nonce : This field contains an arbitrary number that can be used just once in a cryptographic communication. It is often a random or pseudo-random number issued in an authentication protocol to ensure that old communications cannot be reused in replay attacks.
+- aadToken: The AAD token to be used for authentication against the Microsoft Azure Attestation service.
+- cv: This field contains an identifier(Correlation Vector) that will passed in to the service call, that can be used for diagnostics purposes.
+
+Sample Data:
```json
@@ -151,12 +145,13 @@ This node will trigger attestation flow by launching an attestation process. If
```
**AttestStatus**
-
Node type: GET
+
+Node type: GET
+
This node will retrieve the status(HRESULT value) stored in registry updated by the attestation process triggered in the previous step.
The status is always cleared prior to making the attest service call.
-
-
Templated SyncML Call:
+Templated SyncML Call:
```xml
@@ -175,20 +170,21 @@ The status is always cleared prior to making the attest service call.
```
-
Sample Data:
+Sample Data:
-```
+```console
If Successful: 0
If Failed: A corresponding HRESULT error code
Example: 0x80072efd, WININET_E_CANNOT_CONNECT
```
**GetAttestReport**
-
Node type: GET
-This node will retrieve the attestation report per the call made by the TriggerAttestation, if there is any, for the given MDM provider. The report is stored in a registry key in the respective MDM enrollment store.
-
-
Templated SyncML Call:
+Node type: GET
+
+This node will retrieve the attestation report per the call made by the TriggerAttestation, if there is any, for the given MDM provider. The report is stored in a registry key in the respective MDM enrollment store.
+
+Templated SyncML Call:
```xml
@@ -207,9 +203,9 @@ This node will retrieve the attestation report per the call made by the TriggerA
```
-
Sample data:
+Sample data:
-```
+```console
If Success:
JWT token: aaaaaaaaaaaaa.bbbbbbbbbbbbb.cccccccccc
If failed:
@@ -218,10 +214,12 @@ OR Sync ML 404 error if not cached report available.
```
**GetServiceCorrelationIDs**
-
Node type: GET
-This node will retrieve the service-generated correlation IDs for the given MDM provider. If there are more than one correlation IDs, they are separated by “;” in the string.
-
-
Templated SyncML Call:
+
+Node type: GET
+
+This node will retrieve the service-generated correlation IDs for the given MDM provider. If there is more than one correlation ID, they are separated by “;” in the string.
+
+Templated SyncML Call:
```xml
@@ -240,226 +238,220 @@ This node will retrieve the service-generated correlation IDs for the given MDM
```
-
Sample data:
+Sample data:
-> If success:
-> GUID returned by the attestation service: 1k9+vQOn00S8ZK33;CMc969r1JEuHwDpM
-> If Trigger Attestation call failed and no previous data is present. The field remains empty.
-> Otherwise, the last service correlation id will be returned. In a successful attestation there are two
-> calls between client and MAA and for each call the GUID is separated by semicolon.
+```console
+If success:
+GUID returned by the attestation service: 1k9+vQOn00S8ZK33;CMc969r1JEuHwDpM
+If Trigger Attestation call failed and no previous data is present. The field remains empty.
+Otherwise, the last service correlation id will be returned. In a successful attestation there are two
+calls between client and MAA and for each call the GUID is separated by semicolon.
+```
-> **_Note:_** MAA CSP nodes are available on arm64 but is not currently supported.
+> [!NOTE]
+> > MAA CSP nodes are available on arm64 but is not currently supported.
### MAA CSP Integration Steps
-
-
Call TriggerAttestation with your rpid, AAD token and the attestURI:
-Use the Attestation URL generated in step 1, and append the appropriate api version you want to hit. More information about the api version can be found here Attestation - Attest Tpm - REST API (Azure Attestation) | Microsoft Docs
-
Call GetAttestReport and decode and parse the report to ensure the attested report contains the required properties:
-GetAttestReport return the signed attestation token as a JWT. The JWT can be decoded to parse the information per the attestation policy.
-
+3. Call TriggerAttestation with your rpid, AAD token and the attestURI: Use the Attestation URL generated in step 1, and append the appropriate api version you want to hit. For more information about the api version, see [Attestation - Attest Tpm - REST API](/rest/api/attestation/attestation/attest-tpm).
-```json
- {
- "typ": "JWT",
- "alg": "RS256",
- "x5c": [
- "MIIE.....=",
- "MIIG.....=",
- "MIIF.....="
- ],
- "kid": "8FUer20z6wzf1rod044wOAFdjsg"
- }.{
- "nbf": 1633664812,
- "exp": 1634010712,
- "iat": 1633665112,
- "iss": "https://contosopolicy.eus.attest.azure.net",
- "jti": "2b63663acbcafefa004d20969991c0b1f063c9be",
- "ver": "1.0",
- "x-ms-ver": "1.0",
- "rp_data": "AQIDBA",
- "nonce": "AQIDBA",
- "cnf": {
- "jwk": {
- "kty": "RSA",
- "n": "yZGC3-1rFZBt6n6vRHjRjvrOYlH69TftIQWOXiEHz__viQ_Z3qxWVa4TfrUxiQyDQnxJ8-f8tBRmlunMdFDIQWhnew_rc3-UYMUPNcTQ0IkrLBDG6qDjFFeEAMbn8gqr0rRWu_Qt7Cb_Cq1upoEBkv0RXk8yR6JXmFIvLuSdewGs-xCWlHhd5w3n1rVk0hjtRk9ZErlbPXt74E5l-ZZQUIyeYEZ1FmbivOIL-2f6NnKJ-cR4cdhEU8i9CH1YV0r578ry89nGvBJ5u4_3Ib9Ragdmxm259npH53hpnwf0I6V-_ZhGPyF6LBVUG_7x4CyxuHCU20uI0vXKXJNlbj1wsQ",
- "e": "AQAB"
- }
- },
- "x-ms-policy-hash": "GiGQCTOylCohHt4rd3pEppD9arh5mXC3ifF1m1hONh0",
- "WindowsDefenderElamDriverLoaded": true,
- "bitlockerEnabled": true,
- "bitlockerEnabledValue": 4,
- "bootAppSvn": 1,
- "bootDebuggingDisabled": true,
- "bootMgrSvn": 1,
- "bootRevListInfo": "gHWqR2F-1wEgAAAACwBxrZXHbaiuTuO0PSaJ7WQMF8yz37Z2ATgSNTTlRkwcTw",
- "codeIntegrityEnabled": true,
- "codeIntegrityPolicy": [
- "AAABAAAAAQBWAAsAIAAAAHsAOABmAGIANAA4ADYANQBlAC0AZQA5ADAAYgAtADQANAA0AGYALQBiADUAYgA1AC0AZQAyAGEAYQA1ADEAZAA4ADkAMABmAGQAfQAuAEMASQBQAAAAVnW86ERqAg5n9QT1UKFr-bOP2AlNtBaaHXjZODnNLlk",
- "AAAAAAAACgBWAAsAIAAAAHsAYgBjADQAYgBmADYAZAA3AC0AYwBjADYAMAAtADQAMABmADAALQA4ADYANAA0AC0AMQBlADYANAA5ADEANgBmADgAMQA4ADMAfQAuAEMASQBQAAAAQ7vOXuAbBRIMglSSg7g_LHNeHoR4GrY-M-2W5MNvf0o",
- "AAAAAAAACgBWAAsAIAAAAHsAYgAzADEAOAA5ADkAOQBhAC0AYgAxADMAZQAtADQANAA3ADUALQBiAGMAZgBkAC0AMQBiADEANgBlADMAMABlADYAMAAzADAAfQAuAEMASQBQAAAALTmwU3eadNtg0GyAyKIAkYed127RJCSgmfFmO1jN_aI",
- "AAAAAAAACgBWAAsAIAAAAHsAZgBlADgAMgBkADUAOAA5AC0ANwA3AGQAMQAtADQAYwA3ADYALQA5AGEANABhAC0AZQA0ADUANQA0ADYAOAA4ADkANAAxAGIAfQAuAEMASQBQAAAA8HGUwA85gHN_ThItTYtu6sw657gVuOb4fOhYl-YJRoc",
- "AACRVwAACgAmAAsAIAAAAEQAcgBpAHYAZQByAFMAaQBQAG8AbABpAGMAeQAuAHAANwBiAAAAYcVuY0HdW4Iqr5B-6Sl85kwIXRG9bqr43pVhkirg4qM"
- ],
- "depPolicy": 0,
- "flightSigningNotEnabled": false,
- "hvciEnabled": true,
- "iommuEnabled": true,
- "notSafeMode": true,
- "notWinPE": true,
- "osKernelDebuggingDisabled": true,
- "osRevListInfo": "gHLuW2F-1wEgAAAACwDLyDTUQILjdz_RfNlShVgNYT9EghL7ceMReWg9TuwdKA",
- "secureBootEnabled": true,
- "testSigningDisabled": true,
- "vbsEnabled": true
- }.[Signature]
-```
-
-
+4. Call GetAttestReport and decode and parse the report to ensure the attested report contains the required properties: GetAttestReport return the signed attestation token as a JWT. The JWT can be decoded to parse the information per the attestation policy.
+
+ ```json
+ {
+ "typ": "JWT",
+ "alg": "RS256",
+ "x5c": [
+ "MIIE.....=",
+ "MIIG.....=",
+ "MIIF.....="
+ ],
+ "kid": "8FUer20z6wzf1rod044wOAFdjsg"
+ }.{
+ "nbf": 1633664812,
+ "exp": 1634010712,
+ "iat": 1633665112,
+ "iss": "https://contosopolicy.eus.attest.azure.net",
+ "jti": "2b63663acbcafefa004d20969991c0b1f063c9be",
+ "ver": "1.0",
+ "x-ms-ver": "1.0",
+ "rp_data": "AQIDBA",
+ "nonce": "AQIDBA",
+ "cnf": {
+ "jwk": {
+ "kty": "RSA",
+ "n": "yZGC3-1rFZBt6n6vRHjRjvrOYlH69TftIQWOXiEHz__viQ_Z3qxWVa4TfrUxiQyDQnxJ8-f8tBRmlunMdFDIQWhnew_rc3-UYMUPNcTQ0IkrLBDG6qDjFFeEAMbn8gqr0rRWu_Qt7Cb_Cq1upoEBkv0RXk8yR6JXmFIvLuSdewGs-xCWlHhd5w3n1rVk0hjtRk9ZErlbPXt74E5l-ZZQUIyeYEZ1FmbivOIL-2f6NnKJ-cR4cdhEU8i9CH1YV0r578ry89nGvBJ5u4_3Ib9Ragdmxm259npH53hpnwf0I6V-_ZhGPyF6LBVUG_7x4CyxuHCU20uI0vXKXJNlbj1wsQ",
+ "e": "AQAB"
+ }
+ },
+ "x-ms-policy-hash": "GiGQCTOylCohHt4rd3pEppD9arh5mXC3ifF1m1hONh0",
+ "WindowsDefenderElamDriverLoaded": true,
+ "bitlockerEnabled": true,
+ "bitlockerEnabledValue": 4,
+ "bootAppSvn": 1,
+ "bootDebuggingDisabled": true,
+ "bootMgrSvn": 1,
+ "bootRevListInfo": "gHWqR2F-1wEgAAAACwBxrZXHbaiuTuO0PSaJ7WQMF8yz37Z2ATgSNTTlRkwcTw",
+ "codeIntegrityEnabled": true,
+ "codeIntegrityPolicy": [
+ "AAABAAAAAQBWAAsAIAAAAHsAOABmAGIANAA4ADYANQBlAC0AZQA5ADAAYgAtADQANAA0AGYALQBiADUAYgA1AC0AZQAyAGEAYQA1ADEAZAA4ADkAMABmAGQAfQAuAEMASQBQAAAAVnW86ERqAg5n9QT1UKFr-bOP2AlNtBaaHXjZODnNLlk", "AAAAAAAACgBWAAsAIAAAAHsAYgBjADQAYgBmADYAZAA3AC0AYwBjADYAMAAtADQAMABmADAALQA4ADYANAA0AC0AMQBlADYANAA5ADEANgBmADgAMQA4ADMAfQAuAEMASQBQAAAAQ7vOXuAbBRIMglSSg7g_LHNeHoR4GrY-M-2W5MNvf0o", "AAAAAAAACgBWAAsAIAAAAHsAYgAzADEAOAA5ADkAOQBhAC0AYgAxADMAZQAtADQANAA3ADUALQBiAGMAZgBkAC0AMQBiADEANgBlADMAMABlADYAMAAzADAAfQAuAEMASQBQAAAALTmwU3eadNtg0GyAyKIAkYed127RJCSgmfFmO1jN_aI", "AAAAAAAACgBWAAsAIAAAAHsAZgBlADgAMgBkADUAOAA5AC0ANwA3AGQAMQAtADQAYwA3ADYALQA5AGEANABhAC0AZQA0ADUANQA0ADYAOAA4ADkANAAxAGIAfQAuAEMASQBQAAAA8HGUwA85gHN_ThItTYtu6sw657gVuOb4fOhYl-YJRoc", "AACRVwAACgAmAAsAIAAAAEQAcgBpAHYAZQByAFMAaQBQAG8AbABpAGMAeQAuAHAANwBiAAAAYcVuY0HdW4Iqr5B-6Sl85kwIXRG9bqr43pVhkirg4qM"
+ ],
+ "depPolicy": 0,
+ "flightSigningNotEnabled": false,
+ "hvciEnabled": true,
+ "iommuEnabled": true,
+ "notSafeMode": true,
+ "notWinPE": true,
+ "osKernelDebuggingDisabled": true,
+ "osRevListInfo": "gHLuW2F-1wEgAAAACwDLyDTUQILjdz_RfNlShVgNYT9EghL7ceMReWg9TuwdKA",
+ "secureBootEnabled": true,
+ "testSigningDisabled": true,
+ "vbsEnabled": true
+ }.[Signature]
+ ```
### Learn More
@@ -470,159 +462,87 @@ More information about TPM attestation can be found here: [Microsoft Azure Attes
### Terms
-**TPM (Trusted Platform Module)**
-
TPM is a specialized hardware-protected logic that performs a series of hardware protected security operations including providing protected storage, random number generation, encryption, and signing.
+- **TPM (Trusted Platform Module)**: TPM is a specialized hardware-protected logic that performs a series of hardware protected security operations including providing protected storage, random number generation, encryption, and signing.
-**DHA (Device HealthAttestation) feature**
-
The Device HealthAttestation (DHA) feature enables enterprise IT administrators to monitor the security posture of managed devices remotely by using hardware (TPM) protected and attested data via a tamper-resistant and tamper-evident communication channel.
+- **DHA (Device HealthAttestation) feature**: The Device HealthAttestation (DHA) feature enables enterprise IT administrators to monitor the security posture of managed devices remotely by using hardware (TPM) protected and attested data via a tamper-resistant and tamper-evident communication channel.
-**DHA-Enabled device (Device HealthAttestation enabled device)**
-
A Device HealthAttestation enabled (DHA-Enabled) device is a computing device (phone, desktop, laptop, tablet, server) that runs Windows 10 and supports TPM version 1.2 or 2.0.
+- **DHA-Enabled device (Device HealthAttestation enabled device)**: A Device HealthAttestation enabled (DHA-Enabled) device is a computing device (phone, desktop, laptop, tablet, server) that runs Windows 10 and supports TPM version 1.2 or 2.0.
-**DHA-Session (Device HealthAttestation session)**
-
The Device HealthAttestation session (DHA-Session) describes the end-to-end communication flow that is performed in one device health attestation session.
+- **DHA-Session (Device HealthAttestation session)**: The Device HealthAttestation session (DHA-Session) describes the end-to-end communication flow that is performed in one device health attestation session.
-
The following list of transactions is performed in one DHA-Session:
-
-
DHA-CSP and DHA-Service communication:
-
DHA-CSP forwards device boot data (DHA-BootData) to DHA-Service
-
DHA-Service replies with an encrypted data blob (DHA-EncBlob)
-
+ The following list of transactions is performed in one DHA-Session:
-
DHA-CSP and MDM-Server communication:
-
MDM-Server sends a device health verification request to DHA-CSP
-
DHA-CSP replies with a payload called DHA-Data that includes an encrypted (DHA-EncBlob) and a signed (DHA-SignedBlob) data blob
-
+ - DHA-CSP and DHA-Service communication:
+ - DHA-CSP forwards device boot data (DHA-BootData) to DHA-Service
+ - DHA-Service replies with an encrypted data blob (DHA-EncBlob)
-
MDM-Server and DHA-Service communication:
-
MDM-Server posts data it receives from devices to DHA-Service
-
DHA-Service reviews the data it receives, and replies with a device health report (DHA-Report)
-
-
+ - DHA-CSP and MDM-Server communication:
+ - MDM-Server sends a device health verification request to DHA-CSP
+ - DHA-CSP replies with a payload called DHA-Data that includes an encrypted (DHA-EncBlob) and a signed (DHA-SignedBlob) data blob
-
-DHA session data (Device HealthAttestation session data)
-
The following list of data is produced or consumed in one DHA-Transaction:
-
-
DHA-BootData: the device boot data (TCG logs, PCR values, device/TPM certificate, boot, and TPM counters) that are required for validating device boot health.
-
DHA-EncBlob: an encrypted summary report that DHA-Service issues to a device after reviewing the DHA-BootData it receives from devices.
-
DHA-SignedBlob: it is a signed snapshot of the current state of a device’s runtime that is captured by DHA-CSP at device health attestation time.
-
DHA-Data: an XML formatted data blob that devices forward for device health validation to DHA-Service via MDM-Server. DHA-Data has two parts:
-
-
DHA-EncBlob: the encrypted data blob that the device receives from DHA-Service
-
DHA-SignedBlob: a current snapshot of the current security state of the device that is generated by DHA-CSP
-
-
-
DHA-Report: the report that is issued by DHA-Service to MDM-Server
-
Nonce: a crypto protected number that is generated by MDM-Server, which protects the DHA-Session from man-in-the-middle type attacks
-
+ - MDM-Server and DHA-Service communication:
+ - MDM-Server posts data it receives from devices to DHA-Service
+ - DHA-Service reviews the data it receives, and replies with a device health report (DHA-Report)
-DHA-Enabled MDM (Device HealthAttestation enabled device management solution)
-
Device HealthAttestation enabled (DHA-Enabled) device management solution is a device management tool that is integrated with the DHA feature.
-
DHA-Enabled device management solutions enable enterprise IT managers to raise the security protection bar for their managed devices based on hardware (TPM) protected data that can be trusted even if a device is compromised by advanced security threats or running a malicious (jailbroken) operating system.
-
The following list of operations is performed by DHA-Enabled-MDM
-
-
Enables the DHA feature on a DHA-Enabled device
-
Issues device health attestation requests to enrolled/managed devices
-
Collects device health attestation data (DHA-Data), and sends it to Device Health Attestation Service (DHA-Service) for verification
-
Gets the device health report (DHA-Report) from DHA-Service, which triggers compliance action
The Device HealthAttestation Configuration Service Provider (DHA-CSP) uses a device’s TPM and firmware to measure critical security properties of the device’s BIOS and Windows boot, such that even on a system infected with kernel level malware or a rootkit, these properties cannot be spoofed.
-
The following list of operations is performed by DHA-CSP:
-
-
Collects device boot data (DHA-BootData) from a managed device
-
Forwards DHA-BootData to Device Health Attestation Service (DHA-Service)
-
Receives an encrypted blob (DHA-EncBlob) from DHA-Service, and stores it in a local cache on the device
-
Receives attestation requests (DHA-Requests) from a DHA-Enabled MDM, and replies with Device Health Attestation data (DHA-Data)
-
+- **DHA session data (Device HealthAttestation session data)**: The following list of data is produced or consumed in one DHA-Transaction:
-DHA-Service (Device HealthAttestation Service)
-
Device HealthAttestation Service (DHA-Service) validates the data it receives from DHA-CSP and issues a highly trusted hardware (TPM) protected report (DHA-Report) to DHA-Enabled device management solutions through a tamper resistant and tamper evident communication channel.
+ - DHA-BootData: the device boot data (TCG logs, PCR values, device/TPM certificate, boot, and TPM counters) that are required for validating device boot health.
+ - DHA-EncBlob: an encrypted summary report that DHA-Service issues to a device after reviewing the DHA-BootData it receives from devices.
+ - DHA-SignedBlob: it is a signed snapshot of the current state of a device’s runtime that is captured by DHA-CSP at device health attestation time.
+ - DHA-Data: an XML formatted data blob that devices forward for device health validation to DHA-Service via MDM-Server. DHA-Data has two parts:
-
DHA-Service is available in two flavors: “DHA-Cloud” and “DHA-Server2016”. DHA-Service supports various implementation scenarios including cloud, on premises, air-gapped, and hybrid scenarios.
-
The following list of operations is performed by DHA-Service:
+ - DHA-EncBlob: the encrypted data blob that the device receives from DHA-Service
+ - DHA-SignedBlob: a current snapshot of the current security state of the device that is generated by DHA-CSP
-- Receives device boot data (DHA-BootData) from a DHA-Enabled device
-- Forwards DHA-BootData to Device Health Attestation Service (DHA-Service)
-- Receives an encrypted blob (DHA-EncBlob) from DHA-Service, and stores it in a local cache on the device
-- Receives attestation requests (DHA-Requests) from a DHA-Enabled-MDM, and replies with a device health report (DHA-Report)
+ - DHA-Report: the report that is issued by DHA-Service to MDM-Server
+ - Nonce: a crypto protected number that is generated by MDM-Server, which protects the DHA-Session from man-in-the-middle type attacks
-
+- **DHA-Enabled MDM (Device HealthAttestation enabled device management solution)**: Device HealthAttestation enabled (DHA-Enabled) device management solution is a device management tool that is integrated with the DHA feature.
-
-
-
-
-
-
-
-
DHA-Service type
-
Description
-
Operation cost
-
-
-
-
-
Device Health Attestation – Cloud
(DHA-Cloud)
-
DHA-Cloud is a Microsoft owned and operated DHA-Service that is:
-
-
Available in Windows for free
-
Running on a high-availability and geo-balanced cloud infrastructure
-
Supported by most DHA-Enabled device management solutions as the default device attestation service provider
-
Accessible to all enterprise-managed devices via following:
-
-
FQDN = has.spserv.microsoft.com) port
-
Port = 443
-
Protocol = TCP
-
-
-
-
No cost
-
-
-
-
Device Health Attestation – On Premise
(DHA-OnPrem)
-
DHA-OnPrem refers to DHA-Service that is running on premises:
-
-
Offered to Windows Server 2016 customer (no added licensing cost for enabling/running DHA-Service)
-
Hosted on an enterprise owned and managed server device/hardware
-
Supported by 1st and 3rd party DHA-Enabled device management solution providers that support on-premises and hybrid (Cloud + OnPrem) hardware attestation scenarios
-
Accessible to all enterprise-managed devices via following:
-
-
FQDN = (enterprise assigned)
-
Port = (enterprise assigned)
-
Protocol = TCP
-
-
-
-
The operation cost of running one or more instances of Server 2016 on-premises.
-
-
-
Device Health Attestation - Enterprise-Managed Cloud
(DHA-EMC)
-
DHA-EMC refers to an enterprise-managed DHA-Service that is running as a virtual host/service on a Windows Server 2016 compatible - enterprise-managed cloud service, such as Microsoft Azure.
-
-
Offered to Windows Server 2016 customers with no additional licensing cost (no added licensing cost for enabling/running DHA-Service)
-
Supported by 1st and 3rd party DHA-Enabled device management solution providers that support on-premises and hybrid (Cloud + OnPrem) hardware attestation scenarios
-
Accessible to all enterprise-managed devices via following:
-
-
FQDN = (enterprise assigned)
-
Port = (enterprise assigned)
-
Protocol = TCP
-
-
-
-
The operation cost of running Server 2016 on a compatible cloud service, such as Microsoft Azure.
-
-
-
+ DHA-Enabled device management solutions enable enterprise IT managers to raise the security protection bar for their managed devices based on hardware (TPM) protected data that can be trusted even if a device is compromised by advanced security threats or running a malicious (jailbroken) operating system.
+
+ The following list of operations is performed by DHA-Enabled-MDM
+
+ - Enables the DHA feature on a DHA-Enabled device
+ - Issues device health attestation requests to enrolled/managed devices
+ - Collects device health attestation data (DHA-Data), and sends it to Device Health Attestation Service (DHA-Service) for verification
+ - Gets the device health report (DHA-Report) from DHA-Service, which triggers compliance action
+
+- **DHA-CSP (Device HealthAttestation Configuration Service Provider)**: The Device HealthAttestation Configuration Service Provider (DHA-CSP) uses a device’s TPM and firmware to measure critical security properties of the device’s BIOS and Windows boot, such that even on a system infected with kernel level malware or a rootkit, these properties cannot be spoofed.
+
+ The following list of operations is performed by DHA-CSP:
+
+ - Collects device boot data (DHA-BootData) from a managed device
+ - Forwards DHA-BootData to Device Health Attestation Service (DHA-Service)
+ - Receives an encrypted blob (DHA-EncBlob) from DHA-Service, and stores it in a local cache on the device
+ - Receives attestation requests (DHA-Requests) from a DHA-Enabled MDM, and replies with Device Health Attestation data (DHA-Data)
+
+- **DHA-Service (Device HealthAttestation Service)**: Device HealthAttestation Service (DHA-Service) validates the data it receives from DHA-CSP and issues a highly trusted hardware (TPM) protected report (DHA-Report) to DHA-Enabled device management solutions through a tamper resistant and tamper evident communication channel.
+
+ DHA-Service is available in two flavors: “DHA-Cloud” and “DHA-Server2016”. DHA-Service supports various implementation scenarios including cloud, on premises, air-gapped, and hybrid scenarios.
+
+ The following list of operations is performed by DHA-Service:
+
+ - Receives device boot data (DHA-BootData) from a DHA-Enabled device
+ - Forwards DHA-BootData to Device Health Attestation Service (DHA-Service)
+ - Receives an encrypted blob (DHA-EncBlob) from DHA-Service, and stores it in a local cache on the device
+ - Receives attestation requests (DHA-Requests) from a DHA-Enabled-MDM, and replies with a device health report (DHA-Report)
+
+
+
+|DHA-Service type|Description|Operation cost|
+|--- |--- |--- |
+|Device Health Attestation – Cloud (DHA-Cloud)|DHA-Cloud is a Microsoft owned and operated DHA-Service that is:
Available in Windows for free
Running on a high-availability and geo-balanced cloud infrastructure
Supported by most DHA-Enabled device management solutions as the default device attestation service provider
Accessible to all enterprise-managed devices via following:
FQDN = has.spserv.microsoft.com port
Port = 443
Protocol = TCP|No cost
|
+|Device Health Attestation – On Premise(DHA-OnPrem)|DHA-OnPrem refers to DHA-Service that is running on premises:
Offered to Windows Server 2016 customer (no added licensing cost for enabling/running DHA-Service)
Hosted on an enterprise owned and managed server device/hardware
Supported by 1st and 3rd party DHA-Enabled device management solution providers that support on-premises and hybrid (Cloud + OnPrem) hardware attestation scenarios
Accessible to all enterprise-managed devices via following:
FQDN = (enterprise assigned)
Port = (enterprise assigned)
Protocol = TCP|The operation cost of running one or more instances of Server 2016 on-premises.
|
+|Device Health Attestation - Enterprise-Managed Cloud(DHA-EMC)|DHA-EMC refers to an enterprise-managed DHA-Service that is running as a virtual host/service on a Windows Server 2016 compatible - enterprise-managed cloud service, such as Microsoft Azure.
Offered to Windows Server 2016 customers with no additional licensing cost (no added licensing cost for enabling/running DHA-Service)
Supported by 1st and 3rd party DHA-Enabled device management solution providers that support on-premises and hybrid (Cloud + OnPrem) hardware attestation scenarios
Accessible to all enterprise-managed devices via following:
FQDN = (enterprise assigned)
Port = (enterprise assigned)
Protocol = TCP|The operation cost of running Server 2016 on a compatible cloud service, such as Microsoft Azure.
|
### CSP diagram and node descriptions
-
-The following shows the Device HealthAttestation configuration service provider in tree format.
-```
+The following shows the Device HealthAttestation configuration service provider in tree format.
+
+```console
./Vendor/MSFT
HealthAttestation
----VerifyHealth
@@ -637,20 +557,24 @@ HealthAttestation
----PreferredMaxProtocolVersion
----MaxSupportedProtocolVersion
```
+
**./Vendor/MSFT/HealthAttestation**
-
The root node for the device HealthAttestation configuration service provider.
+
+The root node for the device HealthAttestation configuration service provider.
**VerifyHealth** (Required)
-
Notifies the device to prepare a device health verification request.
-
The supported operation is Execute.
+Notifies the device to prepare a device health verification request.
+
+The supported operation is Execute.
**Status** (Required)
-
Provides the current status of the device health request.
-
The supported operation is Get.
+Provides the current status of the device health request.
-
+The supported operation is Get.
+
+The following list shows some examples of supported values. For the complete list of status, see Device HealthAttestation CSP status and error codes.
- 0 - (HEALTHATTESTATION\_CERT\_RETRIEVAL_UNINITIALIZED): DHA-CSP is preparing a request to get a new DHA-EncBlob from DHA-Service
- 1 - (HEALTHATTESTATION\_CERT\_RETRIEVAL_REQUESTED): DHA-CSP is waiting for the DHA-Service to respond back, and issue a DHA-EncBlob to the device
@@ -658,42 +582,47 @@ HealthAttestation
- 3 - (HEALTHATTESTATION\_CERT\_RETRIEVAL_COMPLETE): DHA-Data is ready for pickup
**ForceRetrieve** (Optional)
-
Instructs the client to initiate a new request to DHA-Service, and get a new DHA-EncBlob (a summary of the boot state that is issued by DHA-Service). This option should only be used if the MDM server enforces a certificate freshness policy, which needs to force a device to get a fresh encrypted blob from DHA-Service.
-
Boolean value. The supported operation is Replace.
+Instructs the client to initiate a new request to DHA-Service, and get a new DHA-EncBlob (a summary of the boot state that is issued by DHA-Service). This option should only be used if the MDM server enforces a certificate freshness policy, which needs to force a device to get a fresh encrypted blob from DHA-Service.
+
+Boolean value. The supported operation is Replace.
**Certificate** (Required)
-
Instructs the DHA-CSP to forward DHA-Data to the MDM server.
-
Value type is b64. The supported operation is Get.
+Instructs the DHA-CSP to forward DHA-Data to the MDM server.
+
+Value type is b64. The supported operation is Get.
**Nonce** (Required)
-
Enables MDMs to protect the device health attestation communications from man-in-the-middle type (MITM) attacks with a crypt-protected random value that is generated by the MDM Server.
-
The nonce is in hex format, with a minimum size of 8 bytes, and a maximum size of 32 bytes.
+Enables MDMs to protect the device health attestation communications from man-in-the-middle type (MITM) attacks with a crypt-protected random value that is generated by the MDM Server.
-
The supported operations are Get and Replace.
+The nonce is in hex format, with a minimum size of 8 bytes, and a maximum size of 32 bytes.
+
+The supported operations are Get and Replace.
**CorrelationId** (Required)
-
Identifies a unique device health attestation session. CorrelationId is used to correlate DHA-Service logs with the MDM server events and Client event logs for debug and troubleshooting.
-
Value type is integer, the minimum value is - 2,147,483,648 and the maximum value is 2,147,483,647. The supported operation is Get.
+Identifies a unique device health attestation session. CorrelationId is used to correlate DHA-Service logs with the MDM server events and Client event logs for debug and troubleshooting.
+
+Value type is integer, the minimum value is - 2,147,483,648 and the maximum value is 2,147,483,647. The supported operation is Get.
**HASEndpoint** (Optional)
-
Identifies the fully qualified domain name (FQDN) of the DHA-Service that is assigned to perform attestation. If an FQDN is not assigned, DHA-Cloud (Microsoft owned and operated cloud service) will be used as the default attestation service.
-
Value type is string. The supported operations are Get and Replace. The default value is has.spserv.microsoft.com.
+Identifies the fully qualified domain name (FQDN) of the DHA-Service that is assigned to perform attestation. If an FQDN is not assigned, DHA-Cloud (Microsoft owned and operated cloud service) will be used as the default attestation service.
+
+Value type is string. The supported operations are Get and Replace. The default value is has.spserv.microsoft.com.
**TpmReadyStatus** (Required)
-
Added in Windows 10, version 1607 March service release. Returns a bitmask of information describing the state of TPM. It indicates whether the TPM of the device is in a ready and trusted state.
-
Value type is integer. The supported operation is Get.
-### **DHA-CSP integration steps**
+Added in Windows 10, version 1607 March service release. Returns a bitmask of information describing the state of TPM. It indicates whether the TPM of the device is in a ready and trusted state.
+Value type is integer. The supported operation is Get.
+
+### DHA-CSP integration steps
The following list of validation and development tasks are required for integrating the Microsoft Device Health Attestation feature with a Windows Mobile device management solution (MDM):
-
1. [Verify HTTPS access](#verify-access)
2. [Assign an enterprise trusted DHA-Service](#assign-trusted-dha-service)
3. [Instruct client to prepare DHA-data for verification](#prepare-health-data)
@@ -705,14 +634,13 @@ The following list of validation and development tasks are required for integrat
Each step is described in detail in the following sections of this topic.
-### **Step 1: Verify HTTPS access**
-
+### Step 1: Verify HTTPS access
Validate that both the MDM server and the device (MDM client) can access has.spserv.microsoft.com using the TCP protocol over port 443 (HTTPS).
You can use OpenSSL to validate access to DHA-Service. Here is a sample OpenSSL command and the response that was generated by DHA-Service:
-``` syntax
+```console
PS C:\openssl> ./openssl.exe s_client -connect has.spserv.microsoft.com:443
CONNECTED(000001A8)
---
@@ -757,8 +685,7 @@ SSL-Session:
Verify return code: 20 (unable to get local issuer certificate)
```
-
-### **Step 2: Assign an enterprise trusted DHA-Service**
+### Step 2: Assign an enterprise trusted DHA-Service
There are three types of DHA-Service:
- Device Health Attestation – Cloud (owned and operated by Microsoft)
@@ -783,9 +710,7 @@ The following example shows a sample call that instructs a managed device to com
```
-
-### **Step 3: Instruct client to prepare health data for verification**
-
+### Step 3: Instruct client to prepare health data for verification
Send a SyncML call to start collection of the DHA-Data.
@@ -811,7 +736,7 @@ The following example shows a sample call that triggers collection and verificat
```
-### **Step 4: Take action based on the clients response**
+### Step 4: Take action based on the clients response
After the client receives the health attestation request, it sends a response. The following list describes the responses, along with a recommended action to take.
@@ -839,7 +764,7 @@ Here is a sample alert that is issued by DHA_CSP:
```
- If the response to the status node is not 0, 1 or 3, then troubleshoot the issue. For the complete list of status codes, see [Device HealthAttestation CSP status and error codes](#device-healthattestation-csp-status-and-error-codes).
-### **Step 5: Instruct the client to forward health attestation data for verification**
+### Step 5: Instruct the client to forward health attestation data for verification
Create a call to the **Nonce**, **Certificate** and **CorrelationId** nodes, and pick up an encrypted payload that includes a health certificate and related data from the device.
@@ -876,39 +801,40 @@ Here is an example:
```
-### **Step 6: Forward device health attestation data to DHA-service**
-
+### Step 6: Forward device health attestation data to DHA-service
In response to the request that was sent in the previous step, the MDM client forwards an XML formatted blob (response from ./Vendor/MSFT/HealthAttestation/Certificate node) and a call identifier called CorrelationId (response to ./Vendor/MSFT/HealthAttestation/CorrelationId node).
-When the MDM-Server receives the above data, it must:
+When the MDM-Server receives the above data, it must:
+
- Log the CorrelationId it receives from the device (for future troubleshooting/reference), correlated to the call.
- Decode the XML formatted data blob it receives from the device
- Append the nonce that was generated by MDM service (add the nonce that was forwarded to the device in Step 5) to the XML structure that was forwarded by the device in following format:
-```xml
-
-
- [INT]
- [base64 blob, eg ‘ABc123+/…==’]
- [base64 blob, eg ‘ABc123+/...==’]
-
-
-```
+ ```xml
+
+
+ [INT]
+ [base64 blob, eg ‘ABc123+/…==’]
+ [base64 blob, eg ‘ABc123+/...==’]
+
+
+ ```
+
- Forward (HTTP Post) the XML data struct (including the nonce that was appended in the previous step) to the assigned DHA-Service that runs on:
- - DHA-Cloud (Microsoft owned and operated DHA-Service) scenario: https://has.spserv.microsoft.com/DeviceHealthAttestation/ValidateHealthCertificate/v3
- - DHA-OnPrem or DHA-EMC: https://FullyQualifiedDomainName-FDQN/DeviceHealthAttestation/ValidateHealthCertificate/v3
+
+ - DHA-Cloud (Microsoft owned and operated DHA-Service) scenario: https://has.spserv.microsoft.com/DeviceHealthAttestation/ValidateHealthCertificate/v3
+ - DHA-OnPrem or DHA-EMC: https://FullyQualifiedDomainName-FDQN/DeviceHealthAttestation/ValidateHealthCertificate/v3
-### **Step 7: Receive response from the DHA-service**
+### Step 7: Receive response from the DHA-service
When the Microsoft Device Health Attestation Service receives a request for verification, it performs the following steps:
- Decrypts the encrypted data it receives.
- Validates the data it has received
- Creates a report, and shares the evaluation results to the MDM server via SSL in XML format
-### **Step 8: Take appropriate policy action based on evaluation results**
-
+### Step 8: Take appropriate policy action based on evaluation results
After the MDM server receives the verified data, the information can be used to make policy decisions by evaluating the data. Some possible actions would be:
@@ -948,44 +874,49 @@ The following list of data points is verified by the DHA-Service in DHA-Report v
\* TPM 2.0 only
\*\* Reports if BitLocker was enabled during initial boot.
-\*\*\* The “Hybrid Resume” must be disabled on the device. Reports first-party ELAM “Defender” was loaded during boot.
+\*\*\* The "Hybrid Resume" must be disabled on the device. Reports first-party ELAM "Defender" was loaded during boot.
Each of these are described in further detail in the following sections, along with the recommended actions to take.
**Issued**
-
The date and time DHA-report was evaluated or issued to MDM.
+
+The date and time DHA-report was evaluated or issued to MDM.
**AIKPresent**
-
When an Attestation Identity Key (AIK) is present on a device, it indicates that the device has an endorsement key (EK) certificate. It can be trusted more than a device that doesn’t have an EK certificate.
-
If AIKPresent = True (1), then allow access.
+When an Attestation Identity Key (AIK) is present on a device, it indicates that the device has an endorsement key (EK) certificate. It can be trusted more than a device that doesn’t have an EK certificate.
-
If AIKPresent = False (0), then take one of the following actions that align with your enterprise policies:
+If AIKPresent = True (1), then allow access.
-- Disallow all access
-- Disallow access to HBI assets
-- Allow conditional access based on other data points that are present at evaluation time. For example, other attributes on the health certificate, or a device's past activities and trust history.
-- Take one of the previous actions and additionally place the device in a watch list to monitor the device more closely for potential risks.
+If AIKPresent = False (0), then take one of the following actions that align with your enterprise policies:
+
+- Disallow all access
+- Disallow access to HBI assets
+- Allow conditional access based on other data points that are present at evaluation time. For example, other attributes on the health certificate, or a device's past activities and trust history.
+- Take one of the previous actions and additionally place the device in a watch list to monitor the device more closely for potential risks.
**ResetCount** (Reported only for devices that support TPM 2.0)
-
This attribute reports the number of times a PC device has hibernated or resumed.
+
+This attribute reports the number of times a PC device has hibernated or resumed.
**RestartCount** (Reported only for devices that support TPM 2.0)
-
This attribute reports the number of times a PC device has rebooted
+
+This attribute reports the number of times a PC device has rebooted.
**DEPPolicy**
-
A device can be trusted more if the DEP Policy is enabled on the device.
-
Data Execution Prevention (DEP) Policy defines is a set of hardware and software technologies that perform additional checks on memory to help prevent malicious code from running on a system. Secure boot allows a limited list on x86/amd64 and on ARM NTOS locks it to on.
+A device can be trusted more if the DEP Policy is enabled on the device.
-
DEPPolicy can be disabled or enabled by using the following commands in WMI or a PowerShell script:
+Data Execution Prevention (DEP) Policy defines is a set of hardware and software technologies that perform additional checks on memory to help prevent malicious code from running on a system. Secure boot allows a limited list on x86/amd64 and on ARM NTOS locks it to on.
+
+DEPPolicy can be disabled or enabled by using the following commands in WMI or a PowerShell script:
- To disable DEP, type **bcdedit.exe /set {current} nx AlwaysOff**
- To enable DEP, type **bcdedit.exe /set {current} nx AlwaysOn**
-
If DEPPolicy = 1 (On), then allow access.
+If DEPPolicy = 1 (On), then allow access.
-
If DEPPolicy = 0 (Off), then take one of the following actions that align with your enterprise policies:
+If DEPPolicy = 0 (Off), then take one of the following actions that align with your enterprise policies:
- Disallow all access
- Disallow access to HBI assets
@@ -993,15 +924,16 @@ Each of these are described in further detail in the following sections, along w
- Take one of the previous actions and additionally place the device in a watch list to monitor the device more closely for potential risks.
**BitLockerStatus** (at boot time)
-
When BitLocker is reported "on" at boot time, the device is able to protect data that is stored on the drive from unauthorized access, when the system is turned off or goes to hibernation.
-
Windows BitLocker Drive Encryption, encrypts all data stored on the Windows operating system volume. BitLocker uses the TPM to help protect the Windows operating system and user data and helps to ensure that a computer is not tampered with, even if it is left unattended, lost, or stolen.
+When BitLocker is reported "on" at boot time, the device is able to protect data that is stored on the drive from unauthorized access, when the system is turned off or goes to hibernation.
-
If the computer is equipped with a compatible TPM, BitLocker uses the TPM to lock the encryption keys that protect the data. As a result, the keys cannot be accessed until the TPM has verified the state of the computer.
+Windows BitLocker Drive Encryption, encrypts all data stored on the Windows operating system volume. BitLocker uses the TPM to help protect the Windows operating system and user data and helps to ensure that a computer is not tampered with, even if it is left unattended, lost, or stolen.
-
If BitLockerStatus = 1 (On), then allow access.
+If the computer is equipped with a compatible TPM, BitLocker uses the TPM to lock the encryption keys that protect the data. As a result, the keys cannot be accessed until the TPM has verified the state of the computer.
-
If BitLockerStatus = 0 (Off), then take one of the following actions that align with your enterprise policies:
+If BitLockerStatus = 1 (On), then allow access.
+
+If BitLockerStatus = 0 (Off), then take one of the following actions that align with your enterprise policies:
- Disallow all access
- Disallow access to HBI assets
@@ -1009,11 +941,12 @@ Each of these are described in further detail in the following sections, along w
- Take one of the previous actions and additionally place the device in a watch list to monitor the device more closely for potential risks.
**BootManagerRevListVersion**
-
This attribute indicates the version of the Boot Manager that is running on the device, to allow you to track and manage the security of the boot sequence/environment.
-
If BootManagerRevListVersion = [CurrentVersion], then allow access.
+This attribute indicates the version of the Boot Manager that is running on the device, to allow you to track and manage the security of the boot sequence/environment.
-
If BootManagerRevListVersion != [CurrentVersion], then take one of the following actions that align with your enterprise policies:
+If BootManagerRevListVersion = [CurrentVersion], then allow access.
+
+If BootManagerRevListVersion != [CurrentVersion], then take one of the following actions that align with your enterprise policies:
- Disallow all access
- Disallow access to HBI and MBI assets
@@ -1021,11 +954,12 @@ Each of these are described in further detail in the following sections, along w
- Trigger a corrective action, such as informing the technical support team to contact the owner investigate the issue.
**CodeIntegrityRevListVersion**
-
This attribute indicates the version of the code that is performing integrity checks during the boot sequence. Using this attribute can help you detect if the device is running the latest version of the code that performs integrity checks, or if it is exposed to security risks (revoked) and enforce an appropriate policy action.
-
If CodeIntegrityRevListVersion = [CurrentVersion], then allow access.
+This attribute indicates the version of the code that is performing integrity checks during the boot sequence. Using this attribute can help you detect if the device is running the latest version of the code that performs integrity checks, or if it is exposed to security risks (revoked) and enforce an appropriate policy action.
-
If CodeIntegrityRevListVersion != [CurrentVersion], then take one of the following actions that align with your enterprise policies:
+If CodeIntegrityRevListVersion = [CurrentVersion], then allow access.
+
+If CodeIntegrityRevListVersion != [CurrentVersion], then take one of the following actions that align with your enterprise policies:
- Disallow all access
- Disallow access to HBI and MBI assets
@@ -1033,11 +967,12 @@ Each of these are described in further detail in the following sections, along w
- Trigger a corrective action, such as informing the technical support team to contact the owner investigate the issue.
**SecureBootEnabled**
-
When Secure Boot is enabled the core components used to boot the machine must have correct cryptographic signatures that are trusted by the organization that manufactured the device. The UEFI firmware verifies this before it lets the machine start. If any files have been tampered with, breaking their signature, the system will not boot.
-
If SecureBootEnabled = 1 (True), then allow access.
+When Secure Boot is enabled the core components used to boot the machine must have correct cryptographic signatures that are trusted by the organization that manufactured the device. The UEFI firmware verifies this before it lets the machine start. If any files have been tampered with, breaking their signature, the system will not boot.
-
If SecurebootEnabled = 0 (False), then take one of the following actions that align with your enterprise policies:
+If SecureBootEnabled = 1 (True), then allow access.
+
+If SecurebootEnabled = 0 (False), then take one of the following actions that align with your enterprise policies:
- Disallow all access
- Disallow access to HBI assets
@@ -1045,16 +980,17 @@ Each of these are described in further detail in the following sections, along w
- Take one of the previous actions and additionally place the device in a watch list to monitor the device more closely for potential risks.
**BootDebuggingEnabled**
-
Boot debug-enabled points to a device that is used in development and testing. Devices that are used for test and development typically are less secure: the device may run unstable code, or be configured with fewer security restrictions that is required for testing and development.
-
Boot debugging can be disabled or enabled by using the following commands in WMI or a PowerShell script:
+Boot debug-enabled points to a device that is used in development and testing. Devices that are used for test and development typically are less secure: the device may run unstable code, or be configured with fewer security restrictions that is required for testing and development.
+
+Boot debugging can be disabled or enabled by using the following commands in WMI or a PowerShell script:
- To disable boot debugging, type **bcdedit.exe /set {current} bootdebug off**
- To enable boot debugging, type **bcdedit.exe /set {current} bootdebug on**
-
If BootdebuggingEnabled = 0 (False), then allow access.
+If BootdebuggingEnabled = 0 (False), then allow access.
-
If BootDebuggingEnabled = 1 (True), then take one of the following actions that align with your enterprise policies:
+If BootDebuggingEnabled = 1 (True), then take one of the following actions that align with your enterprise policies:
- Disallow all access
- Disallow access to HBI assets
@@ -1062,11 +998,12 @@ Each of these are described in further detail in the following sections, along w
- Trigger a corrective action, such as enabling VSM using WMI or a PowerShell script.
**OSKernelDebuggingEnabled**
-
OSKernelDebuggingEnabled points to a device that is used in development and testing. Devices that are used for test and development typically are less secure: they may run unstable code, or be configured with fewer security restrictions required for testing and development.
-
If OSKernelDebuggingEnabled = 0 (False), then allow access.
+OSKernelDebuggingEnabled points to a device that is used in development and testing. Devices that are used for test and development typically are less secure: they may run unstable code, or be configured with fewer security restrictions required for testing and development.
-
If OSKernelDebuggingEnabled = 1 (True), then take one of the following actions that align with your enterprise policies:
+If OSKernelDebuggingEnabled = 0 (False), then allow access.
+
+If OSKernelDebuggingEnabled = 1 (True), then take one of the following actions that align with your enterprise policies:
- Disallow all access
- Disallow access to HBI assets
@@ -1074,15 +1011,16 @@ Each of these are described in further detail in the following sections, along w
- Trigger a corrective action, such as informing the technical support team to contact the owner investigate the issue.
**CodeIntegrityEnabled**
-
When code integrity is enabled, code execution is restricted to integrity verified code.
-
Code integrity is a feature that validates the integrity of a driver or system file each time it is loaded into memory. Code integrity detects whether an unsigned driver or system file is being loaded into the kernel, or whether a system file has been modified by malicious software that is being run by a user account with administrator privileges.
+When code integrity is enabled, code execution is restricted to integrity verified code.
-
On x64-based versions of the operating system, kernel-mode drivers must be digitally signed.
+Code integrity is a feature that validates the integrity of a driver or system file each time it is loaded into memory. Code integrity detects whether an unsigned driver or system file is being loaded into the kernel, or whether a system file has been modified by malicious software that is being run by a user account with administrator privileges.
-
If CodeIntegrityEnabled = 1 (True), then allow access.
+On x64-based versions of the operating system, kernel-mode drivers must be digitally signed.
-
If CodeIntegrityEnabled = 0 (False), then take one of the following actions that align with your enterprise policies:
+If CodeIntegrityEnabled = 1 (True), then allow access.
+
+If CodeIntegrityEnabled = 0 (False), then take one of the following actions that align with your enterprise policies:
- Disallow all access
- Disallow access to HBI assets
@@ -1090,16 +1028,17 @@ Each of these are described in further detail in the following sections, along w
- Take one of the previous actions and additionally place the device in a watch list to monitor the device more closely for potential risks.
**TestSigningEnabled**
-
When test signing is enabled, the device does not enforce signature validation during boot, and allows the unsigned drivers (such as unsigned UEFI modules) to load during boot.
-
Test signing can be disabled or enabled by using the following commands in WMI or a PowerShell script:
+When test signing is enabled, the device does not enforce signature validation during boot, and allows the unsigned drivers (such as unsigned UEFI modules) to load during boot.
+
+Test signing can be disabled or enabled by using the following commands in WMI or a PowerShell script:
- To disable boot debugging, type **bcdedit.exe /set {current} testsigning off**
- To enable boot debugging, type **bcdedit.exe /set {current} testsigning on**
-
If TestSigningEnabled = 0 (False), then allow access.
+If TestSigningEnabled = 0 (False), then allow access.
-
If TestSigningEnabled = 1 (True), then take one of the following actions that align with your enterprise policies:
+If TestSigningEnabled = 1 (True), then take one of the following actions that align with your enterprise policies:
- Disallow all access
- Disallow access to HBI and MBI assets
@@ -1107,33 +1046,36 @@ Each of these are described in further detail in the following sections, along w
- Trigger a corrective action, such as enabling test signing using WMI or a PowerShell script.
**SafeMode**
-
Safe mode is a troubleshooting option for Windows that starts your computer in a limited state. Only the basic files and drivers necessary to run Windows are started.
-
If SafeMode = 0 (False), then allow access.
+Safe mode is a troubleshooting option for Windows that starts your computer in a limited state. Only the basic files and drivers necessary to run Windows are started.
-
If SafeMode = 1 (True), then take one of the following actions that align with your enterprise policies:
+If SafeMode = 0 (False), then allow access.
+
+If SafeMode = 1 (True), then take one of the following actions that align with your enterprise policies:
- Disallow all access
- Disallow access to HBI assets
- Trigger a corrective action, such as informing the technical support team to contact the owner investigate the issue.
**WinPE**
-
Windows pre-installation Environment (Windows PE) is a minimal operating system with limited services that is used to prepare a computer for Windows installation, to copy disk images from a network file server, and to initiate Windows Setup.
-
If WinPE = 0 (False), then allow access.
+Windows pre-installation Environment (Windows PE) is a minimal operating system with limited services that is used to prepare a computer for Windows installation, to copy disk images from a network file server, and to initiate Windows Setup.
-
If WinPE = 1 (True), then limit access to remote resources that are required for Windows OS installation.
+If WinPE = 0 (False), then allow access.
+
+If WinPE = 1 (True), then limit access to remote resources that are required for Windows OS installation.
**ELAMDriverLoaded** (Windows Defender)
-
To use this reporting feature, you must disable "Hybrid Resume" on the device. Early launch anti-malware (ELAM) provides protection for the computers in your network when they start up and before third-party drivers initialize.
-
In the current release, this attribute only monitors/reports if a Microsoft first-party ELAM (Windows Defender) was loaded during initial boot.
+To use this reporting feature, you must disable "Hybrid Resume" on the device. Early launch anti-malware (ELAM) provides protection for the computers in your network when they start up and before third-party drivers initialize.
-
If a device is expected to use a third-party antivirus program, ignore the reported state.
+In the current release, this attribute only monitors/reports if a Microsoft first-party ELAM (Windows Defender) was loaded during initial boot.
-
If a device is expected to use Windows Defender and ELAMDriverLoaded = 1 (True), then allow access.
+If a device is expected to use a third-party antivirus program, ignore the reported state.
-
If a device is expected to use Windows Defender and ELAMDriverLoaded = 0 (False), then take one of the following actions that align with your enterprise policies, also accounting for whether it is a desktop or mobile device:
+If a device is expected to use Windows Defender and ELAMDriverLoaded = 1 (True), then allow access.
+
+If a device is expected to use Windows Defender and ELAMDriverLoaded = 0 (False), then take one of the following actions that align with your enterprise policies:
- Disallow all access
- Disallow access to HBI assets
@@ -1141,61 +1083,63 @@ Each of these are described in further detail in the following sections, along w
**Bcdedit.exe /set {current} vsmlaunchtype auto**
-
If ELAMDriverLoaded = 1 (True), then allow access.
+If ELAMDriverLoaded = 1 (True), then allow access.
-
If ELAMDriverLoaded = 0 (False), then take one of the following actions that align with your enterprise policies:
+If ELAMDriverLoaded = 0 (False), then take one of the following actions that align with your enterprise policies:
- Disallow all access
- Disallow access to HBI assets
- Trigger a corrective action, such as informing the technical support team to contact the owner investigate the issue.
**VSMEnabled**
-
Virtual Secure Mode (VSM) is a container that protects high value assets from a compromised kernel. VSM requires about 1 GB of memory – it has enough capability to run the LSA service that is used for all authentication brokering.
-
VSM can be enabled by using the following command in WMI or a PowerShell script:
+Virtual Secure Mode (VSM) is a container that protects high value assets from a compromised kernel. VSM requires about 1 GB of memory – it has enough capability to run the LSA service that is used for all authentication brokering.
-
bcdedit.exe /set {current} vsmlaunchtype auto
+VSM can be enabled by using the following command in WMI or a PowerShell script:
-
If VSMEnabled = 1 (True), then allow access.
-
If VSMEnabled = 0 (False), then take one of the following actions that align with your enterprise policies:
+`bcdedit.exe /set {current} vsmlaunchtype auto`
+
+If VSMEnabled = 1 (True), then allow access.
+If VSMEnabled = 0 (False), then take one of the following actions that align with your enterprise policies:
- Disallow all access
- Disallow access to HBI assets
- Trigger a corrective action, such as informing the technical support team to contact the owner investigate the issue
**PCRHashAlgorithmID**
-
This attribute is an informational attribute that identifies the HASH algorithm that was used by TPM; no compliance action required.
+
+This attribute is an informational attribute that identifies the HASH algorithm that was used by TPM; no compliance action required.
**BootAppSVN**
-
This attribute identifies the security version number of the Boot Application that was loaded during initial boot on the attested device
-
If reported BootAppSVN equals an accepted value, then allow access.
+This attribute identifies the security version number of the Boot Application that was loaded during initial boot on the attested device
-
If reported BootAppSVN does not equal an accepted value, then take one of the following actions that align with your enterprise policies:
+If reported BootAppSVN equals an accepted value, then allow access.
+
+If reported BootAppSVN does not equal an accepted value, then take one of the following actions that align with your enterprise policies:
- Disallow all access
- Direct the device to an enterprise honeypot, to further monitor the device's activities.
**BootManagerSVN**
-
This attribute identifies the security version number of the Boot Manager that was loaded during initial boot on the attested device.
-
If reported BootManagerSVN equals an accepted value, then allow access.
+This attribute identifies the security version number of the Boot Manager that was loaded during initial boot on the attested device.
-
If reported BootManagerSVN does not equal an accepted value, then take one of the following actions that align with your enterprise policies:
+If reported BootManagerSVN equals an accepted value, then allow access.
+
+If reported BootManagerSVN does not equal an accepted value, then take one of the following actions that align with your enterprise policies:
- Disallow all access
- Direct the device to an enterprise honeypot, to further monitor the device's activities.
**TPMVersion**
-
This attribute identifies the version of the TPM that is running on the attested device.
-
TPMVersion node provides to replies "1" and "2":
-
-
1 means TPM specification version 1.2
-
2 means TPM specification version 2.0
-
+This attribute identifies the version of the TPM that is running on the attested device. TPMVersion node provides to replies "1" and "2":
-
Based on the reply you receive from TPMVersion node:
+- 1 means TPM specification version 1.2
+- 2 means TPM specification version 2.0
+
+Based on the reply you receive from TPMVersion node:
- If reported TPMVersion equals an accepted value, then allow access.
- If reported TPMVersion does not equal an accepted value, then take one of the following actions that align with your enterprise policies:
@@ -1203,278 +1147,194 @@ Each of these are described in further detail in the following sections, along w
- Direct the device to an enterprise honeypot, to further monitor the device's activities.
**PCR0**
-
The measurement that is captured in PCR[0] typically represents a consistent view of the Host Platform between boot cycles. It contains a measurement of components that are provided by the host platform manufacturer.
-
Enterprise managers can create an allow list of trusted PCR[0] values, compare the PCR[0] value of the managed devices (the value that is verified and reported by HAS) with the allow list, and then make a trust decision based on the result of the comparison.
+The measurement that is captured in PCR[0] typically represents a consistent view of the Host Platform between boot cycles. It contains a measurement of components that are provided by the host platform manufacturer.
-
If your enterprise does not have a allow list of accepted PCR[0] values, then take no action.
+Enterprise managers can create an allow list of trusted PCR[0] values, compare the PCR[0] value of the managed devices (the value that is verified and reported by HAS) with the allow list, and then make a trust decision based on the result of the comparison.
-
If PCR[0] equals an accepted allow list value, then allow access.
+If your enterprise does not have a allow list of accepted PCR[0] values, then take no action.
-
If PCR[0] does not equal any accepted listed value, then take one of the following actions that align with your enterprise policies:
+If PCR[0] equals an accepted allow list value, then allow access.
+
+If PCR[0] does not equal any accepted listed value, then take one of the following actions that align with your enterprise policies:
- Disallow all access
- Direct the device to an enterprise honeypot, to further monitor the device's activities.
**SBCPHash**
-
SBCPHash is the finger print of the Custom Secure Boot Configuration Policy (SBCP) that was loaded during boot in Windows devices, except PCs.
-
If SBCPHash is not present, or is an accepted allow-listed value, then allow access.
+SBCPHash is the finger print of the Custom Secure Boot Configuration Policy (SBCP) that was loaded during boot in Windows devices, except PCs.
-
If SBCPHash is present in DHA-Report, and is not an allow-listed value, then take one of the following actions that align with your enterprise policies:
+If SBCPHash is not present, or is an accepted allow-listed value, then allow access.
+
+If SBCPHash is present in DHA-Report, and is not an allow-listed value, then take one of the following actions that align with your enterprise policies:
- Disallow all access
- Place the device in a watch list to monitor the device more closely for potential risks.
**CIPolicy**
-
This attribute indicates the Code Integrity policy that is controlling the security of the boot environment.
-
If CIPolicy is not present, or is an accepted allow-listed value, then allow access.
+This attribute indicates the Code Integrity policy that is controlling the security of the boot environment.
-
If CIPolicy is present and is not an allow-listed value, then take one of the following actions that align with your enterprise policies:
+If CIPolicy is not present, or is an accepted allow-listed value, then allow access.
+
+If CIPolicy is present and is not an allow-listed value, then take one of the following actions that align with your enterprise policies:
- Disallow all access
- Place the device in a watch list to monitor the device more closely for potential risks.
**BootRevListInfo**
-
This attribute identifies the Boot Revision List that was loaded during initial boot on the attested device.
-
If reported BootRevListInfo version equals an accepted value, then allow access.
+This attribute identifies the Boot Revision List that was loaded during initial boot on the attested device.
-
If reported BootRevListInfo version does not equal an accepted value, then take one of the following actions that align with your enterprise policies:
+If reported BootRevListInfo version equals an accepted value, then allow access.
+
+If reported BootRevListInfo version does not equal an accepted value, then take one of the following actions that align with your enterprise policies:
- Disallow all access
- Direct the device to an enterprise honeypot, to further monitor the device's activities.
**OSRevListInfo**
-
This attribute identifies the Operating System Revision List that was loaded during initial boot on the attested device.
-
If reported OSRevListInfo version equals an accepted value, then allow access.
+This attribute identifies the Operating System Revision List that was loaded during initial boot on the attested device.
-
If reported OSRevListInfo version does not equal an accepted value, then take one of the following actions that align with your enterprise policies:
+If reported OSRevListInfo version equals an accepted value, then allow access.
+
+If reported OSRevListInfo version does not equal an accepted value, then take one of the following actions that align with your enterprise policies:
- Disallow all access
- Direct the device to an enterprise honeypot, to further monitor the device's activities.
**HealthStatusMismatchFlags**
-
HealthStatusMismatchFlags attribute appears if DHA-Service detects an integrity issue (mismatch) in the DHA-Data it receives from device management solutions, for validation.
-
In case of a detected issue a list of impacted DHA-report elements will be listed under the HealthStatusMismatchFlags attribute.
+HealthStatusMismatchFlags attribute appears if DHA-Service detects an integrity issue (mismatch) in the DHA-Data it receives from device management solutions, for validation.
-### **Device HealthAttestation CSP status and error codes**
+In case of a detected issue a list of impacted DHA-report elements will be listed under the HealthStatusMismatchFlags attribute.
-
-
-
Error code
-
Error name
-
Description
-
-
-
0
-
HEALTHATTESTATION_CERT_RETRIEVAL_UNINITIALIZED
-
This is the initial state for devices that have never participated in a DHA-Session.
-
-
-
1
-
HEALTHATTESTATION_CERT_RETRIEVAL_REQUESTED
-
This state signifies that MDM client’s Exec call on the node VerifyHealth has been triggered and now the OS is trying to retrieve DHA-EncBlob from DHA-Server.
-
-
-
2
-
HEALTHATTESTATION_CERT_RETRIEVAL_FAILED
-
This state signifies that the device failed to retrieve DHA-EncBlob from DHA-Server.
-
-
-
3
-
HEALTHATTESTATION_CERT_RETRIEVAL_COMPLETE
-
This state signifies that the device has successfully retrieved DHA-EncBlob from the DHA-Server.
-
-
-
4
-
HEALTHATTESTATION_CERT_RETRIEVAL_PCR_FAIL
-
Deprecated in Windows 10, version 1607.
-
-
-
5
-
HEALTHATTESTATION_CERT_RETRIEVAL_GETQUOTE_FAIL
-
DHA-CSP failed to get a claim quote.
-
-
-
6
-
HEALTHATTESTATION_CERT_RETRIEVAL_DEVICE_NOT_READY
-
DHA-CSP failed in opening a handle to Microsoft Platform Crypto Provider.
DHA-CSP failed to acquire the PDC activators that are needed for network communication when the device is in Connected standby mode.
-
-
-
0xFFFF
-
HEALTHATTESTATION_CERT_RETRIEVAL_FAILED_UNKNOWN
-
DHA-CSP failed due to an unknown reason, this error is highly unlikely to occur.
-
-
-
400
-
Bad_Request_From_Client
-
DHA-CSP has received a bad (malformed) attestation request.
-
-
-
404
-
Endpoint_Not_Reachable
-
DHA-Service is not reachable by DHA-CSP
-
+### Device HealthAttestation CSP status and error codes
-
+Error code: 0 | Error name: HEALTHATTESTATION_CERT_RETRIEVAL_UNINITIALIZED
+Error description: This is the initial state for devices that have never participated in a DHA-Session.
+
+Error code: 1 | Error name: HEALTHATTESTATION_CERT_RETRIEVAL_REQUESTED
+Error description: This state signifies that MDM client’s Exec call on the node VerifyHealth has been triggered and now the OS is trying to retrieve DHA-EncBlob from DHA-Server.
+
+Error code: 2 | Error name: HEALTHATTESTATION_CERT_RETRIEVAL_FAILED
+Error description: This state signifies that the device failed to retrieve DHA-EncBlob from DHA-Server.
+
+Error code: 3 | Error name: HEALTHATTESTATION_CERT_RETRIEVAL_COMPLETE
+Error description: This state signifies that the device has successfully retrieved DHA-EncBlob from the DHA-Server.
+
+Error code: 4 | Error name: HEALTHATTESTATION_CERT_RETRIEVAL_PCR_FAIL
+Error description: Deprecated in Windows 10, version 1607.
+
+Error code: 5 | Error name: HEALTHATTESTATION_CERT_RETRIEVAL_GETQUOTE_FAIL
+Error description: DHA-CSP failed to get a claim quote.
+
+Error code: 6 | Error name: HEALTHATTESTATION_CERT_RETRIEVAL_DEVICE_NOT_READY
+Error description: DHA-CSP failed in opening a handle to Microsoft Platform Crypto Provider.
+
+Error code: 7 | Error name: HEALTHATTESTATION_CERT_RETRIEVAL_WINDOWS_AIK_FAIL
+Error description: DHA-CSP failed in retrieving Windows AIK
+
+Error code: 8 | Error name: HEALTHATTESTATION_CERT_RETRIEVAL_FROM_WEB_FAIL
+Error description: Deprecated in Windows 10, version 1607.
+
+Error code: 9 | Error name: HEALTHATTESTATION_CERT_RETRIEVAL_INVALID_TPM_VERSION
+Error description: Invalid TPM version (TPM version is not 1.2 or 2.0)
+
+Error code: 10 | Error name: HEALTHATTESTATION_CERT_RETRIEVAL_GETNONCE_FAIL
+Error description: Nonce was not found in the registry.
+
+Error code: 11 | Error name: HEALTHATTESTATION_CERT_RETRIEVAL_GETCORRELATIONID_FAIL
+Error description: Correlation ID was not found in the registry.
+
+Error code: 12 | Error name: HEALTHATTESTATION_CERT_RETRIEVAL_GETCERT_FAIL
+Error description: Deprecated in Windows 10, version 1607.
+
+Error code: 13 | Error name: HEALTHATTESTATION_CERT_RETRIEVAL_GETCLAIM_FAIL
+Error description: Deprecated in Windows 10, version 1607.
+
+Error code: 14 | Error name: HEALTHATTESTATION_CERT_RETRIEVAL_ENCODING_FAIL
+Error description: Failure in Encoding functions. (Extremely unlikely scenario)
+
+Error code: 15 | Error name: HEALTHATTESTATION_CERT_RETRIEVAL_ENDPOINTOVERRIDE_FAIL
+Error description: Deprecated in Windows 10, version 1607.
+
+Error code: 16 | Error name: HEALTHATTESTATION_CERT_RETRIEVAL_FAILED_LOAD_XML
+Error description: DHA-CSP failed to load the payload it received from DHA-Service
+
+Error code: 17 | Error name: HEALTHATTESTATION_CERT_RETRIEVAL_FAILED_CORRUPT_XML
+Error description: DHA-CSP received a corrupted response from DHA-Service.
+
+Error code: 18 | Error name: HEALTHATTESTATION_CERT_RETRIEVAL_FAILED_EMPTY_XML
+Error description: DHA-CSP received an empty response from DHA-Service.
+
+Error code: 19 | Error name: HEALTHATTESTATION_CERT_RETRIEVAL_FAILED_DECRYPT_AES_EK
+Error description: DHA-CSP failed in decrypting the AES key from the EK challenge.
+
+Error code: 20 | Error name: HEALTHATTESTATION_CERT_RETRIEVAL_FAILED_DECRYPT_CERT_AES_EK
+Error description: DHA-CSP failed in decrypting the health cert with the AES key.
+
+Error code: 21 | Error name: HEALTHATTESTATION_CERT_RETRIEVAL_FAILED_EXPORT_AIKPUB
+Error description: DHA-CSP failed in exporting the AIK Public Key.
+
+Error code: 22 | Error name: HEALTHATTESTATION_CERT_RETRIEVAL_FAILED_CREATE_CLAIMAUTHORITYONLY
+Error description: DHA-CSP failed in trying to create a claim with AIK attestation data.
+
+Error code: 23 | Error name: HEALTHATTESTATION_CERT_RETRIEVAL_FAILED_APPEND_AIKPUB
+Error description: DHA-CSP failed in appending the AIK Pub to the request blob.
+
+Error code: 24 | Error name: HEALTHATTESTATION_CERT_RETRIEVAL_FAILED_APPEND_AIKCERT
+Error description: DHA-CSP failed in appending the AIK Cert to the request blob.
+
+Error code: 25 | Error name: HEALTHATTESTATION_CERT_RETRIEVAL_FAILED_INIT_HTTPHANDLE
+Error description: DHA-CSP failed to obtain a Session handle.
+
+Error code: 26 | Error name: HEALTHATTESTATION_CERT_RETRIEVAL_FAILED_GETTARGET_HTTPHANDLE
+Error description: DHA-CSP failed to connect to the DHA-Service.
+
+Error code: 27 | Error name: HEALTHATTESTATION_CERT_RETRIEVAL_FAILED_CREATE_HTTPHAND
+Error description: DHA-CSP failed to create an HTTP request handle.
+
+Error code: 28 | Error name: HEALTHATTESTATION_CERT_RETRIEVAL_FAILED_SET_INTERNETOPTION
+Error description: DHA-CSP failed to set options.
+
+Error code: 29 | Error name: HEALTHATTESTATION_CERT_RETRIEVAL_FAILED_ADD_REQUESTHEADERS
+Error description: DHA-CSP failed to add request headers.
+
+Error code: 30 | Error name: HEALTHATTESTATION_CERT_RETRIEVAL_FAILED_SEND_REQUEST
+Error description: DHA-CSP failed to send the HTTP request.
+
+Error code: 31 | Error name: HEALTHATTESTATION_CERT_RETRIEVAL_FAILED_RECEIVE_RESPONSE
+Error description: DHA-CSP failed to receive a response from the DHA-Service.
+
+Error code: 32 | Error name: HEALTHATTESTATION_CERT_RETRIEVAL_FAILED_QUERY_HEADERS
+Error description: DHA-CSP failed to query headers when trying to get HTTP status code.
+
+Error code: 33 | Error name: HEALTHATTESTATION_CERT_RETRIEVAL_FAILED_EMPTY_RESPONSE
+Error description: DHA-CSP received an empty response from DHA-Service even though HTTP status was OK.
+
+Error code: 34 | Error name: HEALTHATTESTATION_CERT_RETRIEVAL_FAILED_MISSING_RESPONSE
+Error description: DHA-CSP received an empty response along with an HTTP error code from DHA-Service.
+
+Error code: 35 | Error name: HEALTHATTESTATION_CERT_RETRIEVAL_FAILED_IMPERSONATE_USER
+Error description: DHA-CSP failed to impersonate user.
+
+Error code: 36 | Error name: HEALTHATTESTATION_CERT_RETRIEVAL_FAILED_ACQUIRE_PDCNETWORKACTIVATOR
+Error description: DHA-CSP failed to acquire the PDC activators that are needed for network communication when the device is in Connected standby mode.
+
+Error code: 0xFFFF | Error name: HEALTHATTESTATION_CERT_RETRIEVAL_FAILED_UNKNOWN
+Error description: DHA-CSP failed due to an unknown reason, this error is highly unlikely to occur.
+
+Error code: 400 | Error name: Bad_Request_From_Client
+Error description: DHA-CSP has received a bad (malformed) attestation request.
+
+Error code: 404 | Error name: Endpoint_Not_Reachable
+Error description: DHA-Service is not reachable by DHA-CSP
### DHA-Report V3 schema
-
```xml
**Enabled**
-Required. Specifies whether to enable Internet sharing on the device. The default is false.
-
-If this is initially set to false, the feature is turned off and the Internet sharing screen is removed from Settings so that the user cannot access it. Configuration changes or connection sharing state changes will not be possible.
-
-When this is set to true, the Internet sharing screen is added to Settings, though sharing is turned off by default until the user turns it on.
-
-This setting can be provisioned over the air, but it may require a reboot if Settings was open when this was enabled for the first time.
-
-**DedicatedConnections**
-Optional. Specifies the semicolon separated list of Connection Manager cellular connections that Internet sharing will use as the public connections.
-
-By default, any available connection will be used as a public connection. However, this node allows a mobile operator to specify one or more connection names to use as public connections.
-
-Specified connections will be mapped, by policy, to the Internet sharing service. All attempts to enumerate Connection Manager connections for the Internet sharing service will return only the mapped connections.
-
-> **Note** The mapping policy will also include the connection specified in the **TetheringNAIConnection** value as well.
-
-
-
-If the specified connections do not exist, Internet sharing will not start because it will not have any cellular connections available to share
-
-If the Internet sharing service is already in a sharing state, setting this node will not take effect until sharing is stopped and restarted.
-
-**TetheringNAIConnection**
-Optional. Specifies the CDMA TetheringNAI Connection Manager cellular connection that Internet sharing will use as a public connection.
-
-If a CDMA mobile operator requires using a Tethering NAI during Internet sharing, they must use the [CM\_CellularEntries configuration service provider](cm-cellularentries-csp.md) to provision a TetheringNAI connection and then specify the provisioned connection in this node.
-
-Specified connections will be mapped, by policy, to the Internet sharing service. All attempts to enumerate Connection Manager connections for the Internet sharing service will return only the mapped connections.
-
-> **Note** The mapping policy will also include the connections specified in the **DedicatedConnections** as well.
-
-
-
-If the specified connections do not exist, Internet sharing will not start because it will not have any cellular connections available to share
-
-If the Internet sharing service is already in a sharing state, setting this node will not take effect until sharing is stopped and restarted.
-
-**MaxUsers**
-Optional. Specifies the maximum number of simultaneous users that can be connected to a device while in a sharing state. The value must be between 1 and 8 inclusive. The default value is 5.
-
-If the Internet sharing service is already in a sharing state, setting this node will not take effect until sharing is stopped and restarted.
-
-**MaxBluetoothUsers**
-Optional. Specifies the maximum number of simultaneous Bluetooth users that can be connected to a device while sharing over Bluetooth. The value must be between 1 and 7 inclusive. The default value is 7.
-
-**MOHelpNumber**
-Optional. A mobile operator–specified device number that is displayed to the user when the Internet sharing service fails to start. The user interface displays a message informing the user that they can call the specified number for help.
-
-**MOInfoLink**
-Optional. A mobile operator–specified HTTP link that is displayed to the user when Internet sharing is disabled or the device is not entitled. The user interface displays a message informing the user that they can visit the specified link for more information about how to enable the feature.
-
-**MOAppLink**
-Optional. A Windows device application link that points to a preinstalled application, provided by the mobile operator, that will help a user to subscribe to the mobile operator’s Internet sharing service when Internet sharing is not provisioned or entitlement fails. The general format for the link is `app://MOapp`.
-
-**MOHelpMessage**
-Optional. Reference to a localized string, provided by the mobile operator, that is displayed when Internet sharing is not enabled due to entitlement failure. The node takes a language-neutral registry value string, which has the following form:
-
-`@,-`
-
-Where `` is the path to the resource dll that contains the string and `` is the string identifier. For more information on language-neutral string resource registry values, see [Using Registry String Redirection](/windows/win32/intl/using-registry-string-redirection) on MSDN.
-
-> **Note** MOAppLink is required to use the MOHelpMessage setting.
-
-
-
-**EntitlementRequired**
-Optional. Specifies whether the device requires an entitlement check to determine if Internet sharing should be enabled. This node is set to a Boolean value. The default value is **True**.
-
-By default the Internet sharing service will check entitlement every time an attempt is made to enable Internet sharing. Internet sharing should be set to **False** for carrier-unlocked devices.
-
-**EntitlementDll**
-Required if `EntitlementRequired` is set to true. The path to the entitlement DLL used to make entitlement checks that verify that the device is entitled to use the Internet sharing service on a mobile operator’s network. The value is a string that represents a valid file system path to the entitlement DLL. By default, the Internet sharing service fails entitlement checks if this setting is missing or empty. For more information, see [Creating an Entitlement DLL](#creating-entitlement-dll) later in this topic.
-
-**EntitlementInterval**
-Optional. The time interval, in seconds, between entitlement checks. The default value is 86,400 seconds (24 hours).
-
-If a periodic entitlement check fails, Internet sharing is automatically disabled.
-
-**PeerlessTimeout**
-Optional. The time-out period, in minutes, after which Internet sharing should automatically turn off if there are no longer any active clients. This node can be set to any value between 1 and 120 inclusive. A value of 0 is not supported. The default value is 5 minutes.
-
-A reboot may be required before changes to this node take effect.
-
-**PublicConnectionTimeout**
-Optional. The time-out value, in minutes, after which Internet sharing is automatically turned off if a cellular connection is not available. This node can be set to any value between 1 and 60 inclusive. The default value is 20 minutes. A time-out is required, so a value of 0 is not supported.
-
-Changes to this node require a reboot.
-
-**MinWifiKeyLength**
-> **Important** This parm is no longer supported for Windows Phone 8.1. The enforced minimum allowed length of the Wi-Fi key is 8.
-
-
-
-**MinWifiSSIDLength**
-> **Important** This parm is no longer supported for Windows Phone 8.1. The enforced minimum allowed length of the Wi-Fi SSID is 1.
-
-
-
-## Additional requirements for CDMA networks
-
-
-For CDMA networks that use a separate Network Access Identity (NAI) for Internet sharing, a new parm, TetheringNAI, has been added in the [CM\_CellularEntries configuration service provider](cm-cellularentries-csp.md) configuration service provider. The following sample demonstrates how to specify the connection.
-
-```xml
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-```
-
-> **Note** CDMA devices are limited to one active data connection at a time. This means any application or service (such as email or MMS) that is bound to another connection may not work while Internet sharing is turned on.
-
-
-
-## Creating an Entitlement DLL
-
-
-For mobile operator networks that require an entitlement check, the OEM must provide a DLL in the device image that implements a function with the following signature:
-
-`ICS_ENTITLEMENT_RESULT IsEntitled(void);`
-
-The `EntitlementDll` parm of the HotSpot configuration service provider must be set to a string that is the path to this DLL.
-
-The DLL must be code signed in a specific way, see [Sign binaries and packages](/previous-versions/windows/hardware/code-signing/dn789217(v=vs.85)).
-
-During an entitlement check the Internet Sharing service loads the specified DLL and then call the `IsEntitled` function. The function must connect to the server to perform any required validation, then return one of the following **ICS\_ENTITLEMENT\_RESULT** enumeration values.
-
-
-
-
-
-
-
-
-
Value
-
Description
-
-
-
-
-
ENTITLEMENT_SUCCESS
-
The device is allowed to connect to the server.
-
-
-
ENTITLEMENT_FAILED
-
The device is not allowed to connect to the server
-
-
-
ENTITLEMENT_UNAVAILABLE
-
The entitlement check failed because the device could not contact the server or acquire a connection to verify entitlement.
-
-
-
-
-
-
-The definition for the **ICS\_ENTITLEMENT\_RESULT** is in the header file `IcsEntitlementh`, which ships with the Windows Adaptation Kit.
-
-## Related topics
-
-
-[Configuration service provider reference](configuration-service-provider-reference.md)
-
-
-
diff --git a/windows/client-management/mdm/implement-server-side-mobile-application-management.md b/windows/client-management/mdm/implement-server-side-mobile-application-management.md
index 68633b48af..396d3ea018 100644
--- a/windows/client-management/mdm/implement-server-side-mobile-application-management.md
+++ b/windows/client-management/mdm/implement-server-side-mobile-application-management.md
@@ -18,11 +18,11 @@ The Windows version of mobile application management (MAM) is a lightweight solu
## Integration with Azure AD
-MAM on Windows is integrated with Azure Active Directory (Azure AD) identity service. The MAM service supports Azure AD integrated authentication for the user and the device during enrollment and the downloading of MAM policies. MAM integration with Azure AD is similar to mobile device management (MDM) integration. See [Azure Active Directory integration with MDM](azure-active-directory-integration-with-mdm.md).
+MAM on Windows is integrated with Azure Active Directory (Azure AD) identity service. The MAM service supports Azure AD-integrated authentication for the user and the device during enrollment and the downloading of MAM policies. MAM integration with Azure AD is similar to mobile device management (MDM) integration. See [Azure Active Directory integration with MDM](azure-active-directory-integration-with-mdm.md).
-MAM enrollment is integrated with adding a work account flow to a personal device. If both MAM and Azure AD integrated MDM services are provided in an organization, a users’ personal devices will be enrolled to MAM or MDM, depending on the user’s actions. If a user adds their work or school Azure AD account as a secondary account to the machine, their device will be enrolled to MAM. If a user joins their device to Azure AD, it will be enrolled to MDM. In general, a device that has a personal account as its primary account is considered a personal device and should be enrolled to MAM. An Azure AD join, and enrollment to MDM, should be used to manage corporate devices.
+MAM enrollment is integrated with adding a work account flow to a personal device. If both MAM and Azure AD-integrated MDM services are provided in an organization, a users’ personal devices will be enrolled to MAM or MDM, depending on the user’s actions. If a user adds their work or school Azure AD account as a secondary account to the machine, their device will be enrolled to MAM. If a user joins their device to Azure AD, it will be enrolled to MDM. In general, a device that has a personal account as its primary account is considered a personal device and should be enrolled to MAM. An Azure AD join, and enrollment to MDM, should be used to manage corporate devices.
-On personal devices, users can add an Azure AD account as a secondary account to the device while keeping their personal account as primary. Users can add an Azure AD account to the device from a supported Azure AD integrated application, such as the next update of Microsoft Office 365 or Microsoft Office Mobile. Alternatively, users can add an Azure AD account from **Settings > Accounts > Access work or school**.
+On personal devices, users can add an Azure AD account as a secondary account to the device while keeping their personal account as primary. Users can add an Azure AD account to the device from a supported Azure AD-integrated application, such as the next update of Microsoft Office 365 or Microsoft Office Mobile. Alternatively, users can add an Azure AD account from **Settings > Accounts > Access work or school**.
Regular non-admin users can enroll to MAM.
@@ -44,7 +44,7 @@ To make applications WIP-aware, app developers need to include the following dat
MAM enrollment requires integration with Azure AD. The MAM service provider needs to publish the Management MDM app to the Azure AD app gallery. Starting with Azure AD in Windows 10, version 1703, the same cloud-based Management MDM app will support both MDM and MAM enrollments. If you have already published your MDM app, it needs to be updated to include MAM Enrollment and Terms of use URLs. The screenshot below illustrates the management app for an IT admin configuration.
-
+:::image type="content" alt-text="Mobile application management app." source="images/implement-server-side-mobile-application-management.png":::
MAM and MDM services in an organization could be provided by different vendors. Depending on the company configuration, IT admin typically needs to add one or two Azure AD Management apps to configure MAM and MDM policies. For example, if both MAM and MDM are provided by the same vendor, then an IT Admin needs to add one Management app from this vendor that will contain both MAM and MDM policies for the organization. Alternatively, if the MAM and MDM services in an organization are provided by two different vendors, then two Management apps from the two vendors need to be configured for the company in Azure AD: one for MAM and one for MDM. Please note: if the MDM service in an organization is not integrated with Azure AD and uses auto-discovery, only one Management app for MAM needs to be configured.
@@ -129,40 +129,8 @@ If the MAM device is properly configured for MDM enrollment, then the Enroll onl
We have updated Skype for Business to work with MAM. The following table explains Office release channels and release dates for Skype for Business compliance with the MAM feature.
-
Provide pilot users and application compatibility testers the opportunity to test the next Deferred Channel.
-
June 13 2017
-
-
-
-
\ No newline at end of file
+|Update channel|Primary purpose|LOB Tattoo availability|Default update channel for the products|
+|--- |--- |--- |--- |
+|[Current channel](/deployoffice/overview-update-channels#BKMK_CB)|Provide pilot users and application compatibility testers the opportunity to test the next Deferred Channel.|March 9 2017|Visio Pro for Office 365 Project Desktop Client Microsoft 365 Apps for business (the version of Office that comes with some Microsoft 365 plans, such as Business Premium.)|
+|[Deferred channel](/deployoffice/overview-update-channels#BKMK_CBB)|Provide users with new features of Office only a few times a year.|October 10 2017|Microsoft 365 Apps for enterprise|
+|[First release for deferred channel](/deployoffice/overview-update-channels#BKMK_FRCBB)|Provide pilot users and application compatibility testers the opportunity to test the next Deferred Channel.|June 13 2017||
diff --git a/windows/client-management/mdm/index.md b/windows/client-management/mdm/index.md
index bf30b7152c..bf8ff417c4 100644
--- a/windows/client-management/mdm/index.md
+++ b/windows/client-management/mdm/index.md
@@ -10,12 +10,12 @@ ms.topic: article
ms.prod: w10
ms.technology: windows
author: dansimp
+ms.collection: highpri
---
# Mobile device management
-
-Windows 10 and Windows 11 provides an enterprise management solution to help IT pros manage company security policies and business applications, while avoiding compromise of the users’ privacy on their personal devices. A built-in management component can communicate with the management server.
+Windows 10 and Windows 11 provides an enterprise management solution to help IT pros manage company security policies and business applications, while avoiding compromise of the users' privacy on their personal devices. A built-in management component can communicate with the management server.
There are two parts to the Windows management component:
@@ -26,19 +26,18 @@ Third-party MDM servers can manage Windows 10 by using the MDM protocol. The bu
## MDM security baseline
-With Windows 10, version 1809, Microsoft is also releasing a Microsoft MDM security baseline that functions like the Microsoft GP-based security baseline. You can easily integrate this baseline into any MDM to support IT pros’ operational needs, addressing security concerns for modern cloud-managed devices.
-
+With Windows 10, version 1809, Microsoft is also releasing a Microsoft MDM security baseline that functions like the Microsoft GP-based security baseline. You can easily integrate this baseline into any MDM to support IT pros' operational needs, addressing security concerns for modern cloud-managed devices.
The MDM security baseline includes policies that cover the following areas:
-- Microsoft inbox security technology (not deprecated) such as BitLocker, Windows Defender SmartScreen, and DeviceGuard (virtual-based security), ExploitGuard, Defender, and Firewall
+- Microsoft inbox security technology (not deprecated) such as BitLocker, Windows Defender SmartScreen, and Device Guard (virtual-based security), Exploit Guard, Microsoft Defender Antivirus, and Firewall
- Restricting remote access to devices
- Setting credential requirements for passwords and PINs
- Restricting use of legacy technology
- Legacy technology policies that offer alternative solutions with modern technology
- And much more
-For more details about the MDM policies defined in the MDM security baseline and what Microsoft’s recommended baseline policy values are, see:
+For more details about the MDM policies defined in the MDM security baseline and what Microsoft's recommended baseline policy values are, see:
- [MDM Security baseline for Windows 11](https://download.microsoft.com/download/2/C/4/2C418EC7-31E0-4A74-8928-6DCD512F9A46/Windows11-MDM-SecurityBaseLine-Document.zip)
- [MDM Security baseline for Windows 10, version 2004](https://download.microsoft.com/download/2/C/4/2C418EC7-31E0-4A74-8928-6DCD512F9A46/2004-MDM-SecurityBaseLine-Document.zip)
@@ -83,6 +82,3 @@ When an organization wants to move to MDM to manage devices, they should prepare
- [WMI providers supported in Windows 10](wmi-providers-supported-in-windows.md)
- [Using PowerShell scripting with the WMI Bridge Provider](using-powershell-scripting-with-the-wmi-bridge-provider.md)
- [MDM Bridge WMI Provider](/windows/win32/dmwmibridgeprov/mdm-bridge-wmi-provider-portal)
-
-
-
diff --git a/windows/client-management/mdm/management-tool-for-windows-store-for-business.md b/windows/client-management/mdm/management-tool-for-windows-store-for-business.md
index f2da07d4e2..408691f2ed 100644
--- a/windows/client-management/mdm/management-tool-for-windows-store-for-business.md
+++ b/windows/client-management/mdm/management-tool-for-windows-store-for-business.md
@@ -11,7 +11,7 @@ ms.author: dansimp
ms.topic: article
ms.prod: w10
ms.technology: windows
-author: manikadhiman
+author: dansimp
ms.date: 10/27/2017
---
@@ -21,63 +21,52 @@ The Microsoft Store for Business has a new web service designed for the enterpri
Here's the list of the available capabilities:
-- Support for enterprise identities – Enables end users within an organization to use the identity that has been provided to them within the organization. This enables an organization to retain control of the application and eliminates the need for an organization to maintain another set of identities for their users.
+- Support for enterprise identities – Enables end users within an organization to use the identity that has been provided to them within the organization. This feature enables an organization to keep control of the application and eliminates the need for an organization to maintain another set of identities for their users.
- Bulk acquisition support of applications – Enables an IT administrator to acquire applications in bulk. IT departments can now take control over the procurement and distribution of applications. Previously, users acquire applications manually.
-- License reclaim and re-use – Enables an enterprise to retain value in their purchases by allowing the ability to un-assign access to an application, and then reassign the application to another user. In Microsoft Store today, when a user with a Microsoft account leaves the organization he retains ownership of the application.
-- Flexible distribution models for Microsoft Store apps – Allows the enterprise to integrate with an organization's infrastructure the processes to distribute applications to devices that are connected to Store for Business services and to devices without connectivity to the Store for Business services.
-- Custom Line of Business app support –Enables management and distribution of enterprise applications through the Store for Business.
-- Support for Windows desktop and mobile devices - The Store for Business supports both desktop and mobile devices.
+- License reclaim and reuse – Enables an enterprise to keep value in their purchases by allowing the ability to unassign access to an application, and then reassign the application to another user. In Microsoft Store today, when a user with a Microsoft account leaves the organization, they keep ownership of the application.
+- Flexible distribution models for Microsoft Store apps – Allows enterprises to integrate with an organization's infrastructure. It also allows the processes to distribute applications to devices that are connected to Store for Business services and to devices without connectivity to the Store for Business services.
+- Custom Line of Business app support – Enables management and distribution of enterprise applications through the Store for Business.
+- Support for Windows client devices - The Store for Business supports client devices.
-For additional information about Store for Business, see the TechNet topics in [Microsoft Store for Business](/microsoft-store/).
+For more information, see [Microsoft Store for Business and Education](/microsoft-store/).
## Management services
-The Store for Business provides services that enable a management tool to synchronize new and updated applications on behalf of an organization. Once synchronized, you can distribute new and updated applications using the Windows Management framework. The services provides several capabilities including providing application data, the ability to assign and reclaim applications, and the ability to download offline-licensed application packages.
+The Store for Business provides services that enable a management tool to synchronize new and updated applications for an organization. Once synchronized, you can distribute new and updated applications using the Windows Management framework. The services provide several features, including providing application data, can assign and reclaim applications, and can download offline-licensed application packages.
-
-
-
-
-
-
-
-
Application data
-
The Store for Business service provides metadata for the applications that have been acquired via the Store for Business. This includes the application identifier that is used to deploy online license applications, artwork for an application that is used to create a company portal, and localized descriptions for applications.
-
-
-
Licensing models
-
Offline vs. Online
-
Online-licensed applications require connectivity to the Microsoft Store. Users require an Azure Active Directory identity and rely on the store services on the device to be able to acquire an application from the store. It is similar to how applications are acquired from the Microsoft Store using a Microsoft account. Assigning or reclaiming seats for an application require a call to the Store for Business services.
-
Offline-licensed applications enable an organization to use the application for imaging and for devices that may not have connectivity to the store or may not have Azure Active Directory. Offline-licensed application do not require connectivity to the store, however it can be updated directly from the store if the device has connectivity and the app update policies allow updates to be distributed via the store.
-
-
-
+- **Application data**: The Store for Business service provides metadata for the applications that have been acquired via the Store for Business. This metadata includes:
+ - The application identifier that's used to deploy online license applications
+ - Artwork for an application that's used to create a company portal
+ - Localized descriptions for applications
-
+- **Licensing models**:
+
+ - **Online-licensed** applications require connectivity to the Microsoft Store. Users require an Azure Active Directory identity, and rely on the store services on the device to get an application from the store. It's similar to how applications are acquired from the Microsoft Store using a Microsoft account. Assigning or reclaiming seats for an application require a call to the Store for Business services.
+ - **Offline-licensed** applications enable an organization to use the application for imaging and for devices that may not have connectivity to the store or may not have Azure Active Directory. Offline-licensed applications don't require connectivity to the store. It can be updated directly from the store if the device has connectivity, and the app update policies allow updates to be distributed using the store.
### Offline-licensed application distribution
-The following diagram provides an overview of app distribution from acquisition of an offline-licensed application to distribution to a client. Once synchronized from the Store for Business, the management tool can use the Windows management framework to distribute applications to devices.
+The following diagram is an overview of app distribution, from getting an offline-licensed application to distributing to clients. Once synchronized from the Store for Business, the management tool can use the Windows management framework to distribute applications to devices.
### Online-licensed application distribution
-The following diagram provides an overview of app distribution from acquisition of an online-licensed application to distribution to a client. Once synchronized from the Store for Business, the management tool can use the Windows management framework to distribute applications to devices. For online-licensed applications, the management tool calls back into the Store for Business management services to assign an application prior to issuing the policy to install the application.
+The following diagram is an overview of app distribution, from getting an online-licensed application to distributing to clients. Once synchronized from the Store for Business, the management tool can use the Windows management framework to distribute applications to devices. For online-licensed applications, the management tool calls back into the Store for Business management services to assign an application before issuing the policy to install the application.
## Integrate with Azure Active Directory
-The Store for Business services rely on Azure Active Directory for authentication. The management tool must be registered as an Azure AD application within an organization tenant to authenticate against the Store for Business.
+The Store for Business services use Azure Active Directory for authentication. The management tool must be registered as an Azure AD application within an organization tenant to authenticate against the Store for Business.
-To learn more about Azure AD and how to register your application within Azure AD, here are some topics to get you started:
+The following articles have more information about Azure AD, and how to register your application within Azure AD:
- Adding an application to Azure Active Directory - [Azure Active Directory integration with MDM](azure-active-directory-integration-with-mdm.md)
- Accessing other Web applications and configuring your application to access other APIs - [Integrating Applications with Azure Active Directory](/azure/active-directory/develop/quickstart-register-app)
- Authenticating to the Store for Business services via Azure AD - [Authentication Scenarios for Azure Active Directory](/azure/active-directory/develop/authentication-vs-authorization)
-For code samples, see [Microsoft Azure Active Directory Samples and Documentation](https://go.microsoft.com/fwlink/p/?LinkId=623024) in GitHub. Patterns are very similar to [Daemon-DotNet](https://go.microsoft.com/fwlink/p/?LinkId=623025) and [ConsoleApp-GraphAPI-DotNet](https://go.microsoft.com/fwlink/p/?LinkId=623026).
+For code samples, see [Microsoft Azure Active Directory Samples and Documentation](https://go.microsoft.com/fwlink/p/?LinkId=623024) in GitHub. Patterns are similar to [Daemon-DotNet](https://go.microsoft.com/fwlink/p/?LinkId=623025) and [ConsoleApp-GraphAPI-DotNet](https://go.microsoft.com/fwlink/p/?LinkId=623026).
## Configure your Azure AD application
@@ -89,12 +78,10 @@ MTS requires calls to be authenticated using an Azure AD OAuth bearer token. The
Here are the details for requesting an authorization token:
-- Login Authority = https://login.windows.net/\
-- Resource/audience\* = https://onestore.microsoft.com
-- ClientId = your AAD application client id
-- ClientSecret = your AAD application client secret/key
-
-\* The token audience URI is meant as an identifier of the application for which the token is being generated, and it is not a URL for a service endpoint or a web-page.
+- Login Authority = `https://login.windows.net/`
+- Resource/audience = `https://onestore.microsoft.com`: The token audience URI is an application identifier for which the token is being generated. It's not a URL for a service endpoint or a web page.
+- ClientId = your Azure AD application client ID
+- ClientSecret = your Azure AD application client secret/key
## Using the management tool
diff --git a/windows/client-management/mdm/maps-csp.md b/windows/client-management/mdm/maps-csp.md
deleted file mode 100644
index 2fa6bccaa3..0000000000
--- a/windows/client-management/mdm/maps-csp.md
+++ /dev/null
@@ -1,175 +0,0 @@
----
-title: Maps CSP
-description: The Maps configuration service provider (CSP) is used to configure the maps to download to the device. This CSP was added in Windows 10, version 1511.
-ms.assetid: E5157296-7C31-4B08-8877-15304C9F6F26
-ms.reviewer:
-manager: dansimp
-ms.author: dansimp
-ms.topic: article
-ms.prod: w10
-ms.technology: windows
-author: manikadhiman
-ms.date: 06/26/2017
----
-
-# Maps CSP
-
-
-The Maps configuration service provider (CSP) is used to configure the maps to download to the device. This CSP was added in Windows 10, version 1511.
-
-> **Note** The Maps CSP is only supported in Windows 10 Mobile.
-
-
-
-The following shows the Maps configuration service provider in tree format.
-```
-./Vendor/MSFT
-Maps
-----Packages
---------Package
-------------Status
-```
-**Maps**
-Root node.
-
-**Packages**
-Represents the map packages installed on the device.
-
-**Packages/***Package*
-A GUID that represents a map package. When you add a *Package* node, Windows adds it to the queue for download to the device. See the table below for the list of various maps and corresponding GUIDS.
-
-**Packages/*Package*/Status**
-Represents the stat of the package installed on the device.
-
-Valid values:
-
-- 1 - the specified map package is queued for download.
-- 2 - the specified map package is downloading or installed.
-
-Supported operation is Get. If the map is neither queued, downloading, or installed, then you will get a 404 from a Get request.
-
-## Examples
-
-
-Here is a list of GUIDs of the most downloaded reqions.
-
-| Region | GUID |
-|-------------------------------|--------------------------------------|
-| **Germany** | |
-| Baden-Wuerttemberg | bab02b93-31c4-413a-b0fe-95a43e186d8c |
-| Bavaria | dceea482-12e9-458e-9f0f-21def9a70ed7 |
-| Berlin/Brandenburg | d8a80d64-07ef-4145-82e5-97910f1012df |
-| Hesse | b28e2071-678b-4671-8eff-97e1c124f2fb |
-| Lower Saxony/Bremen | e3ac0f21-7209-4f42-93bf-a0d12c7df2e5 |
-| Mecklenburg-Western Pomerania | 75760c3d-e651-4b4a-abfb-c22e2bf1ed93 |
-| North Rhine-Westphalia | 3846905a-891e-46a9-bc6a-53ec43edcab0 |
-| Rhineland-Palatinate/Saarland | b4c18bb5-1bfe-4da8-a951-833046e37c90 |
-| Saxony | 8899e1a8-fc79-4f3a-a591-85f15dfb1adb |
-| Saxony-Anhalt | fdd9a3eb-4253-4c4b-b34d-66265775518d |
-| Schleswig-Holstein/Hamburg | 74d868dd-99a7-492f-93ee-2b9c0a6b7ebc |
-| Thuringia | 399a3387-a545-4249-9925-04660426ef1c |
-| **United Kingdom** | |
-| England | bf612bb8-4094-4158-ac06-96171fa7ffdf |
-| Northern Ireland | 07f1d10f-cd72-4801-912a-7ba75ef5a627 |
-| Scotland | cade44ea-4421-4023-9498-bf1f92025c9e |
-| Wales | 869f9131-e3c7-41df-b106-9d787c633a10 |
-| **USA** | |
-| Alabama | 4fdaabf4-0160-4075-b7ad-7a8a71e69e7e |
-| Alaska | f691e35f-a6b9-4d6c-b657-0f092d5f2f0e |
-| Arizona | 4a179b8e-c993-4c4b-a242-51f69068d73b |
-| Arkansas | 4d152d48-92aa-4696-b8b2-c0bbacd421b6 |
-| California | 1859bd60-854a-40e3-9216-6e9cf1fcfdce |
-| Colorado | d7b4de3d-370c-44dc-8dc7-dcafe676d5ff |
-| Connecticut | 47fbdbe0-6c4d-4966-9a02-8decc94a5a1c |
-| Delaware | b2882156-e75c-4bdf-8f9f-45cbfac6b915 |
-| Florida | 1769c37c-f22a-4212-bd4b-47036693b034 |
-| Georgia | ad34ec5d-d84c-42fa-bec1-fe6143d2e68d |
-| Hawaii | 4019c8a1-0d8f-43c6-baa6-7ff5a7888f21 |
-| Idaho | 008d318b-5004-4e13-a4a4-f520e7969026 |
-| Illinois | a2c35505-daf5-432d-a4df-544a5c2987c2 |
-| Indiana | 4c3b6963-e380-45a9-8b25-2bdc4ce1ab26 |
-| Iowa | e07df1bc-01e6-4ffb-9a20-a142a6d38218 |
-| Kansas | 3397467d-3fb9-4ded-b6ad-3ab7313f8ff1 |
-| Kentucky | bc751324-a591-4ecd-b27a-af15b5518051 |
-| Louisiana | d11a119c-9e25-40d9-aef9-ed2f161113b0 |
-| Maine | db5e6077-f4dd-4548-b50e-ebd147d20c37 |
-| Maryland | 17739d09-a70a-4a23-859c-eabc57418d2f |
-| Massachusetts | d168d0d5-7683-45a4-afd4-767fd1359ad8 |
-| Michigan | 0abd961b-9602-4a2e-b093-c43a2a80aab5 |
-| Minnesota | 2946ed46-b171-4e38-9278-e33a6967f143 |
-| Mississippi | 78a38671-a8e8-48f1-a23b-3576df370437 |
-| Missouri | 5c885acb-5fdc-4305-84f1-e18d3163724b |
-| Montana | baf84353-89cf-4abd-9226-b932fd2294a4 |
-| Nebraska | e389c2f8-41a0-4121-a654-77c52fbd61ed |
-| Nevada | 8c321bdc-8e37-4be6-96e0-1d85c77c89f0 |
-| New Hampshire | 38c35895-98ce-4ee4-bb47-7291b5e8543a |
-| New Jersey | 70b1d647-ff93-415f-b2be-da06ee800516 |
-| New Mexico | b434ea36-03ca-405c-8332-044b602e7b49 |
-| New York | 93f2ba61-e03d-4b30-9be3-6e10728302d4 |
-| North Carolina | d07208ed-50da-42f2-bade-cb26f283e113 |
-| North Dakota | 8c6f0ebb-f282-431e-b4be-8faca5f12be0 |
-| Ohio | 36553594-8197-497f-911e-f1cd976c2e00 |
-| Oklahoma | 4e3a77ff-9dca-4add-93e9-2a9d6bc244a6 |
-| Oregon | cf99c8ce-1b11-4972-9e12-f8c2717ade98 |
-| Pennsylvania | cb7c0dea-1f9d-41ae-b81c-e683488d260c |
-| Rhode Island | 737c2fca-efd3-4f5a-9359-0c301ecc0813 |
-| South Carolina | c0a5542f-5efb-49ae-9d80-3914faa4cf77 |
-| South Dakota | dbd8268b-7502-4f71-ba1c-2d452d496b18 |
-| Tennessee | b51f7ae4-9eac-4a2b-b605-c2f9736b3481 |
-| Texas | 4cc26a23-596f-4164-b9c2-ce0267b1ada7 |
-| Utah | 50b2e947-e7b3-41b2-b595-8446f3f425ca |
-| Vermont | a888d9cc-9f2a-4f18-a00a-15fa860d355d |
-| Virginia | bfb4cce0-8fa5-4e70-a3c7-a69adce17fc9 |
-| Washington | 1734acf4-3f87-47db-aec2-2b24c08f5a60 |
-| Washington D.C. | 271328d6-8409-4975-ba8c-ba44e02fd3e0 |
-| West Virginia | 638b6499-749b-4908-bfe6-1b9dcf5eb675 |
-| Wisconsin | 0b5a98f7-489d-4a07-859b-4e01fe9e1b32 |
-| Wyoming | 360e0c25-a3bb-4e29-939a-3631eae46e9a |
-
-
-
-Here is an example queuing a map package of New York for download.
-
-```xml
-
-
-
- 1
-
-
- ./Vendor/MSFT/Maps/Packages/93f2ba61-e03d-4b30-9be3-6e10728302d4
-
-
-
-
-
-
-```
-
-Here is an example that gets the status of the New York map package on the device.
-
-```xml
-
-
-
- 1
-
-
- ./Vendor/MSFT/Maps/Packages/93f2ba61-e03d-4b30-9be3-6e10728302d4/Status
-
-
-
-
-
-
-```
-
-
-
-
-
-
-
-
-
-
diff --git a/windows/client-management/mdm/maps-ddf-file.md b/windows/client-management/mdm/maps-ddf-file.md
deleted file mode 100644
index 517d02109c..0000000000
--- a/windows/client-management/mdm/maps-ddf-file.md
+++ /dev/null
@@ -1,125 +0,0 @@
----
-title: Maps DDF file
-description: This topic shows the OMA DM device description framework (DDF) for the Maps configuration service provider. This CSP was added in Windows 10, version 1511.
-ms.assetid: EF22DBB6-0578-4FD0-B8A6-19DC03288FAF
-ms.reviewer:
-manager: dansimp
-ms.author: dansimp
-ms.topic: article
-ms.prod: w10
-ms.technology: windows
-author: manikadhiman
-ms.date: 12/05/2017
----
-
-# Maps DDF file
-
-
-This topic shows the OMA DM device description framework (DDF) for the Maps configuration service provider. This CSP was added in Windows 10, version 1511.
-
-Looking for the DDF XML files? See [CSP DDF files download](configuration-service-provider-reference.md#csp-ddf-files-download).
-
-The XML below is the current version for this CSP.
-
-```xml
-
-]>
-
- 1.2
-
- Maps
- ./Vendor/MSFT
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- Packages
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- Package
-
-
-
-
-
- Status
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- text/plain
-
-
-
-
-
-
-
-```
-
-
-
-
-
-
-
-
-
-
diff --git a/windows/client-management/mdm/mdm-enrollment-of-windows-devices.md b/windows/client-management/mdm/mdm-enrollment-of-windows-devices.md
index 6dbe747d92..e475077509 100644
--- a/windows/client-management/mdm/mdm-enrollment-of-windows-devices.md
+++ b/windows/client-management/mdm/mdm-enrollment-of-windows-devices.md
@@ -12,6 +12,7 @@ ms.topic: article
ms.prod: w10
ms.technology: windows
author: dansimp
+ms.collection: highpri
---
# MDM enrollment of Windows 10-based devices
@@ -40,11 +41,11 @@ Joining your device to an Active Directory domain during the out-of-box-experien
1. On the **Who Owns this PC?** page, select **My work or school owns it**.
- 
+ 
2. Next, select **Join a domain**.
- 
+ 
3. You'll see a prompt to set up a local account on the device. Enter your local account details, and then select **Next** to continue.
@@ -56,19 +57,19 @@ To create a local account and connect the device:
1. Launch the Settings app.
- 
+ 
2. Next, select **Accounts**.
- 
+ 
3. Navigate to **Access work or school**.
- 
+ 
4. Select **Connect**.
- 
+ 
5. Under **Alternate actions**, select **Join this device to a local Active Directory domain**.
@@ -101,11 +102,11 @@ To join a domain:
1. Select **My work or school owns it**, then select **Next.**
- 
+ 
2. Select **Join Azure AD**, and then select **Next.**
- 
+ 
3. Type in your Azure AD username. This is the email address you use to log into Microsoft Office 365 and similar services.
@@ -121,23 +122,23 @@ To create a local account and connect the device:
1. Launch the Settings app.
- 
+ 
2. Next, navigate to **Accounts**.
- 
+ 
3. Navigate to **Access work or school**.
- 
+ 
4. Select **Connect**.
- 
+ 
5. Under **Alternate Actions**, selct **Join this device to Azure Active Directory**.
- 
+ 
6. Type in your Azure AD username. This is the email address you use to log into Office 365 and similar services.
@@ -151,7 +152,7 @@ To create a local account and connect the device:
After you reach the end of the flow, your device should be connected to your organization’s Azure AD domain. You may now log out of your current account and sign in using your Azure AD username.
- 
+ 
### Help with connecting to an Azure AD domain
@@ -183,19 +184,19 @@ To create a local account and connect the device:
1. Launch the Settings app, and then select **Accounts** >**Start** > **Settings** > **Accounts**.
- 
+ 
2. Navigate to **Access work or school**.
- 
+ 
3. Select **Connect**.
- 
+ 
4. Type in your Azure AD username. This is the email address you use to log into Office 365 and similar services.
- 
+ 
5. If the tenant is a cloud-only, password hash sync, or pass-through authentication tenant, this page changes to show the organization's custom branding, and can enter your password directly into the page. If the tenant is part of a federated domain, you are redirected to the organization's on-premises federation server, such as AD FS, for authentication.
@@ -205,7 +206,7 @@ To create a local account and connect the device:
Starting in Windows 10, version 1709, you will see the status page that shows the progress of your device being set up.
- 
+ 
6. After you complete the flow, your Microsoft account will be connected to your work or school account.
@@ -221,7 +222,7 @@ To create a local account and connect the device:
1. Launch the Settings app.
- 
+ 
2. Next, navigate to **Accounts**.
@@ -233,17 +234,17 @@ To create a local account and connect the device:
4. Select the **Enroll only in device management** link (available in servicing build 14393.82, KB3176934). For older builds, see [Connect your Windows 10-based device to work using a deep link](mdm-enrollment-of-windows-devices.md#connect-your-windows-10-based-device-to-work-using-a-deep-link).
- 
+ 
5. Type in your work email address.
- 
+ 
6. If the device finds an endpoint that only supports on-premises authentication, this page will change and ask you for your password. If the device finds an MDM endpoint that supports federated authentication, you’ll be presented with a new window that will ask you for additional authentication information.
Based on IT policy, you may also be prompted to provide a second factor of authentication at this point. Starting in Windows 10, version 1709, you will see the enrollment progress on screen.
- 
+ 
After you complete the flow, your device will be connected to your organization’s MDM.
@@ -308,13 +309,13 @@ To connect your devices to MDM using deep links:
Type in your work email address.
- 
+ 
3. If the device finds an endpoint that only supports on-premises authentication, this page will change and ask you for your password. If the device finds an MDM endpoint that supports federated authentication, you’ll be presented with a new window that will ask you for additional authentication information. Based on IT policy, you may also be prompted to provide a second factor of authentication at this point.
After you complete the flow, your device will be connected to your organization's MDM.
- 
+ 
## Manage connections
diff --git a/windows/client-management/mdm/messaging-csp.md b/windows/client-management/mdm/messaging-csp.md
index 1e87fad908..b50647fabd 100644
--- a/windows/client-management/mdm/messaging-csp.md
+++ b/windows/client-management/mdm/messaging-csp.md
@@ -5,7 +5,7 @@ ms.author: dansimp
ms.topic: article
ms.prod: w10
ms.technology: windows
-author: manikadhiman
+author: dansimp
ms.date: 06/26/2017
ms.reviewer:
manager: dansimp
diff --git a/windows/client-management/mdm/messaging-ddf.md b/windows/client-management/mdm/messaging-ddf.md
index 22207f104b..efdad0e72a 100644
--- a/windows/client-management/mdm/messaging-ddf.md
+++ b/windows/client-management/mdm/messaging-ddf.md
@@ -5,7 +5,7 @@ ms.author: dansimp
ms.topic: article
ms.prod: w10
ms.technology: windows
-author: manikadhiman
+author: dansimp
ms.date: 12/05/2017
ms.reviewer:
manager: dansimp
diff --git a/windows/client-management/mdm/mobile-device-enrollment.md b/windows/client-management/mdm/mobile-device-enrollment.md
index d1ada9afe6..10c37d020b 100644
--- a/windows/client-management/mdm/mobile-device-enrollment.md
+++ b/windows/client-management/mdm/mobile-device-enrollment.md
@@ -8,8 +8,9 @@ ms.author: dansimp
ms.topic: article
ms.prod: w10
ms.technology: windows
-author: manikadhiman
+author: dansimp
ms.date: 08/11/2017
+ms.collection: highpri
---
# Mobile device enrollment
@@ -110,75 +111,49 @@ The enrollment server can decline enrollment messages using the SOAP Fault forma
```
-
-
-
-
-
-
-
-
-
-
-
Namespace
-
Subcode
-
Error
-
Description
-
HRESULT
-
-
-
-
-
s:
-
MessageFormat
-
MENROLL_E_DEVICE_MESSAGE_FORMAT_ERROR
-
Invalid message from the Mobile Device Management (MDM) server.
-
80180001
-
-
-
s:
-
Authentication
-
MENROLL_E_DEVICE_AUTHENTICATION_ERROR
-
The Mobile Device Management (MDM) server failed to authenticate the user. Try again or contact your system administrator.
-
80180002
-
-
-
s:
-
Authorization
-
MENROLL_E_DEVICE_AUTHORIZATION_ERROR
-
The user is not authorized to enroll to Mobile Device Management (MDM). Try again or contact your system administrator.
-
80180003
-
-
-
s:
-
CertificateRequest
-
MENROLL_E_DEVICE_CERTIFICATEREQUEST_ERROR
-
The user has no permission for the certificate template or the certificate authority is unreachable. Try again or contact your system administrator.
-
80180004
-
-
-
s:
-
EnrollmentServer
-
MENROLL_E_DEVICE_CONFIGMGRSERVER_ERROR
-
The Mobile Device Management (MDM) server encountered an error. Try again or contact your system administrator.
-
80180005
-
-
-
a:
-
InternalServiceFault
-
MENROLL_E_DEVICE_INTERNALSERVICE_ERROR
-
There was an unhandled exception on the Mobile Device Management (MDM) server. Try again or contact your system administrator.
-
80180006
-
-
-
a:
-
InvalidSecurity
-
MENROLL_E_DEVICE_INVALIDSECURITY_ERROR
-
The Mobile Device Management (MDM) server was not able to validate your account. Try again or contact your system administrator.
-
80180007
-
-
-
+**Sample error messages**
+
+- **Namespace**: `s:`
+ - **Subcode**: MessageFormat
+ - **Error**: MENROLL_E_DEVICE_MESSAGE_FORMAT_ERROR
+ - **Description**: Invalid message from the Mobile Device Management (MDM) server.
+ - **HRESULT**: 80180001
+
+- **Namespace**: `s:`
+ - **Subcode**: Authentication
+ - **Error**: MENROLL_E_DEVICE_AUTHENTICATION_ERROR
+ - **Description**: The Mobile Device Management (MDM) server failed to authenticate the user. Try again or contact your system administrator.
+ - **HRESULT**: 80180002
+
+- **Namespace**: `s:`
+ - **Subcode**: Authorization
+ - **Error**: MENROLL_E_DEVICE_AUTHORIZATION_ERROR
+ - **Description**: The user is not authorized to enroll to Mobile Device Management (MDM). Try again or contact your system administrator.
+ - **HRESULT**: 80180003
+
+- **Namespace**: `s:`
+ - **Subcode**: CertificateRequest
+ - **Error**: MENROLL_E_DEVICE_CERTIFICATEREQUEST_ERROR
+ - **Description**: The user has no permission for the certificate template or the certificate authority is unreachable. Try again or contact your system administrator.
+ - **HRESULT**: 80180004
+
+- **Namespace**: `s:`
+ - **Subcode**: EnrollmentServer
+ - **Error**: MENROLL_E_DEVICE_CONFIGMGRSERVER_ERROR
+ - **Description**: The Mobile Device Management (MDM) server encountered an error. Try again or contact your system administrator.
+ - **HRESULT**: 80180005
+
+- **Namespace**: `a:`
+ - **Subcode**: InternalServiceFault
+ - **Error**: MENROLL_E_DEVICE_INTERNALSERVICE_ERROR
+ - **Description**: There was an unhandled exception on the Mobile Device Management (MDM) server. Try again or contact your system administrator.
+ - **HRESULT**: 80180006
+
+- **Namespace**: `a:`
+ - **Subcode**: InvalidSecurity
+ - **Error**: MENROLL_E_DEVICE_INVALIDSECURITY_ERROR
+ - **Description**: The Mobile Device Management (MDM) server was not able to validate your account. Try again or contact your system administrator.
+ - **HRESULT**: 80180007
In Windows 10, version 1507, we added the deviceenrollmentserviceerror element. Here is an example:
@@ -212,66 +187,42 @@ In Windows 10, version 1507, we added the deviceenrollmentserviceerror element.
```
-
-
-
-
-
-
-
-
-
-
Subcode
-
Error
-
Description
-
HRESULT
-
-
-
-
-
DeviceCapReached
-
MENROLL_E_DEVICECAPREACHED
-
The account has too many devices enrolled to Mobile Device Management (MDM). Delete or unenroll old devices to fix this error.
-
80180013
-
-
-
DeviceNotSupported
-
MENROLL_E_DEVICENOTSUPPORTED
-
The Mobile Device Management (MDM) server doesn't support this platform or version, consider upgrading your device.
-
80180014
-
-
-
NotSupported
-
MENROLL_E_NOT_SUPPORTED
-
Mobile Device Management (MDM) is generally not supported for this device.
-
80180015
-
-
-
NotEligibleToRenew
-
MENROLL_E_NOTELIGIBLETORENEW
-
The device is attempting to renew the Mobile Device Management (MDM) certificate, but the server rejected the request. Check renew schedule on the device.
-
80180016
-
-
-
InMaintenance
-
MENROLL_E_INMAINTENANCE
-
The Mobile Device Management (MDM) server states your account is in maintenance, try again later.
-
80180017
-
-
-
UserLicense
-
MENROLL_E_USER_LICENSE
-
There was an error with your Mobile Device Management (MDM) user license. Contact your system administrator.
-
80180018
-
-
-
InvalidEnrollmentData
-
MENROLL_E_ENROLLMENTDATAINVALID
-
The Mobile Device Management (MDM) server rejected the enrollment data. The server may not be configured correctly.
-
80180019
-
-
-
+**Sample error messages**
+
+- **Subcode**: DeviceCapReached
+ - **Error**: MENROLL_E_DEVICECAPREACHED
+ - **Description**: The account has too many devices enrolled to Mobile Device Management (MDM). Delete or unenroll old devices to fix this error.
+ - **HRESULT**: 80180013
+
+- **Subcode**: DeviceNotSupported
+ - **Error**: MENROLL_E_DEVICENOTSUPPORTED
+ - **Description**: The Mobile Device Management (MDM) server doesn't support this platform or version, consider upgrading your device.
+ - **HRESULT**: 80180014
+
+- **Subcode**: NotSupported
+ - **Error**: MENROLL_E_NOT_SUPPORTED
+ - **Description**: Mobile Device Management (MDM) is generally not supported for this device.
+ - **HRESULT**: 80180015
+
+- **Subcode**: NotEligibleToRenew
+ - **Error**: MENROLL_E_NOTELIGIBLETORENEW
+ - **Description**: The device is attempting to renew the Mobile Device Management (MDM) certificate, but the server rejected the request. Check renew schedule on the device.
+ - **HRESULT**: 80180016
+
+- **Subcode**: InMaintenance
+ - **Error**: MENROLL_E_INMAINTENANCE
+ - **Description**: The Mobile Device Management (MDM) server states your account is in maintenance, try again later.
+ - **HRESULT**: 80180017
+
+- **Subcode**: UserLicense
+ - **Error**: MENROLL_E_USER_LICENSE
+ - **Description**: There was an error with your Mobile Device Management (MDM) user license. Contact your system administrator.
+ - **HRESULT**: 80180018
+
+- **Subcode**: InvalidEnrollmentData
+ - **Error**: MENROLL_E_ENROLLMENTDATAINVALID
+ - **Description**: The Mobile Device Management (MDM) server rejected the enrollment data. The server may not be configured correctly.
+ - **HRESULT**: 80180019
TraceID is a freeform text node which is logged. It should identify the server side state for this enrollment attempt. This information may be used by support to look up why the server declined the enrollment.
@@ -280,4 +231,4 @@ TraceID is a freeform text node which is logged. It should identify the server s
- [MDM enrollment of Windows-based devices](mdm-enrollment-of-windows-devices.md)
- [Federated authentication device enrollment](federated-authentication-device-enrollment.md)
- [Certificate authentication device enrollment](certificate-authentication-device-enrollment.md)
-- [On-premise authentication device enrollment](on-premise-authentication-device-enrollment.md)
\ No newline at end of file
+- [On-premise authentication device enrollment](on-premise-authentication-device-enrollment.md)
diff --git a/windows/client-management/mdm/multisim-csp.md b/windows/client-management/mdm/multisim-csp.md
index 4436e52fc7..aa2284255f 100644
--- a/windows/client-management/mdm/multisim-csp.md
+++ b/windows/client-management/mdm/multisim-csp.md
@@ -5,7 +5,7 @@ ms.author: dansimp
ms.topic: article
ms.prod: w10
ms.technology: windows
-author: manikadhiman
+author: dansimp
ms.date: 03/22/2018
ms.reviewer:
manager: dansimp
diff --git a/windows/client-management/mdm/multisim-ddf.md b/windows/client-management/mdm/multisim-ddf.md
index cd958ba9e2..18b9586283 100644
--- a/windows/client-management/mdm/multisim-ddf.md
+++ b/windows/client-management/mdm/multisim-ddf.md
@@ -5,7 +5,7 @@ ms.author: dansimp
ms.topic: article
ms.prod: w10
ms.technology: windows
-author: manikadhiman
+author: dansimp
ms.date: 02/27/2018
ms.reviewer:
manager: dansimp
diff --git a/windows/client-management/mdm/nap-csp.md b/windows/client-management/mdm/nap-csp.md
index 89d18c8eff..e3edb1b0d1 100644
--- a/windows/client-management/mdm/nap-csp.md
+++ b/windows/client-management/mdm/nap-csp.md
@@ -8,23 +8,22 @@ ms.author: dansimp
ms.topic: article
ms.prod: w10
ms.technology: windows
-author: manikadhiman
+author: dansimp
ms.date: 06/26/2017
---
# NAP CSP
-
The NAP (Network Access Point) Configuration Service Provider is used to manage and query GPRS and CDMA connections.
-> **Note** This configuration service provider requires the ID\_CAP\_CSP\_FOUNDATION and ID\_CAP\_NETWORKING\_ADMIN capabilities to be accessed from a network configuration application.
-
-
+> [!Note]
+> This configuration service provider requires the `ID_CAP_CSP_FOUNDATION` and `ID_CAP_NETWORKING_ADMIN` capabilities to be accessed from a network configuration application.
For the NAP CSP, you cannot use the Replace command unless the node already exists.
The following shows the NAP configuration service provider management object in tree format as used by OMA DM. The OMA Client Provisioning protocol is not supported by this configuration service provider.
-```
+
+```console
./Vendor/MSFT
NAP
----*
@@ -61,6 +60,7 @@ NAP
----------------Secure
----------------SecureLevel
```
+
**./Vendor/MSFT/NAP**
Root node.
@@ -87,34 +87,11 @@ Required. Specifies the type of address used to identify the destination network
The following table shows some commonly used ADDRTYPE values and the types of connection that corresponds with each value.
-
-
-
-
-
-
-
-
ADDRTYPE Value
-
Connection Type
-
-
-
-
-
E164
-
RAS connections
-
-
-
APN
-
GPRS connections
-
-
-
ALPHA
-
Wi-Fi-based connections
-
-
-
-
-
+|ADDRTYPE Value|Connection Type|
+|--- |--- |
+|E164|RAS connections|
+|APN|GPRS connections|
+|ALPHA|Wi-Fi-based connections|
***NAPX*/AuthInfo**
Optional node. Specifies the authentication information, including the protocol, user name, and password.
@@ -136,17 +113,7 @@ Node.
***NAPX*/Bearer/BearerType**
Required. Specifies the network type of the destination network. This can be set to GPRS, CDMA2000, WCDMA, TDMA, CSD, DTPT, WiFi.
-## Related topics
-
+## Related articles
[Configuration service provider reference](configuration-service-provider-reference.md)
-
-
-
-
-
-
-
-
-
diff --git a/windows/client-management/mdm/napdef-csp.md b/windows/client-management/mdm/napdef-csp.md
index bf9a0bc281..341c72e038 100644
--- a/windows/client-management/mdm/napdef-csp.md
+++ b/windows/client-management/mdm/napdef-csp.md
@@ -8,22 +8,18 @@ ms.author: dansimp
ms.topic: article
ms.prod: w10
ms.technology: windows
-author: manikadhiman
+author: dansimp
ms.date: 06/26/2017
---
# NAPDEF CSP
-
The NAPDEF configuration service provider is used to add, modify, or delete WAP network access points (NAPs). For complete information about these settings, see the standard WAP specification WAP-183-ProvCont-20010724-a.
-> **Note** You cannot use NAPDEF CSP on the desktop to update the Push Proxy Gateway (PPG) list.
+> [!Note]
+> You cannot use NAPDEF CSP on the desktop to update the Push Proxy Gateway (PPG) list.
>
->
->
-> **Note** This configuration service provider requires the ID\_CAP\_CSP\_FOUNDATION and ID\_CAP\_NETWORKING\_ADMIN capabilities to be accessed from a network configuration application.
-
-
+> This configuration service provider requires the `ID_CAP_CSP_FOUNDATION` and `ID_CAP_NETWORKING_ADMIN` capabilities to be accessed from a network configuration application.
The following shows the NAPDEF configuration service provider management object in tree format as used by OMA Client Provisioning for **initial bootstrapping of the phone**. The OMA DM protocol is not supported by this configuration service provider.
@@ -77,9 +73,8 @@ Specifies the protocol used to authenticate the user.
The only permitted values for this element are "POP" (Password Authentication Protocol) and "CHAP" (Challenge Handshake Authentication Protocol) authentication protocols. Note
-> **Note** **AuthName** and **AuthSecret** are not created if **AuthType** is not included in the initial device configuration. **AuthName** and **AuthSecret** cannot be changed if **AuthType** is not included in the provisioning XML used to make the change.
-
-
+> [!Note]
+> **AuthName** and **AuthSecret** are not created if **AuthType** is not included in the initial device configuration. **AuthName** and **AuthSecret** cannot be changed if **AuthType** is not included in the provisioning XML used to make the change.
**BEARER**
Specifies the type of bearer.
@@ -124,54 +119,15 @@ The name of the *NAPID* element is the same as the value passed during initial b
## Microsoft Custom Elements
-
The following table shows the Microsoft custom elements that this configuration service provider supports for OMA Client Provisioning.
-
-
-
-
-
-
-
-
Elements
-
Available
-
-
-
-
-
Parm-query
-
Yes
-
Note that some GPRS parameters will not necessarily contain the exact same value as was set.
-
-
-
Noparm
-
Yes
-
-
-
Nocharacteristic
-
Yes
-
-
-
Characteristic-query
-
Yes
-
-
-
-
-
-
-## Related topics
+|Elements|Available|
+|--- |--- |
+|Parm-query|Yes Note that some GPRS parameters will not necessarily contain the exact same value as was set.|
+|Noparm|Yes|
+|Nocharacteristic|Yes|
+|Characteristic-query|Yes|
+## Related articles
[Configuration service provider reference](configuration-service-provider-reference.md)
-
-
-
-
-
-
-
-
-
-
diff --git a/windows/client-management/mdm/networkproxy-csp.md b/windows/client-management/mdm/networkproxy-csp.md
index 4fa1f6289f..743fe416fa 100644
--- a/windows/client-management/mdm/networkproxy-csp.md
+++ b/windows/client-management/mdm/networkproxy-csp.md
@@ -5,7 +5,7 @@ ms.author: dansimp
ms.topic: article
ms.prod: w10
ms.technology: windows
-author: manikadhiman
+author: dansimp
ms.date: 08/29/2018
ms.reviewer:
manager: dansimp
@@ -15,21 +15,16 @@ manager: dansimp
The NetworkProxy configuration service provider (CSP) is used to configure a proxy server for ethernet and Wi-Fi connections. These settings do not apply to VPN connections. This CSP was added in Windows 10, version 1703.
-> [!NOTE]
-> In Windows 10 Mobile, the NetworkProxy CSP only works in ethernet connections. Use the WiFi CSP to configure per-network proxy for Wi-Fi connections in mobile devices.
-
How the settings work:
-
-
If auto-detect is enabled, the system tries to find the path to a proxy auto config (PAC) script and download it.
-
If #1 fails and a setup script is specified, the system tries to download the explicitly configured PAC script.
-
If #2 fails and a proxy server is specified, the system tries to use the explicitly configured proxy server.
-
Otherwise, the system tries to reach the site directly.
-
-
+- If auto-detect is enabled, the system tries to find the path to a proxy auto config (PAC) script and download it.
+- If #1 fails and a setup script is specified, the system tries to download the explicitly configured PAC script.
+- If #2 fails and a proxy server is specified, the system tries to use the explicitly configured proxy server.
+- Otherwise, the system tries to reach the site directly.
The following shows the NetworkProxy configuration service provider in tree format.
-```
+
+```console
./Vendor/MSFT
NetworkProxy
----ProxySettingsPerUser
@@ -40,8 +35,9 @@ NetworkProxy
--------Exceptions
--------UseProxyForLocalAddresses
```
+
**./Vendor/MSFT/NetworkProxy**
-The root node for the NetworkProxy configuration service provider..
+The root node for the NetworkProxy configuration service provider.
**ProxySettingsPerUser**
Added in Windows 10, version 1803. When set to 0, it enables proxy configuration as global, machine wide.
@@ -55,10 +51,9 @@ Supported operations are Add, Get, Replace, and Delete.
Automatically detect settings. If enabled, the system tries to find the path to a PAC script.
Valid values:
-
-
0 - Disabled
-
1 (default) - Enabled
-
+
+- 0 - Disabled
+- 1 (default) - Enabled
The data type is integer. Supported operations are Get and Replace. Starting in Windows 10, version 1803, the Delete operation is also supported.
@@ -84,17 +79,18 @@ The data type is string. Supported operations are Get and Replace. Starting in W
**UseProxyForLocalAddresses**
Specifies whether the proxy server should be used for local (intranet) addresses.
+
Valid values:
-
-
0 (default) - Use proxy server for local addresses
-
1 - Do not use proxy server for local addresses
-
+
+- 0 (default) - Use proxy server for local addresses
+- 1 - Do not use proxy server for local addresses
The data type is integer. Supported operations are Get and Replace. Starting in Windows 10, version 1803, the Delete operation is also supported.
## Configuration Example
These generic code portions for the options **ProxySettingsPerUser**, **Autodetect**, and **SetupScriptURL** can be used for a specific operation, for example Replace. Only enter the portion of code needed in the **Replace** section.
+
```xml
1
diff --git a/windows/client-management/mdm/networkproxy-ddf.md b/windows/client-management/mdm/networkproxy-ddf.md
index 226b6ca0ba..2b5f2798f2 100644
--- a/windows/client-management/mdm/networkproxy-ddf.md
+++ b/windows/client-management/mdm/networkproxy-ddf.md
@@ -5,7 +5,7 @@ ms.author: dansimp
ms.topic: article
ms.prod: w10
ms.technology: windows
-author: manikadhiman
+author: dansimp
ms.date: 12/05/2017
ms.reviewer:
manager: dansimp
diff --git a/windows/client-management/mdm/networkqospolicy-csp.md b/windows/client-management/mdm/networkqospolicy-csp.md
index 19462512ee..464a920e6d 100644
--- a/windows/client-management/mdm/networkqospolicy-csp.md
+++ b/windows/client-management/mdm/networkqospolicy-csp.md
@@ -5,7 +5,7 @@ ms.author: dansimp
ms.topic: article
ms.prod: w10
ms.technology: windows
-author: manikadhiman
+author: dansimp
ms.date: 04/22/2021
ms.reviewer:
manager: dansimp
@@ -29,7 +29,7 @@ The following actions are supported:
> - Azure AD Hybrid joined devices.
> - Devices that use both GPO and CSP at the same time.
>
-> The minimum operating system requirement for this CSP is Windows 10, version 2004. This CSP is supported only in Microsoft Surface Hub prior to Window 10, version 2004.
+> The minimum operating system requirement for this CSP is Windows 10, version 2004. This CSP is supported only in Microsoft Surface Hub prior to Windows 10, version 2004.
The following shows the NetworkQoSPolicy configuration service provider in tree format.
```
diff --git a/windows/client-management/mdm/networkqospolicy-ddf.md b/windows/client-management/mdm/networkqospolicy-ddf.md
index c2d3ea4a5e..379f5051ca 100644
--- a/windows/client-management/mdm/networkqospolicy-ddf.md
+++ b/windows/client-management/mdm/networkqospolicy-ddf.md
@@ -8,7 +8,7 @@ ms.author: dansimp
ms.topic: article
ms.prod: w10
ms.technology: windows
-author: manikadhiman
+author: dansimp
ms.date: 12/05/2017
---
diff --git a/windows/client-management/mdm/new-in-windows-mdm-enrollment-management.md b/windows/client-management/mdm/new-in-windows-mdm-enrollment-management.md
index c21357f4a9..a982810497 100644
--- a/windows/client-management/mdm/new-in-windows-mdm-enrollment-management.md
+++ b/windows/client-management/mdm/new-in-windows-mdm-enrollment-management.md
@@ -11,7 +11,7 @@ ms.author: dansimp
ms.topic: article
ms.prod: w10
ms.technology: windows
-author: manikadhiman
+author: dansimp
ms.localizationpriority: medium
ms.date: 10/20/2020
---
diff --git a/windows/client-management/mdm/nodecache-csp.md b/windows/client-management/mdm/nodecache-csp.md
index ff47aa238d..4ac44047b0 100644
--- a/windows/client-management/mdm/nodecache-csp.md
+++ b/windows/client-management/mdm/nodecache-csp.md
@@ -8,7 +8,7 @@ ms.author: dansimp
ms.topic: article
ms.prod: w10
ms.technology: windows
-author: manikadhiman
+author: dansimp
ms.date: 06/26/2017
---
diff --git a/windows/client-management/mdm/nodecache-ddf-file.md b/windows/client-management/mdm/nodecache-ddf-file.md
index 06a74f2979..0e15800f30 100644
--- a/windows/client-management/mdm/nodecache-ddf-file.md
+++ b/windows/client-management/mdm/nodecache-ddf-file.md
@@ -8,7 +8,7 @@ ms.author: dansimp
ms.topic: article
ms.prod: w10
ms.technology: windows
-author: manikadhiman
+author: dansimp
ms.date: 12/05/2017
---
diff --git a/windows/client-management/mdm/office-csp.md b/windows/client-management/mdm/office-csp.md
index 7516e3c411..79204c2935 100644
--- a/windows/client-management/mdm/office-csp.md
+++ b/windows/client-management/mdm/office-csp.md
@@ -5,7 +5,7 @@ ms.author: dansimp
ms.topic: article
ms.prod: w10
ms.technology: windows
-author: manikadhiman
+author: dansimp
ms.date: 08/15/2018
ms.reviewer:
manager: dansimp
@@ -18,10 +18,11 @@ The Office configuration service provider (CSP) enables a Microsoft Office clien
This CSP was added in Windows 10, version 1703.
-For additional information, see [Office DDF](office-ddf.md).
+For more information, see [Office DDF](office-ddf.md).
The following shows the Office configuration service provider in tree format.
-```
+
+```console
./Vendor/MSFT
Office
----Installation
@@ -46,6 +47,7 @@ Office
------------Install
------------Status
```
+
**./Device/Vendor/MSFT/Office/ or ./User/Vendor/MSFT/Office**
The root node for the Office configuration service provider.
@@ -78,7 +80,7 @@ Behavior:
- When Office CSP is triggered to install, it will first check if the FinalStatus node exists or not. If the node exists, delete it.
- When Office installation reaches any terminal states (either success or failure), this node is created that contains the following values:
- When status = 0: 70 (succeeded)
- - When status != 0: 60 (failed)
+ - When status!= 0: 60 (failed)
**Installation/CurrentStatus**
Returns an XML of current Office 365 installation status on the device.
@@ -151,140 +153,22 @@ To get the current status of Office 365 on the device.
## Status code
-
-
-
-
-
-
-
-
-
-
Status
-
Description
-
Comment
-
-
-
-
-
0
-
Installation succeeded
-
OK
-
-
-
997
-
Installation in progress
-
-
-
-
13
-
ERROR_INVALID_DATA
-
Cannot verify signature of the downloaded Office Deployment Tool (ODT)
-
Failure
-
-
-
1460
-
ERROR_TIMEOUT
-
Failed to download ODT
-
Failure
-
-
-
1602
-
ERROR_INSTALL_USEREXIT
-
User cancelled the installation
-
Failure
-
-
-
1603
-
ERROR_INSTALL_FAILURE
-
Failed any pre-req check.
-
-
SxS (Tried to install when 2016 MSI is installed)
-
Bit mismatch between the currently installed Office and the Office that was attempting to be installed (such as when you try to install a 32-bit version while 64-bit version is currently installed.)
-
-
-
Failure
-
-
-
17000
-
ERROR_PROCESSPOOL_INITIALIZATION
-
Failed to start C2RClient
-
Failure
-
-
-
17001
-
ERROR_QUEUE_SCENARIO
-
Failed to queue installation scenario in C2RClient
-
Failure
-
-
-
17002
-
ERROR_COMPLETING_SCENARIO
-
Failed to complete the process. Possible reasons:
-
-
Installation cancelled by user
-
Installation cancelled by another installation
-
Out of disk space during installation
-
Unknown language ID
-
-
Failure
-
-
-
17003
-
ERROR_ANOTHER_RUNNING_SCENARIO
-
Another scenario is running
-
Failure
-
-
-
17004
-
ERROR_COMPLETING_SCENARIO_NEED_CLEAN_UP
-
Possible reasons:
-
-
Unknown SKUs
-
Content does't exist on CDN
-
such as trying to install an unsupported LAP, like zh-sg
-
CDN issue that content is not available
-
-
Signature check issue, such as failed the signature check for Office content
-
User cancelled
-
-
-
Failure
-
-
-
17005
-
ERROR_SCENARIO_CANCELLED_AS_PLANNED
-
Failure
-
-
-
17006
-
ERROR_SCENARIO_CANCELLED
-
Blocked update by running apps
-
Failure
-
-
-
17007
-
ERROR_REMOVE_INSTALLATION_NEEDED
-
The client is requesting client clean up in a "Remove Installation" scenario
-
Failure
-
-
-
17100
-
ERROR_HANDLING_COMMAND_LINE
-
C2RClient command line error
-
Failure
-
-
-
0x80004005
-
E_FAIL
-
ODT cannot be used to install Volume license
-
Failure
-
-
-
0x8000ffff
-
E_UNEXPECTED
-
Tried to uninstall when there is no C2R Office on the machine.
-
Failure
-
-
-
\ No newline at end of file
+|Status|Description|Comment|
+|--- |--- |--- |
+|0|Installation succeeded|OK|
+|997|Installation in progress||
+|13|ERROR_INVALID_DATA Cannot verify signature of the downloaded Office Deployment Tool (ODT)|Failure|
+|1460|ERROR_TIMEOUT Failed to download ODT|Failure|
+|1602|ERROR_INSTALL_USEREXIT User canceled the installation|Failure|
+|1603|ERROR_INSTALL_FAILURE Failed any pre-req check.
SxS (Tried to install when 2016 MSI is installed)
Bit mismatch between the currently installed Office and the Office that was attempting to be installed (such as when you try to install a 32-bit version while 64-bit version is currently installed.)|Failure|
+|17000|ERROR_PROCESSPOOL_INITIALIZATION Failed to start C2RClient|Failure|
+|17001|ERROR_QUEUE_SCENARIO Failed to queue installation scenario in C2RClient|Failure|
+|17002|ERROR_COMPLETING_SCENARIO Failed to complete the process. Possible reasons:
Installation canceled by user
Installation canceled by another installation
Out of disk space during installation
Unknown language ID|Failure|
+|17003|ERROR_ANOTHER_RUNNING_SCENARIO Another scenario is running|Failure|
+|17004|ERROR_COMPLETING_SCENARIO_NEED_CLEAN_UP Possible reasons:
Unknown SKUs
Content does't exist on CDN
Such as trying to install an unsupported LAP, like zh-sg
CDN issue that content is not available
Signature check issue, such as failed the signature check for Office content
User canceled|Failure|
+|17005|ERROR_SCENARIO_CANCELLED_AS_PLANNED|Failure|
+|17006|ERROR_SCENARIO_CANCELLED Blocked update by running apps|Failure|
+|17007|ERROR_REMOVE_INSTALLATION_NEEDED The client is requesting client clean-up in a "Remove Installation" scenario|Failure|
+|17100|ERROR_HANDLING_COMMAND_LINE C2RClient command-line error|Failure|
+|0x80004005|E_FAIL ODT cannot be used to install Volume license|Failure|
+|0x8000ffff|E_UNEXPECTED Tried to uninstall when there is no C2R Office on the machine.|Failure|
diff --git a/windows/client-management/mdm/office-ddf.md b/windows/client-management/mdm/office-ddf.md
index 88e2b4dee5..dedda7070e 100644
--- a/windows/client-management/mdm/office-ddf.md
+++ b/windows/client-management/mdm/office-ddf.md
@@ -8,7 +8,7 @@ ms.author: dansimp
ms.topic: article
ms.prod: w10
ms.technology: windows
-author: manikadhiman
+author: dansimp
ms.date: 08/15/2018
---
diff --git a/windows/client-management/mdm/oma-dm-protocol-support.md b/windows/client-management/mdm/oma-dm-protocol-support.md
index 5e8ad6957f..8249c0eca9 100644
--- a/windows/client-management/mdm/oma-dm-protocol-support.md
+++ b/windows/client-management/mdm/oma-dm-protocol-support.md
@@ -8,7 +8,7 @@ ms.author: dansimp
ms.topic: article
ms.prod: w10
ms.technology: windows
-author: manikadhiman
+author: dansimp
ms.date: 06/26/2017
---
@@ -17,131 +17,21 @@ ms.date: 06/26/2017
The OMA DM client communicates with the server over HTTPS and uses DM Sync (OMA DM v1.2) as the message payload. This topic describes the OMA DM functionality that the DM client supports in general. The full description of the OMA DM protocol v1.2 can be found at the [OMA website](https://www.openmobilealliance.org/release/DM/V1_2-20070209-A/OMA-TS-DM_Protocol-V1_2-20070209-A.pdf).
-
-## In this topic
-
-- [OMA DM standards](#oma-dm-standards)
-
-- [OMA DM protocol common elements](#protocol-common-elements)
-
-- [Device management session](#device-management-session)
-
-- [User targeted vs. Device targeted configuration](#user-targeted-vs-device-targeted-configuration)
-
-- [SyncML response codes](#syncml-response-codes)
-
-
## OMA DM standards
The following table shows the OMA DM standards that Windows uses.
-
-
-
-
-
-
-
-
General area
-
OMA DM standard that is supported
-
-
-
-
-
Data transport and session
-
-
Client-initiated remote HTTPS DM session over SSL.
-
Remote HTTPS DM session over SSL.
-
Remote DM server initiation notification using WAP Push over Short Message Service (SMS). Not used by enterprise management.
-
Remote bootstrap by using WAP Push over SMS. Not used by enterprise management.
-
-
-
-
Bootstrap XML
-
-
OMA Client Provisioning XML.
-
-
-
-
DM protocol commands
-
The following list shows the commands that are used by the device. For further information about the OMA DM command elements, see "SyncML Representation Protocol Device Management Usage (OMA-SyncML-DMRepPro-V1_1_2-20030613-A)" available from the OMA website.
-
-
Add (Implicit Add supported)
-
Alert (DM alert): Generic alert (1226) is used by enterprise management client when the user triggers an MDM unenrollment action from the device or when a CSP finishes some asynchronous actions. Device alert (1224) is used to notify the server some device triggered event.
-
Atomic: Note that performing an Add command followed by Replace on the same node within an atomic element is not supported. Nested Atomic and Get commands are not allowed and will generate error code 500.
-
Delete: Removes a node from the DM tree, and the entire subtree beneath that node if one exists
-
Exec: Invokes an executable on the client device
-
Get: Retrieves data from the client device; for interior nodes, the child node names in the Data element are returned in URI-encoded format
-
Replace: Overwrites data on the client device
-
Result: Returns the data results of a Get command to the DM server
-
Sequence: Specifies the order in which a group of commands must be processed
-
Status: Indicates the completion status (success or failure) of an operation
-
-
If an XML element that is not a valid OMA DM command is under one of the following elements, the status code 400 is returned for that element:
-
-
SyncBody
-
Atomic
-
Sequence
-
-
If no CmdID is provided in the DM command, the client returns blank in the status element and the status code 400.
-
If Atomic elements are nested, the following status codes are returned:
-
-
The nested Atomic command returns 500.
-
The parent Atomic command returns 507.
-
-
For more information about the Atomic command, see OMA DM protocol common elements.
-
Performing an Add command followed by Replace on the same node within an Atomic element is not supported.
-
LocURI cannot start with "/".
-
Meta XML tag in SyncHdr is ignored by the device.
-
-
-
OMA DM standard objects
-
-
DevInfo
-
DevDetail
-
OMA DM DMS account objects (OMA DM version 1.2)
-
-
-
-
Security
-
-
Authenticate DM server initiation notification SMS message (not used by enterprise management)
-
Application layer Basic and MD5 client authentication
-
Authenticate server with MD5 credential at application level
-
Data integrity and authentication with HMAC at application level
-
SSL level certificate based client/server authentication, encryption, and data integrity check
-
-
-
-
Nodes
-
In the OMA DM tree, the following rules apply for the node name:
-
-
"." can be part of the node name.
-
The node name cannot be empty.
-
The node name cannot be only the asterisk (*) character.
If an XML element that is not a valid OMA DM command is under SyncBody, the status code 400 is returned for that element.
-
-Note
To represent a Unicode string as a URI, first encode the string as UTF-8. Then encode each of the UTF-8 bytes using URI encoding.
-
-
-
-
-
-
-
WBXML support
-
Windows supports sending and receiving SyncML in both XML format and encoded WBXML format. This is configurable by using the DEFAULTENCODING node under the w7 APPLICATION characteristic during enrollment. For more information about WBXML encoding, see section 8 of the SyncML Representation Protocol specification.
-
-
-
Handling of large objects
-
In Windows 10, version 1511, client support for uploading large objects to the server was added.
-
-
-
+|General area|OMA DM standard that is supported|
+|--- |--- |
+|Data transport and session|
Client-initiated remote HTTPS DM session over SSL.
Remote HTTPS DM session over SSL.
Remote DM server initiation notification using WAP Push over Short Message Service (SMS). Not used by enterprise management.
Remote bootstrap by using WAP Push over SMS. Not used by enterprise management.|
+|Bootstrap XML|OMA Client Provisioning XML.|
+|DM protocol commands|The following list shows the commands that are used by the device. For more information about the OMA DM command elements, see "[OMA website](https://www.openmobilealliance.org/release/DM/V1_1_2-20031209-A/)" available from the OMA website.
Add (Implicit Add supported)
Alert (DM alert): Generic alert (1226) is used by enterprise management client when the user triggers an MDM unenrollment action from the device or when a CSP finishes some asynchronous actions. Device alert (1224) is used to notify the server some device triggered event.
Atomic: Performing an Add command followed by Replace on the same node within an atomic element is not supported. Nested Atomic and Get commands are not allowed and will generate error code 500.
Delete: Removes a node from the DM tree, and the entire subtree beneath that node if one exists
Exec: Invokes an executable on the client device
Get: Retrieves data from the client device; for interior nodes, the child node names in the Data element are returned in URI-encoded format
Replace: Overwrites data on the client device
Result: Returns the data results of a Get command to the DM server
Sequence: Specifies the order in which a group of commands must be processed
Status: Indicates the completion status (success or failure) of an operation
If an XML element that is not a valid OMA DM command is under one of the following elements, the status code 400 is returned for that element:
SyncBody
Atomic
Sequence
If no CmdID is provided in the DM command, the client returns blank in the status element and the status code 400.
If Atomic elements are nested, the following status codes are returned:
The nested Atomic command returns 500.
The parent Atomic command returns 507.
For more information about the Atomic command, see OMA DM protocol common elements. Performing an Add command followed by Replace on the same node within an Atomic element is not supported.
LocURI cannot start with `/`.
Meta XML tag in SyncHdr is ignored by the device.|
+|OMA DM standard objects|DevInfo
DevDetail
OMA DM DMS account objects (OMA DM version 1.2)|
+|Security|
Authenticate DM server initiation notification SMS message (not used by enterprise management)
Application layer Basic and MD5 client authentication
Authenticate server with MD5 credential at application level
Data integrity and authentication with HMAC at application level
SSL level certificate-based client/server authentication, encryption, and data integrity check|
+|Nodes|In the OMA DM tree, the following rules apply for the node name:
"." can be part of the node name.
The node name cannot be empty.
The node name cannot be only the asterisk (*) character.|
+|Provisioning Files|Provisioning XML must be well formed and follow the definition in SyncML Representation Protocol](https://go.microsoft.com/fwlink/p/?LinkId=526905).
If an XML element that is not a valid OMA DM command is under SyncBody, the status code 400 is returned for that element.
**Note** To represent a Unicode string as a URI, first encode the string as UTF-8. Then encode each of the UTF-8 bytes using URI encoding.
|
+|WBXML support|Windows supports sending and receiving SyncML in both XML format and encoded WBXML format. This is configurable by using the DEFAULTENCODING node under the w7 APPLICATION characteristic during enrollment. For more information about WBXML encoding, see section 8 of the [SyncML Representation Protocol](https://go.microsoft.com/fwlink/p/?LinkId=526905) specification.|
+|Handling of large objects|In Windows 10, version 1511, client support for uploading large objects to the server was added.|
@@ -149,99 +39,26 @@ The following table shows the OMA DM standards that Windows uses.
Common elements are used by other OMA DM element types. The following table lists the OMA DM common elements used to configure the devices. For more information about OMA DM common elements, see "SyncML Representation Protocol Device Management Usage" (OMA-SyncML-DMRepPro-V1_1_2-20030613-A) available from the [OMA website](https://www.openmobilealliance.org/release/DM/V1_1_2-20031209-A/).
-
-
-
-
-
-
-
-
Element
-
Description
-
-
-
-
-
Chal
-
Specifies an authentication challenge. The server or client can send a challenge to the other if no credentials or inadequate credentials were given in the original request message.
-
-
-
Cmd
-
Specifies the name of an OMA DM command referenced in a Status element.
-
-
-
CmdID
-
Specifies the unique identifier for an OMA DM command.
-
-
-
CmdRef
-
Specifies the ID of the command for which status or results information is being returned. This element takes the value of the CmdID element of the corresponding request message.
-
-
-
Cred
-
Specifies the authentication credential for the originator of the message.
-
-
-
Final
-
Indicates that the current message is the last message in the package.
-
-
-
LocName
-
Specifies the display name in the Target and Source elements, used for sending a user ID for MD5 authentication.
-
-
-
LocURI
-
Specifies the address of the target or source location. If the address contains a non-alphanumeric character, it must be properly escaped according to the URL encoding standard.
-
-
-
MsgID
-
Specifies a unique identifier for an OMA DM session message.
-
-
-
MsgRef
-
Specifies the ID of the corresponding request message. This element takes the value of the request message MsgID element.
-
-
-
RespURI
-
Specifies the URI that the recipient must use when sending a response to this message.
-
-
-
SessionID
-
Specifies the identifier of the OMA DM session associated with the containing message.
-
-Note If the server does not notify the device that it supports a new version (through SyncApplicationVersion node in the DMClient CSP), the desktop client returns the SessionID in integer in decimal format and the mobile device client returns 2 bytes as a string. If the server supports DM session sync version 2.0, which is used in Windows 10, the desktop and mobile device client returns 2 bytes.
-
-
-
-
-
-
-
Source
-
Specifies the message source address.
-
-
-
SourceRef
-
Specifies the source of the corresponding request message. This element takes the value of the request message Source element and is returned in the Status or Results element.
-
-
-
Target
-
Specifies the address of the node, in the DM Tree, that is the target of the OMA DM command.
-
-
-
TargetRef
-
Specifies the target address in the corresponding request message. This element takes the value of the request message Target element and is returned in the Status or Results element.
-
-
-
VerDTD
-
Specifies the major and minor version identifier of the OMA DM representation protocol specification used to represent the message.
-
-
-
VerProto
-
Specifies the major and minor version identifier of the OMA DM protocol specification used with the message.
-
-
-
-
+|Element|Description|
+|--- |--- |
+|Chal|Specifies an authentication challenge. The server or client can send a challenge to the other if no credentials or inadequate credentials were given in the original request message.|
+|Cmd|Specifies the name of an OMA DM command referenced in a Status element.|
+|CmdID|Specifies the unique identifier for an OMA DM command.|
+|CmdRef|Specifies the ID of the command for which status or results information is being returned. This element takes the value of the CmdID element of the corresponding request message.|
+|Cred|Specifies the authentication credential for the originator of the message.|
+|Final|Indicates that the current message is the last message in the package.|
+|LocName|Specifies the display name in the Target and Source elements, used for sending a user ID for MD5 authentication.|
+|LocURI|Specifies the address of the target or source location. If the address contains a non-alphanumeric character, it must be properly escaped according to the URL encoding standard.|
+|MsgID|Specifies a unique identifier for an OMA DM session message.|
+|MsgRef|Specifies the ID of the corresponding request message. This element takes the value of the request message MsgID element.|
+|RespURI|Specifies the URI that the recipient must use when sending a response to this message.|
+|SessionID|Specifies the identifier of the OMA DM session associated with the containing message.
**Note** If the server does not notify the device that it supports a new version (through SyncApplicationVersion node in the DMClient CSP), the client returns the SessionID in integer in decimal format. If the server supports DM session sync version 2.0, which is used in Windows 10, the device client returns 2 bytes.
|
+|Source|Specifies the message source address.|
+|SourceRef|Specifies the source of the corresponding request message. This element takes the value of the request message Source element and is returned in the Status or Results element.|
+|Target|Specifies the address of the node, in the DM Tree, that is the target of the OMA DM command.|
+|TargetRef|Specifies the target address in the corresponding request message. This element takes the value of the request message Target element and is returned in the Status or Results element.|
+|VerDTD|Specifies the major and minor version identifier of the OMA DM representation protocol specification used to represent the message.|
+|VerProto|Specifies the major and minor version identifier of the OMA DM protocol specification used with the message.|
## Device management session
@@ -255,56 +72,25 @@ A DM session can be divided into two phases:
1. **Setup phase**: In response to a trigger event, a client device sends an initiating message to a DM server. The device and server exchange needed authentication and device information. This phase is represented by steps 1, 2, and 3 in the following table.
2. **Management phase**: The DM server is in control. It sends management commands to the device and the device responds. Phase two ends when the DM server stops sending commands and terminates the session. This phase is represented by steps 3, 4, and 5 in the following table.
-The following table shows the sequence of events during a typical DM session.
+The following information shows the sequence of events during a typical DM session.
-
-
-
-
-
-
-
-
-
Step
-
Action
-
Description
-
-
-
-
-
1
-
DM client is invoked to call back to the management server
-
Enterprise scenario – The device task schedule invokes the DM client.
-
The MO server sends a server trigger message to invoke the DM client.
-
The trigger message includes the server ID and tells the client device to initiate a session with the server. The client device authenticates the trigger message and verifies that the server is authorized to communicate with it.
-
Enterprise scenario - At the scheduled time, the DM client is invoked periodically to call back to the enterprise management server over HTTPS.
-
-
-
2
-
The device sends a message, over an IP connection, to initiate the session.
-
This message includes device information and credentials. The client and server do mutual authentication over an SSL channel or at the DM application level.
-
-
-
3
-
The DM server responds, over an IP connection (HTTPS).
-
The server sends initial device management commands, if any.
-
-
-
4
-
The device responds to server management commands.
-
This message includes the results of performing the specified device management operations.
-
-
-
5
-
The DM server terminates the session or sends another command.
-
The DM session ends, or Step 4 is repeated.
-
-
-
+1. DM client is invoked to call back to the management server
Enterprise scenario – The device task schedule invokes the DM client.
+ The MO server sends a server trigger message to invoke the DM client.
+ The trigger message includes the server ID and tells the client device to initiate a session with the server. The client device authenticates the trigger message and verifies that the server is authorized to communicate with it.
Enterprise scenario - At the scheduled time, the DM client is invoked periodically to call back to the enterprise management server over HTTPS.
-The step numbers in the table do not represent message identification numbers (MsgID). All messages from the server must have a MsgID that is unique within the session, starting at 1 for the first message, and increasing by an increment of 1 for each additional message. For more information about MsgID and OMA SyncML protocol, see "OMA Device Management Representation Protocol" (DM_RepPro-V1_2-20070209-A) available from the [OMA website](https://www.openmobilealliance.org/release/DM/V1_2-20070209-A/).
+2. The device sends a message, over an IP connection, to initiate the session.
+
+ This message includes device information and credentials. The client and server do mutual authentication over an SSL channel or at the DM application level.
+
+3. The DM server responds, over an IP connection (HTTPS). The server sends initial device management commands, if any.
+
+4. The device responds to server management commands. This message includes the results of performing the specified device management operations.
+
+5. The DM server terminates the session or sends another command. The DM session ends, or Step 4 is repeated.
+
+The step numbers don't represent message identification numbers (MsgID). All messages from the server must have a MsgID that is unique within the session, starting at 1 for the first message, and increasing by an increment of 1 for each extra message. For more information about MsgID and OMA SyncML protocol, see [OMA Device Management Representation Protocol (DM_RepPro-V1_2-20070209-A)](https://www.openmobilealliance.org/release/DM/V1_2-20070209-A/).
During OMA DM application level mutual authentication, if the device response code to Cred element in the server request is 212, no further authentication is needed for the remainder of the DM session. In the case of the MD5 authentication, the Chal element can be returned. Then the next nonce in Chal must be used for the MD5 digest when the next DM session is started.
@@ -319,24 +105,24 @@ For CSPs and policies that support per user configuration, the MDM server can se
The data part of this alert could be one of following strings:
-- user – the user that enrolled the device is actively logged in. The MDM server could send user specific configuration for CSPs/policies that support per user configuration
-- others – another user login but that user does not have an MDM account. The server can only apply device wide configuration, e.g. configuration applies to all users in the device.
-- none – no active user login. The server can only apply device wide configuration and available configuration is restricted to the device environment (no active user login).
+- User – the user that enrolled the device is actively logged in. The MDM server could send user-specific configuration for CSPs/policies that support per user configuration
+- Others – another user login but that user does not have an MDM account. The server can only apply device-wide configuration, for example, configuration applies to all users in the device.
+- None – no active user login. The server can only apply device-wide configuration and available configuration is restricted to the device environment (no active user login).
Below is an alert example:
-```
+```xml
- 1
- 1224
-
-
- com.microsoft/MDM/LoginStatus
- chr
-
- user
-
-
+ 1
+ 1224
+
+
+ com.microsoft/MDM/LoginStatus
+ chr
+
+ user
+
+
```
The server notifies the device whether it is a user targeted or device targeted configuration by a prefix to the management node’s LocURL, with ./user for user targeted configuration, or ./device for device targeted configuration. By default, if no prefix with ./device or ./user, it is device targeted configuration.
@@ -351,37 +137,27 @@ The following LocURL shows a per device CSP node configuration: **./device/vendo
When using SyncML in OMA DM, there are standard response status codes that are returned. The following table lists the common SyncML response status codes you are likely to see. For more information about SyncML response status codes, see section 10 of the [SyncML Representation Protocol](https://openmobilealliance.org/release/Common/V1_2_2-20090724-A/OMA-TS-SyncML-RepPro-V1_2_2-20090724-A.pdf) specification.
-| Status code | Description |
-|-------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
-| 200 | The SyncML command completed successfully. |
-| 202 | Accepted for processing. This is usually an asynchronous operation, such as a request to run a remote execution of an application. |
+| Status code | Description |
+|---|----|
+| 200 | The SyncML command completed successfully. |
+| 202 | Accepted for processing. This is usually an asynchronous operation, such as a request to run a remote execution of an application. |
| 212 | Authentication accepted. Normally you'll only see this in response to the SyncHdr element (used for authentication in the OMA-DM standard). You may see this if you look at OMA DM logs, but CSPs do not typically generate this. |
-| 214 | Operation cancelled. The SyncML command completed successfully, but no more commands will be processed within the session. |
-| 215 | Not executed. A command was not executed as a result of user interaction to cancel the command. |
-| 216 | `Atomic` roll back OK. A command was inside an `Atomic` element and `Atomic` failed. This command was rolled back successfully. |
-| 400 | Bad request. The requested command could not be performed because of malformed syntax. CSPs do not usually generate this error, however you might see it if your SyncML is malformed. |
-| 401 | Invalid credentials. The requested command failed because the requestor must provide proper authentication. CSPs do not usually generate this error. |
-| 403 | Forbidden. The requested command failed, but the recipient understood the requested command. |
-| 404 | Not found. The requested target was not found. This code will be generated if you query a node that does not exist. |
-| 405 | Command not allowed. This respond code will be generated if you try to write to a read-only node. |
-| 406 | Optional feature not supported. This response code will be generated if you try to access a property that the CSP doesn't support. |
-| 415 | Unsupported type or format. This response code can result from XML parsing or formatting errors. |
-| 418 | Already exists. This response code occurs if you attempt to add a node that already exists. |
-| 425 | Permission Denied. The requested command failed because the sender does not have adequate access control permissions (ACL) on the recipient. "Access denied" errors usually get translated to this response code. |
+| 214 | Operation canceled. The SyncML command completed successfully, but no more commands will be processed within the session. |
+| 215 | Not executed. A command was not executed as a result of user interaction to cancel the command. |
+| 216 | `Atomic` roll back OK. A command was inside an `Atomic` element and `Atomic` failed. This command was rolled back successfully. |
+| 400 | Bad request. The requested command could not be performed because of malformed syntax. CSPs do not usually generate this error, however you might see it if your SyncML is malformed. |
+| 401 | Invalid credentials. The requested command failed because the requestor must provide proper authentication. CSPs do not usually generate this error. |
+| 403 | Forbidden. The requested command failed, but the recipient understood the requested command. |
+| 404 | Not found. The requested target was not found. This code will be generated if you query a node that does not exist. |
+| 405 | Command not allowed. This respond code will be generated if you try to write to a read-only node. |
+| 406 | Optional feature not supported. This response code will be generated if you try to access a property that the CSP doesn't support. |
+| 415 | Unsupported type or format. This response code can result from XML parsing or formatting errors. |
+| 418 | Already exists. This response code occurs if you attempt to add a node that already exists. |
+| 425 | Permission Denied. The requested command failed because the sender does not have adequate access control permissions (ACL) on the recipient. "Access denied" errors usually get translated to this response code. |
| 500 | Command failed. Generic failure. The recipient encountered an unexpected condition which prevented it from fulfilling the request. This response code will occur when the SyncML DPU cannot map the originating error code. |
-| 507 | `Atomic` failed. One of the operations in an `Atomic` block failed. |
-| 516 | `Atomic` roll back failed. An `Atomic` operation failed and the command was not rolled back successfully. |
-
-
+| 507 | `Atomic` failed. One of the operations in an `Atomic` block failed. |
+| 516 | `Atomic` roll back failed. An `Atomic` operation failed and the command was not rolled back successfully. |
## Related topics
[Configuration service provider reference](configuration-service-provider-reference.md)
-
-
-
-
-
-
-
-
diff --git a/windows/client-management/mdm/on-premise-authentication-device-enrollment.md b/windows/client-management/mdm/on-premise-authentication-device-enrollment.md
index 2ff94e841f..97f5528a43 100644
--- a/windows/client-management/mdm/on-premise-authentication-device-enrollment.md
+++ b/windows/client-management/mdm/on-premise-authentication-device-enrollment.md
@@ -8,7 +8,7 @@ ms.author: dansimp
ms.topic: article
ms.prod: w10
ms.technology: windows
-author: manikadhiman
+author: dansimp
ms.date: 06/26/2017
---
diff --git a/windows/client-management/mdm/passportforwork-csp.md b/windows/client-management/mdm/passportforwork-csp.md
index 028da43967..68bd28dd1e 100644
--- a/windows/client-management/mdm/passportforwork-csp.md
+++ b/windows/client-management/mdm/passportforwork-csp.md
@@ -8,7 +8,7 @@ ms.author: dansimp
ms.topic: article
ms.prod: w10
ms.technology: windows
-author: manikadhiman
+author: dansimp
ms.date: 07/19/2019
---
@@ -96,7 +96,7 @@ Node for defining the Windows Hello for Business policy settings.
***TenantId*/Policies/UsePassportForWork**
Boolean value that sets Windows Hello for Business as a method for signing into Windows.
-Default value is true. If you set this policy to false, the user cannot provision Windows Hello for Business except on Azure Active Directory joined mobile phones where provisioning is required.
+Default value is true. If you set this policy to false, the user cannot provision Windows Hello for Business.
Supported operations are Add, Get, Delete, and Replace.
diff --git a/windows/client-management/mdm/passportforwork-ddf.md b/windows/client-management/mdm/passportforwork-ddf.md
index f5b345d7d6..c8bf22bdf1 100644
--- a/windows/client-management/mdm/passportforwork-ddf.md
+++ b/windows/client-management/mdm/passportforwork-ddf.md
@@ -8,7 +8,7 @@ ms.author: dansimp
ms.topic: article
ms.prod: w10
ms.technology: windows
-author: manikadhiman
+author: dansimp
ms.date: 07/29/2019
---
diff --git a/windows/client-management/mdm/personalization-csp.md b/windows/client-management/mdm/personalization-csp.md
index 7a1a41565d..67b7f88ce5 100644
--- a/windows/client-management/mdm/personalization-csp.md
+++ b/windows/client-management/mdm/personalization-csp.md
@@ -5,7 +5,7 @@ ms.author: dansimp
ms.topic: article
ms.prod: w10
ms.technology: windows
-author: manikadhiman
+author: dansimp
ms.date: 06/26/2017
ms.reviewer:
manager: dansimp
diff --git a/windows/client-management/mdm/personalization-ddf.md b/windows/client-management/mdm/personalization-ddf.md
index 5a9ac5cc69..bc7605048f 100644
--- a/windows/client-management/mdm/personalization-ddf.md
+++ b/windows/client-management/mdm/personalization-ddf.md
@@ -5,7 +5,7 @@ ms.author: dansimp
ms.topic: article
ms.prod: w10
ms.technology: windows
-author: manikadhiman
+author: dansimp
ms.date: 12/05/2017
ms.reviewer:
manager: dansimp
diff --git a/windows/client-management/mdm/policies-in-policy-csp-admx-backed.md b/windows/client-management/mdm/policies-in-policy-csp-admx-backed.md
index 6256ffe15a..deb8e8e4aa 100644
--- a/windows/client-management/mdm/policies-in-policy-csp-admx-backed.md
+++ b/windows/client-management/mdm/policies-in-policy-csp-admx-backed.md
@@ -7,7 +7,7 @@ ms.author: dansimp
ms.topic: article
ms.prod: w10
ms.technology: windows
-author: manikadhiman
+author: dansimp
ms.localizationpriority: medium
ms.date: 10/08/2020
---
diff --git a/windows/client-management/mdm/policies-in-policy-csp-supported-by-group-policy.md b/windows/client-management/mdm/policies-in-policy-csp-supported-by-group-policy.md
index d7d340e2b5..86d72e7cfe 100644
--- a/windows/client-management/mdm/policies-in-policy-csp-supported-by-group-policy.md
+++ b/windows/client-management/mdm/policies-in-policy-csp-supported-by-group-policy.md
@@ -7,7 +7,7 @@ ms.author: dansimp
ms.topic: article
ms.prod: w10
ms.technology: windows
-author: manikadhiman
+author: dansimp
ms.localizationpriority: medium
ms.date: 07/18/2019
---
diff --git a/windows/client-management/mdm/policies-in-policy-csp-supported-by-hololens-1st-gen-commercial-suite.md b/windows/client-management/mdm/policies-in-policy-csp-supported-by-hololens-1st-gen-commercial-suite.md
index 0c6853e5dd..c4bd9e3c6b 100644
--- a/windows/client-management/mdm/policies-in-policy-csp-supported-by-hololens-1st-gen-commercial-suite.md
+++ b/windows/client-management/mdm/policies-in-policy-csp-supported-by-hololens-1st-gen-commercial-suite.md
@@ -7,7 +7,7 @@ ms.author: dansimp
ms.topic: article
ms.prod: w10
ms.technology: windows
-author: manikadhiman
+author: dansimp
ms.localizationpriority: medium
ms.date: 09/17/2019
---
diff --git a/windows/client-management/mdm/policies-in-policy-csp-supported-by-hololens-1st-gen-development-edition.md b/windows/client-management/mdm/policies-in-policy-csp-supported-by-hololens-1st-gen-development-edition.md
index 564838b14a..f2ee79c529 100644
--- a/windows/client-management/mdm/policies-in-policy-csp-supported-by-hololens-1st-gen-development-edition.md
+++ b/windows/client-management/mdm/policies-in-policy-csp-supported-by-hololens-1st-gen-development-edition.md
@@ -7,7 +7,7 @@ ms.author: dansimp
ms.topic: article
ms.prod: w10
ms.technology: windows
-author: manikadhiman
+author: dansimp
ms.localizationpriority: medium
ms.date: 07/18/2019
---
diff --git a/windows/client-management/mdm/policies-in-policy-csp-supported-by-hololens2.md b/windows/client-management/mdm/policies-in-policy-csp-supported-by-hololens2.md
index b312ee27f9..debcf03dc5 100644
--- a/windows/client-management/mdm/policies-in-policy-csp-supported-by-hololens2.md
+++ b/windows/client-management/mdm/policies-in-policy-csp-supported-by-hololens2.md
@@ -7,7 +7,7 @@ ms.author: dansimp
ms.topic: article
ms.prod: w10
ms.technology: windows
-author: manikadhiman
+author: dansimp
ms.localizationpriority: medium
ms.date: 10/11/2021
---
diff --git a/windows/client-management/mdm/policies-in-policy-csp-supported-by-iot-core.md b/windows/client-management/mdm/policies-in-policy-csp-supported-by-iot-core.md
index bc1fef5bcc..c06fa67c0e 100644
--- a/windows/client-management/mdm/policies-in-policy-csp-supported-by-iot-core.md
+++ b/windows/client-management/mdm/policies-in-policy-csp-supported-by-iot-core.md
@@ -7,7 +7,7 @@ ms.author: dansimp
ms.topic: article
ms.prod: w10
ms.technology: windows
-author: manikadhiman
+author: dansimp
ms.localizationpriority: medium
ms.date: 09/16/2019
---
diff --git a/windows/client-management/mdm/policies-in-policy-csp-supported-by-surface-hub.md b/windows/client-management/mdm/policies-in-policy-csp-supported-by-surface-hub.md
index 57cbee7b16..c67e00367b 100644
--- a/windows/client-management/mdm/policies-in-policy-csp-supported-by-surface-hub.md
+++ b/windows/client-management/mdm/policies-in-policy-csp-supported-by-surface-hub.md
@@ -7,7 +7,7 @@ ms.author: dansimp
ms.topic: article
ms.prod: w10
ms.technology: windows
-author: manikadhiman
+author: dansimp
ms.localizationpriority: medium
ms.date: 07/22/2020
---
diff --git a/windows/client-management/mdm/policies-in-policy-csp-that-can-be-set-using-eas.md b/windows/client-management/mdm/policies-in-policy-csp-that-can-be-set-using-eas.md
index 4fa3380c87..774b575293 100644
--- a/windows/client-management/mdm/policies-in-policy-csp-that-can-be-set-using-eas.md
+++ b/windows/client-management/mdm/policies-in-policy-csp-that-can-be-set-using-eas.md
@@ -7,7 +7,7 @@ ms.author: dansimp
ms.topic: article
ms.prod: w10
ms.technology: windows
-author: manikadhiman
+author: dansimp
ms.localizationpriority: medium
ms.date: 07/18/2019
---
diff --git a/windows/client-management/mdm/policy-configuration-service-provider.md b/windows/client-management/mdm/policy-configuration-service-provider.md
index bbd3101f94..f88a7df806 100644
--- a/windows/client-management/mdm/policy-configuration-service-provider.md
+++ b/windows/client-management/mdm/policy-configuration-service-provider.md
@@ -8,9 +8,10 @@ ms.author: dansimp
ms.topic: article
ms.prod: w10
ms.technology: windows
-author: manikadhiman
+author: dansimp
ms.localizationpriority: medium
ms.date: 07/18/2019
+ms.collection: highpri
---
# Policy CSP
@@ -8358,6 +8359,12 @@ dfsdiscoverdc">ADMX_DFS/DFSDiscoverDC
+
+|Edition|Windows 10|Windows 11|
+|--- |--- |--- |
+|Home|No|No|
+|Pro|No|No|
+|Business|No|No|
+|Enterprise|Yes|Yes|
+|Education|Yes|Yes|
@@ -507,10 +435,10 @@ ADMX Info:
Allows an administrator to specify if Automatic Exclusions feature for Server SKUs should be turned off.
Disabled (Default):
-Microsoft Defender will exclude pre-defined list of paths from the scan to improve performance.
+Microsoft Defender Antivirus will exclude pre-defined list of paths from the scan to improve performance.
Enabled:
-Microsoft Defender will not exclude pre-defined list of paths from scans. This can impact machine performance in some scenarios.
+Microsoft Defender Antivirus will not exclude pre-defined list of paths from scans. This can impact machine performance in some scenarios.
Not configured:
Same as Disabled.
@@ -533,38 +461,14 @@ ADMX Info:
**ADMX_MicrosoftDefenderAntivirus/DisableBlockAtFirstSeen**
-
+
+|Edition|Windows 10|Windows 11|
+|--- |--- |--- |
+|Home|No|No|
+|Pro|No|No|
+|Business|No|No|
+|Enterprise|Yes|Yes|
+|Education|Yes|Yes|
@@ -1415,7 +1055,7 @@ ADMX Info:
Enable or disable file hash computation feature.
Enabled:
-When this feature is enabled Microsoft Defender will compute hash value for files it scans.
+When this feature is enabled Microsoft Defender Antivirus will compute hash value for files it scans.
Disabled:
File hash value is not computed
@@ -1441,38 +1081,14 @@ ADMX Info:
**ADMX_MicrosoftDefenderAntivirus/Nis_Consumers_IPS_DisableSignatureRetirement**
-
+
+|Edition|Windows 10|Windows 11|
+|--- |--- |--- |
+|Home|No|No|
+|Pro|No|No|
+|Business|No|No|
+|Enterprise|Yes|Yes|
+|Education|Yes|Yes|
@@ -166,7 +118,8 @@ If you enable or do not configure this policy setting, users can access and run
If you disable this policy setting, users cannot access or run the troubleshooting tools from the Control Panel.
-Note that this setting also controls a user's ability to launch standalone troubleshooting packs such as those found in .diagcab files.
+>[!Note]
+>This setting also controls a user's ability to launch standalone troubleshooting packs such as those found in .diagcab files.
@@ -186,38 +139,14 @@ ADMX Info:
**ADMX_sdiageng/ScriptedDiagnosticsSecurityPolicy**
-
+
+|Edition|Windows 10|Windows 11|
+|--- |--- |--- |
+|Home|No|No|
+|Pro|No|No|
+|Business|Yes|Yes|
+|Enterprise|Yes|Yes|
+|Education|Yes|Yes|
@@ -529,32 +385,14 @@ The following list shows the supported values:
**ApplicationManagement/DisableStoreOriginatedApps**
-
-
-
Windows Edition
-
Supported?
-
-
-
Home
-
❌
-
-
-
Pro
-
❌
-
-
-
Business
-
❌
-
-
-
Enterprise
-
✔️1
-
-
-
Education
-
✔️1
-
-
+
+|Edition|Windows 10|Windows 11|
+|--- |--- |--- |
+|Home|No|No|
+|Pro|No|No|
+|Business|No|No|
+|Enterprise|Yes|Yes|
+|Education|Yes|Yes|
@@ -595,32 +433,14 @@ The following list shows the supported values:
**ApplicationManagement/LaunchAppAfterLogOn**
-
-
-
Windows Edition
-
Supported?
-
-
-
Home
-
❌
-
-
-
Pro
-
✔️5
-
-
-
Business
-
✔️5
-
-
-
Enterprise
-
✔️5
-
-
-
Education
-
✔️5
-
-
+
+|Edition|Windows 10|Windows 11|
+|--- |--- |--- |
+|Home|No|No|
+|Pro|Yes|Yes|
+|Business|Yes|Yes|
+|Enterprise|Yes|Yes|
+|Education|Yes|Yes|
@@ -666,32 +486,14 @@ For this policy to work, the Windows apps need to declare in their manifest that
**ApplicationManagement/MSIAllowUserControlOverInstall**
-
-
-
Windows Edition
-
Supported?
-
-
-
Home
-
❌
-
-
-
Pro
-
✔️4
-
-
-
Business
-
❌
-
-
-
Enterprise
-
✔️4
-
-
-
Education
-
✔️4
-
-
+
+|Edition|Windows 10|Windows 11|
+|--- |--- |--- |
+|Home|No|No|
+|Pro|Yes|Yes|
+|Business|No|No|
+|Enterprise|Yes|Yes|
+|Education|Yes|Yes|
@@ -737,32 +539,14 @@ This setting supports a range of values between 0 and 1.
**ApplicationManagement/MSIAlwaysInstallWithElevatedPrivileges**
-
-
-
Windows Edition
-
Supported?
-
-
-
Home
-
❌
-
-
-
Pro
-
✔️4
-
-
-
Business
-
❌
-
-
-
Enterprise
-
✔️4
-
-
-
Education
-
✔️4
-
-
+
+|Edition|Windows 10|Windows 11|
+|--- |--- |--- |
+|Home|No|No|
+|Pro|Yes|Yes|
+|Business|No|No|
+|Enterprise|Yes|Yes|
+|Education|Yes|Yes|
@@ -811,32 +595,14 @@ This setting supports a range of values between 0 and 1.
**ApplicationManagement/RequirePrivateStoreOnly**
-
-
-
Windows Edition
-
Supported?
-
-
-
Home
-
❌
-
-
-
Pro
-
❌
-
-
-
Business
-
❌
-
-
-
Enterprise
-
✔️
-
-
-
Education
-
✔️
-
-
+
+|Edition|Windows 10|Windows 11|
+|--- |--- |--- |
+|Home|No|No|
+|Pro|No|No|
+|Business|No|No|
+|Enterprise|Yes|Yes|
+|Education|Yes|Yes|
@@ -881,32 +647,14 @@ The following list shows the supported values:
**ApplicationManagement/RestrictAppDataToSystemVolume**
-
-
-
Windows Edition
-
Supported?
-
-
-
Home
-
❌
-
-
-
Pro
-
✔️
-
-
-
Business
-
✔️
-
-
-
Enterprise
-
✔️
-
-
-
Education
-
✔️
-
-
+
+|Edition|Windows 10|Windows 11|
+|--- |--- |--- |
+|Home|No|No|
+|Pro|Yes|Yes|
+|Business|Yes|Yes|
+|Enterprise|Yes|Yes|
+|Education|Yes|Yes|
@@ -949,32 +697,14 @@ The following list shows the supported values:
**ApplicationManagement/RestrictAppToSystemVolume**
-
-
-
Windows Edition
-
Supported?
-
-
-
Home
-
❌
-
-
-
Pro
-
✔️
-
-
-
Business
-
✔️
-
-
-
Enterprise
-
✔️
-
-
-
Education
-
✔️
-
-
+
+|Edition|Windows 10|Windows 11|
+|--- |--- |--- |
+|Home|No|No|
+|Pro|Yes|Yes|
+|Business|Yes|Yes|
+|Enterprise|Yes|Yes|
+|Education|Yes|Yes|
@@ -1017,32 +747,14 @@ The following list shows the supported values:
**ApplicationManagement/ScheduleForceRestartForUpdateFailures**
-
+
+|Edition|Windows 10|Windows 11|
+|--- |--- |--- |
+|Home|No|No|
+|Pro|Yes|Yes|
+|Business|Yes|Yes|
+|Enterprise|Yes|Yes|
+|Education|Yes|Yes|
@@ -122,38 +98,14 @@ The following list shows the supported values:
**Authentication/AllowEAPCertSSO**
-
-
-
Edition
-
Windows 10
-
Windows 11
-
-
-
Home
-
No
-
No
-
-
-
Pro
-
Yes
-
Yes
-
-
-
Business
-
Yes
-
Yes
-
-
-
Enterprise
-
Yes
-
Yes
-
-
-
Education
-
Yes
-
Yes
-
-
+
+|Edition|Windows 10|Windows 11|
+|--- |--- |--- |
+|Home|No|No|
+|Pro|Yes|Yes|
+|Business|Yes|Yes|
+|Enterprise|Yes|Yes|
+|Education|Yes|Yes|
@@ -187,38 +139,14 @@ The following list shows the supported values:
**Authentication/AllowFastReconnect**
-
-
-
Edition
-
Windows 10
-
Windows 11
-
-
-
Home
-
No
-
No
-
-
-
Pro
-
Yes
-
Yes
-
-
-
Business
-
Yes
-
Yes
-
-
-
Enterprise
-
Yes
-
Yes
-
-
-
Education
-
Yes
-
Yes
-
-
+
+|Edition|Windows 10|Windows 11|
+|--- |--- |--- |
+|Home|No|No|
+|Pro|Yes|Yes|
+|Business|Yes|Yes|
+|Enterprise|Yes|Yes|
+|Education|Yes|Yes|
@@ -254,38 +182,14 @@ The following list shows the supported values:
**Authentication/AllowFidoDeviceSignon**
-
-
-
Edition
-
Windows 10
-
Windows 11
-
-
-
Home
-
No
-
No
-
-
-
Pro
-
Yes
-
Yes
-
-
-
Business
-
Yes
-
Yes
-
-
-
Enterprise
-
Yes
-
Yes
-
-
-
Education
-
Yes
-
Yes
-
-
+
+|Edition|Windows 10|Windows 11|
+|--- |--- |--- |
+|Home|No|No|
+|Pro|Yes|Yes|
+|Business|Yes|Yes|
+|Enterprise|Yes|Yes|
+|Education|Yes|Yes|
@@ -323,38 +227,14 @@ The following list shows the supported values:
**Authentication/AllowSecondaryAuthenticationDevice**
-
-
-
Edition
-
Windows 10
-
Windows 11
-
-
-
Home
-
No
-
No
-
-
-
Pro
-
Yes
-
Yes
-
-
-
Business
-
Yes
-
Yes
-
-
-
Enterprise
-
Yes
-
Yes
-
-
-
Education
-
Yes
-
Yes
-
-
+
+|Edition|Windows 10|Windows 11|
+|--- |--- |--- |
+|Home|No|No|
+|Pro|Yes|Yes|
+|Business|Yes|Yes|
+|Enterprise|Yes|Yes|
+|Education|Yes|Yes|
@@ -400,38 +280,14 @@ The following list shows the supported values:
**Authentication/ConfigureWebSignInAllowedUrls**
-
-
-
Edition
-
Windows 10
-
Windows 11
-
-
-
Home
-
No
-
No
-
-
-
Pro
-
Yes
-
Yes
-
-
-
Business
-
Yes
-
Yes
-
-
-
Enterprise
-
Yes
-
Yes
-
-
-
Education
-
Yes
-
Yes
-
-
+
+|Edition|Windows 10|Windows 11|
+|--- |--- |--- |
+|Home|No|No|
+|Pro|Yes|Yes|
+|Business|Yes|Yes|
+|Enterprise|Yes|Yes|
+|Education|Yes|Yes|
@@ -469,38 +325,14 @@ Specifies the list of domains that are allowed to be navigated to in AAD PIN res
**Authentication/EnableFastFirstSignIn**
-
-
-
Edition
-
Windows 10
-
Windows 11
-
-
-
Home
-
No
-
No
-
-
-
Pro
-
Yes
-
Yes
-
-
-
Business
-
Yes
-
Yes
-
-
-
Enterprise
-
Yes
-
Yes
-
-
-
Education
-
Yes
-
Yes
-
-
+
+|Edition|Windows 10|Windows 11|
+|--- |--- |--- |
+|Home|No|No|
+|Pro|Yes|Yes|
+|Business|Yes|Yes|
+|Enterprise|Yes|Yes|
+|Education|Yes|Yes|
@@ -548,38 +380,14 @@ Value type is integer. Supported values:
**Authentication/EnableWebSignIn**
-
-
-
Edition
-
Windows 10
-
Windows 11
-
-
-
Home
-
No
-
No
-
-
-
Pro
-
Yes
-
Yes
-
-
-
Business
-
Yes
-
Yes
-
-
-
Enterprise
-
Yes
-
Yes
-
-
-
Education
-
Yes
-
Yes
-
-
+
+|Edition|Windows 10|Windows 11|
+|--- |--- |--- |
+|Home|No|No|
+|Pro|Yes|Yes|
+|Business|Yes|Yes|
+|Enterprise|Yes|Yes|
+|Education|Yes|Yes|
@@ -627,38 +435,14 @@ Value type is integer. Supported values:
**Authentication/PreferredAadTenantDomainName**
-
+
+|Edition|Windows 10|Windows 11|
+|--- |--- |--- |
+|Home|No|No|
+|Pro|Yes|Yes|
+|Business|Yes|Yes|
+|Enterprise|Yes|Yes|
+|Education|Yes|Yes|
@@ -119,38 +95,14 @@ The following list shows the supported values:
**Bluetooth/AllowDiscoverableMode**
-
-
-
Edition
-
Windows 10
-
Windows 11
-
-
-
Home
-
No
-
No
-
-
-
Pro
-
Yes
-
Yes
-
-
-
Business
-
Yes
-
Yes
-
-
-
Enterprise
-
Yes
-
Yes
-
-
-
Education
-
Yes
-
Yes
-
-
+
+|Edition|Windows 10|Windows 11|
+|--- |--- |--- |
+|Home|No|No|
+|Pro|Yes|Yes|
+|Business|Yes|Yes|
+|Enterprise|Yes|Yes|
+|Education|Yes|Yes|
@@ -188,38 +140,14 @@ The following list shows the supported values:
**Bluetooth/AllowPrepairing**
-
-
-
Edition
-
Windows 10
-
Windows 11
-
-
-
Home
-
No
-
No
-
-
-
Pro
-
Yes
-
Yes
-
-
-
Business
-
Yes
-
Yes
-
-
-
Enterprise
-
Yes
-
Yes
-
-
-
Education
-
Yes
-
Yes
-
-
+
+|Edition|Windows 10|Windows 11|
+|--- |--- |--- |
+|Home|No|No|
+|Pro|Yes|Yes|
+|Business|Yes|Yes|
+|Enterprise|Yes|Yes|
+|Education|Yes|Yes|
@@ -253,38 +181,14 @@ The following list shows the supported values:
**Bluetooth/AllowPromptedProximalConnections**
-
-
-
Edition
-
Windows 10
-
Windows 11
-
-
-
Home
-
No
-
No
-
-
-
Pro
-
Yes
-
Yes
-
-
-
Business
-
Yes
-
Yes
-
-
-
Enterprise
-
Yes
-
Yes
-
-
-
Education
-
Yes
-
Yes
-
-
+
+|Edition|Windows 10|Windows 11|
+|--- |--- |--- |
+|Home|No|No|
+|Pro|Yes|Yes|
+|Business|Yes|Yes|
+|Enterprise|Yes|Yes|
+|Education|Yes|Yes|
@@ -318,38 +222,14 @@ The following list shows the supported values:
**Bluetooth/LocalDeviceName**
-
-
-
Edition
-
Windows 10
-
Windows 11
-
-
-
Home
-
No
-
No
-
-
-
Pro
-
Yes
-
Yes
-
-
-
Business
-
Yes
-
Yes
-
-
-
Enterprise
-
Yes
-
Yes
-
-
-
Education
-
Yes
-
Yes
-
-
+
+|Edition|Windows 10|Windows 11|
+|--- |--- |--- |
+|Home|No|No|
+|Pro|Yes|Yes|
+|Business|Yes|Yes|
+|Enterprise|Yes|Yes|
+|Education|Yes|Yes|
@@ -380,38 +260,14 @@ If this policy is not set or it is deleted, the default local radio name is used
**Bluetooth/ServicesAllowedList**
-
-
-
Edition
-
Windows 10
-
Windows 11
-
-
-
Home
-
No
-
No
-
-
-
Pro
-
Yes
-
Yes
-
-
-
Business
-
Yes
-
Yes
-
-
-
Enterprise
-
Yes
-
Yes
-
-
-
Education
-
Yes
-
Yes
-
-
+
+|Edition|Windows 10|Windows 11|
+|--- |--- |--- |
+|Home|No|No|
+|Pro|Yes|Yes|
+|Business|Yes|Yes|
+|Enterprise|Yes|Yes|
+|Education|Yes|Yes|
@@ -440,38 +296,14 @@ The default value is an empty string. For more information, see [ServicesAllowed
**Bluetooth/SetMinimumEncryptionKeySize**
-
+
+|Edition|Windows 10|Windows 11|
+|--- |--- |--- |
+|Home|No|No|
+|Pro|Yes|No|
+|Business|Yes|No|
+|Enterprise|Yes|No|
+|Education|Yes|No|
@@ -511,7 +415,7 @@ Most restricted value: 0
To verify AllowCookies is set to 0 (not allowed):
-1. Open Microsoft Edge or Microsoft Edge for Windows 10 Mobile.
+1. Open Microsoft Edge.
2. In the upper-right corner of the browser, click **…**.
3. Click **Settings** in the drop down list, and select **View Advanced Settings**.
4. Verify the setting **Cookies** is disabled.
@@ -525,38 +429,14 @@ To verify AllowCookies is set to 0 (not allowed):
**Browser/AllowDeveloperTools**
-
-
-
Edition
-
Windows 10
-
Windows 11
-
-
-
Home
-
No
-
No
-
-
-
Pro
-
Yes
-
No
-
-
-
Business
-
Yes
-
No
-
-
-
Enterprise
-
Yes
-
No
-
-
-
Education
-
Yes
-
No
-
-
+
+|Edition|Windows 10|Windows 11|
+|--- |--- |--- |
+|Home|No|No|
+|Pro|Yes|No|
+|Business|Yes|No|
+|Enterprise|Yes|No|
+|Education|Yes|No|
@@ -573,8 +453,6 @@ To verify AllowCookies is set to 0 (not allowed):
-> [!NOTE]
-> This policy is only enforced in Windows for desktop and not supported in Windows Mobile.
[!INCLUDE [allow-developer-tools-shortdesc](../includes/allow-developer-tools-shortdesc.md)]
@@ -603,38 +481,14 @@ Most restricted value: 0
**Browser/AllowDoNotTrack**
-
-
-
Edition
-
Windows 10
-
Windows 11
-
-
-
Home
-
No
-
No
-
-
-
Pro
-
Yes
-
No
-
-
-
Business
-
Yes
-
No
-
-
-
Enterprise
-
Yes
-
No
-
-
-
Education
-
Yes
-
No
-
-
+
+|Edition|Windows 10|Windows 11|
+|--- |--- |--- |
+|Home|No|No|
+|Pro|Yes|No|
+|Business|Yes|No|
+|Enterprise|Yes|No|
+|Education|Yes|No|
@@ -674,7 +528,7 @@ Most restricted value: 1
To verify AllowDoNotTrack is set to 0 (not allowed):
-1. Open Microsoft Edge or Microsoft Edge for Windows 10 Mobile.
+1. Open Microsoft Edge.
2. In the upper-right corner of the browser, click **…**.
3. Click **Settings** in the drop down list, and select **View Advanced Settings**.
4. Verify the setting **Send Do Not Track requests** is grayed out.
@@ -688,38 +542,14 @@ To verify AllowDoNotTrack is set to 0 (not allowed):
**Browser/AllowExtensions**
-
+
+|Edition|Windows 10|Windows 11|
+|--- |--- |--- |
+|Home|No|No|
+|Pro|Yes|No|
+|Business|Yes|No|
+|Enterprise|Yes|No|
+|Education|Yes|No|
@@ -2241,38 +1639,14 @@ To verify that browsing data is cleared on exit (ClearBrowsingDataOnExit is set
**Browser/ConfigureAdditionalSearchEngines**
-
+
+|Edition|Windows 10|Windows 11|
+|--- |--- |--- |
+|Home|No|No|
+|Pro|Yes|No|
+|Business|Yes|No|
+|Enterprise|Yes|No|
+|Education|Yes|No|
@@ -3063,11 +2221,6 @@ Most restricted value: 0
[!INCLUDE [configure-enterprise-mode-site-list-shortdesc](../includes/configure-enterprise-mode-site-list-shortdesc.md)]
-> [!NOTE]
-> This policy is only enforced in Windows for desktop and not supported in Windows Mobile.
-
-
-
ADMX Info:
@@ -3094,38 +2247,14 @@ Supported values:
**Browser/EnterpriseSiteListServiceUrl**
-
+
+|Edition|Windows 10|Windows 11|
+|--- |--- |--- |
+|Home|No|No|
+|Pro|Yes|No|
+|Business|Yes|No|
+|Enterprise|Yes|No|
+|Education|Yes|No|
@@ -3202,9 +2307,6 @@ Supported values:
-> [!NOTE]
-> This policy is only available for Windows for desktop and not supported in Windows Mobile.
-
[!INCLUDE [configure-start-pages-shortdesc](../includes/configure-start-pages-shortdesc.md)]
@@ -3246,38 +2348,14 @@ Supported values:
**Browser/LockdownFavorites**
-
+
+|Edition|Windows 10|Windows 11|
+|--- |--- |--- |
+|Home|No|No|
+|Pro|Yes|No|
+|Business|Yes|No|
+|Enterprise|Yes|No|
+|Education|Yes|No|
@@ -3917,8 +2803,6 @@ Supported values:
-> [!NOTE]
-> This policy is only enforced in Windows for desktop and not supported in Windows Mobile.
[!INCLUDE [prevent-using-localhost-ip-address-for-webrtc-shortdesc](../includes/prevent-using-localhost-ip-address-for-webrtc-shortdesc.md)]
@@ -3947,38 +2831,14 @@ Most restricted value: 1
**Browser/ProvisionFavorites**
-
+
+|Edition|Windows 10|Windows 11|
+|--- |--- |--- |
+|Home|No|No|
+|Pro|Yes|No|
+|Business|Yes|No|
+|Enterprise|Yes|No|
+|Education|Yes|No|
@@ -4083,10 +2919,6 @@ ADMX Info:
[!INCLUDE [send-all-intranet-sites-to-ie-shortdesc](../includes/send-all-intranet-sites-to-ie-shortdesc.md)]
-> [!NOTE]
-> This policy is only enforced in Windows for desktop and not supported in Windows Mobile.
-
-
ADMX Info:
@@ -4113,38 +2945,14 @@ Most restricted value: 0
**Browser/SetDefaultSearchEngine**
-
+
+|Edition|Windows 10|Windows 11|
+|--- |--- |--- |
+|Home|No|No|
+|Pro|Yes|No|
+|Business|Yes|No|
+|Enterprise|Yes|No|
+|Education|Yes|No|
@@ -4411,10 +3147,6 @@ Supported values:
[!INCLUDE [show-message-when-opening-sites-in-ie-shortdesc](../includes/show-message-when-opening-sites-in-ie-shortdesc.md)]
-
-> [!NOTE]
-> This policy is only enforced in Windows for desktop and not supported in Windows Mobile.
-
ADMX Info:
@@ -4441,38 +3173,14 @@ Most restricted value: 0
**Browser/SuppressEdgeDeprecationNotification**
-
-
-
Edition
-
Windows 10
-
Windows 11
-
-
-
Home
-
No
-
No
-
-
-
Pro
-
Yes
-
No
-
-
-
Business
-
Yes
-
No
-
-
-
Enterprise
-
Yes
-
No
-
-
-
Education
-
Yes
-
No
-
-
+
+|Edition|Windows 10|Windows 11|
+|--- |--- |--- |
+|Home|No|No|
+|Pro|Yes|No|
+|Business|Yes|No|
+|Enterprise|Yes|No|
+|Education|Yes|No|
@@ -4493,9 +3201,6 @@ This policy allows Enterprise Admins to turn off the notification for company de
By default, a notification will be presented to the user informing them of this upon application startup.
With this policy, you can either allow (default) or suppress this notification.
-> [!NOTE]
-> This policy is only enforced in Windows for desktop and not supported in Windows Mobile.
-
ADMX Info:
@@ -4516,38 +3221,14 @@ Supported values:
Browser/SyncFavoritesBetweenIEAndMicrosoftEdge
-
-
-
Edition
-
Windows 10
-
Windows 11
-
-
-
Home
-
No
-
No
-
-
-
Pro
-
Yes
-
No
-
-
-
Business
-
Yes
-
No
-
-
-
Enterprise
-
Yes
-
No
-
-
-
Education
-
Yes
-
No
-
-
+
+|Edition|Windows 10|Windows 11|
+|--- |--- |--- |
+|Home|No|No|
+|Pro|Yes|No|
+|Business|Yes|No|
+|Enterprise|Yes|No|
+|Education|Yes|No|
@@ -4569,9 +3250,6 @@ Supported values:
[!INCLUDE [keep-favorites-in-sync-between-ie-and-edge-shortdesc](../includes/keep-favorites-in-sync-between-ie-and-edge-shortdesc.md)]
-> [!NOTE]
-> This policy is only enforced in Windows for desktop and not supported in Windows Mobile.
-
ADMX Info:
@@ -4606,38 +3284,14 @@ To verify that favorites are in synchronized between Internet Explorer and Micro
**Browser/UnlockHomeButton**
-
+
+|Edition|Windows 10|Windows 11|
+|--- |--- |--- |
+|Home|No|No|
+|Pro|Yes|Yes|
+|Business|Yes|Yes|
+|Enterprise|Yes|Yes|
+|Education|Yes|Yes|
@@ -129,7 +105,7 @@ manager: dansimp
Allows the user to enable Bluetooth or restrict access.
> [!NOTE]
-> This value is not supported in Windows Phone 8.1 MDM and EAS, Windows 10 for desktop, or Windows 10 Mobile.
+> This value is not supported in Windows 10.
If this is not set or it is deleted, the default value of 2 (Allow) is used.
@@ -152,38 +128,14 @@ The following list shows the supported values:
**Connectivity/AllowCellularData**
-
-
-
Edition
-
Windows 10
-
Windows 11
-
-
-
Home
-
No
-
No
-
-
-
Pro
-
Yes
-
Yes
-
-
-
Business
-
Yes
-
Yes
-
-
-
Enterprise
-
Yes
-
Yes
-
-
-
Education
-
Yes
-
Yes
-
-
+
+|Edition|Windows 10|Windows 11|
+|--- |--- |--- |
+|Home|No|No|
+|Pro|Yes|Yes|
+|Business|Yes|Yes|
+|Enterprise|Yes|Yes|
+|Education|Yes|Yes|
@@ -218,38 +170,14 @@ The following list shows the supported values:
**Connectivity/AllowCellularDataRoaming**
-
-
-
Edition
-
Windows 10
-
Windows 11
-
-
-
Home
-
No
-
No
-
-
-
Pro
-
Yes
-
Yes
-
-
-
Business
-
Yes
-
Yes
-
-
-
Enterprise
-
Yes
-
Yes
-
-
-
Education
-
Yes
-
Yes
-
-
+
+|Edition|Windows 10|Windows 11|
+|--- |--- |--- |
+|Home|No|No|
+|Pro|Yes|Yes|
+|Business|Yes|Yes|
+|Enterprise|Yes|Yes|
+|Education|Yes|Yes|
@@ -289,7 +217,7 @@ The following list shows the supported values:
To validate, the enterprise can confirm by observing the roaming enable switch in the UX. It will be inactive if the roaming policy is being enforced by the enterprise policy.
-To validate on mobile devices, do the following:
+To validate on devices, do the following:
1. Go to Cellular & SIM.
2. Click on the SIM (next to the signal strength icon) and select **Properties**.
@@ -304,38 +232,14 @@ To validate on mobile devices, do the following:
**Connectivity/AllowConnectedDevices**
-
-
-
Edition
-
Windows 10
-
Windows 11
-
-
-
Home
-
Yes
-
Yes
-
-
-
Pro
-
Yes
-
Yes
-
-
-
Business
-
Yes
-
Yes
-
-
-
Enterprise
-
Yes
-
Yes
-
-
-
Education
-
Yes
-
Yes
-
-
+
+|Edition|Windows 10|Windows 11|
+|--- |--- |--- |
+|Home|Yes|Yes|
+|Pro|Yes|Yes|
+|Business|Yes|Yes|
+|Enterprise|Yes|Yes|
+|Education|Yes|Yes|
@@ -372,38 +276,14 @@ The following list shows the supported values:
**Connectivity/AllowPhonePCLinking**
-
-
-
Edition
-
Windows 10
-
Windows 11
-
-
-
Home
-
No
-
No
-
-
-
Pro
-
Yes
-
Yes
-
-
-
Business
-
Yes
-
Yes
-
-
-
Enterprise
-
Yes
-
Yes
-
-
-
Education
-
Yes
-
Yes
-
-
+
+|Edition|Windows 10|Windows 11|
+|--- |--- |--- |
+|Home|No|No|
+|Pro|Yes|Yes|
+|Business|Yes|Yes|
+|Enterprise|Yes|Yes|
+|Education|Yes|Yes|
@@ -454,38 +334,14 @@ Device that has previously opt-in to MMX will also stop showing on the device li
**Connectivity/AllowUSBConnection**
-
-
-
Edition
-
Windows 10
-
Windows 11
-
-
-
Home
-
No
-
No
-
-
-
Pro
-
No
-
No
-
-
-
Business
-
No
-
No
-
-
-
Enterprise
-
No
-
No
-
-
-
Education
-
No
-
No
-
-
+
+|Edition|Windows 10|Windows 11|
+|--- |--- |--- |
+|Home|No|No|
+|Pro|No|No|
+|Business|No|No|
+|Enterprise|No|No|
+|Education|No|No|
@@ -526,38 +382,14 @@ The following list shows the supported values:
**Connectivity/AllowVPNOverCellular**
-
-
-
Edition
-
Windows 10
-
Windows 11
-
-
-
Home
-
No
-
No
-
-
-
Pro
-
Yes
-
Yes
-
-
-
Business
-
Yes
-
Yes
-
-
-
Enterprise
-
Yes
-
Yes
-
-
-
Education
-
Yes
-
Yes
-
-
+
+|Edition|Windows 10|Windows 11|
+|--- |--- |--- |
+|Home|No|No|
+|Pro|Yes|Yes|
+|Business|Yes|Yes|
+|Enterprise|Yes|Yes|
+|Education|Yes|Yes|
@@ -593,38 +425,14 @@ The following list shows the supported values:
**Connectivity/AllowVPNRoamingOverCellular**
-
-
-
Edition
-
Windows 10
-
Windows 11
-
-
-
Home
-
No
-
No
-
-
-
Pro
-
Yes
-
Yes
-
-
-
Business
-
Yes
-
Yes
-
-
-
Enterprise
-
Yes
-
Yes
-
-
-
Education
-
Yes
-
Yes
-
-
+
+|Edition|Windows 10|Windows 11|
+|--- |--- |--- |
+|Home|No|No|
+|Pro|Yes|Yes|
+|Business|Yes|Yes|
+|Enterprise|Yes|Yes|
+|Education|Yes|Yes|
@@ -660,38 +468,14 @@ The following list shows the supported values:
**Connectivity/DisablePrintingOverHTTP**
-
+
+|Edition|Windows 10|Windows 11|
+|--- |--- |--- |
+|Home|No|No|
+|Pro|Yes|Yes|
+|Business|Yes|Yes|
+|Enterprise|Yes|Yes|
+|Education|Yes|Yes|
@@ -445,38 +349,14 @@ When DHCP Option ID Force (2) is set, the client will query DHCP Option ID 235 a
**DeliveryOptimization/DODelayBackgroundDownloadFromHttp**
-
+
+|Edition|Windows 10|Windows 11|
+|--- |--- |--- |
+|Home|No|No|
+|Pro|Yes|Yes|
+|Business|Yes|Yes|
+|Enterprise|Yes|Yes|
+|Education|Yes|Yes|
@@ -753,38 +561,14 @@ The following list shows the supported values as number of seconds:
**DeliveryOptimization/DODownloadMode**
-
-
-
Edition
-
Windows 10
-
Windows 11
-
-
-
Home
-
No
-
No
-
-
-
Pro
-
Yes
-
Yes
-
-
-
Business
-
Yes
-
Yes
-
-
-
Enterprise
-
Yes
-
Yes
-
-
-
Education
-
Yes
-
Yes
-
-
+
+|Edition|Windows 10|Windows 11|
+|--- |--- |--- |
+|Home|No|No|
+|Pro|Yes|Yes|
+|Business|Yes|Yes|
+|Enterprise|Yes|Yes|
+|Education|Yes|Yes|
@@ -834,38 +618,14 @@ The following list shows the supported values:
**DeliveryOptimization/DOGroupId**
-
+
+|Edition|Windows 10|Windows 11|
+|--- |--- |--- |
+|Home|No|No|
+|Pro|Yes|Yes|
+|Business|Yes|Yes|
+|Enterprise|Yes|Yes|
+|Education|Yes|Yes|
@@ -1232,38 +896,14 @@ This policy is deprecated. Use [DOMaxForegroundDownloadBandwidth](#deliveryoptim
**DeliveryOptimization/DOMaxForegroundDownloadBandwidth**
-
-
-
Edition
-
Windows 10
-
Windows 11
-
-
-
Home
-
No
-
No
-
-
-
Pro
-
Yes
-
Yes
-
-
-
Business
-
Yes
-
Yes
-
-
-
Enterprise
-
Yes
-
Yes
-
-
-
Education
-
Yes
-
Yes
-
-
+
+|Edition|Windows 10|Windows 11|
+|--- |--- |--- |
+|Home|No|No|
+|Pro|Yes|Yes|
+|Business|Yes|Yes|
+|Enterprise|Yes|Yes|
+|Education|Yes|Yes|
@@ -1320,38 +960,14 @@ This policy is deprecated because it only applies to uploads to Internet peers (
**DeliveryOptimization/DOMinBackgroundQos**
-
+
+|Edition|Windows 10|Windows 11|
+|--- |--- |--- |
+|Home|No|No|
+|Pro|Yes|Yes|
+|Business|Yes|Yes|
+|Enterprise|Yes|Yes|
+|Education|Yes|Yes|
@@ -111,38 +87,14 @@ The following list shows the supported values:
**DeviceHealthMonitoring/ConfigDeviceHealthMonitoringScope**
-
-
-
Edition
-
Windows 10
-
Windows 11
-
-
-
Home
-
No
-
No
-
-
-
Pro
-
Yes
-
Yes
-
-
-
Business
-
Yes
-
Yes
-
-
-
Enterprise
-
Yes
-
Yes
-
-
-
Education
-
Yes
-
Yes
-
-
+
+|Edition|Windows 10|Windows 11|
+|--- |--- |--- |
+|Home|No|No|
+|Pro|Yes|Yes|
+|Business|Yes|Yes|
+|Enterprise|Yes|Yes|
+|Education|Yes|Yes|
@@ -181,38 +133,14 @@ IT Pros do not need to set this policy. Instead, Microsoft Intune is expected to
**DeviceHealthMonitoring/ConfigDeviceHealthMonitoringUploadDestination**
-
+
+|Edition|Windows 10|Windows 11|
+|--- |--- |--- |
+|Home|No|No|
+|Pro|Yes|Yes|
+|Business|Yes|Yes|
+|Enterprise|Yes|Yes|
+|Education|Yes|Yes|
@@ -772,41 +628,17 @@ You can also block installation by using a custom profile in Intune.
-## DeviceInstallation/PreventInstallationOfMatchingDeviceIDs
+### DeviceInstallation/PreventInstallationOfMatchingDeviceIDs
-
-
-
Edition
-
Windows 10
-
Windows 11
-
-
-
Home
-
No
-
No
-
-
-
Pro
-
Yes
-
Yes
-
-
-
Business
-
Yes
-
Yes
-
-
-
Enterprise
-
Yes
-
Yes
-
-
-
Education
-
Yes
-
Yes
-
-
+
+|Edition|Windows 10|Windows 11|
+|--- |--- |--- |
+|Home|No|No|
+|Pro|Yes|Yes|
+|Business|Yes|Yes|
+|Enterprise|Yes|Yes|
+|Education|Yes|Yes|
@@ -894,41 +726,17 @@ For example, this custom profile blocks installation and usage of USB devices wi
-## DeviceInstallation/PreventInstallationOfMatchingDeviceInstanceIDs
+### DeviceInstallation/PreventInstallationOfMatchingDeviceInstanceIDs
-
+
+|Edition|Windows 10|Windows 11|
+|--- |--- |--- |
+|Home|No|No|
+|Pro|No|No|
+|Business|No|No|
+|Enterprise|No|No|
+|Education|No|No|
@@ -144,38 +120,14 @@ The following list shows the supported values:
**DeviceLock/AllowSimpleDevicePassword**
-
-
-
Edition
-
Windows 10
-
Windows 11
-
-
-
Home
-
Yes
-
Yes
-
-
-
Pro
-
Yes
-
Yes
-
-
-
Business
-
Yes
-
Yes
-
-
-
Enterprise
-
Yes
-
Yes
-
-
-
Education
-
Yes
-
Yes
-
-
+
+|Edition|Windows 10|Windows 11|
+|--- |--- |--- |
+|Home|Yes|Yes|
+|Pro|Yes|Yes|
+|Business|Yes|Yes|
+|Enterprise|Yes|Yes|
+|Education|Yes|Yes|
@@ -216,38 +168,14 @@ The following list shows the supported values:
**DeviceLock/AlphanumericDevicePasswordRequired**
-
-
-
Edition
-
Windows 10
-
Windows 11
-
-
-
Home
-
Yes
-
Yes
-
-
-
Pro
-
Yes
-
Yes
-
-
-
Business
-
Yes
-
Yes
-
-
-
Enterprise
-
Yes
-
Yes
-
-
-
Education
-
Yes
-
Yes
-
-
+
+|Edition|Windows 10|Windows 11|
+|--- |--- |--- |
+|Home|Yes|Yes|
+|Pro|Yes|Yes|
+|Business|Yes|Yes|
+|Enterprise|Yes|Yes|
+|Education|Yes|Yes|
@@ -294,38 +222,14 @@ The following list shows the supported values:
**DeviceLock/DevicePasswordEnabled**
-
-
-
Edition
-
Windows 10
-
Windows 11
-
-
-
Home
-
Yes
-
Yes
-
-
-
Pro
-
Yes
-
Yes
-
-
-
Business
-
Yes
-
Yes
-
-
-
Enterprise
-
Yes
-
Yes
-
-
-
Education
-
Yes
-
Yes
-
-
+
+|Edition|Windows 10|Windows 11|
+|--- |--- |--- |
+|Home|Yes|Yes|
+|Pro|Yes|Yes|
+|Business|Yes|Yes|
+|Enterprise|Yes|Yes|
+|Education|Yes|Yes|
@@ -400,38 +304,14 @@ The following list shows the supported values:
**DeviceLock/DevicePasswordExpiration**
-
-
-
Edition
-
Windows 10
-
Windows 11
-
-
-
Home
-
Yes
-
Yes
-
-
-
Pro
-
Yes
-
Yes
-
-
-
Business
-
Yes
-
Yes
-
-
-
Enterprise
-
Yes
-
Yes
-
-
-
Education
-
Yes
-
Yes
-
-
+
+|Edition|Windows 10|Windows 11|
+|--- |--- |--- |
+|Home|Yes|Yes|
+|Pro|Yes|Yes|
+|Business|Yes|Yes|
+|Enterprise|Yes|Yes|
+|Education|Yes|Yes|
@@ -474,38 +354,14 @@ The following list shows the supported values:
**DeviceLock/DevicePasswordHistory**
-
-
-
Edition
-
Windows 10
-
Windows 11
-
-
-
Home
-
Yes
-
Yes
-
-
-
Pro
-
Yes
-
Yes
-
-
-
Business
-
Yes
-
Yes
-
-
-
Enterprise
-
Yes
-
Yes
-
-
-
Education
-
Yes
-
Yes
-
-
+
+|Edition|Windows 10|Windows 11|
+|--- |--- |--- |
+|Home|Yes|Yes|
+|Pro|Yes|Yes|
+|Business|Yes|Yes|
+|Enterprise|Yes|Yes|
+|Education|Yes|Yes|
@@ -548,38 +404,14 @@ The following list shows the supported values:
**DeviceLock/EnforceLockScreenAndLogonImage**
-
-
-
Edition
-
Windows 10
-
Windows 11
-
-
-
Home
-
Yes
-
Yes
-
-
-
Pro
-
Yes
-
Yes
-
-
-
Business
-
Yes
-
Yes
-
-
-
Enterprise
-
Yes
-
Yes
-
-
-
Education
-
Yes
-
Yes
-
-
+
+|Edition|Windows 10|Windows 11|
+|--- |--- |--- |
+|Home|Yes|Yes|
+|Pro|Yes|Yes|
+|Business|Yes|Yes|
+|Enterprise|Yes|Yes|
+|Education|Yes|Yes|
@@ -612,38 +444,14 @@ Value type is a string, which is the full image filepath and filename.
**DeviceLock/MaxDevicePasswordFailedAttempts**
-
-
-
Edition
-
Windows 10
-
Windows 11
-
-
-
Home
-
Yes
-
Yes
-
-
-
Pro
-
Yes
-
Yes
-
-
-
Business
-
Yes
-
Yes
-
-
-
Enterprise
-
Yes
-
Yes
-
-
-
Education
-
Yes
-
Yes
-
-
+
+|Edition|Windows 10|Windows 11|
+|--- |--- |--- |
+|Home|Yes|Yes|
+|Pro|Yes|Yes|
+|Business|Yes|Yes|
+|Enterprise|Yes|Yes|
+|Education|Yes|Yes|
@@ -693,38 +501,14 @@ The following list shows the supported values:
**DeviceLock/MaxInactivityTimeDeviceLock**
-
-
-
Edition
-
Windows 10
-
Windows 11
-
-
-
Home
-
Yes
-
Yes
-
-
-
Pro
-
Yes
-
Yes
-
-
-
Business
-
Yes
-
Yes
-
-
-
Enterprise
-
Yes
-
Yes
-
-
-
Education
-
Yes
-
Yes
-
-
+
+|Edition|Windows 10|Windows 11|
+|--- |--- |--- |
+|Home|Yes|Yes|
+|Pro|Yes|Yes|
+|Business|Yes|Yes|
+|Enterprise|Yes|Yes|
+|Education|Yes|Yes|
@@ -768,38 +552,14 @@ The following list shows the supported values:
**DeviceLock/MinDevicePasswordComplexCharacters**
-
-
-
Edition
-
Windows 10
-
Windows 11
-
-
-
Home
-
Yes
-
Yes
-
-
-
Pro
-
Yes
-
Yes
-
-
-
Business
-
Yes
-
Yes
-
-
-
Enterprise
-
Yes
-
Yes
-
-
-
Education
-
Yes
-
Yes
-
-
+
+|Edition|Windows 10|Windows 11|
+|--- |--- |--- |
+|Home|Yes|Yes|
+|Pro|Yes|Yes|
+|Business|Yes|Yes|
+|Enterprise|Yes|Yes|
+|Education|Yes|Yes|
@@ -831,43 +591,12 @@ PIN enforces the following behavior for desktop and mobile devices:
The default value is 1. The following list shows the supported values and actual enforced values:
-
-
-
-
-
-
-
-
-
-
Account Type
-
Supported Values
-
Actual Enforced Values
-
-
-
-
-
Mobile
-
1,2,3,4
-
Same as the value set
-
-
-
Desktop Local Accounts
-
1,2,3
-
3
-
-
-
Desktop Microsoft Accounts
-
1,2
-
<p2
-
-
-
Desktop Domain Accounts
-
Not supported
-
Not supported
-
-
-
+|Account Type|Supported Values|Actual Enforced Values|
+|--- |--- |--- |
+|Mobile|1,2,3,4|Same as the value set|
+|Desktop Local Accounts|1,2,3|3|
+|Desktop Microsoft Accounts|1,2|<p2|
+|Desktop Domain Accounts|Not supported|Not supported|
Enforced values for Local and Microsoft Accounts:
@@ -897,38 +626,14 @@ For additional information about this policy, see [Exchange ActiveSync Policy En
**DeviceLock/MinDevicePasswordLength**
-
-
-
Edition
-
Windows 10
-
Windows 11
-
-
-
Home
-
Yes
-
Yes
-
-
-
Pro
-
Yes
-
Yes
-
-
-
Business
-
Yes
-
Yes
-
-
-
Enterprise
-
Yes
-
Yes
-
-
-
Education
-
Yes
-
Yes
-
-
+
+|Edition|Windows 10|Windows 11|
+|--- |--- |--- |
+|Home|Yes|Yes|
+|Pro|Yes|Yes|
+|Business|Yes|Yes|
+|Enterprise|Yes|Yes|
+|Education|Yes|Yes|
@@ -997,38 +702,14 @@ The following example shows how to set the minimum password length to 4 characte
**DeviceLock/MinimumPasswordAge**
-
+
+|Edition|Windows 10|Windows 11|
+|--- |--- |--- |
+|Home|Yes|Yes|
+|Pro|Yes|Yes|
+|Business|Yes|Yes|
+|Enterprise|Yes|Yes|
+|Education|Yes|Yes|
@@ -112,38 +88,14 @@ The following list shows the supported values:
**Education/DefaultPrinterName**
-
-
-
Edition
-
Windows 10
-
Windows 11
-
-
-
Home
-
No
-
No
-
-
-
Pro
-
Yes
-
Yes
-
-
-
Business
-
Yes
-
Yes
-
-
-
Enterprise
-
Yes
-
Yes
-
-
-
Education
-
Yes
-
Yes
-
-
+
+|Edition|Windows 10|Windows 11|
+|--- |--- |--- |
+|Home|No|No|
+|Pro|Yes|Yes|
+|Business|Yes|Yes|
+|Enterprise|Yes|Yes|
+|Education|Yes|Yes|
@@ -172,38 +124,14 @@ The policy value is expected to be the name (network host name) of an installed
**Education/PreventAddingNewPrinters**
-
-
-
Edition
-
Windows 10
-
Windows 11
-
-
-
Home
-
No
-
No
-
-
-
Pro
-
Yes
-
Yes
-
-
-
Business
-
Yes
-
Yes
-
-
-
Enterprise
-
Yes
-
Yes
-
-
-
Education
-
Yes
-
Yes
-
-
+
+|Edition|Windows 10|Windows 11|
+|--- |--- |--- |
+|Home|No|No|
+|Pro|Yes|Yes|
+|Business|Yes|Yes|
+|Enterprise|Yes|Yes|
+|Education|Yes|Yes|
@@ -245,38 +173,14 @@ The following list shows the supported values:
**Education/PrinterNames**
-
+
+|Edition|Windows 10|Windows 11|
+|--- |--- |--- |
+|Home|No|No|
+|Pro|Yes|Yes|
+|Business|Yes|Yes|
+|Enterprise|Yes|Yes|
+|Education|Yes|Yes|
@@ -110,38 +86,14 @@ The default value is an empty string. Otherwise, the value should contain the UR
**EnterpriseCloudPrint/CloudPrintOAuthClientId**
-
-
-
Edition
-
Windows 10
-
Windows 11
-
-
-
Home
-
No
-
No
-
-
-
Pro
-
Yes
-
Yes
-
-
-
Business
-
Yes
-
Yes
-
-
-
Enterprise
-
Yes
-
Yes
-
-
-
Education
-
Yes
-
Yes
-
-
+
+|Edition|Windows 10|Windows 11|
+|--- |--- |--- |
+|Home|No|No|
+|Pro|Yes|Yes|
+|Business|Yes|Yes|
+|Enterprise|Yes|Yes|
+|Education|Yes|Yes|
@@ -171,38 +123,14 @@ The default value is an empty string. Otherwise, the value should contain a GUID
**EnterpriseCloudPrint/CloudPrintResourceId**
-
-
-
Edition
-
Windows 10
-
Windows 11
-
-
-
Home
-
No
-
No
-
-
-
Pro
-
Yes
-
Yes
-
-
-
Business
-
Yes
-
Yes
-
-
-
Enterprise
-
Yes
-
Yes
-
-
-
Education
-
Yes
-
Yes
-
-
+
+|Edition|Windows 10|Windows 11|
+|--- |--- |--- |
+|Home|No|No|
+|Pro|Yes|Yes|
+|Business|Yes|Yes|
+|Enterprise|Yes|Yes|
+|Education|Yes|Yes|
@@ -232,38 +160,14 @@ The default value is an empty string. Otherwise, the value should contain a URL.
**EnterpriseCloudPrint/CloudPrinterDiscoveryEndPoint**
-
-
-
Edition
-
Windows 10
-
Windows 11
-
-
-
Home
-
No
-
No
-
-
-
Pro
-
Yes
-
Yes
-
-
-
Business
-
Yes
-
Yes
-
-
-
Enterprise
-
Yes
-
Yes
-
-
-
Education
-
Yes
-
Yes
-
-
+
+|Edition|Windows 10|Windows 11|
+|--- |--- |--- |
+|Home|No|No|
+|Pro|Yes|Yes|
+|Business|Yes|Yes|
+|Enterprise|Yes|Yes|
+|Education|Yes|Yes|
@@ -293,38 +197,14 @@ The default value is an empty string. Otherwise, the value should contain the UR
**EnterpriseCloudPrint/DiscoveryMaxPrinterLimit**
-
-
-
Edition
-
Windows 10
-
Windows 11
-
-
-
Home
-
No
-
No
-
-
-
Pro
-
Yes
-
Yes
-
-
-
Business
-
Yes
-
Yes
-
-
-
Enterprise
-
Yes
-
Yes
-
-
-
Education
-
Yes
-
Yes
-
-
+
+|Edition|Windows 10|Windows 11|
+|--- |--- |--- |
+|Home|No|No|
+|Pro|Yes|Yes|
+|Business|Yes|Yes|
+|Enterprise|Yes|Yes|
+|Education|Yes|Yes|
@@ -352,38 +232,14 @@ The datatype is an integer.
**EnterpriseCloudPrint/MopriaDiscoveryResourceId**
-
+
+|Edition|Windows 10|Windows 11|
+|--- |--- |--- |
+|Home|No|No|
+|Pro|Yes|Yes|
+|Business|Yes|Yes|
+|Enterprise|Yes|Yes|
+|Education|Yes|Yes|
@@ -561,38 +417,14 @@ The following list shows the supported values:
**Experience/AllowTailoredExperiencesWithDiagnosticData**
-
-
-
Edition
-
Windows 10
-
Windows 11
-
-
-
Home
-
No
-
No
-
-
-
Pro
-
Yes
-
Yes
-
-
-
Business
-
No
-
No
-
-
-
Enterprise
-
Yes
-
Yes
-
-
-
Education
-
Yes
-
Yes
-
-
+
+|Edition|Windows 10|Windows 11|
+|--- |--- |--- |
+|Home|No|No|
+|Pro|Yes|Yes|
+|Business|No|No|
+|Enterprise|Yes|Yes|
+|Education|Yes|Yes|
@@ -643,38 +475,14 @@ The following list shows the supported values:
**Experience/AllowThirdPartySuggestionsInWindowsSpotlight**
-
-
-
Edition
-
Windows 10
-
Windows 11
-
-
-
Home
-
No
-
No
-
-
-
Pro
-
Yes
-
Yes
-
-
-
Business
-
Yes
-
Yes
-
-
-
Enterprise
-
Yes
-
Yes
-
-
-
Education
-
Yes
-
Yes
-
-
+
+|Edition|Windows 10|Windows 11|
+|--- |--- |--- |
+|Home|No|No|
+|Pro|Yes|Yes|
+|Business|Yes|Yes|
+|Enterprise|Yes|Yes|
+|Education|Yes|Yes|
@@ -719,38 +527,14 @@ The following list shows the supported values:
**Experience/AllowWindowsConsumerFeatures**
-
-
-
Edition
-
Windows 10
-
Windows 11
-
-
-
Home
-
No
-
No
-
-
-
Pro
-
No
-
No
-
-
-
Business
-
No
-
No
-
-
-
Enterprise
-
Yes
-
Yes
-
-
-
Education
-
Yes
-
Yes
-
-
+
+|Edition|Windows 10|Windows 11|
+|--- |--- |--- |
+|Home|No|No|
+|Pro|No|No|
+|Business|No|No|
+|Enterprise|Yes|Yes|
+|Education|Yes|Yes|
@@ -798,38 +582,14 @@ The following list shows the supported values:
**Experience/AllowWindowsSpotlight**
-
-
-
Edition
-
Windows 10
-
Windows 11
-
-
-
Home
-
No
-
No
-
-
-
Pro
-
No
-
No
-
-
-
Business
-
No
-
No
-
-
-
Enterprise
-
Yes
-
Yes
-
-
-
Education
-
Yes
-
Yes
-
-
+
+|Edition|Windows 10|Windows 11|
+|--- |--- |--- |
+|Home|No|No|
+|Pro|No|No|
+|Business|No|No|
+|Enterprise|Yes|Yes|
+|Education|Yes|Yes|
@@ -876,38 +636,14 @@ The following list shows the supported values:
**Experience/AllowWindowsSpotlightOnActionCenter**
-
-
-
Edition
-
Windows 10
-
Windows 11
-
-
-
Home
-
No
-
No
-
-
-
Pro
-
No
-
No
-
-
-
Business
-
No
-
No
-
-
-
Enterprise
-
Yes
-
Yes
-
-
-
Education
-
Yes
-
Yes
-
-
+
+|Edition|Windows 10|Windows 11|
+|--- |--- |--- |
+|Home|No|No|
+|Pro|No|No|
+|Business|No|No|
+|Enterprise|Yes|Yes|
+|Education|Yes|Yes|
@@ -953,38 +689,14 @@ The following list shows the supported values:
**Experience/AllowWindowsSpotlightOnSettings**
-
-
-
Edition
-
Windows 10
-
Windows 11
-
-
-
Home
-
No
-
No
-
-
-
Pro
-
No
-
No
-
-
-
Business
-
No
-
No
-
-
-
Enterprise
-
Yes
-
Yes
-
-
-
Education
-
Yes
-
Yes
-
-
+
+|Edition|Windows 10|Windows 11|
+|--- |--- |--- |
+|Home|No|No|
+|Pro|No|No|
+|Business|No|No|
+|Enterprise|Yes|Yes|
+|Education|Yes|Yes|
@@ -1029,38 +741,14 @@ The following list shows the supported values:
**Experience/AllowWindowsSpotlightWindowsWelcomeExperience**
-
-
-
Edition
-
Windows 10
-
Windows 11
-
-
-
Home
-
No
-
No
-
-
-
Pro
-
No
-
No
-
-
-
Business
-
No
-
No
-
-
-
Enterprise
-
Yes
-
Yes
-
-
-
Education
-
Yes
-
Yes
-
-
+
+|Edition|Windows 10|Windows 11|
+|--- |--- |--- |
+|Home|No|No|
+|Pro|No|No|
+|Business|No|No|
+|Enterprise|Yes|Yes|
+|Education|Yes|Yes|
@@ -1107,38 +795,14 @@ The following list shows the supported values:
**Experience/AllowWindowsTips**
-
-
-
Edition
-
Windows 10
-
Windows 11
-
-
-
Home
-
No
-
No
-
-
-
Pro
-
No
-
No
-
-
-
Business
-
No
-
No
-
-
-
Enterprise
-
Yes
-
Yes
-
-
-
Education
-
Yes
-
Yes
-
-
+
+|Edition|Windows 10|Windows 11|
+|--- |--- |--- |
+|Home|No|No|
+|Pro|No|No|
+|Business|No|No|
+|Enterprise|Yes|Yes|
+|Education|Yes|Yes|
@@ -1179,38 +843,14 @@ The following list shows the supported values:
**Experience/ConfigureChatIcon**
-
-
-
Edition
-
Windows 10
-
Windows 11
-
-
-
Home
-
No
-
No
-
-
-
Pro
-
No
-
No
-
-
-
Business
-
No
-
No
-
-
-
Enterprise
-
No
-
Yes
-
-
-
Education
-
No
-
Yes
-
-
+
+|Edition|Windows 10|Windows 11|
+|--- |--- |--- |
+|Home|No|Yes|
+|Pro|No|Yes|
+|Business|No|No|
+|Enterprise|No|Yes|
+|Education|No|Yes|
@@ -1234,6 +874,9 @@ The values for this policy are 0, 1, 2, and 3. This policy defaults to 0 if not
- 2 - Hide: The Chat icon will be hidden by default. Users can show or hide it in Settings.
- 3 - Disabled: The Chat icon will not be displayed, and users cannot show or hide it in Settings.
+> [!NOTE]
+> Option 1 (Show) and Option 2 (Hide) only work on the first sign-in attempt. Option 3 (Disabled) works on all attempts.
+
@@ -1243,38 +886,14 @@ The values for this policy are 0, 1, 2, and 3. This policy defaults to 0 if not
**Experience/ConfigureWindowsSpotlightOnLockScreen**
-
-
-
Edition
-
Windows 10
-
Windows 11
-
-
-
Home
-
No
-
No
-
-
-
Pro
-
No
-
No
-
-
-
Business
-
No
-
No
-
-
-
Enterprise
-
Yes
-
Yes
-
-
-
Education
-
Yes
-
Yes
-
-
+
+|Edition|Windows 10|Windows 11|
+|--- |--- |--- |
+|Home|No|No|
+|Pro|No|No|
+|Business|No|No|
+|Enterprise|Yes|Yes|
+|Education|Yes|Yes|
@@ -1318,38 +937,14 @@ The following list shows the supported values:
**Experience/DisableCloudOptimizedContent**
-
-
-
Edition
-
Windows 10
-
Windows 11
-
-
-
Home
-
Yes
-
Yes
-
-
-
Pro
-
Yes
-
Yes
-
-
-
Business
-
Yes
-
Yes
-
-
-
Enterprise
-
Yes
-
Yes
-
-
-
Education
-
Yes
-
Yes
-
-
+
+|Edition|Windows 10|Windows 11|
+|--- |--- |--- |
+|Home|Yes|Yes|
+|Pro|Yes|Yes|
+|Business|Yes|Yes|
+|Enterprise|Yes|Yes|
+|Education|Yes|Yes|
@@ -1394,38 +989,14 @@ The following list shows the supported values:
**Experience/DoNotShowFeedbackNotifications**
-
-
-
Edition
-
Windows 10
-
Windows 11
-
-
-
Home
-
No
-
No
-
-
-
Pro
-
Yes
-
Yes
-
-
-
Business
-
Yes
-
Yes
-
-
-
Enterprise
-
Yes
-
Yes
-
-
-
Education
-
Yes
-
Yes
-
-
+
+|Edition|Windows 10|Windows 11|
+|--- |--- |--- |
+|Home|No|No|
+|Pro|Yes|Yes|
+|Business|Yes|Yes|
+|Enterprise|Yes|Yes|
+|Education|Yes|Yes|
@@ -1470,38 +1041,14 @@ The following list shows the supported values:
**Experience/DoNotSyncBrowserSettings**
-
-
-
Edition
-
Windows 10
-
Windows 11
-
-
-
Home
-
No
-
No
-
-
-
Pro
-
No
-
No
-
-
-
Business
-
No
-
No
-
-
-
Enterprise
-
Yes
-
Yes
-
-
-
Education
-
Yes
-
Yes
-
-
+
+|Edition|Windows 10|Windows 11|
+|--- |--- |--- |
+|Home|No|No|
+|Pro|No|No|
+|Business|No|No|
+|Enterprise|Yes|Yes|
+|Education|Yes|Yes|
@@ -1568,38 +1115,14 @@ _**Turn syncing off by default but don’t disable**_
**Experience/PreventUsersFromTurningOnBrowserSyncing**
-
+
+|Edition|Windows 10|Windows 11|
+|--- |--- |--- |
+|Home|No|No|
+|Pro|Yes|Yes|
+|Business|Yes|Yes|
+|Enterprise|Yes|Yes|
+|Education|Yes|Yes|
diff --git a/windows/client-management/mdm/policy-csp-kioskbrowser.md b/windows/client-management/mdm/policy-csp-kioskbrowser.md
index 76dcd8f06b..4dfe60a594 100644
--- a/windows/client-management/mdm/policy-csp-kioskbrowser.md
+++ b/windows/client-management/mdm/policy-csp-kioskbrowser.md
@@ -5,7 +5,7 @@ ms.author: dansimp
ms.topic: article
ms.prod: w10
ms.technology: windows
-author: manikadhiman
+author: dansimp
ms.localizationpriority: medium
ms.date: 09/27/2019
ms.reviewer:
@@ -55,38 +55,14 @@ These policies currently only apply to Kiosk Browser app. Kiosk Browser is a Mic
**KioskBrowser/BlockedUrlExceptions**
-
-
-
Edition
-
Windows 10
-
Windows 11
-
-
-
Home
-
No
-
No
-
-
-
Pro
-
Yes
-
Yes
-
-
-
Business
-
Yes
-
Yes
-
-
-
Enterprise
-
Yes
-
Yes
-
-
-
Education
-
Yes
-
Yes
-
-
+
+|Edition|Windows 10|Windows 11|
+|--- |--- |--- |
+|Home|No|No|
+|Pro|Yes|Yes|
+|Business|Yes|Yes|
+|Enterprise|Yes|Yes|
+|Education|Yes|Yes|
@@ -115,38 +91,14 @@ List of exceptions to the blocked website URLs (with wildcard support). This is
**KioskBrowser/BlockedUrls**
-
-
-
Edition
-
Windows 10
-
Windows 11
-
-
-
Home
-
No
-
No
-
-
-
Pro
-
Yes
-
Yes
-
-
-
Business
-
Yes
-
Yes
-
-
-
Enterprise
-
Yes
-
Yes
-
-
-
Education
-
Yes
-
Yes
-
-
+
+|Edition|Windows 10|Windows 11|
+|--- |--- |--- |
+|Home|No|No|
+|Pro|Yes|Yes|
+|Business|Yes|Yes|
+|Enterprise|Yes|Yes|
+|Education|Yes|Yes|
@@ -175,38 +127,14 @@ List of blocked website URLs (with wildcard support). This is used to configure
**KioskBrowser/DefaultURL**
-
-
-
Edition
-
Windows 10
-
Windows 11
-
-
-
Home
-
No
-
No
-
-
-
Pro
-
Yes
-
Yes
-
-
-
Business
-
Yes
-
Yes
-
-
-
Enterprise
-
Yes
-
Yes
-
-
-
Education
-
Yes
-
Yes
-
-
+
+|Edition|Windows 10|Windows 11|
+|--- |--- |--- |
+|Home|No|No|
+|Pro|Yes|Yes|
+|Business|Yes|Yes|
+|Enterprise|Yes|Yes|
+|Education|Yes|Yes|
@@ -235,38 +163,14 @@ Configures the default URL kiosk browsers to navigate on launch and restart.
**KioskBrowser/EnableEndSessionButton**
-
-
-
Edition
-
Windows 10
-
Windows 11
-
-
-
Home
-
No
-
No
-
-
-
Pro
-
Yes
-
Yes
-
-
-
Business
-
Yes
-
Yes
-
-
-
Enterprise
-
Yes
-
Yes
-
-
-
Education
-
Yes
-
Yes
-
-
+
+|Edition|Windows 10|Windows 11|
+|--- |--- |--- |
+|Home|No|No|
+|Pro|Yes|Yes|
+|Business|Yes|Yes|
+|Enterprise|Yes|Yes|
+|Education|Yes|Yes|
@@ -292,38 +196,14 @@ Shows the Kiosk Browser's end session button. When the policy is enabled, the Ki
**KioskBrowser/EnableHomeButton**
-
+
+|Edition|Windows 10|Windows 11|
+|--- |--- |--- |
+|Home|No|No|
+|Pro|Yes|Yes|
+|Business|Yes|Yes|
+|Enterprise|Yes|Yes|
+|Education|Yes|Yes|
@@ -1131,38 +871,14 @@ Valid values: From 0 to 599940, where the value is the amount of inactivity time
**LocalPoliciesSecurityOptions/InteractiveLogon_MessageTextForUsersAttemptingToLogOn**
-
+
+|Edition|Windows 10|Windows 11|
+|--- |--- |--- |
+|Home|No|No|
+|Pro|Yes|Yes|
+|Business|Yes|Yes|
+|Enterprise|Yes|Yes|
+|Education|Yes|Yes|
@@ -3564,7 +2536,7 @@ The options are:
- 0 - Disabled: Admin Approval Mode and all related UAC policy settings are disabled.
> [!NOTE]
- > If this policy setting is disabled, the Security Center notifies you that the overall security of the operating system has been reduced.
+ > If this policy setting is disabled, Windows Security notifies you that the overall security of the operating system has been reduced.
- 1 - Enabled: (Default) Admin Approval Mode is enabled. This policy must be enabled and related UAC policy settings must also be set appropriately to allow the built-in Administrator account and all other users who are members of the Administrators group to run in Admin Approval Mode.
@@ -3586,38 +2558,14 @@ GP Info:
**LocalPoliciesSecurityOptions/UserAccountControl_SwitchToTheSecureDesktopWhenPromptingForElevation**
-
+
+|Windows Edition|Supported|
+|--- |--- |
+|HoloLens (1st gen) Development Edition|No|
+|HoloLens (1st gen) Commercial Suite|No|
+|HoloLens 2|Yes|
Steps to use this policy correctly:
@@ -86,24 +74,12 @@ Steps to use this policy correctly:
**MixedReality/AutoLogonUser**
-
-
-
Windows Edition
-
Supported?
-
-
-
HoloLens (1st gen) Development Edition
-
❌
-
-
-
HoloLens (1st gen) Commercial Suite
-
❌
-
-
-
HoloLens 2
-
✔️
-
-
+
+|Windows Edition|Supported|
+|--- |--- |
+|HoloLens (1st gen) Development Edition|No|
+|HoloLens (1st gen) Commercial Suite|No|
+|HoloLens 2|Yes|
This new AutoLogonUser policy controls whether a user will be automatically logged on. Some customers want to set up devices that are tied to an identity but don't want any sign in experience. Imagine picking up a device and using remote assist immediately. Or have a benefit of being able to rapidly distribute HoloLens devices and enable their end users to speed up login.
@@ -154,24 +130,12 @@ Supported values are 0-60. The default value is 0 (day) and maximum value is 60
**MixedReality/BrightnessButtonDisabled**
-
-
-
Windows Edition
-
Supported?
-
-
-
HoloLens (1st gen) Development Edition
-
❌
-
-
-
HoloLens (1st gen) Commercial Suite
-
❌
-
-
-
HoloLens 2
-
✔️
-
-
+
+|Windows Edition|Supported|
+|--- |--- |
+|HoloLens (1st gen) Development Edition|No|
+|HoloLens (1st gen) Commercial Suite|No|
+|HoloLens 2|Yes|
@@ -207,24 +171,12 @@ The following list shows the supported values:
**MixedReality/FallbackDiagnostics**
-
-
-
Windows Edition
-
Supported?
-
-
-
HoloLens (1st gen) Development Edition
-
❌
-
-
-
HoloLens (1st gen) Commercial Suite
-
❌
-
-
-
HoloLens 2
-
✔️
-
-
+
+|Windows Edition|Supported|
+|--- |--- |
+|HoloLens (1st gen) Development Edition|No|
+|HoloLens (1st gen) Commercial Suite|No|
+|HoloLens 2|Yes|
@@ -261,24 +213,12 @@ The following list shows the supported values:
**MixedReality/MicrophoneDisabled**
-
-
-
Windows Edition
-
Supported?
-
-
-
HoloLens (1st gen) Development Edition
-
❌
-
-
-
HoloLens (1st gen) Commercial Suite
-
❌
-
-
-
HoloLens 2
-
✔️
-
-
+
+|Windows Edition|Supported|
+|--- |--- |
+|HoloLens (1st gen) Development Edition|No|
+|HoloLens (1st gen) Commercial Suite|No|
+|HoloLens 2|Yes|
@@ -314,24 +254,12 @@ The following list shows the supported values:
**MixedReality/VolumeButtonDisabled**
-
+
+|Edition|Windows 10|Windows 11|
+|--- |--- |--- |
+|Home|No|No|
+|Pro|No|No|
+|Business|No|No|
+|Enterprise|Yes|Yes|
+|Education|Yes|Yes|
@@ -82,7 +58,15 @@ manager: dansimp
-This policy setting provides the list of URLs (separated by Unicode character 0xF000) to endpoints accessible only within an enterprise's network. If any of the URLs can be resolved over HTTPS, the network would be considered authenticated.
+This policy setting provides the list of URLs (separated by Unicode character 0xF000) to endpoints accessible only within an enterprise's network. If any of the URLs can be resolved over HTTPS, the network would be considered authenticated.
+
+When entering a list of TLS endpoints in Microsoft Endpoint Manager, you must follow this format, even in the UI:
+``````
+- The HTTPS endpoint must not have any additional authentication checks, such as login or multifactor authentication.
+- The HTTPS endpoint must be an internal address not accessible from outside the corporate network.
+- The client must trust the server certificate, so the CA certificate that the HTTPS server certificate chains to must be present in the client machine's root certificate store.
+- A certificate should not be a public certificate.
+
@@ -93,38 +77,14 @@ This policy setting provides the list of URLs (separated by Unicode character 0x
**NetworkListManager/ConfiguredTLSAuthenticationNetworkName**
-
-
-
Edition
-
Windows 10
-
Windows 11
-
-
-
Home
-
No
-
No
-
-
-
Pro
-
No
-
No
-
-
-
Business
-
No
-
No
-
-
-
Enterprise
-
Yes
-
Yes
-
-
-
Education
-
Yes
-
Yes
-
-
+
+|Edition|Windows 10|Windows 11|
+|--- |--- |--- |
+|Home|No|No|
+|Pro|No|No|
+|Business|No|No|
+|Enterprise|Yes|Yes|
+|Education|Yes|Yes|
@@ -139,7 +99,7 @@ This policy setting provides the list of URLs (separated by Unicode character 0x
-This policy setting provides the string to be used to name the network authenticated against one of the endpoints listed in NetworkListManager/AllowedTlsAuthenticationEndpoints policy.
+This policy setting provides the string to be used to name the network authenticated against one of the endpoints listed in NetworkListManager/AllowedTlsAuthenticationEndpoints policy. If this setting is used for Trusted Network Detection in an Always On VPN profile, it must be the DNS suffix configured in the TrustedNetworkDetection attribute.
diff --git a/windows/client-management/mdm/policy-csp-notifications.md b/windows/client-management/mdm/policy-csp-notifications.md
index 643ef3e681..4a19dd5b07 100644
--- a/windows/client-management/mdm/policy-csp-notifications.md
+++ b/windows/client-management/mdm/policy-csp-notifications.md
@@ -5,7 +5,7 @@ ms.author: dansimp
ms.topic: article
ms.prod: w10
ms.technology: windows
-author: manikadhiman
+author: dansimp
ms.localizationpriority: medium
ms.date: 09/27/2019
ms.reviewer:
@@ -40,38 +40,14 @@ manager: dansimp
**Notifications/DisallowCloudNotification**
-
+
+|Edition|Windows 10|Windows 11|
+|--- |--- |--- |
+|Home|No|No|
+|Pro|Yes|Yes|
+|Business|Yes|Yes|
+|Enterprise|Yes|Yes|
+|Education|Yes|Yes|
@@ -917,38 +653,14 @@ The following are the supported lid close switch actions (on battery):
**Power/SelectLidCloseActionPluggedIn**
-
-
-
Edition
-
Windows 10
-
Windows 11
-
-
-
Home
-
No
-
No
-
-
-
Pro
-
Yes
-
Yes
-
-
-
Business
-
Yes
-
Yes
-
-
-
Enterprise
-
Yes
-
Yes
-
-
-
Education
-
Yes
-
Yes
-
-
+
+|Edition|Windows 10|Windows 11|
+|--- |--- |--- |
+|Home|No|No|
+|Pro|Yes|Yes|
+|Business|Yes|Yes|
+|Enterprise|Yes|Yes|
+|Education|Yes|Yes|
@@ -1002,38 +714,14 @@ The following are the supported lid close switch actions (plugged in):
**Power/SelectPowerButtonActionOnBattery**
-
-
-
Edition
-
Windows 10
-
Windows 11
-
-
-
Home
-
No
-
No
-
-
-
Pro
-
Yes
-
Yes
-
-
-
Business
-
Yes
-
Yes
-
-
-
Enterprise
-
Yes
-
Yes
-
-
-
Education
-
Yes
-
Yes
-
-
+
+|Edition|Windows 10|Windows 11|
+|--- |--- |--- |
+|Home|No|No|
+|Pro|Yes|Yes|
+|Business|Yes|Yes|
+|Enterprise|Yes|Yes|
+|Education|Yes|Yes|
@@ -1087,38 +775,14 @@ The following are the supported Power button actions (on battery):
**Power/SelectPowerButtonActionPluggedIn**
-
-
-
Edition
-
Windows 10
-
Windows 11
-
-
-
Home
-
No
-
No
-
-
-
Pro
-
Yes
-
Yes
-
-
-
Business
-
Yes
-
Yes
-
-
-
Enterprise
-
Yes
-
Yes
-
-
-
Education
-
Yes
-
Yes
-
-
+
+|Edition|Windows 10|Windows 11|
+|--- |--- |--- |
+|Home|No|No|
+|Pro|Yes|Yes|
+|Business|Yes|Yes|
+|Enterprise|Yes|Yes|
+|Education|Yes|Yes|
@@ -1172,38 +836,14 @@ The following are the supported Power button actions (plugged in):
**Power/SelectSleepButtonActionOnBattery**
-
-
-
Edition
-
Windows 10
-
Windows 11
-
-
-
Home
-
No
-
No
-
-
-
Pro
-
Yes
-
Yes
-
-
-
Business
-
Yes
-
Yes
-
-
-
Enterprise
-
Yes
-
Yes
-
-
-
Education
-
Yes
-
Yes
-
-
+
+|Edition|Windows 10|Windows 11|
+|--- |--- |--- |
+|Home|No|No|
+|Pro|Yes|Yes|
+|Business|Yes|Yes|
+|Enterprise|Yes|Yes|
+|Education|Yes|Yes|
@@ -1257,38 +897,14 @@ The following are the supported Sleep button actions (on battery):
**Power/SelectSleepButtonActionPluggedIn**
-
-
-
Edition
-
Windows 10
-
Windows 11
-
-
-
Home
-
No
-
No
-
-
-
Pro
-
Yes
-
Yes
-
-
-
Business
-
Yes
-
Yes
-
-
-
Enterprise
-
Yes
-
Yes
-
-
-
Education
-
Yes
-
Yes
-
-
+
+|Edition|Windows 10|Windows 11|
+|--- |--- |--- |
+|Home|No|No|
+|Pro|Yes|Yes|
+|Business|Yes|Yes|
+|Enterprise|Yes|Yes|
+|Education|Yes|Yes|
@@ -1342,38 +958,14 @@ The following are the supported Sleep button actions (plugged in):
**Power/StandbyTimeoutOnBattery**
-
+
+|Edition|Windows 10|Windows 11|
+|--- |--- |--- |
+|Home|No|No|
+|Pro|Yes|Yes|
+|Business|Yes|Yes|
+|Enterprise|Yes|Yes|
+|Education|Yes|Yes|
@@ -1568,38 +1112,14 @@ The following are the supported values for Hybrid sleep (on battery):
**Power/TurnOffHybridSleepPluggedIn**
-
-
-
Edition
-
Windows 10
-
Windows 11
-
-
-
Home
-
No
-
No
-
-
-
Pro
-
Yes
-
Yes
-
-
-
Business
-
Yes
-
Yes
-
-
-
Enterprise
-
Yes
-
Yes
-
-
-
Education
-
Yes
-
Yes
-
-
+
+|Edition|Windows 10|Windows 11|
+|--- |--- |--- |
+|Home|No|No|
+|Pro|Yes|Yes|
+|Business|Yes|Yes|
+|Enterprise|Yes|Yes|
+|Education|Yes|Yes|
@@ -1650,38 +1170,14 @@ The following are the supported values for Hybrid sleep (plugged in):
**Power/UnattendedSleepTimeoutOnBattery**
-
-
-
Edition
-
Windows 10
-
Windows 11
-
-
-
Home
-
No
-
No
-
-
-
Pro
-
Yes
-
Yes
-
-
-
Business
-
Yes
-
Yes
-
-
-
Enterprise
-
Yes
-
Yes
-
-
-
Education
-
Yes
-
Yes
-
-
+
+|Edition|Windows 10|Windows 11|
+|--- |--- |--- |
+|Home|No|No|
+|Pro|Yes|Yes|
+|Business|Yes|Yes|
+|Enterprise|Yes|Yes|
+|Education|Yes|Yes|
@@ -1732,38 +1228,14 @@ Default value for unattended sleep timeout (on battery):
**Power/UnattendedSleepTimeoutPluggedIn**
-
+
+|Edition|Windows 10|Windows 11|
+|--- |--- |--- |
+|Home|Yes|Yes|
+|Pro|Yes|Yes|
+|Business|Yes|Yes|
+|Enterprise|Yes|Yes|
+|Education|Yes|Yes|
@@ -2756,38 +1916,14 @@ This policy setting specifies whether Windows apps can access the eye tracker.
**Privacy/LetAppsAccessGazeInput_ForceAllowTheseApps**
-
-
-
Edition
-
Windows 10
-
Windows 11
-
-
-
Home
-
Yes
-
Yes
-
-
-
Pro
-
Yes
-
Yes
-
-
-
Business
-
Yes
-
Yes
-
-
-
Enterprise
-
Yes
-
Yes
-
-
-
Education
-
Yes
-
Yes
-
-
+
+|Edition|Windows 10|Windows 11|
+|--- |--- |--- |
+|Home|Yes|Yes|
+|Pro|Yes|Yes|
+|Business|Yes|Yes|
+|Enterprise|Yes|Yes|
+|Education|Yes|Yes|
@@ -2813,38 +1949,14 @@ List of semi-colon delimited Package Family Names of Windows Store Apps. Listed
**Privacy/LetAppsAccessGazeInput_ForceDenyTheseApps**
-
-
-
Edition
-
Windows 10
-
Windows 11
-
-
-
Home
-
Yes
-
Yes
-
-
-
Pro
-
Yes
-
Yes
-
-
-
Business
-
Yes
-
Yes
-
-
-
Enterprise
-
Yes
-
Yes
-
-
-
Education
-
Yes
-
Yes
-
-
+
+|Edition|Windows 10|Windows 11|
+|--- |--- |--- |
+|Home|Yes|Yes|
+|Pro|Yes|Yes|
+|Business|Yes|Yes|
+|Enterprise|Yes|Yes|
+|Education|Yes|Yes|
@@ -2870,38 +1982,14 @@ List of semi-colon delimited Package Family Names of Windows Store Apps. Listed
**Privacy/LetAppsAccessGazeInput_UserInControlOfTheseApps**
-
-
-
Edition
-
Windows 10
-
Windows 11
-
-
-
Home
-
Yes
-
Yes
-
-
-
Pro
-
Yes
-
Yes
-
-
-
Business
-
Yes
-
Yes
-
-
-
Enterprise
-
Yes
-
Yes
-
-
-
Education
-
Yes
-
Yes
-
-
+
+|Edition|Windows 10|Windows 11|
+|--- |--- |--- |
+|Home|Yes|Yes|
+|Pro|Yes|Yes|
+|Business|Yes|Yes|
+|Enterprise|Yes|Yes|
+|Education|Yes|Yes|
@@ -2927,38 +2015,14 @@ List of semi-colon delimited Package Family Names of Windows Store Apps. The use
**Privacy/LetAppsAccessLocation**
-
-
-
Edition
-
Windows 10
-
Windows 11
-
-
-
Home
-
Yes
-
Yes
-
-
-
Pro
-
Yes
-
Yes
-
-
-
Business
-
Yes
-
Yes
-
-
-
Enterprise
-
Yes
-
Yes
-
-
-
Education
-
Yes
-
Yes
-
-
+
+|Edition|Windows 10|Windows 11|
+|--- |--- |--- |
+|Home|Yes|Yes|
+|Pro|Yes|Yes|
+|Business|Yes|Yes|
+|Enterprise|Yes|Yes|
+|Education|Yes|Yes|
@@ -3004,38 +2068,14 @@ The following list shows the supported values:
**Privacy/LetAppsAccessLocation_ForceAllowTheseApps**
-
+
+|Edition|Windows 10|Windows 11|
+|--- |--- |--- |
+|Home|No|No|
+|Pro|No|No|
+|Business|Yes|Yes|
+|Enterprise|Yes|Yes|
+|Education|Yes|Yes|
@@ -82,7 +58,7 @@ This policy setting enables process mitigation options on svchost.exe processes.
If you enable this policy setting, built-in system services hosted in svchost.exe processes will have stricter security policies enabled on them.
-This includes a policy requiring all binaries loaded in these processes to be signed by Microsoft, as well as a policy disallowing dynamically-generated code.
+This includes a policy requiring all binaries loaded in these processes to be signed by Microsoft, and a policy disallowing dynamically generated code.
> [!IMPORTANT]
> Enabling this policy could cause compatibility issues with third-party software that uses svchost.exe processes (for example, third-party antivirus software).
@@ -107,8 +83,8 @@ ADMX Info:
Supported values:
-- disabled - Do not add ACG/CIG enforcement and other process mitigation/code integrity policies to SVCHOST processes.
-- enabled - Add ACG/CIG enforcement and other process mitigation/code integrity policies to SVCHOST processes.
+- Disabled - Do not add ACG/CIG enforcement and other process mitigation/code integrity policies to SVCHOST processes.
+- Enabled - Add ACG/CIG enforcement and other process mitigation/code integrity policies to SVCHOST processes.
diff --git a/windows/client-management/mdm/policy-csp-settings.md b/windows/client-management/mdm/policy-csp-settings.md
index 69c7b52c83..3648f9e658 100644
--- a/windows/client-management/mdm/policy-csp-settings.md
+++ b/windows/client-management/mdm/policy-csp-settings.md
@@ -5,7 +5,7 @@ ms.author: dansimp
ms.topic: article
ms.prod: w10
ms.technology: windows
-author: manikadhiman
+author: dansimp
ms.localizationpriority: medium
ms.date: 09/27/2019
ms.reviewer:
@@ -68,38 +68,14 @@ manager: dansimp
**Settings/AllowAutoPlay**
-
-
-
Edition
-
Windows 10
-
Windows 11
-
-
-
Home
-
No
-
No
-
-
-
Pro
-
Yes
-
Yes
-
-
-
Business
-
Yes
-
Yes
-
-
-
Enterprise
-
Yes
-
Yes
-
-
-
Education
-
Yes
-
Yes
-
-
+
+|Edition|Windows 10|Windows 11|
+|--- |--- |--- |
+|Home|No|No|
+|Pro|Yes|Yes|
+|Business|Yes|Yes|
+|Enterprise|Yes|Yes|
+|Education|Yes|Yes|
@@ -139,38 +115,14 @@ The following list shows the supported values:
**Settings/AllowDataSense**
-
-
-
Edition
-
Windows 10
-
Windows 11
-
-
-
Home
-
No
-
No
-
-
-
Pro
-
Yes
-
Yes
-
-
-
Business
-
Yes
-
Yes
-
-
-
Enterprise
-
Yes
-
Yes
-
-
-
Education
-
Yes
-
Yes
-
-
+
+|Edition|Windows 10|Windows 11|
+|--- |--- |--- |
+|Home|No|No|
+|Pro|Yes|Yes|
+|Business|Yes|Yes|
+|Enterprise|Yes|Yes|
+|Education|Yes|Yes|
@@ -206,38 +158,14 @@ The following list shows the supported values:
**Settings/AllowDateTime**
-
-
-
Edition
-
Windows 10
-
Windows 11
-
-
-
Home
-
No
-
No
-
-
-
Pro
-
Yes
-
Yes
-
-
-
Business
-
Yes
-
Yes
-
-
-
Enterprise
-
Yes
-
Yes
-
-
-
Education
-
Yes
-
Yes
-
-
+
+|Edition|Windows 10|Windows 11|
+|--- |--- |--- |
+|Home|No|No|
+|Pro|Yes|Yes|
+|Business|Yes|Yes|
+|Enterprise|Yes|Yes|
+|Education|Yes|Yes|
@@ -270,38 +198,14 @@ The following list shows the supported values:
**Settings/AllowLanguage**
-
-
-
Edition
-
Windows 10
-
Windows 11
-
-
-
Home
-
No
-
No
-
-
-
Pro
-
Yes
-
Yes
-
-
-
Business
-
Yes
-
Yes
-
-
-
Enterprise
-
Yes
-
Yes
-
-
-
Education
-
Yes
-
Yes
-
-
+
+|Edition|Windows 10|Windows 11|
+|--- |--- |--- |
+|Home|No|No|
+|Pro|Yes|Yes|
+|Business|Yes|Yes|
+|Enterprise|Yes|Yes|
+|Education|Yes|Yes|
@@ -338,38 +242,14 @@ The following list shows the supported values:
**Settings/AllowOnlineTips**
-
+
+|Edition|Windows 10|Windows 11|
+|--- |--- |--- |
+|Home|No|No|
+|Pro|Yes|Yes|
+|Enterprise|Yes|Yes|
+|Education|Yes|Yes|
@@ -185,33 +171,13 @@ The following list shows the supported values:
**System/AllowCommercialDataPipeline**
-
-
-
Edition
-
Windows 10
-
Windows 11
-
-
-
Home
-
No
-
No
-
-
-
Pro
-
Yes
-
Yes
-
-
-
Enterprise
-
Yes
-
Yes
-
-
-
Education
-
Yes
-
Yes
-
-
+
+|Edition|Windows 10|Windows 11|
+|--- |--- |--- |
+|Home|No|No|
+|Pro|Yes|Yes|
+|Enterprise|Yes|Yes|
+|Education|Yes|Yes|
@@ -302,33 +268,13 @@ The following list shows the supported values:
**System/AllowDeviceNameInDiagnosticData**
-
-
-
Edition
-
Windows 10
-
Windows 11
-
-
-
Home
-
No
-
No
-
-
-
Pro
-
Yes
-
Yes
-
-
-
Enterprise
-
Yes
-
Yes
-
-
-
Education
-
Yes
-
Yes
-
-
+
+|Edition|Windows 10|Windows 11|
+|--- |--- |--- |
+|Home|No|No|
+|Pro|Yes|Yes|
+|Enterprise|Yes|Yes|
+|Education|Yes|Yes|
@@ -376,33 +322,13 @@ The following list shows the supported values:
**System/AllowEmbeddedMode**
-
-
-
Edition
-
Windows 10
-
Windows 11
-
-
-
Home
-
No
-
No
-
-
-
Pro
-
Yes
-
Yes
-
-
-
Enterprise
-
Yes
-
Yes
-
-
-
Education
-
Yes
-
Yes
-
-
+
+|Edition|Windows 10|Windows 11|
+|--- |--- |--- |
+|Home|No|No|
+|Pro|Yes|Yes|
+|Enterprise|Yes|Yes|
+|Education|Yes|Yes|
@@ -437,33 +363,13 @@ The following list shows the supported values:
**System/AllowExperimentation**
-
-
-
Edition
-
Windows 10
-
Windows 11
-
-
-
Home
-
No
-
No
-
-
-
Pro
-
Yes
-
Yes
-
-
-
Enterprise
-
Yes
-
Yes
-
-
-
Education
-
Yes
-
Yes
-
-
+
+|Edition|Windows 10|Windows 11|
+|--- |--- |--- |
+|Home|No|No|
+|Pro|Yes|Yes|
+|Enterprise|Yes|Yes|
+|Education|Yes|Yes|
@@ -503,33 +409,13 @@ The following list shows the supported values:
**System/AllowFontProviders**
-
-
-
Edition
-
Windows 10
-
Windows 11
-
-
-
Home
-
No
-
No
-
-
-
Pro
-
Yes
-
Yes
-
-
-
Enterprise
-
Yes
-
Yes
-
-
-
Education
-
Yes
-
Yes
-
-
+
+|Edition|Windows 10|Windows 11|
+|--- |--- |--- |
+|Home|No|No|
+|Pro|Yes|Yes|
+|Enterprise|Yes|Yes|
+|Education|Yes|Yes|
@@ -583,33 +469,13 @@ To verify if System/AllowFontProviders is set to true:
**System/AllowLocation**
-
-
-
Edition
-
Windows 10
-
Windows 11
-
-
-
Home
-
No
-
No
-
-
-
Pro
-
Yes
-
Yes
-
-
-
Enterprise
-
Yes
-
Yes
-
-
-
Education
-
Yes
-
Yes
-
-
+
+|Edition|Windows 10|Windows 11|
+|--- |--- |--- |
+|Home|No|No|
+|Pro|Yes|Yes|
+|Enterprise|Yes|Yes|
+|Education|Yes|Yes|
@@ -680,33 +546,13 @@ If you disable this policy setting, devices may not appear in Microsoft Managed
**System/AllowStorageCard**
-
-
-
Edition
-
Windows 10
-
Windows 11
-
-
-
Home
-
No
-
No
-
-
-
Pro
-
Yes
-
Yes
-
-
-
Enterprise
-
Yes
-
Yes
-
-
-
Education
-
Yes
-
Yes
-
-
+
+|Edition|Windows 10|Windows 11|
+|--- |--- |--- |
+|Home|No|No|
+|Pro|Yes|Yes|
+|Enterprise|Yes|Yes|
+|Education|Yes|Yes|
@@ -741,33 +587,13 @@ The following list shows the supported values:
**System/AllowTelemetry**
-
-
-
Edition
-
Windows 10
-
Windows 11
-
-
-
Home
-
No
-
No
-
-
-
Pro
-
Yes
-
Yes
-
-
-
Enterprise
-
Yes
-
Yes
-
-
-
Education
-
Yes
-
Yes
-
-
+
+|Edition|Windows 10|Windows 11|
+|--- |--- |--- |
+|Home|No|No|
+|Pro|Yes|Yes|
+|Enterprise|Yes|Yes|
+|Education|Yes|Yes|
@@ -792,28 +618,6 @@ The following list shows the supported values for Windows 8.1:
- 1 – Allowed, except for Secondary Data Requests.
- 2 (default) – Allowed.
-
In Windows 10, you can configure this policy setting to decide what level of diagnostic data to send to Microsoft.
@@ -835,35 +639,6 @@ The following list shows the supported values for Windows 10 version 1809 and ol
Most restrictive value is 0.
-
-
ADMX Info:
@@ -882,33 +657,13 @@ ADMX Info:
**System/AllowUpdateComplianceProcessing**
-
-
-
Edition
-
Windows 10
-
Windows 11
-
-
-
Home
-
No
-
No
-
-
-
Pro
-
Yes
-
Yes
-
-
-
Enterprise
-
Yes
-
Yes
-
-
-
Education
-
Yes
-
Yes
-
-
+
+|Edition|Windows 10|Windows 11|
+|--- |--- |--- |
+|Home|No|No|
+|Pro|Yes|Yes|
+|Enterprise|Yes|Yes|
+|Education|Yes|Yes|
@@ -961,33 +716,13 @@ The following list shows the supported values:
**System/AllowUserToResetPhone**
-
-
-
Edition
-
Windows 10
-
Windows 11
-
-
-
Home
-
No
-
No
-
-
-
Pro
-
Yes
-
Yes
-
-
-
Enterprise
-
Yes
-
Yes
-
-
-
Education
-
Yes
-
Yes
-
-
+
+|Edition|Windows 10|Windows 11|
+|--- |--- |--- |
+|Home|No|No|
+|Pro|Yes|Yes|
+|Enterprise|Yes|Yes|
+|Education|Yes|Yes|
@@ -1053,33 +788,13 @@ The following list shows the supported values:
**System/BootStartDriverInitialization**
-
+
+|Edition|Windows 10|Windows 11|
+|--- |--- |--- |
+|Home|Yes|Yes|
+|Pro|Yes|Yes|
+|Enterprise|Yes|Yes|
+|Education|Yes|Yes|
@@ -1766,37 +1301,116 @@ The following list shows the supported values:
+
+**System/LimitDiagnosticLogCollection**
+
+
+
+|Edition|Windows 10|Windows 11|
+|--- |--- |--- |
+|Home|No|No|
+|Pro|Yes|Yes|
+|Enterprise|Yes|Yes|
+|Education|Yes|Yes|
+
+
+
+
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
+
+This policy setting specifies whether diagnostic log data can be collected when more information is needed to troubleshoot a problem. It is sent only if we have permission to collect optional diagnostic data, and only if the device meets the criteria for additional data collection.
+
+If you disable or do not configure this policy setting, we may occasionally collect advanced diagnostic data if the user has opted to send optional diagnostic data.
+
+
+
+ADMX Info:
+- GP Friendly name: *Limit Diagnostic Log Collection*
+- GP name: *LimitDiagnosticLogCollection*
+- GP path: *Data Collection and Preview Builds*
+- GP ADMX file name: *DataCollection.admx*
+
+
+
+The following list shows the supported values:
+
+- 0 – Disabled
+- 1 – Enabled
+
+
+
+
+
+
+
+**System/LimitDumpCollection**
+
+
+
+|Edition|Windows 10|Windows 11|
+|--- |--- |--- |
+|Home|No|No|
+|Pro|Yes|Yes|
+|Enterprise|Yes|Yes|
+|Education|Yes|Yes|
+
+
+
+
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
+
+This policy setting limits the type of dumps that can be collected when more information is needed to troubleshoot a problem. These dumps are not sent unless we have permission to collect optional diagnostic data.
+
+By enabling this policy setting, Windows Error Reporting is limited to sending kernel mini dumps and user mode triage dumps only.
+
+If you disable or do not configure this policy setting, we may occasionally collect full or heap dumps if the user has opted to send optional diagnostic data.
+
+
+
+ADMX Info:
+- GP Friendly name: *Limit Dump Collection*
+- GP name: *LimitDumpCollection*
+- GP path: *Data Collection and Preview Builds*
+- GP ADMX file name: *DataCollection.admx*
+
+
+
+The following list shows the supported values:
+
+- 0 – Disabled
+- 1 – Enabled
+
+
+
+
+
**System/LimitEnhancedDiagnosticDataWindowsAnalytics**
-
@@ -134,38 +137,14 @@ Placeholder only. Do not use in production environment.
**TextInput/AllowIMELogging**
-
-
-
Edition
-
Windows 10
-
Windows 11
-
-
-
Home
-
No
-
No
-
-
-
Pro
-
Yes
-
Yes
-
-
-
Business
-
Yes
-
Yes
-
-
-
Enterprise
-
Yes
-
Yes
-
-
-
Education
-
Yes
-
Yes
-
-
+
+|Edition|Windows 10|Windows 11|
+|--- |--- |--- |
+|Home|No|No|
+|Pro|Yes|Yes|
+|Business|Yes|Yes|
+|Enterprise|Yes|Yes|
+|Education|Yes|Yes|
@@ -204,38 +183,14 @@ The following list shows the supported values:
**TextInput/AllowIMENetworkAccess**
-
-
-
Edition
-
Windows 10
-
Windows 11
-
-
-
Home
-
No
-
No
-
-
-
Pro
-
Yes
-
Yes
-
-
-
Business
-
Yes
-
Yes
-
-
-
Enterprise
-
Yes
-
Yes
-
-
-
Education
-
Yes
-
Yes
-
-
+
+|Edition|Windows 10|Windows 11|
+|--- |--- |--- |
+|Home|No|No|
+|Pro|Yes|Yes|
+|Business|Yes|Yes|
+|Enterprise|Yes|Yes|
+|Education|Yes|Yes|
@@ -272,38 +227,14 @@ The following list shows the supported values:
**TextInput/AllowInputPanel**
-
-
-
Edition
-
Windows 10
-
Windows 11
-
-
-
Home
-
No
-
No
-
-
-
Pro
-
Yes
-
Yes
-
-
-
Business
-
Yes
-
Yes
-
-
-
Enterprise
-
Yes
-
Yes
-
-
-
Education
-
Yes
-
Yes
-
-
+
+|Edition|Windows 10|Windows 11|
+|--- |--- |--- |
+|Home|No|No|
+|Pro|Yes|Yes|
+|Business|Yes|Yes|
+|Enterprise|Yes|Yes|
+|Education|Yes|Yes|
@@ -342,38 +273,14 @@ The following list shows the supported values:
**TextInput/AllowJapaneseIMESurrogatePairCharacters**
-
-
-
Edition
-
Windows 10
-
Windows 11
-
-
-
Home
-
No
-
No
-
-
-
Pro
-
Yes
-
Yes
-
-
-
Business
-
Yes
-
Yes
-
-
-
Enterprise
-
Yes
-
Yes
-
-
-
Education
-
Yes
-
Yes
-
-
+
+|Edition|Windows 10|Windows 11|
+|--- |--- |--- |
+|Home|No|No|
+|Pro|Yes|Yes|
+|Business|Yes|Yes|
+|Enterprise|Yes|Yes|
+|Education|Yes|Yes|
@@ -413,38 +320,14 @@ The following list shows the supported values:
**TextInput/AllowJapaneseIVSCharacters**
-
-
-
Edition
-
Windows 10
-
Windows 11
-
-
-
Home
-
No
-
No
-
-
-
Pro
-
Yes
-
Yes
-
-
-
Business
-
Yes
-
Yes
-
-
-
Enterprise
-
Yes
-
Yes
-
-
-
Education
-
Yes
-
Yes
-
-
+
+|Edition|Windows 10|Windows 11|
+|--- |--- |--- |
+|Home|No|No|
+|Pro|Yes|Yes|
+|Business|Yes|Yes|
+|Enterprise|Yes|Yes|
+|Education|Yes|Yes|
@@ -483,38 +366,14 @@ The following list shows the supported values:
**TextInput/AllowJapaneseNonPublishingStandardGlyph**
-
-
-
Edition
-
Windows 10
-
Windows 11
-
-
-
Home
-
No
-
No
-
-
-
Pro
-
Yes
-
Yes
-
-
-
Business
-
Yes
-
Yes
-
-
-
Enterprise
-
Yes
-
Yes
-
-
-
Education
-
Yes
-
Yes
-
-
+
+|Edition|Windows 10|Windows 11|
+|--- |--- |--- |
+|Home|No|No|
+|Pro|Yes|Yes|
+|Business|Yes|Yes|
+|Enterprise|Yes|Yes|
+|Education|Yes|Yes|
@@ -553,38 +412,14 @@ The following list shows the supported values:
**TextInput/AllowJapaneseUserDictionary**
-
-
-
Edition
-
Windows 10
-
Windows 11
-
-
-
Home
-
No
-
No
-
-
-
Pro
-
Yes
-
Yes
-
-
-
Business
-
Yes
-
Yes
-
-
-
Enterprise
-
Yes
-
Yes
-
-
-
Education
-
Yes
-
Yes
-
-
+
+|Edition|Windows 10|Windows 11|
+|--- |--- |--- |
+|Home|No|No|
+|Pro|Yes|Yes|
+|Business|Yes|Yes|
+|Enterprise|Yes|Yes|
+|Education|Yes|Yes|
@@ -623,38 +458,14 @@ The following list shows the supported values:
**TextInput/AllowKeyboardTextSuggestions**
-
-
-
Edition
-
Windows 10
-
Windows 11
-
-
-
Home
-
No
-
No
-
-
-
Pro
-
Yes
-
Yes
-
-
-
Business
-
Yes
-
Yes
-
-
-
Enterprise
-
Yes
-
Yes
-
-
-
Education
-
Yes
-
Yes
-
-
+
+|Edition|Windows 10|Windows 11|
+|--- |--- |--- |
+|Home|No|No|
+|Pro|Yes|Yes|
+|Business|Yes|Yes|
+|Enterprise|Yes|Yes|
+|Education|Yes|Yes|
@@ -713,38 +524,14 @@ This policy has been deprecated.
**TextInput/AllowLanguageFeaturesUninstall**
-
-
-
Edition
-
Windows 10
-
Windows 11
-
-
-
Home
-
No
-
No
-
-
-
Pro
-
Yes
-
Yes
-
-
-
Business
-
Yes
-
Yes
-
-
-
Enterprise
-
Yes
-
Yes
-
-
-
Education
-
Yes
-
Yes
-
-
+
+|Edition|Windows 10|Windows 11|
+|--- |--- |--- |
+|Home|No|No|
+|Pro|Yes|Yes|
+|Business|Yes|Yes|
+|Enterprise|Yes|Yes|
+|Education|Yes|Yes|
@@ -791,38 +578,14 @@ The following list shows the supported values:
**TextInput/AllowLinguisticDataCollection**
-
-
-
Edition
-
Windows 10
-
Windows 11
-
-
-
Home
-
No
-
No
-
-
-
Pro
-
Yes
-
Yes
-
-
-
Business
-
Yes
-
Yes
-
-
-
Enterprise
-
Yes
-
Yes
-
-
-
Education
-
Yes
-
Yes
-
-
+
+|Edition|Windows 10|Windows 11|
+|--- |--- |--- |
+|Home|No|No|
+|Pro|Yes|Yes|
+|Business|Yes|Yes|
+|Enterprise|Yes|Yes|
+|Education|Yes|Yes|
@@ -856,42 +619,63 @@ This setting supports a range of values between 0 and 1.
+
+**TextInput/AllowTextInputSuggestionUpdate**
+
+
+
+|Edition|Windows 10|Windows 11|
+|--- |--- |--- |
+|Home|No|No|
+|Pro|Yes|Yes|
+|Business|Yes|Yes|
+|Enterprise|Yes|Yes|
+|Education|Yes|Yes|
+
+
+
+
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
+
+Allows the user to turn on or off the automatic downloading of newer versions of the Expressive Input UI.
+When downloading is not allowed the Expressive Input panel will always display the initial UI included with the base Windows image.
+
+Most restricted value is 0.
+
+Default: Enabled
+
+
+
+The following list shows the supported values:
+
+- 1 (Enabled) - The newer UX is downloaded from Microsoft service.
+- 0 (Disabled) - The UX remains unchanged with what the operating system installs.
+
+
+
+
+
+
**TextInput/ConfigureJapaneseIMEVersion**
-
-
-
Edition
-
Windows 10
-
Windows 11
-
-
-
Home
-
No
-
No
-
-
-
Pro
-
Yes
-
Yes
-
-
-
Business
-
Yes
-
Yes
-
-
-
Enterprise
-
Yes
-
Yes
-
-
-
Education
-
Yes
-
Yes
-
-
+
+|Edition|Windows 10|Windows 11|
+|--- |--- |--- |
+|Home|No|No|
+|Pro|Yes|Yes|
+|Business|Yes|Yes|
+|Enterprise|Yes|Yes|
+|Education|Yes|Yes|
@@ -929,38 +713,14 @@ The following list shows the supported values:
**TextInput/ConfigureSimplifiedChineseIMEVersion**
-
-
-
Edition
-
Windows 10
-
Windows 11
-
-
-
Home
-
No
-
No
-
-
-
Pro
-
Yes
-
Yes
-
-
-
Business
-
Yes
-
Yes
-
-
-
Enterprise
-
Yes
-
Yes
-
-
-
Education
-
Yes
-
Yes
-
-
+
+|Edition|Windows 10|Windows 11|
+|--- |--- |--- |
+|Home|No|No|
+|Pro|Yes|Yes|
+|Business|Yes|Yes|
+|Enterprise|Yes|Yes|
+|Education|Yes|Yes|
@@ -998,38 +758,14 @@ The following list shows the supported values:
**TextInput/ConfigureTraditionalChineseIMEVersion**
-
-
-
Edition
-
Windows 10
-
Windows 11
-
-
-
Home
-
No
-
No
-
-
-
Pro
-
Yes
-
Yes
-
-
-
Business
-
Yes
-
Yes
-
-
-
Enterprise
-
Yes
-
Yes
-
-
-
Education
-
Yes
-
Yes
-
-
+
+|Edition|Windows 10|Windows 11|
+|--- |--- |--- |
+|Home|No|No|
+|Pro|Yes|Yes|
+|Business|Yes|Yes|
+|Enterprise|Yes|Yes|
+|Education|Yes|Yes|
@@ -1066,38 +802,14 @@ The following list shows the supported values:
**TextInput/EnableTouchKeyboardAutoInvokeInDesktopMode**
-
-
-
Edition
-
Windows 10
-
Windows 11
-
-
-
Home
-
No
-
No
-
-
-
Pro
-
Yes
-
Yes
-
-
-
Business
-
Yes
-
Yes
-
-
-
Enterprise
-
Yes
-
Yes
-
-
-
Education
-
Yes
-
Yes
-
-
+
+|Edition|Windows 10|Windows 11|
+|--- |--- |--- |
+|Home|No|No|
+|Pro|Yes|Yes|
+|Business|Yes|Yes|
+|Enterprise|Yes|Yes|
+|Education|Yes|Yes|
@@ -1136,38 +848,14 @@ The following list shows the supported values:
**TextInput/ExcludeJapaneseIMEExceptJIS0208**
-
-
-
Edition
-
Windows 10
-
Windows 11
-
-
-
Home
-
No
-
No
-
-
-
Pro
-
Yes
-
Yes
-
-
-
Business
-
Yes
-
Yes
-
-
-
Enterprise
-
Yes
-
Yes
-
-
-
Education
-
Yes
-
Yes
-
-
+
+|Edition|Windows 10|Windows 11|
+|--- |--- |--- |
+|Home|No|No|
+|Pro|Yes|Yes|
+|Business|Yes|Yes|
+|Enterprise|Yes|Yes|
+|Education|Yes|Yes|
@@ -1204,38 +892,14 @@ The following list shows the supported values:
**TextInput/ExcludeJapaneseIMEExceptJIS0208andEUDC**
-
-
-
Edition
-
Windows 10
-
Windows 11
-
-
-
Home
-
No
-
No
-
-
-
Pro
-
Yes
-
Yes
-
-
-
Business
-
Yes
-
Yes
-
-
-
Enterprise
-
Yes
-
Yes
-
-
-
Education
-
Yes
-
Yes
-
-
+
+|Edition|Windows 10|Windows 11|
+|--- |--- |--- |
+|Home|No|No|
+|Pro|Yes|Yes|
+|Business|Yes|Yes|
+|Enterprise|Yes|Yes|
+|Education|Yes|Yes|
@@ -1272,38 +936,14 @@ The following list shows the supported values:
**TextInput/ExcludeJapaneseIMEExceptShiftJIS**
-
-
-
Edition
-
Windows 10
-
Windows 11
-
-
-
Home
-
No
-
No
-
-
-
Pro
-
Yes
-
Yes
-
-
-
Business
-
Yes
-
Yes
-
-
-
Enterprise
-
Yes
-
Yes
-
-
-
Education
-
Yes
-
Yes
-
-
+
+|Edition|Windows 10|Windows 11|
+|--- |--- |--- |
+|Home|No|No|
+|Pro|Yes|Yes|
+|Business|Yes|Yes|
+|Enterprise|Yes|Yes|
+|Education|Yes|Yes|
@@ -1340,38 +980,14 @@ The following list shows the supported values:
**TextInput/ForceTouchKeyboardDockedState**
-
-
-
Edition
-
Windows 10
-
Windows 11
-
-
-
Home
-
No
-
No
-
-
-
Pro
-
Yes
-
Yes
-
-
-
Business
-
Yes
-
Yes
-
-
-
Enterprise
-
Yes
-
Yes
-
-
-
Education
-
Yes
-
Yes
-
-
+
+|Edition|Windows 10|Windows 11|
+|--- |--- |--- |
+|Home|No|No|
+|Pro|Yes|Yes|
+|Business|Yes|Yes|
+|Enterprise|Yes|Yes|
+|Education|Yes|Yes|
@@ -1405,38 +1021,14 @@ The following list shows the supported values:
**TextInput/TouchKeyboardDictationButtonAvailability**
-
-
-
Edition
-
Windows 10
-
Windows 11
-
-
-
Home
-
No
-
No
-
-
-
Pro
-
Yes
-
Yes
-
-
-
Business
-
Yes
-
Yes
-
-
-
Enterprise
-
Yes
-
Yes
-
-
-
Education
-
Yes
-
Yes
-
-
+
+|Edition|Windows 10|Windows 11|
+|--- |--- |--- |
+|Home|No|No|
+|Pro|Yes|Yes|
+|Business|Yes|Yes|
+|Enterprise|Yes|Yes|
+|Education|Yes|Yes|
@@ -1470,38 +1062,14 @@ The following list shows the supported values:
**TextInput/TouchKeyboardEmojiButtonAvailability**
-
-
-
Edition
-
Windows 10
-
Windows 11
-
-
-
Home
-
No
-
No
-
-
-
Pro
-
Yes
-
Yes
-
-
-
Business
-
Yes
-
Yes
-
-
-
Enterprise
-
Yes
-
Yes
-
-
-
Education
-
Yes
-
Yes
-
-
+
+|Edition|Windows 10|Windows 11|
+|--- |--- |--- |
+|Home|No|No|
+|Pro|Yes|Yes|
+|Business|Yes|Yes|
+|Enterprise|Yes|Yes|
+|Education|Yes|Yes|
@@ -1535,38 +1103,14 @@ The following list shows the supported values:
**TextInput/TouchKeyboardFullModeAvailability**
-
-
-
Edition
-
Windows 10
-
Windows 11
-
-
-
Home
-
No
-
No
-
-
-
Pro
-
Yes
-
Yes
-
-
-
Business
-
Yes
-
Yes
-
-
-
Enterprise
-
Yes
-
Yes
-
-
-
Education
-
Yes
-
Yes
-
-
+
+|Edition|Windows 10|Windows 11|
+|--- |--- |--- |
+|Home|No|No|
+|Pro|Yes|Yes|
+|Business|Yes|Yes|
+|Enterprise|Yes|Yes|
+|Education|Yes|Yes|
@@ -1600,38 +1144,14 @@ The following list shows the supported values:
**TextInput/TouchKeyboardHandwritingModeAvailability**
-
-
-
Edition
-
Windows 10
-
Windows 11
-
-
-
Home
-
No
-
No
-
-
-
Pro
-
Yes
-
Yes
-
-
-
Business
-
Yes
-
Yes
-
-
-
Enterprise
-
Yes
-
Yes
-
-
-
Education
-
Yes
-
Yes
-
-
+
+|Edition|Windows 10|Windows 11|
+|--- |--- |--- |
+|Home|No|No|
+|Pro|Yes|Yes|
+|Business|Yes|Yes|
+|Enterprise|Yes|Yes|
+|Education|Yes|Yes|
@@ -1665,38 +1185,14 @@ The following list shows the supported values:
**TextInput/TouchKeyboardNarrowModeAvailability**
-
-
-
Edition
-
Windows 10
-
Windows 11
-
-
-
Home
-
No
-
No
-
-
-
Pro
-
Yes
-
Yes
-
-
-
Business
-
Yes
-
Yes
-
-
-
Enterprise
-
Yes
-
Yes
-
-
-
Education
-
Yes
-
Yes
-
-
+
+|Edition|Windows 10|Windows 11|
+|--- |--- |--- |
+|Home|No|No|
+|Pro|Yes|Yes|
+|Business|Yes|Yes|
+|Enterprise|Yes|Yes|
+|Education|Yes|Yes|
@@ -1730,38 +1226,14 @@ The following list shows the supported values:
**TextInput/TouchKeyboardSplitModeAvailability**
-
-
-
Edition
-
Windows 10
-
Windows 11
-
-
-
Home
-
No
-
No
-
-
-
Pro
-
Yes
-
Yes
-
-
-
Business
-
Yes
-
Yes
-
-
-
Enterprise
-
Yes
-
Yes
-
-
-
Education
-
Yes
-
Yes
-
-
+
+|Edition|Windows 10|Windows 11|
+|--- |--- |--- |
+|Home|No|No|
+|Pro|Yes|Yes|
+|Business|Yes|Yes|
+|Enterprise|Yes|Yes|
+|Education|Yes|Yes|
@@ -1795,38 +1267,14 @@ The following list shows the supported values:
**TextInput/TouchKeyboardWideModeAvailability**
-
+
+
+
+**TimeLanguageSettings/BlockCleanupOfUnusedPreinstalledLangPacks**
+
+
+
+|Edition|Windows 10|Windows 11|
+|--- |--- |--- |
+|Home|No|No|
+|Pro|Yes|Yes|
+|Business|Yes|Yes|
+|Enterprise|Yes|Yes|
+|Education|Yes|Yes|
+
+
+
+
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
+
+This policy setting controls whether the maintenance task will run to clean up language packs installed on a machine but are not used by any users on that machine.
+
+If you enable this policy setting (value 1), language packs that are installed as part of the system image will remain installed even if they are not used by any user on that system.
+
+If you disable (value 0) or do not configure this policy setting, language packs that are installed as part of the system image but are not used by any user on that system will be removed as part of a scheduled clean up task.
+
+
+
+
+
+
+ADMX Info:
+- GP Friendly name: *Block cleanup of unused language packs*
+- GP name: *BlockCleanupOfUnusedPreinstalledLangPacks*
+- GP path: *Computer Configuration/Administrative Templates/Control Panel/Regional and Language Options*
+- GP ADMX file name: *Globalization.admx*
+
+
+
+
+
+
+
+
+
+
**TimeLanguageSettings/ConfigureTimeZone**
-
-
-
Edition
-
Windows 10
-
Windows 11
-
-
-
Home
-
No
-
No
-
-
-
Pro
-
Yes
-
Yes
-
-
-
Business
-
Yes
-
Yes
-
-
-
Enterprise
-
Yes
-
Yes
-
-
-
Education
-
Yes
-
Yes
-
-
+
+|Edition|Windows 10|Windows 11|
+|--- |--- |--- |
+|Home|No|No|
+|Pro|Yes|Yes|
+|Business|Yes|Yes|
+|Enterprise|Yes|Yes|
+|Education|Yes|Yes|
@@ -98,5 +137,103 @@ Specifies the time zone to be applied to the device. This is the standard Window
+
+**TimeLanguageSettings/MachineUILanguageOverwrite**
+
+
+
+|Edition|Windows 10|Windows 11|
+|--- |--- |--- |
+|Home|No|No|
+|Pro|Yes|Yes|
+|Business|Yes|Yes|
+|Enterprise|Yes|Yes|
+|Education|Yes|Yes|
+
+
+
+
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
+
+This policy setting controls which UI language is used for computers with more than one UI language installed.
+
+If you enable this policy setting, the UI language of Windows menus and dialogs for systems with more than one language is restricted to a specified language. If the specified language is not installed on the target computer or you disable this policy setting, the language selection defaults to the language selected by the local administrator.
+
+If you disable or do not configure this policy setting, there is no restriction of a specific language used for the Windows menus and dialogs.
+
+
+
+
+
+
+ADMX Info:
+- GP Friendly name: *Force selected system UI language to overwrite the user UI language*
+- GP name: *MachineUILanguageOverwrite*
+- GP path: *Computer Configuration/Administrative Templates/Control Panel/Regional and Language Options*
+- GP ADMX file name: *Globalization.admx*
+
+
+
+
+
+
+
+
+
+
+
+
+
+**TimeLanguageSettings/RestrictLanguagePacksAndFeaturesInstall**
+
+
+
+|Edition|Windows 10|Windows 11|
+|--- |--- |--- |
+|Home|No|No|
+|Pro|Yes|Yes|
+|Business|Yes|Yes|
+|Enterprise|Yes|Yes|
+|Education|Yes|Yes|
+
+
+
+
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
+
+This policy setting restricts standard users from installing language features on demand. This policy does not restrict the Windows language, if you want to restrict the Windows language use the following policy: “Restricts the UI languages Windows should use for the selected user.”
+
+If you enable this policy setting, the installation of language features is prevented for standard users.
+
+If you disable or do not configure this policy setting, there is no language feature installation restriction for the standard users.
+
+
+
+
+
+
+
+
+
+
+
+
+
diff --git a/windows/client-management/mdm/policy-csp-troubleshooting.md b/windows/client-management/mdm/policy-csp-troubleshooting.md
index 41deff6293..d04526eee3 100644
--- a/windows/client-management/mdm/policy-csp-troubleshooting.md
+++ b/windows/client-management/mdm/policy-csp-troubleshooting.md
@@ -32,38 +32,14 @@ ms.date: 09/27/2019
**Troubleshooting/AllowRecommendations**
-
-
-
Edition
-
Windows 10
-
Windows 11
-
-
-
Home
-
No
-
No
-
-
-
Pro
-
Yes
-
Yes
-
-
-
Business
-
Yes
-
Yes
-
-
-
Enterprise
-
Yes
-
Yes
-
-
-
Education
-
Yes
-
Yes
-
-
+
+|Edition|Windows 10|Windows 11|
+|--- |--- |--- |
+|Home|No|No|
+|Pro|Yes|Yes|
+|Business|Yes|Yes|
+|Enterprise|Yes|Yes|
+|Education|Yes|Yes|
@@ -101,38 +77,14 @@ Supported values:
- 5 - Allow the user to choose their own recommended troubleshooting settings.
By default, this policy is not configured and the SKU based defaults are used for managed devices. Current policy values for SKU's are as follows:
-
+
+|Edition|Windows 10|Windows 11|
+|--- |--- |--- |
+|Home|No|No|
+|Pro|Yes|Yes|
+|Business|Yes|Yes|
+|Enterprise|Yes|Yes|
+|Education|Yes|Yes|
@@ -1515,42 +1126,65 @@ Default value is 2.
+
+**Update/ConfigureDeadlineGracePeriodForFeatureUpdates**
+
+
+
+|Edition|Windows 10|Windows 11|
+|--- |--- |--- |
+|Home|No|No|
+|Pro|Yes|Yes|
+|Business|Yes|Yes|
+|Enterprise|Yes|Yes|
+|Education|Yes|Yes|
+
+
+
+
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
+
+Allows IT admins to set different grace periods for both Quality Updates and Feature Updates. Specifically, when used with used with [Update/ConfigureDeadlineForFeatureUpdates](#update-configuredeadlineforfeatureupdates).
+
+IT Admins will be able to specify a minimum number of days until restarts occur automatically for Featur Updates. Setting the grace period may extend the effective deadline set by the deadline policies specifically for Feature Updates.
+
+
+
+
+Supports a numeric value from 0 - 7, which indicates the minimum number of days.
+
+Default value is 2.
+
+
+
+
+
+
+
+
+
+
+
**Update/ConfigureDeadlineNoAutoReboot**
-
+
+|Edition|Windows 10|Windows 11|
+|--- |--- |--- |
+|Home|No|No|
+|Pro|Yes|Yes|
+|Business|Yes|Yes|
+|Enterprise|Yes|Yes|
+|Education|Yes|Yes|
@@ -1701,7 +1287,6 @@ Enable IT admin to configure feature update uninstall period. Values range 2 - 6
-Since this policy is not blocked, you will not get a failure message when you use it to configure a Windows 10 Mobile device. However, the policy will not take effect.
Defers Feature Updates for the specified number of days.
@@ -1728,38 +1313,14 @@ ADMX Info:
**Update/DeferQualityUpdatesPeriodInDays**
-
+
+|Edition|Windows 10|Windows 11|
+|--- |--- |--- |
+|Home|No|No|
+|Pro|Yes|Yes|
+|Business|Yes|Yes|
+|Enterprise|Yes|Yes|
+|Education|Yes|Yes|
@@ -1996,8 +1458,6 @@ ADMX Info:
> [!NOTE]
-> Since this policy is not blocked, you will not get a failure message when you use it to configure a Windows 10 Mobile device. However, the policy will not take effect.
->
> Don't use this policy in Windows 10, version 1607 devices, instead use the new policies listed in [Changes in Windows 10, version 1607 for update management](device-update-management.md#windows10version1607forupdatemanagement). You can continue to use DeferUpgradePeriod for Windows 10, version 1511 devices.
@@ -2025,38 +1485,14 @@ ADMX Info:
**Update/DetectionFrequency**
-
+
+|Edition|Windows 10|Windows 11|
+|--- |--- |--- |
+|Home|No|No|
+|Pro|Yes|Yes|
+|Business|Yes|Yes|
+|Enterprise|Yes|Yes|
+|Education|Yes|Yes|
@@ -2141,7 +1553,7 @@ Do not allow update deferral policies to cause scans against Windows Update. If
For more information about dual scan, see [Demystifying "Dual Scan"](/archive/blogs/wsus/demystifying-dual-scan) and [Improving Dual Scan on 1607](/archive/blogs/wsus/improving-dual-scan-on-1607).
-This is the same as the Group Policy in Windows Components > Window Update "Do not allow update deferral policies to cause scans against Windows Update."
+This is the same as the Group Policy in Windows Components > Windows Update "Do not allow update deferral policies to cause scans against Windows Update."
Value type is integer. Supported operations are Add, Get, Replace, and Delete.
@@ -2169,38 +1581,14 @@ The following list shows the supported values:
**Update/DisableWUfBSafeguards**
-
-
-
Edition
-
Windows 10
-
Windows 11
-
-
-
Home
-
No
-
No
-
-
-
Pro
-
Yes
-
Yes
-
-
-
Business
-
Yes
-
Yes
-
-
-
Enterprise
-
Yes
-
Yes
-
-
-
Education
-
Yes
-
Yes
-
-
+
+|Edition|Windows 10|Windows 11|
+|--- |--- |--- |
+|Home|No|No|
+|Pro|Yes|Yes|
+|Business|Yes|Yes|
+|Enterprise|Yes|Yes|
+|Education|Yes|Yes|
@@ -2250,42 +1638,68 @@ The following list shows the supported values:
+
+**Update/DoNotEnforceEnterpriseTLSCertPinningForUpdateDetection**
+
+
+
+|Edition|Windows 10|Windows 11|
+|--- |--- |--- |
+|Home|No|No|
+|Pro|Yes|Yes|
+|Business|Yes|Yes|
+|Enterprise|Yes|Yes|
+|Education|Yes|Yes|
+
+
+
+
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
+
+To ensure the highest levels of security, we recommended leveraging WSUS TLS certificate pinning on all devices.
+
+By default, certificate pinning for Windows Update client is not enforced.
+
+
+
+ADMX Info:
+- GP Friendly name: *Allow user proxy to be used as a fallback if detection using system proxy fails*
+- GP name: *Allow user proxy to be used as a fallback if detection using system proxy fails*
+- GP path: *Windows Update\SpecifyintranetMicrosoftupdateserviceLocation*
+- GP ADMX file name: *WindowsUpdate.admx*
+
+
+
+The following list shows the supported values:
+
+- 0 (default) -Do not enforce certificate pinning
+- 1 - Do not enforce certificate pinning
+
+
+
+
+
+
**Update/EngagedRestartDeadline**
-
+
+|Edition|Windows 10|Windows 11|
+|--- |--- |--- |
+|Home|No|No|
+|Pro|Yes|Yes|
+|Business|Yes|Yes|
+|Enterprise|Yes|Yes|
+|Education|Yes|Yes|
@@ -2771,8 +2041,6 @@ ADMX Info:
-> [!NOTE]
-> Since this policy is not blocked, you will not get a failure message when you use it to configure a Windows 10 Mobile device. However, the policy will not take effect.
Allows IT Admins to exclude Windows Update (WU) drivers during updates.
@@ -2800,38 +2068,14 @@ The following list shows the supported values:
**Update/FillEmptyContentUrls**
-
-
-
Edition
-
Windows 10
-
Windows 11
-
-
-
Home
-
No
-
No
-
-
-
Pro
-
Yes
-
Yes
-
-
-
Business
-
Yes
-
Yes
-
-
-
Enterprise
-
Yes
-
Yes
-
-
-
Education
-
Yes
-
Yes
-
-
+
+|Edition|Windows 10|Windows 11|
+|--- |--- |--- |
+|Home|No|No|
+|Pro|Yes|Yes|
+|Business|Yes|Yes|
+|Enterprise|Yes|Yes|
+|Education|Yes|Yes|
@@ -2876,38 +2120,14 @@ The following list shows the supported values:
**Update/IgnoreMOAppDownloadLimit**
-
-
-
Edition
-
Windows 10
-
Windows 11
-
-
-
Home
-
No
-
No
-
-
-
Pro
-
Yes
-
Yes
-
-
-
Business
-
Yes
-
Yes
-
-
-
Enterprise
-
Yes
-
Yes
-
-
-
Education
-
Yes
-
Yes
-
-
+
+|Edition|Windows 10|Windows 11|
+|--- |--- |--- |
+|Home|No|No|
+|Pro|Yes|Yes|
+|Business|Yes|Yes|
+|Enterprise|Yes|Yes|
+|Education|Yes|Yes|
@@ -2939,7 +2159,7 @@ The following list shows the supported values:
To validate this policy:
1. Enable the policy and ensure the device is on a cellular network.
-2. Run the scheduled task on your device to check for app updates in the background. For example, on a mobile device, run the following commands in TShell:
+2. Run the scheduled task on your device to check for app updates in the background. For example, on a device, run the following commands in TShell:
```TShell
exec-device schtasks.exe -arguments '/run /tn "\Microsoft\Windows\WindowsUpdate\Automatic App Update" /I'
```
@@ -2953,38 +2173,14 @@ To validate this policy:
**Update/IgnoreMOUpdateDownloadLimit**
-
-
-
Edition
-
Windows 10
-
Windows 11
-
-
-
Home
-
No
-
No
-
-
-
Pro
-
Yes
-
Yes
-
-
-
Business
-
Yes
-
Yes
-
-
-
Enterprise
-
Yes
-
Yes
-
-
-
Education
-
Yes
-
Yes
-
-
+
+|Edition|Windows 10|Windows 11|
+|--- |--- |--- |
+|Home|No|No|
+|Pro|Yes|Yes|
+|Business|Yes|Yes|
+|Enterprise|Yes|Yes|
+|Education|Yes|Yes|
@@ -3016,7 +2212,7 @@ The following list shows the supported values:
To validate this policy:
1. Enable the policy and ensure the device is on a cellular network.
-2. Run the scheduled task on your device to check for app updates in the background. For example, on a mobile device, run the following commands in TShell:
+2. Run the scheduled task on your device to check for app updates in the background. For example, on a device, run the following commands in TShell:
```TShell
exec-device schtasks.exe -arguments '/run /tn "\Microsoft\Windows\WindowsUpdate\Automatic App Update" /I'
```
@@ -3030,38 +2226,14 @@ To validate this policy:
**Update/ManagePreviewBuilds**
-
-
-
Edition
-
Windows 10
-
Windows 11
-
-
-
Home
-
No
-
No
-
-
-
Pro
-
Yes
-
Yes
-
-
-
Business
-
Yes
-
Yes
-
-
-
Enterprise
-
Yes
-
Yes
-
-
-
Education
-
Yes
-
Yes
-
-
+
+|Edition|Windows 10|Windows 11|
+|--- |--- |--- |
+|Home|No|No|
+|Pro|Yes|Yes|
+|Business|Yes|Yes|
+|Enterprise|Yes|Yes|
+|Education|Yes|Yes|
@@ -3104,38 +2276,14 @@ The following list shows the supported values:
**Update/PauseDeferrals**
-
-
-
Edition
-
Windows 10
-
Windows 11
-
-
-
Home
-
No
-
No
-
-
-
Pro
-
Yes
-
Yes
-
-
-
Business
-
Yes
-
Yes
-
-
-
Enterprise
-
Yes
-
Yes
-
-
-
Education
-
Yes
-
Yes
-
-
+
+|Edition|Windows 10|Windows 11|
+|--- |--- |--- |
+|Home|No|No|
+|Pro|Yes|Yes|
+|Business|Yes|Yes|
+|Enterprise|Yes|Yes|
+|Education|Yes|Yes|
@@ -3184,38 +2332,14 @@ The following list shows the supported values:
**Update/PauseFeatureUpdates**
-
-
-
Edition
-
Windows 10
-
Windows 11
-
-
-
Home
-
No
-
No
-
-
-
Pro
-
Yes
-
Yes
-
-
-
Business
-
Yes
-
Yes
-
-
-
Enterprise
-
Yes
-
Yes
-
-
-
Education
-
Yes
-
Yes
-
-
+
+|Edition|Windows 10|Windows 11|
+|--- |--- |--- |
+|Home|No|No|
+|Pro|Yes|Yes|
+|Business|Yes|Yes|
+|Enterprise|Yes|Yes|
+|Education|Yes|Yes|
@@ -3230,8 +2354,6 @@ The following list shows the supported values:
-Since this policy is not blocked, you will not get a failure message when you use it to configure a Windows 10 Mobile device. However, the policy will not take effect.
-
Allows IT Admins to pause feature updates for up to 35 days. We recomment that you use the *Update/PauseFeatureUpdatesStartTime* policy if you are running Windows 10, version 1703 or later.
@@ -3260,38 +2382,14 @@ The following list shows the supported values:
**Update/PauseFeatureUpdatesStartTime**
-
+
+|Edition|Windows 10|Windows 11|
+|--- |--- |--- |
+|Home|No|No|
+|Pro|Yes|Yes|
+|Business|Yes|Yes|
+|Enterprise|Yes|Yes|
+|Education|Yes|Yes|
@@ -3401,38 +2475,14 @@ The following list shows the supported values:
**Update/PauseQualityUpdatesStartTime**
-
-
-
Edition
-
Windows 10
-
Windows 11
-
-
-
Home
-
No
-
No
-
-
-
Pro
-
Yes
-
Yes
-
-
-
Business
-
Yes
-
Yes
-
-
-
Enterprise
-
Yes
-
Yes
-
-
-
Education
-
Yes
-
Yes
-
-
+
+|Edition|Windows 10|Windows 11|
+|--- |--- |--- |
+|Home|No|No|
+|Pro|Yes|Yes|
+|Business|Yes|Yes|
+|Enterprise|Yes|Yes|
+|Education|Yes|Yes|
@@ -3476,42 +2526,76 @@ This policy is deprecated. Use [Update/RequireUpdateApproval](#update-requireupd
+
+**Update/ProductVersion**
+
+
+
+|Edition|Windows 10|Windows 11|
+|--- |--- |--- |
+|Home|No|No|
+|Pro|Yes|Yes|
+|Business|Yes|Yes|
+|Enterprise|Yes|Yes|
+|Education|Yes|Yes|
+
+
+
+
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
+
+Available in Windows 10, version 2004 and later. Enables IT administrators to specify which product they would like their device(s) to move to and/or stay on until they reach end of service or reconfigure the policy to target a new product.
+
+If no product is specified, the device will continue receiving newer versions of the Windows product it is currently on. For details about different Windows 10 versions, see [release information](/windows/release-health/release-information).
+
+
+
+ADMX Info:
+- GP Friendly name: *Select the target Feature Update version*
+- GP name: *TargetReleaseVersion*
+- GP element: *ProductVersion*
+- GP path: *Windows Components/Windows Update/Windows Update for Business*
+- GP ADMX file name: *WindowsUpdate.admx*
+
+
+
+Value type is a string containing a Windows product, for example, “Windows 11” or “11” or “Windows 10”.
+
+
+
+
+
+
+
+
+By using this Windows Update for Business policy to upgrade devices to a new product (for example, Windows 11) you are agreeing that when applying this operating system to a device, either:
+
+1. The applicable Windows license was purchased through volume licensing, or
+
+2. That you are authorized to bind your organization and are accepting on its behalf the relevant Microsoft Software License Terms to be found here: (https://www.microsoft.com/Useterms).
+
+
+
**Update/RequireDeferUpgrade**
-
-
-
Edition
-
Windows 10
-
Windows 11
-
-
-
Home
-
No
-
No
-
-
-
Pro
-
Yes
-
No
-
-
-
Business
-
Yes
-
No
-
-
-
Enterprise
-
Yes
-
No
-
-
-
Education
-
Yes
-
No
-
-
+
+|Edition|Windows 10|Windows 11|
+|--- |--- |--- |
+|Home|No|No|
+|Pro|Yes|No|
+|Business|Yes|No|
+|Enterprise|Yes|No|
+|Education|Yes|No|
@@ -3555,38 +2639,14 @@ The following list shows the supported values:
**Update/RequireUpdateApproval**
-
-
-
Edition
-
Windows 10
-
Windows 11
-
-
-
Home
-
No
-
No
-
-
-
Pro
-
Yes
-
No
-
-
-
Business
-
Yes
-
No
-
-
-
Enterprise
-
Yes
-
No
-
-
-
Education
-
Yes
-
No
-
-
+
+|Edition|Windows 10|Windows 11|
+|--- |--- |--- |
+|Home|No|No|
+|Pro|Yes|No|
+|Business|Yes|No|
+|Enterprise|Yes|No|
+|Education|Yes|No|
@@ -3602,7 +2662,7 @@ The following list shows the supported values:
> [!NOTE]
-> This policy is *only* recommended for managing mobile devices. If you previously used the **Update/PhoneUpdateRestrictions** policy in previous versions of Windows, it has been deprecated. Please use this policy instead.
+> If you previously used the **Update/PhoneUpdateRestrictions** policy in previous versions of Windows, it has been deprecated. Please use this policy instead.
Allows the IT admin to restrict the updates that are installed on a device to only those on an update approval list. It enables IT to accept the End User License Agreement (EULA) associated with the approved update on behalf of the end-user. EULAs are approved once an update is approved.
@@ -3625,38 +2685,14 @@ The following list shows the supported values:
**Update/ScheduleImminentRestartWarning**
-
+
+|Edition|Windows 10|Windows 11|
+|--- |--- |--- |
+|Home|No|No|
+|Pro|Yes|Yes|
+|Business|Yes|Yes|
+|Enterprise|Yes|Yes|
+|Education|Yes|Yes|
@@ -4557,43 +3305,242 @@ The following list shows the supported values:
+
+**Update/SetPolicyDrivenUpdateSourceForDriver**
+
+
+
+|Edition|Windows 10|Windows 11|
+|--- |--- |--- |
+|Home|No|No|
+|Pro|Yes|Yes|
+|Business|Yes|Yes|
+|Enterprise|Yes|Yes|
+|Education|Yes|Yes|
+
+
+
+
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
+
+Configure this policy to specify whether to receive Windows Driver Updates from Windows Update endpoint, managed by Windows Update for Business policies, or through your configured Windows Server Update Service (WSUS) server.
+
+If you configure this policy, please also configure the scan source policies for other update types:
+- SetPolicyDrivenUpdateSourceForFeature
+- SetPolicyDrivenUpdateSourceForQuality
+- SetPolicyDrivenUpdateSourceForOther
+
+>[!NOTE]
+>If you have not properly configured Update/UpdateServiceUrl correctly to point to your WSUS server, this policy will have no effect.
+
+
+
+ADMX Info:
+- GP Friendly name: *Specify source service for specific classes of Windows Updates*
+- GP name: *SetPolicyDrivenUpdateSourceForDriver*
+- GP path: *Windows Components/Windows Update*
+- GP ADMX file name: *WindowsUpdate.admx*
+
+
+
+The following list shows the supported values:
+
+- 0: (Default) Detect, download and deploy Driver from Windows Update
+- 1: Enabled, Detect, download and deploy Driver from Windows Server Update Server (WSUS)
+
+
+
+
+
+
+
+**Update/SetPolicyDrivenUpdateSourceForFeature**
+
+
+
+|Edition|Windows 10|Windows 11|
+|--- |--- |--- |
+|Home|No|No|
+|Pro|Yes|Yes|
+|Business|Yes|Yes|
+|Enterprise|Yes|Yes|
+|Education|Yes|Yes|
+
+
+
+
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
+
+Configure this policy to specify whether to receive Windows Driver Updates from Windows Update endpoint, managed by Windows Update for Business policies, or through your configured Windows Server Update Service (WSUS) server.
+
+If you configure this policy, please also configure the scan source policies for other update types:
+- SetPolicyDrivenUpdateSourceForQuality
+- SetPolicyDrivenUpdateSourceForDriver
+- SetPolicyDrivenUpdateSourceForOther
+
+>[!NOTE]
+>If you have not properly configured Update/UpdateServiceUrl correctly to point to your WSUS server, this policy will have no effect.
+
+
+
+ADMX Info:
+- GP Friendly name: *Specify source service for specific classes of Windows Updates*
+- GP name: *SetPolicyDrivenUpdateSourceForFeature*
+- GP path: *Windows Components/Windows Update*
+- GP ADMX file name: *WindowsUpdate.admx*
+
+
+
+The following list shows the supported values:
+
+- 0: (Default) Detect, download and deploy Feature from Windows Update
+- 1: Enabled, Detect, download and deploy Feature from Windows Server Update Server (WSUS)
+
+
+
+
+
+
+
+**Update/SetPolicyDrivenUpdateSourceForOther**
+
+
+
+|Edition|Windows 10|Windows 11|
+|--- |--- |--- |
+|Home|No|No|
+|Pro|Yes|Yes|
+|Business|Yes|Yes|
+|Enterprise|Yes|Yes|
+|Education|Yes|Yes|
+
+
+
+
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
+
+Configure this policy to specify whether to receive Windows Driver Updates from Windows Update endpoint, managed by Windows Update for Business policies, or through your configured Windows Server Update Service (WSUS) server.
+
+If you configure this policy, please also configure the scan source policies for other update types:
+- SetPolicyDrivenUpdateSourceForFeature
+- SetPolicyDrivenUpdateSourceForQuality
+- SetPolicyDrivenUpdateSourceForDriver
+
+>[!NOTE]
+>If you have not properly configured Update/UpdateServiceUrl correctly to point to your WSUS server, this policy will have no effect.
+
+
+
+ADMX Info:
+- GP Friendly name: *Specify source service for specific classes of Windows Updates*
+- GP name: *SetPolicyDrivenUpdateSourceForOther*
+- GP path: *Windows Components/Windows Update*
+- GP ADMX file name: *WindowsUpdate.admx*
+
+
+
+The following list shows the supported values:
+
+- 0: (Default) Detect, download and deploy Other from Windows Update
+- 1: Enabled, Detect, download and deploy Other from Windows Server Update Server (WSUS)
+
+
+
+
+
+
+
+**Update/SetPolicyDrivenUpdateSourceForQuality**
+
+
+
+|Edition|Windows 10|Windows 11|
+|--- |--- |--- |
+|Home|No|No|
+|Pro|Yes|Yes|
+|Business|Yes|Yes|
+|Enterprise|Yes|Yes|
+|Education|Yes|Yes|
+
+
+
+
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
+
+Configure this policy to specify whether to receive Windows Driver Updates from Windows Update endpoint, managed by Windows Update for Business policies, or through your configured Windows Server Update Service (WSUS) server.
+
+If you configure this policy, please also configure the scan source policies for other update types:
+- SetPolicyDrivenUpdateSourceForFeature
+- SetPolicyDrivenUpdateSourceForDriver
+- SetPolicyDrivenUpdateSourceForOther
+
+>[!NOTE]
+>If you have not properly configured Update/UpdateServiceUrl correctly to point to your WSUS server, this policy will have no effect.
+
+
+
+ADMX Info:
+- GP Friendly name: *Specify source service for specific classes of Windows Updates*
+- GP name: *SetPolicyDrivenUpdateSourceForQuality*
+- GP path: *Windows Components/Windows Update*
+- GP ADMX file name: *WindowsUpdate.admx*
+
+
+
+The following list shows the supported values:
+
+- 0: (Default) Detect, download and deploy Quality from Windows Update
+- 1: Enabled, Detect, download and deploy Quality from Windows Server Update Server (WSUS)
+
+
+
+
+**Update/SetProxyBehaviorForUpdateDetection**
-
-
-
Edition
-
Windows 10
-
Windows 11
-
-
-
Home
-
No
-
No
-
-
-
Pro
-
Yes
-
Yes
-
-
-
Business
-
Yes
-
Yes
-
-
-
Enterprise
-
Yes
-
Yes
-
-
-
Education
-
Yes
-
Yes
-
-
+
+|Edition|Windows 10|Windows 11|
+|--- |--- |--- |
+|Home|No|No|
+|Pro|Yes|Yes|
+|Business|Yes|Yes|
+|Enterprise|Yes|Yes|
+|Education|Yes|Yes|
@@ -4635,122 +3582,18 @@ The following list shows the supported values:
-
-**Update/TargetProductVersion**
-
-
-
-
-
Edition
-
Windows 10
-
Windows 11
-
-
-
Home
-
No
-
No
-
-
-
Pro
-
Yes
-
Yes
-
-
-
Business
-
Yes
-
Yes
-
-
-
Enterprise
-
Yes
-
Yes
-
-
-
Education
-
Yes
-
Yes
-
-
-
-
-
-
-
-[Scope](./policy-configuration-service-provider.md#policy-scope):
-
-> [!div class = "checklist"]
-> * Device
-
-
-
-
-
-Available in Windows 10, version 2004 and later. Enables IT administrators to specify which product they would like their device(s) to move to and/or stay on until they reach end of service or reconfigure the policy to target a new product.
-
-If no product is specified, the device will continue receiving newer versions of the Windows product it is currently on. For details about different Windows 10 versions, see [release information](/windows/release-health/release-information).
-
-
-
-ADMX Info:
-- GP Friendly name: *Select the target Feature Update version*
-- GP name: *TargetProductVersion*
-- GP element: *TargetProductVersionId*
-- GP path: *Windows Components/Windows Update/Windows Update for Business*
-- GP ADMX file name: *WindowsUpdate.admx*
-
-
-
-Value type is a string containing a Windows product, for example, “Windows 11” or “11” or “Windows 10”.
-
-
-
-
-
-
-
-
-By using this Windows Update for Business policy to upgrade devices to a new product (ex. Windows 11) you are agreeing that when applying this operating system to a device either
-(1) The applicable Windows license was purchased though volume licensing, or
-(2) That you are authorized to bind your organization and are accepting on its behalf the relevant Microsoft Software License Terms to be found here: (https://www.microsoft.com/Useterms).
-
-
-
**Update/TargetReleaseVersion**
-
-
-
Edition
-
Windows 10
-
Windows 11
-
-
-
Home
-
No
-
No
-
-
-
Pro
-
Yes
-
Yes
-
-
-
Business
-
Yes
-
Yes
-
-
-
Enterprise
-
Yes
-
Yes
-
-
-
Education
-
Yes
-
Yes
-
-
+
+|Edition|Windows 10|Windows 11|
+|--- |--- |--- |
+|Home|No|No|
+|Pro|Yes|Yes|
+|Business|Yes|Yes|
+|Enterprise|Yes|Yes|
+|Education|Yes|Yes|
@@ -4771,7 +3614,7 @@ Available in Windows 10, version 1803 and later. Enables IT administrators to sp
ADMX Info:
- GP Friendly name: *Select the target Feature Update version*
- GP name: *TargetReleaseVersion*
-- GP element: *TargetReleaseVersionId*
+- GP element: *TargetReleaseVersionInfo*
- GP path: *Windows Components/Windows Update/Windows Update for Business*
- GP ADMX file name: *WindowsUpdate.admx*
@@ -4793,38 +3636,14 @@ Value type is a string containing Windows 10 version number. For example, 1809,
**Update/UpdateNotificationLevel**
-
+
+|Edition|Windows 10|Windows 11|
+|--- |--- |--- |
+|Home|No|No|
+|Pro|Yes|Yes|
+|Business|Yes|Yes|
+|Enterprise|Yes|Yes|
+|Education|Yes|Yes|
diff --git a/windows/client-management/mdm/policy-csp-userrights.md b/windows/client-management/mdm/policy-csp-userrights.md
index 65fb6facfd..7c468e27a5 100644
--- a/windows/client-management/mdm/policy-csp-userrights.md
+++ b/windows/client-management/mdm/policy-csp-userrights.md
@@ -5,9 +5,9 @@ ms.author: dansimp
ms.topic: article
ms.prod: w10
ms.technology: windows
-author: manikadhiman
+author: dansimp
ms.localizationpriority: medium
-ms.date: 09/27/2019
+ms.date: 11/24/2021
ms.reviewer:
manager: dansimp
---
@@ -197,38 +197,14 @@ For example, the following syntax grants user rights to a specific user or group
**UserRights/AccessCredentialManagerAsTrustedCaller**
-
+
+|Edition|Windows 10|Windows 11|
+|--- |--- |--- |
+|Home|No|No|
+|Pro|Yes|Yes|
+|Business|Yes|Yes|
+|Enterprise|Yes|Yes|
+|Education|Yes|Yes|
@@ -567,6 +423,14 @@ GP Info:
This user right determines which users and groups can change the time and date on the internal clock of the computer. Users that are assigned this user right can affect the appearance of event logs. If the system time is changed, events that are logged will reflect this new time, not the actual time that the events occurred.
+> [!CAUTION]
+> Configuring user rights replaces existing users or groups previously assigned those user rights. The system requires that Local Service account (SID S-1-5-19) always has the ChangeSystemTime right. Therefore, Local Service must always be specified in addition to any other accounts being configured in this policy.
+>
+> Not including the Local Service account will result in failure with the following error:
+>
+> | Error code | Symbolic name | Error description | Header |
+> |----------|----------|----------|----------|
+> | 0x80070032 (Hex)|ERROR_NOT_SUPPORTED|The request is not supported.| winerror.h |
@@ -583,38 +447,14 @@ GP Info:
**UserRights/CreateGlobalObjects**
-
+
+|Edition|Windows 10|Windows 11|
+|--- |--- |--- |
+|Home|No|No|
+|Pro|Yes|Yes|
+|Business|Yes|Yes|
+|Enterprise|Yes|Yes|
+|Education|Yes|Yes|
@@ -1080,9 +752,10 @@ GP Info:
-This security setting determines which service accounts are prevented from registering a process as a service.
+This security setting determines which users are prevented from logging on to the computer. This policy setting supersedes the **Allow log on locally** policy setting if an account is subject to both policies.
+
> [!NOTE]
-> This security setting does not apply to the System, Local Service, or Network Service accounts.
+> If you apply this security policy to the **Everyone** group, no one will be able to log on locally.
@@ -1099,38 +772,14 @@ GP Info:
**UserRights/DenyRemoteDesktopServicesLogOn**
-
+
+
+
+
+
+**VirtualizationBasedTechnology/HypervisorEnforcedCodeIntegrity**
+
+
+
+|Edition|Windows 10|Windows 11|
+|--- |--- |--- |
+|Home|Yes|Yes|
+|Pro|Yes|Yes|
+|Business|Yes|Yes|
+|Enterprise|Yes|Yes|
+|Education|Yes|Yes|
+
+
+
+
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
+
+Allows the IT admin to control the state of Hypervisor-protected Code Integrity (HVCI) on devices. HVCI is a feature within Virtualization Based Security, and is frequently referred to as Memory integrity. Learn more [here](/windows-hardware/design/device-experiences/oem-vbs).
+
+>[!NOTE]
+>After the policy is pushed, a system reboot will be required to change the state of HVCI.
+
+
+
+The following are the supported values:
+
+- 0: (Disabled) Turns off Hypervisor-Protected Code Integrity remotely if configured previously without UEFI Lock
+- 1: (Enabled with UEFI lock) Turns on Hypervisor-Protected Code Integrity with UEFI lock
+- 2: (Enabled without lock) Turns on Hypervisor-Protected Code Integrity without UEFI lock
+
+
+
+
+
+
+
+
+
+
+
+
+**VirtualizationBasedTechnology/RequireUEFIMemoryAttributesTable**
+
+
+
+|Edition|Windows 10|Windows 11|
+|--- |--- |--- |
+|Home|Yes|Yes|
+|Pro|Yes|Yes|
+|Business|Yes|Yes|
+|Enterprise|Yes|Yes|
+|Education|Yes|Yes|
+
+
+
+
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
+
+Allows the IT admin to control the state of Hypervisor-protected Code Integrity (HVCI) on devices. HVCI is a feature within Virtualization Based Security, and is frequently referred to as Memory integrity. Learn more [here](/windows-hardware/design/device-experiences/oem-vbs).
+
+>[!NOTE]
+>After the policy is pushed, a system reboot will be required to change the state of HVCI.
+
+
+
+
+The following are the supported values:
+
+- 0: (Disabled) Do not require UEFI Memory Attributes Table
+- 1: (Enabled) Require UEFI Memory Attributes Table
+
+
+
+
+
+
+
+
+
+
+
+
+
diff --git a/windows/client-management/mdm/policy-csp-wifi.md b/windows/client-management/mdm/policy-csp-wifi.md
index 77728974a0..0f2a4df17d 100644
--- a/windows/client-management/mdm/policy-csp-wifi.md
+++ b/windows/client-management/mdm/policy-csp-wifi.md
@@ -5,7 +5,7 @@ ms.author: dansimp
ms.topic: article
ms.prod: w10
ms.technology: windows
-author: manikadhiman
+author: dansimp
ms.localizationpriority: medium
ms.date: 09/27/2019
ms.reviewer:
@@ -64,38 +64,14 @@ This policy has been deprecated.
**Wifi/AllowAutoConnectToWiFiSenseHotspots**
-
-
-
Edition
-
Windows 10
-
Windows 11
-
-
-
Home
-
No
-
No
-
-
-
Pro
-
Yes
-
Yes
-
-
-
Business
-
Yes
-
Yes
-
-
-
Enterprise
-
Yes
-
Yes
-
-
-
Education
-
Yes
-
Yes
-
-
+
+|Edition|Windows 10|Windows 11|
+|--- |--- |--- |
+|Home|No|No|
+|Pro|Yes|Yes|
+|Business|Yes|Yes|
+|Enterprise|Yes|Yes|
+|Education|Yes|Yes|
@@ -138,38 +114,14 @@ The following list shows the supported values:
**Wifi/AllowInternetSharing**
-
-
-
Edition
-
Windows 10
-
Windows 11
-
-
-
Home
-
No
-
No
-
-
-
Pro
-
Yes
-
Yes
-
-
-
Business
-
Yes
-
Yes
-
-
-
Enterprise
-
Yes
-
Yes
-
-
-
Education
-
Yes
-
Yes
-
-
+
+|Edition|Windows 10|Windows 11|
+|--- |--- |--- |
+|Home|No|No|
+|Pro|Yes|Yes|
+|Business|Yes|Yes|
+|Enterprise|Yes|Yes|
+|Education|Yes|Yes|
@@ -212,38 +164,14 @@ The following list shows the supported values:
**Wifi/AllowManualWiFiConfiguration**
-
-
-
Edition
-
Windows 10
-
Windows 11
-
-
-
Home
-
No
-
No
-
-
-
Pro
-
Yes
-
Yes
-
-
-
Business
-
Yes
-
Yes
-
-
-
Enterprise
-
Yes
-
Yes
-
-
-
Education
-
Yes
-
Yes
-
-
+
+|Edition|Windows 10|Windows 11|
+|--- |--- |--- |
+|Home|No|No|
+|Pro|Yes|Yes|
+|Business|Yes|Yes|
+|Enterprise|Yes|Yes|
+|Education|Yes|Yes|
@@ -281,38 +209,14 @@ The following list shows the supported values:
**Wifi/AllowWiFi**
-
-
-
Edition
-
Windows 10
-
Windows 11
-
-
-
Home
-
No
-
No
-
-
-
Pro
-
Yes
-
Yes
-
-
-
Business
-
Yes
-
Yes
-
-
-
Enterprise
-
Yes
-
Yes
-
-
-
Education
-
Yes
-
Yes
-
-
+
+|Edition|Windows 10|Windows 11|
+|--- |--- |--- |
+|Home|No|No|
+|Pro|Yes|Yes|
+|Business|Yes|Yes|
+|Enterprise|Yes|Yes|
+|Education|Yes|Yes|
@@ -347,38 +251,14 @@ The following list shows the supported values:
**Wifi/AllowWiFiDirect**
-
-
-
Edition
-
Windows 10
-
Windows 11
-
-
-
Home
-
No
-
No
-
-
-
Pro
-
Yes
-
Yes
-
-
-
Business
-
Yes
-
Yes
-
-
-
Enterprise
-
Yes
-
Yes
-
-
-
Education
-
Yes
-
Yes
-
-
+
+|Edition|Windows 10|Windows 11|
+|--- |--- |--- |
+|Home|No|No|
+|Pro|Yes|Yes|
+|Business|Yes|Yes|
+|Enterprise|Yes|Yes|
+|Education|Yes|Yes|
@@ -411,38 +291,14 @@ The following list shows the supported values:
**Wifi/WLANScanMode**
-
-
-
Edition
-
Windows 10
-
Windows 11
-
-
-
Home
-
No
-
No
-
-
-
Pro
-
Yes
-
Yes
-
-
-
Business
-
Yes
-
Yes
-
-
-
Enterprise
-
Yes
-
Yes
-
-
-
Education
-
Yes
-
Yes
-
-
+
+|Edition|Windows 10|Windows 11|
+|--- |--- |--- |
+|Home|No|No|
+|Pro|Yes|Yes|
+|Business|Yes|Yes|
+|Enterprise|Yes|Yes|
+|Education|Yes|Yes|
diff --git a/windows/client-management/mdm/policy-csp-windowsautopilot.md b/windows/client-management/mdm/policy-csp-windowsautopilot.md
new file mode 100644
index 0000000000..1dc3fde74d
--- /dev/null
+++ b/windows/client-management/mdm/policy-csp-windowsautopilot.md
@@ -0,0 +1,74 @@
+---
+title: Policy CSP - WindowsAutoPilot
+description: Learn to use the Policy CSP - WindowsAutoPilot setting to enable or disable Autopilot Agility feature.
+ms.author: dansimp
+ms.topic: article
+ms.prod: w10
+ms.technology: windows
+author: alekyaj
+ms.localizationpriority: medium
+ms.date: 11/25/2021
+ms.reviewer:
+manager: dansimp
+---
+
+# Policy CSP - WindowsAutoPilot
+
+
+
+
+
+
+## WindowsAutoPilot policies
+
+
+
+|Edition|Windows 10|Windows 11|
+|--- |--- |--- |
+|Home|Yes|Yes|
+|Pro|Yes|Yes|
+|Business|Yes|Yes|
+|Enterprise|Yes|Yes|
+|Education|Yes|Yes|
@@ -210,7 +162,7 @@ ADMX Info:
-Use this policy setting to specify if to display the Account protection area in Windows Defender Security Center. If you disable or do not configure this setting, Windows defender Security Center will display this area.
+Use this policy setting to specify if to display the Account protection area in Windows Defender Security Center. If you disable or do not configure this setting, Windows Defender Security Center will display this area.
@@ -236,38 +188,14 @@ Valid values:
**WindowsDefenderSecurityCenter/DisableAppBrowserUI**
-
-
-
Edition
-
Windows 10
-
Windows 11
-
-
-
Home
-
Yes
-
Yes
-
-
-
Pro
-
Yes
-
Yes
-
-
-
Business
-
Yes
-
Yes
-
-
-
Enterprise
-
Yes
-
Yes
-
-
-
Education
-
Yes
-
Yes
-
-
+
+|Edition|Windows 10|Windows 11|
+|--- |--- |--- |
+|Home|Yes|Yes|
+|Pro|Yes|Yes|
+|Business|Yes|Yes|
+|Enterprise|Yes|Yes|
+|Education|Yes|Yes|
@@ -282,7 +210,7 @@ Valid values:
-Use this policy setting if you want to disable the display of the app and browser protection area in Windows Defender Security Center. If you disable or do not configure this setting, Windows defender Security Center will display this area.
+Use this policy setting if you want to disable the display of the app and browser protection area in Windows Defender Security Center. If you disable or do not configure this setting, Windows Defender Security Center will display this area.
Value type is integer. Supported operations are Add, Get, Replace and Delete.
@@ -310,38 +238,14 @@ The following list shows the supported values:
**WindowsDefenderSecurityCenter/DisableClearTpmButton**
-
+
+|Edition|Windows 10|Windows 11|
+|--- |--- |--- |
+|Home|Yes|Yes|
+|Pro|Yes|Yes|
+|Business|Yes|Yes|
+|Enterprise|Yes|Yes|
+|Education|Yes|Yes|
@@ -444,7 +324,7 @@ ADMX Info:
-Use this policy setting if you want to disable the display of the Device security area in the Windows Defender Security Center. If you disable or do not configure this setting, Windows defender Security Center will display this area.
+Use this policy setting if you want to disable the display of the Device security area in the Windows Defender Security Center. If you disable or do not configure this setting, Windows Defender Security Center will display this area.
@@ -470,38 +350,14 @@ Valid values:
**WindowsDefenderSecurityCenter/DisableEnhancedNotifications**
-
-
-
Edition
-
Windows 10
-
Windows 11
-
-
-
Home
-
Yes
-
Yes
-
-
-
Pro
-
Yes
-
Yes
-
-
-
Business
-
Yes
-
Yes
-
-
-
Enterprise
-
Yes
-
Yes
-
-
-
Education
-
Yes
-
Yes
-
-
+
+|Edition|Windows 10|Windows 11|
+|--- |--- |--- |
+|Home|Yes|Yes|
+|Pro|Yes|Yes|
+|Business|Yes|Yes|
+|Enterprise|Yes|Yes|
+|Education|Yes|Yes|
@@ -547,38 +403,14 @@ The following list shows the supported values:
**WindowsDefenderSecurityCenter/DisableFamilyUI**
-
-
-
Edition
-
Windows 10
-
Windows 11
-
-
-
Home
-
Yes
-
Yes
-
-
-
Pro
-
Yes
-
Yes
-
-
-
Business
-
Yes
-
Yes
-
-
-
Enterprise
-
Yes
-
Yes
-
-
-
Education
-
Yes
-
Yes
-
-
+
+|Edition|Windows 10|Windows 11|
+|--- |--- |--- |
+|Home|Yes|Yes|
+|Pro|Yes|Yes|
+|Business|Yes|Yes|
+|Enterprise|Yes|Yes|
+|Education|Yes|Yes|
@@ -593,7 +425,7 @@ The following list shows the supported values:
-Use this policy setting if you want to disable the display of the family options area in Windows Defender Security Center. If you disable or do not configure this setting, Windows defender Security Center will display this area.
+Use this policy setting if you want to disable the display of the family options area in Windows Defender Security Center. If you disable or do not configure this setting, Windows Defender Security Center will display this area.
Value type is integer. Supported operations are Add, Get, Replace and Delete.
@@ -621,38 +453,14 @@ The following list shows the supported values:
**WindowsDefenderSecurityCenter/DisableHealthUI**
-
-
-
Edition
-
Windows 10
-
Windows 11
-
-
-
Home
-
Yes
-
Yes
-
-
-
Pro
-
Yes
-
Yes
-
-
-
Business
-
Yes
-
Yes
-
-
-
Enterprise
-
Yes
-
Yes
-
-
-
Education
-
Yes
-
Yes
-
-
+
+|Edition|Windows 10|Windows 11|
+|--- |--- |--- |
+|Home|Yes|Yes|
+|Pro|Yes|Yes|
+|Business|Yes|Yes|
+|Enterprise|Yes|Yes|
+|Education|Yes|Yes|
@@ -667,7 +475,7 @@ The following list shows the supported values:
-Use this policy setting if you want to disable the display of the device performance and health area in Windows Defender Security Center. If you disable or do not configure this setting, Windows defender Security Center will display this area.
+Use this policy setting if you want to disable the display of the device performance and health area in Windows Defender Security Center. If you disable or do not configure this setting, Windows Defender Security Center will display this area.
Value type is integer. Supported operations are Add, Get, Replace and Delete.
@@ -695,38 +503,14 @@ The following list shows the supported values:
**WindowsDefenderSecurityCenter/DisableNetworkUI**
-
-
-
Edition
-
Windows 10
-
Windows 11
-
-
-
Home
-
Yes
-
Yes
-
-
-
Pro
-
Yes
-
Yes
-
-
-
Business
-
Yes
-
Yes
-
-
-
Enterprise
-
Yes
-
Yes
-
-
-
Education
-
Yes
-
Yes
-
-
+
+|Edition|Windows 10|Windows 11|
+|--- |--- |--- |
+|Home|Yes|Yes|
+|Pro|Yes|Yes|
+|Business|Yes|Yes|
+|Enterprise|Yes|Yes|
+|Education|Yes|Yes|
@@ -741,7 +525,7 @@ The following list shows the supported values:
-Use this policy setting if you want to disable the display of the firewall and network protection area in Windows Defender Security Center. If you disable or do not configure this setting, Windows defender Security Center will display this area.
+Use this policy setting if you want to disable the display of the firewall and network protection area in Windows Defender Security Center. If you disable or do not configure this setting, Windows Defender Security Center will display this area.
Value type is integer. Supported operations are Add, Get, Replace and Delete.
@@ -769,38 +553,14 @@ The following list shows the supported values:
**WindowsDefenderSecurityCenter/DisableNotifications**
-
-
-
Edition
-
Windows 10
-
Windows 11
-
-
-
Home
-
Yes
-
Yes
-
-
-
Pro
-
Yes
-
Yes
-
-
-
Business
-
Yes
-
Yes
-
-
-
Enterprise
-
Yes
-
Yes
-
-
-
Education
-
Yes
-
Yes
-
-
+
+|Edition|Windows 10|Windows 11|
+|--- |--- |--- |
+|Home|Yes|Yes|
+|Pro|Yes|Yes|
+|Business|Yes|Yes|
+|Enterprise|Yes|Yes|
+|Education|Yes|Yes|
@@ -843,38 +603,14 @@ The following list shows the supported values:
**WindowsDefenderSecurityCenter/DisableTpmFirmwareUpdateWarning**
-
+
+|Edition|Windows 10|Windows 11|
+|--- |--- |--- |
+|Home|Yes|Yes|
+|Pro|Yes|Yes|
+|Business|Yes|Yes|
+|Enterprise|Yes|Yes|
+|Education|Yes|Yes|
@@ -977,7 +689,7 @@ ADMX Info:
-Use this policy setting if you want to disable the display of the virus and threat protection area in Windows Defender Security Center. If you disable or do not configure this setting, Windows defender Security Center will display this area.
+Use this policy setting if you want to disable the display of the virus and threat protection area in Windows Defender Security Center. If you disable or do not configure this setting, Windows Defender Security Center will display this area.
Value type is integer. Supported operations are Add, Get, Replace and Delete.
@@ -1005,38 +717,14 @@ The following list shows the supported values:
**WindowsDefenderSecurityCenter/DisallowExploitProtectionOverride**
-
-
-
Edition
-
Windows 10
-
Windows 11
-
-
-
Home
-
Yes
-
Yes
-
-
-
Pro
-
Yes
-
Yes
-
-
-
Business
-
Yes
-
Yes
-
-
-
Enterprise
-
Yes
-
Yes
-
-
-
Education
-
Yes
-
Yes
-
-
+
+|Edition|Windows 10|Windows 11|
+|--- |--- |--- |
+|Home|Yes|Yes|
+|Pro|Yes|Yes|
+|Business|Yes|Yes|
+|Enterprise|Yes|Yes|
+|Education|Yes|Yes|
@@ -1079,38 +767,14 @@ The following list shows the supported values:
**WindowsDefenderSecurityCenter/Email**
-
+
+|Edition|Windows 10|Windows 11|
+|--- |--- |--- |
+|Home|No|No|
+|Pro|Yes|Yes|
+|Business|Yes|Yes|
+|Enterprise|Yes|Yes|
+|Education|Yes|Yes|
diff --git a/windows/client-management/mdm/policy-csp-windowssandbox.md b/windows/client-management/mdm/policy-csp-windowssandbox.md
index f3fd70ab14..b3c4462090 100644
--- a/windows/client-management/mdm/policy-csp-windowssandbox.md
+++ b/windows/client-management/mdm/policy-csp-windowssandbox.md
@@ -5,7 +5,7 @@ ms.author: dansimp
ms.topic: article
ms.prod: w10
ms.technology: windows
-author: manikadhiman
+author: dansimp
ms.localizationpriority: medium
ms.date: 10/14/2020
---
@@ -48,38 +48,14 @@ ms.date: 10/14/2020
Available in the latest Windows 10 insider preview build.
-
-
-
Edition
-
Windows 10
-
Windows 11
-
-
-
Home
-
No
-
No
-
-
-
Pro
-
Yes
-
Yes
-
-
-
Business
-
No
-
No
-
-
-
Enterprise
-
Yes
-
Yes
-
-
-
Education
-
Yes
-
Yes
-
-
+
+|Edition|Windows 10|Windows 11|
+|--- |--- |--- |
+|Home|No|No|
+|Pro|Yes|Yes|
+|Business|No|No|
+|Enterprise|Yes|Yes|
+|Education|Yes|Yes|
@@ -142,38 +118,14 @@ The following are the supported values:
Available in the latest Windows 10 insider preview build.
-
-
-
Edition
-
Windows 10
-
Windows 11
-
-
-
Home
-
No
-
No
-
-
-
Pro
-
Yes
-
Yes
-
-
-
Business
-
No
-
No
-
-
-
Enterprise
-
Yes
-
Yes
-
-
-
Education
-
Yes
-
Yes
-
-
+
+|Edition|Windows 10|Windows 11|
+|--- |--- |--- |
+|Home|No|No|
+|Pro|Yes|Yes|
+|Business|No|No|
+|Enterprise|Yes|Yes|
+|Education|Yes|Yes|
@@ -233,38 +185,14 @@ The following are the supported values:
Available in the latest Windows 10 insider preview build.
-
-
-
Edition
-
Windows 10
-
Windows 11
-
-
-
Home
-
No
-
No
-
-
-
Pro
-
Yes
-
Yes
-
-
-
Business
-
No
-
No
-
-
-
Enterprise
-
Yes
-
Yes
-
-
-
Education
-
Yes
-
Yes
-
-
+
+|Edition|Windows 10|Windows 11|
+|--- |--- |--- |
+|Home|No|No|
+|Pro|Yes|Yes|
+|Business|No|No|
+|Enterprise|Yes|Yes|
+|Education|Yes|Yes|
@@ -322,38 +250,14 @@ The following are the supported values:
Available in the latest Windows 10 insider preview build.
-
-
-
Edition
-
Windows 10
-
Windows 11
-
-
-
Home
-
No
-
No
-
-
-
Pro
-
Yes
-
Yes
-
-
-
Business
-
No
-
No
-
-
-
Enterprise
-
Yes
-
Yes
-
-
-
Education
-
Yes
-
Yes
-
-
+
+|Edition|Windows 10|Windows 11|
+|--- |--- |--- |
+|Home|No|No|
+|Pro|Yes|Yes|
+|Business|No|No|
+|Enterprise|Yes|Yes|
+|Education|Yes|Yes|
@@ -412,38 +316,14 @@ The following are the supported values:
Available in the latest Windows 10 insider preview build.
-
-
-
Edition
-
Windows 10
-
Windows 11
-
-
-
Home
-
No
-
No
-
-
-
Pro
-
Yes
-
Yes
-
-
-
Business
-
No
-
No
-
-
-
Enterprise
-
Yes
-
Yes
-
-
-
Education
-
Yes
-
Yes
-
-
+
+|Edition|Windows 10|Windows 11|
+|--- |--- |--- |
+|Home|No|No|
+|Pro|Yes|Yes|
+|Business|No|No|
+|Enterprise|Yes|Yes|
+|Education|Yes|Yes|
@@ -505,38 +385,14 @@ The following are the supported values:
Available in the latest Windows 10 insider preview build.
-
+
+|Edition|Windows 10|Windows 11|
+|--- |--- |--- |
+|Home|No|No|
+|Pro|Yes|Yes|
+|Business|Yes|Yes|
+|Enterprise|Yes|Yes|
+|Education|Yes|Yes|
@@ -117,38 +96,14 @@ The following list shows the supported values:
**WirelessDisplay/AllowMdnsDiscovery**
-
-
-
Edition
-
Windows 10
-
Windows 11
-
-
-
Home
-
No
-
No
-
-
-
Pro
-
Yes
-
Yes
-
-
-
Business
-
Yes
-
Yes
-
-
-
Enterprise
-
Yes
-
Yes
-
-
-
Education
-
Yes
-
Yes
-
-
+
+|Edition|Windows 10|Windows 11|
+|--- |--- |--- |
+|Home|No|No|
+|Pro|Yes|Yes|
+|Business|Yes|Yes|
+|Enterprise|Yes|Yes|
+|Education|Yes|Yes|
@@ -177,42 +132,65 @@ The following list shows the supported values:
+
+**WirelessDisplay/AllowMovementDetectionOnInfrastructure**
+
+
+
+|Edition|Windows 10|Windows 11|
+|--- |--- |--- |
+|Home|No|No|
+|Pro|Yes|Yes|
+|Business|Yes|Yes|
+|Enterprise|Yes|Yes|
+|Education|Yes|Yes|
+
+
+
+
+
+[Scope](./policy-configuration-service-provider.md#policy-scope):
+
+> [!div class = "checklist"]
+> * Device
+
+
+
+
+
+This policy setting allows you to disable the infrastructure movement detection feature.
+
+If you set it to 0, your PC may stay connected and continue to project if you walk away from a Wireless Display receiver to which you are projecting over infrastructure.
+
+If you set it to 1, your PC will detect that you have moved and will automatically disconnect your infrastructure Wireless Display session.
+
+The default value is 1.
+
+
+
+
+The following list shows the supported values:
+
+- 0 - Do not allow
+- 1 (Default) - Allow
+
+
+
+
+
+
**WirelessDisplay/AllowProjectionFromPC**
-
-
-
Edition
-
Windows 10
-
Windows 11
-
-
-
Home
-
No
-
No
-
-
-
Pro
-
Yes
-
Yes
-
-
-
Business
-
Yes
-
Yes
-
-
-
Enterprise
-
Yes
-
Yes
-
-
-
Education
-
Yes
-
Yes
-
-
+
+|Edition|Windows 10|Windows 11|
+|--- |--- |--- |
+|Home|No|No|
+|Pro|Yes|Yes|
+|Business|Yes|Yes|
+|Enterprise|Yes|Yes|
+|Education|Yes|Yes|
@@ -245,38 +223,14 @@ The following list shows the supported values:
**WirelessDisplay/AllowProjectionFromPCOverInfrastructure**
-
-
-
Edition
-
Windows 10
-
Windows 11
-
-
-
Home
-
No
-
No
-
-
-
Pro
-
Yes
-
Yes
-
-
-
Business
-
Yes
-
Yes
-
-
-
Enterprise
-
Yes
-
Yes
-
-
-
Education
-
Yes
-
Yes
-
-
+
+|Edition|Windows 10|Windows 11|
+|--- |--- |--- |
+|Home|No|No|
+|Pro|Yes|Yes|
+|Business|Yes|Yes|
+|Enterprise|Yes|Yes|
+|Education|Yes|Yes|
@@ -309,38 +263,14 @@ The following list shows the supported values:
**WirelessDisplay/AllowProjectionToPC**
-
-
-
Edition
-
Windows 10
-
Windows 11
-
-
-
Home
-
No
-
No
-
-
-
Pro
-
Yes
-
Yes
-
-
-
Business
-
Yes
-
Yes
-
-
-
Enterprise
-
Yes
-
Yes
-
-
-
Education
-
Yes
-
Yes
-
-
+
+|Edition|Windows 10|Windows 11|
+|--- |--- |--- |
+|Home|No|No|
+|Pro|Yes|Yes|
+|Business|Yes|Yes|
+|Enterprise|Yes|Yes|
+|Education|Yes|Yes|
@@ -385,38 +315,14 @@ The following list shows the supported values:
**WirelessDisplay/AllowProjectionToPCOverInfrastructure**
-
-
-
Edition
-
Windows 10
-
Windows 11
-
-
-
Home
-
No
-
No
-
-
-
Pro
-
Yes
-
Yes
-
-
-
Business
-
Yes
-
Yes
-
-
-
Enterprise
-
Yes
-
Yes
-
-
-
Education
-
Yes
-
Yes
-
-
+
+|Edition|Windows 10|Windows 11|
+|--- |--- |--- |
+|Home|No|No|
+|Pro|Yes|Yes|
+|Business|Yes|Yes|
+|Enterprise|Yes|Yes|
+|Education|Yes|Yes|
@@ -449,38 +355,14 @@ The following list shows the supported values:
**WirelessDisplay/AllowUserInputFromWirelessDisplayReceiver**
-
-
-
Edition
-
Windows 10
-
Windows 11
-
-
-
Home
-
No
-
No
-
-
-
Pro
-
Yes
-
Yes
-
-
-
Business
-
Yes
-
Yes
-
-
-
Enterprise
-
Yes
-
Yes
-
-
-
Education
-
Yes
-
Yes
-
-
+
+|Edition|Windows 10|Windows 11|
+|--- |--- |--- |
+|Home|No|No|
+|Pro|Yes|Yes|
+|Business|Yes|Yes|
+|Enterprise|Yes|Yes|
+|Education|Yes|Yes|
@@ -513,38 +395,14 @@ The following list shows the supported values:
**WirelessDisplay/RequirePinForPairing**
-
-
-
Edition
-
Windows 10
-
Windows 11
-
-
-
Home
-
No
-
No
-
-
-
Pro
-
Yes
-
Yes
-
-
-
Business
-
Yes
-
Yes
-
-
-
Enterprise
-
Yes
-
Yes
-
-
-
Education
-
Yes
-
Yes
-
-
+
+|Edition|Windows 10|Windows 11|
+|--- |--- |--- |
+|Home|No|No|
+|Pro|Yes|Yes|
+|Business|Yes|Yes|
+|Enterprise|Yes|Yes|
+|Education|Yes|Yes|
diff --git a/windows/client-management/mdm/policy-ddf-file.md b/windows/client-management/mdm/policy-ddf-file.md
index dde8b3089c..4294786148 100644
--- a/windows/client-management/mdm/policy-ddf-file.md
+++ b/windows/client-management/mdm/policy-ddf-file.md
@@ -8,7 +8,7 @@ ms.author: dansimp
ms.topic: article
ms.prod: w10
ms.technology: windows
-author: manikadhiman
+author: dansimp
ms.localizationpriority: medium
ms.date: 10/28/2020
---
diff --git a/windows/client-management/mdm/policymanager-csp.md b/windows/client-management/mdm/policymanager-csp.md
index 656e292b4e..903e9b2279 100644
--- a/windows/client-management/mdm/policymanager-csp.md
+++ b/windows/client-management/mdm/policymanager-csp.md
@@ -8,7 +8,7 @@ ms.author: dansimp
ms.topic: article
ms.prod: w10
ms.technology: windows
-author: manikadhiman
+author: dansimp
ms.date: 06/28/2017
---
diff --git a/windows/client-management/mdm/provisioning-csp.md b/windows/client-management/mdm/provisioning-csp.md
index aad96d1dbf..6e19fc3072 100644
--- a/windows/client-management/mdm/provisioning-csp.md
+++ b/windows/client-management/mdm/provisioning-csp.md
@@ -8,7 +8,7 @@ ms.author: dansimp
ms.topic: article
ms.prod: w10
ms.technology: windows
-author: manikadhiman
+author: dansimp
ms.date: 06/26/2017
---
diff --git a/windows/client-management/mdm/proxy-csp.md b/windows/client-management/mdm/proxy-csp.md
index 2a474b9321..8cea583448 100644
--- a/windows/client-management/mdm/proxy-csp.md
+++ b/windows/client-management/mdm/proxy-csp.md
@@ -8,7 +8,7 @@ ms.author: dansimp
ms.topic: article
ms.prod: w10
ms.technology: windows
-author: manikadhiman
+author: dansimp
ms.date: 06/26/2017
---
diff --git a/windows/client-management/mdm/push-notification-windows-mdm.md b/windows/client-management/mdm/push-notification-windows-mdm.md
index 92df20eba2..13294f3ce5 100644
--- a/windows/client-management/mdm/push-notification-windows-mdm.md
+++ b/windows/client-management/mdm/push-notification-windows-mdm.md
@@ -11,7 +11,7 @@ ms.author: dansimp
ms.topic: article
ms.prod: w10
ms.technology: windows
-author: manikadhiman
+author: dansimp
ms.date: 09/22/2017
---
diff --git a/windows/client-management/mdm/pxlogical-csp.md b/windows/client-management/mdm/pxlogical-csp.md
index 1b7b94e690..8a68f85050 100644
--- a/windows/client-management/mdm/pxlogical-csp.md
+++ b/windows/client-management/mdm/pxlogical-csp.md
@@ -8,7 +8,7 @@ ms.author: dansimp
ms.topic: article
ms.prod: w10
ms.technology: windows
-author: manikadhiman
+author: dansimp
ms.date: 06/26/2017
---
@@ -17,7 +17,8 @@ ms.date: 06/26/2017
The PXLOGICAL configuration service provider is used to add, remove, or modify WAP logical and physical proxies by using WAP or the standard Windows techniques.
-> **Note** This configuration service provider requires the ID\_CAP\_CSP\_FOUNDATION and ID\_CAP\_NETWORKING\_ADMIN capabilities to be accessed from a network configuration application.
+> [!NOTE]
+> This configuration service provider requires the ID\_CAP\_CSP\_FOUNDATION and ID\_CAP\_NETWORKING\_ADMIN capabilities to be accessed from a network configuration application.
The following shows the PXLOGICAL configuration service provider management object in tree format as used by OMA Client Provisioning for initial bootstrapping of the device. The OMA DM protocol is not supported by this configuration service provider.
@@ -151,36 +152,12 @@ The following table shows the Microsoft custom elements that this configuration
These features are available only for the device technique. In addition, the parameter-query and characteristic-query features are not supported for all PXPHYSICAL proxy parameters for all PXADDR types. All parameters can be queried when the PXPHYSICAL proxy PXADDRType is IPv4. For example, if a mobile operator queries the TO-NAPID parameter of a PXPHYSICAL proxy and the PXADDR Type is E164, a noparm is returned.
-
-
-
-
-
-
-
-
Feature
-
Available
-
-
-
-
-
parm-query
-
Yes
-
-
-
noparm
-
Yes
-
-
-
nocharacteristic
-
Yes
-
-
-
characteristic-query
-
Yes
-
-
-
+|Feature|Available|
+|--- |--- |
+|parm-query|Yes|
+|noparm|Yes|
+|nocharacteristic|Yes|
+|characteristic-query|Yes|
@@ -189,12 +166,3 @@ These features are available only for the device technique. In addition, the par
[Configuration service provider reference](configuration-service-provider-reference.md)
-
-
-
-
-
-
-
-
-
diff --git a/windows/client-management/mdm/reboot-csp.md b/windows/client-management/mdm/reboot-csp.md
index dd1cfc4c3a..95d4d915de 100644
--- a/windows/client-management/mdm/reboot-csp.md
+++ b/windows/client-management/mdm/reboot-csp.md
@@ -8,7 +8,7 @@ ms.author: dansimp
ms.topic: article
ms.prod: w10
ms.technology: windows
-author: manikadhiman
+author: dansimp
ms.date: 06/26/2017
---
diff --git a/windows/client-management/mdm/reboot-ddf-file.md b/windows/client-management/mdm/reboot-ddf-file.md
index 1cf001cffb..aa6d711c71 100644
--- a/windows/client-management/mdm/reboot-ddf-file.md
+++ b/windows/client-management/mdm/reboot-ddf-file.md
@@ -8,7 +8,7 @@ ms.author: dansimp
ms.topic: article
ms.prod: w10
ms.technology: windows
-author: manikadhiman
+author: dansimp
ms.date: 12/05/2017
---
diff --git a/windows/client-management/mdm/reclaim-seat-from-user.md b/windows/client-management/mdm/reclaim-seat-from-user.md
index 3beb6993e3..5f8bb0e5da 100644
--- a/windows/client-management/mdm/reclaim-seat-from-user.md
+++ b/windows/client-management/mdm/reclaim-seat-from-user.md
@@ -8,7 +8,7 @@ ms.author: dansimp
ms.topic: article
ms.prod: w10
ms.technology: windows
-author: manikadhiman
+author: dansimp
ms.date: 05/05/2020
---
@@ -18,120 +18,31 @@ The **Reclaim seat from user** operation returns reclaimed seats for a user in t
## Request
-
+|Method|Request URI|
+|--- |--- |
+|DELETE|`https://bspmts.mp.microsoft.com/V1/Inventory/{productId}/{skuId}/Seats/{username}`|
### URI parameters
The following parameters may be specified in the request URI.
-
-
-
-
-
-
-
-
-
Parameter
-
Type
-
Description
-
-
-
-
-
productId
-
string
-
Required. Product identifier for an application that is used by the Store for Business.
-
-
-
skuId
-
string
-
Required. Product identifier that specifies a specific SKU of an application.
-
-
-
username
-
string
-
Requires UserPrincipalName (UPN). User name of the target user account.
-
-
-
+|Parameter|Type|Description|
+|--- |--- |--- |
+|productId|string|Required. Product identifier for an application that is used by the Store for Business.|
+|skuId|string|Required. Product identifier that specifies a specific SKU of an application.|
+|username|string|Requires UserPrincipalName (UPN). User name of the target user account.|
-
## Response
### Response body
The response body contain [SeatDetails](data-structures-windows-store-for-business.md#seatdetails).
-
+|Error code|Description|Retry|Data field|Details|
+|--- |--- |--- |--- |--- |
+|400|Invalid parameters|No|Parameter name Reason: Invalid parameter Details: String|Invalid can include productId, skuId or userName|
+|404|Not found||Item type: Inventory, User, Seat Values: ProductId/SkuId, UserName, ProductId/SkuId/UserName|ItemType: Inventory, User, Seat Values: ProductId/SkuId, UserName, ProductId/SkuId/UserName|
+|409|Conflict||Reason: Not online||
-
-
-
-
-
-
-
diff --git a/windows/client-management/mdm/register-your-free-azure-active-directory-subscription.md b/windows/client-management/mdm/register-your-free-azure-active-directory-subscription.md
index 28e198aa1f..f799b48992 100644
--- a/windows/client-management/mdm/register-your-free-azure-active-directory-subscription.md
+++ b/windows/client-management/mdm/register-your-free-azure-active-directory-subscription.md
@@ -8,7 +8,7 @@ ms.author: dansimp
ms.topic: article
ms.prod: w10
ms.technology: windows
-author: manikadhiman
+author: dansimp
ms.date: 06/26/2017
---
@@ -23,11 +23,11 @@ If you have paid subscriptions to Office 365, Microsoft Dynamics CRM Online, Ent
1. Sign in to the Microsoft 365 admin center at using your organization's account.
- 
+ 
2. On the **Home** page, click on the Admin tools icon.
- 
+ 
3. On the **Admin center** page, under Admin Centers on the left, click **Azure Active Directory**. This will take you to the Azure Active Directory portal.
diff --git a/windows/client-management/mdm/registry-csp.md b/windows/client-management/mdm/registry-csp.md
index 4978cc70e0..bcf194d65a 100644
--- a/windows/client-management/mdm/registry-csp.md
+++ b/windows/client-management/mdm/registry-csp.md
@@ -8,7 +8,7 @@ ms.author: dansimp
ms.topic: article
ms.prod: w10
ms.technology: windows
-author: manikadhiman
+author: dansimp
ms.date: 06/26/2017
---
@@ -33,7 +33,7 @@ For OMA Client Provisioning, the follows notes apply:
- This documentation describes the default characteristics. Additional characteristics may be added.
-- Because the **Registry** configuration service provider uses the backslash (\\) character as a separator between key names, backslashes which occur in the name of a registry key must be escaped. Backslashes can be escaped by using two sequential backslashes (\\\\).
+- Because the **Registry** configuration service provider uses the backslash (\\) character as a separator between key names, backslashes, which occur in the name of a registry key must be escaped. Backslashes can be escaped by using two sequential backslashes (\\\\).
The default security role maps to each subnode unless specific permission is granted to the subnode. The security role for subnodes is implementation specific, and can be changed by OEMs and mobile operators.
@@ -41,38 +41,12 @@ The default security role maps to each subnode unless specific permission is gra
The following table shows the Microsoft custom elements that this configuration service provider supports for OMA Client Provisioning.
-
Top-level query: No|
Use these elements to build standard OMA Client Provisioning configuration XML. For information about specific elements, see MSPROV DTD elements.
@@ -82,62 +56,16 @@ Use these elements to build standard OMA Client Provisioning configuration XML.
The following table shows the data types this configuration service provider supports.
-
-
-
-
-
-
-
-
-
XML Data Type
-
Native Registry Type
-
XML Format
-
-
-
-
-
integer
-
REG_DWORD
-
Integer. A query of this parameter returns an integer type.
-
-
-
boolean
-
REG_DWORD
-
Integer value of 1 or 0. A query of this parameter returns an integer type.
-
-
-
float
-
REG_SZ
-
Float. A query of this parameter returns a string type.
-
-
-
string
-
REG_SZ
-
String. A query of this parameter returns a string type.
-
-
-
multiplestring
-
REG_MULTI_SZ
-
Multiple strings are separated by  and ended with two  - A query of this parameter returns a multistring type.
-
-
-
binary
-
REG_BINARY
-
Base64 encoded. A query of this parameter returns a binary type.
-
-
-
time
-
FILETIME in REG_BINARY
-
The time format conforms to the ISO8601 standard, with the date portion optional. If the date portion is omitted, also omit the "T" delimiter. A query of this parameter returns a binary type.
-
-
-
date
-
FILETIME in REG_BINARY
-
The date format conforms to the ISO8601 standard, with the time portion optional. If the time portion is omitted, also omit the "T" delimiter. A query of this parameter returns a binary type.
-
-
-
+|XML Data Type|Native Registry Type|XML Format|
+|--- |--- |--- |
+|Integer|REG_DWORD|Integer. A query of this parameter returns an integer type.|
+|Boolean|REG_DWORD|Integer value of 1 or 0. A query of this parameter returns an integer type.|
+|Float|REG_SZ|Float. A query of this parameter returns a string type.|
+|String|REG_SZ|String. A query of this parameter returns a string type.|
+|multiple string|REG_MULTI_SZ|Multiple strings are separated by **** and ended with two **** - A query of this parameter returns a multi-string type.|
+|Binary|REG_BINARY|Base64 encoded. A query of this parameter returns a binary type.|
+|Time|FILETIME in REG_BINARY|The time format conforms to the ISO8601 standard, with the date portion optional. If the date portion is omitted, also omit the "T" delimiter. A query of this parameter returns a binary type.|
+|Date|FILETIME in REG_BINARY|The date format conforms to the ISO8601 standard, with the time portion optional. If the time portion is omitted, also omit the "T" delimiter. A query of this parameter returns a binary type.|
@@ -147,13 +75,3 @@ It is not possible to access registry keys nested under the current path by usin
[Configuration service provider reference](configuration-service-provider-reference.md)
-
-
-
-
-
-
-
-
-
-
diff --git a/windows/client-management/mdm/registry-ddf-file.md b/windows/client-management/mdm/registry-ddf-file.md
index 6b6bc9c191..61b54cc6cb 100644
--- a/windows/client-management/mdm/registry-ddf-file.md
+++ b/windows/client-management/mdm/registry-ddf-file.md
@@ -8,7 +8,7 @@ ms.author: dansimp
ms.topic: article
ms.prod: w10
ms.technology: windows
-author: manikadhiman
+author: dansimp
ms.date: 06/26/2017
---
diff --git a/windows/client-management/mdm/remotefind-csp.md b/windows/client-management/mdm/remotefind-csp.md
index 0dc50af800..c559340720 100644
--- a/windows/client-management/mdm/remotefind-csp.md
+++ b/windows/client-management/mdm/remotefind-csp.md
@@ -8,7 +8,7 @@ ms.author: dansimp
ms.topic: article
ms.prod: w10
ms.technology: windows
-author: manikadhiman
+author: dansimp
ms.date: 06/26/2017
---
diff --git a/windows/client-management/mdm/remotefind-ddf-file.md b/windows/client-management/mdm/remotefind-ddf-file.md
index 211fd88e78..e6b61e9477 100644
--- a/windows/client-management/mdm/remotefind-ddf-file.md
+++ b/windows/client-management/mdm/remotefind-ddf-file.md
@@ -8,7 +8,7 @@ ms.author: dansimp
ms.topic: article
ms.prod: w10
ms.technology: windows
-author: manikadhiman
+author: dansimp
ms.date: 12/05/2017
---
diff --git a/windows/client-management/mdm/remotelock-csp.md b/windows/client-management/mdm/remotelock-csp.md
index 47ee3981e4..6550982c70 100644
--- a/windows/client-management/mdm/remotelock-csp.md
+++ b/windows/client-management/mdm/remotelock-csp.md
@@ -8,7 +8,7 @@ ms.author: dansimp
ms.topic: article
ms.prod: w10
ms.technology: windows
-author: manikadhiman
+author: dansimp
ms.date: 06/26/2017
---
@@ -26,71 +26,21 @@ The RemoteLock CSP supports the ability to lock a device that has a PIN set on t
**Lock**
Required. The setting accepts requests to lock the device screen. The device screen will lock immediately if a PIN has been set. If no PIN is set, the lock request is ignored and the OMA DM (405) Forbidden error is returned over the management channel. All OMA DM errors are listed [here](https://go.microsoft.com/fwlink/p/?LinkId=522607) in the protocol specification. The supported operations are Get and Exec.
-
-
-
-
-
-
-
-
-
Status
-
Description
-
Meaning [Standard]
-
-
-
-
-
(200) OK
-
The device was successfully locked.
-
The command and the associated Alert action are completed successfully.
-
-
-
(405)
-
The device could not be locked because there is no PIN currently set on the device.
-
The requested command is not allowed on the target.
-
-
-
(500) Command failed
-
The device was not locked for some unknown reason.
-
Non-specific errors were created by the recipient while attempting to complete the command.
-
-
-
-
-
+|Status|Description|Meaning [Standard]|
+|--- |--- |--- |
+|(200) OK|The device was successfully locked.|The command and the associated Alert action are completed successfully.|
+|(405)|The device could not be locked because there is no PIN currently set on the device.|The requested command is not allowed on the target.|
+|(500) Command failed|The device was not locked for some unknown reason.|Non-specific errors were created by the recipient while attempting to complete the command.|
**LockAndResetPIN**
This setting can be used to lock and reset the PIN on the device. It is used in conjunction with the NewPINValue node. After the **Exec** operation is called successfully on this node, the previous PIN will no longer work and cannot be recovered. The supported operation is Exec.
This node will return the following status. All OMA DM errors are listed [here](https://go.microsoft.com/fwlink/p/?LinkId=522607) in the protocol specification.
-
-
-
-
-
-
-
-
-
Status
-
Description
-
Meaning
-
-
-
-
-
(200) OK
-
The device has been locked with a new password which has been reset.
-
The command and the associated Alert action are completed successfully.
-
-
-
(500) Command failed
-
N/A
-
Non-specific errors were created by the recipient while attempting to complete the command.
-
-
-
+|Status|Description|Meaning|
+|--- |--- |--- |
+|(200) OK|The device has been locked with a new password which has been reset.|The command and the associated Alert action are completed successfully.|
+|(500) Command failed|N/A|Non-specific errors were created by the recipient while attempting to complete the command.|
**LockAndRecoverPIN**
Added in Windows 10, version 1703. This setting performs a similar function to the LockAndResetPIN node. With LockAndResetPIN any Windows Hello keys associated with the PIN gets deleted, but with LockAndRecoverPIN those keys are saved. After the Exec operation is called successfully on this setting, the new PIN can be retrieved from the NewPINValue setting. The previous PIN will no longer work.
diff --git a/windows/client-management/mdm/remotelock-ddf-file.md b/windows/client-management/mdm/remotelock-ddf-file.md
index d740994fc1..ade9d84d3e 100644
--- a/windows/client-management/mdm/remotelock-ddf-file.md
+++ b/windows/client-management/mdm/remotelock-ddf-file.md
@@ -8,7 +8,7 @@ ms.author: dansimp
ms.topic: article
ms.prod: w10
ms.technology: windows
-author: manikadhiman
+author: dansimp
ms.date: 12/05/2017
---
diff --git a/windows/client-management/mdm/remotering-csp.md b/windows/client-management/mdm/remotering-csp.md
index 8125620d66..548923b5fe 100644
--- a/windows/client-management/mdm/remotering-csp.md
+++ b/windows/client-management/mdm/remotering-csp.md
@@ -8,7 +8,7 @@ ms.author: dansimp
ms.topic: article
ms.prod: w10
ms.technology: windows
-author: manikadhiman
+author: dansimp
ms.date: 06/26/2017
---
diff --git a/windows/client-management/mdm/remotering-ddf-file.md b/windows/client-management/mdm/remotering-ddf-file.md
index 6ce26f1758..763d8b6a90 100644
--- a/windows/client-management/mdm/remotering-ddf-file.md
+++ b/windows/client-management/mdm/remotering-ddf-file.md
@@ -8,7 +8,7 @@ ms.author: dansimp
ms.topic: article
ms.prod: w10
ms.technology: windows
-author: manikadhiman
+author: dansimp
ms.date: 12/05/2017
---
diff --git a/windows/client-management/mdm/remotewipe-csp.md b/windows/client-management/mdm/remotewipe-csp.md
index 67772b648f..3b2af238ea 100644
--- a/windows/client-management/mdm/remotewipe-csp.md
+++ b/windows/client-management/mdm/remotewipe-csp.md
@@ -8,7 +8,7 @@ ms.author: dansimp
ms.topic: article
ms.prod: w10
ms.technology: windows
-author: manikadhiman
+author: dansimp
ms.date: 08/13/2018
---
diff --git a/windows/client-management/mdm/remotewipe-ddf-file.md b/windows/client-management/mdm/remotewipe-ddf-file.md
index 36a83bee33..b423d893d9 100644
--- a/windows/client-management/mdm/remotewipe-ddf-file.md
+++ b/windows/client-management/mdm/remotewipe-ddf-file.md
@@ -8,7 +8,7 @@ ms.author: dansimp
ms.topic: article
ms.prod: w10
ms.technology: windows
-author: manikadhiman
+author: dansimp
ms.date: 08/13/2018
---
diff --git a/windows/client-management/mdm/reporting-csp.md b/windows/client-management/mdm/reporting-csp.md
index c8bc78834a..bd1d4ec925 100644
--- a/windows/client-management/mdm/reporting-csp.md
+++ b/windows/client-management/mdm/reporting-csp.md
@@ -8,7 +8,7 @@ ms.author: dansimp
ms.topic: article
ms.prod: w10
ms.technology: windows
-author: manikadhiman
+author: dansimp
ms.date: 06/26/2017
---
diff --git a/windows/client-management/mdm/reporting-ddf-file.md b/windows/client-management/mdm/reporting-ddf-file.md
index 5b16192077..d5d716e6bb 100644
--- a/windows/client-management/mdm/reporting-ddf-file.md
+++ b/windows/client-management/mdm/reporting-ddf-file.md
@@ -8,7 +8,7 @@ ms.author: dansimp
ms.topic: article
ms.prod: w10
ms.technology: windows
-author: manikadhiman
+author: dansimp
ms.date: 12/05/2017
---
diff --git a/windows/client-management/mdm/rest-api-reference-windows-store-for-business.md b/windows/client-management/mdm/rest-api-reference-windows-store-for-business.md
index ad6dd045e3..db7f1cc835 100644
--- a/windows/client-management/mdm/rest-api-reference-windows-store-for-business.md
+++ b/windows/client-management/mdm/rest-api-reference-windows-store-for-business.md
@@ -11,7 +11,7 @@ ms.author: dansimp
ms.topic: article
ms.prod: w10
ms.technology: windows
-author: manikadhiman
+author: dansimp
ms.date: 09/18/2017
---
diff --git a/windows/client-management/mdm/rootcacertificates-csp.md b/windows/client-management/mdm/rootcacertificates-csp.md
index c1e940ef69..643e41cb54 100644
--- a/windows/client-management/mdm/rootcacertificates-csp.md
+++ b/windows/client-management/mdm/rootcacertificates-csp.md
@@ -8,7 +8,7 @@ ms.author: dansimp
ms.topic: article
ms.prod: w10
ms.technology: windows
-author: manikadhiman
+author: dansimp
ms.date: 03/06/2018
---
diff --git a/windows/client-management/mdm/rootcacertificates-ddf-file.md b/windows/client-management/mdm/rootcacertificates-ddf-file.md
index 166dfc0d43..78f3e0b69e 100644
--- a/windows/client-management/mdm/rootcacertificates-ddf-file.md
+++ b/windows/client-management/mdm/rootcacertificates-ddf-file.md
@@ -8,7 +8,7 @@ ms.author: dansimp
ms.topic: article
ms.prod: w10
ms.technology: windows
-author: manikadhiman
+author: dansimp
ms.date: 03/07/2018
---
diff --git a/windows/client-management/mdm/secureassessment-csp.md b/windows/client-management/mdm/secureassessment-csp.md
index 57f3dfc283..1911fa064d 100644
--- a/windows/client-management/mdm/secureassessment-csp.md
+++ b/windows/client-management/mdm/secureassessment-csp.md
@@ -8,7 +8,7 @@ ms.author: dansimp
ms.topic: article
ms.prod: w10
ms.technology: windows
-author: manikadhiman
+author: dansimp
ms.date: 06/26/2017
---
diff --git a/windows/client-management/mdm/secureassessment-ddf-file.md b/windows/client-management/mdm/secureassessment-ddf-file.md
index 383470060b..76fa3dcb8b 100644
--- a/windows/client-management/mdm/secureassessment-ddf-file.md
+++ b/windows/client-management/mdm/secureassessment-ddf-file.md
@@ -8,7 +8,7 @@ ms.author: dansimp
ms.topic: article
ms.prod: w10
ms.technology: windows
-author: manikadhiman
+author: dansimp
ms.date: 12/05/2017
---
diff --git a/windows/client-management/mdm/securitypolicy-csp.md b/windows/client-management/mdm/securitypolicy-csp.md
index fbc7a1ec31..b92b03ae67 100644
--- a/windows/client-management/mdm/securitypolicy-csp.md
+++ b/windows/client-management/mdm/securitypolicy-csp.md
@@ -8,7 +8,7 @@ ms.author: dansimp
ms.topic: article
ms.prod: w10
ms.technology: windows
-author: manikadhiman
+author: dansimp
ms.date: 06/26/2017
---
@@ -17,7 +17,8 @@ ms.date: 06/26/2017
The SecurityPolicy configuration service provider is used to configure security policy settings for WAP push, OMA Client Provisioning, OMA DM, Service Indication (SI), Service Loading (SL), and MMS.
-> **Note** This configuration service provider requires the ID\_CAP\_CSP\_FOUNDATION and ID\_CAP\_DEVICE\_MANAGEMENT\_SECURITY\_POLICIES capabilities to be accessed from a network configuration application.
+> [!NOTE]
+> This configuration service provider requires the ID\_CAP\_CSP\_FOUNDATION and ID\_CAP\_DEVICE\_MANAGEMENT\_SECURITY\_POLICIES capabilities to be accessed from a network configuration application.
@@ -36,122 +37,78 @@ Defines the security policy identifier as a decimal value.
The following security policies are supported.
-
-
-
-
-
-
-
-
-
PolicyID
-
Policy name
-
Policy description
-
-
-
-
-
4104
-
Hex: 1008
-
TPS Policy
-
This setting indicates whether mobile operators can be assigned the Trusted Provisioning Server (TPS) SECROLE_OPERATOR_TPS role.
-
Default value: 1
-
Supported values:
-
0: The TPS role assignment is disabled.
-
1: The TPS role assignment is enabled, and can be assigned to mobile operators.
-
-
-
4105
-
Hex: 1009
-
Message Authentication Retry Policy
-
This setting specifies the maximum number of times the user is allowed to try authenticating a Wireless Application Protocol (WAP) PIN-signed message.
-
Default value: 3
-
Possible values: 0 through 256.
-
-
-
4108
-
Hex: 100c
-
Service Loading Policy
-
This setting indicates whether SL messages are accepted, by specifying the security roles that can accept SL messages. An SL message downloads new services or provisioning XML to the device.
This setting indicates whether SI messages are accepted, by specifying the security roles that can accept SI messages. An SI message is sent to the device to notify users of new services, service updates, and provisioning services.
This setting determines whether PIN signed OMA Client Provisioning messages will be processed. This policy's value specifies a role mask. If a message contains at least one of the following roles in the role mask, then the message is processed. To ensure properly signed OMA Client Provisioning messages are accepted by the configuration client, all of the roles that are set in 4141, 4142, and 4143 policies must also be set in this policy. For example, to ensure properly signed USERNETWPIN signed OMA Client Provisioning messages are accepted by the device, if policy 4143 is set to 4096 (SECROLE_ANY_PUSH_SOURCE) for an carrier-unlocked device, policy 4111 must also have the SECROLE_ANY_PUSH_SOURCE role set.
This setting indicates whether Wireless Session Protocol (WSP) notifications from the WAP stack are routed.
-
Default value: 1
-
Supported values:
-
0: Routing of WSP notifications is not allowed.
-
1: Routing of WSP notifications is allowed.
-
-
-
4132
-
Hex:1024
-
Network PIN signed OTA Provision Message User Prompt Policy
-
This policy specifies whether the device will prompt a UI to get the user confirmation before processing a pure network pin signed OTA Provisioning message. If prompt, the user has the ability to discard the OTA provisioning message.
-
Default value: 0
-
Supported values:
-
0: The device prompts a UI to get user confirmation when the OTA WAP provisioning message is signed purely with network pin.
-
1: There is no user prompt.
-
-
-
4141
-
Hex:102d
-
OMA CP NETWPIN Policy
-
This setting determines whether the OMA network PIN signed message will be accepted. The message's role mask and the policy's role mask are combined using the AND operator. If the result is non-zero, then the message is accepted.
This setting determines whether the OMA user PIN or user MAC signed message will be accepted. The message's role mask and the policy's role mask are combined using the AND operator. If the result is non-zero, then the message is accepted.
This setting determines whether the OMA user network PIN signed message will be accepted. The message's role mask and the policy's role mask are combined using the AND operator. If the result is non-zero, then the message is accepted.
This setting determines whether MMS messages will be processed. This policy's value specifies a role mask. If a message contains at least one of the roles in the role mask, then the message is processed.
+- **PolicyID**: 4104 | Hex: 1008
+ - **Policy name**: TPS Policy
+ - **Policy description**: This setting indicates whether mobile operators can be assigned the Trusted Provisioning Server (TPS) SECROLE_OPERATOR_TPS role.
+ - Default value: 1
+ - Supported values:
+ - 0: The TPS role assignment is disabled.
+ - 1: The TPS role assignment is enabled, and can be assigned to mobile operators.
+
+- **PolicyID**: 4105 | Hex: 1009
+ - **Policy name**: Message Authentication Retry Policy
+ - **Policy description**: This setting specifies the maximum number of times the user is allowed to try authenticating a Wireless Application Protocol (WAP) PIN-signed message.
+ - Default value: 3
+ - Supported values: 0 through 256
+
+- **PolicyID**: 4108 | Hex: 100c
+ - **Policy name**: Service Loading Policy
+ - **Policy description**: This setting indicates whether SL messages are accepted, by specifying the security roles that can accept SL messages. An SL message downloads new services or provisioning XML to the device.
+ - Default value: 256 (SECROLE_KNOWN_PPG)
+ - Supported values: SECROLE_ANY_PUSH_SOURCE, SECROLE_KNOWN_PPG
+
+- **PolicyID**: 4109 | Hex:100d
+ - **Policy name**: Service Indication Policy
+ - **Policy description**: This setting indicates whether SI messages are accepted, by specifying the security roles that can accept SI messages. An SI message is sent to the device to notify users of new services, service updates, and provisioning services.
+ - Default value: 256 (SECROLE_KNOWN_PPG)
+ - Supported values: SECROLE_ANY_PUSH_SOURCE, SECROLE_KNOWN_PPG
+
+- **PolicyID**: 4111 | Hex:100f
+ - **Policy name**: OTA Provisioning Policy
+ - **Policy description**: This setting determines whether PIN signed OMA Client Provisioning messages will be processed. This policy's value specifies a role mask. If a message contains at least one of the following roles in the role mask, then the message is processed. To ensure properly signed OMA Client Provisioning messages are accepted by the configuration client, all of the roles that are set in 4141, 4142, and 4143 policies must also be set in this policy. For example, to ensure properly signed USERNETWPIN signed OMA Client Provisioning messages are accepted by the device, if policy 4143 is set to 4096 (SECROLE_ANY_PUSH_SOURCE) for an carrier-unlocked device, policy 4111 must also have the SECROLE_ANY_PUSH_SOURCE role set.
+ - Default value: 384 (SECROLE_OPERATOR_TPS | SECROLE_KNOWN_PPG)
+ - Supported values: SECROLE_KNOWN_PPG, SECROLE_ANY_PUSH_SOURCE, SECROLE_OPERATOR_TPS
+
+- **PolicyID**: 4113 | Hex:1011
+ - **Policy name**: WSP Push Policy
+ - **Policy description**: This setting indicates whether Wireless Session Protocol (WSP) notifications from the WAP stack are routed.
+ - Default value: 1
+ - Supported values:
+ - 0: Routing of WSP notifications is not allowed.
+ - 1: Routing of WSP notifications is allowed.
+
+- **PolicyID**: 4132 | Hex:1024
+ - **Policy name**: Network PIN signed OTA Provision Message User Prompt Policy
+ - **Policy description**: This policy specifies whether the device will prompt a UI to get the user confirmation before processing a pure network pin signed OTA Provisioning message. If prompt, the user has the ability to discard the OTA provisioning message.
+ - Default value: 0
+ - Supported values:
+ - 0: The device prompts a UI to get user confirmation when the OTA WAP provisioning message is signed purely with network pin.
+ - 1: There is no user prompt.
+
+- **PolicyID**: 4141 | Hex:102d
+ - **Policy name**: OMA CP NETWPIN Policy
+ - **Policy description**: This setting determines whether the OMA network PIN signed message will be accepted. The message's role mask and the policy's role mask are combined using the AND operator. If the result is non-zero, then the message is accepted.
+ - Default value: 0
+ - Supported values: SECROLE_KNOWN_PPG, SECROLE_ANY_PUSH_SOURCE , SECROLE_OPERATOR_TPS
+
+- **PolicyID**: 4142 | Hex:102e
+ - **Policy name**: OMA CP USERPIN Policy
+ - **Policy description**: This setting determines whether the OMA user PIN or user MAC signed message will be accepted. The message's role mask and the policy's role mask are combined using the AND operator. If the result is non-zero, then the message is accepted.
+ - Default value: 256
+ - Supported values: SECROLE_OPERATOR_TPS, SECROLE_ANY_PUSH_SOURCE, SECROLE_KNOWN_PPG
+
+- **PolicyID**: 4143 | Hex:102f
+ - **Policy name**: OMA CP USERNETWPIN Policy
+ - **Policy description**: This setting determines whether the OMA user network PIN signed message will be accepted. The message's role mask and the policy's role mask are combined using the AND operator. If the result is non-zero, then the message is accepted.
+ - Default value: 256
+ - Supported values: SECROLE_KNOWN_PPG, SECROLE_ANY_PUSH_SOURCE, SECROLE_OPERATOR_TPS
+
+- **PolicyID**: 4144 | Hex:1030
+ - **Policy name**: MMS Message Policy
+ - **Policy description**: This setting determines whether MMS messages will be processed. This policy's value specifies a role mask. If a message contains at least one of the roles in the role mask, then the message is processed.
+ - Default value: 256 (SECROLE_KNOWN_PPG)
+ - Supported values: SECROLE_KNOWN_PPG, SECROLE_ANY_PUSH_SOURCE
-
## Remarks
@@ -160,41 +117,11 @@ Security roles allow or restrict access to device resources. The security role i
The following security roles are supported.
-
-
-
-
-
-
-
-
-
Security role
-
Decimal value
-
Description
-
-
-
-
-
SECROLE_OPERATOR_TPS
-
128
-
Trusted Provisioning Server.
-
Assigned to WAP messages that come from a Push Initiator that is authenticated (SECROLE_PPG_AUTH) by a trusted Push Proxy Gateway (SECROLE_TRUSTED_PPG), and where the Uniform Resource Identifier (URI) of the Push Initiator corresponds to the URI of the Trusted Provisioning Server (TPS) on the device.
-
The mobile operator can determine whether this role and the SECROLE_OPERATOR role require the same permissions.
-
-
-
SECROLE_KNOWN_PPG
-
256
-
Known Push Proxy Gateway.
-
Messages assigned this role indicate that the device knows the address to the Push Proxy Gateway.
-
-
-
SECROLE_ANY_PUSH_SOURCE
-
4096
-
Push Router.
-
Messages received by the push router will be assigned to this role.
-
-
-
+|Security role|Decimal value|Description|
+|--- |--- |--- |
+|SECROLE_OPERATOR_TPS|128|Trusted Provisioning Server. Assigned to WAP messages that come from a Push Initiator that is authenticated (SECROLE_PPG_AUTH) by a trusted Push Proxy Gateway (SECROLE_TRUSTED_PPG), and where the Uniform Resource Identifier (URI) of the Push Initiator corresponds to the URI of the Trusted Provisioning Server (TPS) on the device. The mobile operator can determine whether this role and the SECROLE_OPERATOR role require the same permissions.|
+|SECROLE_KNOWN_PPG|256|Known Push Proxy Gateway. Messages assigned this role indicate that the device knows the address to the Push Proxy Gateway.|
+|SECROLE_ANY_PUSH_SOURCE|4096|Push Router. Messages received by the push router will be assigned to this role.|
@@ -271,28 +198,10 @@ Querying a security policy:
The following table shows the Microsoft custom elements that this Configuration Service Provider supports for OMA Client Provisioning.
-
-
-
-
-
-
-
-
Elements
-
Available
-
-
-
-
-
parm-query
-
Yes
-
-
-
noparm
-
Yes. If this is used, then the policy is set to 0 by default (corresponding to the most restrictive of policy values).
-
-
-
+|Elements|Available|
+|--- |--- |
+|parm-query|Yes|
+|noparm|Yes. If this is used, then the policy is set to 0 by default (corresponding to the most restrictive of policy values).|
@@ -300,13 +209,3 @@ The following table shows the Microsoft custom elements that this Configuration
[Configuration service provider reference](configuration-service-provider-reference.md)
-
-
-
-
-
-
-
-
-
-
diff --git a/windows/client-management/mdm/server-requirements-windows-mdm.md b/windows/client-management/mdm/server-requirements-windows-mdm.md
index 032469c901..3880906b71 100644
--- a/windows/client-management/mdm/server-requirements-windows-mdm.md
+++ b/windows/client-management/mdm/server-requirements-windows-mdm.md
@@ -11,7 +11,7 @@ ms.author: dansimp
ms.topic: article
ms.prod: w10
ms.technology: windows
-author: manikadhiman
+author: dansimp
ms.date: 06/26/2017
---
diff --git a/windows/client-management/mdm/sharedpc-csp.md b/windows/client-management/mdm/sharedpc-csp.md
index 82731ed689..fb2d0fb906 100644
--- a/windows/client-management/mdm/sharedpc-csp.md
+++ b/windows/client-management/mdm/sharedpc-csp.md
@@ -8,7 +8,7 @@ ms.author: dansimp
ms.topic: article
ms.prod: w10
ms.technology: windows
-author: manikadhiman
+author: dansimp
ms.date: 01/16/2019
---
diff --git a/windows/client-management/mdm/sharedpc-ddf-file.md b/windows/client-management/mdm/sharedpc-ddf-file.md
index 61e26ea7a0..362f24ac59 100644
--- a/windows/client-management/mdm/sharedpc-ddf-file.md
+++ b/windows/client-management/mdm/sharedpc-ddf-file.md
@@ -8,7 +8,7 @@ ms.author: dansimp
ms.topic: article
ms.prod: w10
ms.technology: windows
-author: manikadhiman
+author: dansimp
ms.date: 12/05/2017
---
diff --git a/windows/client-management/mdm/storage-csp.md b/windows/client-management/mdm/storage-csp.md
index ea5aad60ca..2bb326151e 100644
--- a/windows/client-management/mdm/storage-csp.md
+++ b/windows/client-management/mdm/storage-csp.md
@@ -8,7 +8,7 @@ ms.author: dansimp
ms.topic: article
ms.prod: w10
ms.technology: windows
-author: manikadhiman
+author: dansimp
ms.date: 06/26/2017
---
diff --git a/windows/client-management/mdm/storage-ddf-file.md b/windows/client-management/mdm/storage-ddf-file.md
index 17340fbf2d..16d67a7431 100644
--- a/windows/client-management/mdm/storage-ddf-file.md
+++ b/windows/client-management/mdm/storage-ddf-file.md
@@ -8,7 +8,7 @@ ms.author: dansimp
ms.topic: article
ms.prod: w10
ms.technology: windows
-author: manikadhiman
+author: dansimp
ms.date: 12/05/2017
---
diff --git a/windows/client-management/mdm/structure-of-oma-dm-provisioning-files.md b/windows/client-management/mdm/structure-of-oma-dm-provisioning-files.md
index 2b482383bd..ee78eb1927 100644
--- a/windows/client-management/mdm/structure-of-oma-dm-provisioning-files.md
+++ b/windows/client-management/mdm/structure-of-oma-dm-provisioning-files.md
@@ -8,7 +8,7 @@ ms.author: dansimp
ms.topic: article
ms.prod: w10
ms.technology: windows
-author: manikadhiman
+author: dansimp
ms.date: 06/26/2017
---
@@ -22,32 +22,10 @@ Each message is composed of a header, specified by the SyncHdr element, and a me
The following table shows the OMA DM versions that are supported.
-
</SyncML>|
+|OMA DM version 1.2|<SyncML xmlns='SYNCML:SYNCML1.2'>
</SyncML>|
## File format
@@ -103,7 +81,8 @@ This information is used to by the client device to properly manage the DM sessi
The following example shows the header component of a DM message. In this case, OMA DM version 1.2 is used as an example only.
-> **Note** The <LocURI> node value for the <Source> element in the SyncHdr of the device-generated DM package should be the same as the value of ./DevInfo/DevID. For more information about DevID, see [DevInfo configuration service provider](devinfo-csp.md).
+> [!NOTE]
+> The `` node value for the `` element in the SyncHdr of the device-generated DM package should be the same as the value of ./DevInfo/DevID. For more information about DevID, see [DevInfo configuration service provider](devinfo-csp.md).
@@ -147,7 +126,7 @@ The following example shows the body component of a DM message. In this example,
When using SyncML for OMA DM provisioning, a LocURI in SyncBody can have a "." as a valid segment name only in the first segment. However, a "." is not a valid segment name for the other segments. For example, the following LocURI is not valid because the segment name of the seventh segment is a ".".
-```
+```xml
./Vendor/MSFT/Registry/HKLM/Security/./Test
```
@@ -188,11 +167,3 @@ The following example illustrates how to use the Replace command to update a dev
```
-
-
-
-
-
-
-
-
diff --git a/windows/client-management/mdm/supl-csp.md b/windows/client-management/mdm/supl-csp.md
index e41a8c2374..32af3e680b 100644
--- a/windows/client-management/mdm/supl-csp.md
+++ b/windows/client-management/mdm/supl-csp.md
@@ -8,7 +8,7 @@ ms.author: dansimp
ms.topic: article
ms.prod: w10
ms.technology: windows
-author: manikadhiman
+author: dansimp
ms.date: 09/12/2019
---
@@ -16,56 +16,30 @@ ms.date: 09/12/2019
The SUPL configuration service provider is used to configure the location client, as shown in the following table:
-
-
-
-
-
-
-
-
-
Location Service
-
SUPL
-
V2 UPL
-
-
-
-
-
Connection type
-
All connections other than CDMA
-
CDMA
-
-
-
Configuration
-
-
Settings that need to get pushed to the GNSS driver to configure the SUPL behavior:
-
-
Address of the Home SUPL (H-SLP) server.
-
H-SLP server certificate.
-
Positioning method.
-
Version of the protocol to use by default.
-
-
MCC/MNC value pairs which are used to specify which networks' UUIC the SUPL account matches.
-
-
-
Address of the server — a mobile positioning center for non-trusted mode.
-
The positioning method used by the MPC for non-trusted mode.
-
-
-
-
+- **Location Service**: Connection type
+ - **SUPL**: All connections other than CDMA
+ - **V2 UPL**: CDMA
-
+- **Location Service**: Configuration
+ - **SUPL**:
+ - Settings that need to get pushed to the GNSS driver to configure the SUPL behavior:
+ - Address of the Home SUPL (H-SLP) server.
+ - H-SLP server certificate.
+ - Positioning method.
+ - Version of the protocol to use by default.
+ - MCC/MNC value pairs which are used to specify which networks' UUIC the SUPL account matches.
+ - **V2 UPL**:
+ - Address of the server — a mobile positioning center for non-trusted mode.
+ - The positioning method used by the MPC for non-trusted mode.
The SUPL or V2 UPL connection will be reconfigured every time the device is rebooted, a new UICC is inserted, or new settings are provisioned by using OMA Client Provisioning, OMA DM, or test tools. When the device is in roaming mode, it reverts to Mobile Station Standalone mode, in which only the built–in Microsoft location components are used.
The following shows the SUPL configuration service provider management object in tree format as used by OMA DM and OMA Client Provisioning.
-> **Note** This configuration service provider requires the ID\_CAP\_CSP\_FOUNDATION capability to be accessed from a network configuration application.
+> [!NOTE]
+> This configuration service provider requires the ID\_CAP\_CSP\_FOUNDATION capability to be accessed from a network configuration application.
-
-
-```
+```console
./Vendor/MSFT/
SUPL
----SUPL1
@@ -97,6 +71,7 @@ SUPL
--------NIDefaultTimeout
--------ServerAccessInterval
```
+
**SUPL1**
Required for SUPL. Defines the account for the SUPL Enabled Terminal (SET) node. Only one SUPL account is supported at a given time.
@@ -126,50 +101,21 @@ For OMA DM, if the format for this node is incorrect the entry will be ignored a
**HighAccPositioningMethod**
Optional. Specifies the positioning method that the SUPL client will use for mobile originated position requests. The value can be one of the following integers:
-
-
-
-
-
-
-
-
Value
-
Description
-
-
-
-
-
0
-
None: The device uses the default positioning method. In this default mode, the GNSS obtains assistance (time injection, coarse position injection and ephemeris data) from the Microsoft Positioning Service.
-
-
-
1
-
Mobile Station Assisted: The device contacts the H-SLP server to obtain a position. The H-SLP does the calculation of the position and returns it to the device.
-
-
-
2
-
Mobile Station Based: The device obtains location-aiding data (almanac, ephemeris data, time and coarse initial position of the device) from the H-SLP server, and the device uses this information to help GPS obtain a fix. All position calculations are done in the device.
-
-
-
3
-
Mobile Station Standalone: The device obtains assistance as required from the Microsoft location services.
-
-
-
4
-
OTDOA
-
-
-
5
-
AFLT
-
-
-
+|Value|Description|
+|--- |--- |
+|0|None: The device uses the default positioning method. In this default mode, the GNSS obtains assistance (time injection, coarse position injection and ephemeris data) from the Microsoft Positioning Service.|
+|1|Mobile Station Assisted: The device contacts the H-SLP server to obtain a position. The H-SLP does the calculation of the position and returns it to the device.|
+|2|Mobile Station Based: The device obtains location-aiding data (almanac, ephemeris data, time and coarse initial position of the device) from the H-SLP server, and the device uses this information to help GPS obtain a fix. All position calculations are done in the device.|
+|3|Mobile Station Standalone: The device obtains assistance as required from the Microsoft location services.|
+|4|OTDOA|
+|5|AFLT|
The default is 0. The default method in Windows devices provides high-quality assisted GNSS positioning for mobile originated position requests without loading the mobile operator’s network or location services.
-> **Important** The Mobile Station Assisted, OTDOA, and AFLT positioning methods must only be configured for test purposes.
+> [!IMPORTANT]
+> The Mobile Station Assisted, OTDOA, and AFLT positioning methods must only be configured for test purposes.
@@ -180,44 +126,13 @@ Optional. Boolean. Specifies whether the location toggle on the **location** scr
This value manages the settings for both SUPL and v2 UPL. If a device is configured for both SUPL and V2 UPL and these values differ, the SUPL setting will always be used.
-
-
-
-
-
-
-
-
-
Location toggle setting
-
LocMasterSwitchDependencyNII setting
-
NI request processing allowed
-
-
-
-
-
On
-
0
-
Yes
-
-
-
On
-
1
-
Yes
-
-
-
Off
-
0
-
Yes
-
-
-
Off
-
1
-
No (unless privacyOverride is set)
-
-
-
+|Location toggle setting|LocMasterSwitchDependencyNII setting|NI request processing allowed|
+|--- |--- |--- |
+|On|0|Yes|
+|On|1|Yes|
+|Off|0|Yes|
+|Off|1|No (unless privacyOverride is set)|
-
When the location toggle is set to Off and this value is set to 1, the following application requests will fail:
@@ -309,46 +224,18 @@ Optional. The address of the Position Determination Entity (PDE), in the format
**PositioningMethod\_MR**
Optional. Specifies the positioning method that the SUPL client will use for mobile originated position requests. The value can be one of the following integers:
-
-
-
-
-
-
-
-
Value
-
Description
-
-
-
-
-
0
-
None: The device uses the default positioning method. In this default mode, the GNSS obtains assistance (time injection, coarse position injection, and ephemeris data) from the Microsoft Positioning Service.
-
-
-
1
-
Mobile Station Assisted: The device contacts the H-SLP server to obtain a position. The H-SLP does the calculation of the position and returns it to the device.
-
-
-
2
-
Mobile Station Based: The device obtains location-aiding data (almanac, ephemeris data, time and coarse initial position of the device) from the H-SLP server, and the device uses this information to help GPS obtain a fix. All position calculations are done in the device.
-
-
-
3
-
Mobile Station Standalone: The device obtains assistance as required from the Microsoft location services.
-
-
-
4
-
AFLT
-
-
-
-
-
+|Value|Description|
+|--- |--- |
+|0|None: The device uses the default positioning method. In this default mode, the GNSS obtains assistance (time injection, coarse position injection, and ephemeris data) from the Microsoft Positioning Service.|
+|1|Mobile Station Assisted: The device contacts the H-SLP server to obtain a position. The H-SLP does the calculation of the position and returns it to the device.|
+|2|Mobile Station Based: The device obtains location-aiding data (almanac, ephemeris data, time and coarse initial position of the device) from the H-SLP server, and the device uses this information to help GPS obtain a fix. All position calculations are done in the device.|
+|3|Mobile Station Standalone: The device obtains assistance as required from the Microsoft location services.|
+|4|AFLT|
The default is 0. The default method provides high-quality assisted GNSS positioning for mobile originated position requests without loading the mobile operator’s network or location services.
-> **Important** The Mobile Station Assisted and AFLT positioning methods must only be configured for test purposes.
+> [!IMPORTANT]
+> The Mobile Station Assisted and AFLT positioning methods must only be configured for test purposes.
@@ -359,44 +246,12 @@ Optional. Boolean. Specifies whether the location toggle on the **location** scr
This value manages the settings for both SUPL and v2 UPL. If a device is configured for both SUPL and V2 UPL and these values differ, the SUPL setting will always be used.
-
-
-
-
-
-
-
-
-
Location toggle setting
-
LocMasterSwitchDependencyNII setting
-
NI request processing allowed
-
-
-
-
-
On
-
0
-
Yes
-
-
-
On
-
1
-
Yes
-
-
-
Off
-
0
-
Yes
-
-
-
Off
-
1
-
No (unless privacyOverride is set)
-
-
-
-
-
+|Location toggle setting|LocMasterSwitchDependencyNII setting|NI request processing allowed|
+|--- |--- |--- |
+|On|0|Yes|
+|On|1|Yes|
+|Off|0|Yes|
+|Off|1|No (unless privacyOverride is set)|
When the location toggle is set to Off and this value is set to 1, the following application requests will fail:
@@ -584,32 +439,12 @@ Adding a SUPL account to a device. Values in italic must be replaced with correc
The following table shows the Microsoft custom elements that this configuration service provider supports for OMA Client Provisioning.
-
Top level query: No|
## Related topics
-[Configuration service provider reference](configuration-service-provider-reference.md)
\ No newline at end of file
+[Configuration service provider reference](configuration-service-provider-reference.md)
diff --git a/windows/client-management/mdm/supl-ddf-file.md b/windows/client-management/mdm/supl-ddf-file.md
index 1fabc85e07..dec54b3f0a 100644
--- a/windows/client-management/mdm/supl-ddf-file.md
+++ b/windows/client-management/mdm/supl-ddf-file.md
@@ -8,7 +8,7 @@ ms.author: dansimp
ms.topic: article
ms.prod: w10
ms.technology: windows
-author: manikadhiman
+author: dansimp
ms.date: 06/03/2020
---
diff --git a/windows/client-management/mdm/surfacehub-csp.md b/windows/client-management/mdm/surfacehub-csp.md
index ad67b668bb..e0a043830c 100644
--- a/windows/client-management/mdm/surfacehub-csp.md
+++ b/windows/client-management/mdm/surfacehub-csp.md
@@ -8,7 +8,7 @@ ms.author: dansimp
ms.topic: article
ms.prod: w10
ms.technology: windows
-author: manikadhiman
+author: dansimp
ms.date: 07/28/2017
---
@@ -206,63 +206,22 @@ SurfaceHub
The data type is boolean. Supported operation is Get and Replace.
**DeviceAccount/ErrorContext**
-
If there is an error calling ValidateAndCommit, there is additional context for that error in this node. Here are the possible error values:
-
-
-
-
-
-
-
-
-
ErrorContext value
-
Stage where error occurred
-
Description and suggestions
-
-
-
-
-
1
-
Unknown
-
-
-
-
2
-
Populating account
-
Unable to retrieve account details using the username and password you provided.
-
-
For Azure AD accounts, ensure that UserPrincipalName and Password are valid.
-
For AD accounts, ensure that DomainName, UserName, and Password are valid.
-
Ensure that the specified account has an Exchange server mailbox.
-
-
-
-
3
-
Populating Exchange server address
-
Unable to auto-discover your Exchange server address. Try to manually specify the Exchange server address using the ExchangeServer field.
-
-
-
4
-
Validating Exchange server address
-
Unable to validate the Exchange server address. Ensure that the ExchangeServer field is valid.
-
-
-
5
-
Saving account information
-
Unable to save account details to the system.
-
-
-
6
-
Validating EAS policies
-
The device account uses an unsupported EAS policy. Make sure the EAS policy is configured correctly according to the admin guide.
-
-
-
-
-
The data type is integer. Supported operation is Get.
+If there is an error calling ValidateAndCommit, there is additional context for that error in this node. Here are the possible error values:
+
+| ErrorContext value | Stage where error occurred | Description and suggestions |
+| --- | --- | --- |
+| 1 | Unknown | |
+| 2 | Populating account | Unable to retrieve account details using the username and password you provided.
-For Azure AD accounts, ensure that UserPrincipalName and Password are valid. -For AD accounts, ensure that DomainName, UserName, and Password are valid. -Ensure that the specified account has an Exchange server mailbox. |
+| 3 | Populating Exchange server address | Unable to auto-discover your Exchange server address. Try to manually specify the Exchange server address using the ExchangeServer field. |
+| 4 | Validating Exchange server address | Unable to validate the Exchange server address. Ensure that the ExchangeServer field is valid. |
+| 5 | Saving account information | Unable to save account details to the system. |
+| 6 | Validating EAS policies | The device account uses an unsupported EAS policy. Make sure the EAS policy is configured correctly according to the admin guide. |
+
+The data type is integer. Supported operation is Get.
**MaintenanceHoursSimple/Hours**
+
Node for maintenance schedule.
**MaintenanceHoursSimple/Hours/StartTime**
@@ -282,7 +241,7 @@ SurfaceHub
Added in Windows 10, version 1703. Node for the Skype for Business settings.
**InBoxApps/SkypeForBusiness/DomainName**
-
Added in Windows 10, version 1703. Specifies the domain of the Skype for Business account when you are using Active Directory. For more information, see Set up Skype for Business Online.
+
Added in Windows 10, version 1703. Specifies the domain of the Skype for Business account when you are using Active Directory. For more information, see Set up Skype for Business Online.
The data type is string. Supported operation is Get and Replace.
@@ -295,7 +254,7 @@ SurfaceHub
The data type is boolean. Supported operation is Get and Replace.
**InBoxApps/Welcome/CurrentBackgroundPath**
-
Download location for image to be used as the background during user sessions and on the welcome screen. To set this, specify an https URL to a PNG file (only PNGs are supported for security reasons). If any certificate authorities need to be trusted in order to access the URL, please ensure they are valid and installed on the Hub, otherwise it may not be able to load the image.
+
Download location for image to be used as the background during user sessions and on the welcome screen. To set this, specify an https URL to a 32-bit PNG file (only PNGs are supported for security reasons). If any certificate authorities need to be trusted in order to access the URL, please ensure they are valid and installed on the Hub, otherwise it may not be able to load the image.
The data type is string. Supported operation is Get and Replace.
@@ -343,26 +302,11 @@ SurfaceHub
**InBoxApps/WirelessProjection/Channel**
Wireless channel to use for Miracast operation. The supported channels are defined by the Wi-Fi Alliance Wi-Fi Direct specification.
-
-
-
-
-
-
-
-
Works with all Miracast senders in all regions
-
1, 3, 4, 5, 6, 7, 8, 9, 10, 11
-
-
-
Works with all 5ghz band Miracast senders in all regions
-
36, 40, 44, 48
-
-
-
Works with all 5ghz band Miracast senders in all regions except Japan
-
149, 153, 157, 161, 165
-
-
-
+|Compatibility|Values|
+|--- |--- |
+|Works with all Miracast senders in all regions|1, 3, 4, 5, 6, 7, 8, 9, 10, 11|
+|Works with all 5ghz band Miracast senders in all regions|36, 40, 44, 48|
+|Works with all 5ghz band Miracast senders in all regions except Japan|149, 153, 157, 161, 165|
The default value is 255. Outside of regulatory concerns, if the channel is configured incorrectly the driver will either not boot, or will broadcast on the wrong channel (which senders won't be looking for).
@@ -397,50 +341,19 @@ SurfaceHub
-
-
+|Class|Test completed in Windows 10 for desktop|
+|--- |--- |
+|[**MDM_AppInstallJob**](/previous-versions/windows/desktop/mdmappprov/mdm-appinstalljob)|Currently testing.|
+|[**MDM_Application**](/previous-versions/windows/desktop/mdmappprov/mdm-application)|Currently testing.|
+|[**MDM_ApplicationFramework**](/previous-versions/windows/desktop/mdmappprov/mdm-applicationframework)|Currently testing.|
+|[**MDM_ApplicationSetting**](/previous-versions/windows/desktop/mdmsettingsprov/mdm-applicationsetting)|Currently testing.|
+|[**MDM_BrowserSecurityZones**](/previous-versions/windows/desktop/mdmsettingsprov/mdm-browsersecurityzones)|Yes|
+|[**MDM_BrowserSettings**](/previous-versions/windows/desktop/mdmsettingsprov/mdm-browsersettings)|Yes|
+|[**MDM_Certificate**](/previous-versions/windows/desktop/mdmsettingsprov/mdm-certificate)|Yes|
+|[**MDM_CertificateEnrollment**](/previous-versions/windows/desktop/mdmsettingsprov/mdm-certificateenrollment)|Yes|
+|[**MDM_Client**](/previous-versions/windows/desktop/mdmsettingsprov/mdm-client)|Currently testing.|
+|[**MDM_ConfigSetting**](/previous-versions/windows/desktop/mdmsettingsprov/mdm-configsetting)|Yes|
+|[**MDM_DeviceRegistrationInfo**](/previous-versions/windows/desktop/mdmsettingsprov/mdm-deviceregistrationinfo)||
+|[**MDM_EASPolicy**](/previous-versions/windows/desktop/mdmsettingsprov/mdm-easpolicy)|Yes|
+|[**MDM_MgMtAuthority**](/previous-versions/windows/desktop/mdmsettingsprov/mdm-mgmtauthority)|Yes|
+|**MDM_MsiApplication**||
+|**MDM_MsiInstallJob**||
+|[**MDM_RemoteApplication**](/previous-versions/windows/desktop/mdmappprov/mdm-remoteapplication)|Test not started.|
+|[**MDM_RemoteAppUseCookie**](/previous-versions/windows/desktop/mdmappprov/mdm-remoteappusercookie)|Test not started.|
+|[**MDM_Restrictions**](/previous-versions/windows/desktop/mdmsettingsprov/mdm-restrictions)|Yes|
+|[**MDM_RestrictionsUser**](/previous-versions/windows/desktop/mdmsettingsprov/mdm-restrictionsuser)|Test not started.|
+|[**MDM_SecurityStatus**](/previous-versions/windows/desktop/mdmsettingsprov/mdm-securitystatus)|Yes|
+|[**MDM_SideLoader**](/previous-versions/windows/desktop/mdmsettingsprov/mdm-sideloader)||
+|[**MDM_SecurityStatusUser**](/previous-versions/windows/desktop/mdmsettingsprov/mdm-securitystatususer)|Currently testing.|
+|[**MDM_Updates**](/previous-versions/windows/desktop/mdmsettingsprov/mdm-updates)|Yes|
+|[**MDM_VpnApplicationTrigger**](/previous-versions/windows/desktop/mdmsettingsprov/mdm-vpnapplicationtrigger)|Yes|
+|**MDM_VpnConnection**||
+|[**MDM_WebApplication**](/previous-versions/windows/desktop/mdmappprov/mdm-webapplication)|Currently testing.|
+|[**MDM_WirelessProfile**](/previous-versions/windows/desktop/mdmsettingsprov/mdm-wirelessprofile)|Yes|
+|[**MDM_WirelesssProfileXML**](/previous-versions/windows/desktop/mdmsettingsprov/mdm-wirelessprofilexml)|Yes|
+|[**MDM_WNSChannel**](/previous-versions/windows/desktop/mdmsettingsprov/mdm-wnschannel)|Yes|
+|[**MDM_WNSConfiguration**](/previous-versions/windows/desktop/mdmsettingsprov/mdm-wnsconfiguration)|Yes|
+|[**MSFT_NetFirewallProfile**](/previous-versions/windows/desktop/wfascimprov/msft-netfirewallprofile)|Yes|
+|[**MSFT_VpnConnection**](/previous-versions/windows/desktop/vpnclientpsprov/msft-vpnconnection)|Yes|
+|[**SoftwareLicensingProduct**](/previous-versions/windows/desktop/sppwmi/softwarelicensingproduct)||
+|[**SoftwareLicensingService**](/previous-versions/windows/desktop/sppwmi/softwarelicensingservice)||
### Parental control WMI classes
@@ -305,4 +187,4 @@ For links to these classes, see [**MDM Bridge WMI Provider**](/windows/win32/dmw
[Configuration service provider reference](configuration-service-provider-reference.md)
## Related Links
-[CIM Video Controller](/windows/win32/cimwin32prov/cim-videocontroller)
\ No newline at end of file
+[CIM Video Controller](/windows/win32/cimwin32prov/cim-videocontroller)
diff --git a/windows/client-management/quick-assist.md b/windows/client-management/quick-assist.md
index ced09ebede..0cca91cc74 100644
--- a/windows/client-management/quick-assist.md
+++ b/windows/client-management/quick-assist.md
@@ -8,6 +8,7 @@ author: jaimeo
ms.localizationpriority: medium
ms.author: jaimeo
manager: laurawi
+ms.collection: highpri
---
# Use Quick Assist to help users
diff --git a/windows/client-management/troubleshoot-event-id-41-restart.md b/windows/client-management/troubleshoot-event-id-41-restart.md
index f2673f9414..c1d7a706b0 100644
--- a/windows/client-management/troubleshoot-event-id-41-restart.md
+++ b/windows/client-management/troubleshoot-event-id-41-restart.md
@@ -2,7 +2,7 @@
title: Advanced troubleshooting for Event ID 41 - "The system has rebooted without cleanly shutting down first"
description: Describes the circumstances that cause a computer to generate Event ID 41, and provides guidance for troubleshooting the issue
author: Teresa-Motiv
-ms.author: v-tea
+ms.author: dougeby
ms.date: 12/27/2019
ms.prod: w10
ms.topic: article
@@ -13,7 +13,7 @@ audience: ITPro
ms.localizationpriority: medium
keywords: event id 41, reboot, restart, stop error, bug check code
manager: kaushika
-
+ms.collection: highpri
---
# Advanced troubleshooting for Event ID 41: "The system has rebooted without cleanly shutting down first"
diff --git a/windows/client-management/troubleshoot-stop-error-on-broadcom-driver-update.md b/windows/client-management/troubleshoot-stop-error-on-broadcom-driver-update.md
index fb99d5d919..a22426c30a 100644
--- a/windows/client-management/troubleshoot-stop-error-on-broadcom-driver-update.md
+++ b/windows/client-management/troubleshoot-stop-error-on-broadcom-driver-update.md
@@ -2,7 +2,7 @@
title: Stop error occurs when you update the in-box Broadcom network adapter driver
description: Describes an issue that causes a stop error when you update an in-box Broadcom driver on Windows Server 2019, version 1809.
author: Teresa-Motiv
-ms.author: v-tea
+ms.author: dougeby
ms.date: 2/3/2020
ms.prod: w10
ms.topic: article
diff --git a/windows/client-management/troubleshoot-stop-errors.md b/windows/client-management/troubleshoot-stop-errors.md
index 390add3169..cc92de3f11 100644
--- a/windows/client-management/troubleshoot-stop-errors.md
+++ b/windows/client-management/troubleshoot-stop-errors.md
@@ -10,6 +10,7 @@ ms.topic: troubleshooting
author: dansimp
ms.localizationpriority: medium
ms.author: dansimp
+ms.collection: highpri
---
# Advanced troubleshooting for Stop error or blue screen error issue
@@ -48,6 +49,9 @@ To troubleshoot Stop error messages, follow these general steps:
1. Make sure that you install the latest Windows updates, cumulative updates, and rollup updates. To verify the update status, refer to the appropriate update history for your system:
+ - [Windows 10, version 21H2](https://support.microsoft.com/topic/windows-10-update-history-857b8ccb-71e4-49e5-b3f6-7073197d98fb)
+ - [Windows 10, version 21H1](https://support.microsoft.com/topic/windows-10-update-history-1b6aac92-bf01-42b5-b158-f80c6d93eb11)
+ - [Windows 10, version 20H2](https://support.microsoft.com/topic/windows-10-update-history-7dd3071a-3906-fa2c-c342-f7f86728a6e3)
- [Windows 10, version 2004](https://support.microsoft.com/help/4555932)
- [Windows 10, version 1909](https://support.microsoft.com/help/4529964)
- [Windows 10, version 1903](https://support.microsoft.com/help/4498140)
@@ -81,7 +85,7 @@ To troubleshoot Stop error messages, follow these general steps:
>
>To do this, see [How to perform a clean boot in Windows](https://support.microsoft.com/help/929135).
>
- >You can disable a driver by following the steps in [How to temporarily deactivate the kernel mode filter driver in Windows](https://support.microsoft.com/help/816071).
+ >You can disable a driver by following the steps in [How to temporarily deactivate the kernel mode filter driver in Windows](/troubleshoot/windows-server/performance/deactivate-kernel-mode-filter-driver).
>
>You may also want to consider the option of rolling back changes or reverting to the last-known working state. For more information, see [Roll Back a Device Driver to a Previous Version](/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/cc732648(v=ws.11)).
@@ -125,9 +129,9 @@ More information on how to use Dumpchk.exe to check your dump files:
### Pagefile Settings
-- [Introduction of page file in Long-Term Servicing Channel and Semi-Annual Channel of Windows](https://support.microsoft.com/help/4133658)
-- [How to determine the appropriate page file size for 64-bit versions of Windows](https://support.microsoft.com/help/2860880)
-- [How to generate a kernel or a complete memory dump file in Windows Server 2008 and Windows Server 2008 R2](https://support.microsoft.com/help/969028)
+- [Introduction of page file in Long-Term Servicing Channel and Semi-Annual Channel of Windows](/windows/client-management/introduction-page-file)
+- [How to determine the appropriate page file size for 64-bit versions of Windows](/windows/client-management/determine-appropriate-page-file-size)
+- [How to generate a kernel or a complete memory dump file in Windows Server 2008 and Windows Server 2008 R2](/windows/client-management/generate-kernel-or-complete-crash-dump)
### Memory dump analysis
@@ -165,13 +169,13 @@ You can use the tools such as Windows Software Development KIT (SDK) and Symbols
6. Click on **Open Crash Dump**, and then open the memory.dmp file that you copied. See the example below.
- 
+ :::image type="content" alt-text="WinDbg img." source="images/windbg.png" lightbox="images/windbg.png":::
7. There should be a link that says **!analyze -v** under **Bugcheck Analysis**. Click that link. This will enter the command !analyze -v in the prompt at the bottom of the page.
8. A detailed bugcheck analysis will appear. See the example below.
- 
+ :::image type="content" alt-text="Bugcheck analysis." source="images/bugcheck-analysis.png" lightbox="images/bugcheck-analysis.png":::
9. Scroll down to the section where it says **STACK_TEXT**. There will be rows of numbers with each row followed by a colon and some text. That text should tell you what DLL is causing the crash and if applicable what service is crashing the DLL.
diff --git a/windows/client-management/troubleshoot-tcpip-connectivity.md b/windows/client-management/troubleshoot-tcpip-connectivity.md
index 10ae554304..fd6540824c 100644
--- a/windows/client-management/troubleshoot-tcpip-connectivity.md
+++ b/windows/client-management/troubleshoot-tcpip-connectivity.md
@@ -10,6 +10,7 @@ ms.author: dansimp
ms.date: 12/06/2018
ms.reviewer:
manager: dansimp
+ms.collection: highpri
---
# Troubleshoot TCP/IP connectivity
diff --git a/windows/client-management/troubleshoot-tcpip-netmon.md b/windows/client-management/troubleshoot-tcpip-netmon.md
index daa23de8b1..d63ebc5c58 100644
--- a/windows/client-management/troubleshoot-tcpip-netmon.md
+++ b/windows/client-management/troubleshoot-tcpip-netmon.md
@@ -10,6 +10,7 @@ ms.author: dansimp
ms.date: 12/06/2018
ms.reviewer:
manager: dansimp
+ms.collection: highpri
---
# Collect data using Network Monitor
diff --git a/windows/client-management/troubleshoot-tcpip-port-exhaust.md b/windows/client-management/troubleshoot-tcpip-port-exhaust.md
index 1267dad41f..7cdbf400e9 100644
--- a/windows/client-management/troubleshoot-tcpip-port-exhaust.md
+++ b/windows/client-management/troubleshoot-tcpip-port-exhaust.md
@@ -10,6 +10,7 @@ ms.author: dansimp
ms.date: 12/06/2018
ms.reviewer:
manager: dansimp
+ms.collection: highpri
---
# Troubleshoot port exhaustion issues
diff --git a/windows/client-management/troubleshoot-tcpip-rpc-errors.md b/windows/client-management/troubleshoot-tcpip-rpc-errors.md
index ba02501c81..6601c0c57d 100644
--- a/windows/client-management/troubleshoot-tcpip-rpc-errors.md
+++ b/windows/client-management/troubleshoot-tcpip-rpc-errors.md
@@ -10,6 +10,7 @@ ms.author: dansimp
ms.date: 12/06/2018
ms.reviewer:
manager: dansimp
+ms.collection: highpri
---
# Troubleshoot Remote Procedure Call (RPC) errors
@@ -37,7 +38,7 @@ Before getting in to troubleshooting the *RPC server unavailable- error
Client A wants to execute some functions or wants to make use of a service running on the remote server, will first establish the connection with the Remote Server by doing a three-way handshake.
-
+:::image type="content" alt-text="Diagram illustrating connection to remote server." source="images/rpc-flow.png" lightbox="images/rpc-flow.png":::
RPC ports can be given from a specific range as well.
### Configure RPC dynamic port allocation
@@ -46,7 +47,7 @@ Remote Procedure Call (RPC) dynamic port allocation is used by server applicatio
Customers using firewalls may want to control which ports RPC is using so that their firewall router can be configured to forward only these Transmission Control Protocol (UDP and TCP) ports. Many RPC servers in Windows let you specify the server port in custom configuration items such as registry entries. When you can specify a dedicated server port, you know what traffic flows between the hosts across the firewall, and you can define what traffic is allowed in a more directed manner.
-As a server port, please choose a port outside of the range you may want to specify below. You can find a comprehensive list of server ports that are used in Windows and major Microsoft products in the article [Service overview and network port requirements for Windows](https://support.microsoft.com/help/832017).
+As a server port, please choose a port outside of the range you may want to specify below. You can find a comprehensive list of server ports that are used in Windows and major Microsoft products in the article [Service overview and network port requirements for Windows](/troubleshoot/windows-server/networking/service-overview-and-network-port-requirements).
The article also lists the RPC servers and which RPC servers can be configured to use custom server ports beyond the facilities the RPC runtime offers.
Some firewalls also allow for UUID filtering where it learns from a RPC Endpoint Mapper request for a RPC interface UUID. The response has the server port number, and a subsequent RPC Bind on this port is then allowed to pass.
@@ -109,13 +110,13 @@ If you would like to do a deep dive as to how it works, see [RPC over IT/Pro](ht
The best thing to always troubleshoot RPC issues before even getting in to traces is by making use of tools like **PortQry**. You can quickly determine if you are able to make a connection by running the command:
-```cmd
+```console
Portqry.exe -n -e 135
```
This would give you a lot of output to look for, but you should be looking for *ip_tcp- and the port number in the brackets, which tells whether you were successfully able to get a dynamic port from EPM and also make a connection to it. If the above fails, you can typically start collecting simultaneous network traces. Something like this from the output of “PortQry”:
-```cmd
+```console
Portqry.exe -n 169.254.0.2 -e 135
```
Partial output below:
@@ -140,17 +141,20 @@ The one in bold is the ephemeral port number that you made a connection to succe
You can run the commands below to leverage Windows inbuilt netsh captures, to collect a simultaneous trace. Remember to execute the below on an “Admin CMD”, it requires elevation.
- On the client
- ```cmd
+
+ ```console
Netsh trace start scenario=netconnection capture=yes tracefile=c:\client_nettrace.etl maxsize=512 overwrite=yes report=yes
```
- On the Server
- ```cmd
+
+ ```console
Netsh trace start scenario=netconnection capture=yes tracefile=c:\server_nettrace.etl maxsize=512 overwrite=yes report=yes
```
Now try to reproduce your issue from the client machine and as soon as you feel the issue has been reproduced, go ahead and stop the traces using the command
-```cmd
+
+```console
Netsh trace stop
```
@@ -162,13 +166,13 @@ Open the traces in [Microsoft Network Monitor 3.4](troubleshoot-tcpip-netmon.md)
- Now check if you are getting a response from the server. If you get a response, note the dynamic port number that you have been allocated to use.
- 
+ :::image type="content" alt-text="Screenshot of Network Monitor with dynamic port highlighted." source="images/tcp-ts-23.png" lightbox="images/tcp-ts-23.png":::
- Check if we are connecting successfully to this Dynamic port successfully.
- The filter should be something like this: `tcp.port==` and `ipv4.address==`
- 
+ :::image type="content" alt-text="Screenshot of Network Monitor with filter applied." source="images/tcp-ts-24.png" lightbox="images/tcp-ts-24.png":::
This should help you verify the connectivity and isolate if any network issues are seen.
@@ -177,7 +181,7 @@ This should help you verify the connectivity and isolate if any network issues a
The most common reason why we would see the RPC server unavailable is when the dynamic port that the client tries to connect is not reachable. The client side trace would then show TCP SYN retransmits for the dynamic port.
-
+:::image type="content" alt-text="Screenshot of Network Monitor with TCP SYN retransmits." source="images/tcp-ts-25.png" lightbox="images/tcp-ts-25.png":::
The port cannot be reachable due to one of the following reasons:
diff --git a/windows/client-management/troubleshoot-windows-freeze.md b/windows/client-management/troubleshoot-windows-freeze.md
index 3ed83421c9..9d73bacae3 100644
--- a/windows/client-management/troubleshoot-windows-freeze.md
+++ b/windows/client-management/troubleshoot-windows-freeze.md
@@ -10,6 +10,7 @@ ms.topic: troubleshooting
author: dansimp
ms.localizationpriority: medium
ms.author: dansimp
+ms.collection: highpri
---
# Advanced troubleshooting for Windows-based computer freeze issues
@@ -132,7 +133,7 @@ If the computer is no longer frozen and now is running in a good state, use the
To allow the operating system to generate a memory dump file at an NMI interruption, set the value of the [NMICrashDump](/previous-versions/windows/it-pro/windows-server-2003/cc783271(v=ws.10)) registry entry to `1` (REG_DWORD). Then, restart the computer to apply this change.
> [!NOTE]
- > This is applicable only for Windows 7, Windows Server 2008 R2, and earlier versions of Windows. For Windows 8 Windows Server 2012, and later versions of Windows, the NMICrashDump registry key is no longer required, and an NMI interruption will result in [a Stop error that follows a memory dump data collection](https://support.microsoft.com/help/2750146).
+ > This is applicable only for Windows 7, Windows Server 2008 R2, and earlier versions of Windows. For Windows 8 Windows Server 2012, and later versions of Windows, the NMICrashDump registry key is no longer required, and an NMI interruption will result in [a Stop error that follows a memory dump data collection](/troubleshoot/windows-client/performance/nmi-hardware-failure-error).
4. When the computer exhibits the problem, hold down the right **Ctrl** key, and press the **Scroll Lock** key two times to generate a memory dump file.
@@ -157,17 +158,17 @@ Learn how to use Dumpchk.exe to check your dump files:
You can use Windows Performance Monitor to examine how programs that you run affect your computer's performance, both in real time and by collecting log data for later analysis. To create performance counter and event trace log collections on local and remote systems, run the following commands in a command prompt as administrator:
-```cmd
+```console
Logman create counter LOGNAME_Long -u DOMAIN\USERNAME * -f bincirc -v mmddhhmm -max 500 -c "\\COMPUTERNAME\LogicalDisk(*)\*" "\\COMPUTERNAME\Memory\*" "\\COMPUTERNAME\Network Interface(*)\*" "\\COMPUTERNAME\Paging File(*)\*" "\\COMPUTERNAME\PhysicalDisk(*)\*" "\\COMPUTERNAME\Process(*)\*" "\\COMPUTERNAME\Redirector\*" "\\COMPUTERNAME\Server\*" "\\COMPUTERNAME\System\*" "\\COMPUTERNAME\Terminal Services\*" "\\COMPUTERNAME\Processor(*)\*" "\\COMPUTERNAME\Cache\*" -si 00:05:00
```
-```cmd
+```console
Logman create counter LOGNAME_Short -u DOMAIN\USERNAME * -f bincirc -v mmddhhmm -max 500 -c "\\COMPUTERNAME\LogicalDisk(*)\*" "\\COMPUTERNAME\Memory\*" "\\COMPUTERNAME\Network Interface(*)\*" "\\COMPUTERNAME\Paging File(*)\*" "\\COMPUTERNAME\PhysicalDisk(*)\*" "\\COMPUTERNAME\Process(*)\*" "\\COMPUTERNAME\Redirector\*" "\\COMPUTERNAME\Server\*" "\\COMPUTERNAME\System\*" "\\COMPUTERNAME\Terminal Services\*" "\\COMPUTERNAME\Processor(*)\*" "\\COMPUTERNAME\Cache\*" -si 00:00:10
```
Then, you can start or stop the log by running the following commands:
-```cmd
+```console
logman start LOGNAME_Long / LOGNAME_Short
logman stop LOGNAME_Long / LOGNAME_Short
```
@@ -282,6 +283,6 @@ The memory dump process occurs by pressing the RIGHT CTRL + SCROLL LOCK + SCROLL
On Windows Server 2008, you may not have enough free disk space to generate a complete memory dump file on the system volume. There's a [hotfix](https://support.microsoft.com/help/957517) that allows for the data collection even though there isn't sufficient space on the system drive to store the memory dump file.
-Additionally, on Windows Server 2008 Service Pack (SP2), there's a second option if the system drive doesn't have sufficient space. Namely, you can use the DedicatedDumpFile registry entry. To learn how to use the registry entry, see [New behavior in Windows Vista and Windows Server 2008](https://support.microsoft.com/help/969028).
+Additionally, on Windows Server 2008 Service Pack (SP2), there's a second option if the system drive doesn't have sufficient space. Namely, you can use the DedicatedDumpFile registry entry. To learn how to use the registry entry, see [New behavior in Windows Vista and Windows Server 2008](/windows/client-management/generate-kernel-or-complete-crash-dump).
For more information, see [How to use the DedicatedDumpFile registry value to overcome space limitations on the system drive](https://blogs.msdn.com/b/ntdebugging/archive/2010/04/02/how-to-use-the-dedicateddumpfile-registry-value-to-overcome-space-limitations-on-the-system-drive-when-capturing-a-system-memory-dump.aspx).
\ No newline at end of file
diff --git a/windows/configuration/changes-to-start-policies-in-windows-10.md b/windows/configuration/changes-to-start-policies-in-windows-10.md
index 2deeb1c576..6d1d2b4a1c 100644
--- a/windows/configuration/changes-to-start-policies-in-windows-10.md
+++ b/windows/configuration/changes-to-start-policies-in-windows-10.md
@@ -29,85 +29,24 @@ Windows 10 has a brand new Start experience. As a result, there are changes to
These policy settings are available in **Administrative Templates\\Start Menu and Taskbar** under **User Configuration**.
-
-
-
-
-
Policy
-
Notes
-
-
-
-
-
Clear history of recently opened documents on exit
-
Documents that the user opens are tracked during the session. When the user signs off, the history of opened documents is deleted.
-
-
-
Do not allow pinning items in Jump Lists
-
Jump Lists are lists of recently opened items, such as files, folders, or websites, organized by the program that you use to open them. This policy prevents users from pinning items to any Jump List.
-
-
-
Do not display or track items in Jump Lists from remote locations
-
When this policy is applied, only items local on the computer are shown in Jump Lists.
-
-
-
Do not keep history of recently opened documents
-
Documents that the user opens are not tracked during the session.
-
-
-
Prevent changes to Taskbar and Start Menu Settings
-
In Windows 10, this disables all of the settings in Settings > Personalization > Start as well as the options in dialog available via right-click Taskbar > Properties
-
-
-
Prevent users from customizing their Start Screen
-
Use this policy in conjunction with a customized Start layout to prevent users from changing it
-
-
-
Prevent users from uninstalling applications from Start
-
In Windows 10, this removes the uninstall button in the context menu. It does not prevent users from uninstalling the app through other entry points (e.g. PowerShell)
-
-
-
Remove All Programs list from the Start menu
-
In Windows 10, this removes the All apps button.
-
-
-
Remove and prevent access to the Shut Down, Restart, Sleep, and Hibernate commands
-
This removes the Shut Down, Restart, Sleep, and Hibernate commands from the Start Menu, Start Menu power button, CTRL+ALT+DEL screen, and Alt+F4 Shut Down Windows menu.
-
-
-
Remove common program groups from Start Menu
-
As in earlier versions of Windows, this removes apps specified in the All Users profile from Start
-
-
-
Remove frequent programs list from the Start Menu
-
In Windows 10, this removes the top left Most used group of apps.
-
-
-
Remove Logoff on the Start Menu
-
Logoff has been changed to Sign Out in the user interface, however the functionality is the same.
-
-
-
Remove pinned programs list from the Start Menu
-
In Windows 10, this removes the bottom left group of apps (by default, only File Explorer and Settings are pinned).
-
-
-
Show "Run as different user" command on Start
-
This enables the Run as different user option in the right-click menu for apps.
-
-
-
Start Layout
-
This applies a specific Start layout, and it also prevents users from changing the layout. This policy can be configured in User Configuration or Computer Configuration.
-
-
-
-
-
-
Force Start to be either full screen size or menu size
-
This applies a specific size for Start.
-
-
-
-
+|Policy|Notes|
+|--- |--- |
+|Clear history of recently opened documents on exit|Documents that the user opens are tracked during the session. When the user signs off, the history of opened documents is deleted.|
+|Do not allow pinning items in Jump Lists|Jump Lists are lists of recently opened items, such as files, folders, or websites, organized by the program that you use to open them. This policy prevents users from pinning items to any Jump List.|
+|Do not display or track items in Jump Lists from remote locations|When this policy is applied, only items local on the computer are shown in Jump Lists.|
+|Do not keep history of recently opened documents|Documents that the user opens are not tracked during the session.|
+|Prevent changes to Taskbar and Start Menu Settings|In Windows 10, this disables all of the settings in **Settings** > **Personalization** > **Start** as well as the options in dialog available via right-click Taskbar > **Properties**|
+|Prevent users from customizing their Start Screen|Use this policy in conjunction with a [customized Start layout](windows-10-start-layout-options-and-policies.md) to prevent users from changing it|
+|Prevent users from uninstalling applications from Start|In Windows 10, this removes the uninstall button in the context menu. It does not prevent users from uninstalling the app through other entry points (e.g. PowerShell)|
+|Remove All Programs list from the Start menu|In Windows 10, this removes the **All apps** button.|
+|Remove and prevent access to the Shut Down, Restart, Sleep, and Hibernate commands|This removes the Shut Down, Restart, Sleep, and Hibernate commands from the Start Menu, Start Menu power button, CTRL+ALT+DEL screen, and Alt+F4 Shut Down Windows menu.|
+|Remove common program groups from Start Menu|As in earlier versions of Windows, this removes apps specified in the All Users profile from Start|
+|Remove frequent programs list from the Start Menu|In Windows 10, this removes the top left **Most used** group of apps.|
+|Remove Logoff on the Start Menu|**Logoff** has been changed to **Sign Out** in the user interface, however the functionality is the same.|
+|Remove pinned programs list from the Start Menu|In Windows 10, this removes the bottom left group of apps (by default, only File Explorer and Settings are pinned).|
+|Show "Run as different user" command on Start|This enables the **Run as different user** option in the right-click menu for apps.|
+|Start Layout|This applies a specific Start layout, and it also prevents users from changing the layout. This policy can be configured in **User Configuration** or **Computer Configuration**.|
+|Force Start to be either full screen size or menu size|This applies a specific size for Start.|
## Deprecated Group Policy settings for Start
diff --git a/windows/configuration/configure-windows-10-taskbar.md b/windows/configuration/configure-windows-10-taskbar.md
index 5f433844ac..65c86b5f5f 100644
--- a/windows/configuration/configure-windows-10-taskbar.md
+++ b/windows/configuration/configure-windows-10-taskbar.md
@@ -12,6 +12,7 @@ ms.localizationpriority: medium
ms.date: 01/18/2018
ms.reviewer:
manager: dansimp
+ms.collection: highpri
---
# Configure Windows 10 taskbar
diff --git a/windows/configuration/cortana-at-work/cortana-at-work-o365.md b/windows/configuration/cortana-at-work/cortana-at-work-o365.md
index 2241f9d819..3a9e871905 100644
--- a/windows/configuration/cortana-at-work/cortana-at-work-o365.md
+++ b/windows/configuration/cortana-at-work/cortana-at-work-o365.md
@@ -20,7 +20,7 @@ Your employees can use Cortana to help manage their day and be more productive b
**See also:**
-[Known issues for Windows Desktop Search and Cortana in Windows 10](https://support.microsoft.com/help/3206883/known-issues-for-windows-desktop-search-and-cortana-in-windows-10).
+[Known issues for Windows Desktop Search and Cortana in Windows 10](/troubleshoot/windows-client/shell-experience/windows-desktop-search-and-cortana-issues).
### Before you begin
There are a few things to be aware of before you start using Cortana in Windows 10, versions 1909 and earlier.
diff --git a/windows/configuration/customize-and-export-start-layout.md b/windows/configuration/customize-and-export-start-layout.md
index f50e213ce8..77f724b06e 100644
--- a/windows/configuration/customize-and-export-start-layout.md
+++ b/windows/configuration/customize-and-export-start-layout.md
@@ -13,6 +13,7 @@ ms.author: greglin
ms.topic: article
ms.localizationpriority: medium
ms.date: 09/18/2018
+ms.collection: highpri
---
# Customize and export Start layout
@@ -80,7 +81,7 @@ To prepare a Start layout for export, you simply customize the Start layout on a
## Export the Start layout
-When you have the Start layout that you want your users to see, use the [Export-StartLayout](/powershell/module/startlayout/export-startlayout?view=win10-ps) cmdlet in Windows PowerShell to export the Start layout to an .xml file. Start layout is located by default at C:\Users\username\AppData\Local\Microsoft\Windows\Shell\
+When you have the Start layout that you want your users to see, use the [Export-StartLayout](/powershell/module/startlayout/export-startlayout) cmdlet in Windows PowerShell to export the Start layout to an .xml file. Start layout is located by default at C:\Users\username\AppData\Local\Microsoft\Windows\Shell\
>[!IMPORTANT]
>If you include secondary Microsoft Edge tiles (tiles that link to specific websites in Microsoft Edge), see [Add custom images to Microsoft Edge secondary tiles](start-secondary-tiles.md) for instructions.
@@ -101,38 +102,25 @@ When you have the Start layout that you want your users to see, use the [Export-
In the previous command, `-path` is a required parameter that specifies the path and file name for the export file. You can specify a local path or a UNC path (for example, \\\\FileServer01\\StartLayouts\\StartLayoutMarketing.xml).
- Use a file name of your choice—for example, StartLayoutMarketing.xml. Include the .xml file name extension. The [Export-StartLayout](/powershell/module/startlayout/export-startlayout?view=win10-ps) cmdlet does not append the file name extension, and the policy settings require the extension.
+ Use a file name of your choice—for example, StartLayoutMarketing.xml. Include the .xml file name extension. The [Export-StartLayout](/powershell/module/startlayout/export-startlayout) cmdlet does not append the file name extension, and the policy settings require the extension.
Example of a layout file produced by `Export-StartLayout`:
-
-
+ ```xml
+
+
+
+
+
+
+
+
+
+
+
+
+
+ ```
3. (Optional) Edit the .xml file to add [a taskbar configuration](configure-windows-10-taskbar.md) or to [modify the exported layout](start-layout-xml-desktop.md). When you make changes to the exported layout, be aware that [the order of the elements in the .xml file is critical.](start-layout-xml-desktop.md#required-order)
@@ -197,4 +185,4 @@ If the Start layout is applied by Group Policy or MDM, and the policy is removed
- [Customize Windows 10 Start and taskbar with Group Policy](customize-windows-10-start-screens-by-using-group-policy.md)
- [Customize Windows 10 Start and taskbar with provisioning packages](customize-windows-10-start-screens-by-using-provisioning-packages-and-icd.md)
- [Customize Windows 10 Start and taskbar with mobile device management (MDM)](customize-windows-10-start-screens-by-using-mobile-device-management.md)
-- [Changes to Start policies in Windows 10](changes-to-start-policies-in-windows-10.md)
\ No newline at end of file
+- [Changes to Start policies in Windows 10](changes-to-start-policies-in-windows-10.md)
diff --git a/windows/configuration/customize-start-menu-layout-windows-11.md b/windows/configuration/customize-start-menu-layout-windows-11.md
index f10b516b5c..c42cc44009 100644
--- a/windows/configuration/customize-start-menu-layout-windows-11.md
+++ b/windows/configuration/customize-start-menu-layout-windows-11.md
@@ -11,6 +11,7 @@ ms.sitesec: library
ms.pagetype: mobile
author: MandiOhlinger
ms.localizationpriority: medium
+ms.collection: highpri
---
# Customize the Start menu layout on Windows 11
diff --git a/windows/configuration/customize-taskbar-windows-11.md b/windows/configuration/customize-taskbar-windows-11.md
index 30af3044b2..ec35a1f3e4 100644
--- a/windows/configuration/customize-taskbar-windows-11.md
+++ b/windows/configuration/customize-taskbar-windows-11.md
@@ -11,6 +11,7 @@ ms.sitesec: library
ms.pagetype: mobile
author: MandiOhlinger
ms.localizationpriority: medium
+ms.collection: highpri
---
# Customize the Taskbar on Windows 11
diff --git a/windows/configuration/customize-windows-10-start-screens-by-using-group-policy.md b/windows/configuration/customize-windows-10-start-screens-by-using-group-policy.md
index 7b7dcaed64..885cae4fed 100644
--- a/windows/configuration/customize-windows-10-start-screens-by-using-group-policy.md
+++ b/windows/configuration/customize-windows-10-start-screens-by-using-group-policy.md
@@ -12,6 +12,7 @@ author: greg-lindsay
ms.localizationpriority: medium
ms.author: greglin
ms.topic: article
+ms.collection: highpri
---
# Customize Windows 10 Start and taskbar with Group Policy
diff --git a/windows/configuration/find-the-application-user-model-id-of-an-installed-app.md b/windows/configuration/find-the-application-user-model-id-of-an-installed-app.md
index 6d4c284574..fa89080422 100644
--- a/windows/configuration/find-the-application-user-model-id-of-an-installed-app.md
+++ b/windows/configuration/find-the-application-user-model-id-of-an-installed-app.md
@@ -8,6 +8,7 @@ ms.author: greglin
ms.topic: article
ms.localizationpriority: medium
ms.prod: w10
+ms.collection: highpri
---
# Find the Application User Model ID of an installed app
diff --git a/windows/configuration/guidelines-for-assigned-access-app.md b/windows/configuration/guidelines-for-assigned-access-app.md
index 5a019e0862..b66df8ec19 100644
--- a/windows/configuration/guidelines-for-assigned-access-app.md
+++ b/windows/configuration/guidelines-for-assigned-access-app.md
@@ -11,6 +11,7 @@ ms.author: greglin
ms.topic: article
ms.reviewer: sybruckm
manager: dansimp
+ms.collection: highpri
---
# Guidelines for choosing an app for assigned access (kiosk mode)
diff --git a/windows/configuration/index.yml b/windows/configuration/index.yml
index 66e42dca78..debd8b4652 100644
--- a/windows/configuration/index.yml
+++ b/windows/configuration/index.yml
@@ -10,7 +10,9 @@ metadata:
ms.service: windows-10 #Required; service per approved list. service slug assigned to your service by ACOM.
ms.subservice: subservice
ms.topic: landing-page # Required
- ms.collection: windows-10
+ ms.collection:
+ - windows-10
+ - highpri
author: greg-lindsay #Required; your GitHub user alias, with correct capitalization.
ms.author: greglin #Required; microsoft alias of author; optional team alias.
ms.date: 08/05/2021 #Required; mm/dd/yyyy format.
diff --git a/windows/configuration/kiosk-methods.md b/windows/configuration/kiosk-methods.md
index 0c36aa0d52..42be271448 100644
--- a/windows/configuration/kiosk-methods.md
+++ b/windows/configuration/kiosk-methods.md
@@ -11,6 +11,7 @@ ms.pagetype: security
ms.localizationpriority: medium
author: greg-lindsay
ms.topic: article
+ms.collection: highpri
---
# Configure kiosks and digital signs on Windows desktop editions
diff --git a/windows/configuration/kiosk-prepare.md b/windows/configuration/kiosk-prepare.md
index 5eef3d900c..26a122d0b9 100644
--- a/windows/configuration/kiosk-prepare.md
+++ b/windows/configuration/kiosk-prepare.md
@@ -12,6 +12,7 @@ ms.sitesec: library
author: greg-lindsay
ms.localizationpriority: medium
ms.topic: article
+ms.collection: highpri
---
# Prepare a device for kiosk configuration
@@ -19,7 +20,7 @@ ms.topic: article
**Applies to**
-- Windows 10 Pro, Enterprise, and Education
+- Windows 10 Pro, Enterprise, and Education
- Windows 11
diff --git a/windows/configuration/kiosk-shelllauncher.md b/windows/configuration/kiosk-shelllauncher.md
index 3b720d1bbe..ae9bcae53a 100644
--- a/windows/configuration/kiosk-shelllauncher.md
+++ b/windows/configuration/kiosk-shelllauncher.md
@@ -12,6 +12,7 @@ ms.sitesec: library
author: greg-lindsay
ms.localizationpriority: medium
ms.topic: article
+ms.collection: highpri
---
# Use Shell Launcher to create a Windows client kiosk
diff --git a/windows/configuration/kiosk-single-app.md b/windows/configuration/kiosk-single-app.md
index 3a71008734..ea48de4346 100644
--- a/windows/configuration/kiosk-single-app.md
+++ b/windows/configuration/kiosk-single-app.md
@@ -12,6 +12,7 @@ ms.sitesec: library
author: greg-lindsay
ms.localizationpriority: medium
ms.topic: article
+ms.collection: highpri
---
# Set up a single-app kiosk on Windows 10/11
@@ -19,7 +20,7 @@ ms.topic: article
**Applies to**
-- Windows 10 Pro, Enterprise, and Education
+- Windows 10 Pro, Enterprise, and Education
- Windows 11
A single-app kiosk uses the Assigned Access feature to run a single app above the lock screen. When the kiosk account signs in, the app is launched automatically. The person using the kiosk cannot do anything on the device outside of the kiosk app.
@@ -204,7 +205,7 @@ Clear-AssignedAccess
>[!IMPORTANT]
->When Exchange Active Sync (EAS) password restrictions are active on the device, the autologon feature does not work. This behavior is by design. For more informations, see [How to turn on automatic logon in Windows](https://support.microsoft.com/help/324737/how-to-turn-on-automatic-logon-in-windows).
+>When Exchange Active Sync (EAS) password restrictions are active on the device, the autologon feature does not work. This behavior is by design. For more informations, see [How to turn on automatic logon in Windows](/troubleshoot/windows-server/user-profiles-and-logon/turn-on-automatic-logon).
When you use the **Provision kiosk devices** wizard in Windows Configuration Designer, you can configure the kiosk to run either a Universal Windows app or a Windows desktop application.
diff --git a/windows/configuration/lock-down-windows-10-to-specific-apps.md b/windows/configuration/lock-down-windows-10-to-specific-apps.md
index 2461a34568..1cd8c9fbff 100644
--- a/windows/configuration/lock-down-windows-10-to-specific-apps.md
+++ b/windows/configuration/lock-down-windows-10-to-specific-apps.md
@@ -13,6 +13,7 @@ author: greg-lindsay
ms.localizationpriority: medium
ms.author: greglin
ms.topic: article
+ms.collection: highpri
---
# Set up a multi-app kiosk on Windows 10 devices
@@ -352,7 +353,7 @@ Starting with Windows 10 version 1809, you can configure the display name that w
On domain-joined devices, local user accounts aren't shown on the sign-in screen by default. To show the **AutoLogonAccount** on the sign-in screen, enable the following Group Policy setting: **Computer Configuration > Administrative Templates > System > Logon > Enumerate local users on domain-joined computers**. (The corresponding MDM policy setting is [WindowsLogon/EnumerateLocalUsersOnDomainJoinedComputers in the Policy CSP](/windows/client-management/mdm/policy-csp-windowslogon#windowslogon-enumeratelocalusersondomainjoinedcomputers).)
>[!IMPORTANT]
->When Exchange Active Sync (EAS) password restrictions are active on the device, the autologon feature does not work. This behavior is by design. For more informations, see [How to turn on automatic logon in Windows](https://support.microsoft.com/help/324737/how-to-turn-on-automatic-logon-in-windows).
+>When Exchange Active Sync (EAS) password restrictions are active on the device, the autologon feature does not work. This behavior is by design. For more informations, see [How to turn on automatic logon in Windows](/troubleshoot/windows-server/user-profiles-and-logon/turn-on-automatic-logon).
##### Config for individual accounts
diff --git a/windows/configuration/lockdown-features-windows-10.md b/windows/configuration/lockdown-features-windows-10.md
index df13bd302b..38da2ca1ca 100644
--- a/windows/configuration/lockdown-features-windows-10.md
+++ b/windows/configuration/lockdown-features-windows-10.md
@@ -23,97 +23,18 @@ ms.localizationpriority: medium
Many of the lockdown features available in Windows Embedded 8.1 Industry have been modified in some form for Windows 10. This table maps Windows Embedded Industry 8.1 features to Windows 10 Enterprise features, along with links to documentation.
-
Keyboard filter is added in Windows 10, version 1511. As in Windows Embedded Industry 8.1, Keyboard Filter is an optional component that can be turned on via Turn Windows Features On/Off. Keyboard Filter (in addition to the WMI configuration previously available) will be configurable through Windows Imaging and Configuration Designer (ICD) in the SMISettings path.
-
-
-
Shell Launcher: launch a Windows desktop application on sign-on
The Windows 8 Application Launcher has been consolidated into Assigned Access. Application Launcher enabled launching a Windows 8 app and holding focus on that app. Assigned Access offers a more robust solution for ensuring that apps retain focus.
-
-
-
Dialog Filter: suppress system dialogs and control which processes can run
Dialog Filter has been deprecated for Windows 10. Dialog Filter provided two capabilities; the ability to control which processes were able to run, and the ability to prevent dialogs (in practice, system dialogs) from appearing.
-
-
Control over which processes are able to run will now be provided by AppLocker.
-
System dialogs in Windows 10 have been replaced with system toasts. To see more on blocking system toasts, see Toast Notification Filter below.
Toast Notification Filter has been replaced by MDM and Group Policy settings for blocking the individual components of non-critical system toasts that may appear. For example, to prevent a toast from appearing when a USB drive is connected, ensure that USB connections have been blocked using the USB-related policies, and turn off notifications from apps.
-
Group Policy: User Configuration > Administrative Templates > Start Menu and Taskbar > Notifications
-
MDM policy name may vary depending on your MDM service. In Microsoft Intune, use Allow action center notifications and a custom OMA-URI setting for AboveLock/AllowActionCenterNotifications.
The Embedded Lockdown Manager has been deprecated for Windows 10 and replaced by the Windows ICD. Windows ICD is the consolidated tool for Windows imaging and provisioning scenarios and enables configuration of all Windows settings, including the lockdown features previously configurable through Embedded Lockdown Manager.
-
-
-
USB Filter: restrict USB devices and peripherals on system
-
MDM and Group Policy
-
The USB Filter driver has been replaced by MDM and Group Policy settings for blocking the connection of USB devices.
-
Group Policy: Computer Configuration > Administrative Templates > System > Device Installation > Device Installation Restrictions
-
MDM policy name may vary depending on your MDM service. In Microsoft Intune, use Removable storage.
-
-
-
Assigned Access: launch a UWP app on sign-in and lock access to system
Assigned Access has undergone significant improvement for Windows 10. In Windows 8.1, Assigned Access blocked system hotkeys and edge gestures, and non-critical system notifications, but it also applied some of these limitations to other accounts on the device.
-
In Windows 10, Assigned Access no longer affects accounts other than the one being locked down. Assigned Access now restricts access to other apps or system components by locking the device when the selected user account logs in and launching the designated app above the lock screen, ensuring that no unintended functionality can be accessed.
Gesture Filter: block swipes from top, left, and right edges of screen
-
MDM and Group Policy
-
In Windows 8.1, gestures provided the ability to close an app, to switch apps, and to reach the Charms. In Windows 10, Charms have been removed. In Windows 10, version 1607, you can block swipes using the Allow edge swipe policy.
-
-
-
Custom Logon: suppress Windows UI elements during Windows sign-on, sign-off, and shutdown
No changes. Applies only to Windows 10 Enterprise and Windows 10 Education.
-
-
-
-
-
+|Windows Embedded 8.1 Industry lockdown feature|Windows 10 feature|Changes|
+|--- |--- |--- |
+|[Hibernate Once/Resume Many (HORM)](/previous-versions/windows/embedded/dn449302(v=winembedded.82)): Quick boot to device|[HORM](/windows-hardware/customize/enterprise/hibernate-once-resume-many-horm-)|HORM is supported in Windows 10, version 1607 and later.|
+|[Unified Write Filter](/previous-versions/windows/embedded/dn449332(v=winembedded.82)): protect a device's physical storage media|[Unified Write Filter](/windows-hardware/customize/enterprise/unified-write-filter)|The Unified Write Filter is continued in Windows 10.|
+|[Keyboard Filter](/previous-versions/windows/embedded/dn449298(v=winembedded.82)): block hotkeys and other key combinations|[Keyboard Filter](/windows-hardware/customize/enterprise/keyboardfilter)|Keyboard filter is added in Windows 10, version 1511. As in Windows Embedded Industry 8.1, Keyboard Filter is an optional component that can be turned on via **Turn Windows Features On/Off**. Keyboard Filter (in addition to the WMI configuration previously available) will be configurable through Windows Imaging and Configuration Designer (ICD) in the SMISettings path.|
+|[Shell Launcher](/previous-versions/windows/embedded/dn449423(v=winembedded.82)): launch a Windows desktop application on sign-on|[Shell Launcher](/windows-hardware/customize/enterprise/shell-launcher)|Shell Launcher continues in Windows 10. It is now configurable in Windows ICD under the **SMISettings** category. Learn [how to use Shell Launcher to create a kiosk device](/windows/configuration/kiosk-single-app) that runs a Windows desktop application.|
+|[Application Launcher](/previous-versions/windows/embedded/dn449251(v=winembedded.82)): launch a Universal Windows Platform (UWP) app on sign-on|[Assigned Access](/windows/client-management/mdm/assignedaccess-csp)|The Windows 8 Application Launcher has been consolidated into Assigned Access. Application Launcher enabled launching a Windows 8 app and holding focus on that app. Assigned Access offers a more robust solution for ensuring that apps retain focus.|
+|[Dialog Filter](/previous-versions/windows/embedded/dn449395(v=winembedded.82)): suppress system dialogs and control which processes can run|[AppLocker](/windows/device-security/applocker/applocker-overview)|Dialog Filter has been deprecated for Windows 10. Dialog Filter provided two capabilities; the ability to control which processes were able to run, and the ability to prevent dialogs (in practice, system dialogs) from appearing.
Control over which processes are able to run will now be provided by AppLocker.
System dialogs in Windows 10 have been replaced with system toasts. To see more on blocking system toasts, see Toast Notification Filter below.|
+|[Toast Notification Filter](/previous-versions/windows/embedded/dn449360(v=winembedded.82)): suppress toast notifications|Mobile device management (MDM) and Group Policy|Toast Notification Filter has been replaced by MDM and Group Policy settings for blocking the individual components of non-critical system toasts that may appear. For example, to prevent a toast from appearing when a USB drive is connected, ensure that USB connections have been blocked using the USB-related policies, and turn off notifications from apps. Group Policy: **User Configuration** > **Administrative Templates** > **Start Menu and Taskbar** > **Notifications** MDM policy name may vary depending on your MDM service. In Microsoft Intune, use **Allow action center notifications** and a [custom OMA-URI setting](https://go.microsoft.com/fwlink/p/?LinkID=616317) for **AboveLock/AllowActionCenterNotifications**.|
+|[Embedded Lockdown Manager](/previous-versions/windows/embedded/dn449279(v=winembedded.82)): configure lockdown features|[Windows Imaging and Configuration Designer (ICD)](/windows/configuration/provisioning-packages/provisioning-install-icd)|The Embedded Lockdown Manager has been deprecated for Windows 10 and replaced by the Windows ICD. Windows ICD is the consolidated tool for Windows imaging and provisioning scenarios and enables configuration of all Windows settings, including the lockdown features previously configurable through Embedded Lockdown Manager.|
+|[USB Filter](/previous-versions/windows/embedded/dn449350(v=winembedded.82)): restrict USB devices and peripherals on system|MDM and Group Policy|The USB Filter driver has been replaced by MDM and Group Policy settings for blocking the connection of USB devices.
Group Policy: **Computer Configuration** > **Administrative Templates** > **System** > **Device Installation** > **Device Installation Restrictions** MDM policy name may vary depending on your MDM service. In Microsoft Intune, use **Removable storage**.|
+|[Assigned Access](/previous-versions/windows/embedded/dn449303(v=winembedded.82)): launch a UWP app on sign-in and lock access to system|[Assigned Access](/windows/client-management/mdm/assignedaccess-csp)|Assigned Access has undergone significant improvement for Windows 10. In Windows 8.1, Assigned Access blocked system hotkeys and edge gestures, and non-critical system notifications, but it also applied some of these limitations to other accounts on the device. In Windows 10, Assigned Access no longer affects accounts other than the one being locked down. Assigned Access now restricts access to other apps or system components by locking the device when the selected user account logs in and launching the designated app above the lock screen, ensuring that no unintended functionality can be accessed.
Learn [how to use Assigned Access to create a kiosk device](/windows/configuration/kiosk-single-app) that runs a Universal Windows app.|
+|[Gesture Filter](/previous-versions/windows/embedded/dn449374(v=winembedded.82)): block swipes from top, left, and right edges of screen|MDM and Group Policy|In Windows 8.1, gestures provided the ability to close an app, to switch apps, and to reach the Charms. In Windows 10, Charms have been removed. In Windows 10, version 1607, you can block swipes using the [Allow edge swipe](/windows/client-management/mdm/policy-configuration-service-provider#LockDown_AllowEdgeSwipe) policy.|
+|[Custom Logon](/previous-versions/windows/embedded/dn449309(v=winembedded.82)): suppress Windows UI elements during Windows sign-on, sign-off, and shutdown|[Embedded Logon](/windows-hardware/customize/desktop/unattend/microsoft-windows-embedded-embeddedlogon)|No changes. Applies only to Windows 10 Enterprise and Windows 10 Education.|
+|[Unbranded Boot](/previous-versions/windows/embedded/dn449249(v=winembedded.82)): custom brand a device by removing or replacing Windows boot UI elements|[Unbranded Boot](/windows-hardware/customize/enterprise/unbranded-boot)|No changes. Applies only to Windows 10 Enterprise and Windows 10 Education.|
diff --git a/windows/configuration/provisioning-packages/provisioning-create-package.md b/windows/configuration/provisioning-packages/provisioning-create-package.md
index 5086aae14b..0f8a4b93c1 100644
--- a/windows/configuration/provisioning-packages/provisioning-create-package.md
+++ b/windows/configuration/provisioning-packages/provisioning-create-package.md
@@ -10,6 +10,7 @@ ms.topic: article
ms.localizationpriority: medium
ms.reviewer: gkomatsu
manager: dansimp
+ms.collection: highpri
---
# Create a provisioning package
diff --git a/windows/configuration/provisioning-packages/provisioning-install-icd.md b/windows/configuration/provisioning-packages/provisioning-install-icd.md
index 2185e1123a..484dd4a35b 100644
--- a/windows/configuration/provisioning-packages/provisioning-install-icd.md
+++ b/windows/configuration/provisioning-packages/provisioning-install-icd.md
@@ -10,6 +10,7 @@ ms.topic: article
ms.localizationpriority: medium
ms.reviewer: gkomatsu
manager: dansimp
+ms.collection: highpri
---
# Install Windows Configuration Designer, and learn about any limitations
@@ -17,8 +18,8 @@ manager: dansimp
**Applies to**
-- Windows 10
-- Windows 11
+- Windows 10
+- Windows 11
Use the Windows Configuration Designer tool to create provisioning packages to easily configure devices running Windows client. Windows Configuration Designer is primarily used by IT departments for business and educational institutions who need to provision bring-your-own-device (BYOD) and business-supplied devices.
diff --git a/windows/configuration/provisioning-packages/provisioning-packages.md b/windows/configuration/provisioning-packages/provisioning-packages.md
index 0a4cc16ed5..703606edff 100644
--- a/windows/configuration/provisioning-packages/provisioning-packages.md
+++ b/windows/configuration/provisioning-packages/provisioning-packages.md
@@ -11,7 +11,7 @@ author: greg-lindsay
ms.author: greglin
ms.topic: article
ms.localizationpriority: medium
-
+ms.collection: highpri
---
# Provisioning packages for Windows
@@ -86,18 +86,6 @@ The following table describes settings that you can configure using the wizards
| Configure kiosk common settings | Set tablet mode, configure welcome and shutdown screens, turn off timeout settings | ❌ | ✔️ | ❌ |
| Developer Setup | Enable Developer Mode | ❌ | ❌ | ✔️ |
-
-
-
-
-
-
-
-
-
-
-
-
- [Instructions for the desktop wizard](provision-pcs-for-initial-deployment.md)
- [Instructions for the kiosk wizard](../kiosk-single-app.md#wizard)
- [Instructions for the HoloLens wizard](/hololens/hololens-provisioning#wizard)
@@ -138,7 +126,7 @@ WCD supports the following scenarios for IT administrators:
* **Simple provisioning** – Enables IT administrators to define a desired configuration in WCD and then apply that configuration on target devices. The simple provisioning wizard makes the entire process quick and easy by guiding an IT administrator through common configuration settings in a step-by-step manner.
-[Learn how to use simple provisioning to configure Windows computers.](provision-pcs-for-initial-deployment.md)
+ [Learn how to use simple provisioning to configure Windows computers.](provision-pcs-for-initial-deployment.md)
* **Advanced provisioning (deployment of classic (Win32) and Universal Windows Platform (UWP) apps, and certificates)** – Allows an IT administrator to use WCD to open provisioning packages in the advanced settings editor and include apps for deployment on end-user devices.
diff --git a/windows/configuration/provisioning-packages/provisioning-script-to-install-app.md b/windows/configuration/provisioning-packages/provisioning-script-to-install-app.md
index a894ed2312..1fc466b83d 100644
--- a/windows/configuration/provisioning-packages/provisioning-script-to-install-app.md
+++ b/windows/configuration/provisioning-packages/provisioning-script-to-install-app.md
@@ -171,12 +171,11 @@ Here’s a table describing this relationship, using the PowerShell example from
| ProvisioningCommands/DeviceContext/CommandFiles | PowerShell_Example.bat | The single orchestrator script referenced by the command line that handles calling into the required installers or performing any other actions such as expanding cab files. This script must do the required logging. |
| ProvisioningCommands/DeviceContext/CommandFiles | my_powershell_script.ps1 | Other assets referenced by the orchestrator script. In this example, there is only one, but there could be many assets referenced here. One common use case is using the orchestrator to call a series of install.exe or setup.exe installers to install several applications. Each of those installers must be included as an asset here. |
-
### Add script to provisioning package
-
-When you have the batch file written and the referenced assets ready to include, you can add them to a provisioning package in the Window Configuration Designer.
-Using Windows Configuration Designer, specify the full details of how the script should be run in the CommandLine setting in the provisioning package. This includes flags or any other parameters that you would normally type on the command line. So for example if the package contained an app installer called install.exe and a script used to automate the install called InstallMyApp.bat, the `ProvisioningCommands/DeviceContext/CommandLine` setting should be configured to:
+When you have the batch file written and the referenced assets ready to include, you can add them to a provisioning package in the Windows Configuration Designer.
+
+Using Windows Configuration Designer, specify the full details of how the script should be run in the CommandLine setting in the provisioning package. This includes flags or any other parameters that you would normally type on the command line. So for example if the package contained an app installer called install.exe and a script used to automate the install called InstallMyApp.bat, the `ProvisioningCommands/DeviceContext/CommandLine` setting should be configured to:
```bat
cmd /c InstallMyApp.bat
diff --git a/windows/configuration/set-up-shared-or-guest-pc.md b/windows/configuration/set-up-shared-or-guest-pc.md
index f47dd5956d..18cc716b31 100644
--- a/windows/configuration/set-up-shared-or-guest-pc.md
+++ b/windows/configuration/set-up-shared-or-guest-pc.md
@@ -11,6 +11,7 @@ ms.topic: article
ms.localizationpriority: medium
ms.reviewer: sybruckm
manager: dansimp
+ms.collection: highpri
---
# Set up a shared or guest PC with Windows 10/11
@@ -18,7 +19,7 @@ manager: dansimp
**Applies to**
-- Windows 10
+- Windows 10
- Windows 11
Windows client has a *shared PC mode*, which optimizes Windows client for shared use scenarios, such as touchdown spaces in an enterprise and temporary customer use in retail. You can apply shared PC mode to Windows client Pro, Pro Education, Education, and Enterprise.
@@ -63,8 +64,8 @@ Shared PC mode exposes a set of customizations to tailor the behavior to your re
| Setting | Value |
|:---|:---|
| EnableSharedPCMode | Set as **True**. If this is not set to **True**, shared PC mode is not turned on and none of the other settings apply. This setting controls this API: [IsEnabled](/uwp/api/windows.system.profile.sharedmodesettings) Some of the remaining settings in **SharedPC** are optional, but we strongly recommend that you also set `EnableAccountManager` to **True**. |
-| AccountManagement: AccountModel | This option controls how users can sign-in on the PC. Choosing domain-joined will enable any user in the domain to sign-in. Specifying the guest option will add the **Guest** option to the sign-in screen and enable anonymous guest access to the PC. - **Only guest** allows anyone to use the PC as a local standard (non-admin) account. - **Domain-joined only** allows users to sign in with an Active Directory or Azure AD account. - **Domain-joined and guest** allows users to sign in with an Active Directory, Azure AD, or local standard account. |
-| AccountManagement: DeletionPolicy | - **Delete immediately** will delete the account on sign-out. - **Delete at disk space threshold** will start deleting accounts when available disk space falls below the threshold you set for **DiskLevelDeletion**, and it will stop deleting accounts when the available disk space reaches the threshold you set for **DiskLevelCaching**. Accounts are deleted in order of oldest accessed to most recently accessed.
Example: The caching number is 50 and the deletion number is 25. Accounts will be cached while the free disk space is above 25%. When the free disk space is less than 25% (the deletion number) at a maintenance period, accounts will be deleted (oldest last used first) until the free disk space is above 50% (the caching number). Accounts will be deleted immediately at sign off of an account if free space is under the deletion threshold and disk space is very low, regardless if the PC is actively in use or not. - **Delete at disk space threshold and inactive threshold** will apply the same disk space checks as noted above, but also delete accounts if they have not signed in within the number of days specified by **InactiveThreshold** |
+| AccountManagement: AccountModel | This option controls how users can sign-in on the PC. Choosing domain-joined will enable any user in the domain to sign-in.
Specifying the guest option will add the **Guest** option to the sign-in screen and enable anonymous guest access to the PC.
- **Only guest** allows anyone to use the PC as a local standard (non-admin) account. - **Domain-joined only** allows users to sign in with an Active Directory or Azure AD account. - **Domain-joined and guest** allows users to sign in with an Active Directory, Azure AD, or local standard account. |
+| AccountManagement: DeletionPolicy | - **Delete immediately** will delete the account on sign-out.
- **Delete at disk space threshold** will start deleting accounts when available disk space falls below the threshold you set for **DiskLevelDeletion**, and it will stop deleting accounts when the available disk space reaches the threshold you set for **DiskLevelCaching**. Accounts are deleted in order of oldest accessed to most recently accessed.
Example: The caching number is 50 and the deletion number is 25. Accounts will be cached while the free disk space is above 25%. When the free disk space is less than 25% (the deletion number) at a maintenance period, accounts will be deleted (oldest last used first) until the free disk space is above 50% (the caching number). Accounts will be deleted immediately at sign off of an account if free space is under the deletion threshold and disk space is very low, regardless if the PC is actively in use or not. - **Delete at disk space threshold and inactive threshold** will apply the same disk space checks as noted above, but also delete accounts if they have not signed in within the number of days specified by **InactiveThreshold** |
| AccountManagement: DiskLevelCaching | If you set **DeletionPolicy** to **Delete at disk space threshold**, set the percent of total disk space to be used as the disk space threshold for account caching. |
| AccountManagement: DiskLevelDeletion | If you set **DeletionPolicy** to **Delete at disk space threshold**, set the percent of total disk space to be used as the disk space threshold for account deletion. |
| AccountManagement: InactiveThreshold | If you set **DeletionPolicy** to **Delete at disk space threshold and inactive threshold**, set the number of days after which an account that has not signed in will be deleted. |
@@ -242,92 +243,137 @@ On a desktop computer, navigate to **Settings** > **Accounts** > **Work ac
New-Item -Path "HKLM:\Software\Microsoft\Windows\CurrentVersion\SharedPC\Exemptions\$sid" -Force
```
-
## Policies set by shared PC mode
+
Shared PC mode sets local group policies to configure the device. Some of these are configurable using the shared pc mode options.
> [!IMPORTANT]
> It is not recommended to set additional policies on PCs configured for **Shared PC Mode**. The shared PC mode has been optimized to be fast and reliable over time with minimal to no manual maintenance required.
-
+### Admin Templates > Control Panel > Personalization
-
Policy name
Value
When set?
-
-
Admin Templates > Control Panel > Personalization
-
Prevent enabling lock screen slide show
Enabled
Always
-
Prevent changing lock screen and logon image
Enabled
Always
-
Admin Templates > System > Power Management > Button Settings
-
Select the Power button action (plugged in)
Sleep
SetPowerPolicies=True
-
Select the Power button action (on battery)
Sleep
SetPowerPolicies=True
-
Select the Sleep button action (plugged in)
Sleep
SetPowerPolicies=True
-
Select the lid switch action (plugged in)
Sleep
SetPowerPolicies=True
-
Select the lid switch action (on battery)
Sleep
SetPowerPolicies=True
-
Admin Templates > System > Power Management > Sleep Settings
-
Require a password when a computer wakes (plugged in)
Enabled
SignInOnResume=True
-
Require a password when a computer wakes (on battery)
Enabled
SignInOnResume=True
-
Specify the system sleep timeout (plugged in)
SleepTimeout
SetPowerPolicies=True
-
Specify the system sleep timeout (on battery)
SleepTimeout
SetPowerPolicies=True
-
Turn off hybrid sleep (plugged in)
Enabled
SetPowerPolicies=True
-
Turn off hybrid sleep (on battery)
Enabled
SetPowerPolicies=True
-
Specify the unattended sleep timeout (plugged in)
SleepTimeout
SetPowerPolicies=True
-
Specify the unattended sleep timeout (on battery)
SleepTimeout
SetPowerPolicies=True
-
Allow standby states (S1-S3) when sleeping (plugged in)
Enabled
SetPowerPolicies=True
-
Allow standby states (S1-S3) when sleeping (on battery)
Enabled
SetPowerPolicies=True
-
Specify the system hibernate timeout (plugged in)
Enabled, 0
SetPowerPolicies=True
-
Specify the system hibernate timeout (on battery)
Enabled, 0
SetPowerPolicies=True
-
Admin Templates>System>Power Management>Video and Display Settings
Admin Templates>Windows Components>Windows Hello for Business
-
Use phone sign-in
Disabled
Always
-
Use Windows Hello for Business
Disabled
Always
-
Use biometrics
Disabled
Always
-
Admin Templates>Windows Components>OneDrive
-
Prevent the usage of OneDrive for file storage
Enabled
Always
-
Windows Settings>Security Settings>Local Policies>Security Options
-
-
Interactive logon: Do not display last user name
Enabled, Disabled when account model is only guest
Always
-
Interactive logon: Sign-in last interactive user automatically after a system-initiated restart
Disabled
Always
-
-
Shutdown: Allow system to be shut down without having to log on
Disabled
Always
-
User Account Control: Behavior of the elevation prompt for standard users
Auto deny
Always
-
-
+|Policy Name| Value|When set?|
+|--- |--- |--- |
+|Prevent enabling lock screen slide show|Enabled|Always|
+|Prevent changing lock screen and logon image|Enabled|Always|
+### Admin Templates > System > Power Management > Button Settings
+|Policy Name| Value|When set?|
+|--- |--- |--- |
+|Select the Power button action (plugged in)|Sleep|SetPowerPolicies=True|
+|Select the Power button action (on battery)|Sleep|SetPowerPolicies=True|
+|Select the Sleep button action (plugged in)|Sleep|SetPowerPolicies=True|
+|Select the lid switch action (plugged in)|Sleep|SetPowerPolicies=True|
+|Select the lid switch action (on battery)|Sleep|SetPowerPolicies=True|
+### Admin Templates > System > Power Management > Sleep Settings
+|Policy Name| Value|When set?|
+|--- |--- |--- |
+|Require a password when a computer wakes (plugged in)|Enabled|SignInOnResume=True|
+|Require a password when a computer wakes (on battery)|Enabled|SignInOnResume=True|
+|Specify the system sleep timeout (plugged in)|*SleepTimeout*|SetPowerPolicies=True|
+|Specify the system sleep timeout (on battery)|*SleepTimeout*|SetPowerPolicies=True|
+|Turn off hybrid sleep (plugged in)|Enabled|SetPowerPolicies=True|
+|Turn off hybrid sleep (on battery)|Enabled|SetPowerPolicies=True|
+|Specify the unattended sleep timeout (plugged in)|*SleepTimeout*|SetPowerPolicies=True|
+|Specify the unattended sleep timeout (on battery)|*SleepTimeout*|SetPowerPolicies=True|
+|Allow standby states (S1-S3) when sleeping (plugged in)|Enabled|SetPowerPolicies=True|
+|Allow standby states (S1-S3) when sleeping (on battery)|Enabled |SetPowerPolicies=True|
+|Specify the system hibernate timeout (plugged in)|Enabled, 0|SetPowerPolicies=True|
+|Specify the system hibernate timeout (on battery)|Enabled, 0|SetPowerPolicies=True|
+### Admin Templates>System>Power Management>Video and Display Settings
+
+|Policy Name| Value|When set?|
+|--- |--- |--- |
+|Turn off the display (plugged in)|*SleepTimeout*|SetPowerPolicies=True|
+|Turn off the display (on battery|*SleepTimeout*|SetPowerPolicies=True|
+
+### Admin Templates>System>Power Management>Energy Saver Settings
+
+|Policy Name| Value|When set?|
+|--- |--- |--- |
+|Energy Saver Battery Threshold (on battery)|70|SetPowerPolicies=True|
+
+### Admin Templates>System>Logon
+
+|Policy Name| Value|When set?|
+|--- |--- |--- |
+|Show first sign-in animation|Disabled|Always|
+|Hide entry points for Fast User Switching|Enabled|Always|
+|Turn on convenience PIN sign-in|Disabled|Always|
+|Turn off picture password sign-in|Enabled|Always|
+|Turn off app notification on the lock screen|Enabled|Always|
+|Allow users to select when a password is required when resuming from connected standby|Disabled|SignInOnResume=True|
+|Block user from showing account details on sign-in|Enabled|Always|
+
+### Admin Templates>System>User Profiles
+
+|Policy Name| Value|When set?|
+|--- |--- |--- |
+|Turn off the advertising ID|Enabled|SetEduPolicies=True|
+
+### Admin Templates>Windows Components
+
+|Policy Name| Value|When set?|
+|--- |--- |--- |
+|Do not show Windows Tips |Enabled|SetEduPolicies=True|
+|Turn off Microsoft consumer experiences |Enabled|SetEduPolicies=True|
+|Microsoft Passport for Work|Disabled|Always|
+|Prevent the usage of OneDrive for file storage|Enabled|Always|
+
+### Admin Templates>Windows Components>Biometrics
+
+|Policy Name| Value|When set?|
+|--- |--- |--- |
+|Allow the use of biometrics|Disabled|Always|
+|Allow users to log on using biometrics|Disabled|Always|
+|Allow domain users to log on using biometrics|Disabled|Always|
+
+### Admin Templates>Windows Components>Data Collection and Preview Builds
+
+|Policy Name| Value|When set?|
+|--- |--- |--- |
+|Toggle user control over Insider builds|Disabled|Always|
+|Disable pre-release features or settings|Disabled|Always|
+|Do not show feedback notifications|Enabled|Always|
+|Allow Telemetry|Basic, 0|SetEduPolicies=True|
+
+### Admin Templates>Windows Components>File Explorer
+
+|Policy Name| Value|When set?|
+|--- |--- |--- |
+|Show lock in the user tile menu|Disabled|Always|
+
+### Admin Templates>Windows Components>Maintenance Scheduler
+
+|Policy Name| Value|When set?|
+|--- |--- |--- |
+|Automatic Maintenance Activation Boundary|*MaintenanceStartTime*|Always|
+|Automatic Maintenance Random Delay|Enabled, 2 hours|Always|
+|Automatic Maintenance WakeUp Policy|Enabled|Always|
+
+### Admin Templates>Windows Components>Windows Hello for Business
+
+|Policy Name| Value|When set?|
+|--- |--- |--- |
+|Use phone sign-in|Disabled|Always|
+|Use Windows Hello for Business|Disabled|Always|
+|Use biometrics|Disabled|Always|
+
+### Admin Templates>Windows Components>OneDrive
+
+|Policy Name| Value|When set?|
+|--- |--- |--- |
+|Prevent the usage of OneDrive for file storage|Enabled|Always|
+
+### Windows Settings>Security Settings>Local Policies>Security Options
+
+|Policy Name| Value|When set?|
+|--- |--- |--- |
+|Interactive logon: Do not display last user name|Enabled, Disabled when account model is only guest|Always|
+|Interactive logon: Sign-in last interactive user automatically after a system-initiated restart|Disabled |Always|
+|Shutdown: Allow system to be shut down without having to log on|Disabled|Always|
+|User Account Control: Behavior of the elevation prompt for standard users|Auto deny|Always|
diff --git a/windows/configuration/start-layout-troubleshoot.md b/windows/configuration/start-layout-troubleshoot.md
index 5a39031455..000d733a4e 100644
--- a/windows/configuration/start-layout-troubleshoot.md
+++ b/windows/configuration/start-layout-troubleshoot.md
@@ -10,6 +10,7 @@ ms.localizationpriority: medium
ms.reviewer:
manager: dansimp
ms.topic: troubleshooting
+ms.collection: highpri
---
# Troubleshoot Start menu errors
@@ -42,7 +43,7 @@ When troubleshooting basic Start issues (and for the most part, all other Window
- `get-AppXPackage -Name Microsoft.Windows.ShellExperienceHost`
- `get-AppXPackage -Name Microsoft.Windows.Cortana`
- 
+ :::image type="content" alt-text="Example of output from cmdlets." source="images/start-ts-1.png" lightbox="images/start-ts-1.png":::
Failure messages will appear if they aren't installed
@@ -188,7 +189,7 @@ Events for both PDC and Background Tasks Infrastructure Service will be recorded
### Symptom: Application tiles like Alarm, Calculator, and Edge are missing from Start menu and the Settings app fails to open on Windows 10, version 1709 when a local user profile is deleted
-
+:::image type="content" alt-text="Screenshots that show download icons on app tiles and missing app tiles." source="images/start-ts-2.png" lightbox="images/start-ts-2.png":::
**Cause**: This issue is known. The first-time sign-in experience is not detected and does not trigger the install of some apps.
@@ -279,7 +280,7 @@ Additionally, users may see blank tiles if sign-in was attempted without network
### Symptom: Start Menu issues with Tile Data Layer corruption
-**Cause**: Windows 10, version 1507 through the release of version 1607 uses a database for the Tile image information. This is called the Tile Data Layer database. (The feature was deprecated in [Windows 10 1703](https://support.microsoft.com/help/4014193/features-that-are-removed-or-deprecated-in-windows-10-creators-update).)
+**Cause**: Windows 10, version 1507 through the release of version 1607 uses a database for the Tile image information. This is called the Tile Data Layer database. (The feature was deprecated in [Windows 10 1703](/windows/deployment/planning/windows-10-removed-features).)
**Resolution** There are steps you can take to fix the icons, first is to confirm that is the issue that needs to be addressed.
@@ -292,9 +293,9 @@ Additionally, users may see blank tiles if sign-in was attempted without network
>[!Note]
>Corruption recovery removes any manual pins from Start. Apps should still be visible, but you’ll need to re-pin any secondary tiles and/or pin app tiles to the main Start view. Aps that you have installed that are completely missing from “all apps” is unexpected, however. That implies the re-registration didn’t work.
-- Open a command prompt, and run the following command:
+Open a command prompt, and run the following command:
-```
+```console
C:\Windows\System32\tdlrecover.exe -reregister -resetlayout -resetcache
```
diff --git a/windows/configuration/start-layout-xml-desktop.md b/windows/configuration/start-layout-xml-desktop.md
index 64b68fb707..0e84376bad 100644
--- a/windows/configuration/start-layout-xml-desktop.md
+++ b/windows/configuration/start-layout-xml-desktop.md
@@ -12,6 +12,7 @@ ms.date: 10/02/2018
ms.reviewer:
manager: dansimp
ms.localizationpriority: medium
+ms.collection: highpri
---
# Start layout XML for desktop editions of Windows 10 (reference)
@@ -19,7 +20,7 @@ ms.localizationpriority: medium
**Applies to**
-- Windows 10
+- Windows 10
>**Looking for consumer information?** See [Customize the Start menu](https://go.microsoft.com/fwlink/p/?LinkId=623630)
diff --git a/windows/configuration/stop-employees-from-using-microsoft-store.md b/windows/configuration/stop-employees-from-using-microsoft-store.md
index 000617ec7e..ceb2627452 100644
--- a/windows/configuration/stop-employees-from-using-microsoft-store.md
+++ b/windows/configuration/stop-employees-from-using-microsoft-store.md
@@ -13,6 +13,7 @@ ms.author: greglin
ms.topic: conceptual
ms.localizationpriority: medium
ms.date: 4/16/2018
+ms.collection: highpri
---
# Configure access to Microsoft Store
@@ -20,7 +21,7 @@ ms.date: 4/16/2018
**Applies to**
-- Windows 10
+- Windows 10
>For more info about the features and functionality that are supported in each edition of Windows, see [Compare Windows 10 Editions](https://www.microsoft.com/WindowsForBusiness/Compare).
@@ -82,7 +83,7 @@ For more information on the rules available via AppLocker on the different suppo
Applies to: Windows 10 Enterprise, Windows 10 Education
> [!Note]
-> Not supported on Windows 10 Pro, starting with version 1511. For more info, see [Knowledge Base article #3135657](https://support.microsoft.com/kb/3135657).
+> Not supported on Windows 10 Pro, starting with version 1511. For more info, see [Knowledge Base article #3135657](/troubleshoot/windows-client/group-policy/cannot-disable-microsoft-store).
You can also use Group Policy to manage access to Microsoft Store.
diff --git a/windows/configuration/ue-v/uev-application-template-schema-reference.md b/windows/configuration/ue-v/uev-application-template-schema-reference.md
index 1ac2f752ac..e383e3f70a 100644
--- a/windows/configuration/ue-v/uev-application-template-schema-reference.md
+++ b/windows/configuration/ue-v/uev-application-template-schema-reference.md
@@ -108,52 +108,14 @@ Architecture enumerates two possible values: **Win32** and **Win64**. These valu
**Process**
The Process data type is a container used to describe processes to be monitored by UE-V. It contains six child elements: **Filename**, **Architecture**, **ProductName**, **FileDescription**, **ProductVersion**, and **FileVersion**. This table details each element’s respective data type:
-
-
-
-
-
-
-
-
-
Element
-
Data Type
-
Mandatory
-
-
-
Filename
-
FilenameString
-
True
-
-
-
Architecture
-
Architecture
-
False
-
-
-
ProductName
-
String
-
False
-
-
-
FileDescription
-
String
-
False
-
-
-
ProductVersion
-
ProcessVersion
-
False
-
-
-
FileVersion
-
ProcessVersion
-
False
-
-
-
-
-
+|Element|Data Type|Mandatory|
+|--- |--- |--- |
+|Filename|FilenameString|True|
+|Architecture|Architecture|False|
+|ProductName|String|False|
+|FileDescription|String|False|
+|ProductVersion|ProcessVersion|False|
+|FileVersion|ProcessVersion|False|
**Processes**
The Processes data type represents a container for a collection of one or more Process elements. Two child elements are supported in the Processes sequence type: **Process** and **ShellProcess**. Process is an element of type Process and ShellProcess is of data type Empty. At least one item must be identified in the sequence.
@@ -177,32 +139,11 @@ FileSetting contains parameters associated with files and files paths. Four chil
**Settings**
Settings is a container for all the settings that apply to a particular template. It contains instances of the Registry, File, SystemParameter, and CustomAction settings described earlier. In addition, it can also contain the following child elements with behaviors described:
-
-
-
-
-
-
-
-
Element
-
Description
-
-
-
Asynchronous
-
Asynchronous settings packages are applied without blocking the application startup so that the application start proceeds while the settings are still being applied. This is useful for settings that can be applied asynchronously, such as those get/set through an API, like SystemParameterSetting.
-
-
-
PreventOverlappingSynchronization
-
By default, UE-V only saves settings for an application when the last instance of an application using the template is closed. When this element is set to ‘false’, UE-V exports the settings even if other instances of an application are running. Suited templates – those that include a Common element section– that are shipped with UE-V use this flag to enable shared settings to always export on application close, while preventing application-specific settings from exporting until the last instance is closed.
-
-
-
AlwaysApplySettings
-
This parameter forces an imported settings package to be applied even if there are no differences between the package and the current state of the application. This parameter should be used only in special cases since it can slow down settings import.
-
-
-
-
-
+|Element|Description|
+|--- |--- |
+|Asynchronous|Asynchronous settings packages are applied without blocking the application startup so that the application start proceeds while the settings are still being applied. This is useful for settings that can be applied asynchronously, such as those get/set through an API, like SystemParameterSetting.|
+|PreventOverlappingSynchronization|By default, UE-V only saves settings for an application when the last instance of an application using the template is closed. When this element is set to ‘false’, UE-V exports the settings even if other instances of an application are running. Suited templates – those that include a Common element section– that are shipped with UE-V use this flag to enable shared settings to always export on application close, while preventing application-specific settings from exporting until the last instance is closed.|
+|AlwaysApplySettings|This parameter forces an imported settings package to be applied even if there are no differences between the package and the current state of the application. This parameter should be used only in special cases since it can slow down settings import.|
### Name Element
@@ -212,8 +153,8 @@ Settings is a container for all the settings that apply to a particular template
Name specifies a unique name for the settings location template. This is used for display purposes when referencing the template in WMI, PowerShell, Event Viewer and debug logs. In general, avoid referencing version information, as this can be objected from the ProductVersion element. For example, specify `My Application` rather than `My Application 1.1`.
-**Note**
-UE-V does not reference external DTDs, so it is not possible to use named entities in a settings location template. For example, do not use ® to refer to the registered trade mark sign ®. Instead, use canonical numbered references to include these types of special characters, for example, &\#174 for the ® character. This rule applies to all string values in this document.
+> [!NOTE]
+> UE-V does not reference external DTDs, so it is not possible to use named entities in a settings location template. For example, do not use ® to refer to the registered trade mark sign ®. Instead, use canonical numbered references to include these types of special characters, for example, &\#174 for the ® character. This rule applies to all string values in this document.
See for a complete list of character entities. UTF-8-encoded documents may include the Unicode characters directly. Saving templates through the UE-V template generator converts character entities to their Unicode representations automatically.
@@ -239,22 +180,23 @@ ID populates a unique identifier for a particular template. This tag becomes the
Version identifies the version of the settings location template for administrative tracking of changes. The UE-V template generator automatically increments this number by one each time the template is saved. Notice that this field must be a whole number integer; fractional values, such as `2.5` are not allowed.
-**Hint:** You can save notes about version changes using XML comment tags ``, for example:
+> [!TIP]
+> You can save notes about version changes using XML comment tags ``, for example:
```xml
-
- 4
+ Version 1 Jul 05, 2012 Initial template created by Generator - Denise@Contoso.com
+ Version 2 Jul 31, 2012 Added support for app.exe v2.1.3 - Mark@Contoso.com
+ Version 3 Jan 01, 2013 Added font settings support - Mark@Contoso.com
+ Version 4 Jan 31, 2013 Added support for plugin settings - Tony@Contoso.com
+ -->
+4
```
-**Important**
-This value is queried to determine if a new version of a template should be applied to an existing template in these instances:
+> [!IMPORTANT]
+> This value is queried to determine if a new version of a template should be applied to an existing template in these instances:
- When the scheduled Template Auto Update task executes
@@ -281,24 +223,24 @@ Author identifies the creator of the settings location template. Two optional ch
Processes contains at least one `` element, which in turn contains the following child elements: **Filename**, **Architecture**, **ProductName**, **FileDescription**, **ProductVersion**, and **FileVersion**. The Filename child element is mandatory and the others are optional. A fully populated element contains tags similar to this example:
```xml
-
- MyApplication.exe
- Win64
- MyApplication
- MyApplication.exe
-
-
-
-
-
-
-
-
-
-
-
-
-
+
+ MyApplication.exe
+ Win64
+ MyApplication
+ MyApplication.exe
+
+
+
+
+
+
+
+
+
+
+
+
+
```
### Filename
@@ -311,7 +253,8 @@ Filename refers to the actual file name of the executable as it appears in the f
Valid filenames must not match the regular expression \[^\\\\\\?\\\*\\|<>/:\]+, that is, they may not contain backslash characters, asterisk or question mark wild-card characters, the pipe character, the greater than or less than sign, forward slash, or colon (the \\ ? \* | < > / or : characters.).
-**Hint:** To test a string against this regex, use a PowerShell command window and substitute your executable’s name for **YourFileName**:
+> [!TIP]
+> To test a string against this regex, use a PowerShell command window and substitute your executable’s name for **YourFileName**:
`"YourFileName.exe" -match "[\\\?\*\|<>/:]+"`
@@ -325,8 +268,8 @@ A value of **True** indicates that the string contains illegal characters. Here
- Program<1>.exe
-**Note**
-The UE-V template generator encodes the greater than and less than characters as > and < respectively.
+> [!NOTE]
+> The UE-V template generator encodes the greater than and less than characters as > and < respectively.
@@ -342,8 +285,8 @@ Architecture refers to the processor architecture for which the target executabl
If this element is absent, the settings location template ignores the process’ architecture and applies to both 32 and 64-bit processes if the file name and other attributes apply.
-**Note**
-UE-V does not support ARM processors in this version.
+> [!NOTE]
+> UE-V does not support ARM processors in this version.
@@ -356,13 +299,13 @@ UE-V does not support ARM processors in this version.
ProductName is an optional element used to identify a product for administrative purposes or reporting. ProductName differs from Filename in that there are no regular expression restrictions on its value. This allows for more easily understood descriptions of a process where the executable name may not be obvious. For example:
```xml
-
- MyApplication.exe
- My Application 6.x by Contoso.com
-
-
-
-
+
+ MyApplication.exe
+ My Application 6.x by Contoso.com
+
+
+
+
```
### FileDescription
@@ -410,10 +353,10 @@ The product and file version elements may be left unspecified. Doing so makes th
Product version: 1.0 specified in the UE-V template generator produces the following XML:
```xml
-
-
-
-
+
+
+
+
```
**Example 2:**
@@ -421,12 +364,12 @@ Product version: 1.0 specified in the UE-V template generator produces the follo
File version: 5.0.2.1000 specified in the UE-V template generator produces the following XML:
```xml
-
-
-
-
-
-
+
+
+
+
+
+
```
**Incorrect Example 1 – incomplete range:**
@@ -434,9 +377,9 @@ File version: 5.0.2.1000 specified in the UE-V template generator produces the f
Only the Minimum attribute is present. Maximum must be included in a range as well.
```xml
-
-
-
+
+
+
```
**Incorrect Example 2 – Minor specified without Major element:**
@@ -444,9 +387,9 @@ Only the Minimum attribute is present. Maximum must be included in a range as we
Only the Minor element is present. Major must be included as well.
```xml
-
-
-
+
+
+
```
### FileVersion
@@ -464,180 +407,68 @@ Including a FileVersion element for an application allows for more granular fine
The child elements and syntax rules for FileVersion are identical to those of ProductVersion.
```xml
-
- MSACCESS.EXE
- Win32
-
-
-
-
-
-
-
-
-
+
+ MSACCESS.EXE
+ Win32
+
+
+
+
+
+
+
+
+
```
### Application Element
Application is a container for settings that apply to a particular application. It is a collection of the following fields/types.
-
-
-
-
-
-
-
-
Field/Type
-
Description
-
-
-
Name
-
Specifies a unique name for the settings location template. This is used for display purposes when referencing the template in WMI, PowerShell, Event Viewer and debug logs. For more information, see Name.
-
-
-
ID
-
Populates a unique identifier for a particular template. This tag becomes the primary identifier that the UE-V service uses to reference the template at runtime. For more information, see ID.
-
-
-
Description
-
An optional description of the template.
-
-
-
LocalizedNames
-
An optional name displayed in the UI, localized by a language locale.
-
-
-
LocalizedDescriptions
-
An optional template description localized by a language locale.
-
-
-
Version
-
Identifies the version of the settings location template for administrative tracking of changes. For more information, see Version.
-
-
-
DeferToMSAccount
-
Controls whether this template is enabled in conjunction with a Microsoft account or not. If MSA syncing is enabled for a user on a machine, then this template will automatically be disabled.
-
-
-
DeferToOffice365
-
Similar to MSA, this controls whether this template is enabled in conjunction with Office365. If Office 365 is being used to sync settings, this template will automatically be disabled.
-
-
-
FixedProfile
-
Specifies that this template can only be associated with the profile specified within this element, and cannot be changed via WMI or PowerShell.
-
-
-
Processes
-
A container for a collection of one or more Process elements. For more information, see Processes.
-
-
-
Settings
-
A container for all the settings that apply to a particular template. It contains instances of the Registry, File, SystemParameter, and CustomAction settings. For more information, see Settings in Data types.
-
-
-
+|Field/Type|Description|
+|--- |--- |
+|Name|Specifies a unique name for the settings location template. This is used for display purposes when referencing the template in WMI, PowerShell, Event Viewer and debug logs. For more information, see [Name](#name21).|
+|ID|Populates a unique identifier for a particular template. This tag becomes the primary identifier that the UE-V service uses to reference the template at runtime. For more information, see [ID](#id21).|
+|Description|An optional description of the template.|
+|LocalizedNames|An optional name displayed in the UI, localized by a language locale.|
+|LocalizedDescriptions|An optional template description localized by a language locale.|
+|Version|Identifies the version of the settings location template for administrative tracking of changes. For more information, see [Version](#version21).|
+|DeferToMSAccount|Controls whether this template is enabled in conjunction with a Microsoft account or not. If MSA syncing is enabled for a user on a machine, then this template will automatically be disabled.|
+|DeferToOffice365|Similar to MSA, this controls whether this template is enabled in conjunction with Office365. If Office 365 is being used to sync settings, this template will automatically be disabled.|
+|FixedProfile|Specifies that this template can only be associated with the profile specified within this element, and cannot be changed via WMI or PowerShell.|
+|Processes|A container for a collection of one or more Process elements. For more information, see [Processes](#processes21).|
+|Settings|A container for all the settings that apply to a particular template. It contains instances of the Registry, File, SystemParameter, and CustomAction settings. For more information, see **Settings** in [Data types](#data21)".|
-
### Common Element
Common is similar to an Application element, but it is always associated with two or more Application elements. The Common section represents the set of settings that are shared between those Application instances. It is a collection of the following fields/types.
-
-
-
-
-
-
-
-
Field/Type
-
Description
-
-
-
Name
-
Specifies a unique name for the settings location template. This is used for display purposes when referencing the template in WMI, PowerShell, Event Viewer and debug logs. For more information, see Name.
-
-
-
ID
-
Populates a unique identifier for a particular template. This tag becomes the primary identifier that the UE-V service uses to reference the template at runtime. For more information, see ID.
-
-
-
Description
-
An optional description of the template.
-
-
-
LocalizedNames
-
An optional name displayed in the UI, localized by a language locale.
-
-
-
LocalizedDescriptions
-
An optional template description localized by a language locale.
-
-
-
Version
-
Identifies the version of the settings location template for administrative tracking of changes. For more information, see Version.
-
-
-
DeferToMSAccount
-
Controls whether this template is enabled in conjunction with a Microsoft account or not. If MSA syncing is enabled for a user on a machine, then this template will automatically be disabled.
-
-
-
DeferToOffice365
-
Similar to MSA, this controls whether this template is enabled in conjunction with Office365. If Office 365 is being used to sync settings, this template will automatically be disabled.
-
-
-
FixedProfile
-
Specifies that this template can only be associated with the profile specified within this element, and cannot be changed via WMI or PowerShell.
-
-
-
Settings
-
A container for all the settings that apply to a particular template. It contains instances of the Registry, File, SystemParameter, and CustomAction settings. For more information, see Settings in Data types.
-
-
-
-
-
+|Field/Type|Description|
+|--- |--- |
+|Name|Specifies a unique name for the settings location template. This is used for display purposes when referencing the template in WMI, PowerShell, Event Viewer and debug logs. For more information, see [Name](#name21).|
+|ID|Populates a unique identifier for a particular template. This tag becomes the primary identifier that the UE-V service uses to reference the template at runtime. For more information, see [ID](#id21).|
+|Description|An optional description of the template.|
+|LocalizedNames|An optional name displayed in the UI, localized by a language locale.|
+|LocalizedDescriptions|An optional template description localized by a language locale.|
+|Version|Identifies the version of the settings location template for administrative tracking of changes. For more information, see [Version](#version21).|
+|DeferToMSAccount|Controls whether this template is enabled in conjunction with a Microsoft account or not. If MSA syncing is enabled for a user on a machine, then this template will automatically be disabled.|
+|DeferToOffice365|Similar to MSA, this controls whether this template is enabled in conjunction with Office365. If Office 365 is being used to sync settings, this template will automatically be disabled.|
+|FixedProfile|Specifies that this template can only be associated with the profile specified within this element, and cannot be changed via WMI or PowerShell.|
+|Settings|A container for all the settings that apply to a particular template. It contains instances of the Registry, File, SystemParameter, and CustomAction settings. For more information, see **Settings** in [Data types](#data21).|
### SettingsLocationTemplate Element
This element defines the settings for a single application or a suite of applications.
-
-
-
-
-
-
-
-
Field/Type
-
Description
-
-
-
Name
-
Specifies a unique name for the settings location template. This is used for display purposes when referencing the template in WMI, PowerShell, Event Viewer and debug logs. For more information, see Name.
-
-
-
ID
-
Populates a unique identifier for a particular template. This tag becomes the primary identifier that the UE-V service uses to reference the template at runtime. For more information, see ID.
-
-
-
Description
-
An optional description of the template.
-
-
-
LocalizedNames
-
An optional name displayed in the UI, localized by a language locale.
-
-
-
LocalizedDescriptions
-
An optional template description localized by a language locale.
-
-
-
+|Field/Type|Description|
+|--- |--- |
+|Name|Specifies a unique name for the settings location template. This is used for display purposes when referencing the template in WMI, PowerShell, Event Viewer and debug logs. For more information, see [Name](#name21).|
+|ID|Populates a unique identifier for a particular template. This tag becomes the primary identifier that the UE-V service uses to reference the template at runtime. For more information, see [ID](#id21).|
+|Description|An optional description of the template.|
+|LocalizedNames|An optional name displayed in the UI, localized by a language locale.|
+|LocalizedDescriptions|An optional template description localized by a language locale.|
-
### Appendix: SettingsLocationTemplate.xsd
diff --git a/windows/configuration/ue-v/uev-changing-the-frequency-of-scheduled-tasks.md b/windows/configuration/ue-v/uev-changing-the-frequency-of-scheduled-tasks.md
index 43910cf8eb..9bc89c945f 100644
--- a/windows/configuration/ue-v/uev-changing-the-frequency-of-scheduled-tasks.md
+++ b/windows/configuration/ue-v/uev-changing-the-frequency-of-scheduled-tasks.md
@@ -29,8 +29,8 @@ When the User Experience Virtualization (UE-V) service is enabled, it creates th
- [Template Auto Update](#template-auto-update)
-**Note**
-These tasks must remain enabled, because UE-V cannot function without them.
+> [!NOTE]
+> These tasks must remain enabled, because UE-V cannot function without them.
These scheduled tasks are not configurable with the UE-V tools. Administrators who want to change the scheduled task for these items can create a script that uses the Schtasks.exe command-line options.
@@ -44,55 +44,21 @@ The following scheduled tasks are included in UE-V with sample scheduled task co
The **Monitor Application Settings** task is used to synchronize settings for Windows apps. It is runs at logon but is delayed by 30 seconds to not affect the logon detrimentally. The Monitor Application Status task runs the UevAppMonitor.exe file, which is located in the UE-V Agent installation directory.
-
-
-
-
-
-
-
-
Task name
-
Default event
-
-
-
-
-
\Microsoft\UE-V\Monitor Application Status
-
Logon
-
-
-
-
-
+|Task name|Default event|
+|--- |--- |
+|\Microsoft\UE-V\Monitor Application Status|Logon|
### Sync Controller Application
The **Sync Controller Application** task is used to start the Sync Controller to synchronize settings from the computer to the settings storage location. By default, the task runs every 30 minutes. At that time, local settings are synchronized to the settings storage location, and updated settings on the settings storage location are synchronized to the computer. The Sync Controller application runs the Microsoft.Uev.SyncController.exe, which is located in the UE-V Agent installation directory.
-
-
-
-
-
-
-
-
Task name
-
Default event
-
-
-
-
-
\Microsoft\UE-V\Sync Controller Application
-
Logon, and every 30 minutes thereafter
-
-
-
-
-
+|Task name|Default event|
+|--- |--- |
+|\Microsoft\UE-V\Sync Controller Application|Logon, and every 30 minutes thereafter|
For example, the following command configures the agent to synchronize settings every 15 minutes instead of the default 30 minutes.
-``` syntax
+```console
Schtasks /change /tn “Microsoft\UE-V\Sync Controller Application” /ri 15
```
@@ -100,118 +66,36 @@ Schtasks /change /tn “Microsoft\UE-V\Sync Controller Application” /ri 15
The **Synchronize Settings at Logoff** task is used to start an application at logon that controls the synchronization of applications at logoff for UE-V. The Synchronize Settings at Logoff task runs the Microsoft.Uev.SyncController.exe file, which is located in the UE-V Agent installation directory.
-
-
-
-
-
-
-
-
Task name
-
Default event
-
-
-
-
-
\Microsoft\UE-V\Synchronize Settings at Logoff
-
Logon
-
-
-
-
-
+|Task name|Default event|
+|--- |--- |
+|\Microsoft\UE-V\Synchronize Settings at Logoff|Logon|
### Template Auto Update
The **Template Auto Update** task checks the settings template catalog for new, updated, or removed templates. This task only runs if the SettingsTemplateCatalog is configured. The **Template Auto Update** task runs the ApplySettingsCatalog.exe file, which is located in the UE-V Agent installation directory.
-
-
-
-
-
-
-
-
Task name
-
Default event
-
-
-
-
-
\Microsoft\UE-V\Template Auto Update
-
System startup and at 3:30 AM every day, at a random time within a 1-hour window
-
-
-
+|Task name|Default event|
+|--- |--- |
+|\Microsoft\UE-V\Template Auto Update|System startup and at 3:30 AM every day, at a random time within a 1-hour window|
-
**Example:** The following command configures the UE-V service to check the settings template catalog store every hour.
-``` syntax
+```console
schtasks /change /tn "Microsoft\UE-V\Template Auto Update" /ri 60
```
## UE-V Scheduled Task Details
-
The following chart provides additional information about scheduled tasks for UE-V 2:
-
-
-
-
-
-
-
-
-
-
-
-
Task Name (file name)
-
Default Frequency
-
Power Toggle
-
Idle Only
-
Network Connection
-
Description
-
-
-
Monitor Application Settings (UevAppMonitor.exe)
-
Starts 30 seconds after logon and continues until logoff.
Starts the Sync Controller which synchronizes local settings with the settings storage location.
-
-
-
Synchronize Settings at Logoff (Microsoft.Uev.SyncController.exe)
-
Runs at logon and then waits for Logoff to Synchronize settings.
-
No
-
Yes
-
N/A
-
Start an application at logon that controls the synchronization of applications at logoff.
-
-
-
Template Auto Update (ApplySettingsCatalog.exe)
-
Runs at initial logon and at 3:30 AM every day thereafter.
-
Yes
-
No
-
N/A
-
Checks the settings template catalog for new, updated, or removed templates. This task only runs if SettingsTemplateCatalog is configured.
-
-
-
-
-
+|Task Name (file name)|Default Frequency|Power Toggle|Idle Only|Network Connection|Description|
+|--- |--- |--- |--- |--- |--- |
+|**Monitor Application Settings** (UevAppMonitor.exe)|Starts 30 seconds after logon and continues until logoff.|No|Yes|N/A|Synchronizes settings for Windows (AppX) apps.|
+|**Sync Controller Application** (Microsoft.Uev.SyncController.exe)|At logon and every 30 min thereafter.|Yes|Yes|Only if Network is connected|Starts the Sync Controller which synchronizes local settings with the settings storage location.|
+|**Synchronize Settings at Logoff** (Microsoft.Uev.SyncController.exe)|Runs at logon and then waits for Logoff to Synchronize settings.|No|Yes|N/A|Start an application at logon that controls the synchronization of applications at logoff.|
+|**Template Auto Update** (ApplySettingsCatalog.exe)|Runs at initial logon and at 3:30 AM every day thereafter.|Yes|No|N/A|Checks the settings template catalog for new, updated, or removed templates. This task only runs if SettingsTemplateCatalog is configured.|
**Legend**
@@ -251,4 +135,4 @@ The following additional information applies to UE-V scheduled tasks:
[Administering UE-V](uev-administering-uev.md)
-[Deploy UE-V for Custom Applications](uev-deploy-uev-for-custom-applications.md)
\ No newline at end of file
+[Deploy UE-V for Custom Applications](uev-deploy-uev-for-custom-applications.md)
diff --git a/windows/configuration/ue-v/uev-configuring-uev-with-group-policy-objects.md b/windows/configuration/ue-v/uev-configuring-uev-with-group-policy-objects.md
index 852fd636c1..3e8f520a9f 100644
--- a/windows/configuration/ue-v/uev-configuring-uev-with-group-policy-objects.md
+++ b/windows/configuration/ue-v/uev-configuring-uev-with-group-policy-objects.md
@@ -26,147 +26,31 @@ The following policy settings can be configured for UE-V.
**Group Policy settings**
-
-
-
-
-
-
-
-
-
-
Group Policy setting name
-
Target
-
Group Policy setting description
-
Configuration options
-
-
-
-
-
Do not use the sync provider
-
Computers and Users
-
By using this Group Policy setting, you can configure whether UE-V uses the sync provider feature. This policy setting also lets you enable notification to appear when the import of user settings is delayed.
-
Enable this setting to configure the UE-V service not to use the sync provider.
-
-
-
First Use Notification
-
Computers Only
-
This Group Policy setting enables a notification in the notification area that appears when the UE-V service runs for the first time.
-
The default is enabled.
-
-
-
Synchronize Windows settings
-
Computers and Users
-
This Group Policy setting configures the synchronization of Windows settings.
-
Select which Windows settings synchronize between computers.
-
By default, Windows themes, desktop settings, and Ease of Access settings synchronize settings between computers of the same operating system version.
-
-
-
Settings package size warning threshold
-
Computers and Users
-
This Group Policy setting lets you configure the UE-V service to report when a settings package file size reaches a defined threshold.
-
Specify the preferred threshold for settings package sizes in kilobytes (KB).
-
By default, the UE-V service does not have a package file size threshold.
-
-
-
Settings storage path
-
Computers and Users
-
This Group Policy setting configures where the user settings are to be stored.
-
Enter a Universal Naming Convention (UNC) path and variables such as \Server\SettingsShare%username%.
-
-
-
Settings template catalog path
-
Computers Only
-
This Group Policy setting configures where custom settings location templates are stored. This policy setting also configures whether the catalog is to be used to replace the default Microsoft templates that are installed with the UE-V service.
-
Enter a Universal Naming Convention (UNC) path such as \Server\TemplateShare or a folder location on the computer.
-
Select the check box to replace the default Microsoft templates.
-
-
-
Sync settings over metered connections
-
Computers and Users
-
This Group Policy setting defines whether UE-V synchronizes settings over metered connections.
-
By default, the UE-V service does not synchronize settings over a metered connection.
-
-
-
Sync settings over metered connections even when roaming
-
Computers and Users
-
This Group Policy setting defines whether UE-V synchronizes settings over metered connections outside of the home provider network, for example, when the data connection is in roaming mode.
-
By default, UE-V does not synchronize settings over a metered connection when it is in roaming mode.
-
-
-
Synchronization timeout
-
Computers and Users
-
This Group Policy setting configures the number of milliseconds that the computer waits before a time-out when it retrieves user settings from the remote settings location. If the remote storage location is unavailable, and the user does not use the sync provider, the application start is delayed by this many milliseconds.
-
Specify the preferred synchronization time-out in milliseconds. The default value is 2000 milliseconds.
-
-
-
Tray Icon
-
Computers Only
-
This Group Policy setting enables the User Experience Virtualization (UE-V) tray icon.
-
This setting only has an effect for UE-V 2.x and earlier. It has no effect for UE-V in Windows 10, version 1607.
-
-
-
Use User Experience Virtualization (UE-V)
-
Computers and Users
-
This Group Policy setting lets you enable or disable User Experience Virtualization (UE-V).
-
This setting only has an effect for UE-V 2.x and earlier. For UE-V in Windows 10, version 1607, use the Enable UE-V setting.
-
-
-
Enable UE-V
-
Computers and Users
-
This policy setting allows you to enable or disable User Experience Virtualization (UE-V) feature. Reboot is needed for enable to take effect.
-
This setting only has an effect for UE-V in Windows 10, version 1607. For UE-V 2.x and earlier, choose the Use User Experience Virtualization (UE-V) setting.
-
-
-
+|Group Policy setting name|Target|Group Policy setting description|Configuration options|
+|--- |--- |--- |--- |
+|Do not use the sync provider|Computers and Users|By using this Group Policy setting, you can configure whether UE-V uses the sync provider feature. This policy setting also lets you enable notification to appear when the import of user settings is delayed.|Enable this setting to configure the UE-V service not to use the sync provider.|
+|First Use Notification|Computers Only|This Group Policy setting enables a notification in the notification area that appears when the UE-V service runs for the first time.|The default is enabled.|
+|Synchronize Windows settings|Computers and Users|This Group Policy setting configures the synchronization of Windows settings.|Select which Windows settings synchronize between computers. By default, Windows themes, desktop settings, and Ease of Access settings synchronize settings between computers of the same operating system version.|
+|Settings package size warning threshold|Computers and Users|This Group Policy setting lets you configure the UE-V service to report when a settings package file size reaches a defined threshold.|Specify the preferred threshold for settings package sizes in kilobytes (KB). By default, the UE-V service does not have a package file size threshold.|
+|Settings storage path|Computers and Users|This Group Policy setting configures where the user settings are to be stored.|Enter a Universal Naming Convention (UNC) path and variables such as \Server\SettingsShare%username%.|
+|Settings template catalog path|Computers Only|This Group Policy setting configures where custom settings location templates are stored. This policy setting also configures whether the catalog is to be used to replace the default Microsoft templates that are installed with the UE-V service.|Enter a Universal Naming Convention (UNC) path such as \Server\TemplateShare or a folder location on the computer. Select the check box to replace the default Microsoft templates.|
+|Sync settings over metered connections|Computers and Users|This Group Policy setting defines whether UE-V synchronizes settings over metered connections.|By default, the UE-V service does not synchronize settings over a metered connection.|
+|Sync settings over metered connections even when roaming|Computers and Users|This Group Policy setting defines whether UE-V synchronizes settings over metered connections outside of the home provider network, for example, when the data connection is in roaming mode.|By default, UE-V does not synchronize settings over a metered connection when it is in roaming mode.|
+|Synchronization timeout|Computers and Users|This Group Policy setting configures the number of milliseconds that the computer waits before a time-out when it retrieves user settings from the remote settings location. If the remote storage location is unavailable, and the user does not use the sync provider, the application start is delayed by this many milliseconds.|Specify the preferred synchronization time-out in milliseconds. The default value is 2000 milliseconds.|
+|Tray Icon|Computers Only|This Group Policy setting enables the User Experience Virtualization (UE-V) tray icon.|This setting only has an effect for UE-V 2.x and earlier. It has no effect for UE-V in Windows 10, version 1607.|
+|Use User Experience Virtualization (UE-V)|Computers and Users|This Group Policy setting lets you enable or disable User Experience Virtualization (UE-V).|This setting only has an effect for UE-V 2.x and earlier. For UE-V in Windows 10, version 1607, use the **Enable UE-V** setting.|
+|Enable UE-V|Computers and Users|This policy setting allows you to enable or disable User Experience Virtualization (UE-V) feature. Reboot is needed for enable to take effect.|This setting only has an effect for UE-V in Windows 10, version 1607. For UE-V 2.x and earlier, choose the **Use User Experience Virtualization (UE-V)** setting.|
-
-
-**Note**
-In addition, Group Policy settings are available for many desktop applications and Windows apps. You can use these settings to enable or disable settings synchronization for specific applications.
-
-
+>[!NOTE]
+>In addition, Group Policy settings are available for many desktop applications and Windows apps. You can use these settings to enable or disable settings synchronization for specific applications.
**Windows App Group Policy settings**
-
-
-
-
-
-
-
-
-
-
Group Policy setting name
-
Target
-
Group Policy setting description
-
Configuration options
-
-
-
-
-
Do not synchronize Windows Apps
-
Computers and Users
-
This Group Policy setting defines whether the UE-V service synchronizes settings for Windows apps.
-
The default is to synchronize Windows apps.
-
-
-
Windows App List
-
Computer and User
-
This setting lists the family package names of the Windows apps and states expressly whether UE-V synchronizes that app’s settings.
-
You can use this setting to specify that settings of an app are never synchronized by UE-V, even if the settings of all other Windows apps are synchronized.
-
-
-
Sync Unlisted Windows Apps
-
Computer and User
-
This Group Policy setting defines the default settings sync behavior of the UE-V service for Windows apps that are not explicitly listed in the Windows app list.
-
By default, the UE-V service only synchronizes settings of those Windows apps that are included in the Windows app list.
-
-
-
-
-
+|Group Policy setting name|Target|Group Policy setting description|Configuration options|
+|--- |--- |--- |--- |
+|Do not synchronize Windows Apps|Computers and Users|This Group Policy setting defines whether the UE-V service synchronizes settings for Windows apps.|The default is to synchronize Windows apps.|
+|Windows App List|Computer and User|This setting lists the family package names of the Windows apps and states expressly whether UE-V synchronizes that app’s settings.|You can use this setting to specify that settings of an app are never synchronized by UE-V, even if the settings of all other Windows apps are synchronized.|
+|Sync Unlisted Windows Apps|Computer and User|This Group Policy setting defines the default settings sync behavior of the UE-V service for Windows apps that are not explicitly listed in the Windows app list.|By default, the UE-V service only synchronizes settings of those Windows apps that are included in the Windows app list.|
For more information about synchronizing Windows apps, see [Windows App List](uev-managing-settings-location-templates-using-windows-powershell-and-wmi.md#win8applist).
diff --git a/windows/configuration/ue-v/uev-configuring-uev-with-system-center-configuration-manager.md b/windows/configuration/ue-v/uev-configuring-uev-with-system-center-configuration-manager.md
index 742b25f00e..5be5dbca10 100644
--- a/windows/configuration/ue-v/uev-configuring-uev-with-system-center-configuration-manager.md
+++ b/windows/configuration/ue-v/uev-configuring-uev-with-system-center-configuration-manager.md
@@ -35,52 +35,15 @@ The UE-V Configuration Pack includes tools to:
- Create or update a UE-V Agent policy configuration item to set or clear these settings
-
-
-
-
-
-
-
-
-
Max package size
-
Enable/disable Windows app sync
-
Wait for sync on application start
-
-
-
Setting import delay
-
Sync unlisted Windows apps
-
Wait for sync on logon
-
-
-
Settings import notification
-
IT contact URL
-
Wait for sync timeout
-
-
-
Settings storage path
-
IT contact descriptive text
-
Settings template catalog path
-
-
-
Sync enablement
-
Tray icon enabled
-
Start/Stop UE-V agent service
-
-
-
Sync method
-
First use notification
-
Define which Windows apps will roam settings
-
-
-
Sync timeout
-
-
-
-
-
-
-
+ |Configuration|Setting|Description|
+ |--- |--- |--- |
+ |Max package size|Enable/disable Windows app sync|Wait for sync on application start|
+ |Setting import delay|Sync unlisted Windows apps|Wait for sync on logon|
+ |Settings import notification|IT contact URL|Wait for sync timeout|
+ |Settings storage path|IT contact descriptive text|Settings template catalog path|
+ |Sync enablement|Tray icon enabled|Start/Stop UE-V agent service|
+ |Sync method|First use notification|Define which Windows apps will roam settings|
+ |Sync timeout|||
- Verify compliance by confirming that UE-V is running.
@@ -101,8 +64,8 @@ The UE-V service policy configuration item CAB file is created using the UevTemp
- ConfigurationFile <full path to agent configuration XML file>
-**Note**
-It might be necessary to change the PowerShell execution policy to allow these scripts to run in your environment. Perform these steps in the Configuration Manager console:
+> [!NOTE]
+> It might be necessary to change the PowerShell execution policy to allow these scripts to run in your environment. Perform these steps in the Configuration Manager console:
1. Select **Administration > Client Settings > Properties**
@@ -113,7 +76,7 @@ It might be necessary to change the PowerShell execution policy to allow these s
1. Copy the default settings configuration file from the UE-V Config Pack installation directory to a location visible to your ConfigMgr Admin Console:
- ``` syntax
+ ```cmd
C:\Program Files (x86)\Windows Kits\10\Microsoft User Experience Virtualization\Management\AgentConfiguration.xml
```
@@ -162,7 +125,7 @@ It might be necessary to change the PowerShell execution policy to allow these s
3. Run this command on a machine running the ConfigMgr Admin Console:
- ``` syntax
+ ```cmd
C:\Program Files (x86)\Microsoft User Experience Virtualization\ConfigPack\UevAgentPolicyGenerator.exe -Site ABC -CabFilePath "C:\MyCabFiles\UevPolicyItem.cab" -ConfigurationFile "c:\AgentConfiguration.xml"
```
@@ -206,7 +169,7 @@ The result is a baseline CAB file that is ready for import into Configuration Ma
3. Add the command and parameters to the .bat file that will generate the baseline. The following example creates a baseline that distributes Notepad and Calculator:
- ``` syntax
+ ```cmd
C:\Program Files (x86)\Microsoft User Experience Virtualization\ConfigPack\UevTemplateBaselineGenerator.exe -Site "ABC" -TemplateFolder "C:\ProductionUevTemplates" -Register "MicrosoftNotepad.xml, MicrosoftCalculator.xml" -CabFilePath "C:\MyCabFiles\UevTemplateBaseline.cab"
```
@@ -230,21 +193,7 @@ To distribute a new Notepad template, you would perform these steps:
You can download the [System Center 2012 Configuration Pack for Microsoft User Experience Virtualization 2.0](https://www.microsoft.com/download/details.aspx?id=40913) from the Microsoft Download Center.
-
-
-
-
-
## Related topics
[Manage Configurations for UE-V](uev-manage-configurations.md)
-
-
-
-
-
-
-
-
-
diff --git a/windows/configuration/ue-v/uev-manage-administrative-backup-and-restore.md b/windows/configuration/ue-v/uev-manage-administrative-backup-and-restore.md
index d992db0cca..f75e604b5c 100644
--- a/windows/configuration/ue-v/uev-manage-administrative-backup-and-restore.md
+++ b/windows/configuration/ue-v/uev-manage-administrative-backup-and-restore.md
@@ -112,64 +112,22 @@ WMI and Windows PowerShell commands let you restore application and Windows sett
2. Enter the following Windows PowerShell cmdlet to restore the application settings and Windows settings.
-
-
-
-
-
-
-
-
Windows PowerShell cmdlet
-
Description
-
-
-
-
-
Restore-UevUserSetting -<TemplateID>
-
Restores the user settings for an application or restores a group of Windows settings.
-
-
-
-
-
-
+ |**Windows PowerShell cmdlet**|**Description**|
+ |--- |--- |
+ |`Restore-UevUserSetting -` |Restores the user settings for an application or restores a group of Windows settings.|
+
**To restore application settings and Windows settings with WMI**
1. Open a Windows PowerShell window.
2. Enter the following WMI command to restore application settings and Windows settings.
-
Restores the user settings for an application or restores a group of Windows settings.
-
-
-
-
-
-
-~~~
-**Note**
-UE-V does not provide a settings rollback for Windows apps.
-~~~
-
-
-
-
-
+ |**WMI command**|**Description**|
+ |--- |--- |
+ |`Invoke-WmiMethod -Namespace root\Microsoft\UEV -Class UserSettings -Name RestoreByTemplateId -ArgumentList `|Restores the user settings for an application or restores a group of Windows settings.|
+>[!NOTE]
+>UE-V does not provide a settings rollback for Windows apps.
## Related topics
diff --git a/windows/configuration/ue-v/uev-managing-settings-location-templates-using-windows-powershell-and-wmi.md b/windows/configuration/ue-v/uev-managing-settings-location-templates-using-windows-powershell-and-wmi.md
index 778370f194..ecf3a6472d 100644
--- a/windows/configuration/ue-v/uev-managing-settings-location-templates-using-windows-powershell-and-wmi.md
+++ b/windows/configuration/ue-v/uev-managing-settings-location-templates-using-windows-powershell-and-wmi.md
@@ -21,7 +21,8 @@ ms.topic: article
User Experience Virtualization (UE-V) uses XML settings location templates to define the settings that User Experience Virtualization captures and applies. UE-V includes a set of standard settings location templates. It also includes the UE-V template generator tool that enables you to create custom settings location templates. After you create and deploy settings location templates, you can manage those templates by using Windows PowerShell and the Windows Management Instrumentation (WMI).
-> **Note** For a complete list of UE-V cmdlets, see [User Experience Virtualization in Windows PowerShell](/powershell/module/uev/).
+> [!NOTE]
+> For a complete list of UE-V cmdlets, see [User Experience Virtualization in Windows PowerShell](/powershell/module/uev/).
## Manage UE-V settings location templates by using Windows PowerShell
@@ -29,139 +30,44 @@ The WMI and Windows PowerShell features of UE-V include the ability to enable, d
You must have administrator permissions to update, register, or unregister a settings location template. Administrator permissions are not required to enable, disable, or list templates.
-***To manage settings location templates by using Windows PowerShell***
+**To manage settings location templates by using Windows PowerShell**
1. Use an account with administrator rights to open a Windows PowerShell command prompt.
2. Use the following Windows PowerShell cmdlets to register and manage the UE-V settings location templates.
-
-
-
-
-
-
-
-
-
Windows PowerShell command
-
Description
-
-
-
-
-
Get-UevTemplate
-
Lists all the settings location templates that are registered on the computer.
-
-
-
Get-UevTemplate -Application <string>
-
Lists all the settings location templates that are registered on the computer where the application name or template name contains <string>.
-
-
-
Get-UevTemplate -TemplateID <string>
-
Lists all the settings location templates that are registered on the computer where the template ID contains <string>.
Lists all the settings location templates that are registered on the computer where the application or template name, or template ID contains <string>.
-
-
-
Get-UevTemplateProgram [-ID] <template ID>
-
Gets the name of the program and version information, which depend on the template ID.
-
-
-
Get-UevAppXPackage
-
Gets the effective list of Windows apps.
-
-
-
Get-UevAppXPackage -Computer
-
Gets the list of Windows apps that are configured for the computer.
-
-
-
Get-UevAppXPackage -CurrentComputerUser
-
Gets the list of Windows apps that are configured for the current user.
Registers one or more settings location template with UE-V by using relative paths and/or wildcard characters in file paths. After a template is registered, UE-V synchronizes the settings that are defined in the template between computers that have the template registered.
Registers one or more settings location template with UE-V by using literal paths, where no characters can be interpreted as wildcard characters. After a template is registered, UE-V synchronizes the settings that are defined in the template between computers that have the template registered.
-
-
-
Unregister-UevTemplate [-ID] <template ID>
-
Unregisters a settings location template with UE-V. When a template is unregistered, UE-V no longer synchronizes the settings that are defined in the template between computers.
-
-
-
Unregister-UevTemplate -All
-
Unregisters all settings location templates with UE-V. When a template is unregistered, UE-V no longer synchronizes the settings that are defined in the template between computers.
Updates one or more settings location templates with a more recent version of the template. Use relative paths and/or wildcard characters in the file paths. The new template should be a newer version than the existing template.
Updates one or more settings location templates with a more recent version of the template. Use full paths to template files, where no characters can be interpreted as wildcard characters. The new template should be a newer version than the existing template.
-
-
-
Clear-UevAppXPackage -Computer [-PackageFamilyName] <package family name>[,<package family name>]
-
Removes one or more Windows apps from the computer Windows app list.
-
-
-
Clear-UevAppXPackage -CurrentComputerUser
-
Removes Windows app from the current user Windows app list.
-
-
-
Clear-UevAppXPackage -Computer -All
-
Removes all Windows apps from the computer Windows app list.
-
-
-
Clear-UevAppXPackage [-CurrentComputerUser] [-PackageFamilyName] <package family name>[,<package family name>]
-
Removes one or more Windows apps from the current user Windows app list.
-
-
-
Clear-UevAppXPackage [-CurrentComputerUser] -All
-
Removes all Windows apps from the current user Windows app list.
-
-
-
Disable-UevTemplate [-ID] <template ID>
-
Disables a settings location template for the current user of the computer.
-
-
-
Disable-UevAppXPackage -Computer [-PackageFamilyName] <package family name>[,<package family name>]
-
Disables one or more Windows apps in the computer Windows app list.
-
-
-
Disable-UevAppXPackage [-CurrentComputerUser] [-PackageFamilyName] <package family name>[,<package family name>]
-
Disables one or more Windows apps in the current user Windows app list.
-
-
-
Enable-UevTemplate [-ID] <template ID>
-
Enables a settings location template for the current user of the computer.
-
-
-
Enable-UevAppXPackage -Computer [-PackageFamilyName] <package family name>[,<package family name>]
-
Enables one or more Windows apps in the computer Windows app list.
-
-
-
Enable-UevAppXPackage [-CurrentComputerUser] [-PackageFamilyName] <package family name>[,<package family name>]
-
Enables one or more Windows apps in the current user Windows app list.
Determines whether one or more settings location templates comply with its XML schema. The path must be a full path to the template file, but does not include wildcard characters.
-
-
-
-
-
-
+
+ |Windows PowerShell command|Description|
+ |--- |--- |
+ |`Get-UevTemplate`|Lists all the settings location templates that are registered on the computer.|
+ |`Get-UevTemplate -Application `|Lists all the settings location templates that are registered on the computer where the application name or template name contains.|
+ |`Get-UevTemplate -TemplateID `|Lists all the settings location templates that are registered on the computer where the template ID contains.|
+ |`Get-UevTemplate [-ApplicationOrTemplateID] `|Lists all the settings location templates that are registered on the computer where the application or template name, or template ID contains.|
+ |`Get-UevTemplateProgram [-ID] `|Gets the name of the program and version information, which depend on the template ID.|
+ |`Get-UevAppXPackage`|Gets the effective list of Windows apps.|
+ |`Get-UevAppXPackage -Computer`|Gets the list of Windows apps that are configured for the computer.|
+ |`Get-UevAppXPackage -CurrentComputerUser`|Gets the list of Windows apps that are configured for the current user.|
+ |`Register-UevTemplate [-Path] [,]`|Registers one or more settings location template with UE-V by using relative paths and/or wildcard characters in file paths. After a template is registered, UE-V synchronizes the settings that are defined in the template between computers that have the template registered.|
+ |`Register-UevTemplate -LiteralPath [,]`|Registers one or more settings location template with UE-V by using literal paths, where no characters can be interpreted as wildcard characters. After a template is registered, UE-V synchronizes the settings that are defined in the template between computers that have the template registered.|
+ |`Unregister-UevTemplate [-ID] `|Unregisters a settings location template with UE-V. When a template is unregistered, UE-V no longer synchronizes the settings that are defined in the template between computers.|
+ |`Unregister-UevTemplate -All`|Unregisters all settings location templates with UE-V. When a template is unregistered, UE-V no longer synchronizes the settings that are defined in the template between computers.|
+ |`Update-UevTemplate [-Path] [,]`|Updates one or more settings location templates with a more recent version of the template. Use relative paths and/or wildcard characters in the file paths. The new template should be a newer version than the existing template.|
+ |`Update-UevTemplate -LiteralPath [,]`|Updates one or more settings location templates with a more recent version of the template. Use full paths to template files, where no characters can be interpreted as wildcard characters. The new template should be a newer version than the existing template.|
+ |`Clear-UevAppXPackage -Computer [-PackageFamilyName] [,]`|Removes one or more Windows apps from the computer Windows app list.|
+ |`Clear-UevAppXPackage -CurrentComputerUser`|Removes Windows app from the current user Windows app list.|
+ |`Clear-UevAppXPackage -Computer -All`|Removes all Windows apps from the computer Windows app list.|
+ |`Clear-UevAppXPackage [-CurrentComputerUser] [-PackageFamilyName] [,]`|Removes one or more Windows apps from the current user Windows app list.|
+ |`Clear-UevAppXPackage [-CurrentComputerUser] -All`|Removes all Windows apps from the current user Windows app list.|
+ |`Disable-UevTemplate [-ID] `|Disables a settings location template for the current user of the computer.|
+ |`Disable-UevAppXPackage -Computer [-PackageFamilyName] [,]`|Disables one or more Windows apps in the computer Windows app list.|
+ |`Disable-UevAppXPackage [-CurrentComputerUser] [-PackageFamilyName] [,]`|Disables one or more Windows apps in the current user Windows app list.|
+ |`Enable-UevTemplate [-ID] `|Enables a settings location template for the current user of the computer.|
+ |`Enable-UevAppXPackage -Computer [-PackageFamilyName] [,]`|Enables one or more Windows apps in the computer Windows app list.|
+ |`Enable-UevAppXPackage [-CurrentComputerUser] [-PackageFamilyName] [,]`|Enables one or more Windows apps in the current user Windows app list.|
+ |`Test-UevTemplate [-Path] [,]`|Determines whether one or more settings location templates comply with its XML schema. Can use relative paths and wildcard characters.|
+ |`Test-UevTemplate -LiteralPath [,]`|Determines whether one or more settings location templates comply with its XML schema. The path must be a full path to the template file, but does not include wildcard characters.|
+
The UE-V Windows PowerShell features enable you to manage a group of settings templates that are deployed in your enterprise. Use the following procedure to manage a group of templates by using Windows PowerShell.
-
+
**To manage a group of settings location templates by using Windows PowerShell**
1. Modify or update the desired settings location templates.
@@ -248,95 +154,28 @@ User Experience Virtualization provides the following set of WMI commands. Admin
2. Use the following WMI commands to register and manage the UE-V settings location templates.
-
Unregisters a settings location template with UE-V. As soon as a template is unregistered, UE-V no longer synchronizes the settings that are defined in the template between computers.
Updates a settings location template with UE-V. The new template should be a newer version than the existing one.
-
-
-
Invoke-WmiMethod -Namespace root\Microsoft\UEV -Class MachineConfiguredWindows8App -Name RemoveApp -ArgumentList <package family name | package family name>
-
Removes one or more Windows apps from the computer Windows app list.
-
-
-
Invoke-WmiMethod -Namespace root\Microsoft\UEV -Class UserConfiguredWindows8App -Name RemoveApp -ArgumentList <package family name | package family name>
-
Removes one or more Windows apps from the current user Windows app list.
Disables one or more settings location templates with UE-V.
-
-
-
Invoke-WmiMethod -Namespace root\Microsoft\UEV -Class MachineConfiguredWindows8App -Name DisableApp -ArgumentList <package family name | package family name>
-
Disables one or more Windows apps in the computer Windows app list.
-
-
-
Invoke-WmiMethod -Namespace root\Microsoft\UEV -Class UserConfiguredWindows8App -Name DisableApp -ArgumentList <package family name | package family name>
-
Disables one or more Windows apps in the current user Windows app list.
Invoke-WmiMethod -Namespace root\Microsoft\UEV -Class MachineConfiguredWindows8App -Name EnableApp -ArgumentList <package family name | package family name>
-
Enables Windows apps in the computer Windows app list.
-
-
-
Invoke-WmiMethod -Namespace root\Microsoft\UEV -Class UserConfiguredWindows8App -Name EnableApp -ArgumentList <package family name | package family name>
-
Enables Windows apps in the current user Windows app list.
Determines whether a given settings location template complies with its XML schema.
-
-
-
-
-**Note**
-Where a list of Package Family Names is called by the WMI command, the list must be in quotes and separated by a pipe symbol, for example, `""`.
-
-
-
+ |`Windows PowerShell command`|Description|
+ |--- |--- |
+ |`Get-WmiObject -Namespace root\Microsoft\UEV SettingsLocationTemplate Select-Object TemplateId,TemplateName, TemplateVersion,Enabled Format-Table -Autosize`|Lists all the settings location templates that are registered for the computer.|
+ |`Invoke-WmiMethod -Namespace root\Microsoft\UEV -Class SettingsLocationTemplate -Name GetProcessInfoByTemplateId `|Gets the name of the program and version information, which depends on the template name.|
+ |`Get-WmiObject -Namespace root\Microsoft\UEV EffectiveWindows8App`|Gets the effective list of Windows apps.|
+ |`Get-WmiObject -Namespace root\Microsoft\UEV MachineConfiguredWindows8App`|Gets the list of Windows apps that are configured for the computer.|
+ |`Get-WmiObject -Namespace root\Microsoft\UEV UserConfiguredWindows8App`|Gets the list of Windows apps that are configured for the current user.|
+ |`Invoke-WmiMethod -Namespace root\Microsoft\UEV -Class SettingsLocationTemplate -Name Register -ArgumentList `|Registers a settings location template with UE-V.|
+ |`Invoke-WmiMethod -Namespace root\Microsoft\UEV -Class SettingsLocationTemplate -Name UnregisterByTemplateId -ArgumentList `|Unregisters a settings location template with UE-V. As soon as a template is unregistered, UE-V no longer synchronizes the settings that are defined in the template between computers.|
+ |`Invoke-WmiMethod -Namespace root\Microsoft\UEV -Class SettingsLocationTemplate -Name Update -ArgumentList `|Updates a settings location template with UE-V. The new template should be a newer version than the existing one.|
+ |`Invoke-WmiMethod -Namespace root\Microsoft\UEV -Class MachineConfiguredWindows8App -Name RemoveApp -ArgumentList `|Removes one or more Windows apps from the computer Windows app list.|
+ |`Invoke-WmiMethod -Namespace root\Microsoft\UEV -Class UserConfiguredWindows8App -Name RemoveApp -ArgumentList `|Removes one or more Windows apps from the current user Windows app list.|
+ |`Invoke-WmiMethod -Namespace root\Microsoft\UEV -Class SettingsLocationTemplate -Name DisableByTemplateId -ArgumentList `|Disables one or more settings location templates with UE-V.|
+ |`Invoke-WmiMethod -Namespace root\Microsoft\UEV -Class MachineConfiguredWindows8App -Name DisableApp -ArgumentList `|Disables one or more Windows apps in the computer Windows app list.|
+ |`Invoke-WmiMethod -Namespace root\Microsoft\UEV -Class UserConfiguredWindows8App -Name DisableApp -ArgumentList `|Disables one or more Windows apps in the current user Windows app list.|
+ |`Invoke-WmiMethod -Namespace root\Microsoft\UEV -Class SettingsLocationTemplate -Name EnableByTemplateId -ArgumentList `|Enables a settings location template with UE-V.|
+ |`Invoke-WmiMethod -Namespace root\Microsoft\UEV -Class MachineConfiguredWindows8App -Name EnableApp -ArgumentList `|Enables Windows apps in the computer Windows app list.|
+ |`Invoke-WmiMethod -Namespace root\Microsoft\UEV -Class UserConfiguredWindows8App -Name EnableApp -ArgumentList `|Enables Windows apps in the current user Windows app list.|
+ |`Invoke-WmiMethod -Namespace root\Microsoft\UEV -Class SettingsLocationTemplate -Name Validate -ArgumentList `|Determines whether a given settings location template complies with its XML schema.|
+> [!NOTE]
+> Where a list of Package Family Names is called by the WMI command, the list must be in quotes and separated by a pipe symbol, for example, `""`.
## Related topics
@@ -344,4 +183,4 @@ Where a list of Package Family Names is called by the WMI command, the list must
[Administering UE-V](uev-administering-uev.md)
-[User Experience Virtualization in Windows PowerShell](/powershell/module/uev/)
\ No newline at end of file
+[User Experience Virtualization in Windows PowerShell](/powershell/module/uev/)
diff --git a/windows/configuration/ue-v/uev-managing-uev-agent-and-packages-with-windows-powershell-and-wmi.md b/windows/configuration/ue-v/uev-managing-uev-agent-and-packages-with-windows-powershell-and-wmi.md
index 6d3b2e88dd..e951c019fc 100644
--- a/windows/configuration/ue-v/uev-managing-uev-agent-and-packages-with-windows-powershell-and-wmi.md
+++ b/windows/configuration/ue-v/uev-managing-uev-agent-and-packages-with-windows-powershell-and-wmi.md
@@ -30,165 +30,41 @@ You can use Windows Management Instrumentation (WMI) and Windows PowerShell to m
2. Use the following Windows PowerShell commands to configure the service.
-
-
-
-
-
-
-
-
Windows PowerShell command
-
Description
-
-
-
-
-
Enable-UEV
-
-
Turns on the UE-V service. Requires reboot.
-
-
-
Disable-UEV
-
Turns off the UE-V service. Requires reboot.
-
-
-
Get-UevStatus
-
Displays whether UE-V service is enabled or disabled, using a Boolean value.
-
-
-
Get-UevConfiguration
-
-
Gets the effective UE-V service settings. User-specific settings have precedence over the computer settings.
-
-
-
Get-UevConfiguration -CurrentComputerUser
-
-
Gets the UE-V service settings values for the current user only.
-
-
-
Get-UevConfiguration -Computer
-
Gets the UE-V service configuration settings values for all users on the computer.
-
-
-
Get-UevConfiguration -Details
-
Gets the details for each configuration setting. Displays where the setting is configured or if it uses the default value. Is displayed if the current setting is valid.
Use the DisableSyncUnlistedWindows8Apps parameter to configure the UE-V service to synchronize only Windows apps that are explicitly enabled by the Windows App List.
Use the DisableSyncUnlistedWindows8Apps parameter to configure the UE-V service to synchronize only Windows apps that are explicitly enabled by the Windows App List.
-
-
-
Set-UevConfiguration -Computer -DisableSync
-
Disables UE-V for all the users on the computer.
-
Use the EnableSync parameter to enable or re-enable.
Disables UE-V for the current user on the computer.
-
Use the EnableSync parameter to enable or re-enable.
-
-
-
Set-UevConfiguration -Computer -EnableTrayIcon
-
Enables the UE-V icon in the notification area for all users of the computer.
-
Use the DisableTrayIcon parameter to disable the icon.
-
-
-
Set-UevConfiguration -Computer -MaxPackageSizeInBytes <size in bytes>
-
Configures the UE-V service to report when a settings package file size reaches the defined threshold for all users on the computer. Sets the threshold package size in bytes.
-
-
-
Set-UevConfiguration -CurrentComputerUser -MaxPackageSizeInBytes <size in bytes>
-
Configures the UE-V service to report when a settings package file size reaches the defined threshold. Sets the package size warning threshold for the current user.
Clears the specified setting for the current user only.
-
-
-
Export-UevConfiguration <settings migration file>
-
Exports the UE-V computer configuration to a settings migration file. The file name extension must be .uev.
-
The Export cmdlet exports all UE-V service settings that are configurable with the Computer parameter.
-
-
-
Import-UevConfiguration <settings migration file>
-
Imports the UE-V computer configuration from a settings migration file. The file name extension must be .uev.
-
-
-
-
-
+ |Windows PowerShell command|Description|
+ |--- |--- |
+ |`Enable-UEV`|Turns on the UE-V service. Requires reboot.|
+ |`Disable-UEV`|Turns off the UE-V service. Requires reboot.|
+ |`Get-UevStatus`|Displays whether UE-V service is enabled or disabled, using a Boolean value.|
+ |`Get-UevConfiguration`|Gets the effective UE-V service settings. User-specific settings have precedence over the computer settings.|
+ |`Get-UevConfiguration -CurrentComputerUser`|Gets the UE-V service settings values for the current user only.|
+ |`Get-UevConfiguration -Computer`|Gets the UE-V service configuration settings values for all users on the computer.|
+ |`Get-UevConfiguration -Details`|Gets the details for each configuration setting. Displays where the setting is configured or if it uses the default value. Is displayed if the current setting is valid.|
+ |`Set-UevConfiguration -Computer -EnableDontSyncWindows8AppSettings`|Configures the UE-V service to not synchronize any Windows apps for all users on the computer.|
+ |`Set-UevConfiguration -CurrentComputerUser -EnableDontSyncWindows8AppSettings`|Configures the UE-V service to not synchronize any Windows apps for the current computer user.|
+ |`Set-UevConfiguration -Computer -EnableFirstUseNotification`|Configures the UE-V service to display notification the first time the service runs for all users on the computer.|
+ |`Set-UevConfiguration -Computer -DisableFirstUseNotification`|Configures the UE-V service to not display notification the first time that the service runs for all users on the computer.|
+ |`Set-UevConfiguration -Computer -EnableSettingsImportNotify`|Configures the UE-V service to notify all users on the computer when settings synchronization is delayed.
Use the DisableSettingsImportNotify parameter to disable notification.|
+ |`Set-UevConfiguration -CurrentComputerUser -EnableSettingsImportNotify`|Configures the UE-V service to notify the current user when settings synchronization is delayed.
Use the DisableSettingsImportNotify parameter to disable notification.|
+ |`Set-UevConfiguration -Computer -EnableSyncUnlistedWindows8Apps`|Configures the UE-V service to synchronize all Windows apps that are not explicitly disabled by the Windows app list for all users of the computer. For more information, see "Get-UevAppxPackage" in [Managing UE-V Settings Location Templates Using Windows PowerShell and WMI](uev-managing-settings-location-templates-using-windows-powershell-and-wmi.md).
Use the DisableSyncUnlistedWindows8Apps parameter to configure the UE-V service to synchronize only Windows apps that are explicitly enabled by the Windows App List.|
+ |`Set-UevConfiguration -CurrentComputerUser - EnableSyncUnlistedWindows8Apps`|Configures the UE-V service to synchronize all Windows apps that are not explicitly disabled by the Windows app list for the current user on the computer. For more information, see "Get-UevAppxPackage" in [Managing UE-V Settings Location Templates Using Windows PowerShell and WMI](uev-managing-settings-location-templates-using-windows-powershell-and-wmi.md).
Use the DisableSyncUnlistedWindows8Apps parameter to configure the UE-V service to synchronize only Windows apps that are explicitly enabled by the Windows App List.|
+ |`Set-UevConfiguration -Computer -DisableSync`|Disables UE-V for all the users on the computer.
Use the EnableSync parameter to enable or re-enable.|
+ |`Set-UevConfiguration -CurrentComputerUser -DisableSync`|Disables UE-V for the current user on the computer.
Use the EnableSync parameter to enable or re-enable.|
+ |`Set-UevConfiguration -Computer -EnableTrayIcon`|Enables the UE-V icon in the notification area for all users of the computer.
Use the DisableTrayIcon parameter to disable the icon.|
+ |`Set-UevConfiguration -Computer -MaxPackageSizeInBytes `|Configures the UE-V service to report when a settings package file size reaches the defined threshold for all users on the computer. Sets the threshold package size in bytes.|
+ |`Set-UevConfiguration -CurrentComputerUser -MaxPackageSizeInBytes `|Configures the UE-V service to report when a settings package file size reaches the defined threshold. Sets the package size warning threshold for the current user.|
+ |`Set-UevConfiguration -Computer -SettingsImportNotifyDelayInSeconds`|Specifies the time in seconds before the user is notified for all users of the computer|
+ |`Set-UevConfiguration -CurrentComputerUser -SettingsImportNotifyDelayInSeconds`|Specifies the time in seconds before notification for the current user is sent.|
+ |`Set-UevConfiguration -Computer -SettingsStoragePath `|Defines a per-computer settings storage location for all users of the computer.|
+ |`Set-UevConfiguration -CurrentComputerUser -SettingsStoragePath `|Defines a per-user settings storage location.|
+ |`Set-UevConfiguration -Computer -SettingsTemplateCatalogPath `|Sets the settings template catalog path for all users of the computer.|
+ |`Set-UevConfiguration -Computer -SyncMethod `|Sets the synchronization method for all users of the computer: SyncProvider or None.|
+ |`Set-UevConfiguration -CurrentComputerUser -SyncMethod `|Sets the synchronization method for the current user: SyncProvider or None.|
+ |`Set-UevConfiguration -Computer -SyncTimeoutInMilliseconds `|Sets the synchronization time-out in milliseconds for all users of the computer|
+ |`Set-UevConfiguration -CurrentComputerUser -SyncTimeoutInMilliseconds `|Set the synchronization time-out for the current user.|
+ |`Clear-UevConfiguration -Computer -`|Clears the specified setting for all users on the computer.|
+ |`Clear-UevConfiguration -CurrentComputerUser -`|Clears the specified setting for the current user only.|
+ |`Export-UevConfiguration `|Exports the UE-V computer configuration to a settings migration file. The file name extension must be .uev.
The `Export` cmdlet exports all UE-V service settings that are configurable with the Computer parameter.|
+ |`Import-UevConfiguration `|Imports the UE-V computer configuration from a settings migration file. The file name extension must be .uev.|
## To export UE-V package settings and repair UE-V templates with Windows PowerShell
@@ -196,26 +72,10 @@ You can use Windows Management Instrumentation (WMI) and Windows PowerShell to m
2. Use the following Windows PowerShell commands to configure the service.
-
-
-
-
-
-
-
-
Windows PowerShell command
-
Description
-
-
-
Export-UevPackage MicrosoftNotepad.pkgx
-
Extracts the settings from a Microsoft Notepad package file and converts them into a human-readable format in XML.
-
-
-
Repair-UevTemplateIndex
-
Repairs the index of the UE-V settings location templates.
-
-
-
+ |Windows PowerShell command|Description|
+ |--- |--- |
+ |`Export-UevPackage MicrosoftNotepad.pkgx`|Extracts the settings from a Microsoft Notepad package file and converts them into a human-readable format in XML.|
+ |`Repair-UevTemplateIndex`|Repairs the index of the UE-V settings location templates.|
## To configure the UE-V service with WMI
@@ -225,91 +85,21 @@ You can use Windows Management Instrumentation (WMI) and Windows PowerShell to m
2. Use the following WMI commands to configure the service.
-
Configures the UE-V service to report when a settings package file size reaches a defined threshold. Set the threshold package file size in bytes for all users of the computer.
Updates a specific per-user setting for all users of the computer. To clear the setting, use $null as the setting value.
-
-
-
+ |`Windows PowerShell command`|Description|
+ |--- |--- |
+ |`Get-WmiObject -Namespace root\Microsoft\UEV Configuration`|Displays the active UE-V service settings. User-specific settings have precedence over the computer settings.|
+ |`Get-WmiObject -Namespace root\Microsoft\UEV UserConfiguration`|Displays the UE-V service configuration that is defined for a user.|
+ |`Get-WmiObject -Namespace root\Microsoft\UEV ComputerConfiguration`|Displays the UE-V service configuration that is defined for a computer.|
+ |`Get-WmiObject -Namespace root\Microsoft\Uev ConfigurationItem`|Displays the details for each configuration item.|
+ |`$config = Get-WmiObject -Namespace root\Microsoft\UEV ComputerConfiguration`
`$config.Put()`|Sets the synchronization time-out in milliseconds for all users of the computer.|
+ |`$config = Get-WmiObject -Namespace root\Microsoft\UEV ComputerConfiguration`
`$config.MaxPackageSizeInBytes = `
`$config.Put()`|Configures the UE-V service to report when a settings package file size reaches a defined threshold. Set the threshold package file size in bytes for all users of the computer.|
+ |`$config = Get-WmiObject -Namespace root\Microsoft\UEV ComputerConfiguration`
`$config.SyncMethod = `
`$config.Put()`|Sets the synchronization method for all users of the computer: SyncProvider or None.|
+ |`$config = Get-WmiObject -Namespace root\Microsoft\UEV ComputerConfiguration`
`$config. = $true`
`$config.Put()`|To enable a specific per-computer setting, clear the setting, and use $null as the setting value. Use UserConfiguration for per-user settings.|
+ |`$config = Get-WmiObject -Namespace root\Microsoft\UEV ComputerConfiguration`
`$config. = $false`
`$config.Put()`|To disable a specific per-computer setting, clear the setting, and use $null as the setting value. Use User Configuration for per-user settings.|
+ |`$config = Get-WmiObject -Namespace root\Microsoft\UEV ComputerConfiguration`
`$config. = `
`$config.Put()`|Updates a specific per-computer setting. To clear the setting, use $null as the setting value.|
+ |`$config = Get-WmiObject -Namespace root\Microsoft\UEV ComputerConfiguration`
`$config. = `
`$config.Put()`|Updates a specific per-user setting for all users of the computer. To clear the setting, use $null as the setting value.|
When you are finished configuring the UE-V service with WMI and Windows PowerShell, the defined configuration is stored in the registry in the following locations.
@@ -323,33 +113,10 @@ When you are finished configuring the UE-V service with WMI and Windows PowerShe
2. Use the following WMI commands.
-
Repairs the index of the UE-V settings location templates. Must be run as administrator.
-
-
-
-
-
-
-
-
+ |WMI command|Description|
+ |--- |--- |
+ |`Invoke-WmiMethod -Namespace root\Microsoft\UEV -Class UserSettings -Name ExportPackage -ArgumentList `|Extracts the settings from a package file and converts them into a human-readable format in XML.|
+ |`Invoke-WmiMethod -Namespace root\Microsoft\UEV -Class SettingsLocationTemplate -Name RebuildIndex`|Repairs the index of the UE-V settings location templates. Must be run as administrator.|
## Related topics
diff --git a/windows/configuration/ue-v/uev-prepare-for-deployment.md b/windows/configuration/ue-v/uev-prepare-for-deployment.md
index 08853f5b22..31455009a3 100644
--- a/windows/configuration/ue-v/uev-prepare-for-deployment.md
+++ b/windows/configuration/ue-v/uev-prepare-for-deployment.md
@@ -22,7 +22,7 @@ Before you deploy User Experience Virtualization (UE-V), review this topic for i
## Plan your UE-V deployment
-With UE-V, you can synchronize user-defined application and operating system settings across all the devices that a user works from. Use UE-V to synchronize settings for Windows applications and custom applications, such as third-party and line of business applications.
+With UE-V, you can synchronize user-defined application and operating system settings across all the devices that a user works from. Use UE-V to synchronize settings for Windows applications and custom applications, such as third-party and line-of-business applications.
Whether you want to synchronize settings for only default Windows applications or for both Windows and custom applications, you’ll need to first deploy the features required to use UE-V.
@@ -44,7 +44,7 @@ If you want to use UE-V to synchronize user-defined settings for custom applicat
The workflow diagram below illustrates a typical UE-V deployment and the decisions you need to be prepared to make.
-
+:::image type="content" alt-text="UE-V deployment preparation." source="images/uev-deployment-preparation.png":::
@@ -311,7 +315,7 @@ The UE-V settings storage location and settings template catalog support storing
- [Information about roaming profiles from the Directory Services team](https://blogs.technet.microsoft.com/askds/tag/roaming-profiles/)
- - [Information about Microsoft support policy for a DFS-R and DFS-N deployment scenario](https://support.microsoft.com/kb/2533009)
+ - [Information about Microsoft support policy for a DFS-R and DFS-N deployment scenario](/troubleshoot/windows-server/networking/support-policy-for-dfsr-dfsn-deployment)
In addition, because SYSVOL uses DFSR for replication, SYSVOL cannot be used for UE-V data file replication.
@@ -329,16 +333,16 @@ Computers that run the UE-V service must use a time server to maintain a consist
Before you proceed, ensure that your environment meets these requirements for using UE-V.
-| **Operating system** | **Edition** | **Service pack** | **System architecture** | **Windows PowerShell** | **Microsoft .NET Framework** |
+| Operating system | Edition | Service pack | System architecture | Windows PowerShell | Microsoft .NET Framework |
|--------------------------|---------------|------------------|-------------------------|--------------------------|--------------------------------|
| Windows 10, version 1607 | Windows 10 for Enterprise | NA | 32-bit or 64-bit | Windows PowerShell 3.0 or higher | .NET Framework 4.5 or higher |
| Windows 8 and Windows 8.1 | Enterprise or Pro | None | 32-bit or 64-bit | Windows PowerShell 3.0 or higher | .NET Framework 4.5 or higher |
| Windows Server 2012 and Windows Server 2012 R2 | Standard or Datacenter | None | 64-bit | Windows PowerShell 3.0 or higher | .NET Framework 4.5 or higher |
-**Note**
-- Windows Server 2012 operating systems come with .NET Framework 4.5 installed. The Windows 10 operating system comes with .NET Framework 4.6 installed.
-
-- The “Delete Roaming Cache” policy for mandatory profiles is not supported with UE-V and should not be used.
+> [!NOTE]
+> - Windows Server 2012 operating systems come with .NET Framework 4.5 installed. The Windows 10 operating system comes with .NET Framework 4.6 installed.
+>
+> - The “Delete Roaming Cache” policy for mandatory profiles is not supported with UE-V and should not be used.
There are no special random access memory (RAM) requirements specific to UE-V.
@@ -368,19 +372,19 @@ Enable this configuration using one of these methods:
Restart the device to allow the settings to synchronize.
-- >**Note**
- These methods do not work for pooled virtual desktop infrastructure (VDI) environments.
+> [!NOTE]
+> These methods do not work for pooled virtual desktop infrastructure (VDI) environments.
->**Note**
-If you set *SyncMethod = None*, any settings changes are saved directly to the server. If the network connection to the settings storage path is not found, then the settings changes are cached on the device and are synchronized the next time that the sync provider runs. If the settings storage path is not found and the user profile is removed from a pooled VDI environment on log off, settings changes are lost and the user must reapply the change when the computer is reconnected to the settings storage path.
+> [!NOTE]
+> If you set *SyncMethod = None*, any settings changes are saved directly to the server. If the network connection to the settings storage path is not found, then the settings changes are cached on the device and are synchronized the next time that the sync provider runs. If the settings storage path is not found and the user profile is removed from a pooled VDI environment on log off, settings changes are lost and the user must reapply the change when the computer is reconnected to the settings storage path.
**Synchronization for external sync engines** The *SyncMethod=External* parameter specifies that if UE-V settings are written to a local folder on the user device, then any external sync engine (such as OneDrive for Business, Work Folders, Sharepoint, or Dropbox) can be used to apply these settings to the different devices that users access.
**Support for shared VDI sessions** UE-V supports VDI sessions that are shared among end users. You can register and configure a special VDI template, which ensures that UE-V keeps all of its functionality intact for non-persistent VDI sessions.
->**Note**
-If you do not enable VDI mode for non-persistent VDI sessions, certain features do not work, such as [back-up/restore and last known good (LKG)](uev-manage-administrative-backup-and-restore.md).
+> [!NOTE]
+> If you do not enable VDI mode for non-persistent VDI sessions, certain features do not work, such as [back-up/restore and last known good (LKG)](uev-manage-administrative-backup-and-restore.md).
The VDI template is provided with UE-V and is typically available here after installation: C:\ProgramData\Microsoft\UEV\InboxTemplates
diff --git a/windows/configuration/ue-v/uev-release-notes-1607.md b/windows/configuration/ue-v/uev-release-notes-1607.md
index 91fb17d0de..e648b9ed6b 100644
--- a/windows/configuration/ue-v/uev-release-notes-1607.md
+++ b/windows/configuration/ue-v/uev-release-notes-1607.md
@@ -28,12 +28,12 @@ With the release of Windows 10, version 1607, the Company Settings Center was re
Administrators can still define which user-customized application settings can synchronize (roam) with Group Policy or Windows PowerShell.
-**Note** With the removal of the Company Settings Center, the following group policies are no longer applicable:
-
-- Contact IT Link Text
-- Contact IT URL
-- Tray Icon
-
+> [!NOTE]
+> With the removal of the Company Settings Center, the following group policies are no longer applicable:
+>
+> - Contact IT Link Text
+> - Contact IT URL
+> - Tray Icon
### Upgrading from UE-V 1.0 to the in-box version of UE-V is blocked
@@ -99,31 +99,11 @@ Operating system settings for Narrator and currency characters specific to the l
WORKAROUND: None
-## Hotfixes and Knowledge Base articles for UE-V
-
-This section contains hotfixes and KB articles for UE-V.
-
-| KB Article | Title | Link |
-|------------|---------|--------|
-| 3018608 | UE-V - TemplateConsole.exe crashes when UE-V WMI classes are missing | [support.microsoft.com/kb/3018608](https://support.microsoft.com/kb/3018608) |
-| 2903501 | UE-V: User Experience Virtualization (UE-V) compatibility with user profiles | [support.microsoft.com/kb/2903501](https://support.microsoft.com/kb/2903501) |
-| 2770042 | UE-V Registry Settings | [support.microsoft.com/kb/2770042](https://support.microsoft.com/kb/2770042) |
-| 2847017 | Internet Explorer settings replicated by UE-V | [support.microsoft.com/kb/2847017](https://support.microsoft.com/kb/2847017) |
-| 2769631 | How to repair a corrupted UE-V install | [support.microsoft.com/kb/2769631](https://support.microsoft.com/kb/2769631) |
-| 2850989 | Migrating MAPI profiles with Microsoft UE-V is not supported | [support.microsoft.com/kb/2850989](https://support.microsoft.com/kb/2850989) |
-| 2769586 | UE-V roams empty folders and registry keys | [support.microsoft.com/kb/2769586](https://support.microsoft.com/kb/2769586) |
-| 2782997 | How To Enable Debug Logging in Microsoft User Experience Virtualization (UE-V) | [support.microsoft.com/kb/2782997](https://support.microsoft.com/kb/2782997) |
-| 2769570 | UE-V does not update the theme on RDS or VDI sessions | [support.microsoft.com/kb/2769570](https://support.microsoft.com/kb/2769570) |
-| 2850582 | How To Use Microsoft User Experience Virtualization With App-V Applications | [support.microsoft.com/kb/2850582](https://support.microsoft.com/kb/2850582) |
-| 3041879 | Current file versions for Microsoft User Experience Virtualization | [support.microsoft.com/kb/3041879](https://support.microsoft.com/kb/3041879) |
-| 2843592 | Information on User Experience Virtualization and High Availability | [support.microsoft.com/kb/2843592](https://support.microsoft.com/kb/2843592) |
-
-
-
-
-
**Additional resources for this feature**
+- [UE-V Registry Settings](/troubleshoot/windows-client/ue-v/ue-v-registry-settings)
+
+- [How To Enable Debug Logging in Microsoft User Experience Virtualization (UE-V)](/troubleshoot/windows-client/ue-v/enable-debug-logging)
- [User Experience Virtualization](uev-for-windows.md)
diff --git a/windows/configuration/ue-v/uev-security-considerations.md b/windows/configuration/ue-v/uev-security-considerations.md
index 1548071462..ffc6829922 100644
--- a/windows/configuration/ue-v/uev-security-considerations.md
+++ b/windows/configuration/ue-v/uev-security-considerations.md
@@ -24,8 +24,8 @@ This topic contains a brief overview of accounts and groups, log files, and othe
## Security considerations for UE-V configuration
-**Important**
-When you create the settings storage share, limit the share access to users who require access.
+> [!IMPORTANT]
+> When you create the settings storage share, limit the share access to users who require access.
Because settings packages might contain personal information, you should take care to protect them as well as possible. In general, do the following:
@@ -37,137 +37,36 @@ Because settings packages might contain personal information, you should take ca
1. Set the following share-level SMB permissions for the setting storage location folder.
-
-
-
-
-
-
-
-
User account
-
Recommended permissions
-
-
-
-
-
Everyone
-
No permissions
-
-
-
Security group of UE-V
-
Full control
-
-
-
-
+ |User account|Recommended permissions|
+ |--- |--- |
+ |Everyone|No permissions|
+ |Security group of UE-V|Full control|
2. Set the following NTFS file system permissions for the settings storage location folder.
-
-
-
-
-
-
-
-
-
User account
-
Recommended permissions
-
Folder
-
-
-
-
-
Creator/Owner
-
No permissions
-
No permissions
-
-
-
Domain Admins
-
Full control
-
This folder, subfolders, and files
-
-
-
Security group of UE-V users
-
List folder/read data, create folders/append data
-
This folder only
-
-
-
Everyone
-
Remove all permissions
-
No permissions
-
-
-
+ |User account|Recommended permissions|Folder|
+ |--- |--- |--- |
+ |Creator/Owner|No permissions|No permissions|
+ |Domain Admins|Full control|This folder, subfolders, and files|
+ |Security group of UE-V users|List folder/read data, create folders/append data|This folder only|
+ |Everyone|Remove all permissions|No permissions|
3. Set the following share-level SMB permissions for the settings template catalog folder.
-
-
-
-
-
-
-
-
User account
-
Recommend permissions
-
-
-
-
-
Everyone
-
No permissions
-
-
-
Domain computers
-
Read permission Levels
-
-
-
Administrators
-
Read/write permission levels
-
-
-
-
+ |User account|Recommend permissions|
+ |--- |--- |
+ |Everyone|No permissions|
+ |Domain computers|Read permission Levels|
+ |Administrators|Read/write permission levels|
4. Set the following NTFS permissions for the settings template catalog folder.
-
-
-
-
-
-
-
-
-
User account
-
Recommended permissions
-
Apply to
-
-
-
-
-
Creator/Owner
-
Full control
-
This folder, subfolders, and files
-
-
-
Domain Computers
-
List folder contents and Read permissions
-
This folder, subfolders, and files
-
-
-
Everyone
-
No permissions
-
No permissions
-
-
-
Administrators
-
Full Control
-
This folder, subfolders, and files
-
-
-
+ |User account|Recommended permissions|Apply to|
+ |--- |--- |--- |
+ |Creator/Owner|Full control|This folder, sub-folders, and files|
+ |Domain Computers|List folder contents and Read permissions|This folder, sub-folders, and files|
+ |Everyone|No permissions|No permissions|
+ |Administrators|Full Control|This folder, sub-folders, and files|
### Use Windows Server as of Windows Server 2003 to host redirected file shares
@@ -205,7 +104,8 @@ To ensure that UE-V works optimally, create only the root share on the server, a
This permission configuration enables users to create folders for settings storage. The UE-V service creates and secures a settings package folder while it runs in the context of the user. Users receive full control to their settings package folder. Other users do not inherit access to this folder. You do not have to create and secure individual user directories. The UE-V service that runs in the context of the user does it automatically.
-> **Note** Additional security can be configured when a Windows Server is used for the settings storage share. UE-V can be configured to verify that either the local Administrators group or the current user is the owner of the folder where settings packages are stored. To enable additional security, use the following command:
+> [!NOTE]
+> Additional security can be configured when a Windows Server is used for the settings storage share. UE-V can be configured to verify that either the local Administrators group or the current user is the owner of the folder where settings packages are stored. To enable additional security, use the following command:
1. Add the REG\_DWORD registry key RepositoryOwnerCheckEnabled to `HKEY_LOCAL_MACHINE\Software\Microsoft\UEV\Agent\Configuration`.
@@ -234,11 +134,6 @@ If you plan to share settings location templates with anyone outside your organi
To remove the template author name or template author email, you can use the UE-V generator application. From the generator, select **Edit a Settings Location Template**. Select the settings location template to edit from the recently used templates or Browse to the settings template file. Select **Next** to continue. On the Properties page, remove the data from the Template author name or Template author email text fields. Save the settings location template.
-
-
-
-
-
## Related topics
[Technical Reference for UE-V](uev-technical-reference.md)
diff --git a/windows/configuration/ue-v/uev-sync-trigger-events.md b/windows/configuration/ue-v/uev-sync-trigger-events.md
index 1c4975fe78..d9006a04ab 100644
--- a/windows/configuration/ue-v/uev-sync-trigger-events.md
+++ b/windows/configuration/ue-v/uev-sync-trigger-events.md
@@ -22,96 +22,18 @@ User Experience Virtualization (UE-V) lets you synchronize your application and
## UE-V Sync Trigger Events
-
The following table explains the trigger events for classic applications and Windows settings.
-
-
-
-
-
-
-
-
-
UE-V Trigger Event
-
SyncMethod=SyncProvider
-
SyncMethod=None
-
-
-
Windows Logon
-
-
Application and Windows settings are imported to the local cache from the settings storage location.
Synchronous Windows settings will be applied during the next Windows logon.
-
Application settings will be applied when the application starts.
-
-
-
Application and Windows settings are read directly from the settings storage location.
-
Asynchronous and synchronous Windows settings are applied.
-
Application settings will be applied when the application starts.
-
-
-
-
Windows Logoff
-
Store changes locally and cache and copy asynchronous and synchronous Windows settings to the settings storage location server, if available
-
Store changes to asynchronous and synchronous Windows settings storage location
-
-
-
Windows Connect (RDP) / Unlock
-
Synchronize any asynchronous Windows settings from settings storage location to local cache, if available.
-
Apply cached Windows settings
-
Download and apply asynchronous windows settings from settings storage location
-
-
-
Windows Disconnect (RDP) / Lock
-
Store asynchronous Windows settings changes to the local cache.
-
Synchronize any asynchronous Windows settings from the local cache to settings storage location, if available
-
Store asynchronous Windows settings changes to the settings storage location
-
-
-
Application start
-
Apply application settings from local cache as the application starts
-
Apply application settings from settings storage location as the application starts
-
-
-
Application closes
-
Store any application settings changes to the local cache and copy settings to settings storage location, if available
-
Store any application settings changes to settings storage location
-
-
-
Sync Controller Scheduled Task
-
-
Application and Windows settings are synchronized between the settings storage location and the local cache.
-
-Note
Settings changes are not cached locally until an application closes. This trigger will not export changes made to a currently running application.
-
For Windows settings, this means that any changes will not be cached locally and exported until the next Lock (Asynchronous) or Logoff (Asynchronous and Synchronous).
-
-
-
-
-
Settings are applied in these cases:
-
-
Asynchronous Windows settings are applied directly.
-
Application settings are applied when the application starts.
-
Both asynchronous and synchronous Windows settings are applied during the next Windows logon.
-
Windows app (AppX) settings are applied during the next refresh. See Monitor Application Settings for more information.
-
-
NA
-
-
-
Asynchronous Settings updated on remote store*
-
Load and apply new asynchronous settings from the cache.
Application and Windows settings are imported to the local cache from the settings storage location.
[Asynchronous Windows settings](uev-prepare-for-deployment.md#windows-settings-synchronized-by-default) are applied.
Synchronous Windows settings will be applied during the next Windows logon.
Application settings will be applied when the application starts.|
Application and Windows settings are read directly from the settings storage location.
Asynchronous and synchronous Windows settings are applied.
Application settings will be applied when the application starts.|
+|**Windows Logoff**|Store changes locally and cache and copy asynchronous and synchronous Windows settings to the settings storage location server, if available|Store changes to asynchronous and synchronous Windows settings storage location|
+|**Windows Connect (RDP) / Unlock**|Synchronize any asynchronous Windows settings from settings storage location to local cache, if available.
Apply cached Windows settings|Download and apply asynchronous windows settings from settings storage location|
+|**Windows Disconnect (RDP) / Lock**|Store asynchronous Windows settings changes to the local cache.
Synchronize any asynchronous Windows settings from the local cache to settings storage location, if available|Store asynchronous Windows settings changes to the settings storage location|
+|**Application start**|Apply application settings from local cache as the application starts|Apply application settings from settings storage location as the application starts|
+|**Application closes**|Store any application settings changes to the local cache and copy settings to settings storage location, if available|Store any application settings changes to settings storage location|
+|**Sync Controller Scheduled Task**|Application and Windows settings are synchronized between the settings storage location and the local cache.
**Note** Settings changes are not cached locally until an application closes. This trigger will not export changes made to a currently running application.
For Windows settings, this means that any changes will not be cached locally and exported until the next Lock (Asynchronous) or Logoff (Asynchronous and Synchronous).
Settings are applied in these cases:
Asynchronous Windows settings are applied directly.
Application settings are applied when the application starts.
Both asynchronous and synchronous Windows settings are applied during the next Windows logon.
Windows app (AppX) settings are applied during the next refresh. See [Monitor Application Settings](uev-changing-the-frequency-of-scheduled-tasks.md#monitor-application-settings) for more information.|NA|
+|**Asynchronous Settings updated on remote store***|Load and apply new asynchronous settings from the cache.|Load and apply settings from central server|
## Related topics
diff --git a/windows/configuration/ue-v/uev-synchronizing-microsoft-office-with-uev.md b/windows/configuration/ue-v/uev-synchronizing-microsoft-office-with-uev.md
index 6426a311cb..ee24e695c5 100644
--- a/windows/configuration/ue-v/uev-synchronizing-microsoft-office-with-uev.md
+++ b/windows/configuration/ue-v/uev-synchronizing-microsoft-office-with-uev.md
@@ -37,92 +37,15 @@ Review the following tables for details about Office support in UE-V:
### Supported UE-V templates for Microsoft Office
-
-
-
-
-
-
-
-
-
Office 2016 templates (UE-V for Windows 10 and Windows 10, version 1607, available in UE-V gallery)
-
Office 2013 templates (UE-V for Windows 10 and UE-V 2.x, available on UE-V gallery)
-
Office 2010 templates (UE-V 1.0 and 1.0 SP1)
-
-
-
-
-
MicrosoftOffice2016Win32.xml
-
MicrosoftOffice2016Win64.xml
-
MicrosoftSkypeForBusiness2016Win32.xml
-
MicrosoftSkypeForBusiness2016Win64.xml
-
MicrosoftOffice2013Win32.xml
-
MicrosoftOffice2013Win64.xml
-
MicrosoftLync2013Win32.xml
-
MicrosoftLync2013Win64.xml
-
MicrosoftOffice2010Win32.xml
-
MicrosoftOffice2010Win64.xml
-
MicrosoftLync2010.xml
-
-
-
-
-
-
+|Office 2016 templates (UE-V for Windows 10 and Windows 10, version 1607, available in UE-V gallery)|Office 2013 templates (UE-V for Windows 10 and UE-V 2.x, available on UE-V gallery)|Office 2010 templates (UE-V 1.0 and 1.0 SP1)|
+|--- |--- |--- |
+|MicrosoftOffice2016Win32.xml
Microsoft SharePoint Designer 2013 (not updated for 2016)
Microsoft Visio 2016
Microsoft Word 2016
Microsoft Office Upload Manager|Microsoft Access 2013
Microsoft Lync 2013
Microsoft Excel 2013
Microsoft InfoPath 2013
Microsoft OneNote 2013
Microsoft Outlook 2013
Microsoft PowerPoint 2013
Microsoft Project 2013
Microsoft Publisher 2013
Microsoft SharePoint Designer 2013
Microsoft Visio 2013
Microsoft Word 2013
Microsoft Office Upload Manager|Microsoft Access 2010
Microsoft Lync 2010
Microsoft Excel 2010
Microsoft InfoPath 2010
Microsoft OneNote 2010
Microsoft Outlook 2010
Microsoft PowerPoint 2010
Microsoft Project 2010
Microsoft Publisher 2010
Microsoft SharePoint Designer 2010
Microsoft Visio 2010
Microsoft Word 2010|
## Deploying Office templates
diff --git a/windows/configuration/wcd/wcd-accountmanagement.md b/windows/configuration/wcd/wcd-accountmanagement.md
index b565989431..8d4bfbfc06 100644
--- a/windows/configuration/wcd/wcd-accountmanagement.md
+++ b/windows/configuration/wcd/wcd-accountmanagement.md
@@ -19,13 +19,13 @@ Use these settings to configure the Account Manager service.
## Applies to
-| Settings | Desktop editions | Mobile editions | Surface Hub | HoloLens | IoT Core |
-| --- | :---: | :---: | :---: | :---: | :---: |
-| [DeletionPolicy](#deletionpolicy) | | | | ✔️ | |
-| [EnableProfileManager](#enableprofilemanager) | | | | ✔️ | |
-| [ProfileInactivityThreshold](#profileinactivitythreshold) | | | | ✔️ | |
-| [StorageCapacityStartDeletion](#storagecapacitystartdeletion) | | | | ✔️ | |
-| [StorageCapacityStopDeletion](#storagecapacitystopdeletion) | | | | ✔️ | |
+| Settings | Windows client | Surface Hub | HoloLens | IoT Core |
+| --- | :---: | :---: | :---: | :---: |
+| [DeletionPolicy](#deletionpolicy) | | | ✔️ | |
+| [EnableProfileManager](#enableprofilemanager) | | | ✔️ | |
+| [ProfileInactivityThreshold](#profileinactivitythreshold) | | | ✔️ | |
+| [StorageCapacityStartDeletion](#storagecapacitystartdeletion) | | | ✔️ | |
+| [StorageCapacityStopDeletion](#storagecapacitystopdeletion) | | | ✔️ | |
>[!NOTE]
>Although the AccountManagement settings are available in advanced provisioning for other editions, you should only use them for HoloLens devices.
diff --git a/windows/configuration/wcd/wcd-accounts.md b/windows/configuration/wcd/wcd-accounts.md
index f5ef92247d..a6462788e1 100644
--- a/windows/configuration/wcd/wcd-accounts.md
+++ b/windows/configuration/wcd/wcd-accounts.md
@@ -19,7 +19,7 @@ Use these settings to join a device to an Active Directory domain or an Azure Ac
## Applies to
-| Setting groups | Desktop editions | Surface Hub | HoloLens | IoT Core |
+| Setting groups | Windows client | Surface Hub | HoloLens | IoT Core |
| --- | :---: | :---: | :---: | :---: |
| [Azure](#azure) | ✔️ | ✔️ | ✔️ | |
| [ComputerAccount](#computeraccount) | ✔️ | ✔️ | | ✔️ |
diff --git a/windows/configuration/wcd/wcd-admxingestion.md b/windows/configuration/wcd/wcd-admxingestion.md
index 4f78a97183..1116a54650 100644
--- a/windows/configuration/wcd/wcd-admxingestion.md
+++ b/windows/configuration/wcd/wcd-admxingestion.md
@@ -26,10 +26,10 @@ Starting in Windows 10, version 1703, you can import (*ingest*) select Group Pol
## Applies to
-| Setting groups | Desktop editions | Mobile editions | Surface Hub | HoloLens | IoT Core |
-| --- | :---: | :---: | :---: | :---: | :---: |
-| [ConfigADMXInstalledPolicy](#configadmxinstalledpolicy) | ✔️ | | | | |
-| [ConfigOperations](#configoperations) | ✔️ | | | | |
+| Setting groups | Windows client | Surface Hub | HoloLens | IoT Core |
+| --- | :---: | :---: | :---: | :---: |
+| [ConfigADMXInstalledPolicy](#configadmxinstalledpolicy) | ✔️ | | | |
+| [ConfigOperations](#configoperations) | ✔️ | | | |
## ConfigADMXInstalledPolicy
diff --git a/windows/configuration/wcd/wcd-assignedaccess.md b/windows/configuration/wcd/wcd-assignedaccess.md
index af094faef4..36eb055038 100644
--- a/windows/configuration/wcd/wcd-assignedaccess.md
+++ b/windows/configuration/wcd/wcd-assignedaccess.md
@@ -19,10 +19,10 @@ Use this setting to configure single use (kiosk) devices.
## Applies to
-| Setting | Desktop editions | Mobile editions | Surface Hub | HoloLens | IoT Core |
-| --- | :---: | :---: | :---: | :---: | :---: |
-| [AssignedAccessSettings](#assignedaccesssettings) | ✔️ | | | ✔️ | |
-| [MultiAppAssignedAccessSettings](#multiappassignedaccesssettings) | ✔️ | | | ✔️ | |
+| Setting | Windows client | Surface Hub | HoloLens | IoT Core |
+| --- | :---: | :---: | :---: | :---: |
+| [AssignedAccessSettings](#assignedaccesssettings) | ✔️ | | ✔️ | |
+| [MultiAppAssignedAccessSettings](#multiappassignedaccesssettings) | ✔️ | | ✔️ | |
## AssignedAccessSettings
diff --git a/windows/configuration/wcd/wcd-browser.md b/windows/configuration/wcd/wcd-browser.md
index f9b61ff048..3b57376dae 100644
--- a/windows/configuration/wcd/wcd-browser.md
+++ b/windows/configuration/wcd/wcd-browser.md
@@ -19,13 +19,13 @@ Use to configure browser settings that should only be set by OEMs who are part o
## Applies to
-| Setting groups | Desktop editions | Mobile editions | Surface Hub | HoloLens | IoT Core |
-| --- | :---: | :---: | :---: | :---: | :---: |
-| [AllowPrelaunch](#allowprelaunch) | | | ✔️ | | |
-| [FavoriteBarItems](#favoritebaritems) | ✔️ | | | | |
-| [Favorites](#favorites) | | ✔️ | | | |
-| [PartnerSearchCode](#partnersearchcode) | ✔️ | ✔️ | ✔️ | | |
-| [SearchProviders](#searchproviders) | | ✔️ | | | |
+| Setting groups | Windows client | Surface Hub | HoloLens | IoT Core |
+| --- | :---: | :---: | :---: | :---: |
+| [AllowPrelaunch](#allowprelaunch) | | ✔️ | | |
+| [FavoriteBarItems](#favoritebaritems) | ✔️ | | | |
+| [Favorites](#favorites) | | | | |
+| [PartnerSearchCode](#partnersearchcode) | ✔️ | ✔️ | | |
+| [SearchProviders](#searchproviders) | | | | |
## AllowPrelaunch
diff --git a/windows/configuration/wcd/wcd-cellcore.md b/windows/configuration/wcd/wcd-cellcore.md
index e7c8301aa9..56d5c63695 100644
--- a/windows/configuration/wcd/wcd-cellcore.md
+++ b/windows/configuration/wcd/wcd-cellcore.md
@@ -24,26 +24,26 @@ Use to configure settings for cellular data.
## Applies to
- Setting groups | Desktop editions | Mobile editions | Surface Hub | HoloLens | IoT Core
- --- | :---: | :---: | :---: | :---: | :---:
- PerDevice: [CellConfigurations](#cellconfigurations) | | ✔️ | | | |
- PerDevice: [CellData](#celldata) | ✔️ | ✔️ | ✔️ | |
- PerDevice: [CellUX](#cellux) | ✔️ | ✔️ | ✔️ | |
- PerDevice: [CGDual](#cgdual) | | ✔️ | | |
- PerDevice: [eSim](#esim) | ✔️ | ✔️ | ✔️ | |
- PerDevice: [External](#external) | | ✔️ | | |
- PerDevice: [General](#general) | | ✔️ | | |
- PerDevice: [RCS](#rcs) | | ✔️ | | |
- PerDevice: [SMS](#sms) | ✔️ | ✔️ | ✔️ | |
- PerDevice: [UIX](#uix) | | ✔️ | | |
- PerDevice: [UTK](#utk) | | ✔️ | | |
- PerlMSI: [CellData](#celldata2) | | ✔️ | | |
- PerIMSI: [CellUX](#cellux2) | | ✔️ | | |
- PerIMSI: [General](#general2) | | ✔️ | | |
- PerIMSI: [RCS](#rcs2) | | ✔️ | | |
- PerIMSI: [SMS](#sms2) | ✔️ | ✔️ | ✔️ | |
- PerIMSI: [UTK](#utk2) | | ✔️ | | |
- PerIMSI: [VoLTE](#volte) | | ✔️ | | |
+ Setting groups | Windows client | Surface Hub | HoloLens | IoT Core
+ --- | :---: | :---: | :---: | :---:
+ PerDevice: [CellConfigurations](#cellconfigurations) | | | | |
+ PerDevice: [CellData](#celldata) | ✔️ | ✔️ | |
+ PerDevice: [CellUX](#cellux) | ✔️ | ✔️ | |
+ PerDevice: [CGDual](#cgdual) | | | |
+ PerDevice: [eSim](#esim) | ✔️ | ✔️ | |
+ PerDevice: [External](#external) | | | |
+ PerDevice: [General](#general) | | | |
+ PerDevice: [RCS](#rcs) | | | |
+ PerDevice: [SMS](#sms) | ✔️ | ✔️ | |
+ PerDevice: [UIX](#uix) | | | |
+ PerDevice: [UTK](#utk) | | | |
+ PerlMSI: [CellData](#celldata2) | | | |
+ PerIMSI: [CellUX](#cellux2) | | | |
+ PerIMSI: [General](#general2) | | | |
+ PerIMSI: [RCS](#rcs2) | | | |
+ PerIMSI: [SMS](#sms2) | ✔️ | ✔️ | |
+ PerIMSI: [UTK](#utk2) | | | |
+ PerIMSI: [VoLTE](#volte) | | | |
## PerDevice
diff --git a/windows/configuration/wcd/wcd-cellular.md b/windows/configuration/wcd/wcd-cellular.md
index 323e7faf03..825f43c4c2 100644
--- a/windows/configuration/wcd/wcd-cellular.md
+++ b/windows/configuration/wcd/wcd-cellular.md
@@ -21,9 +21,9 @@ Use to configure settings for cellular connections.
## Applies to
-| Setting groups | Desktop editions | Mobile editions | Surface Hub | HoloLens | IoT Core |
-| --- | :---: | :---: | :---: | :---: | :---: |
-| All settings | ✔️ | | | | |
+| Setting groups | Windows client | Surface Hub | HoloLens | IoT Core |
+| --- | :---: | :---: | :---: | :---: |
+| All settings | ✔️ | | | |
## PerDevice
diff --git a/windows/configuration/wcd/wcd-certificates.md b/windows/configuration/wcd/wcd-certificates.md
index a30bcdeadc..ca41ffe27e 100644
--- a/windows/configuration/wcd/wcd-certificates.md
+++ b/windows/configuration/wcd/wcd-certificates.md
@@ -25,9 +25,9 @@ Use to deploy Root Certificate Authority (CA) certificates to devices. The follo
## Applies to
-| Setting groups | Desktop editions | Mobile editions | Surface Hub | HoloLens | IoT Core |
-| --- | :---: | :---: | :---: | :---: | :---: |
-| All setting groups | ✔️ | ✔️ | ✔️ | ✔️ | ✔️ |
+| Setting groups | Windows client | Surface Hub | HoloLens | IoT Core |
+| --- | :---: | :---: | :---: | :---: |
+| All setting groups | ✔️ | ✔️ | ✔️ | ✔️ |
## CACertificates
diff --git a/windows/configuration/wcd/wcd-cleanpc.md b/windows/configuration/wcd/wcd-cleanpc.md
index 0f31ecac6f..32bdc154b2 100644
--- a/windows/configuration/wcd/wcd-cleanpc.md
+++ b/windows/configuration/wcd/wcd-cleanpc.md
@@ -19,10 +19,10 @@ Use to remove user-installed and pre-installed applications, with the option to
## Applies to
-| Settings | Desktop editions | Mobile editions | Surface Hub | HoloLens | IoT Core |
-| --- | :---: | :---: | :---: | :---: | :---: |
-| CleanPCRetainingUserData | ✔️ | | | | |
-| CleanPCWithoutRetainingUserData | ✔️ | | | | |
+| Settings | Windows client | Surface Hub | HoloLens | IoT Core |
+| --- | :---: | :---: | :---: | :---: |
+| CleanPCRetainingUserData | ✔️ | | | |
+| CleanPCWithoutRetainingUserData | ✔️ | | | |
For each setting, the options are **Enable** and **Not configured**.
diff --git a/windows/configuration/wcd/wcd-connections.md b/windows/configuration/wcd/wcd-connections.md
index 8dc2911a9b..5c59173b68 100644
--- a/windows/configuration/wcd/wcd-connections.md
+++ b/windows/configuration/wcd/wcd-connections.md
@@ -19,9 +19,9 @@ Use to configure settings related to various types of phone connections.
## Applies to
-| Setting groups | Desktop editions | Mobile editions | Surface Hub | HoloLens | IoT Core |
-| --- | :---: | :---: | :---: | :---: | :---: |
-| All settings | ✔️ | ✔️ | ✔️ | | |
+| Setting groups | Windows client | Surface Hub | HoloLens | IoT Core |
+| --- | :---: | :---: | :---: | :---: |
+| All settings | ✔️ | ✔️ | | |
For each setting group:
diff --git a/windows/configuration/wcd/wcd-connectivityprofiles.md b/windows/configuration/wcd/wcd-connectivityprofiles.md
index 2fdfe8372f..33b7de451b 100644
--- a/windows/configuration/wcd/wcd-connectivityprofiles.md
+++ b/windows/configuration/wcd/wcd-connectivityprofiles.md
@@ -19,14 +19,14 @@ Use to configure profiles that a user will connect with, such as an email accoun
## Applies to
-| Setting groups | Desktop editions | Mobile editions | Surface Hub | HoloLens | IoT Core |
-| --- | :---: | :---: | :---: | :---: | :---: |
-| [Email](#email) | ✔️ | ✔️ | ✔️ | | |
-| [Exchange](#exchange) | ✔️ | ✔️ | ✔️ | | |
-| [KnownAccounts](#knownaccounts) | ✔️ | ✔️ | ✔️ | | |
-| [VPN](#vpn) | ✔️ | ✔️ | ✔️ | ✔️ | |
-| [WiFiSense](#wifisense) | ✔️ | ✔️ | ✔️ | | |
-| [WLAN](#wlan) | ✔️ | ✔️ | ✔️ | ✔️ | |
+| Setting groups | Windows client | Surface Hub | HoloLens | IoT Core |
+| --- | :---: | :---: | :---: | :---: |
+| [Email](#email) | ✔️ | ✔️ | | |
+| [Exchange](#exchange) | ✔️ | ✔️ | | |
+| [KnownAccounts](#knownaccounts) | ✔️ | ✔️ | | |
+| [VPN](#vpn) | ✔️ | ✔️ | ✔️ | |
+| [WiFiSense](#wifisense) | ✔️ | ✔️ | | |
+| [WLAN](#wlan) | ✔️ | ✔️ | ✔️ | |
## Email
diff --git a/windows/configuration/wcd/wcd-countryandregion.md b/windows/configuration/wcd/wcd-countryandregion.md
index e8cf5a0b37..81597e49d4 100644
--- a/windows/configuration/wcd/wcd-countryandregion.md
+++ b/windows/configuration/wcd/wcd-countryandregion.md
@@ -19,8 +19,8 @@ Use to configure a setting that partners must customize to ship Windows devices
## Applies to
-| Setting groups | Desktop editions | Mobile editions | Surface Hub | HoloLens | IoT Core |
-| --- | :---: | :---: | :---: | :---: | :---: |
-| CountryCodeForExtendedCapabilityPrompts | ✔️ | ✔️ | ✔️ | | |
+| Setting groups | Windows client | Surface Hub | HoloLens | IoT Core |
+| --- | :---: | :---: | :---: | :---: |
+| CountryCodeForExtendedCapabilityPrompts | ✔️ | ✔️ | | |
You can set the **CountryCodeForExtendedCapabilityPrompts** setting for **China** to enable additional capability prompts when apps use privacy-sensitive features (such as Contacts or Microphone).
diff --git a/windows/configuration/wcd/wcd-desktopbackgroundandcolors.md b/windows/configuration/wcd/wcd-desktopbackgroundandcolors.md
index 464d3c8163..e18abe6ad1 100644
--- a/windows/configuration/wcd/wcd-desktopbackgroundandcolors.md
+++ b/windows/configuration/wcd/wcd-desktopbackgroundandcolors.md
@@ -19,7 +19,7 @@ Do not use. Instead, use the [Personalization settings](wcd-personalization.md).
## Applies to
-| Setting groups | Desktop editions | Mobile editions | Surface Hub | HoloLens | IoT Core |
-| --- | :---: | :---: | :---: | :---: | :---: |
-| All settings | ✔️ | | | | |
+| Setting groups | Windows client | Surface Hub | HoloLens | IoT Core |
+| --- | :---: | :---: | :---: | :---: |
+| All settings | ✔️ | | | |
diff --git a/windows/configuration/wcd/wcd-developersetup.md b/windows/configuration/wcd/wcd-developersetup.md
index 666109a375..eee860859f 100644
--- a/windows/configuration/wcd/wcd-developersetup.md
+++ b/windows/configuration/wcd/wcd-developersetup.md
@@ -19,22 +19,20 @@ Use to unlock developer mode on HoloLens devices and configure authentication to
## Applies to
-| Setting groups | Desktop editions | Mobile editions | Surface Hub | HoloLens | IoT Core |
-| --- | :---: | :---: | :---: | :---: | :---: |
-| [EnableDeveloperMode](#enabledevelopermode) | | | | ✔️ | |
-| [AuthenticationMode](#authenticationmode) | | | | ✔️ | |
+| Setting groups | Windows client | Surface Hub | HoloLens | IoT Core |
+| --- | :---: | :---: | :---: | :---: |
+| [EnableDeveloperMode](#developersetupsettings-enabledevelopermode) | | | ✔️ | |
+| [AuthenticationMode](#windowsdeviceportalsettings-authentication-mode) | | | ✔️ | |
-
## DeveloperSetupSettings: EnableDeveloperMode
When this setting is configured as **True**, the device is unlocked for developer functionality.
-
## WindowsDevicePortalSettings: Authentication Mode
When AuthenticationMode is set to **Basic Auth**, enter a user name and password to enable the device to connect to and authenticate with the Windows Device Portal.
## Related topics
-- [Device Portal for HoloLens](/windows/uwp/debug-test-perf/device-portal-hololens)
\ No newline at end of file
+- [Device Portal for HoloLens](/windows/uwp/debug-test-perf/device-portal-hololens)
diff --git a/windows/configuration/wcd/wcd-deviceformfactor.md b/windows/configuration/wcd/wcd-deviceformfactor.md
index fc86909bc1..b233406d79 100644
--- a/windows/configuration/wcd/wcd-deviceformfactor.md
+++ b/windows/configuration/wcd/wcd-deviceformfactor.md
@@ -19,9 +19,9 @@ Use to identify the form factor of the device.
## Applies to
-| Setting | Desktop editions | Mobile editions | Surface Hub | HoloLens | IoT Core |
-| --- | :---: | :---: | :---: | :---: | :---: |
-| DeviceForm | ✔️ | ✔️ | ✔️ | | |
+| Setting | Windows client | Surface Hub | HoloLens | IoT Core |
+| --- | :---: | :---: | :---: | :---: |
+| DeviceForm | ✔️ | ✔️ | | |
Specifies the device form factor running Windows 10. Generally, the device form is set by the original equipment manufacturer (OEM), however you might want to change the device form based on its usage in your organization.
diff --git a/windows/configuration/wcd/wcd-devicemanagement.md b/windows/configuration/wcd/wcd-devicemanagement.md
index 236416cf96..bb1692d17e 100644
--- a/windows/configuration/wcd/wcd-devicemanagement.md
+++ b/windows/configuration/wcd/wcd-devicemanagement.md
@@ -19,12 +19,12 @@ Use to configure device management settings.
## Applies to
-| Setting | Desktop editions | Mobile editions | Surface Hub | HoloLens | IoT Core |
-| --- | :---: | :---: | :---: | :---: | :---: |
-| [Accounts](#accounts) | ✔️ | ✔️ | ✔️ | | |
-| [PGList](#pglist) | ✔️ | ✔️ | ✔️ | | |
-| [Policies](#policies) | ✔️ | ✔️ | ✔️ | | |
-| [TrustedProvisioningSource](#trustedprovisioningsource) | ✔️ | ✔️ | ✔️ | | |
+| Setting | Windows client | Surface Hub | HoloLens | IoT Core |
+| --- | :---: | :---: | :---: | :---: |
+| [Accounts](#accounts) | ✔️ | ✔️ | | |
+| [PGList](#pglist) | ✔️ | ✔️ | | |
+| [Policies](#policies) | ✔️ | ✔️ | | |
+| [TrustedProvisioningSource](#trustedprovisioningsource) | ✔️ | ✔️ | | |
## Accounts
diff --git a/windows/configuration/wcd/wcd-deviceupdatecenter.md b/windows/configuration/wcd/wcd-deviceupdatecenter.md
index 3dfa2d7fe2..e72df83e2d 100644
--- a/windows/configuration/wcd/wcd-deviceupdatecenter.md
+++ b/windows/configuration/wcd/wcd-deviceupdatecenter.md
@@ -17,7 +17,7 @@ Do not use **DeviceUpdateCenter** settings at this time.
## Applies to
-| Setting | Desktop editions | Mobile editions | Surface Hub | HoloLens | IoT Core |
-| --- | :---: | :---: | :---: | :---: | :---: |
-| All settings | ✔️ | | | | |
+| Setting | Windows client | Surface Hub | HoloLens | IoT Core |
+| --- | :---: | :---: | :---: | :---: |
+| All settings | ✔️ | | | |
diff --git a/windows/configuration/wcd/wcd-dmclient.md b/windows/configuration/wcd/wcd-dmclient.md
index 39949ed4c4..31d0ed7b8c 100644
--- a/windows/configuration/wcd/wcd-dmclient.md
+++ b/windows/configuration/wcd/wcd-dmclient.md
@@ -19,9 +19,9 @@ Use to specify enterprise-specific mobile device management configuration settin
## Applies to
-| Setting | Desktop editions | Mobile editions | Surface Hub | HoloLens | IoT Core |
-| --- | :---: | :---: | :---: | :---: | :---: |
-| UpdateManagementServiceAddress | ✔️ | ✔️ | ✔️ | | ✔️ |
+| Setting | Windows client | Surface Hub | HoloLens | IoT Core |
+| --- | :---: | :---: | :---: | :---: |
+| UpdateManagementServiceAddress | ✔️ | ✔️ | | ✔️ |
For the **UpdateManagementServiceAddress** setting, enter a list of servers. The first server in the semi-colon delimited list is the server that will be used to instantiate MDM sessions.
diff --git a/windows/configuration/wcd/wcd-editionupgrade.md b/windows/configuration/wcd/wcd-editionupgrade.md
index 79e2667cb2..aaa3c9a10e 100644
--- a/windows/configuration/wcd/wcd-editionupgrade.md
+++ b/windows/configuration/wcd/wcd-editionupgrade.md
@@ -19,11 +19,11 @@ Use to upgrade the edition of Windows 10 on the device. [Learn about Windows 10
## Applies to
-| Setting | Desktop editions | Mobile editions | Surface Hub | HoloLens | IoT Core |
-| --- | :---: | :---: | :---: | :---: | :---: |
-| [ChangeProductKey](#changeproductkey) | ✔️ | ✔️ | | | |
-| [UpgradeEditionWithLicense](#upgradeeditionwithlicense) | ✔️ | ✔️ | | ✔️ | |
-| [UpgradeEditionWithProductKey](#upgradeeditionwithproductkey) | ✔️ | ✔️ | | | |
+| Setting | Windows client | Surface Hub | HoloLens | IoT Core |
+| --- | :---: | :---: | :---: | :---: |
+| [ChangeProductKey](#changeproductkey) | ✔️ | | | |
+| [UpgradeEditionWithLicense](#upgradeeditionwithlicense) | ✔️ | | ✔️ | |
+| [UpgradeEditionWithProductKey](#upgradeeditionwithproductkey) | ✔️ | | | |
## ChangeProductKey
diff --git a/windows/configuration/wcd/wcd-firewallconfiguration.md b/windows/configuration/wcd/wcd-firewallconfiguration.md
index 4bc834f3ac..cd505cda87 100644
--- a/windows/configuration/wcd/wcd-firewallconfiguration.md
+++ b/windows/configuration/wcd/wcd-firewallconfiguration.md
@@ -19,9 +19,9 @@ Use to enable AllJoyn router to work on public networks.
## Applies to
-| Setting | Desktop editions | Mobile editions | Surface Hub | HoloLens | IoT Core |
-| --- | :---: | :---: | :---: | :---: | :---: |
-| EnableAllJoynOnPublicNetwork | | | | | ✔️ |
+| Setting | Windows client | Surface Hub | HoloLens | IoT Core |
+| --- | :---: | :---: | :---: | :---: |
+| EnableAllJoynOnPublicNetwork | | | | ✔️ |
Set to **True** or **False**.
diff --git a/windows/configuration/wcd/wcd-firstexperience.md b/windows/configuration/wcd/wcd-firstexperience.md
index 0561b8d3f4..a854a53a49 100644
--- a/windows/configuration/wcd/wcd-firstexperience.md
+++ b/windows/configuration/wcd/wcd-firstexperience.md
@@ -19,9 +19,9 @@ Use these settings to configure the out-of-box experience (OOBE) to set up HoloL
## Applies to
-| Setting | Desktop editions | Mobile editions | Surface Hub | HoloLens | IoT Core |
-| --- | :---: | :---: | :---: | :---: | :---: |
-| All settings | | | | ✔️ | |
+| Setting | Windows client | Surface Hub | HoloLens | IoT Core |
+| --- | :---: | :---: | :---: | :---: |
+| All settings | | | ✔️ | |
Setting | Description
--- | ---
diff --git a/windows/configuration/wcd/wcd-folders.md b/windows/configuration/wcd/wcd-folders.md
index cc594611bc..1eab5f086b 100644
--- a/windows/configuration/wcd/wcd-folders.md
+++ b/windows/configuration/wcd/wcd-folders.md
@@ -19,8 +19,8 @@ Use to add files to the device.
## Applies to
-| Setting | Desktop editions | Mobile editions | Surface Hub | HoloLens | IoT Core |
-| --- | :---: | :---: | :---: | :---: | :---: |
-| PublicDocuments | ✔️ | ✔️ | ✔️ | | |
+| Setting | Windows client | Surface Hub | HoloLens | IoT Core |
+| --- | :---: | :---: | :---: | :---: |
+| PublicDocuments | ✔️ | ✔️ | | |
Browse to and select a file or files that will be included in the provisioning package and added to the public profile documents folder on the target device. You can use the **Relative path to directory on target device** field to create a new folder within the public profile documents folder.
diff --git a/windows/configuration/wcd/wcd-kioskbrowser.md b/windows/configuration/wcd/wcd-kioskbrowser.md
index 0db1c60a59..b8dc34d1e1 100644
--- a/windows/configuration/wcd/wcd-kioskbrowser.md
+++ b/windows/configuration/wcd/wcd-kioskbrowser.md
@@ -19,12 +19,12 @@ Use KioskBrowser settings to configure Internet sharing.
## Applies to
-| Setting groups | Desktop editions | Mobile editions | Surface Hub | HoloLens | IoT Core |
-| --- | :---: | :---: | :---: | :---: | :---: |
-| All settings | | | | | ✔️ |
+| Setting groups | Windows client | Surface Hub | HoloLens | IoT Core |
+| --- | :---: | :---: | :---: | :---: |
+| All settings | | | | ✔️ |
>[!NOTE]
->To configure Kiosk Browser settings for desktop editions, go to [Policies > KioskBrowser](wcd-policies.md#kioskbrowser).
+>To configure Kiosk Browser settings for Windows client, go to [Policies > KioskBrowser](wcd-policies.md#kioskbrowser).
Kiosk Browser settings | Use this setting to
--- | ---
diff --git a/windows/configuration/wcd/wcd-licensing.md b/windows/configuration/wcd/wcd-licensing.md
index 98ebd963b2..82adee0181 100644
--- a/windows/configuration/wcd/wcd-licensing.md
+++ b/windows/configuration/wcd/wcd-licensing.md
@@ -19,10 +19,10 @@ Use for settings related to Microsoft licensing programs.
## Applies to
-| Setting | Desktop editions | Mobile editions | Surface Hub | HoloLens | IoT Core |
-| --- | :---: | :---: | :---: | :---: | :---: |
-| [AllowWindowsEntitlementReactivation](#allowwindowsentitlementreactivation) | ✔️ | | | | |
-| [DisallowKMSClientOnlineAVSValidation](#disallowkmsclientonlineavsvalidation) | ✔️ | | | | |
+| Setting | Windows client | Surface Hub | HoloLens | IoT Core |
+| --- | :---: | :---: | :---: | :---: |
+| [AllowWindowsEntitlementReactivation](#allowwindowsentitlementreactivation) | ✔️ | | | |
+| [DisallowKMSClientOnlineAVSValidation](#disallowkmsclientonlineavsvalidation) | ✔️ | | | |
## AllowWindowsEntitlementReactivation
diff --git a/windows/configuration/wcd/wcd-location.md b/windows/configuration/wcd/wcd-location.md
index c0617f9b4a..a2989cead5 100644
--- a/windows/configuration/wcd/wcd-location.md
+++ b/windows/configuration/wcd/wcd-location.md
@@ -18,9 +18,9 @@ Use Location settings to configure location services.
## Applies to
-| Setting groups | Desktop editions | Mobile editions | Surface Hub | HoloLens | IoT Core |
-| --- | :---: | :---: | :---: | :---: | :---: |
-| [EnableLocation](#enablelocation) | | | | | ✔️ |
+| Setting groups | Windows client | Surface Hub | HoloLens | IoT Core |
+| --- | :---: | :---: | :---: | :---: |
+| [EnableLocation](#enablelocation) | | | | ✔️ |
## EnableLocation
diff --git a/windows/configuration/wcd/wcd-maps.md b/windows/configuration/wcd/wcd-maps.md
index b92e27c14e..51aacf0da3 100644
--- a/windows/configuration/wcd/wcd-maps.md
+++ b/windows/configuration/wcd/wcd-maps.md
@@ -18,11 +18,11 @@ Use for settings related to Maps.
## Applies to
-| Setting | Desktop editions | Mobile editions | Surface Hub | HoloLens | IoT Core |
-| --- | :---: | :---: | :---: | :---: | :---: |
-| [ChinaVariantWin10](#chinavariantwin10) | ✔️ | ✔️ | ✔️ | | |
-| [UseExternalStorage](#useexternalstorage) | ✔️ | ✔️ | ✔️ | | |
-| [UseSmallerCache](#usesmallercache) | ✔️ | ✔️ | ✔️ | | |
+| Setting | Windows client | Surface Hub | HoloLens | IoT Core |
+| --- | :---: | :---: | :---: | :---: |
+| [ChinaVariantWin10](#chinavariantwin10) | ✔️ | ✔️ | | |
+| [UseExternalStorage](#useexternalstorage) | ✔️ | ✔️ | | |
+| [UseSmallerCache](#usesmallercache) | ✔️ | ✔️ | | |
## ChinaVariantWin10
diff --git a/windows/configuration/wcd/wcd-networkproxy.md b/windows/configuration/wcd/wcd-networkproxy.md
index e19c13f19c..957bc2abd1 100644
--- a/windows/configuration/wcd/wcd-networkproxy.md
+++ b/windows/configuration/wcd/wcd-networkproxy.md
@@ -18,9 +18,9 @@ Use for settings related to NetworkProxy.
## Applies to
-| Setting | Desktop editions | Mobile editions | Surface Hub | HoloLens | IoT Core |
-| --- | :---: | :---: | :---: | :---: | :---: |
-| All settings | | | ✔️ | | |
+| Setting | Windows client | Surface Hub | HoloLens | IoT Core |
+| --- | :---: | :---: | :---: | :---: |
+| All settings | | ✔️ | | |
## AutoDetect
diff --git a/windows/configuration/wcd/wcd-networkqospolicy.md b/windows/configuration/wcd/wcd-networkqospolicy.md
index 80e515c380..177a49d274 100644
--- a/windows/configuration/wcd/wcd-networkqospolicy.md
+++ b/windows/configuration/wcd/wcd-networkqospolicy.md
@@ -18,9 +18,9 @@ Use to create network Quality of Service (QoS) policies. A QoS policy performs a
## Applies to
-| Setting | Desktop editions | Mobile editions | Surface Hub | HoloLens | IoT Core |
-| --- | :---: | :---: | :---: | :---: | :---: |
-| All settings | | | ✔️ | | |
+| Setting | Windows client | Surface Hub | HoloLens | IoT Core |
+| --- | :---: | :---: | :---: | :---: |
+| All settings | | ✔️ | | |
1. In **Available customizations**, select **NetworkQ0SPolicy**, enter a friendly name for the account, and then click **Add**.
2. In **Available customizations**, select the name that you just created. The following table describes the settings you can configure.
diff --git a/windows/configuration/wcd/wcd-oobe.md b/windows/configuration/wcd/wcd-oobe.md
index 4245590994..9110aeec1d 100644
--- a/windows/configuration/wcd/wcd-oobe.md
+++ b/windows/configuration/wcd/wcd-oobe.md
@@ -18,35 +18,21 @@ Use to configure settings for the [Out Of Box Experience (OOBE)](/windows-hardwa
## Applies to
-| Setting | Desktop editions | Mobile editions | Surface Hub | HoloLens | IoT Core |
-| --- | :---: | :---: | :---: | :---: | :---: |
-| [Desktop > EnableCortanaVoice](#enablecortanavoice) | ✔️ | | | | |
-| [Desktop > HideOobe](#hided) | ✔️ | | | | |
-| [Mobile > EnforceEnterpriseProvisioning](#nforce) | | ✔️ | | | |
-| [Mobile > HideOobe](#hidem) | | ✔️ | | | |
-
-
-
+| Setting | Windows client | Surface Hub | HoloLens | IoT Core |
+| --- | :---: | :---: | :---: | :---: |
+| [Desktop > EnableCortanaVoice](#enablecortanavoice) | ✔️ | | | |
+| [Desktop > HideOobe](#hideoobe-for-desktop) | ✔️ | | | |
## EnableCortanaVoice
Use this setting to control whether Cortana voice-over is enabled during OOBE. The voice-over is disabled by default on Windows 10 Pro, Education, and Enterprise. The voice-over is enabled by default on Windows 10 Home. Select **True** to enable voice-over during OOBE, or **False** to disable voice-over during OOBE.
-
## HideOobe for desktop
When set to **True**, it hides the interactive OOBE flow for Windows 10.
->[!NOTE]
->You must create a user account if you set the value to true or the device will not be usable.
+> [!NOTE]
+> You must create a user account if you set the value to true or the device will not be usable.
When set to **False**, the OOBE screens are displayed.
-
-## EnforceEnterpriseProvisioning
-
-When set to **True**, it forces the OOBE flow into using the enterprise provisioning page without making the user interact with the Windows button. This is the default setting.
-
-When set to **False**, it does not force the OOBE flow to the enterprise provisioning page.
-
-
diff --git a/windows/configuration/wcd/wcd-personalization.md b/windows/configuration/wcd/wcd-personalization.md
index 08af869bd0..18b6259bdc 100644
--- a/windows/configuration/wcd/wcd-personalization.md
+++ b/windows/configuration/wcd/wcd-personalization.md
@@ -18,12 +18,12 @@ Use to configure settings to personalize a PC.
## Applies to
-| Setting | Desktop editions | Mobile editions | Surface Hub | HoloLens | IoT Core |
-| --- | :---: | :---: | :---: | :---: | :---: |
-| [DeployDesktopImage](#deploydesktopimage) | ✔️ | | | | |
-| [DeployLockScreenImage](#deploylockscreenimage) | ✔️ | | | | |
-| [DesktopImageUrl](#desktopimageurl) | ✔️ | | | | |
-| [LockScreenImageUrl](#lockscreenimageurl) | ✔️ | | | | |
+| Setting | Windows client | Surface Hub | HoloLens | IoT Core |
+| --- | :---: | :---: | :---: | :---: |
+| [DeployDesktopImage](#deploydesktopimage) | ✔️ | | | |
+| [DeployLockScreenImage](#deploylockscreenimage) | ✔️ | | | |
+| [DesktopImageUrl](#desktopimageurl) | ✔️ | | | |
+| [LockScreenImageUrl](#lockscreenimageurl) | ✔️ | | | |
## DeployDesktopImage
diff --git a/windows/configuration/wcd/wcd-policies.md b/windows/configuration/wcd/wcd-policies.md
index 1d9c4d1eee..f7629487bb 100644
--- a/windows/configuration/wcd/wcd-policies.md
+++ b/windows/configuration/wcd/wcd-policies.md
@@ -18,315 +18,316 @@ This section describes the **Policies** settings that you can configure in [prov
## AboveLock
-| Setting | Description | Desktop editions | Mobile editions | Surface Hub | HoloLens | IoT Core |
-| --- | --- | :---: | :---: | :---: | :---: | :---: |
-| [AllowActionCenterNotifications](/windows/client-management/mdm/policy-configuration-service-provider#abovelock-allowactioncenternotifications) | Allow Action Center notifications above the device lock screen. | | ✔️ | | | |
-| [AllowToasts](/windows/client-management/mdm/policy-configuration-service-provider#abovelock-allowtoasts) | Allow toast notifications above the device lock screen. | ✔️ | ✔️ | | | |
+| Setting | Description | Windows client | Surface Hub | HoloLens | IoT Core |
+| --- | --- | :---: | :---: | :---: | :---: |
+| [AllowActionCenterNotifications](/windows/client-management/mdm/policy-configuration-service-provider#abovelock-allowactioncenternotifications) | Allow Action Center notifications above the device lock screen. | | | | |
+| [AllowToasts](/windows/client-management/mdm/policy-configuration-service-provider#abovelock-allowtoasts) | Allow toast notifications above the device lock screen. | ✔️ | | | |
## Accounts
-| Setting | Description | Desktop editions | Mobile editions | Surface Hub | HoloLens | IoT Core |
-| --- | --- | :---: | :---: | :---: | :---: | :---: |
-| [AllowAddingNonMicrosoftAccountManually](/windows/client-management/mdm/policy-configuration-service-provider#accounts-allowaddingnonmicrosoftaccountsmanually) | Whether users can add non-Microsoft email accounts | ✔️ | ✔️ | | | |
-| [AllowMicrosoftAccountConnection](/windows/client-management/mdm/policy-configuration-service-provider#accounts-allowmicrosoftaccountconnection) | Whether users can use a Microsoft account for non-email-related connection authentication and services | ✔️ | ✔️ | | ✔️ | |
-| [AllowMicrosoftAccountSigninAssistant](/windows/client-management/mdm/policy-configuration-service-provider#accounts-allowmicrosoftaccountsigninassistant) | Disable the **Microsoft Account Sign-In Assistant** (wlidsvc) NT service | ✔️ | ✔️ | | | |
-| [DomainNamesForEmailSync](/windows/client-management/mdm/policy-configuration-service-provider#accounts-domainnamesforemailsync) | List of domains that are allowed to sync email on the devices | ✔️ | ✔️ | | | |
+| Setting | Description | Windows client | Surface Hub | HoloLens | IoT Core |
+| --- | --- | :---: | :---: | :---: | :---: |
+| [AllowAddingNonMicrosoftAccountManually](/windows/client-management/mdm/policy-configuration-service-provider#accounts-allowaddingnonmicrosoftaccountsmanually) | Whether users can add non-Microsoft email accounts | ✔️ | | | |
+| [AllowMicrosoftAccountConnection](/windows/client-management/mdm/policy-configuration-service-provider#accounts-allowmicrosoftaccountconnection) | Whether users can use a Microsoft account for non-email-related connection authentication and services | ✔️ | | ✔️ | |
+| [AllowMicrosoftAccountSigninAssistant](/windows/client-management/mdm/policy-configuration-service-provider#accounts-allowmicrosoftaccountsigninassistant) | Disable the **Microsoft Account Sign-In Assistant** (wlidsvc) NT service | ✔️ | | | |
+| [DomainNamesForEmailSync](/windows/client-management/mdm/policy-configuration-service-provider#accounts-domainnamesforemailsync) | List of domains that are allowed to sync email on the devices | ✔️ | | | |
## ApplicationDefaults
-| Setting | Description | Desktop editions | Mobile editions | Surface Hub | HoloLens | IoT Core |
-| --- | --- | :---: | :---: | :---: | :---: | :---: |
-| [DefaultAssociationsConfiguration](/windows/client-management/mdm/policy-configuration-service-provider#applicationdefaults-defaultassociationsconfiguration) | Set default file type and protocol associations | ✔️ | | | | |
+| Setting | Description | Windows client | Surface Hub | HoloLens | IoT Core |
+| --- | --- | :---: | :---: | :---: | :---: |
+| [DefaultAssociationsConfiguration](/windows/client-management/mdm/policy-configuration-service-provider#applicationdefaults-defaultassociationsconfiguration) | Set default file type and protocol associations | ✔️ | | | |
## ApplicationManagement
-| Setting | Description | Desktop editions | Mobile editions | Surface Hub | HoloLens | IoT Core |
-| --- | --- | :---: | :---: | :---: | :---: | :---: |
-| [AllowAllTrustedApps](/windows/client-management/mdm/policy-configuration-service-provider#applicationmanagement-allowalltrustedapps) | Whether non-Microsoft Store apps are allowed | ✔️ | ✔️ | | | ✔️ |
-| [AllowAppStoreAutoUpdate](/windows/client-management/mdm/policy-configuration-service-provider#applicationmanagement-allowappstoreautoupdate) | Whether automatic update of apps from Microsoft Store is allowed | ✔️ | ✔️ | | | ✔️ |
-| [AllowDeveloperUnlock](/windows/client-management/mdm/policy-configuration-service-provider#applicationmanagement-allowdeveloperunlock) | Whether developer unlock of device is allowed | ✔️ | ✔️ | ✔️ | ✔️ | ✔️ |
-| [AllowGameDVR](/windows/client-management/mdm/policy-configuration-service-provider#applicationmanagement-allowgamedvr) |Whether DVR and broadcasting is allowed | ✔️ | | | | |
-| [AllowSharedUserAppData](/windows/client-management/mdm/policy-configuration-service-provider#applicationmanagement-allowshareduserappdata) | Whether multiple users of the same app can share data | ✔️ | ✔️ | | | |
-| [AllowStore](/windows/client-management/mdm/policy-configuration-service-provider#applicationmanagement-allowstore) | Whether app store is allowed at device | | ✔️ | | | |
-| [ApplicationRestrictions](/windows/client-management/mdm/policy-configuration-service-provider#applicationmanagement-applicationrestrictions) | An XML blob that specifies app restrictions, such as an allow list, disallow list, etc. | | ✔️ | | | |
-| [LaunchAppAfterLogOn](/windows/client-management/mdm/policy-configuration-service-provider#applicationmanagement-launchappafterlogon) |Whether to launch an app or apps when the user signs in. | ✔️ | | | | |
-| [RestrictAppDataToSystemVolume](/windows/client-management/mdm/policy-configuration-service-provider#applicationmanagement-restrictappdatatosystemvolume) | Whether app data is restricted to the system drive | ✔️ | ✔️ | | | ✔️ |
-| [RestrictAppToSystemVolume](/windows/client-management/mdm/policy-configuration-service-provider#applicationmanagement-restrictapptosystemvolume) | Whether the installation of apps is restricted to the system drive | ✔️ | ✔️ | | | ✔️ |
+| Setting | Description | Windows client | Surface Hub | HoloLens | IoT Core |
+| --- | --- | :---: | :---: | :---: | :---: |
+| [AllowAllTrustedApps](/windows/client-management/mdm/policy-configuration-service-provider#applicationmanagement-allowalltrustedapps) | Whether non-Microsoft Store apps are allowed | ✔️ | | | ✔️ |
+| [AllowAppStoreAutoUpdate](/windows/client-management/mdm/policy-configuration-service-provider#applicationmanagement-allowappstoreautoupdate) | Whether automatic update of apps from Microsoft Store is allowed | ✔️ | | | ✔️ |
+| [AllowDeveloperUnlock](/windows/client-management/mdm/policy-configuration-service-provider#applicationmanagement-allowdeveloperunlock) | Whether developer unlock of device is allowed | ✔️ | ✔️ | ✔️ | ✔️ |
+| [AllowGameDVR](/windows/client-management/mdm/policy-configuration-service-provider#applicationmanagement-allowgamedvr) |Whether DVR and broadcasting is allowed | ✔️ | | | |
+| [AllowSharedUserAppData](/windows/client-management/mdm/policy-configuration-service-provider#applicationmanagement-allowshareduserappdata) | Whether multiple users of the same app can share data | ✔️ | | | |
+| [AllowStore](/windows/client-management/mdm/policy-configuration-service-provider#applicationmanagement-allowstore) | Whether app store is allowed at device | | | | |
+| [ApplicationRestrictions](/windows/client-management/mdm/policy-configuration-service-provider#applicationmanagement-applicationrestrictions) | An XML blob that specifies app restrictions, such as an allow list, disallow list, etc. | | | | |
+| [LaunchAppAfterLogOn](/windows/client-management/mdm/policy-configuration-service-provider#applicationmanagement-launchappafterlogon) |Whether to launch an app or apps when the user signs in. | ✔️ | | | |
+| [RestrictAppDataToSystemVolume](/windows/client-management/mdm/policy-configuration-service-provider#applicationmanagement-restrictappdatatosystemvolume) | Whether app data is restricted to the system drive | ✔️ | | | ✔️ |
+| [RestrictAppToSystemVolume](/windows/client-management/mdm/policy-configuration-service-provider#applicationmanagement-restrictapptosystemvolume) | Whether the installation of apps is restricted to the system drive | ✔️ | | | ✔️ |
## Authentication
-| Setting | Description | Desktop editions | Mobile editions | Surface Hub | HoloLens | IoT Core |
-| --- | --- | :---: | :---: | :---: | :---: | :---: |
-| [AllowFastReconnect](/windows/client-management/mdm/policy-csp-authentication#authentication-allowfastreconnect) | Allows EAP Fast Reconnect from being attempted for EAP Method TLS. | ✔️ | ✔️ | ✔️ | ✔️ | ✔️ |
-| [EnableFastFirstSignin](/windows/client-management/mdm/policy-csp-authentication#authentication-enablefastfirstsignin) | Enables a quick first sign-in experience for a user by automatically connecting new non-admin Azure AD accounts to the pre-configured candidate local accounts. | ✔️ | ✔️ | ✔️ | | ✔️ |
-| [EnableWebSignin](/windows/client-management/mdm/policy-csp-authentication#authentication-enablewebsignin) | Enables Windows logon support for non-ADFS federated providers (e.g. SAML). | ✔️ | ✔️ | ✔️ | | ✔️ |
-| [PreferredAadTenantDomainName](/windows/client-management/mdm/policy-csp-authentication#authentication-preferredaadtenantdomainname) | Specifies the preferred domain among available domains in the Azure AD tenant. | ✔️ | ✔️ | ✔️ | | ✔️ |
+| Setting | Description | Windows client | Surface Hub | HoloLens | IoT Core |
+| --- | --- | :---: | :---: | :---: | :---: |
+| [AllowFastReconnect](/windows/client-management/mdm/policy-csp-authentication#authentication-allowfastreconnect) | Allows EAP Fast Reconnect from being attempted for EAP Method TLS. | ✔️ | ✔️ | ✔️ | ✔️ |
+| [EnableFastFirstSignin](/windows/client-management/mdm/policy-csp-authentication#authentication-enablefastfirstsignin) | Enables a quick first sign-in experience for a user by automatically connecting new non-admin Azure AD accounts to the pre-configured candidate local accounts. | ✔️ | ✔️ | | ✔️ |
+| [EnableWebSignin](/windows/client-management/mdm/policy-csp-authentication#authentication-enablewebsignin) | Enables Windows logon support for non-ADFS federated providers (e.g. SAML). | ✔️ | ✔️ | | ✔️ |
+| [PreferredAadTenantDomainName](/windows/client-management/mdm/policy-csp-authentication#authentication-preferredaadtenantdomainname) | Specifies the preferred domain among available domains in the Azure AD tenant. | ✔️ | ✔️ | | ✔️ |
## BitLocker
-| Setting | Description | Desktop editions | Mobile editions | Surface Hub | HoloLens | IoT Core |
-| --- | --- | :---: | :---: | :---: | :---: | :---: |
-| [EncryptionMethod](/windows/client-management/mdm/policy-configuration-service-provider#bitlocker-encryptionmethod) | Specify BitLocker drive encryption method and cipher strength | ✔️ | ✔️ | | | |
+| Setting | Description | Windows client | Surface Hub | HoloLens | IoT Core |
+| --- | --- | :---: | :---: | :---: | :---: |
+| [EncryptionMethod](/windows/client-management/mdm/policy-configuration-service-provider#bitlocker-encryptionmethod) | Specify BitLocker drive encryption method and cipher strength | ✔️ | | | |
## Bluetooth
-| Setting | Description | Desktop editions | Mobile editions | Surface Hub | HoloLens | IoT Core |
-| --- | --- | :---: | :---: | :---: | :---: | :---: |
-| [AllowAdvertising](/windows/client-management/mdm/policy-configuration-service-provider#bluetooth-allowadvertising) | Whether the device can send out Bluetooth advertisements | ✔️ | ✔️ | ✔️ | ✔️ | ✔️ |
-| [AllowDiscoverableMode](/windows/client-management/mdm/policy-configuration-service-provider#bluetooth-allowdiscoverablemode) | Whether other Bluetooth-enabled devices can discover the device | ✔️ | ✔️ | ✔️ | ✔️ | ✔️ |
-| [AllowPrepairing](/windows/client-management/mdm/policy-configuration-service-provider#bluetooth-allowprepairing) | Whether to allow specific bundled Bluetooth peripherals to automatically pair with the host device | ✔️ | ✔️ | ✔️ | ✔️ | ✔️ |
-| AllowPromptedProximalConnections | Whether Windows will prompt users when Bluetooth devices that are connectable are in range of the user's device | ✔️ | ✔️ | ✔️ | ✔️ | ✔️ |
-| [LocalDeviceName](/windows/client-management/mdm/policy-configuration-service-provider#bluetooth-localdevicename) | Set the local Bluetooth device name | ✔️ | ✔️ | ✔️ | ✔️ | ✔️ |
-| [ServicesAllowedList](/windows/client-management/mdm/policy-configuration-service-provider#bluetooth-servicesallowedlist) | Set a list of allowable services and profiles | ✔️ | ✔️ | ✔️ | ✔️ | ✔️ |
+| Setting | Description | Windows client | Surface Hub | HoloLens | IoT Core |
+| --- | --- | :---: | :---: | :---: | :---: |
+| [AllowAdvertising](/windows/client-management/mdm/policy-configuration-service-provider#bluetooth-allowadvertising) | Whether the device can send out Bluetooth advertisements | ✔️ | ✔️ | ✔️ | ✔️ |
+| [AllowDiscoverableMode](/windows/client-management/mdm/policy-configuration-service-provider#bluetooth-allowdiscoverablemode) | Whether other Bluetooth-enabled devices can discover the device | ✔️ | ✔️ | ✔️ | ✔️ |
+| [AllowPrepairing](/windows/client-management/mdm/policy-configuration-service-provider#bluetooth-allowprepairing) | Whether to allow specific bundled Bluetooth peripherals to automatically pair with the host device | ✔️ | ✔️ | ✔️ | ✔️ |
+| AllowPromptedProximalConnections | Whether Windows will prompt users when Bluetooth devices that are connectable are in range of the user's device | ✔️ | ✔️ | ✔️ | ✔️ |
+| [LocalDeviceName](/windows/client-management/mdm/policy-configuration-service-provider#bluetooth-localdevicename) | Set the local Bluetooth device name | ✔️ | ✔️ | ✔️ | ✔️ |
+| [ServicesAllowedList](/windows/client-management/mdm/policy-configuration-service-provider#bluetooth-servicesallowedlist) | Set a list of allowable services and profiles | ✔️ | ✔️ | ✔️ | ✔️ |
## Browser
-| Setting | Description | Desktop editions | Mobile editions | Surface Hub | HoloLens | IoT Core |
-| --- | --- | :---: | :---: | :---: | :---: | :---: |
-| [AllowAddressBarDropdown](/windows/client-management/mdm/policy-configuration-service-provider#browser-allowaddressbardropdown) | Specify whether to allow the address bar drop-down functionality in Microsoft Edge. If you want to minimize network connections from Microsoft Edge to Microsoft services, we recommend disabling this functionality. | ✔️ | | | | |
-| [AllowAutofill](/windows/client-management/mdm/policy-configuration-service-provider#browser-allowautofill) | Specify whether autofill on websites is allowed. | ✔️ | ✔️ | ✔️ | | ✔️ |
-| [AllowBrowser](/windows/client-management/mdm/policy-configuration-service-provider#browser-allowbrowser) | Specify whether the browser is allowed on the device (for Windows 10, version 1803 and earlier only). | ✔️ | ✔️ | | | |
-[AllowConfigurationUpdateForBooksLibrary](/windows/client-management/mdm/policy-csp-browser#browser-allowconfigurationupdateforbookslibrary) | Specify whether Microsoft Edge can automatically update the configuration data for the Books Library. | ✔️ | ✔️ | | | |
-| [AllowCookies](/windows/client-management/mdm/policy-configuration-service-provider#browser-allowcookies) | Specify whether cookies are allowed. | ✔️ | ✔️ | ✔️ | | ✔️ |
-| [AllowDeveloperTools](/windows/client-management/mdm/policy-configuration-service-provider#browser-allowdevelopertools) | Specify whether employees can use F12 Developer Tools on Microsoft Edge. | ✔️ | | | | |
-| [AllowDoNotTrack](/windows/client-management/mdm/policy-configuration-service-provider#browser-allowdonottrack) | Specify whether Do Not Track headers are allowed. | ✔️ | ✔️ | ✔️ | | ✔️ |
-| [AllowExtensions](/windows/client-management/mdm/policy-configuration-service-provider#browser-allowextensions) | Specify whether Microsoft Edge extensions are allowed. | ✔️ | | | | |
-| [AllowFlash](/windows/client-management/mdm/policy-configuration-service-provider#browser-allowflash) | Specify whether Adobe Flash can run in Microsoft Edge. | ✔️ | | | | |
-| [AllowFlashClickToRun](/windows/client-management/mdm/policy-configuration-service-provider#browser-allowflashclicktorun) | Specify whether users must take an action, such as clicking the content or a Click-to-Run button, before seeing content in Adobe Flash. | ✔️ | | | | |
-| [AllowFullScreenMode](/windows/client-management/mdm/policy-configuration-service-provider#browser-allowfullscreenmode) | Specify whether full-screen mode is allowed. | ✔️ | ✔️ | ✔️ | | ✔️ |
-| [AllowInPrivate](/windows/client-management/mdm/policy-configuration-service-provider#browser-allowinprivate) | Specify whether InPrivate browsing is allowed on corporate networks. | ✔️ | ✔️ | ✔️ | | ✔️ |
-| [AllowMicrosoftCompatibilityList](/windows/client-management/mdm/policy-configuration-service-provider#browser-allowmicrosoftcompatibilitylist) | Specify whether to use the Microsoft compatibility list in Microsoft Edge. | ✔️ | ✔️ | ✔️ | | ✔️ |
-| [AllowPasswordManager](/windows/client-management/mdm/policy-configuration-service-provider#browser-allowpasswordmanager) | Specify whether saving and managing passwords locally on the device is allowed. | ✔️ | ✔️ | ✔️ | | ✔️ |
-| [AllowPopups](/windows/client-management/mdm/policy-configuration-service-provider#browser-allowpopups) | Specify whether pop-up blocker is allowed or enabled. | ✔️ | | | ✔️ | |
-| [AllowPrelaunch](/windows/client-management/mdm/policy-csp-browser#browser-allowprelaunch) | Specify whether Microsoft Edge can pre-launch as a background process during Windows startup when the system is idle waiting to be launched by the user. | ✔️ | | | | |
-| [AllowPrinting](/windows/client-management/mdm/policy-csp-browser#browser-allowprinting) | Specify whether users can print web content in Microsoft Edge. | ✔️ | ✔️ | ✔️ | | ✔️ |
-| [AllowSavingHistory](/windows/client-management/mdm/policy-csp-browser#browser-allowsavinghistory) | Specify whether Microsoft Edge saves the browsing history. | ✔️ | | | | |
-| [AllowSearchEngineCustomization](/windows/client-management/mdm/policy-configuration-service-provider#browser-allowsearchenginecustomization) | Allow search engine customization for MDM-enrolled devices. | ✔️ | ✔️ | ✔️ | | ✔️ |
-| [AllowSearchSuggestionsinAddressBar](/windows/client-management/mdm/policy-configuration-service-provider#browser-allowsearchsuggestionsinaddressbar) | Specify whether search suggestions are allowed in the address bar. | ✔️ | ✔️ | ✔️ | | ✔️ |
-| [AllowSideloadingOfExtensions](/windows/client-management/mdm/policy-csp-browser#browser-allowsideloadingofextensions) | Specify whether extensions can be sideloaded in Microsoft Edge. | ✔️ | | | | |
-| [AllowSmartScreen](/windows/client-management/mdm/policy-configuration-service-provider#browser-allowsmartscreen) | Specify whether Windows Defender SmartScreen is allowed. | ✔️ | ✔️ | ✔️ | ✔️ | ✔️ |
-| [AllowTabPreloading](/windows/client-management/mdm/policy-csp-browser#browser-allowtabpreloading) | Specify whether preloading the Start and New tab pages during Windows sign-in is allowed. | ✔️ | | | | |
-| [AllowWebContentOnNewTabPage](/windows/client-management/mdm/policy-csp-browser#browser-allowwebcontentonnewtabpage) | Specify whether a New tab page opens with the default content or a blank page. | ✔️ | ✔️ | ✔️ | | ✔️ |
-[AlwaysEnableBooksLibrary](/windows/client-management/mdm/policy-csp-browser#browser-alwaysenablebookslibrary) | Always show the Books Library in Microsoft Edge. | ✔️ | ✔️ | | | |
-| [ClearBrowsingDataOnExit](/windows/client-management/mdm/policy-configuration-service-provider#browser-clearbrowsingdataonexit) | Specify whether to clear browsing data when exiting Microsoft Edge. | ✔️ | | | | |
-| [ConfigureAdditionalSearchEngines](/windows/client-management/mdm/policy-configuration-service-provider#browser-configureadditionalsearchengines) | Allows you to add up to 5 additional search engines for MDM-enrolled devices. | ✔️ | ✔️ | ✔️ | | ✔️ |
-| [ConfigureFavoritesBar](/windows/client-management/mdm/policy-csp-browser#browser-configurefavoritesbar) | Specify whether the Favorites bar is shown or hidden on all pages. | ✔️ | | | | |
-| [ConfigureHomeButton](/windows/client-management/mdm/policy-csp-browser#browser-configurehomebutton) | Configure whether the Home button will be shown, and what should happen when it is selected. You should also configure the [SetHomeButtonURL](/windows/client-management/mdm/policy-csp-browser#browser-sethomebuttonurl) setting. To configure this setting and also allow users to make changes to the Home button, see the [UnlockHomeButton](/windows/client-management/mdm/policy-csp-browser#browser-unlockhomebutton) setting. | ✔️ | | | | |
-| [ConfigureKioskMode](/windows/client-management/mdm/policy-csp-browser#browser-configurekioskmode) | Configure how Microsoft Edge operates when it's running in kiosk mode, either as a single-app kiosk or as one of multiple apps running on the kiosk device. | ✔️ | | | | |
-| [ConfigureKioskResetAfterIdleTimeout](/windows/client-management/mdm/policy-csp-browser#browser-configurekioskresetafteridletimeout) | Specify the time, in minutes, after which Microsoft Edge running in kiosk mode resets to the default kiosk configuration. | ✔️ | | | | |
-| [ConfigureOpenMicrosoftEdgeWith](/windows/client-management/mdm/policy-csp-browser#browser-configureopenmicrosoftedgewith) | Specify which pages should load when Microsoft Edge opens. You should also configure the [ConfigureStartPages](/windows/client-management/mdm/policy-csp-browser#browser-configurestartpages) setting and [DisableLockdownOfStartPages](/windows/client-management/mdm/policy-configuration-service-provider#browser-disablelockdownofstartpages) setting. | ✔️ | | | | |
-| [ConfigureTelemetryForMicrosoft365Analytics](/windows/client-management/mdm/policy-csp-browser#browser-configuretelemetryformicrosoft365analytics) | Specify whether to send Microsoft Edge browsing history data to Microsoft 365 Analytics. | ✔️ | | | | |
-| [DisableLockdownOfStartPages](/windows/client-management/mdm/policy-configuration-service-provider#browser-disablelockdownofstartpages) | Specify whether the lockdown on the Start pages is disabled. | ✔️ | | | | |
-[EnableExtendedBooksTelemetry](/windows/client-management/mdm/policy-csp-browser#browser-enableextendedbookstelemetry) | Enable this setting to send additional diagnostic data, on top of the basic diagnostic data, from the Books tab. | ✔️ | ✔️ | | | |
-| [EnterpriseModeSiteList](/windows/client-management/mdm/policy-configuration-service-provider#browser-enterprisemodesitelist) | Allow the user to specify a URL of an enterprise site list. | ✔️ | | | | |
-| [EnterpriseSiteListServiceUrl](/windows/client-management/mdm/policy-csp-browser#browser-enterprisesitelistserviceurl) | This policy (introduced in Windows 10, version 1507) was deprecated in Windows 10, version 1511 by [Browser/EnterpriseModeSiteList](/windows/client-management/mdm/policy-configuration-service-provider#browser-enterprisemodesitelist). | ✔️ | | | | |
-| [FirstRunURL](/windows/client-management/mdm/policy-configuration-service-provider#browser-firstrunurl) | Specify the URL that Microsoft Edge will use when it is opened for the first time. | ✔️ | ✔️ | | | |
-| [HomePages](/windows/client-management/mdm/policy-configuration-service-provider#browser-homepages) | Specify your Start pages for MDM-enrolled devices. | ✔️ | | | | |
-[LockdownFavorites](/windows/client-management/mdm/policy-csp-browser#browser-lockdownfavorites) | Configure whether employees can add, import, sort, or edit the Favorites list in Microsoft Edge. | ✔️ | ✔️ | | | |
-| [PreventAccessToAboutFlagsInMicrosoftEdge](/windows/client-management/mdm/policy-configuration-service-provider#browser-preventaccesstoaboutflagsinmicrosoftedge) | Specify whether users can access the **about:flags** page, which is used to change developer settings and to enable experimental features. | ✔️ | ✔️ | ✔️ | | ✔️ |
-| [PreventCertErrorOverrides](/windows/client-management/mdm/policy-csp-browser#browser-preventcerterroroverrides) | Specify whether to override security warnings about sites that have SSL errors. | ✔️ | ✔️ | ✔️ | | ✔️ |
-| [PreventFirstRunPage](/windows/client-management/mdm/policy-configuration-service-provider#browser-preventfirstrunpage) | Specify whether to enable or disable the First Run webpage. | ✔️ | | | | |
-| [PreventLiveTileDataCollection](/windows/client-management/mdm/policy-configuration-service-provider#browser-preventlivetiledatacollection) | Specify whether Microsoft can collect information to create a Live Tile when pinning a site to Start from Microsoft Edge. | ✔️ | ✔️ | ✔️ | | ✔️ |
-| [PreventSmartScreenPromptOverride](/windows/client-management/mdm/policy-configuration-service-provider#browser-preventsmartscreenpromptoverride) | Specify whether users can override the Windows Defender SmartScreen warnings about potentially malicious websites. | ✔️ | ✔️ | ✔️ | | ✔️ |
-| [PreventSmartScreenPromptOverrideForFiles](/windows/client-management/mdm/policy-configuration-service-provider#browser-preventsmartscreenpromptoverrideforfiles) | Specify whether users can override the Windows Defender SmartScreen warnings about downloading unverified files. | ✔️ | ✔️ | ✔️ | | ✔️ |
-PreventTabPreloading | Prevent Microsoft Edge from starting and loading the Start and New Tab page at Windows startup and each time Microsoft Edge is closed. Applies to Windows 10, version 1803 and earlier only. | ✔️ | | | | |
-| [PreventTurningOffRequiredExtensions](/windows/client-management/mdm/policy-configuration-service-provider#browser-forceenabledextensions) | Enter a list of extensions in Microsoft Edge that users cannot turn off, using a semi-colon delimited list of extension package family names. | ✔️ | | | | |
-| [PreventUsingLocalHostIPAddressForWebRTC](/windows/client-management/mdm/policy-configuration-service-provider#browser-preventusinglocalhostipaddressforwebrtc) | Specify whether a user's localhost IP address is displayed while making phone calls using the WebRTC protocol. | ✔️ | ✔️ | ✔️ | | ✔️ |
-[ProvisionFavorites](/windows/client-management/mdm/policy-csp-browser#browser-provisionfavorites) | Configure a default set of favorites which will appear for employees. | ✔️ | ✔️ | | | |
-| [SendIntranetTraffictoInternetExplorer](/windows/client-management/mdm/policy-configuration-service-provider#browser-sendintranettraffictointernetexplorer) | Specify whether to send intranet traffic to Internet Explorer. | ✔️ | | | | |
-| [SetDefaultSearchEngine](/windows/client-management/mdm/policy-configuration-service-provider#browser-setdefaultsearchengine) | Configure the default search engine for your employees. | ✔️ | ✔️ | ✔️ | | ✔️ |
-| [SetHomeButtonURL](/windows/client-management/mdm/policy-csp-browser#browser-sethomebuttonurl) | Specify a custom URL for the Home button. You should also enable the [ConfigureHomeButton](/windows/client-management/mdm/policy-csp-browser#browser-configurehomebutton) setting and select the **Show the home button; clicking the home button loads a specific URL** option. | ✔️ | | | | |
-| [SetNewTabPageURL](/windows/client-management/mdm/policy-csp-browser#browser-setnewtabpageurl) | Specify a custom URL for a New tab page. | ✔️ | | | | |
-| [ShowMessageWhenOpeningSitesInInternetExplorer](/windows/client-management/mdm/policy-configuration-service-provider#browser-showmessagewhenopeningsitesininternetexplorer) | Specify whether users should see a full interstitial page in Microsoft Edge when opening sites that are configured to open in Internet Explorer using the Enterprise Site list. | ✔️ | | | | |
-| [SyncFavoritesBetweenIEAndMicrosoftEdge](/windows/client-management/mdm/policy-configuration-service-provider#browser-syncfavoritesbetweenieandmicrosoftedge) | Specify whether favorites are kept in sync between Internet Explorer and Microsoft Edge. | ✔️ | | | | |
-| [UnlockHomeButton](/windows/client-management/mdm/policy-csp-browser#browser-unlockhomebutton) | Specify whether users can make changes to the Home button. | ✔️ | | | | |
-[UseSharedFolderForBooks](/windows/client-management/mdm/policy-csp-browser#browser-usesharedfolderforbooks) | Specify whether organizations should use a folder shared across users to store books from the Books Library. | ✔️ | ✔️ | | | |
+| Setting | Description | Windows client | Surface Hub | HoloLens | IoT Core |
+| --- | --- | :---: | :---: | :---: | :---: |
+| [AllowAddressBarDropdown](/windows/client-management/mdm/policy-configuration-service-provider#browser-allowaddressbardropdown) | Specify whether to allow the address bar drop-down functionality in Microsoft Edge. If you want to minimize network connections from Microsoft Edge to Microsoft services, we recommend disabling this functionality. | ✔️ | | | |
+| [AllowAutofill](/windows/client-management/mdm/policy-configuration-service-provider#browser-allowautofill) | Specify whether autofill on websites is allowed. | ✔️ | ✔️ | | ✔️ |
+| [AllowBrowser](/windows/client-management/mdm/policy-configuration-service-provider#browser-allowbrowser) | Specify whether the browser is allowed on the device (for Windows 10, version 1803 and earlier only). | ✔️ | | | |
+[AllowConfigurationUpdateForBooksLibrary](/windows/client-management/mdm/policy-csp-browser#browser-allowconfigurationupdateforbookslibrary) | Specify whether Microsoft Edge can automatically update the configuration data for the Books Library. | ✔️ | | | |
+| [AllowCookies](/windows/client-management/mdm/policy-configuration-service-provider#browser-allowcookies) | Specify whether cookies are allowed. | ✔️ | ✔️ | | ✔️ |
+| [AllowDeveloperTools](/windows/client-management/mdm/policy-configuration-service-provider#browser-allowdevelopertools) | Specify whether employees can use F12 Developer Tools on Microsoft Edge. | ✔️ | | | |
+| [AllowDoNotTrack](/windows/client-management/mdm/policy-configuration-service-provider#browser-allowdonottrack) | Specify whether Do Not Track headers are allowed. | ✔️ | ✔️ | | ✔️ |
+| [AllowExtensions](/windows/client-management/mdm/policy-configuration-service-provider#browser-allowextensions) | Specify whether Microsoft Edge extensions are allowed. | ✔️ | | | |
+| [AllowFlash](/windows/client-management/mdm/policy-configuration-service-provider#browser-allowflash) | Specify whether Adobe Flash can run in Microsoft Edge. | ✔️ | | | |
+| [AllowFlashClickToRun](/windows/client-management/mdm/policy-configuration-service-provider#browser-allowflashclicktorun) | Specify whether users must take an action, such as clicking the content or a Click-to-Run button, before seeing content in Adobe Flash. | ✔️ | | | |
+| [AllowFullScreenMode](/windows/client-management/mdm/policy-configuration-service-provider#browser-allowfullscreenmode) | Specify whether full-screen mode is allowed. | ✔️ | ✔️ | | ✔️ |
+| [AllowInPrivate](/windows/client-management/mdm/policy-configuration-service-provider#browser-allowinprivate) | Specify whether InPrivate browsing is allowed on corporate networks. | ✔️ | ✔️ | | ✔️ |
+| [AllowMicrosoftCompatibilityList](/windows/client-management/mdm/policy-configuration-service-provider#browser-allowmicrosoftcompatibilitylist) | Specify whether to use the Microsoft compatibility list in Microsoft Edge. | ✔️ | ✔️ | | ✔️ |
+| [AllowPasswordManager](/windows/client-management/mdm/policy-configuration-service-provider#browser-allowpasswordmanager) | Specify whether saving and managing passwords locally on the device is allowed. | ✔️ | ✔️ | | ✔️ |
+| [AllowPopups](/windows/client-management/mdm/policy-configuration-service-provider#browser-allowpopups) | Specify whether pop-up blocker is allowed or enabled. | ✔️ | | ✔️ | |
+| [AllowPrelaunch](/windows/client-management/mdm/policy-csp-browser#browser-allowprelaunch) | Specify whether Microsoft Edge can pre-launch as a background process during Windows startup when the system is idle waiting to be launched by the user. | ✔️ | | | |
+| [AllowPrinting](/windows/client-management/mdm/policy-csp-browser#browser-allowprinting) | Specify whether users can print web content in Microsoft Edge. | ✔️ | ✔️ | | ✔️ |
+| [AllowSavingHistory](/windows/client-management/mdm/policy-csp-browser#browser-allowsavinghistory) | Specify whether Microsoft Edge saves the browsing history. | ✔️ | | | |
+| [AllowSearchEngineCustomization](/windows/client-management/mdm/policy-configuration-service-provider#browser-allowsearchenginecustomization) | Allow search engine customization for MDM-enrolled devices. | ✔️ | ✔️ | | ✔️ |
+| [AllowSearchSuggestionsinAddressBar](/windows/client-management/mdm/policy-configuration-service-provider#browser-allowsearchsuggestionsinaddressbar) | Specify whether search suggestions are allowed in the address bar. | ✔️ | ✔️ | | ✔️ |
+| [AllowSideloadingOfExtensions](/windows/client-management/mdm/policy-csp-browser#browser-allowsideloadingofextensions) | Specify whether extensions can be sideloaded in Microsoft Edge. | ✔️ | | | |
+| [AllowSmartScreen](/windows/client-management/mdm/policy-configuration-service-provider#browser-allowsmartscreen) | Specify whether Windows Defender SmartScreen is allowed. | ✔️ | ✔️ | ✔️ | ✔️ |
+| [AllowTabPreloading](/windows/client-management/mdm/policy-csp-browser#browser-allowtabpreloading) | Specify whether preloading the Start and New tab pages during Windows sign-in is allowed. | ✔️ | | | |
+| [AllowWebContentOnNewTabPage](/windows/client-management/mdm/policy-csp-browser#browser-allowwebcontentonnewtabpage) | Specify whether a New tab page opens with the default content or a blank page. | ✔️ | ✔️ | | ✔️ |
+[AlwaysEnableBooksLibrary](/windows/client-management/mdm/policy-csp-browser#browser-alwaysenablebookslibrary) | Always show the Books Library in Microsoft Edge. | ✔️ | | | |
+| [ClearBrowsingDataOnExit](/windows/client-management/mdm/policy-configuration-service-provider#browser-clearbrowsingdataonexit) | Specify whether to clear browsing data when exiting Microsoft Edge. | ✔️ | | | |
+| [ConfigureAdditionalSearchEngines](/windows/client-management/mdm/policy-configuration-service-provider#browser-configureadditionalsearchengines) | Allows you to add up to 5 additional search engines for MDM-enrolled devices. | ✔️ | ✔️ | | ✔️ |
+| [ConfigureFavoritesBar](/windows/client-management/mdm/policy-csp-browser#browser-configurefavoritesbar) | Specify whether the Favorites bar is shown or hidden on all pages. | ✔️ | | | |
+| [ConfigureHomeButton](/windows/client-management/mdm/policy-csp-browser#browser-configurehomebutton) | Configure whether the Home button will be shown, and what should happen when it is selected. You should also configure the [SetHomeButtonURL](/windows/client-management/mdm/policy-csp-browser#browser-sethomebuttonurl) setting. To configure this setting and also allow users to make changes to the Home button, see the [UnlockHomeButton](/windows/client-management/mdm/policy-csp-browser#browser-unlockhomebutton) setting. | ✔️ | | | |
+| [ConfigureKioskMode](/windows/client-management/mdm/policy-csp-browser#browser-configurekioskmode) | Configure how Microsoft Edge operates when it's running in kiosk mode, either as a single-app kiosk or as one of multiple apps running on the kiosk device. | ✔️ | | | |
+| [ConfigureKioskResetAfterIdleTimeout](/windows/client-management/mdm/policy-csp-browser#browser-configurekioskresetafteridletimeout) | Specify the time, in minutes, after which Microsoft Edge running in kiosk mode resets to the default kiosk configuration. | ✔️ | | | |
+| [ConfigureOpenMicrosoftEdgeWith](/windows/client-management/mdm/policy-csp-browser#browser-configureopenmicrosoftedgewith) | Specify which pages should load when Microsoft Edge opens. You should also configure the [ConfigureStartPages](/windows/client-management/mdm/policy-csp-browser#browser-configurestartpages) setting and [DisableLockdownOfStartPages](/windows/client-management/mdm/policy-configuration-service-provider#browser-disablelockdownofstartpages) setting. | ✔️ | | | |
+| [ConfigureTelemetryForMicrosoft365Analytics](/windows/client-management/mdm/policy-csp-browser#browser-configuretelemetryformicrosoft365analytics) | Specify whether to send Microsoft Edge browsing history data to Microsoft 365 Analytics. | ✔️ | | | |
+| [DisableLockdownOfStartPages](/windows/client-management/mdm/policy-configuration-service-provider#browser-disablelockdownofstartpages) | Specify whether the lockdown on the Start pages is disabled. | ✔️ | | | |
+[EnableExtendedBooksTelemetry](/windows/client-management/mdm/policy-csp-browser#browser-enableextendedbookstelemetry) | Enable this setting to send additional diagnostic data, on top of the basic diagnostic data, from the Books tab. | ✔️ | ✔️ | | |
+| [EnterpriseModeSiteList](/windows/client-management/mdm/policy-configuration-service-provider#browser-enterprisemodesitelist) | Allow the user to specify a URL of an enterprise site list. | ✔️ | | | |
+| [EnterpriseSiteListServiceUrl](/windows/client-management/mdm/policy-csp-browser#browser-enterprisesitelistserviceurl) | This policy (introduced in Windows 10, version 1507) was deprecated in Windows 10, version 1511 by [Browser/EnterpriseModeSiteList](/windows/client-management/mdm/policy-configuration-service-provider#browser-enterprisemodesitelist). | ✔️ | | | |
+| [FirstRunURL](/windows/client-management/mdm/policy-configuration-service-provider#browser-firstrunurl) | Specify the URL that Microsoft Edge will use when it is opened for the first time. | ✔️ | | | |
+| [HomePages](/windows/client-management/mdm/policy-configuration-service-provider#browser-homepages) | Specify your Start pages for MDM-enrolled devices. | ✔️ | | | |
+[LockdownFavorites](/windows/client-management/mdm/policy-csp-browser#browser-lockdownfavorites) | Configure whether employees can add, import, sort, or edit the Favorites list in Microsoft Edge. | ✔️ | | | |
+| [PreventAccessToAboutFlagsInMicrosoftEdge](/windows/client-management/mdm/policy-configuration-service-provider#browser-preventaccesstoaboutflagsinmicrosoftedge) | Specify whether users can access the **about:flags** page, which is used to change developer settings and to enable experimental features. | ✔️ | ✔️ | | ✔️ |
+| [PreventCertErrorOverrides](/windows/client-management/mdm/policy-csp-browser#browser-preventcerterroroverrides) | Specify whether to override security warnings about sites that have SSL errors. | ✔️ | ✔️ | | ✔️ |
+| [PreventFirstRunPage](/windows/client-management/mdm/policy-configuration-service-provider#browser-preventfirstrunpage) | Specify whether to enable or disable the First Run webpage. | ✔️ | | | |
+| [PreventLiveTileDataCollection](/windows/client-management/mdm/policy-configuration-service-provider#browser-preventlivetiledatacollection) | Specify whether Microsoft can collect information to create a Live Tile when pinning a site to Start from Microsoft Edge. | ✔️ | ✔️ | | ✔️ |
+| [PreventSmartScreenPromptOverride](/windows/client-management/mdm/policy-configuration-service-provider#browser-preventsmartscreenpromptoverride) | Specify whether users can override the Windows Defender SmartScreen warnings about potentially malicious websites. | ✔️ | ✔️ | | ✔️ |
+| [PreventSmartScreenPromptOverrideForFiles](/windows/client-management/mdm/policy-configuration-service-provider#browser-preventsmartscreenpromptoverrideforfiles) | Specify whether users can override the Windows Defender SmartScreen warnings about downloading unverified files. | ✔️ | ✔️ | | ✔️ |
+PreventTabPreloading | Prevent Microsoft Edge from starting and loading the Start and New Tab page at Windows startup and each time Microsoft Edge is closed. Applies to Windows 10, version 1803 and earlier only. | ✔️ | | | |
+| [PreventTurningOffRequiredExtensions](/windows/client-management/mdm/policy-configuration-service-provider#browser-forceenabledextensions) | Enter a list of extensions in Microsoft Edge that users cannot turn off, using a semi-colon delimited list of extension package family names. | ✔️ | | | |
+| [PreventUsingLocalHostIPAddressForWebRTC](/windows/client-management/mdm/policy-configuration-service-provider#browser-preventusinglocalhostipaddressforwebrtc) | Specify whether a user's localhost IP address is displayed while making phone calls using the WebRTC protocol. | ✔️ | ✔️ | | ✔️ |
+[ProvisionFavorites](/windows/client-management/mdm/policy-csp-browser#browser-provisionfavorites) | Configure a default set of favorites which will appear for employees. | ✔️ | | | |
+| [SendIntranetTraffictoInternetExplorer](/windows/client-management/mdm/policy-configuration-service-provider#browser-sendintranettraffictointernetexplorer) | Specify whether to send intranet traffic to Internet Explorer. | ✔️ | | | |
+| [SetDefaultSearchEngine](/windows/client-management/mdm/policy-configuration-service-provider#browser-setdefaultsearchengine) | Configure the default search engine for your employees. | ✔️ | ✔️ | | ✔️ |
+| [SetHomeButtonURL](/windows/client-management/mdm/policy-csp-browser#browser-sethomebuttonurl) | Specify a custom URL for the Home button. You should also enable the [ConfigureHomeButton](/windows/client-management/mdm/policy-csp-browser#browser-configurehomebutton) setting and select the **Show the home button; clicking the home button loads a specific URL** option. | ✔️ | | | |
+| [SetNewTabPageURL](/windows/client-management/mdm/policy-csp-browser#browser-setnewtabpageurl) | Specify a custom URL for a New tab page. | ✔️ | | | |
+| [ShowMessageWhenOpeningSitesInInternetExplorer](/windows/client-management/mdm/policy-configuration-service-provider#browser-showmessagewhenopeningsitesininternetexplorer) | Specify whether users should see a full interstitial page in Microsoft Edge when opening sites that are configured to open in Internet Explorer using the Enterprise Site list. | ✔️ | | | |
+| [SyncFavoritesBetweenIEAndMicrosoftEdge](/windows/client-management/mdm/policy-configuration-service-provider#browser-syncfavoritesbetweenieandmicrosoftedge) | Specify whether favorites are kept in sync between Internet Explorer and Microsoft Edge. | ✔️ | | | |
+| [UnlockHomeButton](/windows/client-management/mdm/policy-csp-browser#browser-unlockhomebutton) | Specify whether users can make changes to the Home button. | ✔️ | | | |
+[UseSharedFolderForBooks](/windows/client-management/mdm/policy-csp-browser#browser-usesharedfolderforbooks) | Specify whether organizations should use a folder shared across users to store books from the Books Library. | ✔️ | | | |
## Camera
-| Setting | Description | Desktop editions | Mobile editions | Surface Hub | HoloLens | IoT Core |
-| --- | --- | :---: | :---: | :---: | :---: | :---: |
-| [AllowCamera](/windows/client-management/mdm/policy-configuration-service-provider#camera-allowcamera) | Disable or enable the camera. | ✔️ | ✔️ | ✔️ | | |
+| Setting | Description | Windows client | Surface Hub | HoloLens | IoT Core |
+| --- | --- | :---: | :---: | :---: | :---: |
+| [AllowCamera](/windows/client-management/mdm/policy-configuration-service-provider#camera-allowcamera) | Disable or enable the camera. | ✔️ | ✔️ | | |
## Connectivity
-| Setting | Description | Desktop editions | Mobile editions | Surface Hub | HoloLens | IoT Core |
-| --- | --- | :---: | :---: | :---: | :---: | :---: |
-| [AllowBluetooth](/windows/client-management/mdm/policy-configuration-service-provider#connectivity-allowbluetooth) | Allow the user to enable Bluetooth or restrict access. | ✔️ | ✔️ | ✔️ | ✔️ | ✔️ |
-| [AllowCellularData](/windows/client-management/mdm/policy-configuration-service-provider#connectivity-allowcellulardata) | Allow the cellular data channel on the device. | ✔️ | ✔️ | ✔️ | | ✔️ |
-| [AllowCellularDataRoaming](/windows/client-management/mdm/policy-configuration-service-provider#connectivity-allowcellulardataroaming) | Allow or disallow cellular data roaming on the device. | ✔️ | ✔️ | ✔️ | | ✔️ |
-| [AllowConnectedDevices](/windows/client-management/mdm/policy-configuration-service-provider#connectivity-allowconnecteddevices) | Allows IT admins the ability to disable the Connected Devices Platform component. | ✔️ | ✔️ | ✔️ | | ✔️ |
-| [AllowNFC](/windows/client-management/mdm/policy-configuration-service-provider#connectivity-allownfc) | Allow or disallow near field communication (NFC) on the device. | | ✔️ | | | ✔️ |
-| [AllowUSBConnection](/windows/client-management/mdm/policy-configuration-service-provider#connectivity-allowusbconnection) | Enable USB connection between the device and a computer to sync files with the device or to use developer tools or to deploy or debug applications. | | ✔️ | | | ✔️ |
-| [AllowVPNOverCellular](/windows/client-management/mdm/policy-configuration-service-provider#connectivity-allowvpnovercellular) | Specify what type of underlyinng connections VPN is allowed to use. |✔️ | ✔️ | ✔️ | | ✔️ |
-| [AllowVPNRoamingOverCellular](/windows/client-management/mdm/policy-configuration-service-provider#connectivity-allowvpnroamingovercellular) | Prevent the device from connecting to VPN when the device roams over cellular networks. | ✔️ | ✔️ | ✔️ | | ✔️ |
-| HideCellularConnectionMode | Hide the checkbox that lets the user change the connection mode. | ✔️ | ✔️ | ✔️ | | ✔️ |
-| HideCellularRoamingOption | Hide the dropdown menu that lets the user change the roaming preferences. | ✔️ | ✔️ | ✔️ | | ✔️ |
+| Setting | Description | Windows client | Surface Hub | HoloLens | IoT Core |
+| --- | --- | :---: | :---: | :---: | :---: |
+| [AllowBluetooth](/windows/client-management/mdm/policy-configuration-service-provider#connectivity-allowbluetooth) | Allow the user to enable Bluetooth or restrict access. | ✔️ | ✔️ | ✔️ | ✔️ |
+| [AllowCellularData](/windows/client-management/mdm/policy-configuration-service-provider#connectivity-allowcellulardata) | Allow the cellular data channel on the device. | ✔️ | ✔️ | | ✔️ |
+| [AllowCellularDataRoaming](/windows/client-management/mdm/policy-configuration-service-provider#connectivity-allowcellulardataroaming) | Allow or disallow cellular data roaming on the device. | ✔️ | ✔️ | | ✔️ |
+| [AllowConnectedDevices](/windows/client-management/mdm/policy-configuration-service-provider#connectivity-allowconnecteddevices) | Allows IT admins the ability to disable the Connected Devices Platform component. | ✔️ | ✔️ | | ✔️ |
+| [AllowNFC](/windows/client-management/mdm/policy-configuration-service-provider#connectivity-allownfc) | Allow or disallow near field communication (NFC) on the device. | | | | ✔️ |
+| [AllowUSBConnection](/windows/client-management/mdm/policy-configuration-service-provider#connectivity-allowusbconnection) | Enable USB connection between the device and a computer to sync files with the device or to use developer tools or to deploy or debug applications. | | | | ✔️ |
+| [AllowVPNOverCellular](/windows/client-management/mdm/policy-configuration-service-provider#connectivity-allowvpnovercellular) | Specify what type of underlying connections VPN is allowed to use. |✔️ | ✔️ | | ✔️ |
+| [AllowVPNRoamingOverCellular](/windows/client-management/mdm/policy-configuration-service-provider#connectivity-allowvpnroamingovercellular) | Prevent the device from connecting to VPN when the device roams over cellular networks. | ✔️ | ✔️ | | ✔️ |
+| HideCellularConnectionMode | Hide the checkbox that lets the user change the connection mode. | ✔️ | ✔️ | | ✔️ |
+| HideCellularRoamingOption | Hide the dropdown menu that lets the user change the roaming preferences. | ✔️ | ✔️ | | ✔️ |
## CredentialProviders
-| Setting | Description | Desktop editions | Mobile editions | Surface Hub | HoloLens | IoT Core |
-| --- | --- | :---: | :---: | :---: | :---: | :---: |
-[DisableAutomaticReDeploymentCredentials](/windows/client-management/mdm/policy-csp-credentialproviders) | This setting disables the visibility of the credential provider that triggers the PC refresh on a device. This policy does not actually trigger the refresh. The admin user is required to authenticate to trigger the refresh on the target device. The Windows 10 Autopilot Reset feature allows admin to reset devices to a known good managed state while preserving the management enrollment. After the automatic redeployment is triggered the devices are for ready for use by information workers or students. | ✔️ | | | | |
+| Setting | Description | Windows client | Surface Hub | HoloLens | IoT Core |
+| --- | --- | :---: | :---: | :---: | :---: |
+[DisableAutomaticReDeploymentCredentials](/windows/client-management/mdm/policy-csp-credentialproviders) | This setting disables the visibility of the credential provider that triggers the PC refresh on a device. This policy does not actually trigger the refresh. The admin user is required to authenticate to trigger the refresh on the target device. The Windows 10 Autopilot Reset feature allows admin to reset devices to a known good managed state while preserving the management enrollment. After the automatic redeployment is triggered the devices are for ready for use by information workers or students. | ✔️ | | | |
## Cryptography
-| Setting | Description | Desktop editions | Mobile editions | Surface Hub | HoloLens | IoT Core |
-| --- | --- | :---: | :---: | :---: | :---: | :---: |
-| [AllowFipsAlgorithmPolicy](/windows/client-management/mdm/policy-configuration-service-provider#cryptography-allowfipsalgorithmpolicy) | Allow or disallow the Federal Information Processing Standard (FIPS) policy. | ✔️ | ✔️ | | | |
-| [TLSCiperSuites](/windows/client-management/mdm/policy-configuration-service-provider#cryptography-tlsciphersuites) | List the Cryptographic Cipher Algorithms allowed for SSL connections. Format is a semicolon delimited list. Last write win. | ✔️ | ✔️ | | | |
+| Setting | Description | Windows client | Surface Hub | HoloLens | IoT Core |
+| --- | --- | :---: | :---: | :---: | :---: |
+| [AllowFipsAlgorithmPolicy](/windows/client-management/mdm/policy-configuration-service-provider#cryptography-allowfipsalgorithmpolicy) | Allow or disallow the Federal Information Processing Standard (FIPS) policy. | ✔️ | | | |
+| [TLSCiperSuites](/windows/client-management/mdm/policy-configuration-service-provider#cryptography-tlsciphersuites) | List the Cryptographic Cipher Algorithms allowed for SSL connections. Format is a semicolon delimited list. Last write win. | ✔️ | | | |
## Defender
-| Setting | Description | Desktop editions | Mobile editions | Surface Hub | HoloLens | IoT Core |
-| --- | --- | :---: | :---: | :---: | :---: | :---: |
-| [AllowArchiveScanning](/windows/client-management/mdm/policy-configuration-service-provider#defender-allowarchivescanning) | Allow or disallow scanning of archives. | ✔️ | | | | |
-| [AllowBehaviorMonitoring](/windows/client-management/mdm/policy-configuration-service-provider#defender-allowbehaviormonitoring) | Allow or disallow Windows Defender Behavior Monitoring functionality. | ✔️ | | | | |
-| [AllowCloudProtection](/windows/client-management/mdm/policy-configuration-service-provider#defender-allowcloudprotection) | To best protect your PC, Windows Defender will send information to Microsoft about any problems it finds. Microsoft will analyze that information, learn more about problems affecting you and other customers, and offer improved solutions. | ✔️ | | | | |
-| [AllowEmailScanning](/windows/client-management/mdm/policy-configuration-service-provider#defender-allowemailscanning) | Allow or disallow scanning of email. | ✔️ | | | | |
-| [AllowFullScanOnMappedNetworkDrives](/windows/client-management/mdm/policy-configuration-service-provider#defender-allowfullscanonmappednetworkdrives) | Allow or disallow a full scan of mapped network drives. | ✔️ | | | | |
-| [AllowFullScanRemovableDriveScanning](/windows/client-management/mdm/policy-configuration-service-provider#defender-allowfullscanremovabledrivescanning) | Allow or disallow a full scan of removable drives. | ✔️ | | | | |
-| [AllowIOAVProtection](/windows/client-management/mdm/policy-configuration-service-provider#defender-allowioavprotection) | Allow or disallow Windows Defender IOAVP Protection functionality. | ✔️ | | | | |
-| [AllowOnAccessProtection](/windows/client-management/mdm/policy-configuration-service-provider#defender-allowonaccessprotection) | Allow or disallow Windows Defender On Access Protection functionality. | ✔️ | | | | |
-| [AllowRealtimeMonitoring](/windows/client-management/mdm/policy-configuration-service-provider#defender-allowrealtimemonitoring) | Allow or disallow Windows Defender Realtime Monitoring functionality. | ✔️ | | | | |
-| [AllowScanningNetworkFiles](/windows/client-management/mdm/policy-configuration-service-provider#defender-allowscanningnetworkfiles) | Allow or disallow scanning of network files. | ✔️ | | | | |
-| [AllowScriptScanning](/windows/client-management/mdm/policy-configuration-service-provider#defender-allowscriptscanning) | Allow or disallow Windows Defender Script Scanning functionality. | ✔️ | | | | |
-| [AllowUserUIAccess](/windows/client-management/mdm/policy-configuration-service-provider#defender-allowuseruiaccess) | Allow or disallow user access to the Windows Defender UI. | ✔️ | | | | |
-| [AvgCPULoadFactor](/windows/client-management/mdm/policy-configuration-service-provider#defender-avgcpuloadfactor) | Represents the average CPU load factor for the Windows Defeder scan (in percent). | ✔️ | | | | |
-| [DaysToRetainCleanedMalware](/windows/client-management/mdm/policy-configuration-service-provider#defender-daystoretaincleanedmalware) | Specify time period (in days) that quarantine items will be stored on the system. | ✔️ | | | | |
-| [ExcludedExtensions](/windows/client-management/mdm/policy-configuration-service-provider#defender-excludedextensions) | Specify a list of file type extensions to ignore durinng a scan. Separate each file type in the list by using \|. | ✔️ | | | | |
-| [ExcludedPaths](/windows/client-management/mdm/policy-configuration-service-provider#defender-excludedpaths) | Specify a list of directory paths to ignore during a scan. Separate each path in the list by using \|. | ✔️ | | | | |
-| [ExcludedProcesses](/windows/client-management/mdm/policy-configuration-service-provider#defender-excludedprocesses) | Specify a list of files opened by processes to ignore durinng a scan. Separate each file type in the list by using \|. The process itself is not excluded from the scan, but can be excluded by using the [Defender/ExcludedPaths](/windows/client-management/mdm/policy-configuration-service-provider#defender-excludedpaths) policy to exclude its path. | ✔️ | | | | |
-| [RealTimeScanDirection](/windows/client-management/mdm/policy-configuration-service-provider#defender-realtimescandirection) | Control which sets of files should be monitored. | ✔️ | | | | |
-| [ScanParameter](/windows/client-management/mdm/policy-configuration-service-provider#defender-scanparameter) | Select whether to perform a quick scan or full scan. | ✔️ | | | | |
-| [ScheduleQuickScanTime](/windows/client-management/mdm/policy-configuration-service-provider#defender-schedulequickscantime) | Specify the time of day that Windows Defender quick scan should run. | ✔️ | | | | |
-| [ScheduleScanDay](/windows/client-management/mdm/policy-configuration-service-provider#defender-schedulescanday) | Select the day that Windows Defender scan should run. | ✔️ | | | | |
-| [ScheduleScanTime](/windows/client-management/mdm/policy-configuration-service-provider#defender-schedulescantime) | Select the time of day that the Windows Defender scan should run. | ✔️ | | | | |
-| [SignatureUpdateInterval](/windows/client-management/mdm/policy-configuration-service-provider#defender-signatureupdateinterval) | Specify the interval (in hours) that will be used to check for signatures, so instead of using the ScheduleDay and ScheduleTime the check for new signatures will be set according to the interval. | ✔️ | | | | |
-| [SubmitSamplesConsent](/windows/client-management/mdm/policy-configuration-service-provider#defender-submitsamplesconsent) | Checks for the user consent level in Windows Defender to send data. | ✔️ | | | | |
-| [ThreatSeverityDefaultAction](/windows/client-management/mdm/policy-configuration-service-provider#defender-threatseveritydefaultaction) | Specify any valid threat severity levels and the corresponding default action ID to take. | ✔️ | | | | |
+| Setting | Description | Windows client | Surface Hub | HoloLens | IoT Core |
+| --- | --- | :---: | :---: | :---: | :---: |
+| [AllowArchiveScanning](/windows/client-management/mdm/policy-configuration-service-provider#defender-allowarchivescanning) | Allow or disallow scanning of archives. | ✔️ | | | |
+| [AllowBehaviorMonitoring](/windows/client-management/mdm/policy-configuration-service-provider#defender-allowbehaviormonitoring) | Allow or disallow Windows Defender Behavior Monitoring functionality. | ✔️ | | | |
+| [AllowCloudProtection](/windows/client-management/mdm/policy-configuration-service-provider#defender-allowcloudprotection) | To best protect your PC, Windows Defender will send information to Microsoft about any problems it finds. Microsoft will analyze that information, learn more about problems affecting you and other customers, and offer improved solutions. | ✔️ | | | |
+| [AllowEmailScanning](/windows/client-management/mdm/policy-configuration-service-provider#defender-allowemailscanning) | Allow or disallow scanning of email. | ✔️ | | | |
+| [AllowFullScanOnMappedNetworkDrives](/windows/client-management/mdm/policy-configuration-service-provider#defender-allowfullscanonmappednetworkdrives) | Allow or disallow a full scan of mapped network drives. | ✔️ | | | |
+| [AllowFullScanRemovableDriveScanning](/windows/client-management/mdm/policy-configuration-service-provider#defender-allowfullscanremovabledrivescanning) | Allow or disallow a full scan of removable drives. | ✔️ | | | |
+| [AllowIntrusionPreventionSystem](/windows/client-management/mdm/policy-configuration-service-provider#defender-allowintrusionpreventionsystem) | Allow or disallow Windows Defender Intrusion Prevention functionality. | ✔️ | | | |
+| [AllowIOAVProtection](/windows/client-management/mdm/policy-configuration-service-provider#defender-allowioavprotection) | Allow or disallow Windows Defender IOAVP Protection functionality. | ✔️ | | | |
+| [AllowOnAccessProtection](/windows/client-management/mdm/policy-configuration-service-provider#defender-allowonaccessprotection) | Allow or disallow Windows Defender On Access Protection functionality. | ✔️ | | | |
+| [AllowRealtimeMonitoring](/windows/client-management/mdm/policy-configuration-service-provider#defender-allowrealtimemonitoring) | Allow or disallow Windows Defender Realtime Monitoring functionality. | ✔️ | | | |
+| [AllowScanningNetworkFiles](/windows/client-management/mdm/policy-configuration-service-provider#defender-allowscanningnetworkfiles) | Allow or disallow scanning of network files. | ✔️ | | | |
+| [AllowScriptScanning](/windows/client-management/mdm/policy-configuration-service-provider#defender-allowscriptscanning) | Allow or disallow Windows Defender Script Scanning functionality. | ✔️ | | | |
+| [AllowUserUIAccess](/windows/client-management/mdm/policy-configuration-service-provider#defender-allowuseruiaccess) | Allow or disallow user access to the Windows Defender UI. | ✔️ | | | |
+| [AvgCPULoadFactor](/windows/client-management/mdm/policy-configuration-service-provider#defender-avgcpuloadfactor) | Represents the average CPU load factor for the Windows Defender scan (in percent). | ✔️ | | | |
+| [DaysToRetainCleanedMalware](/windows/client-management/mdm/policy-configuration-service-provider#defender-daystoretaincleanedmalware) | Specify time period (in days) that quarantine items will be stored on the system. | ✔️ | | | |
+| [ExcludedExtensions](/windows/client-management/mdm/policy-configuration-service-provider#defender-excludedextensions) | Specify a list of file type extensions to ignore during a scan. Separate each file type in the list by using \|. | ✔️ | | | |
+| [ExcludedPaths](/windows/client-management/mdm/policy-configuration-service-provider#defender-excludedpaths) | Specify a list of directory paths to ignore during a scan. Separate each path in the list by using \|. | ✔️ | | | |
+| [ExcludedProcesses](/windows/client-management/mdm/policy-configuration-service-provider#defender-excludedprocesses) | Specify a list of files opened by processes to ignore during a scan. Separate each file type in the list by using \|. The process itself is not excluded from the scan, but can be excluded by using the [Defender/ExcludedPaths](/windows/client-management/mdm/policy-configuration-service-provider#defender-excludedpaths) policy to exclude its path. | ✔️ | | | |
+| [RealTimeScanDirection](/windows/client-management/mdm/policy-configuration-service-provider#defender-realtimescandirection) | Control which sets of files should be monitored. | ✔️ | | | |
+| [ScanParameter](/windows/client-management/mdm/policy-configuration-service-provider#defender-scanparameter) | Select whether to perform a quick scan or full scan. | ✔️ | | | |
+| [ScheduleQuickScanTime](/windows/client-management/mdm/policy-configuration-service-provider#defender-schedulequickscantime) | Specify the time of day that Windows Defender quick scan should run. | ✔️ | | | |
+| [ScheduleScanDay](/windows/client-management/mdm/policy-configuration-service-provider#defender-schedulescanday) | Select the day that Windows Defender scan should run. | ✔️ | | | |
+| [ScheduleScanTime](/windows/client-management/mdm/policy-configuration-service-provider#defender-schedulescantime) | Select the time of day that the Windows Defender scan should run. | ✔️ | | | |
+| [SignatureUpdateInterval](/windows/client-management/mdm/policy-configuration-service-provider#defender-signatureupdateinterval) | Specify the interval (in hours) that will be used to check for signatures, so instead of using the ScheduleDay and ScheduleTime the check for new signatures will be set according to the interval. | ✔️ | | | |
+| [SubmitSamplesConsent](/windows/client-management/mdm/policy-configuration-service-provider#defender-submitsamplesconsent) | Checks for the user consent level in Windows Defender to send data. | ✔️ | | | |
+| [ThreatSeverityDefaultAction](/windows/client-management/mdm/policy-configuration-service-provider#defender-threatseveritydefaultaction) | Specify any valid threat severity levels and the corresponding default action ID to take. | ✔️ | | | |
## DeliveryOptimization
-| Setting | Description | Desktop editions | Mobile editions | Surface Hub | HoloLens | IoT Core |
-| --- | --- | :---: | :---: | :---: | :---: | :---: |
-| [DOAbsoluteMaxCacheSize](/windows/client-management/mdm/policy-configuration-service-provider#deliveryoptimization-doabsolutemaxcachesize) | Specify the maximum size in GB of Delivery Optimization cache. | ✔️ | | | | |
-| [DOAllowVPNPeerCaching](/windows/client-management/mdm/policy-configuration-service-provider#deliveryoptimization-doallowvpnpeercaching) | Specify whether the device is allowed to participate in Peer Caching while connected via VPN to the domain network. | ✔️ | | | | |
-| [DODelayBackgroundDownloadFromHttp](/windows/client-management/mdm/policy-csp-deliveryoptimization#deliveryoptimization-dodelaybackgrounddownloadfromhttp) | Allows you to delay the use of an HTTP source in a background download that is allowed to use peer-to-peer. | ✔️ | | | | |
-| [DODelayForegroundDownloadFromHttp](/windows/client-management/mdm/policy-csp-deliveryoptimization#deliveryoptimization-dodelayforegrounddownloadfromhttp) | Allows you to delay the use of an HTTP source in a foreground (interactive) download that is allowed to use peer-to-peer. | ✔️ | | | | |
-| [DODownloadMode](/windows/client-management/mdm/policy-configuration-service-provider#deliveryoptimization-dodownloadmode) | Specify the download method that Delivery Optimization can use in downloads of Windows Updates, apps, and app updates. | ✔️ | | | | |
-| [DOGroupId](/windows/client-management/mdm/policy-configuration-service-provider#deliveryoptimization-dogroupid) | Specify an arbitrary group ID that the device belongs to. | ✔️ | | | | |
-| [DOGroupIdSource](/windows/client-management/mdm/policy-configuration-service-provider#deliveryoptimization-dogroupidsource) | Set this policy to restrict peer selection to a specific source | ✔️ | | | | |
-| [DOMaxCacheAge](/windows/client-management/mdm/policy-configuration-service-provider#deliveryoptimization-domaxcacheage) | Specify the maximum time in seconds that each file is held in the Delivery Optimization cache after downloading successfully. | ✔️ | | | | |
-| [DOMaxCacheSize](/windows/client-management/mdm/policy-configuration-service-provider#deliveryoptimization-domaxcachesize) | Specify the maximum cache size that Delivery Optimization can utilize, as a percentage of disk size (1-100). | ✔️ | | | | |
-| [DOMaxDownloadBandwidth](/windows/client-management/mdm/policy-configuration-service-provider#deliveryoptimization-domaxdownloadbandwidth) | Specify the maximum download bandwidth in kilobytes/second that the device can use across all concurrent download activities using Delivery Optimization. | ✔️ | | | | |
-| [DOMaxUploadBandwidth](/windows/client-management/mdm/policy-configuration-service-provider#deliveryoptimization-domaxuploadbandwidth) | Specify the maximum upload bandwidth in kilobytes/second that a device will use across all concurrent upload activity usinng Delivery Optimization. | ✔️ | | | | |
-| [DOMinBackgroundQos](/windows/client-management/mdm/policy-configuration-service-provider#deliveryoptimization-dominbackgroundqos) | Specify the minimum download QoS (Quality of Service or speed) i kilobytes/second for background downloads. | ✔️ | | | | |
-| [DOMinBatteryPercentageAllowedToUpload](/windows/client-management/mdm/policy-configuration-service-provider#deliveryoptimization-dominbatterypercentageallowedtoupload) | Specify any value between 1 and 100 (in percentage) to allow the device to upload data to LAN and group peers while on battery power. | ✔️ | | | | |
-| [DOMinDiskSizeAllowedToPeer](/windows/client-management/mdm/policy-configuration-service-provider#deliveryoptimization-domindisksizeallowedtopeer) | Specify the required minimum disk size (capabity in GB) for the device to use Peer Caching. | ✔️ | | | | |
-| [DOMinFileSizeToCache](/windows/client-management/mdm/policy-configuration-service-provider#deliveryoptimization-dominfilesizetocache) | Specify the minimum content file size in MB enabled to use Peer Caching. | ✔️ | | | | |
-| [DOMinRAMAllowedToPeer](/windows/client-management/mdm/policy-configuration-service-provider#deliveryoptimization-dominramallowedtopeer) | Specify the minimum RAM size in GB requried to use Peer Caching. | ✔️ | | | | |
-| [DOModifyCacheDrive](/windows/client-management/mdm/policy-configuration-service-provider#deliveryoptimization-domodifycachedrive) | Specify the drive that Delivery Optimization should use for its cache. | ✔️ | | | | |
-| [DOMonthlyUploadDataCap](/windows/client-management/mdm/policy-configuration-service-provider#deliveryoptimization-domonthlyuploaddatacap) | Specify the maximum total bytes in GB that Delivery Optimization is allowed to upload to Internet peers in each calendar month. | ✔️ | | | | |
-| [DOPercentageMaxBackDownloadBandwidth](/windows/client-management/mdm/policy-configuration-service-provider#deliveryoptimization-dopercentagemaxbackgroundbandwidth) | Specify the maximum background download bandwidth that Delivery Optimization uses across all concurrent download activities as a percentage of available download bandwidth. | ✔️ | | | | |
-| [DOPercentageMaxDownloadBandwidth](/windows/client-management/mdm/policy-configuration-service-provider#deliveryoptimization-dopercentagemaxdownloadbandwidth) | Specify the maximum download bandwidth that Delivery Optimization uses across all concurrent download activities as a percentage of available download bandwidth. | ✔️ | | | | |
-| [DOPercentageMaxForeDownloadBandwidth](/windows/client-management/mdm/policy-configuration-service-provider#deliveryoptimization-dopercentagemaxforegroundbandwidth) | Specify the maximum foreground download bandwidth that Delivery Optimization uses across all concurrent download activities as a percentage of available download bandwidth. | ✔️ | | | | |
-| [DORestrictPeerSelectionBy](/windows/client-management/mdm/policy-configuration-service-provider#deliveryoptimization-dorestrictpeerselectionby) | Set this policy to restrict peer selection by the selected option. | ✔️ | | | | |
-| [DOSetHoursToLimitBackgroundDownloadBandwidth](/windows/client-management/mdm/policy-configuration-service-provider#deliveryoptimization-dosethourstolimitbackgrounddownloadbandwidth) | Specify the maximum background download bandwidth that Delivery Optimization uses during and outside business hours across all concurrent download activities as a percentage of available download bandwidth. | ✔️ | | | | |
-| [DOSetHoursToLimitForegroundDownloadBandwidth](/windows/client-management/mdm/policy-configuration-service-provider#deliveryoptimization-dosethourstolimitforegrounddownloadbandwidth) | Specify the maximum foreground download bandwidth that Delivery Optimization uses during and outside business hours across all concurrent download activities as a percentage of available download bandwidth. | ✔️ | | | | |
+| Setting | Description | Windows client | Surface Hub | HoloLens | IoT Core |
+| --- | --- | :---: | :---: | :---: | :---: |
+| [DOAbsoluteMaxCacheSize](/windows/client-management/mdm/policy-configuration-service-provider#deliveryoptimization-doabsolutemaxcachesize) | Specify the maximum size in GB of Delivery Optimization cache. | ✔️ | | | |
+| [DOAllowVPNPeerCaching](/windows/client-management/mdm/policy-configuration-service-provider#deliveryoptimization-doallowvpnpeercaching) | Specify whether the device is allowed to participate in Peer Caching while connected via VPN to the domain network. | ✔️ | | | |
+| [DODelayBackgroundDownloadFromHttp](/windows/client-management/mdm/policy-csp-deliveryoptimization#deliveryoptimization-dodelaybackgrounddownloadfromhttp) | Allows you to delay the use of an HTTP source in a background download that is allowed to use peer-to-peer. | ✔️ | | | |
+| [DODelayForegroundDownloadFromHttp](/windows/client-management/mdm/policy-csp-deliveryoptimization#deliveryoptimization-dodelayforegrounddownloadfromhttp) | Allows you to delay the use of an HTTP source in a foreground (interactive) download that is allowed to use peer-to-peer. | ✔️ | | | |
+| [DODownloadMode](/windows/client-management/mdm/policy-configuration-service-provider#deliveryoptimization-dodownloadmode) | Specify the download method that Delivery Optimization can use in downloads of Windows Updates, apps, and app updates. | ✔️ | | | |
+| [DOGroupId](/windows/client-management/mdm/policy-configuration-service-provider#deliveryoptimization-dogroupid) | Specify an arbitrary group ID that the device belongs to. | ✔️ | | | |
+| [DOGroupIdSource](/windows/client-management/mdm/policy-configuration-service-provider#deliveryoptimization-dogroupidsource) | Set this policy to restrict peer selection to a specific source | ✔️ | | | |
+| [DOMaxCacheAge](/windows/client-management/mdm/policy-configuration-service-provider#deliveryoptimization-domaxcacheage) | Specify the maximum time in seconds that each file is held in the Delivery Optimization cache after downloading successfully. | ✔️ | | | |
+| [DOMaxCacheSize](/windows/client-management/mdm/policy-configuration-service-provider#deliveryoptimization-domaxcachesize) | Specify the maximum cache size that Delivery Optimization can utilize, as a percentage of disk size (1-100). | ✔️ | | | |
+| [DOMaxDownloadBandwidth](/windows/client-management/mdm/policy-configuration-service-provider#deliveryoptimization-domaxdownloadbandwidth) | Specify the maximum download bandwidth in kilobytes/second that the device can use across all concurrent download activities using Delivery Optimization. | ✔️ | | | |
+| [DOMaxUploadBandwidth](/windows/client-management/mdm/policy-configuration-service-provider#deliveryoptimization-domaxuploadbandwidth) | Specify the maximum upload bandwidth in kilobytes/second that a device will use across all concurrent upload activity using Delivery Optimization. | ✔️ | | | |
+| [DOMinBackgroundQos](/windows/client-management/mdm/policy-configuration-service-provider#deliveryoptimization-dominbackgroundqos) | Specify the minimum download QoS (Quality of Service or speed) i kilobytes/second for background downloads. | ✔️ | | | |
+| [DOMinBatteryPercentageAllowedToUpload](/windows/client-management/mdm/policy-configuration-service-provider#deliveryoptimization-dominbatterypercentageallowedtoupload) | Specify any value between 1 and 100 (in percentage) to allow the device to upload data to LAN and group peers while on battery power. | ✔️ | | | |
+| [DOMinDiskSizeAllowedToPeer](/windows/client-management/mdm/policy-configuration-service-provider#deliveryoptimization-domindisksizeallowedtopeer) | Specify the required minimum disk size (capacity in GB) for the device to use Peer Caching. | ✔️ | | | |
+| [DOMinFileSizeToCache](/windows/client-management/mdm/policy-configuration-service-provider#deliveryoptimization-dominfilesizetocache) | Specify the minimum content file size in MB enabled to use Peer Caching. | ✔️ | | | |
+| [DOMinRAMAllowedToPeer](/windows/client-management/mdm/policy-configuration-service-provider#deliveryoptimization-dominramallowedtopeer) | Specify the minimum RAM size in GB required to use Peer Caching. | ✔️ | | | |
+| [DOModifyCacheDrive](/windows/client-management/mdm/policy-configuration-service-provider#deliveryoptimization-domodifycachedrive) | Specify the drive that Delivery Optimization should use for its cache. | ✔️ | | | |
+| [DOMonthlyUploadDataCap](/windows/client-management/mdm/policy-configuration-service-provider#deliveryoptimization-domonthlyuploaddatacap) | Specify the maximum total bytes in GB that Delivery Optimization is allowed to upload to Internet peers in each calendar month. | ✔️ | | | |
+| [DOPercentageMaxBackDownloadBandwidth](/windows/client-management/mdm/policy-configuration-service-provider#deliveryoptimization-dopercentagemaxbackgroundbandwidth) | Specify the maximum background download bandwidth that Delivery Optimization uses across all concurrent download activities as a percentage of available download bandwidth. | ✔️ | | | |
+| [DOPercentageMaxDownloadBandwidth](/windows/client-management/mdm/policy-configuration-service-provider#deliveryoptimization-dopercentagemaxdownloadbandwidth) | Specify the maximum download bandwidth that Delivery Optimization uses across all concurrent download activities as a percentage of available download bandwidth. | ✔️ | | | |
+| [DOPercentageMaxForeDownloadBandwidth](/windows/client-management/mdm/policy-configuration-service-provider#deliveryoptimization-dopercentagemaxforegroundbandwidth) | Specify the maximum foreground download bandwidth that Delivery Optimization uses across all concurrent download activities as a percentage of available download bandwidth. | ✔️ | | | |
+| [DORestrictPeerSelectionBy](/windows/client-management/mdm/policy-configuration-service-provider#deliveryoptimization-dorestrictpeerselectionby) | Set this policy to restrict peer selection by the selected option. | ✔️ | | | |
+| [DOSetHoursToLimitBackgroundDownloadBandwidth](/windows/client-management/mdm/policy-configuration-service-provider#deliveryoptimization-dosethourstolimitbackgrounddownloadbandwidth) | Specify the maximum background download bandwidth that Delivery Optimization uses during and outside business hours across all concurrent download activities as a percentage of available download bandwidth. | ✔️ | | | |
+| [DOSetHoursToLimitForegroundDownloadBandwidth](/windows/client-management/mdm/policy-configuration-service-provider#deliveryoptimization-dosethourstolimitforegrounddownloadbandwidth) | Specify the maximum foreground download bandwidth that Delivery Optimization uses during and outside business hours across all concurrent download activities as a percentage of available download bandwidth. | ✔️ | | | |
## DeviceGuard
-| Setting | Description | Desktop editions | Mobile editions | Surface Hub | HoloLens | IoT Core |
-| --- | --- | :---: | :---: | :---: | :---: | :---: |
-[EnableVirtualizationBasedSecurity](/windows/client-management/mdm/policy-csp-deviceguard) | Turns on virtualization based security(VBS) at the next reboot. virtualization based security uses the Windows Hypervisor to provide support for security services. | ✔️ | | | | |
+| Setting | Description | Windows client | Surface Hub | HoloLens | IoT Core |
+| --- | --- | :---: | :---: | :---: | :---: |
+[EnableVirtualizationBasedSecurity](/windows/client-management/mdm/policy-csp-deviceguard) | Turns on virtualization based security(VBS) at the next reboot. virtualization based security uses the Windows Hypervisor to provide support for security services. | ✔️ | | | |
## DeviceLock
-| Setting | Description | Desktop editions | Mobile editions | Surface Hub | HoloLens | IoT Core |
-| --- | --- | :---: | :---: | :---: | :---: | :---: |
-| [AllowIdleReturnWithoutPassword](/windows/client-management/mdm/policy-configuration-service-provider#devicelock-allowidlereturnwithoutpassword) | Specify whether the user must input a PIN or password when the device resumes from an idle state. | | ✔️ | | | |
-| [AllowScreenTimeoutWhileLockedUserConfig](/windows/client-management/mdm/policy-configuration-service-provider#devicelock-allowscreentimeoutwhilelockeduserconfig) | Specify whether to show a user-configurable setting to control the screen timeout while on the lock screen. | | ✔️ | | | |
-| [AllowSimpleDevicePassword](/windows/client-management/mdm/policy-configuration-service-provider#devicelock-allowsimpledevicepassword) | Specify whether PINs or passwords such as "1111" or "1234" are allowed. For the desktop, it also controls the use of picture passwords. | ✔️ | ✔️ | | ✔️ | |
-|[AlphanumericDevicePasswordRequired](/windows/client-management/mdm/policy-configuration-service-provider#devicelock-alphanumericdevicepasswordrequired) | Select the type of PIN or password required. | ✔️ | ✔️ | | ✔️ | |
-| [DevicePasswordEnabled](/windows/client-management/mdm/policy-configuration-service-provider#devicelock-devicepasswordenabled) | Specify whether device password is enabled. | ✔️ | ✔️ | | ✔️ | |
-| [DevicePasswordExpiration](/windows/client-management/mdm/policy-configuration-service-provider#devicelock-devicepasswordexpiration) | Specify when the password expires (in days). | ✔️ | ✔️ | | ✔️ | |
-| [DevicePasswordHistory](/windows/client-management/mdm/policy-configuration-service-provider#devicelock-devicepasswordhistory) | Specify how many passwords can be stored in the history that can't be reused. | ✔️ | ✔️ | | ✔️ | |
-| [MaxDevicePasswordFailedAttempts](/windows/client-management/mdm/policy-configuration-service-provider#devicelock-maxdevicepasswordfailedattempts) | Specify the number of authentication failures allowed before the device will be wiped. | ✔️ | ✔️ | | ✔️ | |
-| [MaxInactivityTimeDeviceLock](/windows/client-management/mdm/policy-configuration-service-provider#devicelock-maxinactivitytimedevicelock) |Specify the maximum amount of time (in minutes) allowed after the device is idle that will cause the device to become PIN or password locked. | ✔️ | ✔️ | | ✔️ | |
-| [MinDevicePasswordComplexCharacters](/windows/client-management/mdm/policy-configuration-service-provider#devicelock-mindevicepasswordcomplexcharacters) | Specify the number of complex element types (uppercase and lowercase letters, numbers, and punctuation) required for a strong PIN or password. | ✔️ | ✔️ | | ✔️ | |
-| [MinDevicePasswordLength](/windows/client-management/mdm/policy-configuration-service-provider#devicelock-mindevicepasswordlength) | Specify the minimum number or characters required in the PIN or password. | ✔️ | ✔️ | | ✔️ | |
-| [ScreenTimeoutWhileLocked](/windows/client-management/mdm/policy-configuration-service-provider#devicelock-screentimeoutwhilelocked) | Specify the duration in seconds for the screen timeout while on the lock screen. | | ✔️ | | | |
+| Setting | Description | Windows client | Surface Hub | HoloLens | IoT Core |
+| --- | --- | :---: | :---: | :---: | :---: |
+| [AllowIdleReturnWithoutPassword](/windows/client-management/mdm/policy-configuration-service-provider#devicelock-allowidlereturnwithoutpassword) | Specify whether the user must input a PIN or password when the device resumes from an idle state. | | | | |
+| [AllowScreenTimeoutWhileLockedUserConfig](/windows/client-management/mdm/policy-configuration-service-provider#devicelock-allowscreentimeoutwhilelockeduserconfig) | Specify whether to show a user-configurable setting to control the screen timeout while on the lock screen. | | | | |
+| [AllowSimpleDevicePassword](/windows/client-management/mdm/policy-configuration-service-provider#devicelock-allowsimpledevicepassword) | Specify whether PINs or passwords such as "1111" or "1234" are allowed. For the desktop, it also controls the use of picture passwords. | ✔️ | | ✔️ | |
+|[AlphanumericDevicePasswordRequired](/windows/client-management/mdm/policy-configuration-service-provider#devicelock-alphanumericdevicepasswordrequired) | Select the type of PIN or password required. | ✔️ | | ✔️ | |
+| [DevicePasswordEnabled](/windows/client-management/mdm/policy-configuration-service-provider#devicelock-devicepasswordenabled) | Specify whether device password is enabled. | ✔️ | | ✔️ | |
+| [DevicePasswordExpiration](/windows/client-management/mdm/policy-configuration-service-provider#devicelock-devicepasswordexpiration) | Specify when the password expires (in days). | ✔️ | | ✔️ | |
+| [DevicePasswordHistory](/windows/client-management/mdm/policy-configuration-service-provider#devicelock-devicepasswordhistory) | Specify how many passwords can be stored in the history that can't be reused. | ✔️ | | ✔️ | |
+| [MaxDevicePasswordFailedAttempts](/windows/client-management/mdm/policy-configuration-service-provider#devicelock-maxdevicepasswordfailedattempts) | Specify the number of authentication failures allowed before the device will be wiped. | ✔️ | | ✔️ | |
+| [MaxInactivityTimeDeviceLock](/windows/client-management/mdm/policy-configuration-service-provider#devicelock-maxinactivitytimedevicelock) |Specify the maximum amount of time (in minutes) allowed after the device is idle that will cause the device to become PIN or password locked. | ✔️ | | ✔️ | |
+| [MinDevicePasswordComplexCharacters](/windows/client-management/mdm/policy-configuration-service-provider#devicelock-mindevicepasswordcomplexcharacters) | Specify the number of complex element types (uppercase and lowercase letters, numbers, and punctuation) required for a strong PIN or password. | ✔️ | | ✔️ | |
+| [MinDevicePasswordLength](/windows/client-management/mdm/policy-configuration-service-provider#devicelock-mindevicepasswordlength) | Specify the minimum number or characters required in the PIN or password. | ✔️ | | ✔️ | |
+| [ScreenTimeoutWhileLocked](/windows/client-management/mdm/policy-configuration-service-provider#devicelock-screentimeoutwhilelocked) | Specify the duration in seconds for the screen timeout while on the lock screen. | | | | |
## DeviceManagement
-| Setting | Description | Desktop editions | Mobile editions | Surface Hub | HoloLens | IoT Core |
-| --- | --- | :---: | :---: | :---: | :---: | :---: |
-| DisableMDMEnrollment | Use this setting to prevent the device from enrolling in MDM. | ✔️ | | | | |
+| Setting | Description | Windows client | Surface Hub | HoloLens | IoT Core |
+| --- | --- | :---: | :---: | :---: | :---: |
+| DisableMDMEnrollment | Use this setting to prevent the device from enrolling in MDM. | ✔️ | | | |
## Experience
-| Setting | Description | Desktop editions | Mobile editions | Surface Hub | HoloLens | IoT Core |
-| --- | --- | :---: | :---: | :---: | :---: | :---: |
-| [AllowCopyPaste](/windows/client-management/mdm/policy-configuration-service-provider#experience-allowcopypaste) | Specify whether copy and paste is allowed. | | ✔️ | | | |
-| [AllowCortana](/windows/client-management/mdm/policy-configuration-service-provider#experience-allowcortana) | Specify whether Cortana is allowed on the device. | ✔️ | ✔️ | | ✔️ | |
-| [AllowDeviceDiscovery](/windows/client-management/mdm/policy-configuration-service-provider#experience-allowdevicediscovery) | Allow users to turn device discovery on or off in the UI. | ✔️ | ✔️ | | | |
-| [AllowFindMyDevice](/windows/client-management/mdm/policy-configuration-service-provider#experience-allowfindmydevice) | Turn on **Find my device** feature. | ✔️ | ✔️ | | | |
-| [AllowManualMDMUnenrollment](/windows/client-management/mdm/policy-configuration-service-provider#experience-allowmanualmdmunenrollment) | Specify whether the user is allowed to delete the workplace account. | ✔️ | ✔️ | | ✔️ | |
-| [AllowScreenCapture](/windows/client-management/mdm/policy-configuration-service-provider#experience-allowscreencapture) | Specify whether screen capture is allowed. | | ✔️ | | | |
-| [AllowSIMErrorDialogPromptWhenNoSIM](/windows/client-management/mdm/policy-configuration-service-provider#experience-allowsimerrordialogpromptwhennosim) | Specify whether to display a dialog prompt when no SIM card is detected. | | ✔️ | | | |
-| [AllowSyncMySettings](/windows/client-management/mdm/policy-configuration-service-provider#experience-allowsyncmysettings) | Allow or disallow all Windows sync settings on the device. | ✔️ | ✔️ | | | |
-| [AllowTailoredExperiencesWithDiagnosticData](/windows/client-management/mdm/policy-configuration-service-provider#experience-allowtailoredexperienceswithdiagnosticdata) | Prevent Windows from using diagnostic data to provide customized experiences to the user. | ✔️ | | | | |
-| [AllowTaskSwitcher](/windows/client-management/mdm/policy-configuration-service-provider#experience-allowtaskswitcher) | Allow or disallow task switching on the device. | | ✔️ | | | |
-| [AllowThirdPartySuggestionsInWindowsSpotlight](/windows/client-management/mdm/policy-configuration-service-provider#experience-allowthirdpartysuggestionsinwindowsspotlight) | Specify whether to allow app and content suggestions from third-party software publishers in Windows Spotlight. | ✔️ | | | | |
-| [AllowVoiceRecording](/windows/client-management/mdm/policy-configuration-service-provider#experience-allowvoicerecording) | Specify whether voice recording is allowed for apps. | | ✔️ | | | |
-| [AllowWindowsConsumerFeatures](/windows/client-management/mdm/policy-csp-experience#experience-allowwindowsconsumerfeatures) | Turn on experiences that are typically for consumers only, such as Start suggetions, membership notifications, post-OOBE app install, and redirect tiles. | ✔️ | | | | |
-| [AllowWindowsSpotlight](/windows/client-management/mdm/policy-configuration-service-provider#experience-allowwindowsspotlight) |Specify whether to turn off all Windows Spotlight features at once. | ✔️ | | | | |
-| [AllowWindowsSpotlightOnActionCenter](/windows/client-management/mdm/policy-configuration-service-provider#experience-allowwindowsspotlightonactioncenter) | Prevent Windows Spotlight notifications from being displayed in the Action Center. | ✔️ | | | | |
-| [AllowWindowsSpotlightWindowsWelcomeExperience](/windows/client-management/mdm/policy-configuration-service-provider#experience-allowwindowsspotlightwindowswelcomeexperience) | Turn off the Windows Spotlight Windows welcome experience feature. | ✔️ | | | | |
-| [AllowWindowsTips](/windows/client-management/mdm/policy-configuration-service-provider#experience-allowwindowstips) | Enable or disable Windows Tips. | ✔️ | | | | |
-| [ConfigureWindowsSpotlightOnLockScreen](/windows/client-management/mdm/policy-configuration-service-provider#experience-configurewindowsspotlightonlockscreen) | Specify whether Spotlight should be used on the user's lock screen. | ✔️ | | | | |
+| Setting | Description | Windows client | Surface Hub | HoloLens | IoT Core |
+| --- | --- | :---: | :---: | :---: | :---: |
+| [AllowCopyPaste](/windows/client-management/mdm/policy-configuration-service-provider#experience-allowcopypaste) | Specify whether copy and paste is allowed. | | | | |
+| [AllowCortana](/windows/client-management/mdm/policy-configuration-service-provider#experience-allowcortana) | Specify whether Cortana is allowed on the device. | ✔️ | | ✔️ | |
+| [AllowDeviceDiscovery](/windows/client-management/mdm/policy-configuration-service-provider#experience-allowdevicediscovery) | Allow users to turn device discovery on or off in the UI. | ✔️ | | | |
+| [AllowFindMyDevice](/windows/client-management/mdm/policy-configuration-service-provider#experience-allowfindmydevice) | Turn on **Find my device** feature. | ✔️ | | | |
+| [AllowManualMDMUnenrollment](/windows/client-management/mdm/policy-configuration-service-provider#experience-allowmanualmdmunenrollment) | Specify whether the user is allowed to delete the workplace account. | ✔️ | | ✔️ | |
+| [AllowScreenCapture](/windows/client-management/mdm/policy-configuration-service-provider#experience-allowscreencapture) | Specify whether screen capture is allowed. | | | | |
+| [AllowSIMErrorDialogPromptWhenNoSIM](/windows/client-management/mdm/policy-configuration-service-provider#experience-allowsimerrordialogpromptwhennosim) | Specify whether to display a dialog prompt when no SIM card is detected. | | | | |
+| [AllowSyncMySettings](/windows/client-management/mdm/policy-configuration-service-provider#experience-allowsyncmysettings) | Allow or disallow all Windows sync settings on the device. | ✔️ | | | |
+| [AllowTailoredExperiencesWithDiagnosticData](/windows/client-management/mdm/policy-configuration-service-provider#experience-allowtailoredexperienceswithdiagnosticdata) | Prevent Windows from using diagnostic data to provide customized experiences to the user. | ✔️ | | | |
+| [AllowTaskSwitcher](/windows/client-management/mdm/policy-configuration-service-provider#experience-allowtaskswitcher) | Allow or disallow task switching on the device. | | | | |
+| [AllowThirdPartySuggestionsInWindowsSpotlight](/windows/client-management/mdm/policy-configuration-service-provider#experience-allowthirdpartysuggestionsinwindowsspotlight) | Specify whether to allow app and content suggestions from third-party software publishers in Windows Spotlight. | ✔️ | | | |
+| [AllowVoiceRecording](/windows/client-management/mdm/policy-configuration-service-provider#experience-allowvoicerecording) | Specify whether voice recording is allowed for apps. | | | | |
+| [AllowWindowsConsumerFeatures](/windows/client-management/mdm/policy-csp-experience#experience-allowwindowsconsumerfeatures) | Turn on experiences that are typically for consumers only, such as Start suggestions, membership notifications, post-OOBE app install, and redirect tiles. | ✔️ | | | |
+| [AllowWindowsSpotlight](/windows/client-management/mdm/policy-configuration-service-provider#experience-allowwindowsspotlight) |Specify whether to turn off all Windows Spotlight features at once. | ✔️ | | | |
+| [AllowWindowsSpotlightOnActionCenter](/windows/client-management/mdm/policy-configuration-service-provider#experience-allowwindowsspotlightonactioncenter) | Prevent Windows Spotlight notifications from being displayed in the Action Center. | ✔️ | | | |
+| [AllowWindowsSpotlightWindowsWelcomeExperience](/windows/client-management/mdm/policy-configuration-service-provider#experience-allowwindowsspotlightwindowswelcomeexperience) | Turn off the Windows Spotlight Windows welcome experience feature. | ✔️ | | | |
+| [AllowWindowsTips](/windows/client-management/mdm/policy-configuration-service-provider#experience-allowwindowstips) | Enable or disable Windows Tips. | ✔️ | | | |
+| [ConfigureWindowsSpotlightOnLockScreen](/windows/client-management/mdm/policy-configuration-service-provider#experience-configurewindowsspotlightonlockscreen) | Specify whether Spotlight should be used on the user's lock screen. | ✔️ | | | |
## ExploitGuard
-| Setting | Description | Desktop editions | Mobile editions | Surface Hub | HoloLens | IoT Core |
-| --- | --- | :---: | :---: | :---: | :---: | :---: |
-| [ExploitProtectionSettings](/windows/client-management/mdm/policy-csp-exploitguard) | See the [explanation of ExploitProtectionSettings](/windows/client-management/mdm/policy-csp-exploitguard) in the Policy CSP for instructions. In the **ExploitProtectionSettings** field, you can enter a path (local, UNC, or URI) to the mitigation options config, or you can enter the XML for the config. | ✔️ | ✔️ | | | |
+| Setting | Description | Windows client | Surface Hub | HoloLens | IoT Core |
+| --- | --- | :---: | :---: | :---: | :---: |
+| [ExploitProtectionSettings](/windows/client-management/mdm/policy-csp-exploitguard) | See the [explanation of ExploitProtectionSettings](/windows/client-management/mdm/policy-csp-exploitguard) in the Policy CSP for instructions. In the **ExploitProtectionSettings** field, you can enter a path (local, UNC, or URI) to the mitigation options config, or you can enter the XML for the config. | ✔️ | | | |
## Games
-| Setting | Description | Desktop editions | Mobile editions | Surface Hub | HoloLens | IoT Core |
-| --- | --- | :---: | :---: | :---: | :---: | :---: |
-| [AllowAdvancedGamingServices](/windows/client-management/mdm/policy-configuration-service-provider#games-allowadvancedgamingservices) | Currently not supported. | ✔️ | | | | |
+| Setting | Description | Windows client | Surface Hub | HoloLens | IoT Core |
+| --- | --- | :---: | :---: | :---: | :---: |
+| [AllowAdvancedGamingServices](/windows/client-management/mdm/policy-configuration-service-provider#games-allowadvancedgamingservices) | Currently not supported. | ✔️ | | | |
## KioskBrowser
These settings apply to the **Kiosk Browser** app available in Microsoft Store. For more information, see [Guidelines for web browsers](../guidelines-for-assigned-access-app.md#guidelines-for-web-browsers).
-| Setting | Description | Desktop editions | Mobile editions | Surface Hub | HoloLens | IoT Core |
-| --- | --- | :---: | :---: | :---: | :---: | :---: |
-[BlockedUrlExceptions](/windows/client-management/mdm/policy-csp-kioskbrowser#kioskbrowser-blockedurlexceptions) | List of exceptions to the blocked website URLs (with wildcard support). This is used to configure URLs kiosk browsers are allowed to navigate to, which are a subset of the blocked URLs. | ✔️ | | | | |
-[BlockedUrls](/windows/client-management/mdm/policy-csp-kioskbrowser#kioskbrowser-blockedurls) | List of blocked website URLs (with wildcard support). This is used to configure blocked URLs kiosk browsers cannot navigate to. | ✔️ | | | | |
-[DefaultURL](/windows/client-management/mdm/policy-csp-kioskbrowser#kioskbrowser-defaulturl) | Configures the default URL kiosk browsers to navigate on launch and restart. | ✔️ | | | | |
-[EnableEndSessionButton](/windows/client-management/mdm/policy-csp-kioskbrowser#kioskbrowser-enableendsessionbutton) | Enable/disable kiosk browser's end session button. | ✔️ | | | | |
-[EnableHomeButton](/windows/client-management/mdm/policy-csp-kioskbrowser#kioskbrowser-enablehomebutton) | Enable/disable kiosk browser's home button. | ✔️ | | | | |
-[EnableNavigationButtons](/windows/client-management/mdm/policy-csp-kioskbrowser#kioskbrowser-enablenavigationbuttons) | Enable/disable kiosk browser's navigation buttons (forward/back). | ✔️ | | | | |
-[RestartOnIdleTime](/windows/client-management/mdm/policy-csp-kioskbrowser#kioskbrowser-restartonidletime) | Amount of time in minutes the session is idle until the kiosk browser restarts in a fresh state. The value is an int 1-1440 that specifies the amount of minutes the session is idle until the kiosk browser restarts in a fresh state. The default value is empty which means there is no idle timeout within the kiosk browser. | ✔️ | | | | |
+| Setting | Description | Windows client | Surface Hub | HoloLens | IoT Core |
+| --- | --- | :---: | :---: | :---: | :---: |
+|[BlockedUrlExceptions](/windows/client-management/mdm/policy-csp-kioskbrowser#kioskbrowser-blockedurlexceptions) | List of exceptions to the blocked website URLs (with wildcard support). This is used to configure URLs kiosk browsers are allowed to navigate to, which are a subset of the blocked URLs. | ✔️ | | | |
+|[BlockedUrls](/windows/client-management/mdm/policy-csp-kioskbrowser#kioskbrowser-blockedurls) | List of blocked website URLs (with wildcard support). This is used to configure blocked URLs kiosk browsers cannot navigate to. | ✔️ | | | |
+|[DefaultURL](/windows/client-management/mdm/policy-csp-kioskbrowser#kioskbrowser-defaulturl) | Configures the default URL kiosk browsers to navigate on launch and restart. | ✔️ | | | |
+|[EnableEndSessionButton](/windows/client-management/mdm/policy-csp-kioskbrowser#kioskbrowser-enableendsessionbutton) | Enable/disable kiosk browser's end session button. | ✔️ | | | |
+|[EnableHomeButton](/windows/client-management/mdm/policy-csp-kioskbrowser#kioskbrowser-enablehomebutton) | Enable/disable kiosk browser's home button. | ✔️ | | | |
+|[EnableNavigationButtons](/windows/client-management/mdm/policy-csp-kioskbrowser#kioskbrowser-enablenavigationbuttons) | Enable/disable kiosk browser's navigation buttons (forward/back). | ✔️ | | | |
+|[RestartOnIdleTime](/windows/client-management/mdm/policy-csp-kioskbrowser#kioskbrowser-restartonidletime) | Amount of time in minutes the session is idle until the kiosk browser restarts in a fresh state. The value is an int 1-1440 that specifies the amount of minutes the session is idle until the kiosk browser restarts in a fresh state. The default value is empty which means there is no idle timeout within the kiosk browser. | ✔️ | | | |
To configure multiple URLs for **Blocked URL Exceptions** or **Blocked URLs** in Windows Configuration Designer:
@@ -339,252 +340,253 @@ To configure multiple URLs for **Blocked URL Exceptions** or **Blocked URLs** in
## LocalPoliciesSecurityOptions
-| Setting | Description | Desktop editions | Mobile editions | Surface Hub | HoloLens | IoT Core |
-| --- | --- | :---: | :---: | :---: | :---: | :---: |
-| [InteractiveLogon_DoNotDisplayLastSignedIn](/windows/client-management/mdm/policy-csp-localpoliciessecurityoptions#localpoliciessecurityoptions-interactivelogon-donotdisplaylastsignedin) | Specify whether the Windows sign-in screen will show the username of the last person who signed in. | ✔️ | | | | |
-| [Shutdown_AllowSystemtobeShutDownWithoutHavingToLogOn](/windows/client-management/mdm/policy-csp-localpoliciessecurityoptions#localpoliciessecurityoptions-shutdown-allowsystemtobeshutdownwithouthavingtologon) | Specify whether a computer can be shut down without signing in. | ✔️ | | | | |
-| [UserAccountControl_BehaviorOfTheElevationPromptForStandardUsers](/windows/client-management/mdm/policy-csp-localpoliciessecurityoptions#localpoliciessecurityoptions-useraccountcontrol-behavioroftheelevationpromptforstandardusers) | Configure how an elevation prompt should behave for standard users. | ✔️ | | | | |
+| Setting | Description | Windows client | Surface Hub | HoloLens | IoT Core |
+| --- | --- | :---: | :---: | :---: | :---: |
+| [InteractiveLogon_DoNotDisplayLastSignedIn](/windows/client-management/mdm/policy-csp-localpoliciessecurityoptions#localpoliciessecurityoptions-interactivelogon-donotdisplaylastsignedin) | Specify whether the Windows sign-in screen will show the username of the last person who signed in. | ✔️ | | | |
+| [Shutdown_AllowSystemtobeShutDownWithoutHavingToLogOn](/windows/client-management/mdm/policy-csp-localpoliciessecurityoptions#localpoliciessecurityoptions-shutdown-allowsystemtobeshutdownwithouthavingtologon) | Specify whether a computer can be shut down without signing in. | ✔️ | | | |
+| [UserAccountControl_BehaviorOfTheElevationPromptForStandardUsers](/windows/client-management/mdm/policy-csp-localpoliciessecurityoptions#localpoliciessecurityoptions-useraccountcontrol-behavioroftheelevationpromptforstandardusers) | Configure how an elevation prompt should behave for standard users. | ✔️ | | | |
## Location
-| Setting | Description | Desktop editions | Mobile editions | Surface Hub | HoloLens | IoT Core |
-| --- | --- | :---: | :---: | :---: | :---: | :---: |
-| [EnableLocation](/windows/client-management/mdm/policy-configuration-service-provider#location-enablelocation) | Do not use. | | | | | |
+| Setting | Description | Windows client | Surface Hub | HoloLens | IoT Core |
+| --- | --- | :---: | :---: | :---: | :---: |
+| [EnableLocation](/windows/client-management/mdm/policy-configuration-service-provider#location-enablelocation) | Do not use. | | | | |
## Power
-| Setting | Description | Desktop editions | Mobile editions | Surface Hub | HoloLens | IoT Core |
-| --- | --- | :---: | :---: | :---: | :---: | :---: |
-| [AllowStandbyStatesWhenSleepingOnBattery](/windows/client-management/mdm/policy-csp-power#allowstandbystateswhensleepingonbattery) | Specify whether Windows can use standby states when putting the computer in a sleep state while on battery. | ✔️ | | | | |
-| [AllowStandbyWhenSleepingPluggedIn](/windows/client-management/mdm/policy-csp-power#allowstandbystateswhensleepingpluggedin) | Specify whether Windows can use standby states when putting the computer in a sleep state while plugged in. | ✔️ | | | | |
-| [DisplayOffTimeoutOnBattery](/windows/client-management/mdm/policy-csp-power#displayofftimeoutonbattery) | Specify the period of inactivity before Windows turns off the display while on battery. | ✔️ | | | | |
-| [DisplayOffTimeoutPluggedIn](/windows/client-management/mdm/policy-csp-power#displayofftimeoutpluggedin) | Specify the period of inactivity before Windows turns off the display while plugged in. | ✔️ | | | | |
-| [EnergySaverBatteryThresholdOnBattery](/windows/client-management/mdm/policy-csp-power#energysaverbatterythresholdonbattery) | Specify the battery charge level at which Energy Saver is turned on while on battery. | ✔️ | | | | |
-| [EnergySaverBatteryThresholdPluggedIn](/windows/client-management/mdm/policy-csp-power#EnergySaverBatteryThresholdPluggedIn) | Specify the battery charge level at which Energy Saver is turned on while plugged in. | ✔️ | | | | |
-| [HibernateTimeoutOnBattery](/windows/client-management/mdm/policy-csp-power#hibernatetimeoutonbattery) | Specify the period of inactivity before Windows transitions the system to hibernate while on battery. | ✔️ | | | | |
-| [HibernateTimeoutPluggedIn](/windows/client-management/mdm/policy-csp-power#hibernatetimeoutpluggedin) | Specify the period of inactivity before Windows transitions the system to hibernate while plugged in. | ✔️ | | | | |
-| [RequirePasswordWhenComputerWakesOnBattery](/windows/client-management/mdm/policy-csp-power#requirepasswordwhencomputerwakesonbattery) | Specify whether the user is prompted for a password when the system resumes from sleep while on battery. | ✔️ | | | | |
-| [RequirePasswordWhenComputerWakesPluggedIn](/windows/client-management/mdm/policy-csp-power#requirepasswordwhencomputerwakespluggedin) | Specify whether the user is prompted for a password when the system resumes from sleep while plugged in. | ✔️ | | | | |
-| [SelectLidCloseActionBattery](/windows/client-management/mdm/policy-csp-power#selectlidcloseactionpluggedin) | Select the action to be taken when a user closes the lid on a mobile device while on battery. | ✔️ | | | | |
-| [SelectLidCloseActionPluggedIn](/windows/client-management/mdm/policy-csp-power#selectlidcloseactionpluggedin) | Select the action to be taken when a user closes the lid on a mobile device while on plugged in. | ✔️ | | | | |
-| [SelectPowerButtonActionOnBattery](/windows/client-management/mdm/policy-csp-power#selectpowerbuttonactiononbattery) | Select the action to be taken when the user presses the power button while on battery. | ✔️ | | | | |
-| [SelectPowerButtonActionPluggedIn](/windows/client-management/mdm/policy-csp-power#selectpowerbuttonactionpluggedin) | Select the action to be taken when the user presses the power button while on plugged in. | ✔️ | | | | |
-| [SelectSleepButtonActionOnBattery](/windows/client-management/mdm/policy-csp-power#selectsleepbuttonactiononbattery) | Select the action to be taken when the user presses the sleep button while on battery. | ✔️ | | | | |
-| [SelectSleepButtonActionPluggedIn](/windows/client-management/mdm/policy-csp-power#selectsleepbuttonactionpluggedin) | Select the action to be taken when the user presses the sleep button while plugged in. | ✔️ | | | | |
-| [StandbyTimeoutOnBattery](/windows/client-management/mdm/policy-csp-power#StandbyTimeoutOnBattery) | Specify the period of inactivity before Windows transitions the system to sleep while on battery. | ✔️ | | | | |
-| [StandbyTimeoutPluggedIn](/windows/client-management/mdm/policy-csp-power#standbytimeoutpluggedin) | Specify the period of inactivity before Windows transitions the system to sleep while plugged in. | ✔️ | | | | |
-| [TurnOffHybridSleepOnBattery](/windows/client-management/mdm/policy-csp-power#turnoffhybridsleeponbattery) | Turn off hybrid sleep while on battery. | ✔️ | | | | |
-| [TurnOffHybridSleepPluggedIn](/windows/client-management/mdm/policy-csp-power#turnoffhybridsleeppluggedin) | Turn off hybrid sleep while plugged in. | ✔️ | | | | |
-| [UnattendedSleepTimeoutOnBattery](/windows/client-management/mdm/policy-csp-power#unattendedsleeptimeoutonbattery) | Specify the period of inactivity before Windows transitions the system to sleep automatically when a user is not present while on battery. | ✔️ | | | | |
-| [UnattendedSleepTimeoutPluggedIn](/windows/client-management/mdm/policy-csp-power#unattendedsleeptimeoutpluggedin) | Specify the period of inactivity before Windows transitions the system to sleep automatically when a user is not present while plugged in. | ✔️ | | | | |
+| Setting | Description | Windows client | Surface Hub | HoloLens | IoT Core |
+| --- | --- | :---: | :---: | :---: | :---: |
+| [AllowStandbyStatesWhenSleepingOnBattery](/windows/client-management/mdm/policy-csp-power#allowstandbystateswhensleepingonbattery) | Specify whether Windows can use standby states when putting the computer in a sleep state while on battery. | ✔️ | | | |
+| [AllowStandbyWhenSleepingPluggedIn](/windows/client-management/mdm/policy-csp-power#allowstandbystateswhensleepingpluggedin) | Specify whether Windows can use standby states when putting the computer in a sleep state while plugged in. | ✔️ | | | |
+| [DisplayOffTimeoutOnBattery](/windows/client-management/mdm/policy-csp-power#displayofftimeoutonbattery) | Specify the period of inactivity before Windows turns off the display while on battery. | ✔️ | | | |
+| [DisplayOffTimeoutPluggedIn](/windows/client-management/mdm/policy-csp-power#displayofftimeoutpluggedin) | Specify the period of inactivity before Windows turns off the display while plugged in. | ✔️ | | | |
+| [EnergySaverBatteryThresholdOnBattery](/windows/client-management/mdm/policy-csp-power#energysaverbatterythresholdonbattery) | Specify the battery charge level at which Energy Saver is turned on while on battery. | ✔️ | | | |
+| [EnergySaverBatteryThresholdPluggedIn](/windows/client-management/mdm/policy-csp-power#EnergySaverBatteryThresholdPluggedIn) | Specify the battery charge level at which Energy Saver is turned on while plugged in. | ✔️ | | | |
+| [HibernateTimeoutOnBattery](/windows/client-management/mdm/policy-csp-power#hibernatetimeoutonbattery) | Specify the period of inactivity before Windows transitions the system to hibernate while on battery. | ✔️ | | | |
+| [HibernateTimeoutPluggedIn](/windows/client-management/mdm/policy-csp-power#hibernatetimeoutpluggedin) | Specify the period of inactivity before Windows transitions the system to hibernate while plugged in. | ✔️ | | | |
+| [RequirePasswordWhenComputerWakesOnBattery](/windows/client-management/mdm/policy-csp-power#requirepasswordwhencomputerwakesonbattery) | Specify whether the user is prompted for a password when the system resumes from sleep while on battery. | ✔️ | | | |
+| [RequirePasswordWhenComputerWakesPluggedIn](/windows/client-management/mdm/policy-csp-power#requirepasswordwhencomputerwakespluggedin) | Specify whether the user is prompted for a password when the system resumes from sleep while plugged in. | ✔️ | | | |
+| [SelectLidCloseActionBattery](/windows/client-management/mdm/policy-csp-power#selectlidcloseactionpluggedin) | Select the action to be taken when a user closes the lid on a mobile device while on battery. | ✔️ | | | |
+| [SelectLidCloseActionPluggedIn](/windows/client-management/mdm/policy-csp-power#selectlidcloseactionpluggedin) | Select the action to be taken when a user closes the lid on a mobile device while on plugged in. | ✔️ | | | |
+| [SelectPowerButtonActionOnBattery](/windows/client-management/mdm/policy-csp-power#selectpowerbuttonactiononbattery) | Select the action to be taken when the user presses the power button while on battery. | ✔️ | | | |
+| [SelectPowerButtonActionPluggedIn](/windows/client-management/mdm/policy-csp-power#selectpowerbuttonactionpluggedin) | Select the action to be taken when the user presses the power button while on plugged in. | ✔️ | | | |
+| [SelectSleepButtonActionOnBattery](/windows/client-management/mdm/policy-csp-power#selectsleepbuttonactiononbattery) | Select the action to be taken when the user presses the sleep button while on battery. | ✔️ | | | |
+| [SelectSleepButtonActionPluggedIn](/windows/client-management/mdm/policy-csp-power#selectsleepbuttonactionpluggedin) | Select the action to be taken when the user presses the sleep button while plugged in. | ✔️ | | | |
+| [StandbyTimeoutOnBattery](/windows/client-management/mdm/policy-csp-power#StandbyTimeoutOnBattery) | Specify the period of inactivity before Windows transitions the system to sleep while on battery. | ✔️ | | | |
+| [StandbyTimeoutPluggedIn](/windows/client-management/mdm/policy-csp-power#standbytimeoutpluggedin) | Specify the period of inactivity before Windows transitions the system to sleep while plugged in. | ✔️ | | | |
+| [TurnOffHybridSleepOnBattery](/windows/client-management/mdm/policy-csp-power#turnoffhybridsleeponbattery) | Turn off hybrid sleep while on battery. | ✔️ | | | |
+| [TurnOffHybridSleepPluggedIn](/windows/client-management/mdm/policy-csp-power#turnoffhybridsleeppluggedin) | Turn off hybrid sleep while plugged in. | ✔️ | | | |
+| [UnattendedSleepTimeoutOnBattery](/windows/client-management/mdm/policy-csp-power#unattendedsleeptimeoutonbattery) | Specify the period of inactivity before Windows transitions the system to sleep automatically when a user is not present while on battery. | ✔️ | | | |
+| [UnattendedSleepTimeoutPluggedIn](/windows/client-management/mdm/policy-csp-power#unattendedsleeptimeoutpluggedin) | Specify the period of inactivity before Windows transitions the system to sleep automatically when a user is not present while plugged in. | ✔️ | | | |
## Privacy
-| Setting | Description | Desktop editions | Mobile editions | Surface Hub | HoloLens | IoT Core |
-| --- | --- | :---: | :---: | :---: | :---: | :---: |
-| [AllowAutoAcceptPairingAndPrivacyConsentPrompts](/windows/client-management/mdm/policy-configuration-service-provider#privacy-allowautoacceptpairingandprivacyconsentprompts) | Allow or disallow the automatic acceptance of the pairing and privacy user consent dialog boxes when launching apps. | | ✔️ | | | |
-| [AllowInputPersonalization](/windows/client-management/mdm/policy-configuration-service-provider#privacy-allowinputpersonalization) | Allow the use of cloud-based speech services for Cortana, dictation, or Store apps. | ✔️ | ✔️ | | ✔️ | |
+| Setting | Description | Windows client | Surface Hub | HoloLens | IoT Core |
+| --- | --- | :---: | :---: | :---: | :---: |
+| [AllowAutoAcceptPairingAndPrivacyConsentPrompts](/windows/client-management/mdm/policy-configuration-service-provider#privacy-allowautoacceptpairingandprivacyconsentprompts) | Allow or disallow the automatic acceptance of the pairing and privacy user consent dialog boxes when launching apps. | | | | |
+| [AllowInputPersonalization](/windows/client-management/mdm/policy-configuration-service-provider#privacy-allowinputpersonalization) | Allow the use of cloud-based speech services for Cortana, dictation, or Store apps. | ✔️ | | ✔️ | |
## Search
-| Setting | Description | Desktop editions | Mobile editions | Surface Hub | HoloLens | IoT Core |
-| --- | --- | :---: | :---: | :---: | :---: | :---: |
-[AllowCloudSearch](/windows/client-management/mdm/policy-csp-search#search-allowcloudsearch) | Allow search and Cortana to search cloud sources like OneDrive and SharePoint. T | ✔️ | ✔️ | | | |
-[AllowCortanaInAAD](/windows/client-management/mdm/policy-csp-search#search-allowcortanainaad) | This specifies whether the Cortana consent page can appear in the Azure Active Directory (AAD) device out-of-box-experience (OOBE) flow. | ✔️ | | | | |
-| [AllowIndexingEncryptedStoresOrItems](/windows/client-management/mdm/policy-configuration-service-provider#search-allowindexingencryptedstoresoritems) | Allow or disallow the indexing of items. | ✔️ | ✔️ | | | |
-| [AllowSearchToUseLocation](/windows/client-management/mdm/policy-configuration-service-provider#search-allowsearchtouselocation) | Specify whether search can use location information. | ✔️ | ✔️ | | ✔️ | |
-| [AllowUsingDiacritics](/windows/client-management/mdm/policy-configuration-service-provider#search-allowusingdiacritics) | Allow the use of diacritics. | ✔️ | ✔️ | | | |
-| [AllowWindowsIndexer](/windows/client-management/mdm/policy-csp-search#search-allowwindowsindexer) | The indexer provides fast file, email, and web history search for apps and system components including Cortana, Outlook, file explorer, and Edge. To do this, it requires access to the file system and app data stores such as Outlook OST files.- **Off** setting disables Windows indexer- **EnterpriseSecure** setting stops the indexer from indexing encrypted files or stores, and is recommended for enterprises using Windows Information Protection (WIP)- **Enterprise** setting reduces potential network loads for enterprises- **Standard** setting is appropriate for consuemrs | ✔️ | ✔️ | | | |
-| [AlwaysUseAutoLangDetection](/windows/client-management/mdm/policy-configuration-service-provider#search-alwaysuseautolangdetection) | Specify whether to always use automatic language detection when indexing content and properties. | ✔️ | ✔️ | | | |
-| [DoNotUseWebResults](/windows/client-management/mdm/policy-configuration-service-provider#search-donotusewebresults) | Specify whether to allow Search to perform queries on the web. | ✔️ | ✔️ | | | |
-| [DisableBackoff](/windows/client-management/mdm/policy-configuration-service-provider#search-disablebackoff) | If enabled, the search indexer backoff feature will be disabled. | ✔️ | ✔️ | | | |
-| [DisableRemovableDriveIndexing](/windows/client-management/mdm/policy-configuration-service-provider#search-disableremovabledriveindexing) | Configure whether locations on removable drives can be added to libraries. | ✔️ | ✔️ | | | |
-| [PreventIndexingLowDiskSpaceMB](/windows/client-management/mdm/policy-configuration-service-provider#search-preventindexinglowdiskspacemb) | Prevent indexing from continuing after less than the specified amount of hard drive space is left on the same drive as the index location. | ✔️ | ✔️ | | | |
-| [PreventRemoteQueries](/windows/client-management/mdm/policy-configuration-service-provider#search-preventremotequeries) | If enabled, clients will be unable to query this device's index remotely. | ✔️ | ✔️ | | | |
-| [SafeSearchPermissions](/windows/client-management/mdm/policy-configuration-service-provider#search-safesearchpermissions) | Specify the level of safe search (filtering adult content) required. | | ✔️ | | | |
+| Setting | Description | Windows client | Surface Hub | HoloLens | IoT Core |
+| --- | --- | :---: | :---: | :---: | :---: |
+[AllowCloudSearch](/windows/client-management/mdm/policy-csp-search#search-allowcloudsearch) | Allow search and Cortana to search cloud sources like OneDrive and SharePoint. T | ✔️ | | | |
+[AllowCortanaInAAD](/windows/client-management/mdm/policy-csp-search#search-allowcortanainaad) | This specifies whether the Cortana consent page can appear in the Azure Active Directory (AAD) device out-of-box-experience (OOBE) flow. | ✔️ | | | |
+| [AllowIndexingEncryptedStoresOrItems](/windows/client-management/mdm/policy-configuration-service-provider#search-allowindexingencryptedstoresoritems) | Allow or disallow the indexing of items. | ✔️ | | | |
+| [AllowSearchToUseLocation](/windows/client-management/mdm/policy-configuration-service-provider#search-allowsearchtouselocation) | Specify whether search can use location information. | ✔️ | | ✔️ | |
+| [AllowUsingDiacritics](/windows/client-management/mdm/policy-configuration-service-provider#search-allowusingdiacritics) | Allow the use of diacritics. | ✔️ | | | |
+| [AllowWindowsIndexer](/windows/client-management/mdm/policy-csp-search#search-allowwindowsindexer) | The indexer provides fast file, email, and web history search for apps and system components including Cortana, Outlook, file explorer, and Edge. To do this, it requires access to the file system and app data stores such as Outlook OST files.- **Off** setting disables Windows indexer- **EnterpriseSecure** setting stops the indexer from indexing encrypted files or stores, and is recommended for enterprises using Windows Information Protection (WIP)- **Enterprise** setting reduces potential network loads for enterprises- **Standard** setting is appropriate for consumers | ✔️ | | | |
+| [AlwaysUseAutoLangDetection](/windows/client-management/mdm/policy-configuration-service-provider#search-alwaysuseautolangdetection) | Specify whether to always use automatic language detection when indexing content and properties. | ✔️ | | | |
+| [DoNotUseWebResults](/windows/client-management/mdm/policy-configuration-service-provider#search-donotusewebresults) | Specify whether to allow Search to perform queries on the web. | ✔️ | | | |
+| [DisableBackoff](/windows/client-management/mdm/policy-configuration-service-provider#search-disablebackoff) | If enabled, the search indexer backoff feature will be disabled. | ✔️ | | | |
+| [DisableRemovableDriveIndexing](/windows/client-management/mdm/policy-configuration-service-provider#search-disableremovabledriveindexing) | Configure whether locations on removable drives can be added to libraries. | ✔️ | | | |
+| [PreventIndexingLowDiskSpaceMB](/windows/client-management/mdm/policy-configuration-service-provider#search-preventindexinglowdiskspacemb) | Prevent indexing from continuing after less than the specified amount of hard drive space is left on the same drive as the index location. | ✔️ | | | |
+| [PreventRemoteQueries](/windows/client-management/mdm/policy-configuration-service-provider#search-preventremotequeries) | If enabled, clients will be unable to query this device's index remotely. | ✔️ | | | |
+| [SafeSearchPermissions](/windows/client-management/mdm/policy-configuration-service-provider#search-safesearchpermissions) | Specify the level of safe search (filtering adult content) required. | | | | |
## Security
-| Setting | Description | Desktop editions | Mobile editions | Surface Hub | HoloLens | IoT Core |
-| --- | --- | :---: | :---: | :---: | :---: | :---: |
-| [AllowAddProvisioningPackage](/windows/client-management/mdm/policy-configuration-service-provider#security-allowaddprovisioningpackage) | Specify whether to allow installation of provisioning packages. | ✔️ | ✔️ | ✔️ | | ✔️ |
-| [AllowManualRootCertificateInstallation](/windows/client-management/mdm/policy-configuration-service-provider#security-allowmanualrootcertificateinstallation) | Specify whether the user is allowed to manually install root and intermediate CA certificates. | | ✔️ | | | |
-| [AllowRemoveProvisioningPackage](/windows/client-management/mdm/policy-configuration-service-provider#security-allowremoveprovisioningpackage) | Specify whether removal of provisioning packages is allowed. | ✔️ | ✔️ | ✔️ | | ✔️ |
-| [AntiTheftMode](/windows/client-management/mdm/policy-configuration-service-provider#security-antitheftmode) | Allow or disallow Anti Theft Mode on the device. | | ✔️ | | | |
-| [RequireDeviceEncryption](/windows/client-management/mdm/policy-configuration-service-provider#security-requiredeviceencryption) | Specify whether encryption is required. | ✔️ | ✔️ | ✔️ | ✔️ | ✔️ |
-| [RequireProvisioningPackageSignature](/windows/client-management/mdm/policy-configuration-service-provider#security-requireprovisioningpackagesignature) | Specify whether provisioning packages must have a certificate signed by a device-trusted authority. | ✔️ | ✔️ | ✔️ | | ✔️ |
-| [RequireRetrieveHealthCertificateOnBoot](/windows/client-management/mdm/policy-configuration-service-provider#security-requireretrievehealthcertificateonboot) | Specify whether to retrieve and post TCG Boot logs, and get or cache an encrypted or signed Health Attestation Report from the Microsoft Health Attestation Service when a device boots or reboots. | ✔️ | ✔️ | | | |
+| Setting | Description | Windows client | Surface Hub | HoloLens | IoT Core |
+| --- | --- | :---: | :---: | :---: | :---: |
+| [AllowAddProvisioningPackage](/windows/client-management/mdm/policy-configuration-service-provider#security-allowaddprovisioningpackage) | Specify whether to allow installation of provisioning packages. | ✔️ | ✔️ | | ✔️ |
+| [AllowManualRootCertificateInstallation](/windows/client-management/mdm/policy-configuration-service-provider#security-allowmanualrootcertificateinstallation) | Specify whether the user is allowed to manually install root and intermediate CA certificates. | | | | |
+| [AllowRemoveProvisioningPackage](/windows/client-management/mdm/policy-configuration-service-provider#security-allowremoveprovisioningpackage) | Specify whether removal of provisioning packages is allowed. | ✔️ | ✔️ | | ✔️ |
+| [AntiTheftMode](/windows/client-management/mdm/policy-configuration-service-provider#security-antitheftmode) | Allow or disallow Anti Theft Mode on the device. | | | | |
+| [RequireDeviceEncryption](/windows/client-management/mdm/policy-configuration-service-provider#security-requiredeviceencryption) | Specify whether encryption is required. | ✔️ | ✔️ | ✔️ | ✔️ |
+| [RequireProvisioningPackageSignature](/windows/client-management/mdm/policy-configuration-service-provider#security-requireprovisioningpackagesignature) | Specify whether provisioning packages must have a certificate signed by a device-trusted authority. | ✔️ | ✔️ | | ✔️ |
+| [RequireRetrieveHealthCertificateOnBoot](/windows/client-management/mdm/policy-configuration-service-provider#security-requireretrievehealthcertificateonboot) | Specify whether to retrieve and post TCG Boot logs, and get or cache an encrypted or signed Health Attestation Report from the Microsoft Health Attestation Service when a device boots or reboots. | ✔️ | | | |
## Settings
-| Setting | Description | Desktop editions | Mobile editions | Surface Hub | HoloLens | IoT Core |
-| --- | --- | :---: | :---: | :---: | :---: | :---: |
-| [AllowAutoPlay](/windows/client-management/mdm/policy-configuration-service-provider#settings-allowautoplay) | Allow the user to change AutoPlay settings. | | ✔️ | | | |
-| [AllowDataSense](/windows/client-management/mdm/policy-configuration-service-provider#settings-allowdatasense) | Allow the user to change Data Sense settings. | | ✔️ | | | |
-| [AllowVPN](/windows/client-management/mdm/policy-configuration-service-provider#settings-allowvpn) | Allow the user to change VPN settings. | | ✔️ | | ✔️ | |
-| [ConfigureTaskbarCalendar](/windows/client-management/mdm/policy-configuration-service-provider#settings-configuretaskbarcalendar) | Configure the default setting for showing additional calendars (besides the default calendar for the locale) in the taskbar clock and calendar flyout. | ✔️ | | | | |
-[PageVisiblityList](/windows/client-management/mdm/policy-csp-settings#settings-pagevisibilitylist) | Allows IT admins to prevent specific pages in the System Settings app from being visible or accessible. Pages are identified by a shortened version of their already [published URIs](/windows/uwp/launch-resume/launch-settings-app#ms-settings-uri-scheme-reference), which is the URI minus the "ms-settings:" prefix. For example, if the URI for a settings page is "ms-settings:foo", the page identifier used in the policy will be just "foo". Multiple page identifiers are separated by semicolons. | ✔️ | | | | |
+| Setting | Description | Windows client | Surface Hub | HoloLens | IoT Core |
+| --- | --- | :---: | :---: | :---: | :---: |
+| [AllowAutoPlay](/windows/client-management/mdm/policy-configuration-service-provider#settings-allowautoplay) | Allow the user to change AutoPlay settings. | | | | |
+| [AllowDataSense](/windows/client-management/mdm/policy-configuration-service-provider#settings-allowdatasense) | Allow the user to change Data Sense settings. | | | | |
+| [AllowVPN](/windows/client-management/mdm/policy-configuration-service-provider#settings-allowvpn) | Allow the user to change VPN settings. | | | ✔️ | |
+| [ConfigureTaskbarCalendar](/windows/client-management/mdm/policy-configuration-service-provider#settings-configuretaskbarcalendar) | Configure the default setting for showing additional calendars (besides the default calendar for the locale) in the taskbar clock and calendar flyout. | ✔️ | | | |
+[PageVisiblityList](/windows/client-management/mdm/policy-csp-settings#settings-pagevisibilitylist) | Allows IT admins to prevent specific pages in the System Settings app from being visible or accessible. Pages are identified by a shortened version of their already [published URIs](/windows/uwp/launch-resume/launch-settings-app#ms-settings-uri-scheme-reference), which is the URI minus the "ms-settings:" prefix. For example, if the URI for a settings page is "ms-settings:foo", the page identifier used in the policy will be just "foo". Multiple page identifiers are separated by semicolons. | ✔️ | | | |
## Start
-| Setting | Description | Desktop editions | Mobile editions | Surface Hub | HoloLens | IoT Core |
-| --- | --- | :---: | :---: | :---: | :---: | :---: |
-| [AllowPinnedFolderDocuments](/windows/client-management/mdm/policy-csp-start#start-allowpinnedfolderdocuments) | Control the visibility of the Documents shortcut on the Start menu. | ✔️ | | | | |
-| [AllowPinnedFolderDownloads](/windows/client-management/mdm/policy-csp-start#start-allowpinnedfolderdownloads) | Control the visibility of the Downloadds shortcut on the Start menu. | ✔️ | | | | |
-| [AllowPinnedFolderFileExplorer](/windows/client-management/mdm/policy-csp-start#start-allowpinnedfolderfileexplorer) | Control the visibility of the File Explorer shortcut on the Start menu. | ✔️ | | | | |
-| [AllowPinnedFolderHomeGroup](/windows/client-management/mdm/policy-csp-start#start-allowpinnedfolderhomegroup) | Control the visibility of the Home Group shortcut on the Start menu. | ✔️ | | | | |
-| [AllowPinnedFolderMusic](/windows/client-management/mdm/policy-csp-start#start-allowpinnedfoldermusic) | Control the visibility of the Music shortcut on the Start menu. | ✔️ | | | | |
-| [AllowPinnedFolderNetwork](/windows/client-management/mdm/policy-csp-start#start-allowpinnedfoldernetwork) | Control the visibility of the Network shortcut on the Start menu. | ✔️ | | | | |
-| [AllowPinnedFolderPersonalFolder](/windows/client-management/mdm/policy-csp-start#start-allowpinnedfolderpersonalfolder) | Control the visibility of the Personal Folder shortcut on the Start menu. | ✔️ | | | | |
-| [AllowPinnedFolderPictures](/windows/client-management/mdm/policy-csp-start#start-allowpinnedfolderpictures) | Control the visibility of the Pictures shortcut on the Start menu. | ✔️ | | | | |
-| [AllowPinnedFolderSettings](/windows/client-management/mdm/policy-csp-start#start-allowpinnedfoldersettings) | Control the visibility of the Settings shortcut on the Start menu. | ✔️ | | | | |
-| [AllowPinnedFolderVideos](/windows/client-management/mdm/policy-csp-start#start-allowpinnedfoldervideos) |Control the visibility of the Videos shortcut on the Start menu. | ✔️ | | | | |
-DisableContextMenus | Prevent context menus from being invoked in the Start menu. | ✔️ | | | | |
-| [ForceStartSize](/windows/client-management/mdm/policy-configuration-service-provider#start-forcestartsize) | Force the size of the Start screen. | ✔️ | | | | |
-| [HideAppList](/windows/client-management/mdm/policy-configuration-service-provider#start-hideapplist) | Collapse or remove the all apps list. | ✔️ | | | | |
-| [HideChangeAccountSettings](/windows/client-management/mdm/policy-configuration-service-provider#start-hidechangeaccountsettings) | Hide **Change account settings** from appearing in the user tile. | ✔️ | | | | |
-| [HideFrequentlyUsedApps](/windows/client-management/mdm/policy-configuration-service-provider#start-hidefrequentlyusedapps) | Hide **Most used** section of Start. | ✔️ | | | | |
-| [HideHibernate](/windows/client-management/mdm/policy-configuration-service-provider#start-hidehibernate) | Prevent **Hibernate** option from appearing in the Power button. | ✔️ | | | | |
-| [HideLock](/windows/client-management/mdm/policy-configuration-service-provider#start-hidelock) | Prevent **Lock** from appearing in the user tile. | ✔️ | | | | |
-| HidePeopleBar | Remove the people icon from the taskbar, as well as the corresponding settings toggle. It also prevents users from pinning people to the taskbar. | ✔️ | | | | |
-| [HidePowerButton](/windows/client-management/mdm/policy-configuration-service-provider#start-hidepowerbutton) | Hide the **Power** button. | ✔️ | | | | |
-| [HideRecentJumplists](/windows/client-management/mdm/policy-configuration-service-provider#start-hiderecentjumplists) | Hide jumplists of recently opened items. | ✔️ | | | | |
-| [HideRecentlyAddedApps](/windows/client-management/mdm/policy-configuration-service-provider#start-hiderecentlyaddedapps) | Hide **Recently added** section of Start. | ✔️ | | | | |
-| [HideRestart](/windows/client-management/mdm/policy-configuration-service-provider#start-hiderestart) | Prevent **Restart** and **Update and restart** from appearing in the Power button. | ✔️ | | | | |
-| [HideShutDown](/windows/client-management/mdm/policy-configuration-service-provider#start-hideshutdown) | Prevent **Shut down** and **Update and shut down** from appearing in the Power button. | ✔️ | | | | |
-| [HideSignOut](/windows/client-management/mdm/policy-configuration-service-provider#start-hidesignout) | Prevent **Sign out** from appearing in the user tile. | ✔️ | | | | |
-| [HideSleep](/windows/client-management/mdm/policy-configuration-service-provider#start-hidesleep) | Prevent **Sleep** from appearing in the Power button. | ✔️ | | | | |
-| [HideSwitchAccount](/windows/client-management/mdm/policy-configuration-service-provider#start-hideswitchaccount) | Prevent **Switch account** from appearing in the user tile. | ✔️ | | | | |
-| [HideUserTile](/windows/client-management/mdm/policy-configuration-service-provider#start-hideusertile) | Hide the user tile. | ✔️ | | | | |
-| [ImportEdgeAssets](/windows/client-management/mdm/policy-configuration-service-provider#start-importedgeassets) | Import Edge assets for secondary tiles. For more information, see [Add image for secondary Microsoft Edge tiles](../start-secondary-tiles.md). | ✔️ | | | | |
-| [NoPinningToTaskbar](/windows/client-management/mdm/policy-configuration-service-provider#start-nopinningtotaskbar) | Prevent users from pinning and unpinning apps on the taskbar. | ✔️ | | | | |
-| [StartLayout](/windows/client-management/mdm/policy-configuration-service-provider#start-startlayout) | Apply a custom Start layout. For more information, see [Customize Windows 10 Start and taskbar with provisioning packages](../customize-windows-10-start-screens-by-using-provisioning-packages-and-icd.md) | ✔️ | | | | |
+| Setting | Description | Windows client | Surface Hub | HoloLens | IoT Core |
+| --- | --- | :---: | :---: | :---: | :---: |
+| [AllowPinnedFolderDocuments](/windows/client-management/mdm/policy-csp-start#start-allowpinnedfolderdocuments) | Control the visibility of the Documents shortcut on the Start menu. | ✔️ | | | |
+| [AllowPinnedFolderDownloads](/windows/client-management/mdm/policy-csp-start#start-allowpinnedfolderdownloads) | Control the visibility of the Downloads shortcut on the Start menu. | ✔️ | | | |
+| [AllowPinnedFolderFileExplorer](/windows/client-management/mdm/policy-csp-start#start-allowpinnedfolderfileexplorer) | Control the visibility of the File Explorer shortcut on the Start menu. | ✔️ | | | |
+| [AllowPinnedFolderHomeGroup](/windows/client-management/mdm/policy-csp-start#start-allowpinnedfolderhomegroup) | Control the visibility of the Home Group shortcut on the Start menu. | ✔️ | | | |
+| [AllowPinnedFolderMusic](/windows/client-management/mdm/policy-csp-start#start-allowpinnedfoldermusic) | Control the visibility of the Music shortcut on the Start menu. | ✔️ | | | |
+| [AllowPinnedFolderNetwork](/windows/client-management/mdm/policy-csp-start#start-allowpinnedfoldernetwork) | Control the visibility of the Network shortcut on the Start menu. | ✔️ | | | |
+| [AllowPinnedFolderPersonalFolder](/windows/client-management/mdm/policy-csp-start#start-allowpinnedfolderpersonalfolder) | Control the visibility of the Personal Folder shortcut on the Start menu. | ✔️ | | | |
+| [AllowPinnedFolderPictures](/windows/client-management/mdm/policy-csp-start#start-allowpinnedfolderpictures) | Control the visibility of the Pictures shortcut on the Start menu. | ✔️ | | | |
+| [AllowPinnedFolderSettings](/windows/client-management/mdm/policy-csp-start#start-allowpinnedfoldersettings) | Control the visibility of the Settings shortcut on the Start menu. | ✔️ | | | |
+| [AllowPinnedFolderVideos](/windows/client-management/mdm/policy-csp-start#start-allowpinnedfoldervideos) |Control the visibility of the Videos shortcut on the Start menu. | ✔️ | | | |
+| DisableContextMenus | Prevent context menus from being invoked in the Start menu. | ✔️ | | | |
+| [ForceStartSize](/windows/client-management/mdm/policy-configuration-service-provider#start-forcestartsize) | Force the size of the Start screen. | ✔️ | | | |
+| [HideAppList](/windows/client-management/mdm/policy-configuration-service-provider#start-hideapplist) | Collapse or remove the all apps list. | ✔️ | | | |
+| [HideChangeAccountSettings](/windows/client-management/mdm/policy-configuration-service-provider#start-hidechangeaccountsettings) | Hide **Change account settings** from appearing in the user tile. | ✔️ | | | |
+| [HideFrequentlyUsedApps](/windows/client-management/mdm/policy-configuration-service-provider#start-hidefrequentlyusedapps) | Hide **Most used** section of Start. | ✔️ | | | |
+| [HideHibernate](/windows/client-management/mdm/policy-configuration-service-provider#start-hidehibernate) | Prevent **Hibernate** option from appearing in the Power button. | ✔️ | | | |
+| [HideLock](/windows/client-management/mdm/policy-configuration-service-provider#start-hidelock) | Prevent **Lock** from appearing in the user tile. | ✔️ | | | |
+| HidePeopleBar | Remove the people icon from the taskbar, as well as the corresponding settings toggle. It also prevents users from pinning people to the taskbar. | ✔️ | | | |
+| [HidePowerButton](/windows/client-management/mdm/policy-configuration-service-provider#start-hidepowerbutton) | Hide the **Power** button. | ✔️ | | | |
+| [HideRecentJumplists](/windows/client-management/mdm/policy-configuration-service-provider#start-hiderecentjumplists) | Hide jumplists of recently opened items. | ✔️ | | | |
+| [HideRecentlyAddedApps](/windows/client-management/mdm/policy-configuration-service-provider#start-hiderecentlyaddedapps) | Hide **Recently added** section of Start. | ✔️ | | | |
+| [HideRestart](/windows/client-management/mdm/policy-configuration-service-provider#start-hiderestart) | Prevent **Restart** and **Update and restart** from appearing in the Power button. | ✔️ | | | |
+| [HideShutDown](/windows/client-management/mdm/policy-configuration-service-provider#start-hideshutdown) | Prevent **Shut down** and **Update and shut down** from appearing in the Power button. | ✔️ | | | |
+| [HideSignOut](/windows/client-management/mdm/policy-configuration-service-provider#start-hidesignout) | Prevent **Sign out** from appearing in the user tile. | ✔️ | | | |
+| [HideSleep](/windows/client-management/mdm/policy-configuration-service-provider#start-hidesleep) | Prevent **Sleep** from appearing in the Power button. | ✔️ | | | |
+| [HideSwitchAccount](/windows/client-management/mdm/policy-configuration-service-provider#start-hideswitchaccount) | Prevent **Switch account** from appearing in the user tile. | ✔️ | | | |
+| [HideUserTile](/windows/client-management/mdm/policy-configuration-service-provider#start-hideusertile) | Hide the user tile. | ✔️ | | | |
+| [ImportEdgeAssets](/windows/client-management/mdm/policy-configuration-service-provider#start-importedgeassets) | Import Edge assets for secondary tiles. For more information, see [Add image for secondary Microsoft Edge tiles](../start-secondary-tiles.md). | ✔️ | | | |
+| [NoPinningToTaskbar](/windows/client-management/mdm/policy-configuration-service-provider#start-nopinningtotaskbar) | Prevent users from pinning and unpinning apps on the taskbar. | ✔️ | | | |
+| [StartLayout](/windows/client-management/mdm/policy-configuration-service-provider#start-startlayout) | Apply a custom Start layout. For more information, see [Customize Windows 10 Start and taskbar with provisioning packages](../customize-windows-10-start-screens-by-using-provisioning-packages-and-icd.md) | ✔️ | | | |
## System
-| Setting | Description | Desktop editions | Mobile editions | Surface Hub | HoloLens | IoT Core |
-| --- | --- | :---: | :---: | :---: | :---: | :---: |
-| [AllowBuildPreview](/windows/client-management/mdm/policy-configuration-service-provider#system-allowbuildpreview) | Specify whether users can access the Insider build controls in the **Advanced Options** for Windows Update. | ✔️ | ✔️ | | | |
-| [AllowEmbeddedMode](/windows/client-management/mdm/policy-configuration-service-provider#system-allowembeddedmode) | Specify whether to set general purpose device to be in embedded mode. | ✔️ | ✔️ | ✔️ | | ✔️ |
-| [AllowExperimentation](/windows/client-management/mdm/policy-configuration-service-provider#system-allowexperimentation) | Determine the level that Microsoft can experiment with the product to study user preferences or device behavior. | ✔️ | ✔️ | | | |
-| [AllowLocation](/windows/client-management/mdm/policy-configuration-service-provider#system-allowlocation) | Specify whether to allow app access to the Location service. | ✔️ | ✔️ | ✔️ | ✔️ | ✔️ |
-| [AllowStorageCard](/windows/client-management/mdm/policy-configuration-service-provider#system-allowstoragecard) | Specify whether the user is allowed to use the storage card for device storage. | ✔️ | ✔️ | ✔️ | | ✔️ |
-| [AllowTelemetry](/windows/client-management/mdm/policy-configuration-service-provider#system-allowtelemetry) | Allow the device to send diagnostic and usage data. | ✔️ | ✔️ | | ✔️ | |
-| [AllowUserToResetPhone](/windows/client-management/mdm/policy-configuration-service-provider#system-allowusertoresetphone) | Allow the user to factory reset the phone. | ✔️ | ✔️ | | | |
-ConfigureTelemetryOptInChangeNotification | This policy setting determines whether a device shows notifications about telemetry levels to people on first sign-in or when changes occur in Settings. | ✔️ | ✔️ | | | |
-ConfigureTelemetryOptInSettingsUx | This policy setting determines whether people can change their own telemetry levels in Settings | ✔️ | ✔️ | | | |
-| DisableDeviceDelete | Specify whether the delete diagnostic data is enabled in the Diagnostic & Feedback Settings page. | ✔️ | ✔️ | | | |
-| DisableDataDiagnosticViewer | Configure whether users can enable and launch the Diagnostic Data Viewer from the Diagnostic & Feedback Settings page. | ✔️ | ✔️ | | | |
-| [DisableOneDriveFileSync](/windows/client-management/mdm/policy-configuration-service-provider#system-disableonedrivefilesync) | Prevent apps and features from working with files on OneDrive. | ✔️ | | | | |
-| [LimitEnhancedDiagnosticDataWindowsAnalytics](/windows/client-management/mdm/policy-csp-system#system-limitenhanceddiagnosticdatawindowsanalytics) | This policy setting, in combination with the System/AllowTelemetry policy setting, enables organizations to send Microsoft a specific set of diagnostic data for IT insights via Windows Analytics services. To enable this behavior you must enable this policy setting, and set Allow Telemetry to level 2 (Enhanced). When you configure these policy settings, a basic level of diagnostic data plus additional events that are required for Windows Analytics are sent to Microsoft. These events are documented in [Windows 10, version 1703 basic level Windows diagnostic events and fields](/windows/privacy/enhanced-diagnostic-data-windows-analytics-events-and-fields). Enabling enhanced diagnostic data in the System/AllowTelemetry policy in combination with not configuring this policy will also send the required events for Windows Analytics, plus additional enhanced level diagnostic data. This setting has no effect on computers configured to send full, basic or security level diagnostic data to Microsoft. If you disable or do not configure this policy setting, then the level of diagnostic data sent to Microsoft is determined by the System/AllowTelemetry policy. | ✔️ | ✔️ | | | |
+| Setting | Description | Windows client | Surface Hub | HoloLens | IoT Core |
+| --- | --- | :---: | :---: | :---: | :---: |
+| [AllowBuildPreview](/windows/client-management/mdm/policy-configuration-service-provider#system-allowbuildpreview) | Specify whether users can access the Insider build controls in the **Advanced Options** for Windows Update. | ✔️ | | | |
+| [AllowEmbeddedMode](/windows/client-management/mdm/policy-configuration-service-provider#system-allowembeddedmode) | Specify whether to set general purpose device to be in embedded mode. | ✔️ | ✔️ | | ✔️ |
+| [AllowExperimentation](/windows/client-management/mdm/policy-configuration-service-provider#system-allowexperimentation) | Determine the level that Microsoft can experiment with the product to study user preferences or device behavior. | ✔️ | | | |
+| [AllowLocation](/windows/client-management/mdm/policy-configuration-service-provider#system-allowlocation) | Specify whether to allow app access to the Location service. | ✔️ | ✔️ | ✔️ | ✔️ |
+| [AllowStorageCard](/windows/client-management/mdm/policy-configuration-service-provider#system-allowstoragecard) | Specify whether the user is allowed to use the storage card for device storage. | ✔️ | ✔️ | | ✔️ |
+| [AllowTelemetry](/windows/client-management/mdm/policy-configuration-service-provider#system-allowtelemetry) | Allow the device to send diagnostic and usage data. | ✔️ | | ✔️ | |
+| [AllowUserToResetPhone](/windows/client-management/mdm/policy-configuration-service-provider#system-allowusertoresetphone) | Allow the user to factory reset the phone. | ✔️ | | | |
+ConfigureTelemetryOptInChangeNotification | This policy setting determines whether a device shows notifications about telemetry levels to people on first sign-in or when changes occur in Settings. | ✔️ | | | |
+ConfigureTelemetryOptInSettingsUx | This policy setting determines whether people can change their own telemetry levels in Settings | ✔️ | | | |
+| DisableDeviceDelete | Specify whether the delete diagnostic data is enabled in the Diagnostic & Feedback Settings page. | ✔️ | | | |
+| DisableDataDiagnosticViewer | Configure whether users can enable and launch the Diagnostic Data Viewer from the Diagnostic & Feedback Settings page. | ✔️ | | | |
+| [DisableOneDriveFileSync](/windows/client-management/mdm/policy-configuration-service-provider#system-disableonedrivefilesync) | Prevent apps and features from working with files on OneDrive. | ✔️ | | | |
+| [LimitEnhancedDiagnosticDataWindowsAnalytics](/windows/client-management/mdm/policy-csp-system#system-limitenhanceddiagnosticdatawindowsanalytics) | This policy setting, in combination with the System/AllowTelemetry policy setting, enables organizations to send Microsoft a specific set of diagnostic data for IT insights via Windows Analytics services. To enable this behavior you must enable this policy setting, and set Allow Telemetry to level 2 (Enhanced). When you configure these policy settings, a basic level of diagnostic data plus additional events that are required for Windows Analytics are sent to Microsoft. These events are documented in [Windows 10, version 1703 basic level Windows diagnostic events and fields](/windows/privacy/enhanced-diagnostic-data-windows-analytics-events-and-fields). Enabling enhanced diagnostic data in the System/AllowTelemetry policy in combination with not configuring this policy will also send the required events for Windows Analytics, plus additional enhanced level diagnostic data. This setting has no effect on computers configured to send full, basic or security level diagnostic data to Microsoft. If you disable or do not configure this policy setting, then the level of diagnostic data sent to Microsoft is determined by the System/AllowTelemetry policy. | ✔️ | | | |
## TextInput
-| Setting | Description | Desktop editions | Mobile editions | Surface Hub | HoloLens | IoT Core |
-| --- | --- | :---: | :---: | :---: | :---: | :---: |
-| [AllowIMELogging](/windows/client-management/mdm/policy-configuration-service-provider#textinput-allowimelogging) | Allow the user to turn on and off the logging for incorrect conversion and saving auto-tuning result to a file and history-based predictive input. | ✔️ | | | | |
-| [AllowIMENetworkAccess](/windows/client-management/mdm/policy-configuration-service-provider#textinput-allowimenetworkaccess) | Allow the user to turn on Open Extended Dictionary, Internet search integration, or cloud candidate features to provide input suggestions that do not exist in the device's local dictionary. | ✔️ | | | | |
-| [AllowInputPanel](/windows/client-management/mdm/policy-configuration-service-provider#textinput-allowinputpanel) | Disable the touch/handwriting keyboard. | ✔️ | | | | |
-| [AllowJapaneseIMESurrogatePairCharacters](/windows/client-management/mdm/policy-configuration-service-provider#textinput-allowjapaneseimesurrogatepaircharacters) | Allow the Japanese IME surrogate pair characters. | ✔️ | | | | |
-| [AllowJapaneseIVSCharacters](/windows/client-management/mdm/policy-configuration-service-provider#textinput-allowjapaneseivscharacters) | Allow Japanese Ideographic Variation Sequence (IVS) characters. | ✔️ | | | | |
-| [AllJapaneseNonPublishingStandardGlyph](/windows/client-management/mdm/policy-configuration-service-provider#textinput-allowjapanesenonpublishingstandardglyph) | All the Japanese non-publishing standard glyph. | ✔️ | | | | |
-| [AllowJapaneseUserDictionary](/windows/client-management/mdm/policy-configuration-service-provider#textinput-allowjapaneseuserdictionary) | Allow the Japanese user dictionary. | ✔️ | | | | |
-| [AllowKeyboardTextSuggestions](/windows/client-management/mdm/policy-configuration-service-provider#textinput-allowkeyboardtextsuggestions) | Specify whether text prediction is enabled or disabled for the on-screen keyboard, touch keyboard, and handwriting recognition tool. | ✔️ | | | | |
-| [AllowLanguageFeaturesUninstall](/windows/client-management/mdm/policy-configuration-service-provider#textinput-allowlanguagefeaturesuninstall) | All language features to be uninstalled. | ✔️ | | | | |
-| AllowUserInputsFromMiracastRecevier | Do not use. Instead, use [WirelessDisplay](#wirelessdisplay)/[AllowUserInputFromWirelessDisplayReceiver](/windows/client-management/mdm/policy-configuration-service-provider#wirelessdisplay-allowuserinputfromwirelessdisplayreceiver) | | | | | |
-| [ExcludeJapaneseIMEExceptISO208](/windows/client-management/mdm/policy-configuration-service-provider#textinput-excludejapaneseimeexceptjis0208) | Allow users to restrict character code range of conversion by setting the character filter. | ✔️ | | | | |
-| [ExcludeJapaneseIMEExceptISO208andEUDC](/windows/client-management/mdm/policy-configuration-service-provider#textinput-excludejapaneseimeexceptjis0208andeudc) | Allow users to restrict character code range of conversion by setting the character filter. | ✔️ | | | | |
-| [ExcludeJapaneseIMEExceptShiftJIS](/windows/client-management/mdm/policy-configuration-service-provider#textinput-excludejapaneseimeexceptshiftjis) | Allow users to restrict character code range of conversion by setting the character filter. | ✔️ | | | | |
+| Setting | Description | Windows client | Surface Hub | HoloLens | IoT Core |
+| --- | --- | :---: | :---: | :---: | :---: |
+| [AllowIMELogging](/windows/client-management/mdm/policy-configuration-service-provider#textinput-allowimelogging) | Allow the user to turn on and off the logging for incorrect conversion and saving auto-tuning result to a file and history-based predictive input. | ✔️ | | | |
+| [AllowIMENetworkAccess](/windows/client-management/mdm/policy-configuration-service-provider#textinput-allowimenetworkaccess) | Allow the user to turn on Open Extended Dictionary, Internet search integration, or cloud candidate features to provide input suggestions that do not exist in the device's local dictionary. | ✔️ | | | |
+| [AllowInputPanel](/windows/client-management/mdm/policy-configuration-service-provider#textinput-allowinputpanel) | Disable the touch/handwriting keyboard. | ✔️ | | | |
+| [AllowJapaneseIMESurrogatePairCharacters](/windows/client-management/mdm/policy-configuration-service-provider#textinput-allowjapaneseimesurrogatepaircharacters) | Allow the Japanese IME surrogate pair characters. | ✔️ | | | |
+| [AllowJapaneseIVSCharacters](/windows/client-management/mdm/policy-configuration-service-provider#textinput-allowjapaneseivscharacters) | Allow Japanese Ideographic Variation Sequence (IVS) characters. | ✔️ | | | |
+| [AllJapaneseNonPublishingStandardGlyph](/windows/client-management/mdm/policy-configuration-service-provider#textinput-allowjapanesenonpublishingstandardglyph) | All the Japanese non-publishing standard glyph. | ✔️ | | | |
+| [AllowJapaneseUserDictionary](/windows/client-management/mdm/policy-configuration-service-provider#textinput-allowjapaneseuserdictionary) | Allow the Japanese user dictionary. | ✔️ | | | |
+| [AllowKeyboardTextSuggestions](/windows/client-management/mdm/policy-configuration-service-provider#textinput-allowkeyboardtextsuggestions) | Specify whether text prediction is enabled or disabled for the on-screen keyboard, touch keyboard, and handwriting recognition tool. | ✔️ | | | |
+| [AllowLanguageFeaturesUninstall](/windows/client-management/mdm/policy-configuration-service-provider#textinput-allowlanguagefeaturesuninstall) | All language features to be uninstalled. | ✔️ | | | |
+| AllowUserInputsFromMiracastRecevier | Do not use. Instead, use [WirelessDisplay](#wirelessdisplay)/[AllowUserInputFromWirelessDisplayReceiver](/windows/client-management/mdm/policy-configuration-service-provider#wirelessdisplay-allowuserinputfromwirelessdisplayreceiver) | | | | |
+| [ExcludeJapaneseIMEExceptISO208](/windows/client-management/mdm/policy-configuration-service-provider#textinput-excludejapaneseimeexceptjis0208) | Allow users to restrict character code range of conversion by setting the character filter. | ✔️ | | | |
+| [ExcludeJapaneseIMEExceptISO208andEUDC](/windows/client-management/mdm/policy-configuration-service-provider#textinput-excludejapaneseimeexceptjis0208andeudc) | Allow users to restrict character code range of conversion by setting the character filter. | ✔️ | | | |
+| [ExcludeJapaneseIMEExceptShiftJIS](/windows/client-management/mdm/policy-configuration-service-provider#textinput-excludejapaneseimeexceptshiftjis) | Allow users to restrict character code range of conversion by setting the character filter. | ✔️ | | | |
## TimeLanguageSettings
-| Setting | Description | Desktop editions | Mobile editions | Surface Hub | HoloLens | IoT Core |
-| --- | --- | :---: | :---: | :---: | :---: | :---: |
-| [AllowSet24HourClock](/windows/client-management/mdm/policy-configuration-service-provider#timelanguagesettings-allowset24hourclock) | Configure the default clock setting to be the 24 hour format. | | ✔️ | | | |
+| Setting | Description | Windows client | Surface Hub | HoloLens | IoT Core |
+| --- | --- | :---: | :---: | :---: | :---: |
+| [AllowSet24HourClock](/windows/client-management/mdm/policy-configuration-service-provider#timelanguagesettings-allowset24hourclock) | Configure the default clock setting to be the 24 hour format. | | | | |
## Update
-| Setting | Description | Desktop editions | Mobile editions | Surface Hub | HoloLens | IoT Core |
-|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------|:----------------:|:---------------:|:-----------:|:--------:|:--------:|
-| [ActiveHoursEnd](/windows/client-management/mdm/policy-configuration-service-provider#update-activehoursend) | Use with **Update/ActiveHoursStart** to manage the range of active hours where update rboots are not scheduled. | ✔️ | ✔️ | ✔️ | | ✔️ |
-| [ActiveHoursMaxRange](/windows/client-management/mdm/policy-configuration-service-provider#update-activehoursmaxrange) | Specify the maximum active hours range. | ✔️ | ✔️ | ✔️ | | ✔️ |
-| [ActiveHoursStart](/windows/client-management/mdm/policy-configuration-service-provider#update-activehoursstart) | Use with **Update/ActiveHoursEnd** to manage the range of active hours where update reboots are not scheduled. | ✔️ | ✔️ | ✔️ | | ✔️ |
-| [AllowAutoUpdate](/windows/client-management/mdm/policy-configuration-service-provider#update-allowautoupdate) | Configure automatic update behavior to scan, download, and install updates. | ✔️ | ✔️ | ✔️ | ✔️ | ✔️ |
-| [AllowAutoWindowsUpdateDownloadOverMeteredNetwork](/windows/client-management/mdm/policy-csp-update#update-allowautowindowsupdatedownloadovermeterednetwork) | Option to download updates automatically over metered connections (off by default). Enter `0` for not allowed, or `1` for allowed. | ✔️ | ✔️ | ✔️ | | ✔️ |
-| [AllowMUUpdateService](/windows/client-management/mdm/policy-configuration-service-provider#update-allowmuupdateservice) | Manage whether to scan for app updates from Microsoft Update. | ✔️ | ✔️ | ✔️ | ✔️ | ✔️ |
-| [AllowNonMicrosoftSignedUpdate](/windows/client-management/mdm/policy-configuration-service-provider#update-allownonmicrosoftsignedupdate) | Manage whether Automatic Updates accepts updates signed by entities other than Microsoft when the update is found at the UpdateServiceUrl location. | ✔️ | ✔️ | ✔️ | | ✔️ |
-| [AllowUpdateService](/windows/client-management/mdm/policy-configuration-service-provider#update-allowupdateservice) | Specify whether the device can use Microsoft Update, Windows Server Update Services (WSUS), or Microsoft Store. | ✔️ | ✔️ | ✔️ | ✔️ | ✔️ |
-| [AutoRestartDeadlinePeriodInDays](/windows/client-management/mdm/policy-csp-update#update-autorestartdeadlineperiodindays) | Specify number of days (between 2 and 30) after which a forced restart will occur outside of active hours when restart is pending. | ✔️ | ✔️ | ✔️ | | ✔️ |
-| [AutoRestartDeadlinePeriodInDaysForFeatureUpdates](/windows/client-management/mdm/policy-csp-update#update-autorestartdeadlineperiodindaysforfeatureupdates) | Specify number of days (between 2 and 30) after which a forced restart will occur outside of active hours when restart is pending. | ✔️ | ✔️ | ✔️ | | ✔️ |
-| [AutoRestartNotificationSchedule](/windows/client-management/mdm/policy-configuration-service-provider#update-autorestartnotificationschedule) | Specify the period for auto-restart reminder notifications. | ✔️ | ✔️ | ✔️ | | ✔️ |
-| [AutoRestartRequiredNotificationDismissal](/windows/client-management/mdm/policy-configuration-service-provider#update-autorestartrequirednotificationdismissal) | Specify the method by which the auto-restart required notification is dismissed. | ✔️ | ✔️ | ✔️ | | ✔️ |
-| [BranchReadinessLevel](/windows/client-management/mdm/policy-configuration-service-provider#update-branchreadinesslevel) | Select which branch a device receives their updates from. | ✔️ | ✔️ | ✔️ | ✔️ | ✔️ |
-| [DeferFeatureUpdatesPeriodInDays](/windows/client-management/mdm/policy-configuration-service-provider#update-deferfeatureupdatesperiodindays) | Defer Feature Updates for the specified number of days. | ✔️ | ✔️ | ✔️ | | ✔️ |
-| [DeferQualityUpdatesPeriodInDays](/windows/client-management/mdm/policy-configuration-service-provider#update-deferqualityupdatesperiodindays) | Defer Quality Updates for the specified number of days. | ✔️ | ✔️ | ✔️ | | ✔️ |
-| [DeferUpdatePeriod](/windows/client-management/mdm/policy-csp-update#update-deferupdateperiod) | Specify update delays for up to 4 weeks. | ✔️ | ✔️ | ✔️ | ✔️ | ✔️ |
-| [DeferUpgradePeriod](/windows/client-management/mdm/policy-csp-update#update-deferupgradeperiod) | Specify upgrade delays for up to 8 months. | ✔️ | ✔️ | ✔️ | ✔️ | ✔️ |
-| [DetectionFrequency](/windows/client-management/mdm/policy-configuration-service-provider#update-detectionfrequency) | Specify the frequency to scan for updates, from every 1-22 hours. | ✔️ | ✔️ | ✔️ | ✔️ | ✔️ |
-| [DisableDualScan](/windows/client-management/mdm/policy-csp-update#update-disabledualscan) | Do not allow update deferral policies to cause scans against Windows Update. | ✔️ | ✔️ | ✔️ | | ✔️ |
-| [EngagedRestartDeadline](/windows/client-management/mdm/policy-configuration-service-provider#update-engagedrestartdeadline) | Specify the deadline in days before automatically scheduling and executing a pending restart outside of active hours. | ✔️ | ✔️ | ✔️ | | ✔️ |
-| [EngagedRestartDeadlineForFeatureUpdates](/windows/client-management/mdm/policy-configuration-service-provider#update-engagedrestartdeadlineforfeatureupdates) | Specify the deadline in days before automatically scheduling and executing a pending restart outside of active hours. | ✔️ | ✔️ | ✔️ | | ✔️ |
-| [EngagedRestartSnoozeSchedule](/windows/client-management/mdm/policy-configuration-service-provider#update-engagedrestartsnoozeschedule) | Specify the number of days a user can snooze Engaged restart reminder notifications. | ✔️ | ✔️ | ✔️ | | ✔️ |
-| [EngagedRestartSnoozeScheduleForFeatureUpdates](/windows/client-management/mdm/policy-configuration-service-provider#update-engagedrestartsnoozescheduleforfeatureupdates) | Specify the number of days a user can snooze Engaged restart reminder notifications. | ✔️ | ✔️ | ✔️ | | ✔️ |
-| [EngagedRestartTransitionSchedule](/windows/client-management/mdm/policy-configuration-service-provider#update-engagedrestarttransitionschedule) | Specify the timing before transitioning from Auto restarts scheduled outside of active hours to Engaged restart, which requires the user to schedule. | ✔️ | ✔️ | ✔️ | | ✔️ |
-| [EngagedRestartTransitionScheduleForFeatureUpdates](/windows/client-management/mdm/policy-configuration-service-provider#update-engagedrestarttransitionscheduleforfeatureupdates) | Specify the timing before transitioning from Auto restarts scheduled outside of active hours to Engaged restart, which requires the user to schedule. | ✔️ | ✔️ | ✔️ | | ✔️ |
-| [ExcludeWUDriversInQualityUpdate](/windows/client-management/mdm/policy-configuration-service-provider#update-excludewudriversinqualityupdate) | Exclude Windws Update (WU) drivers during quality updates. | ✔️ | | ✔️ | | ✔️ |
-| [FillEmptyContentUrls](/windows/client-management/mdm/policy-configuration-service-provider#update-fillemptycontenturls) | Allow Windows Update Agent to determine the download URL when it is missing from the metadata. | ✔️ | ✔️ | ✔️ | | ✔️ |
-| ManagePreviewBuilds | Use to enable or disable preview builds. | ✔️ | ✔️ | ✔️ | ✔️ | ✔️ |
-| PhoneUpdateRestrictions | Deprecated | | ✔️ | | | |
-| [RequireDeferUpgrade](/windows/client-management/mdm/policy-configuration-service-provider#update-requiredeferupgrade) | Configure device to receive updates from Current Branch for Business (CBB). | ✔️ | ✔️ | ✔️ | ✔️ | ✔️ |
-| [ScheduledInstallDay](/windows/client-management/mdm/policy-configuration-service-provider#update-scheduledinstallday) | Schedule the day for update installation. | ✔️ | ✔️ | ✔️ | ✔️ | ✔️ |
-| [ScheduledInstallEveryWeek](/windows/client-management/mdm/policy-csp-update#update-scheduledinstalleveryweek) | To schedule update installation every week, set the value as `1`. | ✔️ | ✔️ | ✔️ | ✔️ | ✔️ |
-| [ScheduledInstallFirstWeek](/windows/client-management/mdm/policy-csp-update#update-scheduledinstallfirstweek) | To schedule update installation the first week of the month, see the value as `1`. | ✔️ | ✔️ | ✔️ | ✔️ | ✔️ |
-| [ScheduledInstallFourthWeek](/windows/client-management/mdm/policy-csp-update#update-scheduledinstallfourthweek) | To schedule update installation the fourth week of the month, see the value as `1`. | ✔️ | ✔️ | ✔️ | ✔️ | ✔️ |
-| [ScheduledInstallSecondWeek](/windows/client-management/mdm/policy-csp-update#update-scheduledinstallsecondweek) | To schedule update installation the second week of the month, see the value as `1`. | ✔️ | ✔️ | ✔️ | ✔️ | ✔️ |
-| [ScheduledInstallThirdWeek](/windows/client-management/mdm/policy-csp-update#update-scheduledinstallthirdweek) | To schedule update installation the third week of the month, see the value as `1`. | ✔️ | ✔️ | ✔️ | ✔️ | ✔️ |
-| [ScheduledInstallTime](/windows/client-management/mdm/policy-configuration-service-provider#update-scheduledinstalltime) | Schedule the time for update installation. | ✔️ | ✔️ | ✔️ | ✔️ | ✔️ |
-| [ScheduleImminentRestartWarning](/windows/client-management/mdm/policy-configuration-service-provider#update-scheduleimminentrestartwarning) | Specify the period for auto-restart imminent warning notifications. | ✔️ | ✔️ | ✔️ | | ✔️ |
-| [ScheduleRestartWarning](/windows/client-management/mdm/policy-configuration-service-provider#update-schedulerestartwarning) | Specify the period for auto-restart warning reminder notifications. | ✔️ | ✔️ | ✔️ | | ✔️ |
-| [SetAutoRestartNotificationDisable](/windows/client-management/mdm/policy-configuration-service-provider#update-setautorestartnotificationdisable) | Disable auto-restart notifications for update installations. | ✔️ | ✔️ | ✔️ | | ✔️ |
-| [SetDisablePauseUXAccess](/windows/client-management/mdm/policy-configuration-service-provider#update-setdisablepauseuxaccess) | Disable access to scan Windows Update. | ✔️ | ✔️ | ✔️ | | ✔️ |
-| [SetDisableUXWUAccess](/windows/client-management/mdm/policy-configuration-service-provider#update-setdisableuxwuaccess) | Disable the **Pause updates** feature. | ✔️ | ✔️ | ✔️ | | ✔️ |
-| [SetEDURestart](/windows/client-management/mdm/policy-configuration-service-provider#update-setedurestart) | Skip the check for battery level to ensure that the reboot will happen at ScheduledInstallTime. | ✔️ | ✔️ | ✔️ | | ✔️ |
-| UpdateNotificationLevel | Specify whether to enable or disable Windows Update notifications, including restart warnings. | ✔️ | ✔️ | ✔️ | | ✔️ |
-| [UpdateServiceUrl](/windows/client-management/mdm/policy-configuration-service-provider#update-updateserviceurl) | Configure the device to check for updates from a WSUS server instead of Microsoft Update. | ✔️ | ✔️ | ✔️ | ✔️ | ✔️ |
-| [UpdateServiceUrlAlternate](/windows/client-management/mdm/policy-configuration-service-provider#update-updateserviceurlalternate) | Specify an alternate intranet server to host updates from Microsoft Update. | ✔️ | ✔️ | ✔️ | ✔️ | ✔️ |
+| Setting | Description | Windows client | Surface Hub | HoloLens | IoT Core |
+|---------|-------------|:--------------:|:-----------:|:--------:|:--------:|
+| [ActiveHoursEnd](/windows/client-management/mdm/policy-configuration-service-provider#update-activehoursend) | Use with **Update/ActiveHoursStart** to manage the range of active hours where update reboots are not scheduled. | ✔️ | ✔️ | | ✔️ |
+| [ActiveHoursMaxRange](/windows/client-management/mdm/policy-configuration-service-provider#update-activehoursmaxrange) | Specify the maximum active hours range. | ✔️ | ✔️ | | ✔️ |
+| [ActiveHoursStart](/windows/client-management/mdm/policy-configuration-service-provider#update-activehoursstart) | Use with **Update/ActiveHoursEnd** to manage the range of active hours where update reboots are not scheduled. | ✔️ | ✔️ | | ✔️ |
+| [AllowAutoUpdate](/windows/client-management/mdm/policy-configuration-service-provider#update-allowautoupdate) | Configure automatic update behavior to scan, download, and install updates. | ✔️ | ✔️ | ✔️ | ✔️ |
+| [AllowAutoWindowsUpdateDownloadOverMeteredNetwork](/windows/client-management/mdm/policy-csp-update#update-allowautowindowsupdatedownloadovermeterednetwork) | Option to download updates automatically over metered connections (off by default). Enter `0` for not allowed, or `1` for allowed. | ✔️ | ✔️ | | ✔️ |
+| [AllowMUUpdateService](/windows/client-management/mdm/policy-configuration-service-provider#update-allowmuupdateservice) | Manage whether to scan for app updates from Microsoft Update. | ✔️ | ✔️ | ✔️ | ✔️ |
+| [AllowNonMicrosoftSignedUpdate](/windows/client-management/mdm/policy-configuration-service-provider#update-allownonmicrosoftsignedupdate) | Manage whether Automatic Updates accepts updates signed by entities other than Microsoft when the update is found at the UpdateServiceUrl location. | ✔️ | ✔️ | | ✔️ |
+| [AllowUpdateService](/windows/client-management/mdm/policy-configuration-service-provider#update-allowupdateservice) | Specify whether the device can use Microsoft Update, Windows Server Update Services (WSUS), or Microsoft Store. | ✔️ | ✔️ | ✔️ | ✔️ |
+| [AutoRestartDeadlinePeriodInDays](/windows/client-management/mdm/policy-csp-update#update-autorestartdeadlineperiodindays) | Specify number of days (between 2 and 30) after which a forced restart will occur outside of active hours when restart is pending. | ✔️ | ✔️ | | ✔️ |
+| [AutoRestartDeadlinePeriodInDaysForFeatureUpdates](/windows/client-management/mdm/policy-csp-update#update-autorestartdeadlineperiodindaysforfeatureupdates) | Specify number of days (between 2 and 30) after which a forced restart will occur outside of active hours when restart is pending. | ✔️ | ✔️ | | ✔️ |
+| [AutoRestartNotificationSchedule](/windows/client-management/mdm/policy-configuration-service-provider#update-autorestartnotificationschedule) | Specify the period for auto-restart reminder notifications. | ✔️ | ✔️ | | ✔️ |
+| [AutoRestartRequiredNotificationDismissal](/windows/client-management/mdm/policy-configuration-service-provider#update-autorestartrequirednotificationdismissal) | Specify the method by which the auto-restart required notification is dismissed. | ✔️ | ✔️ | | ✔️ |
+| [BranchReadinessLevel](/windows/client-management/mdm/policy-configuration-service-provider#update-branchreadinesslevel) | Select which branch a device receives their updates from. | ✔️ | ✔️ | ✔️ | ✔️ |
+| [DeferFeatureUpdatesPeriodInDays](/windows/client-management/mdm/policy-configuration-service-provider#update-deferfeatureupdatesperiodindays) | Defer Feature Updates for the specified number of days. | ✔️ | ✔️ | | ✔️ |
+| [DeferQualityUpdatesPeriodInDays](/windows/client-management/mdm/policy-configuration-service-provider#update-deferqualityupdatesperiodindays) | Defer Quality Updates for the specified number of days. | ✔️ | ✔️ | | ✔️ |
+| [DeferUpdatePeriod](/windows/client-management/mdm/policy-csp-update#update-deferupdateperiod) | Specify update delays for up to 4 weeks. | ✔️ | ✔️ | ✔️ | ✔️ |
+| [DeferUpgradePeriod](/windows/client-management/mdm/policy-csp-update#update-deferupgradeperiod) | Specify upgrade delays for up to 8 months. | ✔️ | ✔️ | ✔️ | ✔️ |
+| [DetectionFrequency](/windows/client-management/mdm/policy-configuration-service-provider#update-detectionfrequency) | Specify the frequency to scan for updates, from every 1-22 hours. | ✔️ | ✔️ | ✔️ | ✔️ |
+| [DisableDualScan](/windows/client-management/mdm/policy-csp-update#update-disabledualscan) | Do not allow update deferral policies to cause scans against Windows Update. | ✔️ | ✔️ | | ✔️ |
+| [EngagedRestartDeadline](/windows/client-management/mdm/policy-configuration-service-provider#update-engagedrestartdeadline) | Specify the deadline in days before automatically scheduling and executing a pending restart outside of active hours. | ✔️ | ✔️ | | ✔️ |
+| [EngagedRestartDeadlineForFeatureUpdates](/windows/client-management/mdm/policy-configuration-service-provider#update-engagedrestartdeadlineforfeatureupdates) | Specify the deadline in days before automatically scheduling and executing a pending restart outside of active hours. | ✔️ | ✔️ | | ✔️ |
+| [EngagedRestartSnoozeSchedule](/windows/client-management/mdm/policy-configuration-service-provider#update-engagedrestartsnoozeschedule) | Specify the number of days a user can snooze Engaged restart reminder notifications. | ✔️ | ✔️ | | ✔️ |
+| [EngagedRestartSnoozeScheduleForFeatureUpdates](/windows/client-management/mdm/policy-configuration-service-provider#update-engagedrestartsnoozescheduleforfeatureupdates) | Specify the number of days a user can snooze Engaged restart reminder notifications. | ✔️ | ✔️ | | ✔️ |
+| [EngagedRestartTransitionSchedule](/windows/client-management/mdm/policy-configuration-service-provider#update-engagedrestarttransitionschedule) | Specify the timing before transitioning from Auto restarts scheduled outside of active hours to Engaged restart, which requires the user to schedule. | ✔️ | ✔️ | | ✔️ |
+| [EngagedRestartTransitionScheduleForFeatureUpdates](/windows/client-management/mdm/policy-configuration-service-provider#update-engagedrestarttransitionscheduleforfeatureupdates) | Specify the timing before transitioning from Auto restarts scheduled outside of active hours to Engaged restart, which requires the user to schedule. | ✔️ | ✔️ | | ✔️ |
+| [ExcludeWUDriversInQualityUpdate](/windows/client-management/mdm/policy-configuration-service-provider#update-excludewudriversinqualityupdate) | Exclude Windows Update (WU) drivers during quality updates. | ✔️ | ✔️ | | ✔️ |
+| [FillEmptyContentUrls](/windows/client-management/mdm/policy-configuration-service-provider#update-fillemptycontenturls) | Allow Windows Update Agent to determine the download URL when it is missing from the metadata. | ✔️ | ✔️ | | ✔️ |
+| ManagePreviewBuilds | Use to enable or disable preview builds. | ✔️ | ✔️ | ✔️ | ✔️ |
+| PhoneUpdateRestrictions | Deprecated | | ✔️ | | |
+| [RequireDeferUpgrade](/windows/client-management/mdm/policy-configuration-service-provider#update-requiredeferupgrade) | Configure device to receive updates from Current Branch for Business (CBB). | ✔️ | ✔️ | ✔️ | ✔️ |
+| [ScheduledInstallDay](/windows/client-management/mdm/policy-configuration-service-provider#update-scheduledinstallday) | Schedule the day for update installation. | ✔️ | ✔️ | ✔️ | ✔️ |
+| [ScheduledInstallEveryWeek](/windows/client-management/mdm/policy-csp-update#update-scheduledinstalleveryweek) | To schedule update installation every week, set the value as `1`. | ✔️ | ✔️ | ✔️ | ✔️ |
+| [ScheduledInstallFirstWeek](/windows/client-management/mdm/policy-csp-update#update-scheduledinstallfirstweek) | To schedule update installation the first week of the month, see the value as `1`. | ✔️ | ✔️ | ✔️ | ✔️ |
+| [ScheduledInstallFourthWeek](/windows/client-management/mdm/policy-csp-update#update-scheduledinstallfourthweek) | To schedule update installation the fourth week of the month, see the value as `1`. | ✔️ | ✔️ | ✔️ | ✔️ |
+| [ScheduledInstallSecondWeek](/windows/client-management/mdm/policy-csp-update#update-scheduledinstallsecondweek) | To schedule update installation the second week of the month, see the value as `1`. | ✔️ | ✔️ | ✔️ | ✔️ |
+| [ScheduledInstallThirdWeek](/windows/client-management/mdm/policy-csp-update#update-scheduledinstallthirdweek) | To schedule update installation the third week of the month, see the value as `1`. | ✔️ | ✔️ | ✔️ | ✔️ |
+| [ScheduledInstallTime](/windows/client-management/mdm/policy-configuration-service-provider#update-scheduledinstalltime) | Schedule the time for update installation. | ✔️ | ✔️ | ✔️ | ✔️ |
+| [ScheduleImminentRestartWarning](/windows/client-management/mdm/policy-configuration-service-provider#update-scheduleimminentrestartwarning) | Specify the period for auto-restart imminent warning notifications. | ✔️ | ✔️ | | ✔️ |
+| [ScheduleRestartWarning](/windows/client-management/mdm/policy-configuration-service-provider#update-schedulerestartwarning) | Specify the period for auto-restart warning reminder notifications. | ✔️ | ✔️ | | ✔️ |
+| [SetAutoRestartNotificationDisable](/windows/client-management/mdm/policy-configuration-service-provider#update-setautorestartnotificationdisable) | Disable auto-restart notifications for update installations. | ✔️ | ✔️ | | ✔️ |
+| [SetDisablePauseUXAccess](/windows/client-management/mdm/policy-configuration-service-provider#update-setdisablepauseuxaccess) | Disable access to scan Windows Update. | ✔️ | ✔️ | | ✔️ |
+| [SetDisableUXWUAccess](/windows/client-management/mdm/policy-configuration-service-provider#update-setdisableuxwuaccess) | Disable the **Pause updates** feature. | ✔️ | ✔️ | | ✔️ |
+| [SetEDURestart](/windows/client-management/mdm/policy-configuration-service-provider#update-setedurestart) | Skip the check for battery level to ensure that the reboot will happen at ScheduledInstallTime. | ✔️ | ✔️ | | ✔️ |
+| UpdateNotificationLevel | Specify whether to enable or disable Windows Update notifications, including restart warnings. | ✔️ | ✔️ | | ✔️ |
+| [UpdateServiceUrl](/windows/client-management/mdm/policy-configuration-service-provider#update-updateserviceurl) | Configure the device to check for updates from a WSUS server instead of Microsoft Update. | ✔️ | ✔️ | ✔️ | ✔️ |
+| [UpdateServiceUrlAlternate](/windows/client-management/mdm/policy-configuration-service-provider#update-updateserviceurlalternate) | Specify an alternate intranet server to host updates from Microsoft Update. | ✔️ | ✔️ | ✔️ | ✔️ |
## WiFi
-| Setting | Description | Desktop editions | Mobile editions | Surface Hub | HoloLens | IoT Core |
-| --- | --- | :---: | :---: | :---: | :---: | :---: |
-| [AllowAutoConnectToWiFiSenseHotspots](/windows/client-management/mdm/policy-configuration-service-provider#wifi-allowautoconnecttowifisensehotspots) | Allow the device to connect automatically to Wi-Fi hotspots. | ✔️ | ✔️ | | | |
-| [AllowInternetSharing](/windows/client-management/mdm/policy-configuration-service-provider#wifi-allowinternetsharing) | Allow Internet sharing. | ✔️ | ✔️ | | | |
-| [AllowManualWiFiConfiguration](/windows/client-management/mdm/policy-configuration-service-provider#wifi-allowmanualwificonfiguration) | Allow connecting to Wi-Fi outside of MDM server-installed networks. | | ✔️ | | | |
-| [AllowWiFi](/windows/client-management/mdm/policy-configuration-service-provider#wifi-allowwifi) | Allow Wi-Fi connections. | | ✔️ | | | |
-| [WLANScanMode](/windows/client-management/mdm/policy-configuration-service-provider#wifi-wlanscanmode) | Configure the WLAN scanning behavior and how aggressively devices should be actively scanning for Wi-Fi networks to get devices connected. | ✔️ | ✔️ | ✔️ | | ✔️ |
+| Setting | Description | Windows client | Surface Hub | HoloLens | IoT Core |
+| --- | --- | :---: | :---: | :---: | :---: |
+| [AllowAutoConnectToWiFiSenseHotspots](/windows/client-management/mdm/policy-configuration-service-provider#wifi-allowautoconnecttowifisensehotspots) | Allow the device to connect automatically to Wi-Fi hotspots. | ✔️ | | | |
+| [AllowInternetSharing](/windows/client-management/mdm/policy-configuration-service-provider#wifi-allowinternetsharing) | Allow Internet sharing. | ✔️ | | | |
+| [AllowManualWiFiConfiguration](/windows/client-management/mdm/policy-configuration-service-provider#wifi-allowmanualwificonfiguration) | Allow connecting to Wi-Fi outside of MDM server-installed networks. | | | | |
+| [AllowWiFi](/windows/client-management/mdm/policy-configuration-service-provider#wifi-allowwifi) | Allow Wi-Fi connections. | | | | |
+| [WLANScanMode](/windows/client-management/mdm/policy-configuration-service-provider#wifi-wlanscanmode) | Configure the WLAN scanning behavior and how aggressively devices should be actively scanning for Wi-Fi networks to get devices connected. | ✔️ | ✔️ | | ✔️ |
## WindowsInkWorkspace
-| Setting | Description | Desktop editions | Mobile editions | Surface Hub | HoloLens | IoT Core |
-| --- | --- | :---: | :---: | :---: | :---: | :---: |
-| [AllowSuggestedAppsInWindowsInkWorkspace](/windows/client-management/mdm/policy-configuration-service-provider#windowsinkworkspace-allowsuggestedappsinwindowsinkworkspace) | Show recommended app suggestions in the ink workspace. | ✔️ | | | | |
-| [AllowWindowsInkWorkspace](/windows/client-management/mdm/policy-configuration-service-provider#windowsinkworkspace-allowwindowsinkworkspace) | Specify whether to allow the user to access the ink workspace. | ✔️ | | | | |
+| Setting | Description | Windows client | Surface Hub | HoloLens | IoT Core |
+| --- | --- | :---: | :---: | :---: | :---: |
+| [AllowSuggestedAppsInWindowsInkWorkspace](/windows/client-management/mdm/policy-configuration-service-provider#windowsinkworkspace-allowsuggestedappsinwindowsinkworkspace) | Show recommended app suggestions in the ink workspace. | ✔️ | | | |
+| [AllowWindowsInkWorkspace](/windows/client-management/mdm/policy-configuration-service-provider#windowsinkworkspace-allowwindowsinkworkspace) | Specify whether to allow the user to access the ink workspace. | ✔️ | | | |
## WindowsLogon
-| Setting | Description | Desktop editions | Mobile editions | Surface Hub | HoloLens | IoT Core |
-| --- | --- | :---: | :---: | :---: | :---: | :---: |
-| [HideFastUserSwitching](/windows/client-management/mdm/policy-configuration-service-provider#windowslogon-hidefastuserswitching) | Hide the **Switch account** button on the sign-in screen, Start, and the Task Manager. | ✔️ | | | | |
+
+| Setting | Description | Windows client | Surface Hub | HoloLens | IoT Core |
+| --- | --- | :---: | :---: | :---: | :---: |
+| [HideFastUserSwitching](/windows/client-management/mdm/policy-configuration-service-provider#windowslogon-hidefastuserswitching) | Hide the **Switch account** button on the sign-in screen, Start, and the Task Manager. | ✔️ | | | |
## WirelessDisplay
-| Setting | Description | Desktop editions | Mobile editions | Surface Hub | HoloLens | IoT Core |
-| --- | --- | :---: | :---: | :---: | :---: | :---: |
-| [AllowUserInputFromWirelessDisplayReceiver](/windows/client-management/mdm/policy-configuration-service-provider#wirelessdisplay-allowuserinputfromwirelessdisplayreceiver) | This policy controls whether or not the wireless display can send input (keyboard, mouse, pen, and touch, dependent upon display support) back to the source device. For example, a Surface Laptop is projecting wirelessly to a Surface Hub. If input from the wireless display receiver is allowed, users can draw with a pen on the Surface Hub. | ✔️ | ✔️ | | | |
+| Setting | Description | Windows client | Surface Hub | HoloLens | IoT Core |
+| --- | --- | :---: | :---: | :---: | :---: |
+| [AllowUserInputFromWirelessDisplayReceiver](/windows/client-management/mdm/policy-configuration-service-provider#wirelessdisplay-allowuserinputfromwirelessdisplayreceiver) | This policy controls whether or not the wireless display can send input (keyboard, mouse, pen, and touch, dependent upon display support) back to the source device. For example, a Surface Laptop is projecting wirelessly to a Surface Hub. If input from the wireless display receiver is allowed, users can draw with a pen on the Surface Hub. | ✔️ | | | |
diff --git a/windows/configuration/wcd/wcd-privacy.md b/windows/configuration/wcd/wcd-privacy.md
index 5904abff0c..867728c6b3 100644
--- a/windows/configuration/wcd/wcd-privacy.md
+++ b/windows/configuration/wcd/wcd-privacy.md
@@ -17,9 +17,9 @@ Use **Privacy** to configure settings for app activation with voice.
## Applies to
-| Setting | Desktop editions | Mobile editions | Surface Hub | HoloLens | IoT Core |
-| --- | :---: | :---: | :---: | :---: | :---: |
-| All settings | ✔️ | ✔️ | ✔️ | | ✔️ |
+| Setting | Windows client | Surface Hub | HoloLens | IoT Core |
+| --- | :---: | :---: | :---: | :---: |
+| All settings | ✔️ | ✔️ | | ✔️ |
## LetAppsActivateWithVoice
@@ -27,4 +27,4 @@ Select between **User is in control**, **Force allow**, or **Force deny**.
## LetAppsActivateWithVoiceAboveLock
-Select between **User is in control**, **Force allow**, or **Force deny**.
\ No newline at end of file
+Select between **User is in control**, **Force allow**, or **Force deny**.
diff --git a/windows/configuration/wcd/wcd-provisioningcommands.md b/windows/configuration/wcd/wcd-provisioningcommands.md
index 51ca4daddb..dab5b939b7 100644
--- a/windows/configuration/wcd/wcd-provisioningcommands.md
+++ b/windows/configuration/wcd/wcd-provisioningcommands.md
@@ -19,9 +19,9 @@ Use ProvisioningCommands settings to install Windows desktop applications using
## Applies to
-| Setting | Desktop editions | Mobile editions | Surface Hub | HoloLens | IoT Core |
-| --- | :---: | :---: | :---: | :---: | :---: |
-| All settings | ✔️ | | | | |
+| Setting | Windows client | Surface Hub | HoloLens | IoT Core |
+| --- | :---: | :---: | :---: | :---: |
+| All settings | ✔️ | | | |
For instructions on adding apps to provisioning packages, see [Provision PCs with apps](../provisioning-packages/provision-pcs-with-apps.md).
diff --git a/windows/configuration/wcd/wcd-sharedpc.md b/windows/configuration/wcd/wcd-sharedpc.md
index 2cee7eec84..3dd25e3954 100644
--- a/windows/configuration/wcd/wcd-sharedpc.md
+++ b/windows/configuration/wcd/wcd-sharedpc.md
@@ -20,9 +20,9 @@ Use SharedPC settings to optimize Windows 10 for shared use scenarios, such as t
## Applies to
-| Setting | Desktop editions | Mobile editions | Surface Hub | HoloLens | IoT Core |
-| --- | :---: | :---: | :---: | :---: | :---: |
-| All settings | ✔️ | | | | |
+| Setting | Windows client | Surface Hub | HoloLens | IoT Core |
+| --- | :---: | :---: | :---: | :---: |
+| All settings | ✔️ | | | |
## AccountManagement
diff --git a/windows/configuration/wcd/wcd-smisettings.md b/windows/configuration/wcd/wcd-smisettings.md
index f378d5f114..ed3dbc5df6 100644
--- a/windows/configuration/wcd/wcd-smisettings.md
+++ b/windows/configuration/wcd/wcd-smisettings.md
@@ -19,9 +19,9 @@ Use SMISettings settings to customize the device with custom shell, suppress Win
## Applies to
-| Setting | Desktop editions | Mobile editions | Surface Hub | HoloLens | IoT Core |
-| --- | :---: | :---: | :---: | :---: | :---: |
-| All settings | ✔️ | | | | |
+| Setting | Windows client | Surface Hub | HoloLens | IoT Core |
+| --- | :---: | :---: | :---: | :---: |
+| All settings | ✔️ | | | |
## All settings in SMISettings
diff --git a/windows/configuration/wcd/wcd-start.md b/windows/configuration/wcd/wcd-start.md
index cd1ddd0c36..b5e9674a75 100644
--- a/windows/configuration/wcd/wcd-start.md
+++ b/windows/configuration/wcd/wcd-start.md
@@ -19,12 +19,12 @@ Use Start settings to apply a customized Start screen to devices.
## Applies to
-| Setting | Desktop editions | Surface Hub | HoloLens | IoT Core |
+| Setting | Windows client | Surface Hub | HoloLens | IoT Core |
| --- | :---: | :---: | :---: | :---: |
| StartLayout | ✔️ | | | |
>[!IMPORTANT]
->The StartLayout setting is available in the advanced provisioning for Windows 10 desktop editions, but shouldn't be used. For desktop editions, use [Policies > StartLayout](wcd-policies.md#start).
+>The StartLayout setting is available in the advanced provisioning for Windows 10, but shouldn't be used. For Windows client, use [Policies > StartLayout](wcd-policies.md#start).
## StartLayout
diff --git a/windows/configuration/wcd/wcd-startupapp.md b/windows/configuration/wcd/wcd-startupapp.md
index 84b5fbc1cd..49815cf169 100644
--- a/windows/configuration/wcd/wcd-startupapp.md
+++ b/windows/configuration/wcd/wcd-startupapp.md
@@ -19,8 +19,8 @@ Use StartupApp settings to configure the default app that will run on start for
## Applies to
-| Setting | Desktop editions | Mobile editions | Surface Hub | HoloLens | IoT Core |
-| --- | :---: | :---: | :---: | :---: | :---: |
-| Default | | | | | ✔️ |
+| Setting | Windows client | Surface Hub | HoloLens | IoT Core |
+| --- | :---: | :---: | :---: | :---: |
+| Default | | | | ✔️ |
Enter the [Application User Model ID (AUMID)](/windows-hardware/customize/enterprise/find-the-application-user-model-id-of-an-installed-app) for the default app.
\ No newline at end of file
diff --git a/windows/configuration/wcd/wcd-startupbackgroundtasks.md b/windows/configuration/wcd/wcd-startupbackgroundtasks.md
index 375b29173c..7d169c131d 100644
--- a/windows/configuration/wcd/wcd-startupbackgroundtasks.md
+++ b/windows/configuration/wcd/wcd-startupbackgroundtasks.md
@@ -19,7 +19,7 @@ Documentation not available at this time.
## Applies to
-| Setting | Desktop editions | Mobile editions | Surface Hub | HoloLens | IoT Core |
-| --- | :---: | :---: | :---: | :---: | :---: |
-| All settings | | | | | ✔️ |
+| Setting | Windows client | Surface Hub | HoloLens | IoT Core |
+| --- | :---: | :---: | :---: | :---: |
+| All settings | | | | ✔️ |
diff --git a/windows/configuration/wcd/wcd-storaged3inmodernstandby.md b/windows/configuration/wcd/wcd-storaged3inmodernstandby.md
index bf25d4dfd0..d48b954521 100644
--- a/windows/configuration/wcd/wcd-storaged3inmodernstandby.md
+++ b/windows/configuration/wcd/wcd-storaged3inmodernstandby.md
@@ -22,6 +22,6 @@ Use **StorageD3InModernStandby** to enable or disable low-power state (D3) durin
## Applies to
-| Setting | Desktop editions | Mobile editions | Surface Hub | HoloLens | IoT Core |
-| --- | :---: | :---: | :---: | :---: | :---: |
-| All settings | ✔️ | ✔️ | ✔️ | | ✔️ |
\ No newline at end of file
+| Setting | Windows client | Surface Hub | HoloLens | IoT Core |
+| --- | :---: | :---: | :---: | :---: |
+| All settings | ✔️ | ✔️ | | ✔️ |
\ No newline at end of file
diff --git a/windows/configuration/wcd/wcd-surfacehubmanagement.md b/windows/configuration/wcd/wcd-surfacehubmanagement.md
index d0492b9ac5..edf2a819ed 100644
--- a/windows/configuration/wcd/wcd-surfacehubmanagement.md
+++ b/windows/configuration/wcd/wcd-surfacehubmanagement.md
@@ -24,9 +24,9 @@ Use SurfaceHubManagement settings to set the administrator group that will manag
## Applies to
-| Setting | Desktop editions | Mobile editions | Surface Hub | HoloLens | IoT Core |
-| --- | :---: | :---: | :---: | :---: | :---: |
-| All settings | | | ✔️ | | |
+| Setting | Windows client | Surface Hub | HoloLens | IoT Core |
+| --- | :---: | :---: | :---: | :---: |
+| All settings | | ✔️ | | |
## GroupName
diff --git a/windows/configuration/wcd/wcd-tabletmode.md b/windows/configuration/wcd/wcd-tabletmode.md
index 6f1c67bfb8..e97c3ebf6e 100644
--- a/windows/configuration/wcd/wcd-tabletmode.md
+++ b/windows/configuration/wcd/wcd-tabletmode.md
@@ -19,9 +19,9 @@ Use TabletMode to configure settings related to tablet mode.
## Applies to
-| Setting | Desktop editions | Mobile editions | Surface Hub | HoloLens | IoT Core |
-| --- | :---: | :---: | :---: | :---: | :---: |
-| All settings | ✔️ | ✔️ | ✔️ | | |
+| Setting | Windows client | Surface Hub | HoloLens | IoT Core |
+| --- | :---: | :---: | :---: | :---: |
+| All settings | ✔️ | ✔️ | | |
## ConvertibleSlateModePromptPreference
diff --git a/windows/configuration/wcd/wcd-takeatest.md b/windows/configuration/wcd/wcd-takeatest.md
index 0f3d22d642..f9f3708a13 100644
--- a/windows/configuration/wcd/wcd-takeatest.md
+++ b/windows/configuration/wcd/wcd-takeatest.md
@@ -19,9 +19,9 @@ Use TakeATest to configure the Take A Test app, a secure browser for test-taking
## Applies to
-| Setting | Desktop editions | Mobile editions | Surface Hub | HoloLens | IoT Core |
-| --- | :---: | :---: | :---: | :---: | :---: |
-| All settings | ✔️ | | | | |
+| Setting | Windows client | Surface Hub | HoloLens | IoT Core |
+| --- | :---: | :---: | :---: | :---: |
+| All settings | ✔️ | | | |
## AllowScreenMonitoring
diff --git a/windows/configuration/wcd/wcd-time.md b/windows/configuration/wcd/wcd-time.md
index 1efcbc613a..259df9fdd1 100644
--- a/windows/configuration/wcd/wcd-time.md
+++ b/windows/configuration/wcd/wcd-time.md
@@ -17,9 +17,9 @@ Use **Time** to configure settings for time zone setup for Windows 10, version (
## Applies to
-| Setting | Desktop editions | Mobile editions | Surface Hub | HoloLens | IoT Core |
-| --- | :---: | :---: | :---: | :---: | :---: |
-| [ProvisionSetTimeZone](#provisionsettimezone) | ✔️ | | | | |
+| Setting | Windows client | Surface Hub | HoloLens | IoT Core |
+| --- | :---: | :---: | :---: | :---: |
+| [ProvisionSetTimeZone](#provisionsettimezone) | ✔️ | | | |
## ProvisionSetTimeZone
diff --git a/windows/configuration/wcd/wcd-unifiedwritefilter.md b/windows/configuration/wcd/wcd-unifiedwritefilter.md
index 2463513137..c5586d1c3a 100644
--- a/windows/configuration/wcd/wcd-unifiedwritefilter.md
+++ b/windows/configuration/wcd/wcd-unifiedwritefilter.md
@@ -40,9 +40,9 @@ The overlay doesn't mirror the entire volume. It dynamically grows to keep track
## Applies to
-| Setting | Desktop editions | Mobile editions | Surface Hub | HoloLens | IoT Core |
-| --- | :---: | :---: | :---: | :---: | :---: |
-| All settings | ✔️ | | | | ✔️ |
+| Setting | Windows client | Surface Hub | HoloLens | IoT Core |
+| --- | :---: | :---: | :---: | :---: |
+| All settings | ✔️ | | | ✔️ |
## FilterEnabled
diff --git a/windows/configuration/wcd/wcd-universalappinstall.md b/windows/configuration/wcd/wcd-universalappinstall.md
index 2085c5e99a..0822937da4 100644
--- a/windows/configuration/wcd/wcd-universalappinstall.md
+++ b/windows/configuration/wcd/wcd-universalappinstall.md
@@ -22,13 +22,13 @@ Use UniversalAppInstall settings to install Windows apps from the Microsoft Stor
## Applies to
-| Setting | Desktop editions | Mobile editions | Surface Hub | HoloLens | IoT Core |
-| --- | :---: | :---: | :---: | :---: | :---: |
-| [DeviceContextApp](#devicecontextapp) | ✔️ | | ✔️ | | |
-| [DeviceContextAppLicense](#devicecontextapplicense) | ✔️ | | ✔️ | | |
-| [StoreInstall](#storeinstall) | ✔️ | ✔️ | ✔️ | | ✔️ |
-| [UserContextApp](#usercontextapp) | ✔️ | ✔️ | ✔️ | | ✔️ |
-| [UserContextAppLicense](#usercontextapplicense) | ✔️ | ✔️ | ✔️ | | ✔️ |
+| Setting | Windows client | Surface Hub | HoloLens | IoT Core |
+| --- | :---: | :---: | :---: | :---: |
+| [DeviceContextApp](#devicecontextapp) | ✔️ | ✔️ | | |
+| [DeviceContextAppLicense](#devicecontextapplicense) | ✔️ | ✔️ | | |
+| [StoreInstall](#storeinstall) | ✔️ | ✔️ | | ✔️ |
+| [UserContextApp](#usercontextapp) | ✔️ | ✔️ | | ✔️ |
+| [UserContextAppLicense](#usercontextapplicense) | ✔️ | ✔️ | | ✔️ |
## DeviceContextApp
diff --git a/windows/configuration/wcd/wcd-universalappuninstall.md b/windows/configuration/wcd/wcd-universalappuninstall.md
index 0ae1ade853..625891ae05 100644
--- a/windows/configuration/wcd/wcd-universalappuninstall.md
+++ b/windows/configuration/wcd/wcd-universalappuninstall.md
@@ -20,10 +20,10 @@ Use UniversalAppUninstall settings to uninstall or remove Windows apps.
## Applies to
-| Setting | Desktop editions | Mobile editions | Surface Hub | HoloLens | IoT Core |
-| --- | :---: | :---: | :---: | :---: | :---: |
-| [RemoveProvisionedApp](#removeprovisionedapp) | ✔️ | | | | |
-| [Uninstall](#uninstall) | ✔️ | ✔️ | ✔️ | | ✔️ |
+| Setting | Windows client | Surface Hub | HoloLens | IoT Core |
+| --- | :---: | :---: | :---: | :---: |
+| [RemoveProvisionedApp](#removeprovisionedapp) | ✔️ | | | |
+| [Uninstall](#uninstall) | ✔️ | ✔️ | | ✔️ |
## RemoveProvisionedApp
diff --git a/windows/configuration/wcd/wcd-usberrorsoemoverride.md b/windows/configuration/wcd/wcd-usberrorsoemoverride.md
index 9b4fc26665..3eb9975d01 100644
--- a/windows/configuration/wcd/wcd-usberrorsoemoverride.md
+++ b/windows/configuration/wcd/wcd-usberrorsoemoverride.md
@@ -20,9 +20,9 @@ Allows an OEM to hide the USB option UI in Settings and all USB device errors.
## Applies to
-| Setting | Desktop editions | Mobile editions | Surface Hub | HoloLens | IoT Core |
-| --- | :---: | :---: | :---: | :---: | :---: |
-| [HideUsbErrorNotifyOptionUI](#hideusberrornotifyoptionui) | ✔️ | ✔️ | ✔️ | ✔️ | |
+| Setting | Windows client | Surface Hub | HoloLens | IoT Core |
+| --- | :---: | :---: | :---: | :---: |
+| [HideUsbErrorNotifyOptionUI](#hideusberrornotifyoptionui) | ✔️ | ✔️ | ✔️ | |
## HideUsbErrorNotifyOptionUI
diff --git a/windows/configuration/wcd/wcd-weakcharger.md b/windows/configuration/wcd/wcd-weakcharger.md
index 0f57e581fd..ce9f3ab265 100644
--- a/windows/configuration/wcd/wcd-weakcharger.md
+++ b/windows/configuration/wcd/wcd-weakcharger.md
@@ -20,10 +20,10 @@ Use WeakCharger settings to configure the charger notification UI.
## Applies to
-| Setting | Desktop editions | Mobile editions | Surface Hub | HoloLens | IoT Core |
-| --- | :---: | :---: | :---: | :---: | :---: |
-| [HideWeakChargerNotifyOptionUI](#hideweakchargernotifyoptionui) | ✔️ | ✔️ | ✔️ | | |
-| [NotifyOnWeakCharger](#notifyonweakcharger) | ✔️ | ✔️ | ✔️ | | |
+| Setting | Windows client | Surface Hub | HoloLens | IoT Core |
+| --- | :---: | :---: | :---: | :---: |
+| [HideWeakChargerNotifyOptionUI](#hideweakchargernotifyoptionui) | ✔️ | ✔️ | | |
+| [NotifyOnWeakCharger](#notifyonweakcharger) | ✔️ | ✔️ | | |
## HideWeakChargerNotifyOptionUI
diff --git a/windows/configuration/wcd/wcd-windowshelloforbusiness.md b/windows/configuration/wcd/wcd-windowshelloforbusiness.md
index d000b9facc..fc0d8fbd54 100644
--- a/windows/configuration/wcd/wcd-windowshelloforbusiness.md
+++ b/windows/configuration/wcd/wcd-windowshelloforbusiness.md
@@ -19,9 +19,9 @@ Use WindowsHelloForBusiness settings to specify whether [FIDO2 security keys for
## Applies to
-| Setting groups | Desktop editions | Mobile editions | Surface Hub | HoloLens | IoT Core |
-| --- | :---: | :---: | :---: | :---: | :---: |
-| [SecurityKeys](#securitykeys) | ✔️ | | | | |
+| Setting groups | Windows client | Surface Hub | HoloLens | IoT Core |
+| --- | :---: | :---: | :---: | :---: |
+| [SecurityKeys](#securitykeys) | ✔️ | | | |
## SecurityKeys
diff --git a/windows/configuration/wcd/wcd-windowsteamsettings.md b/windows/configuration/wcd/wcd-windowsteamsettings.md
index a4e82b4a0e..9307518bf1 100644
--- a/windows/configuration/wcd/wcd-windowsteamsettings.md
+++ b/windows/configuration/wcd/wcd-windowsteamsettings.md
@@ -20,9 +20,9 @@ Use WindowsTeamSettings settings to configure Surface Hub.
## Applies to
-| Setting | Desktop editions | Mobile editions | Surface Hub | HoloLens | IoT Core |
-| --- | :---: | :---: | :---: | :---: | :---: |
-| All settings | | | ✔️ | | |
+| Setting | Windows client | Surface Hub | HoloLens | IoT Core |
+| --- | :---: | :---: | :---: | :---: |
+| All settings | | ✔️ | | |
## Connect
diff --git a/windows/configuration/wcd/wcd-wlan.md b/windows/configuration/wcd/wcd-wlan.md
index 2a746063eb..8b931bc90a 100644
--- a/windows/configuration/wcd/wcd-wlan.md
+++ b/windows/configuration/wcd/wcd-wlan.md
@@ -20,7 +20,7 @@ Do not use at this time. Instead, use [ConnectivityProfiles > WLAN](wcd-connecti
## Applies to
-| Setting | Desktop editions | Mobile editions | Surface Hub | HoloLens | IoT Core |
-| --- | :---: | :---: | :---: | :---: | :---: |
-| All settings | | | | | |
+| Setting | Windows client | Surface Hub | HoloLens | IoT Core |
+| --- | :---: | :---: | :---: | :---: |
+| All settings | | | | |
diff --git a/windows/configuration/wcd/wcd-workplace.md b/windows/configuration/wcd/wcd-workplace.md
index 48f7826dc9..e810f28679 100644
--- a/windows/configuration/wcd/wcd-workplace.md
+++ b/windows/configuration/wcd/wcd-workplace.md
@@ -20,9 +20,9 @@ Use Workplace settings to configure bulk user enrollment to a mobile device mana
## Applies to
-| Setting | Desktop editions | Mobile editions | Surface Hub | HoloLens | IoT Core |
-| --- | :---: | :---: | :---: | :---: | :---: |
-| [Enrollments](#enrollments) | ✔️ | ✔️ | ✔️ | | ✔️ |
+| Setting | Windows client | Surface Hub | HoloLens | IoT Core |
+| --- | :---: | :---: | :---: | :---: |
+| [Enrollments](#enrollments) | ✔️ | ✔️ | | ✔️ |
## Enrollments
diff --git a/windows/configuration/wcd/wcd.md b/windows/configuration/wcd/wcd.md
index 0d09e59143..952a247ff3 100644
--- a/windows/configuration/wcd/wcd.md
+++ b/windows/configuration/wcd/wcd.md
@@ -18,7 +18,7 @@ This section describes the settings that you can configure in [provisioning pack
## Edition that each group of settings applies to
-| Setting group | Desktop editions | Surface Hub | HoloLens | IoT Core |
+| Setting group | Windows client | Surface Hub | HoloLens | IoT Core |
| --- | :---: | :---: | :---: | :---: |
| [AccountManagement](wcd-accountmanagement.md) | | | ✔️ | |
| [Accounts](wcd-accounts.md) | ✔️ | ✔️ | ✔️ | ✔️ |
diff --git a/windows/configuration/windows-10-start-layout-options-and-policies.md b/windows/configuration/windows-10-start-layout-options-and-policies.md
index b426a02ca2..13515dad9b 100644
--- a/windows/configuration/windows-10-start-layout-options-and-policies.md
+++ b/windows/configuration/windows-10-start-layout-options-and-policies.md
@@ -13,13 +13,14 @@ ms.author: greglin
ms.topic: article
ms.localizationpriority: medium
ms.date: 08/05/2021
+ms.collection: highpri
---
# Customize the Start menu and taskbar layout on Windows 10 and later devices
**Applies to**:
-- Windows 10 version 1607 and later
+- Windows 10 version 1607 and later
- Windows Server 2016 with Desktop Experience
- Windows Server 2019 with Desktop Experience
diff --git a/windows/configuration/windows-spotlight.md b/windows/configuration/windows-spotlight.md
index 08afef11a3..b3febec8f6 100644
--- a/windows/configuration/windows-spotlight.md
+++ b/windows/configuration/windows-spotlight.md
@@ -13,6 +13,7 @@ ms.author: greglin
ms.topic: article
ms.localizationpriority: medium
ms.date: 04/30/2018
+ms.collection: highpri
---
# Configure Windows Spotlight on the lock screen
@@ -20,7 +21,7 @@ ms.date: 04/30/2018
**Applies to**
-- Windows 10
+- Windows 10
Windows Spotlight is an option for the lock screen background that displays different background images and occasionally offers suggestions on the lock screen. Windows Spotlight is available in all desktop editions of Windows 10.
diff --git a/windows/deployment/configure-a-pxe-server-to-load-windows-pe.md b/windows/deployment/configure-a-pxe-server-to-load-windows-pe.md
index 2038b91889..d16a0e9084 100644
--- a/windows/deployment/configure-a-pxe-server-to-load-windows-pe.md
+++ b/windows/deployment/configure-a-pxe-server-to-load-windows-pe.md
@@ -1,6 +1,6 @@
---
-title: Configure a PXE server to load Windows PE (Windows 10)
-description: This topic describes how to configure a PXE server to load Windows PE so that it can be used with an image file to install Windows 10 from the network.
+title: Configure a PXE server to load Windows PE (Windows 10)
+description: This topic describes how to configure a PXE server to load Windows PE so that it can be used with an image file to install Windows 10 from the network.
keywords: upgrade, update, windows, windows 10, pxe, WinPE, image, wim
ms.prod: w10
ms.mktglfcycl: deploy
@@ -9,18 +9,18 @@ ms.sitesec: library
ms.pagetype: deploy
audience: itpro
author: greg-lindsay
-ms.reviewer:
-manager: laurawi
+manager: dougeby
ms.author: greglin
ms.topic: article
ms.custom: seo-marvel-apr2020
+ms.collection: highpri
---
-# Configure a PXE server to load Windows PE
+# Configure a PXE server to load Windows PE
**Applies to**
-- Windows 10
+- Windows 10
This walkthrough describes how to configure a PXE server to load Windows PE by booting a client computer from the network. Using the Windows PE tools and a Windows 10 image file, you can install Windows 10 from the network.
diff --git a/windows/deployment/deploy-enterprise-licenses.md b/windows/deployment/deploy-enterprise-licenses.md
index 9b4d7283c3..719e822d59 100644
--- a/windows/deployment/deploy-enterprise-licenses.md
+++ b/windows/deployment/deploy-enterprise-licenses.md
@@ -1,7 +1,6 @@
---
title: Deploy Windows 10/11 Enterprise licenses
-ms.reviewer:
-manager: laurawi
+manager: dougeby
ms.audience: itpro
ms.author: greglin
description: Steps to deploy Windows 10 Enterprise or Windows 11 Enterprise licenses for Windows 10/11 Enterprise E3 or E5 Subscription Activation, or for Windows 10/11 Enterprise E3 in CSP
@@ -14,6 +13,7 @@ ms.pagetype: mdt
audience: itpro
author: greg-lindsay
ms.topic: article
+ms.collection: highpri
---
# Deploy Windows 10/11 Enterprise licenses
diff --git a/windows/deployment/deploy-whats-new.md b/windows/deployment/deploy-whats-new.md
index b092bc6e3c..287142a49d 100644
--- a/windows/deployment/deploy-whats-new.md
+++ b/windows/deployment/deploy-whats-new.md
@@ -1,7 +1,6 @@
---
title: What's new in Windows client deployment
-ms.reviewer:
-manager: laurawi
+manager: dougeby
ms.author: greglin
description: Use this article to learn about new solutions and online content related to deploying Windows in your organization.
keywords: deployment, automate, tools, configure, news
@@ -14,12 +13,13 @@ audience: itpro
author: greg-lindsay
ms.topic: article
ms.custom: seo-marvel-apr2020
+ms.collection: highpri
---
# What's new in Windows client deployment
**Applies to:**
-- Windows 10
+- Windows 10
- Windows 11
## In this topic
diff --git a/windows/deployment/deploy-windows-cm/deploy-windows-10-using-pxe-and-configuration-manager.md b/windows/deployment/deploy-windows-cm/deploy-windows-10-using-pxe-and-configuration-manager.md
index ff7ad50540..8279bcedf6 100644
--- a/windows/deployment/deploy-windows-cm/deploy-windows-10-using-pxe-and-configuration-manager.md
+++ b/windows/deployment/deploy-windows-cm/deploy-windows-10-using-pxe-and-configuration-manager.md
@@ -2,8 +2,7 @@
title: Deploy Windows 10 using PXE and Configuration Manager (Windows 10)
description: In this topic, you will learn how to deploy Windows 10 using Microsoft Endpoint Manager deployment packages and task sequences.
ms.assetid: fb93f514-5b30-4f4b-99dc-58e6860009fa
-ms.reviewer:
-manager: laurawi
+manager: dougeby
ms.author: greglin
keywords: deployment, image, UEFI, task sequence
ms.prod: w10
@@ -13,13 +12,14 @@ ms.sitesec: library
audience: itpro
author: greg-lindsay
ms.topic: article
+ms.collection: highpri
---
# Deploy Windows 10 using PXE and Configuration Manager
**Applies to**
-- Windows 10
+- Windows 10
In this topic, you will learn how to deploy Windows 10 using Microsoft Endpoint Manager deployment packages and task sequences. This topic will walk you through the process of deploying the Windows 10 Enterprise image to a Unified Extensible Firmware Interface (UEFI) computer named PC0001. An existing Configuration Manager infrastructure that is integrated with MDT is used for the procedures in this topic.
diff --git a/windows/deployment/deploy-windows-mdt/TOC.yml b/windows/deployment/deploy-windows-mdt/TOC.yml
index 3f4a5f1d0d..51493a1083 100644
--- a/windows/deployment/deploy-windows-mdt/TOC.yml
+++ b/windows/deployment/deploy-windows-mdt/TOC.yml
@@ -1,23 +1,23 @@
-- name: Deploy Windows 11 with the Microsoft Deployment Toolkit (MDT)
+- name: Deploy Windows 10 with the Microsoft Deployment Toolkit (MDT)
items:
- name: Get started with MDT
href: get-started-with-the-microsoft-deployment-toolkit.md
- - name: Deploy Windows 11 with MDT
+ - name: Deploy Windows 10 with MDT
items:
- name: Prepare for deployment with MDT
href: prepare-for-windows-deployment-with-mdt.md
- - name: Create a Windows 11 reference image
- href: create-a-windows-11-reference-image.md
- - name: Deploy a Windows 11 image using MDT
- href: deploy-a-windows-11-image-using-mdt.md
- - name: Build a distributed environment for Windows 11 deployment
- href: build-a-distributed-environment-for-windows-deployment.md
- - name: Refresh a Windows 10 computer with Windows 11
- href: refresh-a-windows-10-computer-with-windows-11.md
- - name: Replace a Windows 10 computer with a Windows 11 computer
- href: replace-a-windows-10-computer-with-a-windows-11-computer.md
- - name: Perform an in-place upgrade to Windows 11 with MDT
- href: upgrade-to-windows-11-with-the-microsoft-deployment-toolkit.md
+ - name: Create a Windows 10 reference image
+ href: create-a-windows-10-reference-image.md
+ - name: Deploy a Windows 10 image using MDT
+ href: deploy-a-windows-10-image-using-mdt.md
+ - name: Build a distributed environment for Windows 10 deployment
+ href: build-a-distributed-environment-for-windows-10-deployment.md
+ - name: Refresh a Windows 7 computer with Windows 10
+ href: refresh-a-windows-7-computer-with-windows-10.md
+ - name: Replace a Windows 7 computer with a Windows 10 computer
+ href: replace-a-windows-7-computer-with-a-windows-10-computer.md
+ - name: Perform an in-place upgrade to Windows 10 with MDT
+ href: upgrade-to-windows-10-with-the-microsoft-deployment-toolkit.md
- name: Customize MDT
items:
- name: Configure MDT settings
@@ -28,10 +28,10 @@
href: configure-mdt-deployment-share-rules.md
- name: Configure MDT for UserExit scripts
href: configure-mdt-for-userexit-scripts.md
- - name: Simulate a Windows 11 deployment in a test environment
- href: simulate-a-windows-11-deployment-in-a-test-environment.md
- - name: Use the MDT database to stage Windows deployment information
- href: use-the-mdt-database-to-stage-windows-deployment-information.md
+ - name: Simulate a Windows 10 deployment in a test environment
+ href: simulate-a-windows-10-deployment-in-a-test-environment.md
+ - name: Use the MDT database to stage Windows 10 deployment information
+ href: use-the-mdt-database-to-stage-windows-10-deployment-information.md
- name: Assign applications using roles in MDT
href: assign-applications-using-roles-in-mdt.md
- name: Use web services in MDT
diff --git a/windows/deployment/deploy-windows-mdt/assign-applications-using-roles-in-mdt.md b/windows/deployment/deploy-windows-mdt/assign-applications-using-roles-in-mdt.md
index 21bf379b8e..453515a466 100644
--- a/windows/deployment/deploy-windows-mdt/assign-applications-using-roles-in-mdt.md
+++ b/windows/deployment/deploy-windows-mdt/assign-applications-using-roles-in-mdt.md
@@ -18,10 +18,6 @@ ms.topic: article
# Assign applications using roles in MDT
-**Applies to**
-- Windows 10
-- Windows 11
-
This topic will show you how to add applications to a role in the MDT database and then assign that role to a computer. For the purposes of this topic, the application we are adding is Adobe Reader XI. In addition to using computer-specific entries in the database, you can use roles in MDT to group settings together.
## Create and assign a role entry in the database
diff --git a/windows/deployment/deploy-windows-mdt/build-a-distributed-environment-for-windows-deployment.md b/windows/deployment/deploy-windows-mdt/build-a-distributed-environment-for-windows-10-deployment.md
similarity index 85%
rename from windows/deployment/deploy-windows-mdt/build-a-distributed-environment-for-windows-deployment.md
rename to windows/deployment/deploy-windows-mdt/build-a-distributed-environment-for-windows-10-deployment.md
index b47530ab45..c05e2b7c67 100644
--- a/windows/deployment/deploy-windows-mdt/build-a-distributed-environment-for-windows-deployment.md
+++ b/windows/deployment/deploy-windows-mdt/build-a-distributed-environment-for-windows-10-deployment.md
@@ -1,12 +1,12 @@
---
-title: Build a distributed environment for Windows 11 deployment (Windows 11)
-description: In this topic, you will learn how to replicate your Windows 11 deployment shares to facilitate the deployment of Windows 11 in remote or branch locations.
+title: Build a distributed environment for Windows 10 deployment (Windows 10)
+description: In this topic, you will learn how to replicate your Windows 10 deployment shares to facilitate the deployment of Windows 10 in remote or branch locations.
ms.assetid: a6cd5657-6a16-4fff-bfb4-44760902d00c
ms.reviewer:
manager: dougeby
ms.author: greglin
keywords: replication, replicate, deploy, configure, remote
-ms.prod: w11
+ms.prod: w10
ms.mktglfcycl: deploy
ms.localizationpriority: medium
ms.sitesec: library
@@ -16,13 +16,12 @@ author: greg-lindsay
ms.topic: article
---
-# Build a distributed environment for Windows 11 deployment
+# Build a distributed environment for Windows 10 deployment
**Applies to**
-- Windows 10
-- Windows 11
+- Windows 10
-Perform the steps in this article to build a distributed environment for Windows 11 deployment. A distributed environment for deployment is useful when you have a segmented network, for example one that is segmented geographically into two branch locations. If you work in a distributed environment, replicating the deployment shares is an important part of a deployment solution because images of 5 GB or more in size can present bandwidth issues when deployed over the wire. Replicating this content enables clients to do local deployments.
+Perform the steps in this article to build a distributed environment for Windows 10 deployment. A distributed environment for deployment is useful when you have a segmented network, for example one that is segmented geographically into two branch locations. If you work in a distributed environment, replicating the deployment shares is an important part of a deployment solution because images of 5 GB or more in size can present bandwidth issues when deployed over the wire. Replicating this content enables clients to do local deployments.
Four computers are used in this topic: DC01, MDT01, MDT02, and PC0006. DC01 is a domain controller, MDT01 and MDT02 are domain member computers running Windows Server 2019, and PC0006 is a blank device where we will deploy Windows 10. The second deployment server (MDT02) will be configured for a remote site (Stockholm) by replicating the deployment share on MDT01 at the original site (New York). All devices are members of the domain contoso.com for the fictitious Contoso Corporation.
@@ -32,7 +31,7 @@ For the purposes of this article, we assume that MDT02 is prepared with the same
Computers used in this topic.
-> HV01 is also used in this topic to host the PC0006 virtual machine.
+>HV01 is also used in this topic to host the PC0006 virtual machine.
## Replicate deployment shares
@@ -63,7 +62,7 @@ On **MDT01**:
Install-WindowsFeature -Name FS-DFS-Replication -IncludeManagementTools
```
-2. Wait for installation to comlete, and then verify that the installation was successful. See the following output:
+2. Wait for installation to complete, and then verify that the installation was successful. See the following output:
```output
PS C:\> Install-WindowsFeature -Name FS-DFS-Replication -IncludeManagementTools
@@ -83,7 +82,7 @@ On **MDT02**:
Install-WindowsFeature -Name FS-DFS-Replication -IncludeManagementTools
```
-2. Wait for installation to comlete, and then verify that the installation was successful. See the following output:
+2. Wait for installation to complete, and then verify that the installation was successful. See the following output:
```output
PS C:\> Install-WindowsFeature -Name FS-DFS-Replication -IncludeManagementTools
@@ -120,7 +119,7 @@ When you have multiple deployment servers sharing the same content, you need to
On **MDT01**:
-1. Using Notepad, navigate to the **D:\\MDTProduction\\Control** folder and modify the Boostrap.ini file as follows. Under [DefaultGateway] enter the IP addresses for the default gateway of client devices in your locations (replace 10.10.10.1 and 10.10.20.1 with your default gateways). The default gateway setting is what tells the client which deployment share (i.e. server) to use.
+1. Using Notepad, navigate to the **D:\\MDTProduction\\Control** folder and modify the Boostrap.ini file as follows. Under [DefaultGateway] enter the IP addresses for the client's default gateway in New York and Stockholm, respectively (replace 10.10.10.1 and 10.10.20.1 with your default gateways). The default gateway setting is what tells the client which deployment share (i.e. server) to use.
```ini
[Settings]
@@ -142,8 +141,8 @@ On **MDT01**:
UserPassword=pass@word1
SkipBDDWelcome=YES
```
- > [!NOTE]
- > The DeployRoot value needs to go into the Bootstrap.ini file, but you can use the same logic in the CustomSettings.ini file. For example, you can redirect the logs to the local deployment server (SLSHARE), or have the User State Migration Tool (USMT) migration store (UDDIR) local. To learn more about USMT, see [Refresh a Windows 10 computer with Windows 11](refresh-a-windows-10-computer-with-windows-11.md) and [Replace a Windows 10 computer with a Windows 11 computer](replace-a-windows-10-computer-with-a-windows-11-computer.md).
+ >[!NOTE]
+ >The DeployRoot value needs to go into the Bootstrap.ini file, but you can use the same logic in the CustomSettings.ini file. For example, you can redirect the logs to the local deployment server (SLSHARE), or have the User State Migration Tool (USMT) migration store (UDDIR) local. To learn more about USMT, see [Refresh a Windows 7 computer with Windows 10](refresh-a-windows-7-computer-with-windows-10.md) and [Replace a Windows 7 computer with a Windows 10 computer](replace-a-windows-7-computer-with-a-windows-10-computer.md).
2. Save the Bootstrap.ini file.
3. Using the Deployment Workbench, right-click the **MDT Production** deployment share and select **Update Deployment Share**. Use the default settings for the Update Deployment Share Wizard. This process will take a few minutes.
@@ -154,8 +153,8 @@ On **MDT01**:
Replacing the updated boot image in WDS.
- > [!TIP]
- > If you modify bootstrap.ini again later, be sure to repeat the process of updating the deployment share in the Deployment Workbench and replacing the boot image in the WDS console.
+ >[!TIP]
+ >If you modify bootstrap.ini again later, be sure to repeat the process of updating the deployment share in the Deployment Workbench and replacing the boot image in the WDS console.
## Replicate the content
@@ -228,7 +227,7 @@ On **MDT02**:
The DFS Replication Health Report.
-> If there are replication errors you can review the DFS event log in Event Viewer under **Applications and Services Logs**.
+>If there are replication errors you can review the DFS event log in Event Viewer under **Applications and Services Logs**.
## Configure Windows Deployment Services (WDS) in a remote site
@@ -251,19 +250,21 @@ Now you should have a solution ready for deploying the Windows 10 client to the
6. Install an operating system from a network-based installation server
2. Start the PC0006 virtual machine, and press **Enter** to start the Pre-Boot Execution Environment (PXE) boot. The VM will now load the Windows PE boot image from the WDS server.
3. After Windows Preinstallation Environment (Windows PE) has booted, complete the Windows Deployment Wizard using the following settings:
- 1. Select a task sequence to execute on this computer: Windows 11 Enterprise x64 Custom Image
+ 1. Select a task sequence to execute on this computer: Windows 10 Enterprise x64 RTM Custom Image
2. Computer Name: PC0006
3. Applications: Select the Install - Adobe Reader
4. Setup will now start and perform the following:
- 1. Install the Windows 11 Enterprise operating system.
+ 1. Install the Windows 10 Enterprise operating system.
2. Install applications.
3. Update the operating system using your local Windows Server Update Services (WSUS) server.
+
+
## Related topics
[Get started with the Microsoft Deployment Toolkit (MDT)](get-started-with-the-microsoft-deployment-toolkit.md)
-[Create a Windows 11 reference image](create-a-windows-11-reference-image.md)
-[Deploy a Windows 11 image using MDT](deploy-a-windows-11-image-using-mdt.md)
-[Refresh a Windows 10 computer with Windows 11](refresh-a-windows-10-computer-with-windows-11.md)
-[Replace a Windows 10 computer with a Windows 11 computer](replace-a-windows-10-computer-with-a-windows-11-computer.md)
+[Create a Windows 10 reference image](create-a-windows-10-reference-image.md)
+[Deploy a Windows 10 image using MDT](deploy-a-windows-10-image-using-mdt.md)
+[Refresh a Windows 7 computer with Windows 10](refresh-a-windows-7-computer-with-windows-10.md)
+[Replace a Windows 7 computer with a Windows 10 computer](replace-a-windows-7-computer-with-a-windows-10-computer.md)
[Configure MDT settings](configure-mdt-settings.md)
\ No newline at end of file
diff --git a/windows/deployment/deploy-windows-mdt/configure-mdt-deployment-share-rules.md b/windows/deployment/deploy-windows-mdt/configure-mdt-deployment-share-rules.md
index 187f8fb4cc..0fb4725b6b 100644
--- a/windows/deployment/deploy-windows-mdt/configure-mdt-deployment-share-rules.md
+++ b/windows/deployment/deploy-windows-mdt/configure-mdt-deployment-share-rules.md
@@ -18,10 +18,6 @@ ms.topic: article
# Configure MDT deployment share rules
-**Applies to**
-- Windows 10
-- Windows 11
-
In this topic, you will learn how to configure the MDT rules engine to reach out to other resources, including external scripts, databases, and web services, for additional information instead of storing settings directly in the rules engine. The rules engine in MDT is powerful: most of the settings used for operating system deployments are retrieved and assigned via the rules engine. In its simplest form, the rules engine is the CustomSettings.ini text file.
## Assign settings
diff --git a/windows/deployment/deploy-windows-mdt/configure-mdt-for-userexit-scripts.md b/windows/deployment/deploy-windows-mdt/configure-mdt-for-userexit-scripts.md
index 22a7921c84..342cec9742 100644
--- a/windows/deployment/deploy-windows-mdt/configure-mdt-for-userexit-scripts.md
+++ b/windows/deployment/deploy-windows-mdt/configure-mdt-for-userexit-scripts.md
@@ -18,10 +18,6 @@ ms.topic: article
# Configure MDT for UserExit scripts
-**Applies to**
-- Windows 10
-- Windows 11
-
In this topic, you will learn how to configure the MDT rules engine to use a UserExit script to generate computer names based on a prefix and the computer MAC Address. MDT supports calling external VBScripts as part of the Gather process; these scripts are referred to as UserExit scripts. The script also removes the colons in the MAC Address.
## Configure the rules to call a UserExit script
diff --git a/windows/deployment/deploy-windows-mdt/configure-mdt-settings.md b/windows/deployment/deploy-windows-mdt/configure-mdt-settings.md
index 05f03ea220..731550645c 100644
--- a/windows/deployment/deploy-windows-mdt/configure-mdt-settings.md
+++ b/windows/deployment/deploy-windows-mdt/configure-mdt-settings.md
@@ -18,10 +18,6 @@ ms.topic: article
# Configure MDT settings
-**Applies to**
-- Windows 10
-- Windows 11
-
One of the most powerful features in Microsoft Deployment Toolkit (MDT) is its extension capabilities; there is virtually no limitation to what you can do in terms of customization. In this topic, you learn about configuring customizations for your environment.
For the purposes of this topic, we will use four machines: DC01, MDT01, HV01, and PC0001. DC01 is a domain controller, MDT01 is a Windows Server 2012 R2 Standard server, and PC0001 is a Windows 10 Enterprise x64 client used for the MDT simulation environment. OR01 has Microsoft System Center 2012 R2 Orchestrator installed. MDT01, OR01, and PC0001 are members of the domain contoso.com for the fictitious Contoso Corporation. For more details on the setup for this topic, please see [Deploy Windows 10 with the Microsoft Deployment Toolkit](./prepare-for-windows-deployment-with-mdt.md).
diff --git a/windows/deployment/deploy-windows-mdt/create-a-windows-11-reference-image.md b/windows/deployment/deploy-windows-mdt/create-a-windows-10-reference-image.md
similarity index 81%
rename from windows/deployment/deploy-windows-mdt/create-a-windows-11-reference-image.md
rename to windows/deployment/deploy-windows-mdt/create-a-windows-10-reference-image.md
index a548b5c748..9dd26e0e66 100644
--- a/windows/deployment/deploy-windows-mdt/create-a-windows-11-reference-image.md
+++ b/windows/deployment/deploy-windows-mdt/create-a-windows-10-reference-image.md
@@ -1,12 +1,12 @@
---
-title: Create a Windows 11 reference image (Windows 11)
+title: Create a Windows 10 reference image (Windows 10)
description: Creating a reference image is important because that image serves as the foundation for the devices in your organization.
ms.assetid: 9da2fb57-f2ff-4fce-a858-4ae4c237b5aa
ms.reviewer:
manager: dougeby
ms.author: greglin
keywords: deploy, deployment, configure, customize, install, installation
-ms.prod: w11
+ms.prod: w10
ms.mktglfcycl: deploy
ms.localizationpriority: medium
ms.sitesec: library
@@ -16,25 +16,22 @@ author: greg-lindsay
ms.topic: article
---
-# Create a Windows 11 reference image
+# Create a Windows 10 reference image
**Applies to**
- Windows 10
-- Windows 11
-In this topic, you will learn how to create a Windows 11 reference image using the Microsoft Deployment Toolkit (MDT). You will create a deployment share, configure rules and settings, and import all the applications and operating system files required to build a Windows 11 reference image. After completing the steps outlined in this topic, you will have a Windows 11 reference image that can be used in your deployment solution.
+Creating a reference image is important because that image serves as the foundation for the devices in your organization. In this topic, you will learn how to create a Windows 10 reference image using the Microsoft Deployment Toolkit (MDT). You will create a deployment share, configure rules and settings, and import all the applications and operating system files required to build a Windows 10 reference image. After completing the steps outlined in this topic, you will have a Windows 10 reference image that can be used in your deployment solution.
-All procedures in this article can also be used to create a Windows 10 reference image by using Windows 10 media instead of Windows 11 media in the [Add setup files](#add-setup-files) section below.
-
-> [!NOTE]
-> This guide assumes that you have already installed and configured deployment tools. See [Prepare for deployment with MDT](prepare-for-windows-deployment-with-mdt.md) for more information.
+>[!NOTE]
+>See [Prepare for deployment with MDT](prepare-for-windows-deployment-with-mdt.md) for more information about the server, client, and network infrastructure used in this guide.
For the purposes of this topic, we will use three computers: DC01, MDT01, and HV01.
- DC01 is a domain controller for the contoso.com domain.
- MDT01 is a contoso.com domain member server.
- HV01 is a Hyper-V server that will be used to build the reference image.
- 
+ 
Computers used in this topic.
@@ -48,20 +45,19 @@ The reference image described in this guide is designed primarily for deployment
## Set up the MDT build lab deployment share
-With Windows 10 and Windows 11, there is no hard requirement to create reference images. However, to reduce the time needed for deployment, you might want to create a reference image that contains a few base applications as well as all of the latest updates. This section will show you how to create and configure the MDT Build Lab deployment share to create a Windows 11 reference image. Because reference images will be deployed only to virtual machines during the creation process and have specific settings (rules), you should always create a separate deployment share specifically for this process.
+With Windows 10, there is no hard requirement to create reference images. However, to reduce the time needed for deployment, you might want to create a reference image that contains a few base applications as well as all of the latest updates. This section will show you how to create and configure the MDT Build Lab deployment share to create a Windows 10 reference image. Because reference images will be deployed only to virtual machines during the creation process and have specific settings (rules), you should always create a separate deployment share specifically for this process.
### Create the MDT build lab deployment share
On **MDT01**:
- Sign in as contoso\\administrator using a password of pass@word1 (credentials from the [prepare for deployment](prepare-for-windows-deployment-with-mdt.md) topic).
-- Start the MDT deployment workbench, and pin the console to the taskbar for easy access.
- - If it is your first time starting the console, search for **Deployment Workbench**.
+- Start the MDT deployment workbench, and pin this to the taskbar for easy access.
- Using the Deployment Workbench, right-click **Deployment Shares** and select **New Deployment Share**.
- Use the following settings for the New Deployment Share Wizard:
- Deployment share path: **D:\\MDTBuildLab**
- Share name: **MDTBuildLab$**
- - Descriptive name: **MDT Build Lab**
+ - Deployment share description: **MDT Build Lab**
- Accept the default selections on the Options page and click **Next**.
- Review the Summary page, click **Next**, wait for the deployment share to be created, then click **Finish**.
- Verify that you can access the \\\\MDT01\\MDTBuildLab$ share.
@@ -72,7 +68,7 @@ On **MDT01**:
### Enable monitoring
-To monitor the task sequence as it happens, right-click the **MDT Build Lab** deployment share in the Deployment Workbench, click **Properties**, click the **Monitoring** tab, and select **Enable monitoring for this deployment share**. This step is optional.
+To monitor the task sequence as it happens, right-click the **MDT Build Lab** deployment share, click **Properties**, click the **Monitoring** tab, and select **Enable monitoring for this deployment share**. This step is optional.
### Configure permissions for the deployment share
@@ -90,41 +86,34 @@ On **MDT01**:
## Add setup files
-This section will show you how to populate the MDT deployment share with the Windows 11 operating system source files, commonly referred to as setup files, which will be used to create a reference image. Setup files are used during the reference image creation process and are the foundation for the reference image.
+This section will show you how to populate the MDT deployment share with the Windows 10 operating system source files, commonly referred to as setup files, which will be used to create a reference image. Setup files are used during the reference image creation process and are the foundation for the reference image.
-### Add the Windows 11 installation files
+### Add the Windows 10 installation files
-MDT supports adding both full source Windows 11 DVDs (ISOs) and custom images that you have created. In this case, you create a reference image, so you add the full source setup files from Microsoft.
+MDT supports adding both full source Windows 10 DVDs (ISOs) and custom images that you have created. In this case, you create a reference image, so you add the full source setup files from Microsoft.
-> [!NOTE]
-> Windows 11 media is pre-release as of the date this article was last updated. To obtain Windows 11 pre-release media, join the Windows Insider program and visit [Windows Insider Preview Downloads](https://www.microsoft.com/software-download/windowsinsiderpreviewiso).
-> The build selected in this example is **Windows 11 Insider Preview Enterprise (Dev Channel) - Build 22454**.
+>[!NOTE]
+>Due to the Windows limits on path length, we are purposely keeping the operating system destination directory short, using the folder name W10EX64RTM rather than a more descriptive name like Windows 10 Enterprise x64 RTM.
-### Add Windows 11 Enterprise x64 (full source)
+### Add Windows 10 Enterprise x64 (full source)
On **MDT01**:
-1. Sign in as **contoso\\administrator** and copy the content of a Windows 11 Enterprise x64 DVD/ISO to the **D:\\Downloads\\Windows 11 Enterprise x64** folder on MDT01, or just insert the DVD or mount an ISO on MDT01. The following example shows the files copied to the D:\\Downloads folder, but you can also choose to import the OS directly from an ISO or DVD.
+1. Sign in as **contoso\\administrator** and copy the content of a Windows 10 Enterprise x64 DVD/ISO to the **D:\\Downloads\\Windows 10 Enterprise x64** folder on MDT01, or just insert the DVD or mount an ISO on MDT01. The following example shows the files copied to the D:\\Downloads folder, but you can also choose to import the OS directly from an ISO or DVD.
2. Using the Deployment Workbench, expand the **Deployment Shares** node, and then expand **MDT Build Lab**.
-3. Right-click the **Operating Systems** node, and create a new folder named **Windows 11**.
-4. Expand the **Operating Systems** node, right-click the **Windows 11** folder, and select **Import Operating System**. Use the following settings for the Import Operating System Wizard:
+3. Right-click the **Operating Systems** node, and create a new folder named **Windows 10**.
+4. Expand the **Operating Systems** node, right-click the **Windows 10** folder, and select **Import Operating System**. Use the following settings for the Import Operating System Wizard:
- Full set of source files
- Source directory: (location of your source files)
- - Destination directory name: W11EX64
-
- > [!NOTE]
- > Due to the Windows limits on path length, we are purposely keeping the operating system destination directory short, using the folder name W11EX64 rather than a more descriptive name like Windows 11 Enterprise x64.
- > Depending on the DVD or ISO you used, there might be multiple editions added by the import process. For the purposes of this guide, we are using the Windows 11 Enterprise image, but other images will also work. In the example shown, editions that will not be used are deleted from the list.
-
-5. After adding the operating system, in the **Operating Systems / Windows 11** folder, double-click it and change the name to: **Windows 11 Enterprise x64 Default Image**. See the following example.
+ - Destination directory name: W10EX64RTM
+5. After adding the operating system, in the **Operating Systems / Windows 10** folder, double-click it and change the name to: **Windows 10 Enterprise x64 RTM Default Image**. See the following example.
- > [!NOTE]
- > The pre-release version of Windows 11 used here has "Windows 10" in the description. You can ignore this.
+>Depending on the DVD you used, there might be multiple editions available. For the purposes of this guide, we are using the Windows 10 Enterprise image, but other images will also work.
## Add applications
@@ -308,7 +297,7 @@ On **MDT01**:
## Create the reference image task sequence
-In order to build and capture your Windows 11 reference image for deployment using MDT, you will create a task sequence. The task sequence will reference the operating system and applications that you previously imported into the MDT Build Lab deployment share to build a Windows 11 reference image.
+In order to build and capture your Windows 10 reference image for deployment using MDT, you will create a task sequence. The task sequence will reference the operating system and applications that you previously imported into the MDT Build Lab deployment share to build a Windows 10 reference image.
After creating the task sequence, you configure it to enable patching against the Windows Server Update Services (WSUS) server. The Task Sequence Windows Update action supports getting updates directly from Microsoft Update, but you get more stable patching if you use a local WSUS server. WSUS also allows for an easy process of approving the patches that you are deploying.
### Drivers and the reference image
@@ -317,31 +306,31 @@ Because we use modern virtual platforms for creating our reference images, we do
### Create a task sequence for Windows 10 Enterprise
-To create a Windows 11 reference image task sequence, the process is as follows:
+To create a Windows 10 reference image task sequence, the process is as follows:
On **MDT01**:
-1. Using the Deployment Workbench, under **Deployment Shares > MDT Build Lab** right-click **Task Sequences**, and create a **New Folder** named **Windows 11**.
-2. Right-click the new **Windows 11** folder and select **New Task Sequence**. Use the following settings for the New Task Sequence Wizard:
- 1. Task sequence ID: REFW11X64-001
- 2. Task sequence name: Windows 11 Enterprise x64 Default Image
+1. Using the Deployment Workbench, under **Deployment Shares > MDT Build Lab** right-click **Task Sequences**, and create a **New Folder** named **Windows 10**.
+2. Right-click the new **Windows 10** folder and select **New Task Sequence**. Use the following settings for the New Task Sequence Wizard:
+ 1. Task sequence ID: REFW10X64-001
+ 2. Task sequence name: Windows 10 Enterprise x64 RTM Default Image
3. Task sequence comments: Reference Build
4. Template: Standard Client Task Sequence
- 5. Select OS: Windows 11 Enterprise x64 Default Image
+ 5. Select OS: Windows 10 Enterprise x64 RTM Default Image
6. Specify Product Key: Do not specify a product key at this time
7. Full Name: Contoso
8. Organization: Contoso
- 9. Internet Explorer home page: https://www.contoso.com
+ 9. Internet Explorer home page: http://www.contoso.com
10. Admin Password: Do not specify an Administrator Password at this time
-### Edit the Windows 11 task sequence
+### Edit the Windows 10 task sequence
The steps below walk you through the process of editing the Windows 10 reference image task sequence to include the actions required to update the reference image with the latest updates from WSUS, install roles and features, and utilities, and install Microsoft Office365 ProPlus x64.
On **MDT01**:
-1. In the **Task Sequences / Windows 11** folder, right-click the **Windows 11 Enterprise x64 Default Image** task sequence, and select **Properties**.
-2. On the **Task Sequence** tab, configure the Windows 11 Enterprise x64 Default Image task sequence with the following settings:
+1. In the **Task Sequences / Windows 10** folder, right-click the **Windows 10 Enterprise x64 RTM Default Image** task sequence, and select **Properties**.
+2. On the **Task Sequence** tab, configure the Windows 10 Enterprise x64 RTM Default Image task sequence with the following settings:
1. **State Restore > Windows Update (Pre-Application Installation)** action: Enable this action by clicking the **Options** tab and clearing the **Disable this step** check box.
2. **State Restore > Windows Update (Post-Application Installation)** action: Also enable this action.
@@ -351,7 +340,7 @@ On **MDT01**:
- **Note**: The reason for adding the applications after the Tattoo action but before running Windows Update is simply to save time during the deployment. This way we can add all applications that will upgrade some of the built-in components and avoid unnecessary updating.
5. **State Restore > Custom Tasks (Pre-Windows Update)**: Add a new **Install Roles and Features** action with the following settings:
1. Name: Install - Microsoft NET Framework 3.5.1
- 2. Select the operating system for which roles are to be installed: Windows 10 (this also works for Windows 11)
+ 2. Select the operating system for which roles are to be installed: Windows 10
3. Select the roles and features that should be installed: .NET Framework 3.5 (includes .NET 2.0 and 3.0)
>[!IMPORTANT]
@@ -364,7 +353,7 @@ On **MDT01**:
6. **State Restore > Custom Tasks (Pre-Windows Update)**: After the **Install - Microsoft NET Framework 3.5.1** action, add a new **Install Application** action (selected from the **General** group) with the following settings:
1. Name: Microsoft Visual C++ Redistributable 2019 - x86
2. Install a Single Application: browse to **Install - MSVC 2019 - x86**
- 7. Repeat these steps (add a new **Install Application**) to add Microsoft Visual C++ Redistributable 2019 - x64 and Office 365 ProPlus - x64 as well.
+ 7. Repeat these steps (add a new **Install Application**) to add Microsoft Visual C++ Redistributable 2019 - x64 and Microsoft 365 Apps for enterprise as well.
3. Click **OK**.
@@ -396,18 +385,26 @@ Follow these steps to configure Internet Explorer settings in Unattend.xml for t
On **MDT01**:
-1. Using the Deployment Workbench, under **Deployment Shares > MDT Build Lab > Task Sequences** right-click the **Windows 11 Enterprise x64 Default Image** task sequence and select **Properties**.
+1. Using the Deployment Workbench, under **Deployment Shares > MDT Build Lab > Task Sequences** right-click the **Windows 10 Enterprise x64 RTM Default Image** task sequence and select **Properties**.
2. In the **OS Info** tab, click **Edit Unattend.xml**. MDT now generates a catalog file. This will take a few minutes, and then Windows System Image Manager (Windows SIM) will start.
+
+ > [!IMPORTANT]
+ > The ADK version 1903 has a [known issue](/windows-hardware/get-started/what-s-new-in-kits-and-tools#whats-new-in-the-windows-adk-for-windows-10-version-1903) generating a catalog file for Windows 10, version 1903 or 1909 X64 install.wim. You might see the error "Could not load file or assembly" in in the console output. To avoid this issue, [install the ADK, version 2004 or a later version](/windows-hardware/get-started/adk-install). A workaround is also available for the ADK version 1903:
+ > - Close the Deployment Workbench and install the [WSIM 1903 update](https://go.microsoft.com/fwlink/?linkid=2095334). This will update imagecat.exe and imgmgr.exe to version 10.0.18362.144.
+ > - Manually run imgmgr.exe (C:\Program Files (x86)\\Windows Kits\\10\\Assessment and Deployment Kit\\Deployment Tools\\WSIM\\imgmgr.exe).
+ > - Generate a catalog (Tools/Create Catalog) for the selected install.wim (ex: D:\\MDTBuildLab\\Operating Systems\\W10EX64RTM\\sources\\install.wim).
+ > - After manually creating the catalog file (ex: D:\\MDTBuildLab\\Operating Systems\\W10EX64RTM\\sources\\install_Windows 10 Enterprise.clg), open the Deployment Workbench and proceed to edit unattend.xml.
+
3. In Windows SIM, expand the **4 specialize** node in the **Answer File** pane and select the amd64\_Microsoft-Windows-IE-InternetExplorer\_neutral entry.
4. In the **amd64\_Microsoft-Windows-IE-InternetExplorer\_neutral properties** window (right-hand window), set the following values:
- DisableDevTools: true
-5. Save the Answer File, and close Windows SIM.
- - Note: If validation errors are reported that certain display values are incorrect, you can ignore this or browse to **7oobeSystem\\amd64_Microsoft-Windows-Shell-Setup__neutral\\Display** and enter the following: ColorDepth 32, HorizontalResolution 1, RefreshRate 60, VerticalResolution 1.
-6. On the Windows 11 Enterprise x64 Default Image Properties, click **OK**.
+5. Save the Unattend.xml file, and close Windows SIM.
+ - Note: If errors are reported that certain display values are incorrect, you can ignore this or browse to **7oobeSystem\\amd64_Microsoft-Windows-Shell-Setup__neutral\\Display** and enter the following: ColorDepth 32, HorizontalResolution 1, RefreshRate 60, VerticalResolution 1.
+6. On the Windows 10 Enterprise x64 RTM Default Image Properties, click **OK**.
- Windows System Image Manager with the Windows 11 Unattend.xml.
+ Windows System Image Manager with the Windows 10 Unattend.xml.
## Configure the MDT deployment share rules
@@ -478,7 +475,7 @@ On **MDT01**:
```
>[!NOTE]
- >For security reasons, you normally don't add the password to the Bootstrap.ini file; however, because this deployment share is for creating reference image builds only, and should not be published to the production network, it is acceptable to do so in this situation. Obviously if you are not using the same password (pass@word1) that is provided in this lab, you must enter your own custom password on the Rules tab and in Bootstrap.ini.
+ >For security reasons, you normally don't add the password to the Bootstrap.ini file; however, because this deployment share is for creating reference image builds only, and should not be published to the production network, it is acceptable to do so in this situation. Obviously if you are not using the same password (pass@word3) that is provided in this lab, you must enter your own custom password on the Rules tab and in Bootstrap.ini.
4. On the **Windows PE** tab, in the **Platform** drop-down list, select **x86**.
5. In the **Lite Touch Boot Image Settings** area, configure the following settings:
@@ -609,11 +606,11 @@ SkipFinalSummary=YES
- **SkipCapture.** Skips the Capture pane.
- **SkipFinalSummary.** Skips the final Windows Deployment Wizard summary. Because you use FinishAction=Shutdown, you don't want the wizard to stop in the end so that you need to click OK before the machine shuts down.
-## Build the Windows 11 reference image
+## Build the Windows 10 reference image
As previously described, this section requires a Hyper-V host. See [Hyper-V requirements](prepare-for-windows-deployment-with-mdt.md#hyper-v-requirements) for more information.
-Once you have created your task sequence, you are ready to create the Windows 11 reference image. This will be performed by launching the task sequence from a virtual machine which will then automatically perform the reference image creation and capture process.
+Once you have created your task sequence, you are ready to create the Windows 10 reference image. This will be performed by launching the task sequence from a virtual machine which will then automatically perform the reference image creation and capture process.
The steps below outline the process used to boot a virtual machine using an ISO boot image created by MDT, and then run the reference image task sequence image to create and capture the Windows 10 reference image.
@@ -624,67 +621,56 @@ The steps below outline the process used to boot a virtual machine using an ISO
On **HV01**:
2. Create a new virtual machine with the following settings:
- 1. Name: REFW11X64-001
+ 1. Name: REFW10X64-001
2. Store the virtual machine in a different location: C:\VM
3. Generation 1
4. Memory: 1024 MB
5. Network: Must be able to connect to \\MDT01\MDTBuildLab$
7. Hard disk: 60 GB (dynamic disk)
8. Install OS with image file: C:\\ISO\\MDT Build Lab x86.iso
-1. Before you start the VM, add a checkpoint for REFW11X64-001, and name it **Clean with MDT Build Lab x86 ISO**.
+1. Before you start the VM, add a checkpoint for REFW10X64-001, and name it **Clean with MDT Build Lab x86 ISO**.
**Note**: Checkpoints are useful if you need to restart the process and want to make sure you can start clean.
-4. Start the REFW11X64-001 virtual machine and connect to it.
+4. Start the REFW10X64-001 virtual machine and connect to it.
- > [!IMPORTANT]
- > Up to this point we have not discussed IP addressing or DHCP. In the initial setup for this guide, DC01 was provisioned as a DHCP server to provide IP address leases to client computers. You might have a different DHCP server on your network that you wish to use. The REFW11X64-001 virtual machine requires an IP address lease that provides it with connectivity to MDT01 so that it can connect to the \\MDT01\MDTBuildLab$ share, and optionally the WSUS server on your network. A connection to the Internet is also used to download and updates during the image creation process. In the current scenario, this is accomplished with a DHCP scope that provides IP addresses in the 10.10.10.100 - 10.10.10.200 range, with a 10.10.10.1 gateway, as part of a /24 subnet so that the client can connect to MDT01 at 10.10.10.11, and also connect to external networks.
- > If you receive a message that "A connection to the deployment share could not be made, check that the DHCP service is available to the REFW11X64-001 VM, and it has been issued a valid IP address lease (check your DHCP server).
+ **Note**: Up to this point we have not discussed IP addressing or DHCP. In the initial setup for this guide, DC01 was provisioned as a DHCP server to provide IP address leases to client computers. You might have a different DHCP server on your network that you wish to use. The REFW10X64-001 virtual machine requires an IP address lease that provides it with connectivity to MDT01 so that it can connect to the \\MDT01\MDTBuildLab$ share. In the current scenario this is accomplished with a DHCP scope that provides IP addresses in the 10.10.10.100 - 10.10.10.200 range, as part of a /24 subnet so that the client can connect to MDT01 at 10.10.10.11.
-5. After booting into Windows PE, complete the Windows Deployment Wizard with the following settings:
- - Select a task sequence to execute on this computer: Windows 11 Enterprise x64 Default Image
- - Specify whether to capture an image: Capture an image of this reference computer
- - Location: \\\\MDT01\\MDTBuildLab$\\Captures
- - File name: REFW11X64-001.wim
+ After booting into Windows PE, complete the Windows Deployment Wizard with the following settings:
+ 1. Select a task sequence to execute on this computer: Windows 10 Enterprise x64 RTM Default Image
+ 2. Specify whether to capture an image: Capture an image of this reference computer
+ - Location: \\\\MDT01\\MDTBuildLab$\\Captures
+ 3. File name: REFW10X64-001.wim
- 
+ 
- The Windows Deployment Wizard for the Windows 11 reference image.
+ The Windows Deployment Wizard for the Windows 10 reference image.
-The image creation process starts and does the following:
- 1. Installs the Windows 11 Enterprise operating system.
- 2. Installs the added applications, roles, and features.
- 3. Updates the operating system via your local Windows Server Update Services (WSUS) server (if provisioned).
- 4. Stages Windows PE on the local disk.
- 5. Runs System Preparation (Sysprep) and reboots into Windows PE.
- 6. Captures the installation to a Windows Imaging (WIM) file.
- 7. Turns off the virtual machine.
+5. The setup now starts and does the following:
+ 1. Installs the Windows 10 Enterprise operating system.
+ 2. Installs the added applications, roles, and features.
+ 3. Updates the operating system via your local Windows Server Update Services (WSUS) server.
+ 4. Stages Windows PE on the local disk.
+ 5. Runs System Preparation (Sysprep) and reboots into Windows PE.
+ 6. Captures the installation to a Windows Imaging (WIM) file.
+ 7. Turns off the virtual machine.
-After some time (30-90 minutes depending on resources available), you will have a Windows 11 Enterprise x64 image that is fully patched and has run through Sysprep, located in the D:\\MDTBuildLab\\Captures folder on your deployment server. The file name is **REFW11X64-001.wim**.
+After some time, you will have a Windows 10 Enterprise x64 image that is fully patched and has run through Sysprep, located in the D:\\MDTBuildLab\\Captures folder on your deployment server. The file name is REFW10X64-001.wim.
## Troubleshooting
+> [!IMPORTANT]
+> If you encounter errors applying the image when using a BIOS firmware type, see [Windows 10 deployments fail with Microsoft Deployment Toolkit on computers with BIOS type firmware](https://support.microsoft.com/topic/windows-10-deployments-fail-with-microsoft-deployment-toolkit-on-computers-with-bios-type-firmware-70557b0b-6be3-81d2-556f-b313e29e2cb7). This
+
If you [enabled monitoring](#enable-monitoring), you can check the progress of the task sequence.
-If monitoring is not working, check that http://localhost:9801/MDTMonitorData/ loads on MDT01, and try turning monitoring off and on again.
+If there are problems with your task sequence, you can troubleshoot in Windows PE by pressing F8 to open a command prompt. There are several [MDT log files](/configmgr/mdt/troubleshooting-reference#mdt-logs) created that can be helpful determining the origin of an error, such as BDD.log. From the command line in Windows PE you can copy these logs from the client to your MDT server for viewing with CMTrace. For example: copy BDD.log \\\\mdt01\\logs$.
-If there are problems with your task sequence, you can troubleshoot in Windows PE by pressing F8 to open a command prompt. There are several [MDT log files](/configmgr/mdt/troubleshooting-reference#mdt-logs) created that can be helpful determining the origin of an error, such as BDD.log. From the command line in Windows PE you can copy these logs from the client to your MDT server for viewing with CMTrace. For example: copy BDD.log \\\\mdt01\\logs$. An example is shown below.
-
-```cmd
-X:\>net use G: \\mdt01\c$\tmp /user:contoso\administrator pass@word1
-The command completed successfully.
-
-X:\>copy X:\MININT\SMSOSD\OSDLOGS\*.log G:
- 6 files copied.
-X:\>copp X:\Windows\Temp\SMSTSLog\smsts.log G:
- 1 file copied.
-```
-
-If you have trouble connecting to the deployment share, verify that your DHCP server (DC01 in this lab) has issued a lease to the VM. The DHCP client name will be something like minint-p1st75s.contoso.com.
+After some time, you will have a Windows 10 Enterprise x64 image that is fully patched and has run through Sysprep, located in the D:\\MDTBuildLab\\Captures folder on your deployment server. The file name is REFW10X64-001.wim.
## Related topics
diff --git a/windows/deployment/deploy-windows-mdt/deploy-a-windows-11-image-using-mdt.md b/windows/deployment/deploy-windows-mdt/deploy-a-windows-10-image-using-mdt.md
similarity index 88%
rename from windows/deployment/deploy-windows-mdt/deploy-a-windows-11-image-using-mdt.md
rename to windows/deployment/deploy-windows-mdt/deploy-a-windows-10-image-using-mdt.md
index 435f937e56..9d20892e07 100644
--- a/windows/deployment/deploy-windows-mdt/deploy-a-windows-11-image-using-mdt.md
+++ b/windows/deployment/deploy-windows-mdt/deploy-a-windows-10-image-using-mdt.md
@@ -1,12 +1,12 @@
---
-title: Deploy a Windows 11 image using MDT (Windows 11)
-description: This topic will show you how to take your reference image for Windows 11, and deploy that image to your environment using the Microsoft Deployment Toolkit (MDT).
+title: Deploy a Windows 10 image using MDT (Windows 10)
+description: This topic will show you how to take your reference image for Windows 10, and deploy that image to your environment using the Microsoft Deployment Toolkit (MDT).
ms.assetid: 1d70a3d8-1b1d-4051-b656-c0393a93f83c
ms.reviewer:
manager: dougeby
ms.author: greglin
keywords: deployment, automate, tools, configure
-ms.prod: w11
+ms.prod: w10
ms.mktglfcycl: deploy
ms.localizationpriority: medium
ms.sitesec: library
@@ -16,13 +16,12 @@ author: greg-lindsay
ms.topic: article
---
-# Deploy a Windows 11 image using MDT
+# Deploy a Windows 10 image using MDT
**Applies to**
-- Windows 10
-- Windows 11
+- Windows 10
-This topic will show you how to take your reference image for Windows 11 [that was just created](create-a-windows-11-reference-image.md), and deploy that image to your environment using the Microsoft Deployment Toolkit (MDT).
+This topic will show you how to take your reference image for Windows 10 (that was just [created](create-a-windows-10-reference-image.md)), and deploy that image to your environment using the Microsoft Deployment Toolkit (MDT).
We will prepare for this by creating an MDT deployment share that is used solely for image deployment. Separating the processes of creating reference images from the processes used to deploy them in production allows greater control of on both processes. We will configure Active Directory permissions, configure the deployment share, create a new task sequence, and add applications, drivers, and rules.
@@ -31,7 +30,7 @@ For the purposes of this topic, we will use four computers: DC01, MDT01, HV01 an
- DC01 is a domain controller
- MDT01 is a domain member server
- HV01 is a Hyper-V server
-- PC0005 is a blank device to which we will deploy Windows 11
+- PC0005 is a blank device to which we will deploy Windows 10
MDT01 and PC0005 are members of the domain contoso.com for the fictitious Contoso Corporation. HV01 used to test deployment of PC0005 in a virtual environment.
@@ -90,8 +89,11 @@ The steps for creating the deployment share for production are the same as when
1. Ensure you are signed on as: contoso\administrator.
2. In the Deployment Workbench console, right-click **Deployment Shares** and select **New Deployment Share**.
3. On the **Path** page, in the **Deployment share path** text box, type **D:\\MDTProduction** and click **Next**.
+
4. On the **Share** page, in the **Share name** text box, type **MDTProduction$** and click **Next**.
+
5. On the **Descriptive Name** page, in the **Deployment share description** text box, type **MDT Production** and click **Next**.
+
6. On the **Options** page, accept the default settings and click **Next** twice, and then click **Finish**.
7. Using File Explorer, verify that you can access the **\\\\MDT01\\MDTProduction$** share.
@@ -111,22 +113,26 @@ On **MDT01**:
## Step 3: Add a custom image
-The next step is to add a reference image into the deployment share with the setup files required to successfully deploy Windows 11. When adding a custom image, you still need to copy setup files (an option in the wizard) because Windows 10/11 stores additional components in the Sources\\SxS folder which is outside the image and may be required when installing components.
+The next step is to add a reference image into the deployment share with the setup files required to successfully deploy Windows 10. When adding a custom image, you still need to copy setup files (an option in the wizard) because Windows 10 stores additional components in the Sources\\SxS folder which is outside the image and may be required when installing components.
-### Add the Windows 11 Enterprise x64 custom image
+### Add the Windows 10 Enterprise x64 RTM custom image
-In these steps, we assume that you have completed the steps in the [Create a Windows 11 reference image](create-a-windows-11-reference-image.md) topic, so you have a Windows 11 reference image at **D:\\MDTBuildLab\\Captures\REFW11X64-001.wim** on MDT01.
+In these steps, we assume that you have completed the steps in the [Create a Windows 10 reference image](create-a-windows-10-reference-image.md) topic, so you have a Windows 10 reference image at **D:\\MDTBuildLab\\Captures\REFW10X64-001.wim** on MDT01.
-1. Using the Deployment Workbench, expand the **Deployment Shares** node, and then expand **MDT Production**; select the **Operating Systems** node, and create a folder named **Windows 11**.
+1. Using the Deployment Workbench, expand the **Deployment Shares** node, and then expand **MDT Production**; select the **Operating Systems** node, and create a folder named **Windows 10**.
2. Right-click the **Windows 10** folder and select **Import Operating System**.
-3. On the **OS Type** page, select **Custom image file** and click **Next**.
-4. On the **Image** page, in the **Source file** text box, browse to **D:\\MDTBuildLab\\Captures\\REFW11X64-001.wim** and click **Next**.
-5. On the **Setup** page, select the **Copy Windows 7, Windows Server 2008 R2, or later setup files from the specified path** option; in the **Setup source directory** text box, browse to **D:\\MDTBuildLab\\Operating Systems\\W11EX64** and click **Next**.
-6. On the **Destination** page, in the **Destination directory name** text box, type **W11EX64**, click **Next** twice, and then click **Finish**.
-7. After adding the operating system, double-click the added operating system name in the **Operating Systems / Windows 11** node and change the name to **Windows 11 Enterprise x64 Custom Image**.
-> [!NOTE]
-> The reason for adding the setup files has changed since earlier versions of MDT. MDT 2010 used the setup files to install Windows. MDT now uses DISM to apply the image; however, you still need the setup files because some components in roles and features are stored outside the main image.
+3. On the **OS Type** page, select **Custom image file** and click **Next**.
+
+4. On the **Image** page, in the **Source file** text box, browse to **D:\\MDTBuildLab\\Captures\\REFW10X64-001.wim** and click **Next**.
+
+5. On the **Setup** page, select the **Copy Windows 7, Windows Server 2008 R2, or later setup files from the specified path** option; in the **Setup source directory** text box, browse to **D:\\MDTBuildLab\\Operating Systems\\W10EX64RTM** and click **Next**.
+
+6. On the **Destination** page, in the **Destination directory name** text box, type **W10EX64RTM**, click **Next** twice, and then click **Finish**.
+7. After adding the operating system, double-click the added operating system name in the **Operating Systems / Windows 10** node and change the name to **Windows 10 Enterprise x64 RTM Custom Image**.
+
+>[!NOTE]
+>The reason for adding the setup files has changed since earlier versions of MDT. MDT 2010 used the setup files to install Windows. MDT uses DISM to apply the image; however, you still need the setup files because some components in roles and features are stored outside the main image.
@@ -139,15 +145,21 @@ When you configure your MDT Build Lab deployment share, you can also add applica
On **MDT01**:
-1. Download the Enterprise distribution version of [Adobe Acrobat Reader DC](https://get.adobe.com/reader/enterprise/) (AcroRdrDC2100720091_en_US.exe) to **D:\\setup\\adobe** on MDT01.
-2. Extract the .exe file that you downloaded to an .msi (ex: .\AcroRdrDC2100720091_en_US.exe -sfx_o"d:\setup\adobe\install\" -sfx_ne).
+1. Download the Enterprise distribution version of [Adobe Acrobat Reader DC](https://get.adobe.com/reader/enterprise/) (AcroRdrDC2100520060_en_US.exe) to **D:\\setup\\adobe** on MDT01.
+2. Extract the .exe file that you downloaded to an .msi (ex: .\AcroRdrDC2100520060_en_US.exe -sfx_o"d:\setup\adobe\install\" -sfx_ne).
3. In the Deployment Workbench, expand the **MDT Production** node and navigate to the **Applications** node.
4. Right-click the **Applications** node, and create a new folder named **Adobe**.
+
5. In the **Applications** node, right-click the **Adobe** folder and select **New Application**.
+
6. On the **Application Type** page, select the **Application with source files** option and click **Next**.
+
7. On the **Details** page, in the **Application Name** text box, type **Install - Adobe Reader** and click *Next**.
+
8. On the **Source** page, in the **Source Directory** text box, browse to **D:\\setup\\adobe\\install** and click **Next**.
+
9. On the **Destination** page, in the **Specify the name of the directory that should be created** text box, type **Install - Adobe Reader** and click **Next**.
+
10. On the **Command Details** page, in the **Command Line** text box, type **msiexec /i AcroRead.msi /q**, click **Next** twice, and then click **Finish**.
@@ -156,10 +168,7 @@ On **MDT01**:
## Step 5: Prepare the drivers repository
-> [!IMPORTANT]
-> The section below on preparing the drivers repository uses Windows 10-compatible devices and drivers as examples. These examples do not infer Windows 11 compatibility. Check with your device manufacturer before deploying drivers, and verify that the device meets Windows 11 hardware requirements. For more information, see [Windows 11 requirements](/windows/whats-new/windows-11-requirements).
-
-In order to deploy Windows 10 or Windows 11 with MDT successfully, you need drivers for the boot images and for the actual operating system. This section will show you how to add drivers for the boot image and operating system, using the following hardware models as examples:
+In order to deploy Windows 10 with MDT successfully, you need drivers for the boot images and for the actual operating system. This section will show you how to add drivers for the boot image and operating system, using the following hardware models as examples:
- Lenovo ThinkPad T420
- Dell Latitude 7390
- HP EliteBook 8560w
@@ -167,8 +176,8 @@ In order to deploy Windows 10 or Windows 11 with MDT successfully, you need dri
For boot images, you need to have storage and network drivers; for the operating system, you need to have the full suite of drivers.
-> [!NOTE]
-> You should only add drivers to the Windows PE images if the default drivers don't work. Adding drivers that are not necessary will only make the boot image larger and potentially delay the download time.
+>[!NOTE]
+>You should only add drivers to the Windows PE images if the default drivers don't work. Adding drivers that are not necessary will only make the boot image larger and potentially delay the download time.
### Create the driver source structure in the file system
@@ -183,8 +192,8 @@ On **MDT01**:
2. In the **D:\\drivers** folder, create the following folder structure:
1. WinPE x86
2. WinPE x64
- 3. Windows 11 x64
-3. In the new Windows 11 x64 folder, create the following folder structure:
+ 3. Windows 10 x64
+3. In the new Windows 10 x64 folder, create the following folder structure:
- Dell Inc.
- Latitude E7450
- Hewlett-Packard
@@ -204,8 +213,8 @@ When you import drivers to the MDT driver repository, MDT creates a single insta
2. In the **Out-Of-Box Drivers** node, create the following folder structure:
1. WinPE x86
2. WinPE x64
- 3. Windows 11 x64
-3. In the **Windows 11 x64** folder, create the following folder structure:
+ 3. Windows 10 x64
+3. In the **Windows 10 x64** folder, create the following folder structure:
- Dell Inc.
- Latitude E7450
- Hewlett-Packard
@@ -236,28 +245,32 @@ The Out-of-Box Drivers structure in the Deployment Workbench.
### Create the selection profiles for boot image drivers
By default, MDT adds any storage and network drivers that you import to the boot images. However, you should add only the drivers that are necessary to the boot image. You can control which drivers are added by using selection profiles.
-The drivers that are used for the boot images (Windows PE) are Windows 11 drivers. If you can’t locate Windows 11 drivers for your device, a Windows 10, Windows 8.1 or Windows 7 driver will most likely work, but Windows 11 drivers should be your first choice.
+The drivers that are used for the boot images (Windows PE) are Windows 10 drivers. If you can’t locate Windows 10 drivers for your device, a Windows 7 or Windows 8.1 driver will most likely work, but Windows 10 drivers should be your first choice.
On **MDT01**:
1. In the Deployment Workbench, under the **MDT Production** node, expand the **Advanced Configuration** node, right-click the **Selection Profiles** node, and select **New Selection Profile**.
2. In the New Selection Profile Wizard, create a selection profile with the following settings:
- 1. Selection Profile name: **WinPE x86**
+ 1. Selection Profile name: WinPE x86
2. Folders: Select the WinPE x86 folder in Out-of-Box Drivers.
3. Click **Next**, **Next** and **Finish**.
3. Right-click the **Selection Profiles** node again, and select **New Selection Profile**.
4. In the New Selection Profile Wizard, create a selection profile with the following settings:
- 1. Selection Profile name: **WinPE x64**
+ 1. Selection Profile name: WinPE x64
2. Folders: Select the WinPE x64 folder in Out-of-Box Drivers.
3. Click **Next**, **Next** and **Finish**.
+ 
+
+ Creating the WinPE x64 selection profile.
+
### Extract and import drivers for the x64 boot image
Windows PE supports all the hardware models that we have, but here you learn to add boot image drivers to accommodate any new hardware that might require additional drivers. In this example, you add the latest Intel network drivers to the x64 boot image.
On **MDT01**:
-1. Download **PROWinx64.exe** from Intel.com (ex: [Intel® Network Adapter Driver](https://www.intel.com/content/www/us/en/download/16765/intel-network-adapter-driver-for-windows-8-final-release.html)).
+1. Download **PROWinx64.exe** from Intel.com (ex: [PROWinx64.exe](https://downloadcenter.intel.com/downloads/eula/25016/Intel-Network-Adapter-Driver-for-Windows-10?httpDown=https%3A%2F%2Fdownloadmirror.intel.com%2F25016%2Feng%2FPROWinx64.exe)).
2. Extract PROWinx64.exe to a temporary folder - in this example to the **C:\\Tmp\\ProWinx64** folder.
a. **Note**: Extracting the .exe file manually requires an extraction utility. You can also run the .exe and it will self-extract files to the **%userprofile%\AppData\Local\Temp\RarSFX0** directory. This directory is temporary and will be deleted when the .exe terminates.
3. Using File Explorer, create the **D:\\Drivers\\WinPE x64\\Intel PRO1000** folder.
@@ -279,11 +292,11 @@ In this example, we assume you have downloaded and extracted the drivers using T
On **MDT01**:
-1. In the Deployment Workbench, in the **MDT Production** > **Out-Of-Box Drivers** > **Windows 11 x64** node, expand the **Lenovo** node.
+1. In the Deployment Workbench, in the **MDT Production** > **Out-Of-Box Drivers** > **Windows 10 x64** node, expand the **Lenovo** node.
2. Right-click the **30A6003TUS** folder and select **Import Drivers** and use the following Driver source directory to import drivers:
- **D:\\Drivers\\Windows 11 x64\\Lenovo\\ThinkStation P500 (30A6003TUS)**
+ **D:\\Drivers\\Windows 10 x64\\Lenovo\\ThinkStation P500 (30A6003TUS)**
The folder you select and all sub-folders will be checked for drivers, expanding any .cab files that are present and searching for drivers.
@@ -295,29 +308,29 @@ In these steps, we assume you have downloaded and extracted the CAB file for the
On **MDT01**:
-1. In the **Deployment Workbench**, in the **MDT Production** > **Out-Of-Box Drivers** > **Windows 11 x64** node, expand the **Dell Inc.** node.
+1. In the **Deployment Workbench**, in the **MDT Production** > **Out-Of-Box Drivers** > **Windows 10 x64** node, expand the **Dell Inc.** node.
2. Right-click the **Latitude E7450** folder and select **Import Drivers** and use the following Driver source directory to import drivers:
- **D:\\Drivers\\Windows 11 x64\\Dell Inc.\\Latitude E7450**
+ **D:\\Drivers\\Windows 10 x64\\Dell Inc.\\Latitude E7450**
### For the HP EliteBook 8560w
For the HP EliteBook 8560w, you use HP Image Assistant to get the drivers. The HP Image Assistant can be accessed on the [HP Support site](https://ftp.ext.hp.com/pub/caps-softpaq/cmit/HPIA.html).
-In these steps, we assume you have downloaded and extracted the drivers for the HP EliteBook 8650w model to the **D:\\Drivers\\Windows 11 x64\\Hewlett-Packard\\HP EliteBook 8560w** folder.
+In these steps, we assume you have downloaded and extracted the drivers for the HP EliteBook 8650w model to the **D:\\Drivers\\Windows 10 x64\\Hewlett-Packard\\HP EliteBook 8560w** folder.
On **MDT01**:
-1. In the **Deployment Workbench**, in the **MDT Production** > **Out-Of-Box Drivers** > **Windows 11 x64** node, expand the **Hewlett-Packard** node.
+1. In the **Deployment Workbench**, in the **MDT Production** > **Out-Of-Box Drivers** > **Windows 10 x64** node, expand the **Hewlett-Packard** node.
2. Right-click the **HP EliteBook 8560w** folder and select **Import Drivers** and use the following Driver source directory to import drivers:
- **D:\\Drivers\\Windows 11 x64\\Hewlett-Packard\\HP EliteBook 8560w**
+ **D:\\Drivers\\Windows 10 x64\\Hewlett-Packard\\HP EliteBook 8560w**
### For the Microsoft Surface Laptop
-For the Microsoft Surface Laptop model, you find the drivers on the Microsoft website. In these steps we assume you have downloaded and extracted the Surface Laptop drivers to the **D:\\Drivers\\Windows 11 x64\\Microsoft\\Surface Laptop** folder.
+For the Microsoft Surface Laptop model, you find the drivers on the Microsoft website. In these steps we assume you have downloaded and extracted the Surface Laptop drivers to the **D:\\Drivers\\Windows 10 x64\\Microsoft\\Surface Laptop** folder.
On **MDT01**:
@@ -325,40 +338,40 @@ On **MDT01**:
2. Right-click the **Surface Laptop** folder and select **Import Drivers**; and use the following Driver source directory to import drivers:
- **D:\\Drivers\\Windows 11 x64\\Microsoft\\Surface Laptop**
+ **D:\\Drivers\\Windows 10 x64\\Microsoft\\Surface Laptop**
## Step 6: Create the deployment task sequence
-This section will show you how to create the task sequence used to deploy your production Windows 11 reference image. You will then configure the task sequence to enable patching via a Windows Server Update Services (WSUS) server.
+This section will show you how to create the task sequence used to deploy your production Windows 10 reference image. You will then configure the task sequence to enable patching via a Windows Server Update Services (WSUS) server.
-### Create a task sequence for Windows 11 Enterprise
+### Create a task sequence for Windows 10 Enterprise
On **MDT01**:
-1. In the Deployment Workbench, under the **MDT Production** node, right-click **Task Sequences**, and create a folder named **Windows 11**.
+1. In the Deployment Workbench, under the **MDT Production** node, right-click **Task Sequences**, and create a folder named **Windows 10**.
-2. Right-click the new **Windows 11** folder and select **New Task Sequence**. Use the following settings for the New Task Sequence Wizard:
- - Task sequence ID: W11-X64-001
- - Task sequence name: Windows 11 Enterprise x64 Custom Image
+2. Right-click the new **Windows 10** folder and select **New Task Sequence**. Use the following settings for the New Task Sequence Wizard:
+ - Task sequence ID: W10-X64-001
+ - Task sequence name: Windows 10 Enterprise x64 RTM Custom Image
- Task sequence comments: Production Image
- Template: Standard Client Task Sequence
- - Select OS: Windows 11 Enterprise x64 Custom Image
+ - Select OS: Windows 10 Enterprise x64 RTM Custom Image
- Specify Product Key: Do not specify a product key at this time
- Full Name: Contoso
- Organization: Contoso
- Internet Explorer home page: https://www.contoso.com
- Admin Password: Do not specify an Administrator Password at this time
-### Edit the Windows 11 task sequence
+### Edit the Windows 10 task sequence
-1. Continuing from the previous procedure, right-click the **Windows 11 Enterprise x64 Custom Image** task sequence, and select **Properties**.
+1. Continuing from the previous procedure, right-click the **Windows 10 Enterprise x64 RTM Custom Image** task sequence, and select **Properties**.
-2. On the **Task Sequence** tab, configure the **Windows 11 Enterprise x64 Custom Image** task sequence with the following settings:
+2. On the **Task Sequence** tab, configure the **Windows 10 Enterprise x64 RTM Custom Image** task sequence with the following settings:
1. Preinstall: After the **Enable BitLocker (Offline)** action, add a **Set Task Sequence Variable** action with the following settings:
1. Name: Set DriverGroup001
2. Task Sequence Variable: DriverGroup001
- 3. Value: Windows 11 x64\\%Manufacturer%\\%Model%
+ 3. Value: Windows 10 x64\\%Manufacturer%\\%Model%
2. Configure the **Inject Drivers** action with the following settings:
- Choose a selection profile: Nothing
@@ -473,7 +486,7 @@ On **MDT01**:
11. Click **OK**.
>[!NOTE]
- >It might take a while for the Deployment Workbench to create the monitoring database and web service.
+ >It will take a while for the Deployment Workbench to create the monitoring database and web service.
@@ -604,13 +617,13 @@ Like the MDT Build Lab deployment share, the MDT Production deployment share nee
>[!NOTE]
>The update process will take 5 to 10 minutes.
-## Step 8: Deploy the Windows 11 client image
+## Step 8: Deploy the Windows 10 client image
These steps will walk you through the process of using task sequences to deploy Windows 10 images through a fully automated process. First, you need to add the boot image to Windows Deployment Services (WDS) and then start the deployment. In contrast with deploying images from the MDT Build Lab deployment share, we recommend using the Pre-Installation Execution Environment (PXE) to start the full deployments in the datacenter, even though you technically can use an ISO/CD or USB to start the process.
### Configure Windows Deployment Services
-You need to add the MDT Production Lite Touch x64 Boot image to WDS in preparation for the deployment. In this procedure, we assume that WDS is already installed and initialized on MDT01 as described in the [Prepare for Windows deployment](prepare-for-windows-deployment-with-mdt.md#install-and-initialize-wds) article.
+You need to add the MDT Production Lite Touch x64 Boot image to WDS in preparation for the deployment. In this procedure, we assume that WDS is already installed and initialized on MDT01 as described in the [Prepare for Windows deployment](prepare-for-windows-deployment-with-mdt.md#install-and-initialize-windows-deployment-services-wds) article.
On **MDT01**:
@@ -624,7 +637,7 @@ On **MDT01**:
The boot image added to the WDS console.
-### Deploy the Windows 11 client
+### Deploy the Windows 10 client
At this point, you should have a solution ready for deploying the Windows 10 client. We recommend starting by trying a few deployments at a time until you are confident that your configuration works as expected. We find it useful to try some initial tests on virtual machines before testing on physical hardware. This helps rule out hardware issues when testing or troubleshooting. Here are the steps to deploy your Windows 10 image to a virtual machine:
@@ -654,9 +667,9 @@ On **HV01**:
4. Setup now begins and does the following:
- - Installs the Windows 11 Enterprise operating system.
+ - Installs the Windows 10 Enterprise operating system.
- Installs the added application.
- - Updates the operating system via your local Windows Server Update Services (WSUS) server (if configured).
+ - Updates the operating system via your local Windows Server Update Services (WSUS) server.
@@ -714,9 +727,9 @@ On **MDT01**:
The newly created multicast namespace.
-## Use offline media to deploy Windows 11
+## Use offline media to deploy Windows 10
-In addition to network-based deployments, MDT supports the use of offline media-based deployments of Windows 11. You can very easily generate an offline version of your deployment share - either the full deployment share or a subset of it - through the use of selection profiles. The generated offline media can be burned to a DVD or copied to a USB stick for deployment.
+In addition to network-based deployments, MDT supports the use of offline media-based deployments of Windows 10. You can very easily generate an offline version of your deployment share - either the full deployment share or a subset of it - through the use of selection profiles. The generated offline media can be burned to a DVD or copied to a USB stick for deployment.
Offline media are useful not only when you do not have network connectivity to the deployment share, but also when you have limited connection to the deployment share and do not want to copy 5 GB of data over the wire. Offline media can still join the domain, but you save the transfer of operating system images, drivers, and applications over the wire.
@@ -735,10 +748,10 @@ On **MDT01**:
- Folders
- Applications / Adobe
- - Operating Systems / Windows 11
+ - Operating Systems / Windows 10
- Out-Of-Box Drivers / WinPE x64
- - Out-Of-Box Drivers / Windows 11 x64
- - Task Sequences / Windows 11
+ - Out-Of-Box Drivers / Windows 10 x64
+ - Task Sequences / Windows 10
@@ -756,7 +769,7 @@ In these steps, you generate offline media from the MDT Production deployment sh
3. Use the following settings for the New Media Wizard:
- General Settings
- Media path: **D:\\MDTOfflineMedia**
- - Selection profile: **Windows 11 Offline Media**
+ - Selection profile: **Windows 10 Offline Media**
### Configure the offline media
@@ -770,7 +783,7 @@ On **MDT01**:
3. In the **General** tab, configure the following:
- Clear the Generate x86 boot image check box.
- - ISO file name: Windows 11 Offline Media.iso
+ - ISO file name: Windows 10 Offline Media.iso
4. On the **Windows PE** tab, in the **Platform** drop-down list, select **x64**.
@@ -803,10 +816,15 @@ The ISO that you got when updating the offline media item can be burned to a DVD
Follow these steps to create a bootable USB stick from the offline media content:
1. On a physical machine running Windows 7 or later, insert the USB stick you want to use.
+
2. Copy the content of the **MDTOfflineMedia\\Content** folder to the root of the USB stick.
+
3. Start an elevated command prompt (run as Administrator), and start the Diskpart utility by typing **Diskpart** and pressing **Enter**.
+
4. In the Diskpart utility, you can type **list volume** (or the shorter **list vol**) to list the volumes, but you really only need to remember the drive letter of the USB stick to which you copied the content. In our example, the USB stick had the drive letter F.
+
5. In the Diskpart utility, type **select volume F** (replace F with your USB stick drive letter).
+
6. In the Diskpart utility, type **active**, and then type **exit**.
## Unified Extensible Firmware Interface (UEFI)-based deployments
diff --git a/windows/deployment/deploy-windows-mdt/get-started-with-the-microsoft-deployment-toolkit.md b/windows/deployment/deploy-windows-mdt/get-started-with-the-microsoft-deployment-toolkit.md
index 0d0b8199c5..df26acb90f 100644
--- a/windows/deployment/deploy-windows-mdt/get-started-with-the-microsoft-deployment-toolkit.md
+++ b/windows/deployment/deploy-windows-mdt/get-started-with-the-microsoft-deployment-toolkit.md
@@ -1,5 +1,5 @@
---
-title: Get started with the Microsoft Deployment Toolkit (MDT) (Windows 10/11)
+title: Get started with the Microsoft Deployment Toolkit (MDT) (Windows 10)
description: This topic will help you gain a better understanding of how to use the Microsoft Deployment Toolkit (MDT), as part of a Windows operating system deployment.
ms.assetid: a256442c-be47-4bb9-a105-c831f58ce3ee
ms.reviewer:
@@ -20,7 +20,6 @@ ms.topic: article
**Applies to**
- Windows 10
-- Windows 11
This article provides an overview of the features, components, and capabilities of the [Microsoft Deployment Toolkit (MDT)](/mem/configmgr/mdt/). When you have finished reviewing this information, see [Prepare for deployment with MDT](prepare-for-windows-deployment-with-mdt.md).
@@ -30,14 +29,17 @@ MDT is a unified collection of tools, processes, and guidance for automating des
In addition to reducing deployment time and standardizing desktop and server images, MDT enables you to more easily manage security and ongoing configurations. MDT builds on top of the core deployment tools in the [Windows Assessment and Deployment Kit](/windows-hardware/get-started/adk-install) (Windows ADK) with additional guidance and features designed to reduce the complexity and time required for deployment in an enterprise environment.
-MDT supports the deployment of Windows 11, as well as Windows 7, Windows 8.1, Windows 10, and Windows Server. It also includes support for zero-touch installation (ZTI) with [Microsoft Endpoint Configuration Manager](/configmgr/).
+MDT supports the deployment of Windows 10, as well as Windows 7, Windows 8.1, and Windows Server. It also includes support for zero-touch installation (ZTI) with [Microsoft Endpoint Configuration Manager](/configmgr/).
+
+> [!IMPORTANT]
+> For more information about MDT supported platforms, see [MDT Release Notes](/mem/configmgr/mdt/release-notes#supported-platforms) and [MDT FAQ](/mem/configmgr/mdt/faq#is-this-release-only-supported-with-version--x--of-windows-client--windows-adk--or-configuration-manager-).
## Key features in MDT
MDT has been in existence since 2003, when it was first introduced as Business Desktop Deployment (BDD) 1.0. The toolkit has evolved, both in functionality and popularity, and today it is considered fundamental to Windows operating system and enterprise application deployment.
MDT has many useful features, such as:
-- **Windows Client support.** Supports Windows 7, Windows 8.1, Windows 10, and Windows 11.
+- **Windows Client support.** Supports Windows 7, Windows 8.1, and Windows 10.
- **Windows Server support.** Supports Windows Server 2008 R2, Windows Server 2012, Windows Server 2012 R2, Windows Server 2016, and Windows Server 2019.
- **Additional operating systems support.** Supports Windows Thin PC and [Windows Embedded POSReady 7](https://www.microsoft.com/en-us/download/details.aspx?id=26558), as well as Windows 8.1 Embedded Industry.
- **UEFI support.** Supports deployment to machines using Unified Extensible Firmware Interface (UEFI) version 2.3.1.
@@ -69,11 +71,11 @@ MDT has many useful features, such as:
- **Support for Microsoft Office.** Provides added support for deploying Microsoft Office.
- **Support for Modern UI app package provisioning.** Provisions applications based on the new Windows app package standard, which is used in Windows 8 and later.
- **Extensibility.** Provides the capability to extend MDT far beyond the built-in features by adding custom scripts, web services, System Center Orchestrator runbooks, PowerShell scripts, and VBScripts.
-- **Upgrade task sequence.** Provides a new upgrade task sequence template that you can use to upgrade existing Windows 7, Windows 8, Windows 8.1, and Windows 10 systems directly to Windows 11, automatically preserving all data, settings, applications, and drivers. For more information about using this new upgrade task sequence, refer to the [Microsoft Deployment Toolkit resource page](/mem/configmgr/mdt/).
+- **Upgrade task sequence.** Provides a new upgrade task sequence template that you can use to upgrade existing Windows 7, Windows 8, and Windows 8.1 systems directly to Windows 10, automatically preserving all data, settings, applications, and drivers. For more information about using this new upgrade task sequence, refer to the [Microsoft Deployment Toolkit resource page](/mem/configmgr/mdt/).
## MDT Lite Touch components
-Many features in MDT support Lite Touch Installation (LTI) for Windows 11. An LTI deployment strategy requires very little infrastructure or user interaction, and can be used to deploy an operating system from a network share or from a physical media, such as a USB flash drive or disc.
+Many features in MDT support Lite Touch Installation (LTI) for Windows 10. An LTI deployment strategy requires very little infrastructure or user interaction, and can be used to deploy an operating system from a network share or from a physical media, such as a USB flash drive or disc.
When deploying the Windows operating system using MDT, most of the administration and configuration is done through the Deployment Workbench, but you also can perform many of the tasks using Windows PowerShell. The easiest way to find out how to use PowerShell in MDT is to use the Deployment Workbench to perform an operation and at the end of that task, click View Script. That will give you the PowerShell command.
diff --git a/windows/deployment/deploy-windows-mdt/prepare-for-windows-deployment-with-mdt.md b/windows/deployment/deploy-windows-mdt/prepare-for-windows-deployment-with-mdt.md
index bd9599c6e4..186a8fe7bd 100644
--- a/windows/deployment/deploy-windows-mdt/prepare-for-windows-deployment-with-mdt.md
+++ b/windows/deployment/deploy-windows-mdt/prepare-for-windows-deployment-with-mdt.md
@@ -1,12 +1,12 @@
---
-title: Prepare for deployment with MDT (Windows 11)
-description: This topic will walk you through the steps necessary to create the server structure required to deploy the Windows 11 operating system using the Microsoft Deployment Toolkit (MDT).
+title: Prepare for deployment with MDT (Windows 10)
+description: This topic will walk you through the steps necessary to create the server structure required to deploy the Windows 10 operating system using the Microsoft Deployment Toolkit (MDT).
ms.assetid: 5103c418-0c61-414b-b93c-a8e8207d1226
ms.reviewer:
manager: dougeby
ms.author: greglin
keywords: deploy, system requirements
-ms.prod: w11
+ms.prod: w10
ms.mktglfcycl: deploy
ms.localizationpriority: medium
ms.sitesec: library
@@ -19,68 +19,51 @@ ms.topic: article
# Prepare for deployment with MDT
**Applies to**
-- Windows 10
-- Windows 11
+- Windows 10
+This article will walk you through the steps necessary to prepare your network and server infrastructure to deploy Windows 10 with the Microsoft Deployment Toolkit (MDT). It covers the installation of the necessary system prerequisites, the creation of shared folders and service accounts, and the configuration of security permissions in the file system and in Active Directory.
-This article will walk you through the steps necessary to prepare your network and server infrastructure to deploy Windows 11 with the Microsoft Deployment Toolkit (MDT). All procedures in this guide can also be used to deploy Windows 10. For an overview of the features, components, and capabilities of MDT, see [Get started with MDT](get-started-with-the-microsoft-deployment-toolkit.md).
-
-This article covers installation of necessary system prerequisites, creation of shared folders and service accounts, and configuration of security permissions in the file system and in Active Directory. Steps to complete the following procedures are provided:
-
-1. Install the Windows Assessment and Deployment Kit (ADK)
-2. Install and initialize Windows Deployment Services (WDS)
-3. Install MDT
-4. Create an Active Directory Organizational Unit structure to support deployment
-5. Create the MDT service account
-6. Create and share the logs folder
-
-After completing these steps, you can create a [Windows 11 reference image](create-a-windows-11-reference-image.md) that will be used to deploy Windows 11. If you are installing Windows 10 instead of Windows 11, use [source media](create-a-windows-11-reference-image.md#add-setup-files) for Windows 10 instead of Windows 11 to create your reference image.
-
-> [!IMPORTANT]
-> Before deploying Windows 11, verify that the device meets [requirements](/windows/whats-new/windows-11-requirements).
-
-## Infrastructure and requirements
+## Infrastructure
The procedures in this guide use the following names and infrastructure.
-#### Network and servers
+### Network and servers
For the purposes of this topic, we will use three server computers: **DC01**, **MDT01**, and **HV01**.
- All servers are running Windows Server 2019.
- You can use an earlier version of Windows Server with minor modifications to some procedures.
- Note: Although MDT supports Windows Server 2008 R2, at least Windows Server 2012 R2 or later is required to perform the procedures in this guide.
- **DC01** is a domain controller, DHCP server, and DNS server for contoso.com, representing the fictitious Contoso Corporation.
- - The DHCP scope used in this lab is 10.10.10.0/24 with a gateway of 10.10.10.1. but you can adjust the scope settings to your environment.
- **MDT01** is a domain member server in contoso.com with a data (D:) drive that can store at least 200GB. MDT01 will host deployment shares and run the Windows Deployment Service. Optionally, MDT01 is also a WSUS server.
- - A second MDT server (**MDT02**) configured identically to MDT01 is optionally used to [build a distributed environment](build-a-distributed-environment-for-windows-deployment.md) for Windows 11 deployment. This server is located on a different subnet than MDT01 and has a different default gateway.
-- **HV01** is a Hyper-V host computer that is used to build a Windows 11 reference image.
+ - A second MDT server (**MDT02**) configured identically to MDT01 is optionally used to [build a distributed environment](build-a-distributed-environment-for-windows-10-deployment.md) for Windows 10 deployment. This server is located on a different subnet than MDT01 and has a different default gateway.
+- **HV01** is a Hyper-V host computer that is used to build a Windows 10 reference image.
- See [Hyper-V requirements](#hyper-v-requirements) below for more information about HV01.
-#### Client computers
+### Client computers
Several client computers are referenced in this guide with hostnames of PC0001 to PC0007.
-- **PC0001**: A computer running Windows 11 Enterprise x64, fully patched with the latest security updates, and configured as a member in the contoso.com domain.
+- **PC0001**: A computer running Windows 10 Enterprise x64, fully patched with the latest security updates, and configured as a member in the contoso.com domain.
- Client name: PC0001
- IP Address: DHCP
-- **PC0002**: A computer running Windows 10 Enterprise x64, fully patched with the latest security updates, and configured as a member in the contoso.com domain. This computer is referenced during the migration scenarios.
+- **PC0002**: A computer running Windows 7 SP1 Enterprise x64, fully patched with the latest security updates, and configured as a member in the contoso.com domain. This computer is referenced during the migration scenarios.
- Client name: PC0002
- IP Address: DHCP
-- **PC0003 - PC0007**: These are other client computers similar to PC0001 and PC0002 that are used in this guide and another guide for various scenarios. The device names are incremented for clarity within each scenario. For example, PC0003 and PC0004 are running Windows 10 just like PC0002, but are used for Configuration Manager refresh and replace scenarios, respectively.
+- **PC0003 - PC0007**: These are other client computers similar to PC0001 and PC0002 that are used in this guide and another guide for various scenarios. The device names are incremented for clarity within each scenario. For example, PC0003 and PC0004 are running Windows 7 just like PC0002, but are used for Configuration Manager refresh and replace scenarios, respectively.
-#### Storage requirements
+### Storage requirements
MDT01 and HV01 should have the ability to store up to 200 GB of files on a data drive (D:). If you use a computer with a single system partition (C:), you will need to adjust some procedures in this guide to specify the C: drive instead of the D: drive.
-#### Hyper-V requirements
+### Hyper-V requirements
-If you do not have access to a Hyper-V server, you can install Hyper-V on a Windows 8.1, Windows 10, or Windows 11 computer temporarily to use for building reference images. For instructions on how to enable Hyper-V on Windows 10, see the [Verify support and install Hyper-V](../windows-10-poc.md#verify-support-and-install-hyper-v) section in the Windows 10 deployment test lab guide. This guide is a proof-of-concept guide that has detailed instructions for installing Hyper-V.
+If you do not have access to a Hyper-V server, you can install Hyper-V on a Windows 10 or Windows 8.1 computer temporarily to use for building reference images. For instructions on how to enable Hyper-V on Windows 10, see the [Verify support and install Hyper-V](../windows-10-poc.md#verify-support-and-install-hyper-v) section in the Windows 10 deployment test lab guide. This guide is a proof-of-concept guide that has detailed instructions for installing Hyper-V.
-#### Network requirements
+### Network requirements
All server and client computers referenced in this guide are on the same subnet. This is not required, but each server and client computer must be able to connect to each other to share files, and to resolve all DNS names and Active Directory information for the contoso.com domain. Internet connectivity is also required to download OS and application updates.
-#### Domain credentials
+### Domain credentials
The following generic credentials are used in this guide. You should replace these credentials as they appear in each procedure with your credentials.
@@ -88,7 +71,7 @@ The following generic credentials are used in this guide. You should replace the
**Domain administrator username**: administrator
**Domain administrator password**: pass@word1
-#### Organizational unit structure
+### Organizational unit structure
The following OU structure is used in this guide. Instructions are provided [below](#create-the-ou-structure) to help you create the required OUs.
@@ -101,8 +84,11 @@ These steps assume that you have the MDT01 member server running and configured
On **MDT01**:
Visit the [Download and install the Windows ADK](/windows-hardware/get-started/adk-install) page and download the following items to the **D:\\Downloads\\ADK** folder on MDT01 (you will need to create this folder):
-- [The Windows ADK](https://go.microsoft.com/fwlink/?linkid=2165884)
-- [The Windows PE add-on for the ADK](https://go.microsoft.com/fwlink/?linkid=2166133)
+- [The Windows ADK for Windows 10](https://go.microsoft.com/fwlink/?linkid=2086042)
+- [The Windows PE add-on for the ADK](https://go.microsoft.com/fwlink/?linkid=2087112)
+- [The Windows System Image Manager (WSIM) 1903 update](https://go.microsoft.com/fwlink/?linkid=2095334)
+- (Optional) [The MDT_KB4564442 patch for BIOS firmware](https://download.microsoft.com/download/3/0/6/306AC1B2-59BE-43B8-8C65-E141EF287A5E/KB4564442/MDT_KB4564442.exe)
+ - This patch is needed to resolve a bug that causes detection of BIOS-based machines as UEFI-based machines. If you have a UEFI deployment, you do not need this patch.
>[!TIP]
>You might need to temporarily disable IE Enhanced Security Configuration for administrators in order to download files from the Internet to the server. This setting can be disabled by using Server Manager (Local Server/Properties).
@@ -110,9 +96,12 @@ Visit the [Download and install the Windows ADK](/windows-hardware/get-started/a
1. On **MDT01**, ensure that you are signed in as an administrator in the CONTOSO domain.
- For the purposes of this guide, we are using a Domain Admin account of **administrator** with a password of pass@word1. You can use your own administrator username and password as long as you properly adjust all steps in this guide that use these login credentials.
2. Start the **ADK Setup** (D:\\Downloads\\ADK\\adksetup.exe), click **Next** twice to accept the default installation parameters, click **Accept** to accept the license agreement, and then on the **Select the features you want to install** page accept the default list of features by clicking **Install**. This will install deployment tools and the USMT. Verify that the installation completes successfully before moving to the next step.
-3. Start the **WinPE Setup** (D:\\Downloads\\ADK\\adkwinpesetup.exe), click **Next** twice to accept the default installation parameters, click **Accept** to accept the license agreement, and then on the **Select the features you want to install** page click **Install**. This will install Windows PE for x86, AMD64, ARM, and ARM64. Verify that the installation completes successfully.
+3. Start the **WinPE Setup** (D:\\Downloads\\ADK\\adkwinpesetup.exe), click **Next** twice to accept the default installation parameters, click **Accept** to accept the license agreement, and then on the **Select the features you want to install** page click **Install**. This will install Windows PE for x86, AMD64, ARM, and ARM64. Verify that the installation completes successfully before moving to the next step.
+4. Extract the **WSIM 1903 update** (D:\\Downloads\ADK\\WSIM1903.zip) and then run the **UpdateWSIM.bat** file.
+ - You can confirm that the update is applied by viewing properties of the ImageCat.exe and ImgMgr.exe files at **C:\\Program Files (x86)\\Windows Kits\\10\\Assessment and Deployment Kit\\Deployment Tools\\WSIM** and verifying that the **Details** tab displays a **File version** of **10.0.18362.144** or later.
+5. If you downloaded the optional MDT_KB4564442 patch for BIOS based deployment, see [this support article](https://support.microsoft.com/en-us/topic/windows-10-deployments-fail-with-microsoft-deployment-toolkit-on-computers-with-bios-type-firmware-70557b0b-6be3-81d2-556f-b313e29e2cb7) for instructions on how to install the patch.
-## Install and initialize WDS
+## Install and initialize Windows Deployment Services (WDS)
On **MDT01**:
@@ -141,7 +130,7 @@ To install WSUS on MDT01, enter the following at an elevated Windows PowerShell
>[!NOTE]
>MDT installation requires the following:
->- The Windows ADK (installed in the previous procedure)
+>- The Windows ADK for Windows 10 (installed in the previous procedure)
>- Windows PowerShell ([version 5.1](https://www.microsoft.com/download/details.aspx?id=54616) is recommended; type **$host** to check)
>- Microsoft .NET Framework
@@ -149,10 +138,8 @@ On **MDT01**:
1. Visit the [MDT resource page](/mem/configmgr/mdt/) and click **Download MDT**.
2. Save the **MicrosoftDeploymentToolkit_x64.msi** file to the D:\\Downloads\\MDT folder on MDT01.
-3. Save the [MDT update](https://support.microsoft.com/topic/windows-10-deployments-fail-with-microsoft-deployment-toolkit-on-computers-with-bios-type-firmware-70557b0b-6be3-81d2-556f-b313e29e2cb7) to D:\\Downloads\\MDT folder on MDT01.
- **Note**: As of the publishing date for this guide, the current version of MDT is 8456 (6.3.8456.1000), but a later version will also work.
-4. Install **MDT** (D:\\Downloads\\MDT\\MicrosoftDeploymentToolkit_x64.exe) with the default settings.
-5. If you are using MDT version 8456, download, extract, and update MDT per the instructions on [Windows 10 deployments fail with Microsoft Deployment Toolkit on computers with BIOS type firmware](https://support.microsoft.com/topic/windows-10-deployments-fail-with-microsoft-deployment-toolkit-on-computers-with-bios-type-firmware-70557b0b-6be3-81d2-556f-b313e29e2cb7). This will update **Microsoft.BDD.Utility.dll** from version 6.3.8456.1000 to 6.3.8456.1001.
+3. Install **MDT** (D:\\Downloads\\MDT\\MicrosoftDeploymentToolkit_x64.exe) with the default settings.
## Create the OU structure
@@ -231,8 +218,6 @@ If you have the Active Directory Users and Computers console open you can refres
## Create and share the logs folder
-Switch back to the MDT01 computer.
-
By default MDT stores the log files locally on the client. In order to capture a reference image, you will need to enable server-side logging and, to do that, you will need to have a folder in which to store the logs. For more information, see [Create a Windows 10 reference image](create-a-windows-10-reference-image.md).
On **MDT01**:
@@ -265,5 +250,13 @@ After installing the ConfigMgrTools.msi file, you can search for **cmtrace** and
## Next steps
-When you have completed all the steps in this section to prepare for deployment, see [Create a Windows 11 reference image](create-a-windows-11-reference-image.md).
+When you have completed all the steps in this section to prepare for deployment, see [Create a Windows 10 reference image](create-a-windows-10-reference-image.md).
+## Appendix
+
+**Sample files**
+
+The following sample files are also available to help automate some MDT deployment tasks. This guide does not use these files, but they are made available here so you can see how some tasks can be automated with Windows PowerShell.
+- [Gather.ps1](/samples/browse/?redirectedfrom=TechNet-Gallery). This sample Windows PowerShell script performs the MDT Gather process in a simulated MDT environment. This allows you to test the MDT gather process and check to see if it is working correctly without performing a full Windows deployment.
+- [Set-OUPermissions.ps1](https://go.microsoft.com/fwlink/p/?LinkId=619362). This sample Windows PowerShell script creates a domain account and then configures OU permissions to allow the account to join machines to the domain in the specified OU.
+- [MDTSample.zip](https://go.microsoft.com/fwlink/p/?LinkId=619363). This sample web service shows you how to configure a computer name dynamically using MDT.
diff --git a/windows/deployment/deploy-windows-mdt/refresh-a-windows-10-computer-with-windows-11.md b/windows/deployment/deploy-windows-mdt/refresh-a-windows-7-computer-with-windows-10.md
similarity index 53%
rename from windows/deployment/deploy-windows-mdt/refresh-a-windows-10-computer-with-windows-11.md
rename to windows/deployment/deploy-windows-mdt/refresh-a-windows-7-computer-with-windows-10.md
index 1ec5026bb1..57a26f04a9 100644
--- a/windows/deployment/deploy-windows-mdt/refresh-a-windows-10-computer-with-windows-11.md
+++ b/windows/deployment/deploy-windows-mdt/refresh-a-windows-7-computer-with-windows-10.md
@@ -1,6 +1,6 @@
---
-title: Refresh a Windows 10 computer with Windows 11 (Windows 11)
-description: This topic will show you how to use MDT Lite Touch Installation (LTI) to upgrade a Windows 10 computer to a Windows 11 computer using the computer refresh process.
+title: Refresh a Windows 7 computer with Windows 10 (Windows 10)
+description: This topic will show you how to use MDT Lite Touch Installation (LTI) to upgrade a Windows 7 computer to a Windows 10 computer using the computer refresh process.
ms.assetid: 2866fb3c-4909-4c25-b083-6fc1f7869f6f
ms.reviewer:
manager: dougeby
@@ -16,18 +16,17 @@ author: greg-lindsay
ms.topic: article
---
-# Refresh a Windows 10 computer with Windows 11
+# Refresh a Windows 7 computer with Windows 10
**Applies to**
-- Windows 10
-- Windows 11
+- Windows 10
-This topic will show you how to use MDT Lite Touch Installation (LTI) to upgrade a Windows 10 computer to a Windows 11 computer using the online computer refresh process. The computer refresh scenario is a reinstallation of an updated operating system on the same computer. You can also use this procedure to reinstall the same OS version. In this article, the computer refresh will be done while the computer is online. MDT also supports an offline computer refresh. For more info on that scenario, see the USMTOfflineMigration property on the [MDT resource page](/mem/configmgr/mdt/).
+This topic will show you how to use MDT Lite Touch Installation (LTI) to upgrade a Windows 7 computer to a Windows 10 computer using the online computer refresh process. The computer refresh scenario is a reinstallation of an updated operating system on the same computer. You can also use this procedure to reinstall the same OS version. In this article, the computer refresh will be done while the computer is online. MDT also supports an offline computer refresh. For more info on that scenario, see the USMTOfflineMigration property on the [MDT resource page](/mem/configmgr/mdt/).
For the purposes of this topic, we will use three computers: DC01, MDT01, and PC0001.
- DC01 is a domain controller for the contoso.com domain.
- MDT01 is domain member server that hosts your deployment share.
-- PC0001 is a domain member computer running a previous version of Windows that is going to be refreshed to Windows 11, with data and settings restored. The example used here is a computer running Windows 10, version 1909.
+- PC0001 is a domain member computer running a previous version of Windows that is going to be refreshed to a new version of Windows 10, with data and settings restored. The example used here is a computer running Windows 7 SP1.
Both DC01 and MDT01 are running Windows Server 2019; however any supported version of Windows Server can be used. For more details on the setup for this topic, please see [Prepare for deployment with MDT](prepare-for-windows-deployment-with-mdt.md).
@@ -39,7 +38,7 @@ The computers used in this topic.
A computer refresh is not the same as an in-place upgrade because a computer refresh involves exporting user data and settings then wiping the device before installing a fresh OS and restoring the user's data and settings.
-For a computer refresh with MDT, you use the User State Migration Tool (USMT), which is part of the Windows Assessment and Deployment Kit (ADK), to migrate user data and settings. To complete a computer refresh you will:
+For a computer refresh with MDT, you use the User State Migration Tool (USMT), which is part of the Windows Assessment and Deployment Kit (ADK) for Windows 10, to migrate user data and settings. To complete a computer refresh you will:
1. Back up data and settings locally, in a backup folder.
2. Wipe the partition, except for the backup folder.
@@ -49,8 +48,8 @@ For a computer refresh with MDT, you use the User State Migration Tool (USMT), w
During the computer refresh, USMT uses a feature called Hard-Link Migration Store. When you use this feature, the files are simply linked in the file system, which allows for fast migration, even when there is a lot of data.
-> [!NOTE]
-> In addition to the USMT backup, you can enable an optional full Windows Imaging (WIM) backup of the machine by configuring the MDT rules. If you do this, a .wim file is created in addition to the USMT backup. The .wim file contains the entire volume from the computer and helpdesk personnel can extract content from it if needed. Please note that this is a data WIM backup only. Using this backup to restore the entire computer is not a supported scenario.
+>[!NOTE]
+>In addition to the USMT backup, you can enable an optional full Windows Imaging (WIM) backup of the machine by configuring the MDT rules. If you do this, a .wim file is created in addition to the USMT backup. The .wim file contains the entire volume from the computer and helpdesk personnel can extract content from it if needed. Please note that this is a data WIM backup only. Using this backup to restore the entire computer is not a supported scenario.
### Multi-user migration
@@ -58,8 +57,8 @@ By default, ScanState in USMT backs up all profiles on the machine, including lo
For example, the following line configures USMT to migrate only domain user profiles and not profiles from the local SAM account database: ScanStateArgs=/ue:\*\\\* /ui:CONTOSO\\\*
-> [!NOTE]
-> You also can combine the preceding switches with the /uel switch, which excludes profiles that have not been accessed within a specific number of days. For example, adding /uel:60 will configure ScanState (or LoadState) not to include profiles that haven't been accessed for more than 60 days.
+>[!NOTE]
+>You also can combine the preceding switches with the /uel switch, which excludes profiles that have not been accessed within a specific number of days. For example, adding /uel:60 will configure ScanState (or LoadState) not to include profiles that haven't been accessed for more than 60 days.
### Support for additional settings
@@ -69,32 +68,29 @@ In addition to the command-line switches that control which profiles to migrate,
Multicast is a technology designed to optimize simultaneous deployment to multiple devices. If you have a limited number of simultaneous deployments, you should disable multicast which was [configured in a previous procedure](deploy-a-windows-10-image-using-mdt.md#set-up-mdt-for-multicast) in this guide. Disabling multicast will speed up deployment for a small number of computers. You will need to update the deployment share after changing this setting.
-## Refresh a Windows 10 client
+## Refresh a Windows 7 SP1 client
In these section, we assume that you have already performed the prerequisite procedures in the following topics, so that you have a deployment share named **MDTProduction$** on MDT01:
- [Prepare for deployment with MDT](prepare-for-windows-deployment-with-mdt.md)
-- [Create a Windows 11 reference image](create-a-windows-11-reference-image.md)
-- [Deploy a Windows 11 image using MDT](deploy-a-windows-11-image-using-mdt.md)
+- [Create a Windows 10 reference image](create-a-windows-10-reference-image.md)
+- [Deploy a Windows 10 image using MDT](deploy-a-windows-10-image-using-mdt.md)
-It is also assumed that you have a domain member client computer named PC0001 in your environment running Windows 7, 8.1 or 10 that is ready for a refresh to Windows 11. For demonstration purposes, we will refreshing a Windows 10 PC to Windows 11.
-
-> [!IMPORTANT]
-> The computer refresh process can be used to install Windows 11 on a device that doesn't meet Windows 11 hardware requirements, resulting in an unsupported configuration. Before upgrading to Windows 11, verify that the device meets [Windows 11 hardware requirements](/windows/whats-new/windows-11-requirements).
+It is also assumed that you have a domain member client computer named PC0001 in your environment running Windows 7, 8.1 or 10 that is ready for a refresh to the latest version of Windows 10. For demonstration purposes, we will refreshing a Windows 7 SP1 PC to Windows 10, version 1909.
-### Upgrade (refresh) a Windows 10 client
+### Upgrade (refresh) a Windows 7 SP1 client
-> [!IMPORTANT]
-> Domain join details [specified in the deployment share rules](deploy-a-windows-11-image-using-mdt.md#configure-the-rules) will be used to rejoin the computer to the domain during the refresh process. If the Windows 10 client is domain-jonied in a different OU than the one specified by MachineObjectOU, the domain join process will initially fail and then retry without specifying an OU. If the domain account that is specified (ex: **MDT_JD**) has [permissions limited to a specific OU](deploy-a-windows-11-image-using-mdt.md#step-1-configure-active-directory-permissions) then the domain join will ultimately fail, the refresh process will proceed, and the client computer object will be orphaned in Active Directory. In the current guide, computer objects should be located in Contoso > Computers > Workstations. Use the Active Directory Users and Computers console to review the location of computer objects and move them if needed. To diagnose MDT domain join errors, see **ZTIDomainJoin.log** in the C:\Windows\Temp\DeploymentLogs directory on the client computer.
+>[!IMPORTANT]
+>Domain join details [specified in the deployment share rules](deploy-a-windows-10-image-using-mdt.md#configure-the-rules) will be used to rejoin the computer to the domain during the refresh process. If the Windows 7 client is domain-jonied in a different OU than the one specified by MachineObjectOU, the domain join process will initially fail and then retry without specifying an OU. If the domain account that is specified (ex: **MDT_JD**) has [permissions limited to a specific OU](deploy-a-windows-10-image-using-mdt.md#step-1-configure-active-directory-permissions) then the domain join will ultimately fail, the refresh process will proceed, and the client computer object will be orphaned in Active Directory. In the current guide, computer objects should be located in Contoso > Computers > Workstations. Use the Active Directory Users and Computers console to review the location of computer objects and move them if needed. To diagnose MDT domain join errors, see **ZTIDomainJoin.log** in the C:\Windows\Temp\DeploymentLogs directory on the client computer.
1. On PC0001, sign in as **contoso\\Administrator** and start the Lite Touch Deploy Wizard by opening **\\\\MDT01\\MDTProduction$\\Scripts\\Litetouch.vbs**.
2. Complete the deployment guide using the following settings:
- * Select a task sequence to execute on this computer: Windows 11 Enterprise x64 Custom Image
+ * Select a task sequence to execute on this computer: Windows 10 Enterprise x64 RTM Custom Image
* Computer name: <default>
* Specify where to save a complete computer backup: Do not back up the existing computer
- > [!NOTE]
- > Skip this optional full WIM backup that we are choosing not to perform. The USMT backup will still run.
+ >[!NOTE]
+ >Skip this optional full WIM backup that we are choosing not to perform. The USMT backup will still run.
* Select one or more applications to install: Install - Adobe Reader
@@ -102,23 +98,23 @@ It is also assumed that you have a domain member client computer named PC0001 in
4. Setup starts and does the following:
* Backs up user settings and data using USMT.
- * Installs the Windows 11 Enterprise x64 operating system.
+ * Installs the Windows 10 Enterprise x64 operating system.
* Installs any added applications.
- * Updates the operating system using your local Windows Server Update Services (WSUS) server (if applicable).
+ * Updates the operating system using your local Windows Server Update Services (WSUS) server.
* Restores user settings and data using USMT.
5. You can monitor progress of the deployment using the deployment workbench on MDT01. See the following example:
-6. After the refresh process completes, sign in to the Windows 11 computer and verify that user accounts, data and settings were migrated.
+6. After the refresh process completes, sign in to the Windows 10 computer and verify that user accounts, data and settings were migrated.
## Related topics
[Get started with the Microsoft Deployment Toolkit (MDT)](get-started-with-the-microsoft-deployment-toolkit.md)
[Prepare for deployment with MDT](prepare-for-windows-deployment-with-mdt.md)
-[Create a Windows 11 reference image](create-a-windows-11-reference-image.md)
-[Deploy a Windows 11 image using MDT](deploy-a-windows-11-image-using-mdt.md)
-[Build a distributed environment for Windows 11 deployment](build-a-distributed-environment-for-windows-deployment.md)
-[Replace a Windows 10 computer with a Windows 11 computer](replace-a-windows-10-computer-with-a-windows-11-computer.md)
+[Create a Windows 10 reference image](create-a-windows-10-reference-image.md)
+[Deploy a Windows 10 image using MDT](deploy-a-windows-10-image-using-mdt.md)
+[Build a distributed environment for Windows 10 deployment](build-a-distributed-environment-for-windows-10-deployment.md)
+[Replace a Windows 7 computer with a Windows 10 computer](replace-a-windows-7-computer-with-a-windows-10-computer.md)
[Configure MDT settings](configure-mdt-settings.md)
\ No newline at end of file
diff --git a/windows/deployment/deploy-windows-mdt/replace-a-windows-10-computer-with-a-windows-11-computer.md b/windows/deployment/deploy-windows-mdt/replace-a-windows-7-computer-with-a-windows-10-computer.md
similarity index 85%
rename from windows/deployment/deploy-windows-mdt/replace-a-windows-10-computer-with-a-windows-11-computer.md
rename to windows/deployment/deploy-windows-mdt/replace-a-windows-7-computer-with-a-windows-10-computer.md
index 951872540b..baa35a0260 100644
--- a/windows/deployment/deploy-windows-mdt/replace-a-windows-10-computer-with-a-windows-11-computer.md
+++ b/windows/deployment/deploy-windows-mdt/replace-a-windows-7-computer-with-a-windows-10-computer.md
@@ -1,13 +1,13 @@
---
-title: Replace a Windows 10 computer with a Windows 11 computer (Windows 11)
-description: In this article, you will learn how to replace a Windows 10 device with a Windows 11 device.
+title: Replace a Windows 7 computer with a Windows 10 computer (Windows 10)
+description: In this article, you will learn how to replace a Windows 7 device with a Windows 10 device.
ms.custom: seo-marvel-apr2020
ms.assetid: acf091c9-f8f4-4131-9845-625691c09a2a
ms.reviewer:
manager: dougeby
ms.author: greglin
keywords: deploy, deployment, replace
-ms.prod: w11
+ms.prod: w10
ms.mktglfcycl: deploy
ms.localizationpriority: medium
ms.sitesec: library
@@ -17,19 +17,18 @@ author: greg-lindsay
ms.topic: article
---
-# Replace a Windows 10 computer with a Windows 11 computer
+# Replace a Windows 7 computer with a Windows 10 computer
**Applies to**
-- Windows 10
-- Windows 11
+- Windows 10
-A computer replace scenario for Windows 11 is quite similar to a computer refresh for Windows 11. However, because you are replacing a device, you cannot store the backup on the old computer. Instead you need to store the backup to a location where the new computer can read it. The User State Migration Tool (USMT) will be used to back up and restore data and settings.
+A computer replace scenario for Windows 10 is quite similar to a computer refresh for Windows 10. However, because you are replacing a device, you cannot store the backup on the old computer. Instead you need to store the backup to a location where the new computer can read it. The User State Migration Tool (USMT) will be used to back up and restore data and settings.
For the purposes of this topic, we will use four computers: DC01, MDT01, PC0002, and PC0007.
- DC01 is a domain controller for the contoso.com domain.
- MDT01 is domain member server that hosts your deployment share.
-- PC0002 is an old computer running Windows 10 that will be replaced by PC0007.
-- PC0007 is a new computer will have the Windows 11 OS installed prior to data from PC0002 being migrated. Both PC0002 and PC0007 are members of the contoso.com domain.
+- PC0002 is an old computer running Windows 7 SP1 that will be replaced by PC0007.
+- PC0007 is a new computer will have the Windows 10 OS installed prior to data from PC0002 being migrated. Both PC0002 and PC0007 are members of the contoso.com domain.
For more details on the setup for this topic, please see [Prepare for deployment with MDT](prepare-for-windows-deployment-with-mdt.md).
@@ -49,7 +48,7 @@ On **MDT01**:
1. Open the Deployment Workbench, under **Deployment Shares** right-click **MDT Production**, click **Properties**, and then click the **Rules** tab.
2. Change the **SkipUserData=YES** option to **NO**, and click **OK**.
-3. Right-click **MDT Production** and click **Update Deployment Share**. Click **Next**, **Next**, and **Finish** to complete the Update Deployment Share Wizard with the default setttings.
+3. Right-click **MDT Production** and click **Update Deployment Share**. Click **Next**, **Next**, and **Finish** to complete the Update Deployment Share Wizard with the default settings.
### Create and share the MigData folder
@@ -82,7 +81,7 @@ On **MDT01**:
During a computer replace, these are the high-level steps that occur:
-1. On the computer you are replacing, a special replace task sequence runs the USMT backup and, if you configured it, runs the optional full Window Imaging (WIM) backup.
+1. On the computer you are replacing, a special replace task sequence runs the USMT backup and, if you configured it, runs the optional full Windows Imaging (WIM) backup.
2. On the new computer, you perform a standard bare-metal deployment. At the end of the bare-metal deployment, the USMT backup from the old computer is restored.
### Run the replace task sequence
@@ -97,8 +96,8 @@ On **PC0002**:
* Specify where to save your data and settings: Specify a location
* Location: \\\\MDT01\\MigData$\\PC0002
- > [!NOTE]
- > If you are replacing the computer at a remote site you should create the MigData folder on MDT02 and use that share instead.
+ >[!NOTE]
+ >If you are replacing the computer at a remote site you should create the MigData folder on MDT02 and use that share instead.
2. Specify where to save a complete computer backup: Do not back up the existing computer
@@ -152,16 +151,15 @@ On **HV01**:
* Updates the operating system via your local Windows Server Update Services (WSUS) server.
* Restores the USMT backup from PC0002.
-You can view progress of the process by clicking the Monitoring node in the Deployment Workbrench on MDT01.
+You can view progress of the process by clicking the Monitoring node in the Deployment Workbench on MDT01.
-
## Related topics
[Get started with the Microsoft Deployment Toolkit (MDT)](get-started-with-the-microsoft-deployment-toolkit.md)
-[Create a Windows 11 reference image](create-a-windows-11-reference-image.md)
-[Deploy a Windows 11 image using MDT](deploy-a-windows-11-image-using-mdt.md)
-[Build a distributed environment for Windows 11 deployment](build-a-distributed-environment-for-windows-deployment.md)
-[Refresh a Windows 10 computer with Windows 11](refresh-a-windows-10-computer-with-windows-11.md)
+[Create a Windows 10 reference image](create-a-windows-10-reference-image.md)
+[Deploy a Windows 10 image using MDT](deploy-a-windows-10-image-using-mdt.md)
+[Build a distributed environment for Windows 10 deployment](build-a-distributed-environment-for-windows-10-deployment.md)
+[Refresh a Windows 7 computer with Windows 10](refresh-a-windows-7-computer-with-windows-10.md)
[Configure MDT settings](configure-mdt-settings.md)
diff --git a/windows/deployment/deploy-windows-mdt/set-up-mdt-for-bitlocker.md b/windows/deployment/deploy-windows-mdt/set-up-mdt-for-bitlocker.md
index 481df59b4a..64938b8f63 100644
--- a/windows/deployment/deploy-windows-mdt/set-up-mdt-for-bitlocker.md
+++ b/windows/deployment/deploy-windows-mdt/set-up-mdt-for-bitlocker.md
@@ -19,10 +19,6 @@ ms.custom: seo-marvel-mar2020
# Set up MDT for BitLocker
-**Applies to**
-- Windows 10
-- Windows 11
-
This topic will show you how to configure your environment for BitLocker, the disk volume encryption built into Windows 10 Enterprise and Windows 10 Pro, using MDT. BitLocker in Windows 10 has two requirements in regard to an operating system deployment:
- A protector, which can either be stored in the Trusted Platform Module (TPM) chip, or stored as a password. Technically, you can also use a USB stick to store the protector, but it's not a practical approach as the USB stick can be lost or stolen. We, therefore, recommend that you instead use a TPM chip and/or a password.
diff --git a/windows/deployment/deploy-windows-mdt/simulate-a-windows-11-deployment-in-a-test-environment.md b/windows/deployment/deploy-windows-mdt/simulate-a-windows-10-deployment-in-a-test-environment.md
similarity index 76%
rename from windows/deployment/deploy-windows-mdt/simulate-a-windows-11-deployment-in-a-test-environment.md
rename to windows/deployment/deploy-windows-mdt/simulate-a-windows-10-deployment-in-a-test-environment.md
index 877add3082..d538a02412 100644
--- a/windows/deployment/deploy-windows-mdt/simulate-a-windows-11-deployment-in-a-test-environment.md
+++ b/windows/deployment/deploy-windows-mdt/simulate-a-windows-10-deployment-in-a-test-environment.md
@@ -1,12 +1,12 @@
---
-title: Simulate a Windows 11 deployment in a test environment (Windows 11)
-description: This topic will walk you through the process of creating a simulated environment on which to test your Windows 11 deployment using MDT.
+title: Simulate a Windows 10 deployment in a test environment (Windows 10)
+description: This topic will walk you through the process of creating a simulated environment on which to test your Windows 10 deployment using MDT.
ms.assetid: 2de86c55-ced9-4078-b280-35e0329aea9c
ms.reviewer:
manager: dougeby
ms.author: greglin
keywords: deploy, script
-ms.prod: w11
+ms.prod: w10
ms.mktglfcycl: deploy
ms.localizationpriority: medium
ms.sitesec: library
@@ -16,11 +16,7 @@ author: greg-lindsay
ms.topic: article
---
-# Simulate a Windows 11 deployment in a test environment
-
-**Applies to**
-- Windows 10
-- Windows 11
+# Simulate a Windows 10 deployment in a test environment
This topic will walk you through the process of creating a simulated environment on which to test your Windows 10 deployment using MDT. When working with advanced settings and rules, especially those like database calls, it is most efficient to be able to test the settings without having to run through a complete deployment. Luckily, MDT enables you to perform a simulated deployment by running the Gather process by itself. The simulation works best when you are using a domain-joined client.
@@ -29,8 +25,8 @@ This topic will walk you through the process of creating a simulated environment
- A Windows 10 client named **PC0001** will be used to simulate deployment. The client is joined to the contoso.com domain and has access to the Internet to required download tools and scripts.
- It is assumed that you have performed (at least) the following procedures so that you have an MDT service account and an MDT production deployment share:
- [Prepare for deployment with MDT](prepare-for-windows-deployment-with-mdt.md)
- - [Create a Windows 11 reference image](create-a-windows-11-reference-image.md)
- - [Deploy a Windows 11 image using MDT](deploy-a-windows-11-image-using-mdt.md)
+ - [Create a Windows 10 reference image](create-a-windows-10-reference-image.md)
+ - [Deploy a Windows 10 image using MDT](deploy-a-windows-10-image-using-mdt.md)
## Simulate deployment
@@ -39,23 +35,21 @@ On **PC0001**:
1. Sign as **contoso\\Administrator**.
2. Copy the following to a PowerShell script named gather.ps1 and copy it to a directory named **C:\MDT** on PC0001.
-```
-# Check for elevation
-If (-NOT ([Security.Principal.WindowsPrincipal] [Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole(`
- [Security.Principal.WindowsBuiltInRole] "Administrator"))
-{
- Write-Warning "Oupps, you need to run this script from an elevated PowerShell prompt!`nPlease start the PowerShell prompt as an Administrator and re-run the script."
- Write-Warning "Aborting script..."
- Break
-}
-
-cls
-if (Test-Path -Path "C:\MININT") {Write-Host "C:\MININT exists, deleting...";Remove-Item C:\MININT -Recurse}
-cscript.exe ZTIGather.wsf /debug:true
-
-# Optional, comment out if you want the script to open the log in CMTrace
-& "C:\MDT\CMTrace" C:\MININT\SMSOSD\OSDLOGS\ZTIGather.log
-```
+ ```powershell
+ # Check for elevation
+ If (-NOT ([Security.Principal.WindowsPrincipal] [Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole(`
+ [Security.Principal.WindowsBuiltInRole] "Administrator"))
+ {
+ Write-Warning "Oupps, you need to run this script from an elevated PowerShell prompt!`nPlease start the PowerShell prompt as an Administrator and re-run the script."
+ Write-Warning "Aborting script..."
+ Break
+ }
+ cls
+ if (Test-Path -Path "C:\MININT") {Write-Host "C:\MININT exists, deleting...";Remove-Item C:\MININT -Recurse}
+ cscript.exe ZTIGather.wsf /debug:true
+ # Optional, comment out if you want the script to open the log in CMTrace
+ & "C:\MDT\CMTrace" C:\MININT\SMSOSD\OSDLOGS\ZTIGather.log
+ ```
3. Download and install the free [Microsoft System Center 2012 R2 Configuration Manager Toolkit](https://go.microsoft.com/fwlink/p/?LinkId=734717) on PC0001 so that you have access to the Configuration Manager Trace (cmtrace.exe) tool.
4. Using Local Users and Groups (lusrmgr.msc), add the **contoso\\MDT\_BA** user account to the local **Administrators** group.
diff --git a/windows/deployment/deploy-windows-mdt/upgrade-to-windows-10-with-the-microsoft-deployment-toolkit.md b/windows/deployment/deploy-windows-mdt/upgrade-to-windows-10-with-the-microsoft-deployment-toolkit.md
new file mode 100644
index 0000000000..8760205a12
--- /dev/null
+++ b/windows/deployment/deploy-windows-mdt/upgrade-to-windows-10-with-the-microsoft-deployment-toolkit.md
@@ -0,0 +1,114 @@
+---
+title: Perform an in-place upgrade to Windows 10 with MDT (Windows 10)
+description: The simplest path to upgrade PCs that are currently running Windows 7, Windows 8, or Windows 8.1 to Windows 10 is through an in-place upgrade.
+ms.assetid: B8993151-3C1E-4F22-93F4-2C5F2771A460
+ms.reviewer:
+manager: dougeby
+ms.author: greglin
+keywords: upgrade, update, task sequence, deploy
+ms.prod: w10
+ms.mktglfcycl: deploy
+ms.localizationpriority: medium
+ms.sitesec: library
+ms.pagetype: mdt
+audience: itpro
+author: greg-lindsay
+ms.topic: article
+---
+
+# Perform an in-place upgrade to Windows 10 with MDT
+
+**Applies to**
+- Windows 10
+
+The simplest path to upgrade PCs that are currently running Windows 7, Windows 8, or Windows 8.1 to Windows 10 is through an in-place upgrade.
+
+>[!TIP]
+>In-place upgrade is the preferred method to use when migrating from Windows 10 to a later release of Windows 10, and is also a preferred method for upgrading from Windows 7 or 8.1 if you do not plan to significantly change the device's configuration or applications. MDT includes an in-place upgrade task sequence template that makes the process really simple.
+
+In-place upgrade differs from [computer refresh](refresh-a-windows-7-computer-with-windows-10.md) in that you cannot use a custom image to perform the in-place upgrade. In this article we will add a default Windows 10 image to the production deployment share specifically to perform an in-place upgrade.
+
+Three computers are used in this topic: DC01, MDT01, and PC0002.
+
+- DC01 is a domain controller for the contoso.com domain
+- MDT01 is a domain member server
+- PC0002 is a domain member computer running Windows 7 SP1, targeted for the Windows 10 upgrade
+
+ 
+
+ The computers used in this topic.
+
+>[!NOTE]
+>For details about the setup for the procedures in this article, please see [Prepare for deployment with MDT](prepare-for-windows-deployment-with-mdt.md).
+
+>If you have already completed all the steps in [Deploy a Windows 10 image using MDT](deploy-a-windows-10-image-using-mdt.md), then you already have a production deployment share and you can skip to [Add Windows 10 Enterprise x64 (full source)](#add-windows-10-enterprise-x64-full-source).
+
+## Create the MDT production deployment share
+
+On **MDT01**:
+
+1. Ensure you are signed on as: contoso\administrator.
+2. In the Deployment Workbench console, right-click **Deployment Shares** and select **New Deployment Share**.
+3. On the **Path** page, in the **Deployment share path** text box, type **D:\\MDTProduction** and click **Next**.
+4. On the **Share** page, in the **Share name** text box, type **MDTProduction$** and click **Next**.
+5. On the **Descriptive Name** page, in the **Deployment share description** text box, type **MDT Production** and click **Next**.
+6. On the **Options** page, accept the default settings and click **Next** twice, and then click **Finish**.
+7. Using File Explorer, verify that you can access the **\\\\MDT01\\MDTProduction$** share.
+
+## Add Windows 10 Enterprise x64 (full source)
+
+>If you have already have a Windows 10 [reference image](create-a-windows-10-reference-image.md) in the **MDT Build Lab** deployment share, you can use the deployment workbench to copy and paste this image from the MDT Build Lab share to the MDT Production share and skip the steps in this section.
+
+On **MDT01**:
+
+1. Sign in as contoso\\administrator and copy the content of a Windows 10 Enterprise x64 DVD/ISO to the **D:\\Downloads\\Windows 10 Enterprise x64** folder on MDT01, or just insert the DVD or mount an ISO on MDT01.
+2. Using the Deployment Workbench, expand the **Deployment Shares** node, and then expand **MDT Production**.
+3. Right-click the **Operating Systems** node, and create a new folder named **Windows 10**.
+4. Expand the **Operating Systems** node, right-click the **Windows 10** folder, and select **Import Operating System**. Use the following settings for the Import Operating System Wizard:
+ - Full set of source files
+ - Source directory: (location of your source files)
+ - Destination directory name: W10EX64RTM
+5. After adding the operating system, in the **Operating Systems / Windows 10** folder, double-click it and change the name to: **Windows 10 Enterprise x64 RTM Default Image**.
+
+## Create a task sequence to upgrade to Windows 10 Enterprise
+
+On **MDT01**:
+
+1. Using the Deployment Workbench, select **Task Sequences** in the **MDT Production** node, and create a folder named **Windows 10**.
+2. Right-click the new **Windows 10** folder and select **New Task Sequence**. Use the following settings for the New Task Sequence Wizard:
+ - Task sequence ID: W10-X64-UPG
+ - Task sequence name: Windows 10 Enterprise x64 RTM Upgrade
+ - Template: Standard Client Upgrade Task Sequence
+ - Select OS: Windows 10 Enterprise x64 RTM Default Image
+ - Specify Product Key: Do not specify a product key at this time
+ - Organization: Contoso
+ - Admin Password: Do not specify an Administrator password at this time
+
+## Perform the Windows 10 upgrade
+
+To initiate the in-place upgrade, perform the following steps on PC0002 (the device to be upgraded).
+
+On **PC0002**:
+
+1. Start the MDT deployment wizard by running the following command: **\\\\MDT01\\MDTProduction$\\Scripts\\LiteTouch.vbs**
+2. Select the **Windows 10 Enterprise x64 RTM Upgrade** task sequence, and then click **Next**.
+3. Select one or more applications to install (will appear if you use custom image): Install - Adobe Reader
+4. On the **Ready** tab, click **Begin** to start the task sequence.
+ When the task sequence begins, it automatically initiates the in-place upgrade process by invoking the Windows setup program (Setup.exe) with the necessary command-line parameters to perform an automated upgrade, which preserves all data, settings, apps, and drivers.
+
+
+
+
+
+
+
+
+
+
+
+After the task sequence completes, the computer will be fully upgraded to Windows 10.
+
+## Related topics
+
+[Windows 10 deployment scenarios](../windows-10-deployment-scenarios.md)
+[Microsoft Deployment Toolkit downloads and resources](/mem/configmgr/mdt/)
\ No newline at end of file
diff --git a/windows/deployment/deploy-windows-mdt/upgrade-to-windows-11-with-the-microsoft-deployment-toolkit.md b/windows/deployment/deploy-windows-mdt/upgrade-to-windows-11-with-the-microsoft-deployment-toolkit.md
deleted file mode 100644
index ccbb15d9c5..0000000000
--- a/windows/deployment/deploy-windows-mdt/upgrade-to-windows-11-with-the-microsoft-deployment-toolkit.md
+++ /dev/null
@@ -1,134 +0,0 @@
----
-title: Perform an in-place upgrade to Windows 11 with MDT (Windows 11)
-description: The simplest path to upgrade PCs that are currently running an earlier version of Windows client to Windows 11 is through an in-place upgrade.
-ms.assetid: B8993151-3C1E-4F22-93F4-2C5F2771A460
-ms.reviewer:
-manager: dougeby
-ms.author: greglin
-keywords: upgrade, update, task sequence, deploy
-ms.prod: w10
-ms.mktglfcycl: deploy
-ms.localizationpriority: medium
-ms.sitesec: library
-ms.pagetype: mdt
-audience: itpro
-author: greg-lindsay
-ms.topic: article
----
-
-# Perform an in-place upgrade to Windows 11 with MDT
-
-**Applies to**
-- Windows 10
-- Windows 11
-
-The simplest path to upgrade PCs that are currently running an earlier version of Windows client to Windows 11 is through an in-place upgrade.
-
-> [!TIP]
-> In-place upgrade is the preferred method to use when migrating to a newer version of the same OS, or upgrading to a new OS. This is especially true when you do not plan to significantly change the device's configuration or applications. MDT includes an in-place upgrade task sequence template that makes the process really simple.
-
-In-place upgrade differs from [computer refresh](refresh-a-windows-10-computer-with-windows-11.md) in that you cannot use a custom image to perform the in-place upgrade. In this article we will add a default Windows 11 image to the production deployment share specifically to perform an in-place upgrade.
-
-> [!IMPORTANT]
-> Windows 11 setup will block the upgrade process on devices that do not meet [Windows 11 hardware requirements](/windows/whats-new/windows-11-requirements). Be sure to verify that your device meets these requirements before attempting to upgrade to Windows 11.
-
-Three computers are used in this topic: DC01, MDT01, and PC0002.
-
-- DC01 is a domain controller for the contoso.com domain
-- MDT01 is a domain member server
-- PC0002 is a domain member computer running Windows 10, targeted for the Windows 11 upgrade
-
- 
-
- The computers used in this topic.
-
-> [!NOTE]
-> For details about the setup for the procedures in this article, please see [Prepare for deployment with MDT](prepare-for-windows-deployment-with-mdt.md).
-
-> If you have already completed all the steps in [Deploy a Windows 11 image using MDT](deploy-a-windows-11-image-using-mdt.md), then you already have a production deployment share and you can skip to [Add Windows 11 Enterprise x64 (full source)](#add-windows-11-enterprise-x64-full-source).
-
-## Create the MDT production deployment share
-
-On **MDT01**:
-
-1. Ensure you are signed on as: contoso\administrator.
-2. In the Deployment Workbench console, right-click **Deployment Shares** and select **New Deployment Share**.
-3. On the **Path** page, in the **Deployment share path** text box, type **D:\\MDTProduction** and click **Next**.
-4. On the **Share** page, in the **Share name** text box, type **MDTProduction$** and click **Next**.
-5. On the **Descriptive Name** page, in the **Deployment share description** text box, type **MDT Production** and click **Next**.
-6. On the **Options** page, accept the default settings and click **Next** twice, and then click **Finish**.
-7. Using File Explorer, verify that you can access the **\\\\MDT01\\MDTProduction$** share.
-
-## Add Windows 11 Enterprise x64 (full source)
-
-> If you have already have a Windows 11 [reference image](create-a-windows-11-reference-image.md) in the **MDT Build Lab** deployment share, you can use the deployment workbench to copy and paste this image from the MDT Build Lab share to the MDT Production share and skip the steps in this section.
-
- 
-
- Copying the reference image to the production deployment share
-
- If you copy the reference image using the above process, you should verify that all the files on MDT01 in **D:\\MDTBuildLab\\Operating Systems\\W11EX64** were successfully copied to **D:\\MDTProduction\\Operating Systems\\W11EX64** and then skip to [Create a task sequence to upgrade to Windows 11 Enterprise](#create-a-task-sequence-to-upgrade-to-windows11-enterprise).
-
-On **MDT01**:
-
-1. Sign in as contoso\\administrator and copy the content of a Windows 11 Enterprise x64 DVD/ISO to the **D:\\Downloads\\Windows 11 Enterprise x64** folder on MDT01, or just insert the DVD or mount an ISO on MDT01.
-2. Using the Deployment Workbench, expand the **Deployment Shares** node, and then expand **MDT Production**.
-3. Right-click the **Operating Systems** node, and create a new folder named **Windows 11**.
-4. Expand the **Operating Systems** node, right-click the **Windows 11** folder, and select **Import Operating System**. Use the following settings for the Import Operating System Wizard:
- - Full set of source files
- - Source directory: (location of your source files)
- - Destination directory name: W11EX64
-5. After adding the operating system, in the **Operating Systems / Windows 11** folder, double-click it and change the name to: **Windows 11 Enterprise x64 Default Image**.
-
-## Create a task sequence to upgrade to Windows 11 Enterprise
-
-On **MDT01**:
-
-1. Using the Deployment Workbench, select **Task Sequences** in the **MDT Production** node, and create a folder named **Windows 11**.
-2. Right-click the new **Windows 11** folder and select **New Task Sequence**. Use the following settings for the New Task Sequence Wizard:
- - Task sequence ID: W11-X64-UPG
- - Task sequence name: Windows 11 Enterprise x64 Upgrade
- - Template: Standard Client Upgrade Task Sequence
- - Select OS: Windows 11 Enterprise x64 Default Image
- - Specify Product Key: Do not specify a product key at this time
- - Organization: Contoso
- - Admin Password: Do not specify an Administrator password at this time
-
-### Specify additional command line options
-
-Before running the upgrade task sequence, an additional step is required if you are upgrading to Windows 11. This step is not necessary if you are upgrading to Windows 10.
-
-The **/EULA accept** command line option is required starting with Windows 11. For more information, see [Windows Setup command-line options](/windows-hardware/manufacture/desktop/windows-setup-command-line-options#eula). To add this command line option:
-
-1. In the Windows 11 Enterprise x64 Upgrade task sequence that you just created, in the Preparation section, click **Add** > **General** > **Set Task Sequence Variable** and provide the following values:
- - Name: WindowsUpgradeAdditionalOptions
- - Task Sequence Variable: WindowsUpgradeAdditionalOptions
- - Value: /EULA accept
-2. Make the Set Task Sequence Variable step the first step in the Preparation phase by moving it up above the other steps. See the following example:
-
-
-
-Using the WindowsUpgradeAdditionalOptions variable to set command line options.
-
-## Perform the Windows 11 upgrade
-
-To initiate the in-place upgrade, perform the following steps on PC0002 (the device to be upgraded).
-
-On **PC0002**:
-
-1. Start the MDT deployment wizard by running the following command: **\\\\MDT01\\MDTProduction$\\Scripts\\LiteTouch.vbs**
-2. Select the **Windows 11 Enterprise x64 Upgrade** task sequence, and then click **Next**.
-3. Select one or more applications to install (will appear if you use custom image): Install - Adobe Reader
-4. On the **Ready** tab, click **Begin** to start the task sequence.
- When the task sequence begins, it automatically initiates the in-place upgrade process by invoking the Windows setup program (Setup.exe) with the necessary command-line parameters to perform an automated upgrade, which preserves all data, settings, apps, and drivers.
-
-
-
-
-
-After the task sequence completes, the computer will be fully upgraded to Windows 11.
-
-## Related topics
-
-[Windows 10 deployment scenarios](../windows-10-deployment-scenarios.md)
-[Microsoft Deployment Toolkit downloads and resources](/mem/configmgr/mdt/)
\ No newline at end of file
diff --git a/windows/deployment/deploy-windows-mdt/use-orchestrator-runbooks-with-mdt.md b/windows/deployment/deploy-windows-mdt/use-orchestrator-runbooks-with-mdt.md
index 1a2a665f6a..600f2dec3e 100644
--- a/windows/deployment/deploy-windows-mdt/use-orchestrator-runbooks-with-mdt.md
+++ b/windows/deployment/deploy-windows-mdt/use-orchestrator-runbooks-with-mdt.md
@@ -1,5 +1,5 @@
---
-title: Use Orchestrator runbooks with MDT (Windows 11)
+title: Use Orchestrator runbooks with MDT (Windows 10)
description: Learn how to integrate Microsoft System Center 2012 R2 Orchestrator with MDT to replace the existing web services that are used in deployment solutions.
ms.assetid: 68302780-1f6f-4a9c-9407-b14371fdce3f
ms.reviewer:
@@ -18,10 +18,6 @@ ms.topic: article
# Use Orchestrator runbooks with MDT
-**Applies to**
-- Windows 10
-- Windows 11
-
This topic will show you how to integrate Microsoft System Center 2012 R2 Orchestrator with MDT to replace the existing web services that are used in deployment solutions.
MDT can integrate with System Center 2012 R2 Orchestrator, which is a component that ties the Microsoft System Center products together, as well as other products from both Microsoft and third-party vendors. The difference between using Orchestrator and "normal" web services, is that with Orchestrator you have a rich drag-and-drop style interface when building the solution, and little or no coding is required.
diff --git a/windows/deployment/deploy-windows-mdt/use-the-mdt-database-to-stage-windows-deployment-information.md b/windows/deployment/deploy-windows-mdt/use-the-mdt-database-to-stage-windows-10-deployment-information.md
similarity index 96%
rename from windows/deployment/deploy-windows-mdt/use-the-mdt-database-to-stage-windows-deployment-information.md
rename to windows/deployment/deploy-windows-mdt/use-the-mdt-database-to-stage-windows-10-deployment-information.md
index 85da7682da..235c3ecedb 100644
--- a/windows/deployment/deploy-windows-mdt/use-the-mdt-database-to-stage-windows-deployment-information.md
+++ b/windows/deployment/deploy-windows-mdt/use-the-mdt-database-to-stage-windows-10-deployment-information.md
@@ -1,6 +1,6 @@
---
-title: Use MDT database to stage Windows 11 deployment info (Windows 11)
-description: Learn how to use the MDT database to pre-stage information on your Windows 11 deployment in a Microsoft SQL Server 2012 SP1 Express database.
+title: Use MDT database to stage Windows 10 deployment info (Windows 10)
+description: Learn how to use the MDT database to pre-stage information on your Windows 10 deployment in a Microsoft SQL Server 2012 SP1 Express database.
ms.assetid: 8956ab54-90ba-45d3-a384-4fdec72c4d46
ms.reviewer:
manager: dougeby
@@ -18,10 +18,6 @@ ms.topic: article
# Use the MDT database to stage Windows 10 deployment information
-**Applies to**
-- Windows 10
-- Windows 11
-
This topic is designed to teach you how to use the MDT database to pre-stage information on your Windows 10 deployment in a Microsoft SQL Server 2012 SP1 Express database, rather than include the information in a text file (CustomSettings.ini). You can use this process, for example, to add the client machines you want to deploy, specify their computer names and IP addresses, indicate applications to be deployed, and determine many additional settings for the machines.
## Database prerequisites
diff --git a/windows/deployment/deploy-windows-mdt/use-web-services-in-mdt.md b/windows/deployment/deploy-windows-mdt/use-web-services-in-mdt.md
index f9c72cfd2c..21536126c8 100644
--- a/windows/deployment/deploy-windows-mdt/use-web-services-in-mdt.md
+++ b/windows/deployment/deploy-windows-mdt/use-web-services-in-mdt.md
@@ -1,12 +1,12 @@
---
-title: Use web services in MDT (Windows 11)
-description: Learn how to create a simple web service that generates computer names and then configure MDT to use that service during your Windows 11 deployment.
+title: Use web services in MDT (Windows 10)
+description: Learn how to create a simple web service that generates computer names and then configure MDT to use that service during your Windows 10 deployment.
ms.assetid: 8f47535e-0551-4ccb-8f02-bb97539c6522
ms.reviewer:
manager: dougeby
ms.author: greglin
keywords: deploy, web apps
-ms.prod: w11
+ms.prod: w10
ms.mktglfcycl: deploy
ms.localizationpriority: medium
ms.pagetype: mdt
@@ -18,10 +18,6 @@ ms.topic: article
# Use web services in MDT
-**Applies to**
-- Windows 10
-- Windows 11
-
In this topic, you will learn how to create a simple web service that generates computer names and then configure MDT to use that service during your Windows 10 deployment. Web services provide a powerful way to assign settings during a deployment. Simply put, web services are web applications that run code on the server side, and MDT has built-in functions to call these web services.
Using a web service in MDT is straightforward, but it does require that you have enabled the Web Server (IIS) role on the server. Developing web services involves a little bit of coding, but for most web services used with MDT, you can use the free Microsoft Visual Studio Express 2013 for Web.
diff --git a/windows/deployment/images/acroread.png b/windows/deployment/images/acroread.png
index 13bc5c84e1..142e7b6d74 100644
Binary files a/windows/deployment/images/acroread.png and b/windows/deployment/images/acroread.png differ
diff --git a/windows/deployment/images/captureimage.png b/windows/deployment/images/captureimage.png
index 9cccb88a1f..e9ebbf3aad 100644
Binary files a/windows/deployment/images/captureimage.png and b/windows/deployment/images/captureimage.png differ
diff --git a/windows/deployment/images/deployment-workbench01.png b/windows/deployment/images/deployment-workbench01.png
index 34a03a5e1d..c68ee25db1 100644
Binary files a/windows/deployment/images/deployment-workbench01.png and b/windows/deployment/images/deployment-workbench01.png differ
diff --git a/windows/deployment/images/fig2-importedos.png b/windows/deployment/images/fig2-importedos.png
index 8aa48d1b25..90cf910c24 100644
Binary files a/windows/deployment/images/fig2-importedos.png and b/windows/deployment/images/fig2-importedos.png differ
diff --git a/windows/deployment/images/fig2-taskseq.png b/windows/deployment/images/fig2-taskseq.png
index d3deca7024..bdd81ddbde 100644
Binary files a/windows/deployment/images/fig2-taskseq.png and b/windows/deployment/images/fig2-taskseq.png differ
diff --git a/windows/deployment/images/fig4-oob-drivers.png b/windows/deployment/images/fig4-oob-drivers.png
index 11eb769926..14d93fb278 100644
Binary files a/windows/deployment/images/fig4-oob-drivers.png and b/windows/deployment/images/fig4-oob-drivers.png differ
diff --git a/windows/deployment/images/fig5-selectprofile.png b/windows/deployment/images/fig5-selectprofile.png
index 61c795dcee..452ab4f581 100644
Binary files a/windows/deployment/images/fig5-selectprofile.png and b/windows/deployment/images/fig5-selectprofile.png differ
diff --git a/windows/deployment/images/fig6-taskseq.png b/windows/deployment/images/fig6-taskseq.png
index d77e99d70d..8696cc04c4 100644
Binary files a/windows/deployment/images/fig6-taskseq.png and b/windows/deployment/images/fig6-taskseq.png differ
diff --git a/windows/deployment/images/fig8-cust-tasks.png b/windows/deployment/images/fig8-cust-tasks.png
index 5a0c7c2ac7..3ab40d730a 100644
Binary files a/windows/deployment/images/fig8-cust-tasks.png and b/windows/deployment/images/fig8-cust-tasks.png differ
diff --git a/windows/deployment/images/image-captured.png b/windows/deployment/images/image-captured.png
index 281e8ea0ff..69c5d5ef15 100644
Binary files a/windows/deployment/images/image-captured.png and b/windows/deployment/images/image-captured.png differ
diff --git a/windows/deployment/images/iso-data.png b/windows/deployment/images/iso-data.png
index 27075a9502..f188046b7f 100644
Binary files a/windows/deployment/images/iso-data.png and b/windows/deployment/images/iso-data.png differ
diff --git a/windows/deployment/images/mdt-03-fig03.png b/windows/deployment/images/mdt-03-fig03.png
index 7e128451d6..a387923d80 100644
Binary files a/windows/deployment/images/mdt-03-fig03.png and b/windows/deployment/images/mdt-03-fig03.png differ
diff --git a/windows/deployment/images/mdt-03-fig04.png b/windows/deployment/images/mdt-03-fig04.png
index 9ac1267b22..437531d2f6 100644
Binary files a/windows/deployment/images/mdt-03-fig04.png and b/windows/deployment/images/mdt-03-fig04.png differ
diff --git a/windows/deployment/images/mdt-07-fig10.png b/windows/deployment/images/mdt-07-fig10.png
index 23037de07d..2c61e0eb3d 100644
Binary files a/windows/deployment/images/mdt-07-fig10.png and b/windows/deployment/images/mdt-07-fig10.png differ
diff --git a/windows/deployment/images/mdt-10-fig05.png b/windows/deployment/images/mdt-10-fig05.png
index 94ce5cd310..8625f2972b 100644
Binary files a/windows/deployment/images/mdt-10-fig05.png and b/windows/deployment/images/mdt-10-fig05.png differ
diff --git a/windows/deployment/images/mdt-10-fig09.png b/windows/deployment/images/mdt-10-fig09.png
index 77b8960921..bb5010a93d 100644
Binary files a/windows/deployment/images/mdt-10-fig09.png and b/windows/deployment/images/mdt-10-fig09.png differ
diff --git a/windows/deployment/images/mdt-apps.png b/windows/deployment/images/mdt-apps.png
index 73587506af..72ee2268f2 100644
Binary files a/windows/deployment/images/mdt-apps.png and b/windows/deployment/images/mdt-apps.png differ
diff --git a/windows/deployment/images/mdt-offline-media.png b/windows/deployment/images/mdt-offline-media.png
index d31ad0f27d..d81ea4e0d8 100644
Binary files a/windows/deployment/images/mdt-offline-media.png and b/windows/deployment/images/mdt-offline-media.png differ
diff --git a/windows/deployment/images/mdt-replace.png b/windows/deployment/images/mdt-replace.png
index 950ec3d6f7..d731037d38 100644
Binary files a/windows/deployment/images/mdt-replace.png and b/windows/deployment/images/mdt-replace.png differ
diff --git a/windows/deployment/images/monitor-pc0001.PNG b/windows/deployment/images/monitor-pc0001.PNG
index 10708e3f71..072b9cb58c 100644
Binary files a/windows/deployment/images/monitor-pc0001.PNG and b/windows/deployment/images/monitor-pc0001.PNG differ
diff --git a/windows/deployment/images/pc0005-vm-office.png b/windows/deployment/images/pc0005-vm-office.png
index d572ae77e9..bb8e96f5af 100644
Binary files a/windows/deployment/images/pc0005-vm-office.png and b/windows/deployment/images/pc0005-vm-office.png differ
diff --git a/windows/deployment/images/pc0005-vm.png b/windows/deployment/images/pc0005-vm.png
index 9d4c46dfac..4b2af635c4 100644
Binary files a/windows/deployment/images/pc0005-vm.png and b/windows/deployment/images/pc0005-vm.png differ
diff --git a/windows/deployment/images/upgrademdt-fig5-winupgrade.png b/windows/deployment/images/upgrademdt-fig5-winupgrade.png
index f346380b98..f3bc05508a 100644
Binary files a/windows/deployment/images/upgrademdt-fig5-winupgrade.png and b/windows/deployment/images/upgrademdt-fig5-winupgrade.png differ
diff --git a/windows/deployment/index.yml b/windows/deployment/index.yml
index 1bb703d0bf..314d9aa780 100644
--- a/windows/deployment/index.yml
+++ b/windows/deployment/index.yml
@@ -10,7 +10,9 @@ metadata:
ms.service: windows-10 #Required; service per approved list. service slug assigned to your service by ACOM.
ms.subservice: subservice
ms.topic: landing-page # Required
- ms.collection: windows-10
+ ms.collection:
+ - windows-10
+ - highpri
author: greg-lindsay #Required; your GitHub user alias, with correct capitalization.
ms.author: greglin #Required; microsoft alias of author; optional team alias.
ms.date: 06/24/2021 #Required; mm/dd/yyyy format.
diff --git a/windows/deployment/mbr-to-gpt.md b/windows/deployment/mbr-to-gpt.md
index 8ad4b1b6a3..bae2b9eb0d 100644
--- a/windows/deployment/mbr-to-gpt.md
+++ b/windows/deployment/mbr-to-gpt.md
@@ -10,12 +10,12 @@ audience: itpro
author: greg-lindsay
ms.author: greglin
ms.date: 02/13/2018
-ms.reviewer:
-manager: laurawi
+manager: dougeby
ms.audience: itpro
ms.localizationpriority: medium
ms.topic: article
ms.custom: seo-marvel-apr2020
+ms.collection: highpri
---
# MBR2GPT.EXE
@@ -25,8 +25,9 @@ ms.custom: seo-marvel-apr2020
**MBR2GPT.EXE** converts a disk from the Master Boot Record (MBR) to the GUID Partition Table (GPT) partition style without modifying or deleting data on the disk. The tool is designed to be run from a Windows Preinstallation Environment (Windows PE) command prompt, but can also be run from the full Windows 10 operating system (OS) by using the **/allowFullOS** option.
->MBR2GPT.EXE is located in the **Windows\\System32** directory on a computer running Windows 10 version 1703 (also known as the Creator's Update) or later.
->The tool is available in both the full OS environment and Windows PE. To use this tool in a deployment task sequence with Configuration Manager or Microsoft Deployment Toolkit (MDT), you must first update the Windows PE image (winpe.wim, boot.wim) with the [Windows ADK](https://developer.microsoft.com/windows/hardware/windows-assessment-deployment-kit) 1703, or a later version.
+MBR2GPT.EXE is located in the **Windows\\System32** directory on a computer running Windows 10 version 1703 (also known as the Creator's Update) or later.
+
+The tool is available in both the full OS environment and Windows PE. To use this tool in a deployment task sequence with Configuration Manager or Microsoft Deployment Toolkit (MDT), you must first update the Windows PE image (winpe.wim, boot.wim) with the [Windows ADK](https://developer.microsoft.com/windows/hardware/windows-assessment-deployment-kit) 1703, or a later version.
See the following video for a detailed description and demonstration of MBR2GPT.
@@ -41,8 +42,10 @@ You can use MBR2GPT to:
Offline conversion of system disks with earlier versions of Windows installed, such as Windows 7, 8, or 8.1 are not officially supported. The recommended method to convert these disks is to upgrade the operating system to Windows 10 first, then perform the MBR to GPT conversion.
->[!IMPORTANT]
->After the disk has been converted to GPT partition style, the firmware must be reconfigured to boot in UEFI mode. Make sure that your device supports UEFI before attempting to convert the disk.
+> [!IMPORTANT]
+> After the disk has been converted to GPT partition style, the firmware must be reconfigured to boot in UEFI mode.
+>
+> Make sure that your device supports UEFI before attempting to convert the disk.
## Disk Prerequisites
@@ -62,9 +65,7 @@ If any of these checks fails, the conversion will not proceed and an error will
## Syntax
-
+`MBR2GPT /validate|convert [/disk:] [/logs:] [/map:=] [/allowFullOS]`
### Options
@@ -83,7 +84,7 @@ If any of these checks fails, the conversion will not proceed and an error will
In the following example, disk 0 is validated for conversion. Errors and warnings are logged to the default location, **%windir%**.
-```
+```console
X:\>mbr2gpt /validate /disk:0
MBR2GPT: Attempting to validate disk 0
MBR2GPT: Retrieving layout of disk
@@ -102,9 +103,9 @@ In the following example:
4. The new disk layout is displayed - four partitions are present on the GPT disk: three are identical to the previous partitions and one is the new EFI system partition (volume 3).
5. The OS volume is selected again, and detail displays that it has been converted to the [GPT partition type](/windows/win32/api/winioctl/ns-winioctl-partition_information_gpt) of **ebd0a0a2-b9e5-4433-87c0-68b6b72699c7** corresponding to the **PARTITION_BASIC_DATA_GUID** type.
->As noted in the output from the MBR2GPT tool, you must make changes to the computer firmware so that the new EFI system partition will boot properly.
+As noted in the output from the MBR2GPT tool, you must make changes to the computer firmware so that the new EFI system partition will boot properly.
-```
+```console
X:\>DiskPart
Microsoft DiskPart version 10.0.15048.0
@@ -240,11 +241,12 @@ The following steps illustrate high-level phases of the MBR-to-GPT conversion pr
For Windows to remain bootable after the conversion, an EFI system partition (ESP) must be in place. MBR2GPT creates the ESP using the following rules:
-1. The existing MBR system partition is reused if it meets these requirements:
- a. It is not also the OS or Windows Recovery Environment partition.
- b. It is at least 100MB (or 260MB for 4K sector size disks) in size.
- c. It is less than or equal to 1GB in size. This is a safety precaution to ensure it is not a data partition.
- d. The conversion is not being performed from the full OS. In this case, the existing MBR system partition is in use and cannot be repurposed.
+1. The existing MBR system partition is reused if it meets these requirements:
+ 1. It is not also the OS or Windows Recovery Environment partition.
+ 1. It is at least 100MB (or 260MB for 4K sector size disks) in size.
+ 1. It is less than or equal to 1GB in size. This is a safety precaution to ensure it is not a data partition.
+ 1. The conversion is not being performed from the full OS. In this case, the existing MBR system partition is in use and cannot be repurposed.
+
2. If the existing MBR system partition cannot be reused, a new ESP is created by shrinking the OS partition. This new partition has a size of 100MB (or 260MB for 4K sector size disks) and is formatted FAT32.
If the existing MBR system partition is not reused for the ESP, it is no longer used by the boot process after the conversion. Other partitions are not modified.
@@ -272,7 +274,10 @@ For more information about partition types, see:
### Persisting drive letter assignments
-The conversion tool will attempt to remap all drive letter assignment information contained in the registry that correspond to the volumes of the converted disk. If a drive letter assignment cannot be restored, an error will be displayed at the console and in the log, so that you can manually perform the correct assignment of the drive letter. **Important**: this code runs after the layout conversion has taken place, so the operation cannot be undone at this stage.
+The conversion tool will attempt to remap all drive letter assignment information contained in the registry that correspond to the volumes of the converted disk. If a drive letter assignment cannot be restored, an error will be displayed at the console and in the log, so that you can manually perform the correct assignment of the drive letter.
+
+> [!IMPORTANT]
+> This code runs after the layout conversion has taken place, so the operation cannot be undone at this stage.
The conversion tool will obtain volume unique ID data before and after the layout conversion, organizing this information into a lookup table. It will then iterate through all the entries in **HKLM\SYSTEM\MountedDevices**, and for each entry do the following:
@@ -293,7 +298,10 @@ Four log files are created by the MBR2GPT tool:
- setupact.log
- setuperr.log
-These files contain errors and warnings encountered during disk validation and conversion. Information in these files can be helpful in diagnosing problems with the tool. The setupact.log and setuperr.log files will have the most detailed information about disk layouts, processes, and other information pertaining to disk validation and conversion. Note: The setupact*.log files are different than the Windows Setup files that are found in the %Windir%\Panther directory.
+These files contain errors and warnings encountered during disk validation and conversion. Information in these files can be helpful in diagnosing problems with the tool. The setupact.log and setuperr.log files will have the most detailed information about disk layouts, processes, and other information pertaining to disk validation and conversion.
+
+> [!NOTE]
+> The setupact*.log files are different than the Windows Setup files that are found in the %Windir%\Panther directory.
The default location for all these log files in Windows PE is **%windir%**.
@@ -303,8 +311,7 @@ To view a list of options available when using the tool, type **mbr2gpt /?**
The following text is displayed:
-```
-
+```console
C:\> mbr2gpt /?
Converts a disk from MBR to GPT partitioning without modifying or deleting data on the disk.
@@ -365,7 +372,7 @@ MBR2GPT has the following associated return codes:
You can type the following command at a Windows PowerShell prompt to display the disk number and partition type. Example output is also shown:
-```
+```powershell
PS C:\> Get-Disk | ft -Auto
Number Friendly Name Serial Number HealthStatus OperationalStatus Total Size Partition Style
@@ -376,12 +383,12 @@ Number Friendly Name Serial Number HealthStatus OperationalStatus To
You can also view the partition type of a disk by opening the Disk Management tool, right-clicking the disk number, clicking **Properties**, and then clicking the **Volumes** tab. See the following example:
-
+:::image type="content" alt-text="Volumes." source="images/mbr2gpt-volume.png":::
If Windows PowerShell and Disk Management are not available, such as when you are using Windows PE, you can determine the partition type at a command prompt with the DiskPart tool. To determine the partition style from a command line, type **diskpart** and then type **list disk**. See the following example:
-```
+```console
X:\>DiskPart
Microsoft DiskPart version 10.0.15048.0
@@ -422,33 +429,38 @@ To fix this issue, mount the Windows PE image (WIM), copy the missing file from
1. Mount the Windows PE WIM to a path (for example, C:\WinPE_Mount). For more information about how to mount WIM files, see [Mount an image](/windows-hardware/manufacture/desktop/mount-and-modify-a-windows-image-using-dism#mount-an-image).
-2. Copy the ReAgent files and the ReAgent localization files from the Window 10, version 1903 ADK source folder to the mounted WIM.
+2. Copy the ReAgent files and the ReAgent localization files from the Windows 10, version 1903 ADK source folder to the mounted WIM.
- For example, if the ADK is installed to the default location of C:\Program Files (x86)\Windows Kits\10 and the Windows PE image is mounted to C:\WinPE_Mount, run the following commands from an elevated Command Prompt window:
+ For example, if the ADK is installed to the default location of C:\Program Files (x86)\Windows Kits\10 and the Windows PE image is mounted to C:\WinPE_Mount, run the following commands from an elevated Command Prompt window:
- > [!NOTE]
- > You can access the ReAgent files if you have installed the User State Migration Tool (USMT) as a feature while installing Windows Assessment and Deployment Kit.
+ > [!NOTE]
+ > You can access the ReAgent files if you have installed the User State Migration Tool (USMT) as a feature while installing Windows Assessment and Deployment Kit.
- **Command 1:**
- ```cmd
- copy "C:\Program Files (x86)\Windows Kits\10\Assessment and Deployment Kit\Windows Setup\amd64\Sources\ReAgent*.*" "C:\WinPE_Mount\Windows\System32"
- ```
- This command copies three files:
+ **Command 1:**
+
+ ```console
+ copy "C:\Program Files (x86)\Windows Kits\10\Assessment and Deployment Kit\Windows Setup\amd64\Sources\ReAgent*.*" "C:\WinPE_Mount\Windows\System32"
+ ```
+
+ This command copies three files:
- * ReAgent.admx
- * ReAgent.dll
- * ReAgent.xml
+ * ReAgent.admx
+ * ReAgent.dll
+ * ReAgent.xml
- **Command 2:**
- ```cmd
- copy "C:\Program Files (x86)\Windows Kits\10\Assessment and Deployment Kit\Windows Setup\amd64\Sources\En-Us\ReAgent*.*" "C:\WinPE_Mount\Windows\System32\En-Us"
- ```
- This command copies two files:
- * ReAgent.adml
- * ReAgent.dll.mui
+ **Command 2:**
+
+ ```console
+ copy "C:\Program Files (x86)\Windows Kits\10\Assessment and Deployment Kit\Windows Setup\amd64\Sources\En-Us\ReAgent*.*" "C:\WinPE_Mount\Windows\System32\En-Us"
+ ```
+
+ This command copies two files:
- > [!NOTE]
- > If you aren't using an English version of Windows, replace "En-Us" in the path with the appropriate string that represents the system language.
+ * ReAgent.adml
+ * ReAgent.dll.mui
+
+ > [!NOTE]
+ > If you aren't using an English version of Windows, replace "En-Us" in the path with the appropriate string that represents the system language.
3. After you copy all the files, commit the changes and unmount the Windows PE WIM. MBR2GPT.exe now functions as expected in Windows PE. For information about how to unmount WIM files while committing changes, see [Unmounting an image](/windows-hardware/manufacture/desktop/mount-and-modify-a-windows-image-using-dism#unmounting-an-image).
@@ -457,4 +469,4 @@ To fix this issue, mount the Windows PE image (WIM), copy the missing file from
[Windows 10 Enterprise system requirements](https://technet.microsoft.com/windows/dn798752.aspx)
[Windows 10 Specifications](https://www.microsoft.com/windows/Windows-10-specifications)
- [Windows 10 IT pro forums](https://social.technet.microsoft.com/Forums/en-US/home?category=Windows10ITPro)
\ No newline at end of file
+ [Windows 10 IT pro forums](https://social.technet.microsoft.com/Forums/en-US/home?category=Windows10ITPro)
diff --git a/windows/deployment/planning/applying-filters-to-data-in-the-sua-tool.md b/windows/deployment/planning/applying-filters-to-data-in-the-sua-tool.md
index 5edd92497e..3ad9a31c4c 100644
--- a/windows/deployment/planning/applying-filters-to-data-in-the-sua-tool.md
+++ b/windows/deployment/planning/applying-filters-to-data-in-the-sua-tool.md
@@ -37,65 +37,14 @@ On the user interface for the Standard User Analyzer (SUA) tool, you can apply f
3. On the **Options** menu, click a command that corresponds to the filter that you want to apply. The following table describes the commands.
-
-
-
-
-
-
-
-
Options menu command
-
Description
-
-
-
-
-
Filter Noise
-
Filters noise from the issues.
-
This command is selected by default.
-
-
-
Load Noise Filter File
-
Opens the Open Noise Filter File dialog box, in which you can load an existing noise filter (.xml) file.
-
-
-
Export Noise Filter File
-
Opens the Save Noise Filter File dialog box, in which you can save filter settings as a noise filter (.xml) file.
-
-
-
Only Display Records with Application Name in StackTrace
-
Filters out records that do not have the application name in the stack trace.
-
However, because the SUA tool captures only the first 32 stack frames, this command can also filter out real issues with the application where the call stack is deeper than 32 frames.
-
-
-
Show More Details in StackTrace
-
Shows additional stack frames that are related to the SUA tool, but not related to the diagnosed application.
-
-
-
Warn Before Deleting AppVerifier Logs
-
Displays a warning message before the SUA tool deletes all of the existing SUA-related log files on the computer.
-
This command is selected by default.
-
-
-
Logging
-
Provides the following logging-related options:
-
-
Show or hide log errors.
-
Show or hide log warnings.
-
Show or hide log information.
-
-
To maintain a manageable file size, we recommend that you do not select the option to show informational messages.
-
-
-
-
-
-
-
-
-
-
-
-
-
-
+ |Options menu command|Description|
+ |--- |--- |
+ |**Filter Noise**|Filters noise from the issues.
This command is selected by default.|
+ |**Load Noise Filter File**|Opens the **Open Noise Filter File** dialog box, in which you can load an existing noise filter (.xml) file.|
+ |**Export Noise Filter File**|Opens the **Save Noise Filter File** dialog box, in which you can save filter settings as a noise filter (.xml) file.|
+ |**Only Display Records with Application Name in StackTrace**|Filters out records that do not have the application name in the stack trace.
However, because the SUA tool captures only the first 32 stack frames, this command can also filter out real issues with the application where the call stack is deeper than 32 frames.|
+ |**Show More Details in StackTrace**|Shows additional stack frames that are related to the SUA tool, but not related to the diagnosed application.|
+ |**Warn Before Deleting AppVerifier Logs**|Displays a warning message before the SUA tool deletes all of the existing SUA-related log files on the computer.
This command is selected by default.|
+ |**Logging**|Provides the following logging-related options:
Show or hide log errors.
Show or hide log warnings.
Show or hide log information.
To maintain a manageable file size, we recommend that you do not select the option to show informational messages.|
+
+
\ No newline at end of file
diff --git a/windows/deployment/planning/available-data-types-and-operators-in-compatibility-administrator.md b/windows/deployment/planning/available-data-types-and-operators-in-compatibility-administrator.md
index f128528a5e..2db04e673e 100644
--- a/windows/deployment/planning/available-data-types-and-operators-in-compatibility-administrator.md
+++ b/windows/deployment/planning/available-data-types-and-operators-in-compatibility-administrator.md
@@ -45,195 +45,41 @@ Customized-compatibility databases in Compatibility Administrator contain the fo
The following table shows the attributes you can use for querying your customized-compatibility databases in Compatibility Administrator.
-
-
-
-
-
-
-
-
-
Attribute
-
Description
-
Data type
-
-
-
-
-
APP_NAME
-
Name of the application.
-
String
-
-
-
DATABASE_GUID
-
Unique ID for your compatibility database.
-
String
-
-
-
DATABASE_INSTALLED
-
Specifies if you have installed the database.
-
Boolean
-
-
-
DATABASE_NAME
-
Descriptive name of your database.
-
String
-
-
-
DATABASE_PATH
-
Location of the database on your computer.
-
String
-
-
-
FIX_COUNT
-
Number of compatibility fixes applied to a specific application.
-
Integer
-
-
-
FIX_NAME
-
Name of your compatibility fix.
-
String
-
-
-
MATCH_COUNT
-
Number of matching files for a specific, fixed application.
-
Integer
-
-
-
MATCHFILE_NAME
-
Name of a matching file used to identify a specific, fixed application.
-
String
-
-
-
MODE_COUNT
-
Number of compatibility modes applied to a specific, fixed application.
-
Integer
-
-
-
MODE_NAME
-
Name of your compatibility mode.
-
String
-
-
-
PROGRAM_APPHELPTYPE
-
Type of AppHelp message applied to an entry. The value can be 1 or 2, where 1 enables the program to run and 2 blocks the program.
-
Integer
-
-
-
PROGRAM_DISABLED
-
Specifies if you disabled the compatibility fix for an application. If True, Compatibility Administrator does not apply the fixes to the application.
-
Boolean
-
-
-
PROGRAM_GUID
-
Unique ID for an application.
-
String
-
-
-
PROGRAM_NAME
-
Name of the application that you are fixing.
-
String
-
-
-
-
-
+|Attribute|Description|Data type|
+|--- |--- |--- |
+|APP_NAME|Name of the application.|String|
+|DATABASE_GUID|Unique ID for your compatibility database.|String|
+|DATABASE_INSTALLED|Specifies if you have installed the database.|Boolean|
+|DATABASE_NAME|Descriptive name of your database.|String|
+|DATABASE_PATH|Location of the database on your computer.|String|
+|FIX_COUNT|Number of compatibility fixes applied to a specific application.|Integer|
+|FIX_NAME|Name of your compatibility fix.|String|
+|MATCH_COUNT|Number of matching files for a specific, fixed application.|Integer|
+|MATCHFILE_NAME|Name of a matching file used to identify a specific, fixed application.|String|
+|MODE_COUNT|Number of compatibility modes applied to a specific, fixed application.|Integer|
+|MODE_NAME|Name of your compatibility mode.|String|
+|PROGRAM_APPHELPTYPE|Type of AppHelp message applied to an entry. The value can be 1 or 2, where 1 enables the program to run and 2 blocks the program.|Integer|
+|PROGRAM_DISABLED|Specifies if you disabled the compatibility fix for an application. If True, Compatibility Administrator does not apply the fixes to the application.|Boolean|
+|PROGRAM_GUID|Unique ID for an application.|String|
+|PROGRAM_NAME|Name of the application that you are fixing.|String|
## Available Operators
-
The following table shows the operators that you can use for querying your customized-compatibility databases in the Compatibility Administrator.
-
-
-
-
-
-
-
-
-
-
Symbol
-
Description
-
Data type
-
Precedence
-
-
-
-
-
>
-
Greater than
-
Integer or string
-
1
-
-
-
>=
-
Greater than or equal to
-
Integer or string
-
1
-
-
-
<
-
Less than
-
Integer or string
-
1
-
-
-
<=
-
Less than or equal to
-
Integer or string
-
1
-
-
-
<>
-
Not equal to
-
Integer or string
-
1
-
-
-
=
-
Equal to
-
Integer, string, or Boolean
-
1
-
-
-
HAS
-
A special SQL operator used to check if the left-hand operand contains a substring specified by the right-hand operand.
Only the HAS operator can be applied to the MATCHFILE_NAME, MODE_NAME, and FIX_NAME attributes.
-
-
-
-
-
Right-hand operand. String
-
1
-
-
-
OR
-
Logical OR operator
-
Boolean
-
2
-
-
-
AND
-
Logical AND operator
-
Boolean
-
2
-
-
-
-
-
+|Symbol|Description|Data type|Precedence|
+|--- |--- |--- |--- |
+|>|Greater than|Integer or string|1|
+|>=|Greater than or equal to|Integer or string|1|
+|<|Less than|Integer or string|1|
+|<=|Less than or equal to|Integer or string|1|
+|<>|Not equal to|Integer or string|1|
+|=|Equal to|Integer, string, or Boolean|1|
+|HAS|A special SQL operator used to check if the left-hand operand contains a substring specified by the right-hand operand.|Left-hand operand. MATCHFILE_NAME, MODE_NAME, FIX_NAME
Note: Only the HAS operator can be applied to the MATCHFILE_NAME, MODE_NAME, and FIX_NAME attributes.
Right-hand operand. String|1|
+|OR|Logical OR operator|Boolean|2|
+|AND|Logical AND operator|Boolean|2|
## Related topics
+
[Using the Compatibility Administrator Tool](using-the-compatibility-administrator-tool.md)
-
-
-
-
-
-
-
-
diff --git a/windows/deployment/planning/compatibility-administrator-users-guide.md b/windows/deployment/planning/compatibility-administrator-users-guide.md
index 9b6a2402c6..f0d03186b1 100644
--- a/windows/deployment/planning/compatibility-administrator-users-guide.md
+++ b/windows/deployment/planning/compatibility-administrator-users-guide.md
@@ -44,29 +44,8 @@ The following flowchart shows the steps for using the Compatibility Administrato
## In this section
-
This section provides information about managing your application-compatibility fixes and custom-compatibility fix databases. This section explains the reasons for using compatibility fixes and how to deploy custom-compatibility fix databases.
You must deploy your customized database (.sdb) files to other computers in your organization before your compatibility fixes, compatibility modes, and AppHelp messages are applied. You can deploy your customized database files in several ways, including by using a logon script, by using Group Policy, or by performing file copy operations.
-
-
-
+|Topic|Description|
+|--- |--- |
+|[Using the Compatibility Administrator Tool](using-the-compatibility-administrator-tool.md)|This section provides information about using the Compatibility Administrator tool.|
+|[Managing Application-Compatibility Fixes and Custom Fix Databases](managing-application-compatibility-fixes-and-custom-fix-databases.md)|This section provides information about managing your application-compatibility fixes and custom-compatibility fix databases. This section explains the reasons for using compatibility fixes and how to deploy custom-compatibility fix databases.|
+|[Using the Sdbinst.exe Command-Line Tool](using-the-sdbinstexe-command-line-tool.md)|You must deploy your customized database (.Sdb) files to other computers in your organization before your compatibility fixes, compatibility modes, and AppHelp messages are applied. You can deploy your customized database files in several ways. Including, by using a logon script, by using Group Policy, or by performing file copy operations.|
\ No newline at end of file
diff --git a/windows/deployment/planning/compatibility-fixes-for-windows-8-windows-7-and-windows-vista.md b/windows/deployment/planning/compatibility-fixes-for-windows-8-windows-7-and-windows-vista.md
index eda58b00ab..6f317ff61b 100644
--- a/windows/deployment/planning/compatibility-fixes-for-windows-8-windows-7-and-windows-vista.md
+++ b/windows/deployment/planning/compatibility-fixes-for-windows-8-windows-7-and-windows-vista.md
@@ -42,933 +42,131 @@ If you start the Compatibility Administrator as an Administrator (with elevated
The following table lists the known compatibility fixes for all Windows operating systems that have been released from Windows Vista through Windows 10. The fixes are listed in alphabetical order.
-
-
-
-
-
-
-
-
Fix
-
Fix Description
-
-
-
-
-
8And16BitAggregateBlts
-
Applications that are mitigated by 8/16-bit mitigation can exhibit performance issues. This layer aggregates all the blt operations and improves performance.
-
-
-
8And16BitDXMaxWinMode
-
Applications that use DX8/9 and are mitigated by the 8/16-bit mitigation are run in a maximized windowed mode. This layer mitigates applications that exhibit graphical corruption in full screen mode.
-
-
-
8And16BitGDIRedraw
-
This fix repairs applications that use GDI and that work in 8-bit color mode. The application is forced to repaint its window on RealizePalette.
-
-
-
AccelGdipFlush
-
This fix increases the speed of GdipFlush, which has perf issues in DWM.
-
-
-
AoaMp4Converter
-
This fix resolves a display issue for the AoA Mp4 Converter.
-
-
-
BIOSRead
-
This problem is indicated when an application cannot access the Device\PhysicalMemory object beyond the kernel-mode drivers, on any of the Windows Server® 2003 operating systems.
-
The fix enables OEM executable (.exe) files to use the GetSystemFirmwareTable function instead of the NtOpenSection function when the BIOS is queried for the \Device\Physical memory information..
-
-
-
BlockRunasInteractiveUser
-
This problem occurs when InstallShield creates installers and uninstallers that fail to complete and that generate error messages or warnings.
-
The fix blocks InstallShield from setting the value of RunAs registry keys to InteractiveUser Because InteractiveUser no longer has Administrator rights.
This fix is required when an application cannot return shell folder paths when it uses the SHGetFolder API.
-
The fix intercepts the SHGetFolder path request to the common appdata file path and returns the Windows® XP-style file path instead of the Windows Vista-style file path.
-
-
-
ClearLastErrorStatusonIntializeCriticalSection
-
This fix is indicated when an application fails to start.
-
The fix modifies the InitializeCriticalSection function call so that it checks the NTSTATUS error code, and then sets the last error to ERROR_SUCCESS.
-
-
-
CopyHKCUSettingsFromOtherUsers
-
This problem occurs when an application's installer must run in elevated mode and depends on the HKCU settings that are provided for other users.
-
The fix scans the existing user profiles and tries to copy the specified keys into the HKEY_CURRENT_USER registry area.
-
You can control this fix further by entering the relevant registry keys as parameters that are separated by the ^ Symbol; for example: Software\MyCompany\Key1^Software\MyCompany\Key2.
The problem is indicated by an access violation error message that displays and when the application fails when you select or crop an image.
-
The fix corrects the brush style hatch value, which is passed to the CreateBrushIndirect() function and enables the information to be correctly interpreted.
-
-
-
CorrectFilePaths
-
The problem is indicated when an application tries to write files to the hard disk and is denied access or receives a file not found or path not found error message.
-
The fix modifies the file path names to point to a new location on the hard disk.
-
-Note
For more detailed information about the CorrectFilePaths application fix, see Using the CorrectFilePaths Fix. We recommend that you use this fix together with the CorrectFilePathsUninstall fix if you are applying it to a setup installation file.
-
-
-
-
-
-
-
CorrectFilePathsUninstall
-
This problem occurs when an uninstalled application leaves behind files, directories, and links.
-
The fix corrects the file paths that are used by the uninstallation process of an application.
-
-Note
For more detailed information about this fix, see Using the CorrectFilePathsUninstall Fix. We recommend that you use this fix together with the CorrectFilePaths fix if you are applying it to a setup installation file.
-
-
-
-
-
-
-
CorrectShellExecuteHWND
-
This problem occurs when you start an executable (.exe) and a taskbar item blinks instead of an elevation prompt being opened, or when the application does not provide a valid HWND value when it calls the ShellExecute(Ex) function.
-
The fix intercepts the ShellExecute(Ex) calls, and then inspects the HWND value. If the value is invalid, this fix enables the call to use the currently active HWND value.
This fix instructs DWM to not render the non-client area, thereby forcing the application to do its own NC rendering. This often gives windows an XP look.
-
-
-
DelayApplyFlag
-
This fix applies a KERNEL, USER, or PROCESS flag if the specified DLL is loaded.
-
You can control this fix further by typing the following command at the command prompt:
-
DLL_Name;Flag_Type;Hexidecimal_Value
-
Where the DLL_Name is the name of the specific DLL, including the file extension. Flag_Type is KERNEL, USER, or PROCESS, and a Hexidecimal_Value, starting with 0x and up to 64-bits long.
-
-Note
The PROCESS flag type can have a 32-bit length only. You can separate multiple entries with a backslash ().
-
-
-
-
-
-
-
DeprecatedServiceShim
-
The problem is indicated when an application tries to install a service that has a dependency on a deprecated service. An error message displays.
-
The fix intercepts the CreateService function calls and removes the deprecated dependency service from the lpDependencies parameter.
-
You can control this fix further by typing the following command at the command prompt:
Where Deprecated_Service is the name of the service that has been deprecated and App_Service is the name of the specific application service that is to be modified; for example, NtLmSsp\WMI.
-
-Note
If you do not provide an App_Service name, the deprecated service will be removed from all newly created services.
-
-
-
-
-
-Note
You can separate multiple entries with a forward slash (/).
-
-
-
-
-
-
-
DirectXVersionLie
-
This problem occurs when an application fails because it does not find the correct version number for DirectX®.
-
The fix modifies the DXDIAGN GetProp function call to return the correct DirectX version.
-
You can control this fix further by typing the following command at the command prompt:
-
MAJORVERSION.MINORVERSION.LETTER
-
For example, 9.0.c.
-
-
-
DetectorDWM8And16Bit
-
This fix offeres mitigation for applications that work in 8/16-bit display color mode because these legacy color modes are not supported in Windows 8 .
-
-
-
Disable8And16BitD3D
-
This fix improves performance of 8/16-bit color applications that render using D3D and do not mix directdraw.
-
-
-
Disable8And16BitModes
-
This fix disables 8/16-bit color mitigation and enumeration of 8/16-bit color modes.
-
-
-
DisableDWM
-
The problem occurs when some objects are not drawn or object artifacts remain on the screen in an application.
-
The fix temporarily disables the Windows Aero menu theme functionality for unsupported applications.
The problem is indicated when an application fade animations, buttons, or other controls do not function properly.
-
The fix disables the fade animations functionality for unsupported applications.
-
-
-
DisableThemeMenus
-
The problem is indicated by an application that behaves unpredictably when it tries to detect and use the correct Windows settings.
-
The fix temporarily disables the Windows Aero menu theme functionality for unsupported applications.
-
-
-
DisableWindowsDefender
-
The fix disables Windows Defender for security applications that do not work with Windows Defender.
-
-
-
DWM8And16BitMitigation
-
The fix offers mitigation for applications that work in 8/16-bit display color mode because these legacy color modes are not supported in Windows 8.
-
-
-
DXGICompat
-
The fix allows application-specific compatibility instructions to be passed to the DirectX engine.
-
-
-
DXMaximizedWindowedMode
-
Applications that use DX8/9 are run in a maximized windowed mode. This is required for applications that use GDI/DirectDraw in addition to Direct3D.
-
-
-
ElevateCreateProcess
-
The problem is indicated when installations, de-installations, or updates fail because the host process calls the CreateProcess function and it returns an ERROR_ELEVATION_REQUIRED error message.
-
The fix handles the error code and attempts to recall the CreateProcess function together with requested elevation. If the fixed application already has a UAC manifest, the error code will be returned unchanged.
The problem occurs when an application fails because of an incorrect UNC path.
-
The fix changes the PathIsUNC function to return a value of True for UNC paths in Windows.
-
-
-
EmulateGetDiskFreeSpace
-
The problem is indicated when an application fails to install or to run, and it generates an error message that there is not enough free disk space to install or use the application, even though there is enough free disk space to meet the application requirements.
-
The fix determines the amount of free space, so that if the amount of free space is larger than 2 GB, the compatibility fix returns a value of 2 GB, but if the amount of free space is smaller than 2 GB, the compatibility fix returns the actual free space amount.
The fix emulates the sorting order of Windows 7 and Windows Server 2008 R2 for various APIs.
-
-
-
EnableRestarts
-
The problem is indicated when an application and computer appear to hang because processes cannot end to allow the computer to complete its restart processes.
-
The fix enables the computer to restart and finish the installation process by verifying and enabling that the SeShutdownPrivilege service privilege exists.
The problem occurs when an application invokes the Release() method too many times and causes an object to be prematurely destroyed.
-
The fix counteracts the application's tries to obtain the shell desktop folder by invoking the AddRef() method on the Desktop folder, which is returned by the SHGetDesktopFolder function.
-
-
-
FailObsoleteShellAPIs
-
The problem occurs when an application fails because it generated deprecated API calls.
-
The fix either fully implements the obsolete functions or implements the obsolete functions with stubs that fail.
-
-Note
You can type FailAll=1 at the command prompt to suppress the function implementation and force all functions to fail.
-
-
-
-
-
-
-
FailRemoveDirectory
-
The problem occurs when an application uninstallation process does not remove all of the application files and folders.
-
This fix fails calls to RemoveDirectory() when called with a path matching the one specified in the shim command-line. Only a single path is supported. The path can contain environment variables, but must be an exact path – no partial paths are supported.
-
The fix can resolve an issue where an application expects RemoveDirectory() to delete a folder immediately even though a handle is open to it.
-
-
-
FakeLunaTheme
-
The problem occurs when a theme application does not properly display: the colors are washed out or the user interface is not detailed.
-
The fix intercepts the GetCurrentThemeName API and returns the value for the Windows XP default theme, (Luna).
The fix invalidates any windows that exist under a closing or hiding window for applications that rely on the invalidation messages.
-
-
-
ForceLoadMirrorDrvMitigation
-
The fix loads the Windows 8 mirror driver mitigation for applications where the mitigation is not automatically applied.
-
-
-
FreestyleBMX
-
The fix resolves an application race condition that is related to window message order.
-
-
-
GetDriveTypeWHook
-
The application presents unusual behavior during installation; for example, the setup program states that it cannot install to a user-specified location.
-
The fix changes GetDriveType() so that only the root information appears for the file path. This is required when an application passes an incomplete or badly-formed file path when it tries to retrieve the drive type on which the file path exists.
-
-
-
GlobalMemoryStatusLie
-
The problem is indicated by a Computer memory full error message that displays when you start an application.
-
The fix modifies the memory status structure, so that it reports a swap file that is 400 MB, regardless of the true swap file size.
-
-
-
HandleBadPtr
-
The problem is indicated by an access violation error message that displays because an API is performing pointer validation before it uses a parameter.
-
The fix supports using lpBuffer validation from the InternetSetOptionA and InternetSetOptionW functions to perform the additional parameter validation.
-
-
-
HandleMarkedContentNotIndexed
-
The problem is indicated by an application that fails when it changes an attribute on a file or directory.
-
The fix intercepts any API calls that return file attributes and directories that are invoked from the %TEMP% directory, and resets the FILE_ATTRIBUTE_NOT_CONTENT_INDEXED attribute to its original state.
-
-
-
HeapClearAllocation
-
The problem is indicated when the allocation process shuts down unexpectedly.
-
The fix uses zeros to clear out the heap allocation for an application.
-
-
-
IgnoreAltTab
-
The problem occurs when an application fails to function when special key combinations are used.
-
The fix intercepts the RegisterRawInputDevices API and prevents the delivery of the WM_INPUT messages. This delivery failure forces the included hooks to be ignored and forces DInput to use Windows-specific hooks.
The fix allows Google Chrome to run on systems that have ntdll loaded above 4GB.
-
-
-
IgnoreDirectoryJunction
-
The problem is indicated by a read or access violation error message that displays when an application tries to find or open files.
-
The fix links the FindNextFileW, FindNextFileA, FindFirstFileExW, FindFirstFileExA, FindFirstFileW and FindFirstFileA APIs to prevent them from returning directory junctions.
-
-Note
Symbolic links appear starting in Windows Vista.
-
-
-
-
-
-
-
IgnoreException
-
The problem is indicated when an application stops functioning immediately after it starts, or the application starts with only a cursor appearing on the screen.
-
The fix enables the application to ignore specified exceptions. By default, this fix ignores privileged-mode exceptions; however, it can be configured to ignore any exception.
-
You can control this fix further by typing the following command at the command prompt:
-
Exception1;Exception2
-
Where Exception1 and Exception2 are specific exceptions to be ignored. For example: ACCESS_VIOLATION_READ:1;ACCESS_VIOLATION_WRITE:1.
-
-Important
You should use this compatibility fix only if you are certain that it is acceptable to ignore the exception. You might experience additional compatibility issues if you choose to incorrectly ignore an exception.
This fix enables an application to ignore the rounding control request and to behave as expected in previous versions of the application.
-
Before floating point SSE2 support in the C runtime library, the rounding control request was being ignored which would use round to nearest option by default. This shim ignores the rounding control request to support applications relying on old behavior.
-
-
-
IgnoreFontQuality
-
The problem occurs when application text appears to be distorted.
-
The fix enables color-keyed fonts to properly work with anti-aliasing.
-
-
-
IgnoreMessageBox
-
The problem is indicated by a message box that displays with debugging or extraneous content when the application runs on an unexpected operating system.
-
The fix intercepts the MessageBox* APIs and inspects them for specific message text. If matching text is found, the application continues without showing the message box.
The problem is indicated by an error message that states that the operating system cannot locate the MSVCR80D.DLL file.
-
The fix ignores the registered MSOXMLMF.DLL object, which Microsoft® Office 2007 loads into the operating system any time that you load an XML file, and then it fails the CoGetClassObject for its CLSID. This compatibility fix will just ignore the registered MSOXMLMF and fail the CoGetClassObject for its CLSID.
-
-
-
IgnoreSetROP2
-
The fix ignores read-modify-write operations on the desktop to avoid performance issues.
-
-
-
InstallComponent
-
The fix prompts the user to install.Net 3.5 or .Net 2.0 because .Net is not included with Windows 8.
-
-
-
LoadLibraryRedirect
-
The fix forces an application to load system versions of libraries instead of loading redistributable versions that shipped with the application.
-
-
-
LocalMappedObject
-
The problem occurs when an application unsuccessfully tries to create an object in the Global namespace.
-
The fix intercepts the function call to create the object and replaces the word Global with Local.
The problem is indicated when an application fails to uninstall because of access-related errors.
-
The fix locates any RunDLL.exe-based uninstallers and forces them to run with different credentials during the application installation. After it applies this fix, the installer will create a shortcut that specifies a matching string to run during the application installation, thereby enabling the uninstallation to occur later.
The fix intercepts common APIs that are going to a directory or to an executable (.exe) file, and then converts any symbolic or directory junctions before passing it back to the original APIs.
-
-
-
MirrorDriverWithComposition
-
The fix allows mirror drivers to work properly with acceptable performance with desktop composition.
-
-
-
MoveToCopyFileShim
-
The problem occurs when an application experiences security access issues during setup.
-
The fix forces the CopyFile APIs to run instead of the MoveFile APIs. CopyFile APIs avoid moving the security descriptor, which enables the application files to get the default descriptor of the destination folder and prevents the security access issue.
-
-
-
OpenDirectoryAcl
-
The problem is indicated by an error message that states that you do not have the appropriate permissions to access the application.
-
The fix reduces the security privilege levels on a specified set of files and folders.
The fix resolves the performance issues in PopCap games like Bejeweled2. The performance issues are visible in certain low-end cards at certain resolutions where the 1024x768 buffer is scaled to fit the display resolution.
-
-
-
PreInstallDriver
-
The fix preinstalls drivers for applications that would otherwise try to install or start drivers during the initial start process.
-
-
-
PreInstallSmarteSECURE
-
The fix preinstalls computer-wide CLSIDs for applications that use SmartSECURE copy protection, which would otherwise try to install the CLSIDs during the initial start process.
-
-
-
ProcessPerfData
-
The problem is indicated by an Unhandled Exception error message because the application tried to read the process performance data registry value to determine if another instance of the application is running.
-
The fix handles the failure case by passing a fake process performance data registry key, so that the application perceives that it is the only instance running.
-
-Note
This issue seems to occur most frequently with .NET applications.
-
-
-
-
-
-
-
PromoteDAM
-
The fix registers an application for power state change notifications.
-
-
-
PropagateProcessHistory
-
The problem occurs when an application incorrectly fails to apply an application fix.
-
The fix sets the _PROCESS_HISTORY environment variable so that child processes can look in the parent directory for matching information while searching for application fixes.
-
-
-
ProtectedAdminCheck
-
The problem occurs when an application fails to run because of incorrect Protected Administrator permissions.
-
The fix addresses the issues that occur when applications use non-standard Administrator checks, thereby generating false positives for user accounts that are being run as Protected Administrators. In this case, the associated SID exists, but it is set as deny-only.
-
-
-
RedirectCRTTempFile
-
The fix intercepts failing CRT calls that try to create a temporary file at the root of the volume, thereby redirecting the calls to a temporary file in the user's temporary directory.
-
-
-
RedirectHKCUKeys
-
The problem occurs when an application cannot be accessed because of User Account Control (UAC) restrictions.
-
The fix duplicates any newly created HKCU keys to other users' HKCU accounts. This fix is generic for UAC restrictions, whereby the HKCU keys are required, but are unavailable to an application at runtime.
-
-
-
RedirectMP3Codec
-
This problem occurs when you cannot play MP3 files.
-
The fix intercepts the CoCreateInstance call for the missing filter and then redirects it to a supported version.
-
-
-
RedirectShortcut
-
The problem occurs when an application cannot be accessed by its shortcut, or application shortcuts are not removed during the application uninstallation process.
-
The fix redirects all of the shortcuts created during the application setup to appear according to a specified path.
-
-
Start Menu shortcuts: Appear in the \ProgramData\Microsoft\Windows\Start Menu directory for all users.
-
Desktop or Quick Launch shortcuts:You must manually place the shortcuts on the individual user's desktop or Quick Launch bar.
-
-
This issue occurs because of UAC restrictions: specifically, when an application setup runs by using elevated privileges and stores the shortcuts according to the elevated user's context. In this situation, a restricted user cannot access the shortcuts.
-
You cannot apply this fix to an .exe file that includes a manifest and provides a runlevel.
-
-
-
RelaunchElevated
-
The problem occurs when installers, uninstallers, or updaters fail when they are started from a host application.
-
The fix enables a child .exe file to run with elevated privileges when it is difficult to determine the parent process with either the ElevateCreateProcess fix or by marking the .exe files to RunAsAdmin.
The problem occurs when an Unable to open service due to your application using the OpenService() API to test for the existence of a particular service error message displays.
-
The fix retries the OpenService() API call and verifies that the user has Administrator rights, is not a Protected Administrator, and by using read-only access. Applications can test for the existence of a service by calling the OpenService() API but some applications ask for all access when making this check. This fix retries the call but only asking for read-only access. The user needs to be an administrator for this to work
The problem occurs when an application fails to function by using the Standard User or Protected Administrator account.
-
The fix enables the application to run by using elevated privileges. The fix is the equivalent of specifying requireAdministrator in an application manifest.
The problem occurs when administrators cannot view the read/write version of an application that presents a read-only view to standard users.
-
The fix enables the application to run by using the highest available permissions. This is the equivalent of specifying highestAvailable in an application manifest.
The problem occurs when an application is not detected as requiring elevation.
-
The fix enables the application to run by using the privileges that are associated with the creation process, without requiring elevation. This is the equivalent of specifying asInvoker in an application manifest.
The fix repairs applications by using SecuROM7 for copy protection.
-
-
-
SessionShim
-
The fix intercepts API calls from applications that are trying to interact with services that are running in another session, by using the terminal service name prefix (Global or Local) as the parameter.
-
At the command prompt, you can supply a list of objects to modify, separating the values by a double backslash (). Or, you can choose not to include any parameters, so that all of the objects are modified.
-
-Important
Users cannot log in as Session 0 (Global Session) in Windows Vista and later. Therefore, applications that require access to Session 0 automatically fail.
The fix registers an application as a protocol handler.
-
You can control this fix further by typing the following command at the command prompt:
-
Client;Protocol;App
-
Where the Client is the name of the email protocol, Protocol is mailto, and App is the name of the application.
-
-Note
Only the mail client and the mailto protocol are supported. You can separate multiple clients by using a backslash ().
-
-
-
-
-
-
-
SetupCommitFileQueueIgnoreWow
-
The problem occurs when a 32-bit setup program fails to install because it requires 64-bit drivers.
-
The fix disables the Wow64 file system that is used by the 64-bit editions of Windows, to prevent 32-bit applications from accessing 64-bit file systems during the application setup.
-
-
-
SharePointDesigner2007
-
The fix resolves an application bug that severely slows the application when it runs in DWM.
-
-
-
ShimViaEAT
-
The problem occurs when an application fails, even after applying acompatibility fix that is known to fix an issue. Applications that use unicows.dll or copy protection often present this issue.
-
The fix applies the specified compatibility fixes by modifying the export table and by nullifying the use of module inclusion and exclusion.
The problem occurs when a web application experiences navigation and display issues because of the tabbing feature.
-
The fix intercepts the ShowWindow API call to address the issues that can occur when a web application determines that it is in a child window. This fix calls the real ShowWindow API on the top-level parent window.
-
-
-
SierraWirelessHideCDROM
-
The fix repairs the Sierra Wireless Driver installation, thereby preventing bugcheck.
-
-
-
Sonique2
-
The application uses an invalid window style, which breaks in DWM. This fix replaces the window style with a valid value.
-
-
-
SpecificInstaller
-
The problem occurs when an application installation file fails to be picked up by the GenericInstaller function.
-
The fix flags the application as being an installer file (for example, setup.exe), and then prompts for elevation.
The problem occurs when an application that is not an installer (and has sufficient privileges) generates a false positive from the GenericInstaller function.
-
The fix flags the application to exclude it from detection by the GenericInstaller function.
The fix replaces SystemMetrics values and SystemParametersInfo values with the values of previous Windows versions.
-
-
-
TextArt
-
The application receives different mouse coordinates with DWM ON versus DWM OFF, which causes the application to hang. This fix resolves the issue.
-
-
-
TrimDisplayDeviceNames
-
The fix trims the names of the display devices that are returned by the EnumDisplayDevices API.
-
-
-
UIPICompatLogging
-
The fix enables the logging of Windows messages from Internet Explorer and other processes.
-
-
-
UIPIEnableCustomMsgs
-
The problem occurs when an application does not properly communicate with other processes because customized Windows messages are not delivered.
-
The fix enables customized Windows messages to pass through to the current process from a lower Desktop integrity level. This fix is the equivalent of calling the RegisterWindowMessage function, followed by the ChangeWindowMessageFilter function in the code.
-
You can control this fix further by typing the following command at the command prompt:
-
MessageString1 MessageString2
-
Where MessageString1 and MessageString2 reflect the message strings that can pass.
-
-Note
Multiple message strings must be separated by spaces. For more detailed information about this application fix, see Using the UIPIEnableCustomMsgs Fix.
-
-
-
-
-
-
-
UIPIEnableStandardMsgs
-
The problem occurs when an application does not communicate properly with other processes because standard Windows messages are not delivered.
-
The fix enables standard Windows messages to pass through to the current process from a lower Desktop integrity level. This fix is the equivalent of calling the ChangeWindowMessageFilter function in the code.
-
You can control this fix further by typing the following command at the command prompt:
-
1055 1056 1069
-
Where 1055 reflects the first message ID, 1056 reflects the second message ID, and 1069 reflects the third message ID that can pass.
The fix virtualizes DeleteFile operations for applications that try to delete protected files.
-
-
-
VirtualizeDesktopPainting
-
This fix improves the performance of a number of operations on the Desktop DC while using DWM.
-
-
-
VirtualRegistry
-
The problem is indicated when a Component failed to be located error message displays when an application is started.
-
The fix enables the registry functions to allow for virtualization, redirection, expansion values, version spoofing, the simulation of performance data counters, and so on.
The problem occurs when several error messages display and the application cannot delete files.
-
The fix makes the application's DeleteFile function call a virtual call in an effort to remedy the UAC and file virtualization issues that were introduced with Windows Vista. This fix also links other file APIs (for example, GetFileAttributes) to ensure that the virtualization of the file is deleted.
The problem occurs when an application fails to register COM components at runtime.
-
The fix redirects the HKCR write calls (HKLM) to the HKCU hive for a per-user COM registration. This operates much like the VirtualRegistry fix when you use the VirtualizeHKCR parameter; however, VirtualizeHKCRLite provides better performance.
-
HKCR is a virtual merge of the HKCU\Software\Classes and HKLM\Software\Classes directories. The use of HKCU is preferred if an application is not elevated and is ignored if the application is elevated.
-
You typically will use this compatibility fix in conjunction with the VirtualizeRegisterTypeLib fix.
The fix, when it is used with the VirtualizeHKCRLite fix, ensures that the type library and the COM class registration happen simultaneously. This functions much like the RegistryTypeLib fix when the RegisterTypeLibForUser parameter is used.
This problem is indicated by an error message that states: Unable to initialize sound device from your audio driver; the application then closes.
-
The fix enables the application to ignore the format error and continue to function properly.
-
-
-
WerDisableReportException
-
The fix turns off the silent reporting of exceptions to the Windows Error Reporting tool, including those that are reported by Object Linking and Embedding-Database (OLE DB). The fix intercepts the RtlReportException API and returns a STATUS_NOT_SUPPORTED error message.
-
-
-
Win7RTM/Win8RTM
-
The layer provides the application with Windows 7/Windows 8 compatibility mode.
-
-
-
WinxxRTMVersionLie
-
The problem occurs when an application fails because it does not find the correct version number for the required Windows operating system.
-
All version lie compatibility fixes address the issue whereby an application fails to function because it is checking for, but not finding, a specific version of the operating system. The version lie fix returns the appropriate operating system version information. For example, the VistaRTMVersionLie returns the Windows Vista version information to the application, regardless of the actual operating system version that is running on the computer.
-
-
-
Wing32SystoSys32
-
The problem is indicated by an error message that states that the WinG library was not properly installed.
-
The fix detects whether the WinG32 library exists in the correct directory. If the library is located in the wrong location, this fix copies the information (typically during the runtime of the application) into the %WINDIR% \system32 directory.
-
-Important
The application must have Administrator privileges for this fix to work.
-
-
-
-
-
-
-
WinSrv08R2RTM
-
-
-
-
WinXPSP2VersionLie
-
The problem occurs when an application experiences issues because of a VB runtime DLL.
-
The fix forces the application to follow these steps:
-
-
Open the Compatibility Administrator, and then select None for Operating System Mode.
-
On the Compatibility Fixes page, click WinXPSP2VersionLie, and then click Parameters.
-
The Options for <fix_name> dialog box appears.
-
Type vbrun60.dll into the Module Name box, click Include, and then click Add.
The application fails when it tries to register a COM component that is released together with Windows Vista and later.
-
The fix skips the processes of registering and unregistering WRP-protected COM components when calling the DLLRegisterServer and DLLUnregisterServer functions.
-
You can control this fix further by typing the following command at the command prompt:
-
Component1.dll;Component2.dll
-
Where Component1.dll and Component2.dll reflect the components to be skipped.
The problem is indicated when an access denied error message displays when the application tries to access a protected operating system resource by using more than read-only access.
-
The fix emulates the successful authentication and modification of file and registry APIs, so that the application can continue.
The problem is indicated by an access denied error message that displays when the application tries to delete a registry key.
-
The fix verifies whether the registry key is WRP-protected. If the key is protected, this fix emulates the deletion process.
-
-
-
XPAfxIsValidAddress
-
The fix emulates the behavior of Windows XP for MFC42!AfxIsValidAddress.
-
-
-
-
-
+|Fix|Fix Description|
+|--- |--- |
+|8And16BitAggregateBlts|Applications that are mitigated by 8/16-bit mitigation can exhibit performance issues. This layer aggregates all the blt operations and improves performance.|
+|8And16BitDXMaxWinMode|Applications that use DX8/9 and are mitigated by the 8/16-bit mitigation are run in a maximized windowed mode. This layer mitigates applications that exhibit graphical corruption in full screen mode.|
+|8And16BitGDIRedraw|This fix repairs applications that use GDI and that work in 8-bit color mode. The application is forced to repaint its window on RealizePalette.|
+|AccelGdipFlush|This fix increases the speed of GdipFlush, which has perf issues in DWM.|
+|AoaMp4Converter|This fix resolves a display issue for the AoA Mp4 Converter.|
+|BIOSRead|This problem is indicated when an application cannot access the **Device\PhysicalMemory** object beyond the kernel-mode drivers, on any of the Windows Server® 2003 operating systems.
The fix enables OEM executable (.exe) files to use the GetSystemFirmwareTable function instead of the NtOpenSection function when the BIOS is queried for the **\Device\Physical** memory information..|
+|BlockRunasInteractiveUser|This problem occurs when **InstallShield** creates installers and uninstallers that fail to complete and that generate error messages or warnings.
The fix blocks **InstallShield** from setting the value of RunAs registry keys to InteractiveUser Because InteractiveUser no longer has Administrator rights.
**Note:** For more detailed information about this application fix, see [Using the BlockRunAsInteractiveUser Fix](/previous-versions/windows/it-pro/windows-7/dd638336(v=ws.10)).
|
+|ChangeFolderPathToXPStyle|This fix is required when an application cannot return shell folder paths when it uses the **SHGetFolder** API.
The fix intercepts the **SHGetFolder**path request to the common **appdata** file path and returns the Windows® XP-style file path instead of the Windows Vista-style file path.|
+|ClearLastErrorStatusonIntializeCriticalSection|This fix is indicated when an application fails to start.
The fix modifies the InitializeCriticalSection function call so that it checks the NTSTATUS error code, and then sets the last error to ERROR_SUCCESS.|
+|CopyHKCUSettingsFromOtherUsers|This problem occurs when an application's installer must run in elevated mode and depends on the HKCU settings that are provided for other users.
The fix scans the existing user profiles and tries to copy the specified keys into the HKEY_CURRENT_USER registry area.
You can control this fix further by entering the relevant registry keys as parameters that are separated by the ^ Symbol; for example: Software\MyCompany\Key1^Software\MyCompany\Key2.
**Note:** For more detailed information about this application fix, see [Using the CopyHKCUSettingsFromOtherUsers Fix](/previous-versions/windows/it-pro/windows-7/dd638375(v=ws.10)).
|
+|CorrectCreateBrushIndirectHatch|The problem is indicated by an access violation error message that displays and when the application fails when you select or crop an image.
The fix corrects the brush style hatch value, which is passed to the CreateBrushIndirect() function and enables the information to be correctly interpreted.|
+|CorrectFilePaths|The problem is indicated when an application tries to write files to the hard disk and is denied access or receives a file not found or path not found error message.
The fixmodifies the file path names to point to a new location on the hard disk.
**Note:** For more detailed information about the CorrectFilePaths application fix, see [Using the CorrectFilePaths Fix](/previous-versions/windows/it-pro/windows-7/cc766201(v=ws.10)). We recommend that you use this fix together with the CorrectFilePathsUninstall fix if you are applying it to a setup installation file.
|
+|CorrectFilePathsUninstall|This problem occurs when an uninstalled application leaves behind files, directories, and links.
The fix corrects the file paths that are used by the uninstallation process of an application.
**Note:** For more detailed information about this fix, see [Using the CorrectFilePathsUninstall Fix](/previous-versions/windows/it-pro/windows-7/dd638414(v=ws.10)). We recommend that you use this fix together with the CorrectFilePaths fix if you are applying it to a setup installation file.
|
+|CorrectShellExecuteHWND|This problem occurs when you start an executable (.exe) and a taskbar item blinks instead of an elevation prompt being opened, or when the application does not provide a valid HWND value when it calls the ShellExecute(Ex) function.
The fixintercepts the ShellExecute(Ex) calls, and then inspects the HWND value. If the value is invalid, this fix enables the call to use the currently active HWND value.
**Note:** For more detailed information about the CorrectShellExecuteHWND application fix, see [Using the CorrectShellExecuteHWND Fix](/previous-versions/windows/it-pro/windows-7/cc722028(v=ws.10)).
|
+|CustomNCRender|This fix instructs DWM to not render the non-client area, thereby forcing the application to do its own NC rendering. This often gives windows an XP look.|
+|DelayApplyFlag|This fix applies a KERNEL, USER, or PROCESS flag if the specified DLL is loaded.
You can control this fix further by typing the following command at the command prompt:
`DLL_Name;Flag_Type;Hexidecimal_Value` Where the DLL_Name is the name of the specific DLL, including the file extension. Flag_Type is KERNEL, USER, or PROCESS, and a Hexidecimal_Value, starting with 0x and up to 64 bits long.
**Note:** The PROCESS flag type can have a 32-bit length only. You can separate multiple entries with a backslash ().
|
+|DeprecatedServiceShim|The problem is indicated when an application tries to install a service that has a dependency on a deprecated service. An error message displays.
The fix intercepts the CreateService function calls and removes the deprecated dependency service from the lpDependencies parameter.
You can control this fix further by typing the following command at the command prompt:
`Deprecated_Service\App_Service/Deprecated_Service2 \App_Service2` Where Deprecated_Service is the name of the service that has been deprecated and App_Service is the name of the specific application service that is to be modified; for example, NtLmSsp\WMI.
**Note:** If you do not provide an App_Service name, the deprecated service will be removed from all newly created services.
**Note:** You can separate multiple entries with a forward slash (/).
|
+|DirectXVersionLie|This problem occurs when an application fails because it does not find the correct version number for DirectX®.
The fix modifies the DXDIAGN GetProp function call to return the correct DirectX version.
You can control this fix further by typing the following command at the command prompt: `MAJORVERSION.MINORVERSION.LETTER`
For example, 9.0.c.|
+|DetectorDWM8And16Bit|This fix offers mitigation for applications that work in 8/16-bit display color mode because these legacy color modes are not supported in Windows 8 .|
+|Disable8And16BitD3D|This fix improves performance of 8/16-bit color applications that render using D3D and do not mix direct draw.|
+|Disable8And16BitModes|This fix disables 8/16-bit color mitigation and enumeration of 8/16-bit color modes.|
+|DisableDWM|The problem occurs when some objects are not drawn or object artifacts remain on the screen in an application.
The fix temporarily disables the Windows Aero menu theme functionality for unsupported applications.
**Note:** For more detailed information about this application fix, see [Using the DisableDWM Fix](/previous-versions/windows/it-pro/windows-7/cc722418(v=ws.10)).
|
+|DisableFadeAnimations|The problem is indicated when an application fades animation, buttons, or other controls do not function properly.
The fix disables the fade animations functionality for unsupported applications.|
+|DisableThemeMenus|The problem is indicated by an application that behaves unpredictably when it tries to detect and use the correct Windows settings.
The fix temporarily disables the Windows Aero menu theme functionality for unsupported applications.|
+|DisableWindowsDefender|The fix disables Windows Defender for security applications that do not work with Windows Defender.|
+|DWM8And16BitMitigation|The fix offers mitigation for applications that work in 8/16-bit display color mode because these legacy color modes are not supported in Windows 8.|
+|DXGICompat|The fix allows application-specific compatibility instructions to be passed to the DirectX engine.|
+|DXMaximizedWindowedMode|Applications that use DX8/9 are run in a maximized windowed mode. This is required for applications that use GDI/DirectDraw in addition to Direct3D.|
+|ElevateCreateProcess|The problem is indicated when installations, de-installations, or updates fail because the host process calls the CreateProcess function and it returns an ERROR_ELEVATION_REQUIRED error message.
The fixhandles the error code and attempts to recall the CreateProcess function together with requested elevation. If the fixed application already has a UAC manifest, the error code will be returned unchanged.
**Note:** For more detailed information about this application fix, see [Using the ElevateCreateProcess Fix](/previous-versions/windows/it-pro/windows-7/cc722422(v=ws.10)).
|
+|EmulateOldPathIsUNC|The problem occurs when an application fails because of an incorrect UNC path.
The fix exchanges the PathIsUNC function to return a value of True for UNC paths in Windows.|
+|EmulateGetDiskFreeSpace|The problem is indicated when an application fails to install or to run, and it generates an error message that there is not enough free disk space to install or use the application, even though there is enough free disk space to meet the application requirements.
The fix determines the amount of free space, so that if the amount of free space is larger than 2 GB, the compatibility fix returns a value of 2 GB, but if the amount of free space is smaller than 2 GB, the compatibility fix returns the actual-free space amount.
**Note:** For more detailed information about this application fix, see [Using the EmulateGetDiskFreeSpace Fix](/previous-versions/windows/it-pro/windows-7/ff720129(v=ws.10)).
|
+|EmulateSorting|The problem occurs when an application experiences search functionality issues.
The fix forces applications that use the CompareStringW/LCMapString sorting table to use an older version of the table.
**Note:** For more detailed information about this e application fix, see [Using the EmulateSorting Fix](/previous-versions/windows/it-pro/windows-7/cc749209(v=ws.10)).
|
+|EmulateSortingWindows61|The fix emulates the sorting order of Windows 7 and Windows Server 2008 R2 for various APIs.|
+|EnableRestarts|The problem is indicated when an application and computer appear to hang because processes cannot end to allow the computer to complete its restart processes.
The fix enables the computer to restart and finish the installation process by verifying and enabling that the SeShutdownPrivilege service privilege exists.
**Note:** For more detailed information about this application fix, see [Using the EnableRestarts Fix](/previous-versions/windows/it-pro/windows-7/ff720128(v=ws.10)).
|
+|ExtraAddRefDesktopFolder|The problem occurs when an application invokes the Release() method too many times and causes an object to be prematurely destroyed.
The fix counteracts the application's tries to obtain the shell desktop folder by invoking the AddRef() method on the Desktop folder, which is returned by the SHGetDesktopFolder function.|
+|FailObsoleteShellAPIs|The problem occurs when an application fails because it generated deprecated API calls.
The fix either fully implements the obsolete functions or implements the obsolete functions with stubs that fail.
**Note:** You can type FailAll=1 at the command prompt to suppress the function implementation and force all functions to fail.
|
+|FailRemoveDirectory|The problem occurs when an application uninstallation process does not remove all of the application files and folders.
This fix fails calls to RemoveDirectory() when called with a path matching the one specified in the shim command line. Only a single path is supported. The path can contain environment variables, but must be an exact path – no partial paths are supported.
The fixcan resolves an issue where an application expects RemoveDirectory() to delete a folder immediately even though a handle is open to it.|
+|FakeLunaTheme|The problem occurs when a theme application does not properly display: the colors are washed out or the user interface is not detailed.
The fix intercepts the GetCurrentThemeName API and returns the value for the Windows XP default theme (Luna).
**Note:** For more detailed information about the FakeLunaTheme application fix, see [Using the FakeLunaTheme Fix](/previous-versions/windows/it-pro/windows-7/cc766315(v=ws.10)).
|
+|FlushFile|This problem is indicated when a file is updated and changes do not immediately appear on the hard disk. Applications cannot see the file changes.
The fixenables the WriteFile function to call to the FlushFileBuffers APIs, which flush the file cache onto the hard disk.|
+|FontMigration|The fix replaces an application-requested font with a better font selection, to avoid text truncation.|
+|ForceAdminAccess|The problem occurs when an application fails to function during an explicit administrator check.
The fix allows the user to temporarily imitate being a part of the Administrators group by returning a value of True during the administrator check.
**Note:** For more detailed information about this application fix, see [Using the ForceAdminAccess Fix](/previous-versions/windows/it-pro/windows-7/cc766024(v=ws.10)).
|
+|ForceInvalidateOnClose|The fix invalidates any windows that exist under a closing or hiding window for applications that rely on the invalidation messages.|
+|ForceLoadMirrorDrvMitigation|The fix loads the Windows 8-mirror driver mitigation for applications where the mitigation is not automatically applied.|
+|FreestyleBMX|The fix resolves an application race condition that is related to window message order.|
+|GetDriveTypeWHook|The application presents unusual behavior during installation; for example, the setup program states that it cannot install to a user-specified location.
The fix exchanges GetDriveType() so that only the root information appears for the file path. This is required when an application passes an incomplete or badly formed file path when it tries to retrieve the drive type on which the file path exists.|
+|GlobalMemoryStatusLie|The problem is indicated by a Computer memory full error message that displays when you start an application.
The fix modifies the memory status structure, so that it reports a swap file that is 400 MB, regardless of the true swap file size.|
+|HandleBadPtr|The problem is indicated by an access violation error message that displays because an API is performing pointer validation before it uses a parameter.
The fix supports using lpBuffer validation from the InternetSetOptionA and InternetSetOptionW functions to perform the more parameter validation.|
+|HandleMarkedContentNotIndexed|The problem is indicated by an application that fails when it changes an attribute on a file or directory.
The fix intercepts any API calls that return file attributes and directories that are invoked from the %TEMP% directory, and resets the FILE_ATTRIBUTE_NOT_CONTENT_INDEXED attribute to its original state.|
+|HeapClearAllocation|The problem is indicated when the allocation process shuts down unexpectedly.
The fix uses zeros to clear out the heap allocation for an application.|
+|IgnoreAltTab|The problem occurs when an application fails to function when special key combinations are used.
The fix intercepts the RegisterRawInputDevices API and prevents the delivery of the WM_INPUT messages. This delivery failure forces the included hooks to be ignored and forces DInput to use Windows-specific hooks.
**Note:** For more detailed information about this application fix, see [Using the IgnoreAltTab Fix](/previous-versions/windows/it-pro/windows-7/cc722093(v=ws.10)).
|
+|IgnoreChromeSandbox|The fix allows Google Chrome to run on systems that have ntdll loaded above 4 GB.|
+|IgnoreDirectoryJunction|The problem is indicated by a read or access violation error message that displays when an application tries to find or open files.
The fix links the FindNextFileW, FindNextFileA, FindFirstFileExW, FindFirstFileExA, FindFirstFileW, and FindFirstFileA APIs to prevent them from returning directory junctions.
**Note:** Symbolic links appear to start in Windows Vista.
|
+|IgnoreException|The problem is indicated when an application stops functioning immediately after it starts, or the application starts with only a cursor appearing on the screen.
The fix enables the application to ignore specified exceptions. By default, this fix ignores privileged-mode exceptions; however, it can be configured to ignore any exception.
You can control this fix further by typing the following command at the command prompt:
`Exception1;Exception2` Where Exception1 and Exception2 are specific exceptions to be ignored. For example: ACCESS_VIOLATION_READ:1;ACCESS_VIOLATION_WRITE:1.
**Important:** You should use this compatibility fix only if you are certain that it is acceptable to ignore the exception. You might experience more compatibility issues if you choose to incorrectly ignore an exception.
**Note:** For more detailed information about this application fix, see [Using the IgnoreException Fix](/previous-versions/windows/it-pro/windows-7/cc766154(v=ws.10)).
|
+|IgnoreFloatingPointRoundingControl|This fix enables an application to ignore the rounding control request and to behave as expected in previous versions of the application.
Before floating point SSE2 support in the C runtime library, the rounding control request was being ignored which would use round to nearest option by default. This shim ignores the rounding control request to support applications relying on old behavior.|
+|IgnoreFontQuality|The problem occurs when application text appears to be distorted.
The fix enables color-keyed fonts to properly work with anti-aliasing.|
+|IgnoreMessageBox|The problem is indicated by a message box that displays with debugging or extraneous content when the application runs on an unexpected operating system.
The fix intercepts the MessageBox* APIs and inspects them for specific message text. If matching text is found, the application continues without showing the message box.
**Note:** For more detailed information about this application fix, see [Using the IgnoreMessageBox Fix](/previous-versions/windows/it-pro/windows-7/cc749044(v=ws.10)).
|
+|IgnoreMSOXMLMF|The problem is indicated by an error message that states that the operating system cannot locate the MSVCR80D.DLL file.
The fix ignores the registered MSOXMLMF.DLL object, which Microsoft® Office 2007 loads into the operating system anytime that you load an XML file, and then it fails the CoGetClassObject for its CLSID. This compatibility fix will just ignore the registered MSOXMLMF and fail the CoGetClassObject for its CLSID.|
+|IgnoreSetROP2|The fix ignores read-modify-write operations on the desktop to avoid performance issues.|
+|InstallComponent|The fix prompts the user to install.Net 3.5 or .NET 2.0 because .NET is not included with Windows 8.|
+|LoadLibraryRedirect|The fix forces an application to load system versions of libraries instead of loading redistributable versions that shipped with the application.|
+|LocalMappedObject|The problem occurs when an application unsuccessfully tries to create an object in the Global namespace.
The fix intercepts the function call to create the object and replaces the word Global with Local.
**Note:** For more detailed information about this application fix, see [Using the LocalMappedObject Fix](/previous-versions/windows/it-pro/windows-7/cc749287(v=ws.10)).
|
+|MakeShortcutRunas|The problem is indicated when an application fails to uninstall because of access-related errors.
The fix locates any RunDLL.exe-based uninstallers and forces them to run with different credentials during the application installation. After it applies this fix, the installer will create a shortcut that specifies a matching string to run during the application installation, thereby enabling the uninstallation to occur later.
**Note:** For more detailed information about this application fix, see [Using the MakeShortcutRunas Fix](/previous-versions/windows/it-pro/windows-7/dd638338(v=ws.10))
|
+|ManageLinks|The fix intercepts common APIs that are going to a directory or to an executable (.exe) file, and then converts any symbolic or directory junctions before passing it back to the original APIs.|
+|MirrorDriverWithComposition|The fix allows mirror drivers to work properly with acceptable performance with desktop composition.|
+|MoveToCopyFileShim|The problem occurs when an application experiences security access issues during setup.
The fix forces the CopyFile APIs to run instead of the MoveFile APIs. CopyFile APIs avoid moving the security descriptor, which enables the application files to get the default descriptor of the destination folder and prevents the security access issue.|
+|OpenDirectoryAcl|The problem is indicated by an error message that states that you do not have the appropriate permissions to access the application.
The fix reduces the security privilege levels on a specified set of files and folders.
**Note:** For more detailed information about this application fix, see [Using the OpenDirectoryACL Fix](/previous-versions/windows/it-pro/windows-7/dd638417(v=ws.10)).
|
+|PopCapGamesForceResPerf|The fix resolves the performance issues in PopCap games like Bejeweled2. The performance issues are visible in certain low-end cards at certain resolutions where the 1024x768 buffer is scaled to fit the display resolution.|
+|PreInstallDriver|The fix preinstalls drivers for applications that would otherwise try to install or start drivers during the initial start process.|
+|PreInstallSmarteSECURE|The fix preinstalls computer-wide CLSIDs for applications that use SmartSECURE copy protection, which would otherwise try to install the CLSIDs during the initial start process.|
+|ProcessPerfData|The problem is indicated by an Unhandled Exception error message because the application tried to read the process performance data registry value to determine if another instance of the application is running.
The fix handles the failure case by passing a fake process performance data registry key, so that the application perceives that it is the only instance running.
**Note:** This issue seems to occur most frequently with .NET applications.|
+|PromoteDAM|The fix registers an application for power state change notifications.
|
+|PropagateProcessHistory|The problem occurs when an application incorrectly fails to apply an application fix.
The fix sets the _PROCESS_HISTORY environment variable so that child processes can look in the parent directory for matching information while searching for application fixes.|
+|ProtectedAdminCheck|The problem occurs when an application fails to run because of incorrect Protected Administrator permissions.
The fix addresses the issues that occur when applications use non-standard Administrator checks, thereby generating false positives for user accounts that are being run as Protected Administrators. In this case, the associated SID exists, but it is set as deny-only.|
+|RedirectCRTTempFile|The fix intercepts failing CRT calls that try to create a temporary file at the root of the volume, thereby redirecting the calls to a temporary file in the user's temporary directory.|
+|RedirectHKCUKeys|The problem occurs when an application cannot be accessed because of User Account Control (UAC) restrictions.
The fix duplicates any newly created HKCU keys to other users' HKCU accounts. This fix is generic for UAC restrictions, whereby the HKCU keys are required, but are unavailable to an application at runtime.|
+|RedirectMP3Codec|This problem occurs when you cannot play MP3 files.
The fix intercepts the CoCreateInstance call for the missing filter and then redirects it to a supported version.|
+|RedirectShortcut|The problem occurs when an application cannot be accessed by its shortcut, or application shortcuts are not removed during the application uninstallation process.
The fix redirects all of the shortcuts created during the application setup to appear according to a specified path.
Start Menu shortcuts: Appear in the \ProgramData\Microsoft\Windows\Start Menu directory for all users. Desktop or Quick Launch shortcuts: You must manually place the shortcuts on the individual user's desktop or Quick Launch bar.
This issue occurs because of UAC restrictions: specifically, when an application setup runs by using elevated privileges and stores the shortcuts according to the elevated user's context. In this situation, a restricted user cannot access the shortcuts.
You cannot apply this fix to an .exe file that includes a manifest and provides a run level.|
+|RelaunchElevated|The problem occurs when installers, uninstallers, or updaters fail when they are started from a host application.
The fix enables a child .exe file to run with elevated privileges when it is difficult to determine the parent process with either the ElevateCreateProcess fix or by marking the .exe files to RunAsAdmin.
**Note:** For more detailed information about this application fix, see [Using the RelaunchElevated Fix](/previous-versions/windows/it-pro/windows-7/dd638373(v=ws.10)).
|
+|RetryOpenSCManagerWithReadAccess|The problem occurs when an application tries to open the Service Control Manager (SCM) and receives an Access Denied error message.
The fix retries the call and requests a more restricted set of rights that include the following:
SC_MANAGER_CONNECT
SC_MANAGER_ENUMERATE_SERVICE
SC_MANAGER_QUERY_LOCK_STATUS
STANDARD_READ_RIGHTS
**Note:** For more detailed information about this application fix, see [Using the RetryOpenSCManagerwithReadAccess Fix](/previous-versions/windows/it-pro/windows-7/cc721915(v=ws.10)).
|
+|RetryOpenServiceWithReadAccess|The problem occurs when an Unable to open service due to your application using the OpenService() API to test for the existence of a particular service error message displays.
The fix retries the OpenService() API call and verifies that the user has Administrator rights, is not a Protected Administrator, and by using read-only access. Applications can test for the existence of a service by calling the OpenService() API but some applications ask for all access when making this check. This fix retries the call but only asking for read-only access. The user needs to be an administrator for this to work
**Note:** For more detailed information about this application fix, see [Using the RetryOpenServiceWithReadAccess Fix](/previous-versions/windows/it-pro/windows-7/cc766423(v=ws.10)).
|
+|RunAsAdmin|The problem occurs when an application fails to function by using the Standard User or Protected Administrator account.
The fix enables the application to run by using elevated privileges. The fix is the equivalent of specifying requireAdministrator in an application manifest.
**Note:** For more detailed information about this application fix, see [Using the RunAsAdmin Fix](/previous-versions/windows/it-pro/windows-7/dd638315(v=ws.10)).
|
+|RunAsHighest|The problem occurs when administrators cannot view the read/write version of an application that presents a read-only view to standard users.
The fix enables the application to run by using the highest available permissions. This is the equivalent of specifying highestAvailable in an application manifest.
**Note:** For more detailed information about this application fix, see [Using the RunAsHighest Fix](/previous-versions/windows/it-pro/windows-7/dd638322(v=ws.10)).
|
+|RunAsInvoker|The problem occurs when an application is not detected as requiring elevation.
The fix enables the application to run by using the privileges that are associated with the creation process, without requiring elevation. This is the equivalent of specifying asInvoker in an application manifest.
**Note:** For more detailed information about this application fix, see [Using the RunAsInvoker Fix](/previous-versions/windows/it-pro/windows-7/dd638389(v=ws.10)).
|
+|SecuROM7|The fix repairs applications by using SecuROM7 for copy protection.|
+|SessionShim|The fix intercepts API calls from applications that are trying to interact with services that are running in another session, by using the terminal service name prefix (Global or Local) as the parameter.
At the command prompt, you can supply a list of objects to modify, separating the values by a double backslash (). Or, you can choose not to include any parameters, so that all of the objects are modified.
**Important:** Users cannot log in as Session 0 (Global Session) in Windows Vista and later. Therefore, applications that require access to Session 0 automatically fail.
**Note:** For more detailed information about this application fix, see [Using the SessionShim Fix](/previous-versions/windows/it-pro/windows-7/cc722085(v=ws.10)).
|
+|SetProtocolHandler|The fix registers an application as a protocol handler.
You can control this fix further by typing the following command at the command prompt:`Client;Protocol;App` Where the Client is the name of the email protocol, Protocol is mailto, and App is the name of the application.
**Note:** Only the mail client and the mailto protocol are supported. You can separate multiple clients by using a backslash ().
|
+|SetupCommitFileQueueIgnoreWow|The problem occurs when a 32-bit setup program fails to install because it requires 64-bit drivers.
The fixdisables the Wow64 file system that is used by the 64-bit editions of Windows, to prevent 32-bit applications from accessing 64-bit file systems during the application setup.|
+|SharePointDesigner2007|The fix resolves an application bug that severely slows the application when it runs in DWM.|
+|ShimViaEAT|The problem occurs when an application fails, even after applying acompatibility fix that is known to fix an issue. Applications that use unicows.dll or copy protection often present this issue.
The fixapplies the specified compatibility fixes by modifying the export table and by nullifying the use of module inclusion and exclusion.
**Note:** For more information about this application fix, see [Using the ShimViaEAT Fix](/previous-versions/windows/it-pro/windows-7/cc766286(v=ws.10)).
|
+|ShowWindowIE|The problem occurs when a web application experiences navigation and display issues because of the tabbing feature.
The fixintercepts the ShowWindow API call to address the issues that can occur when a web application determines that it is in a child window. This fix calls the real ShowWindow API on the top-level parent window.|
+|SierraWirelessHideCDROM|The fix repairs the Sierra Wireless Driver installation, thereby preventing bugcheck.|
+|Sonique2|The application uses an invalid window style, which breaks in DWM. This fix replaces the window style with a valid value.|
+|SpecificInstaller|The problem occurs when an application installation file fails to be picked up by the GenericInstaller function.
The fixflags the application as being an installer file (for example, setup.exe), and then prompts for elevation.
**Note:** For more detailed information about this application fix, see [Using the SpecificInstaller Fix](/previous-versions/windows/it-pro/windows-7/dd638397(v=ws.10)).
|
+|SpecificNonInstaller|The problem occurs when an application that is not an installer (and has sufficient privileges) generates a false positive from the GenericInstaller function.
The fixflags the application to exclude it from detection by the GenericInstaller function.
**Note:** For more detailed information about this application fix, see [Using the SpecificNonInstaller Fix](/previous-versions/windows/it-pro/windows-7/dd638326(v=ws.10)).
|
+|SystemMetricsLie|The fix replaces SystemMetrics values and SystemParametersInfo values with the values of previous Windows versions.|
+|TextArt|The application receives different mouse coordinates with DWM ON versus DWM OFF, which causes the application to hang. This fix resolves the issue.|
+|TrimDisplayDeviceNames|The fix trims the names of the display devices that are returned by the EnumDisplayDevices API.|
+|UIPICompatLogging|The fix enables the logging of Windows messages from Internet Explorer and other processes.|
+|UIPIEnableCustomMsgs|The problem occurs when an application does not properly communicate with other processes because customized Windows messages are not delivered.
The fixenables customized Windows messages to pass through to the current process from a lower Desktop integrity level. This fix is the equivalent of calling the RegisterWindowMessage function, followed by the ChangeWindowMessageFilter function in the code.
You can control this fix further by typing the following command at the command prompt:
`MessageString1 MessageString2` Where MessageString1 and MessageString2 reflect the message strings that can pass.
**Note:** Multiple message strings must be separated by spaces. For more detailed information about this application fix, see [Using the UIPIEnableCustomMsgs Fix](/previous-versions/windows/it-pro/windows-7/dd638320(v=ws.10)).
|
+|UIPIEnableStandardMsgs|The problem occurs when an application does not communicate properly with other processes because standard Windows messages are not delivered.
The fixenables standard Windows messages to pass through to the current process from a lower Desktop integrity level. This fix is the equivalent of calling the ChangeWindowMessageFilter function in the code.
You can control this fix further by typing the following command at the command prompt:
`1055 1056 1069`
Where 1055 reflects the first message ID, 1056 reflects the second message ID, and 1069 reflects the third message ID that can pass.
**Note:** Multiple messages can be separated by spaces. For more detailed information about this application fix, see [Using the UIPIEnableStandardMsgs Fix [act]](/previous-versions/windows/it-pro/windows-7/dd638361(v=ws.10)).
|
+|VirtualizeDeleteFileLayer|The fix virtualizes DeleteFile operations for applications that try to delete protected files.|
+|VirtualizeDesktopPainting|This fix improves the performance of a number of operations on the Desktop DC while using DWM.|
+|VirtualRegistry|The problem is indicated when a Component failed to be located error message displays when an application is started.
The fixenables the registry functions to allow for virtualization, redirection, expansion values, version spoofing, the simulation of performance data counters, and so on.
For more detailed information about this application fix, see [Using the VirtualRegistry Fix](/previous-versions/windows/it-pro/windows-7/cc749368(v=ws.10)).|
+|VirtualizeDeleteFile|The problem occurs when several error messages display and the application cannot delete files.
The fixmakes the application's DeleteFile function call a virtual call in an effort to remedy the UAC and file virtualization issues that were introduced with Windows Vista. This fix also links other file APIs (for example, GetFileAttributes) to ensure that the virtualization of the file is deleted.
**Note:** For more detailed information about this application fix, see [Using the VirtualizeDeleteFile Fix](/previous-versions/windows/it-pro/windows-7/dd638360(v=ws.10)).
|
+|VirtualizeHKCRLite|The problem occurs when an application fails to register COM components at runtime.
The fixredirects the HKCR write calls (HKLM) to the HKCU hive for a per-user COM registration. This operates much like the VirtualRegistry fix when you use the VirtualizeHKCR parameter; however, VirtualizeHKCRLite provides better performance.
HKCR is a virtual merge of the HKCU\Software\Classes and HKLM\Software\Classes directories. The use of HKCU is preferred if an application is not elevated and is ignored if the application is elevated.
You typically will use this compatibility fix in conjunction with the VirtualizeRegisterTypeLib fix. For more detailed information about this application fix, see [Using the VirtualizeHKCRLite Fix](/previous-versions/windows/it-pro/windows-7/dd638327(v=ws.10)).|
+|VirtualizeRegisterTypeLib|The fix, when it is used with the VirtualizeHKCRLite fix, ensures that the type library and the COM class registration happen simultaneously. This functions much like the RegistryTypeLib fix when the RegisterTypeLibForUser parameter is used.
**Note:** For more detailed information about this application fix, see [Using the VirtualizeRegisterTypelib Fix](/previous-versions/windows/it-pro/windows-7/dd638385(v=ws.10)).
|
+|WaveOutIgnoreBadFormat|This problem is indicated by an error message that states: Unable to initialize sound device from your audio driver; the application then closes.
The fixenables the application to ignore the format error and continue to function properly.|
+|WerDisableReportException|The fix turns off the silent reporting of exceptions to the Windows Error Reporting tool, including those that are reported by Object Linking and Embedding-Database (OLE DB). The fix intercepts the RtlReportException API and returns a STATUS_NOT_SUPPORTED error message.|
+|Win7RTM/Win8RTM|The layer provides the application with Windows 7/Windows 8 compatibility mode.|
+|WinxxRTMVersionLie|The problem occurs when an application fails because it does not find the correct version number for the required Windows operating system.
All version lie compatibility fixes address the issue whereby an application fails to function because it is checking for, but not finding, a specific version of the operating system. The version lie fix returns the appropriate operating system version information. For example, the VistaRTMVersionLie returns the Windows Vista version information to the application, regardless of the actual operating system version that is running on the computer.|
+|Wing32SystoSys32|The problem is indicated by an error message that states that the WinG library was not properly installed.
The fixdetects whether the WinG32 library exists in the correct directory. If the library is located in the wrong location, this fix copies the information (typically during the runtime of the application) into the %WINDIR% \system32 directory.
**Important:** The application must have Administrator privileges for this fix to work.|
+|WinSrv08R2RTM||
+|WinXPSP2VersionLie|The problem occurs when an application experiences issues because of a VB runtime DLL.
The fixforces the application to follow these steps:
Open the Compatibility Administrator, and then select None for Operating System Mode.
On the Compatibility Fixes page, click WinXPSP2VersionLie, and then click Parameters.
The Options for <fix_name> dialog box appears.
Type vbrun60.dll into the Module Name box, click Include, and then click Add.
Save the custom database.
**Note:** For more information about the WinXPSP2VersionLie application fix, see [Using the WinXPSP2VersionLie Fix](/previous-versions/windows/it-pro/windows-7/cc749518(v=ws.10)).
|
+|WRPDllRegister|The application fails when it tries to register a COM component that is released together with Windows Vista and later.
The fixskips the processes of registering and unregistering WRP-protected COM components when calling the DLLRegisterServer and DLLUnregisterServer functions.
You can control this fix further by typing the following command at the command prompt:
`Component1.dll;Component2.dll` Where Component1.dll and Component2.dll reflect the components to be skipped.
**Note:** For more detailed information about this application fix, see [Using the WRPDllRegister Fix](/previous-versions/windows/it-pro/windows-7/dd638345(v=ws.10)).
|
+|WRPMitigation|The problem is indicated when an access denied error message displays when the application tries to access a protected operating system resource by using more than read-only access.
The fixemulates the successful authentication and modification of file and registry APIs, so that the application can continue.
**Note:** For more detailed information about WRPMitigation, see [Using the WRPMitigation Fix](/previous-versions/windows/it-pro/windows-7/dd638325(v=ws.10)).
|
+|WRPRegDeleteKey|The problem is indicated by an access denied error message that displays when the application tries to delete a registry key.
The fixverifies whether the registry key is WRP-protected. If the key is protected, this fix emulates the deletion process.|
+|XPAfxIsValidAddress|The fix emulates the behavior of Windows XP for MFC42!AfxIsValidAddress.|
## Compatibility Modes
-
The following table lists the known compatibility modes.
-
-
-
-
-
-
-
-
-
Compatibility Mode Name
-
Description
-
Included Compatibility Fixes
-
-
-
-
-
WinSrv03
-
Emulates the Windows Server 2003 operating system.
-
-
Win2k3RTMVersionLie
-
VirtualRegistry
-
ElevateCreateProcess
-
EmulateSorting
-
FailObsoleteShellAPIs
-
LoadLibraryCWD
-
HandleBadPtr
-
GlobalMemoryStatus2GB
-
RedirectMP3Codec
-
EnableLegacyExceptionHandlinginOLE
-
NoGhost
-
HardwareAudioMixer
-
-
-
-
WinSrv03Sp1
-
Emulates the Windows Server 2003 with Service Pack 1 (SP1) operating system.
-
-
Win2K3SP1VersionLie
-
VirtualRegistry
-
ElevateCreateProcess
-
EmulateSorting
-
FailObsoleteShellAPIs
-
LoadLibraryCWD
-
HandleBadPtr
-
EnableLegacyExceptionHandlinginOLE
-
RedirectMP3Codec
-
HardwareAudioMixer
-
-
-
-
\ No newline at end of file
+|Compatibility Mode Name|Description|Included Compatibility Fixes|
+|--- |--- |--- |
+|WinSrv03|Emulates the Windows Server 2003 operating system.|
Win2k3RTMVersionLie
VirtualRegistry
ElevateCreateProcess
EmulateSorting
FailObsoleteShellAPIs
LoadLibraryCWD
HandleBadPtr
GlobalMemoryStatus2GB
RedirectMP3Codec
EnableLegacyExceptionHandlinginOLE
NoGhost
HardwareAudioMixer|
+|WinSrv03Sp1|Emulates the Windows Server 2003 with Service Pack 1 (SP1) operating system.|
Win2K3SP1VersionLie
VirtualRegistry
ElevateCreateProcess
EmulateSorting
FailObsoleteShellAPIs
LoadLibraryCWD
HandleBadPtr
EnableLegacyExceptionHandlinginOLE
RedirectMP3Codec
HardwareAudioMixer|
\ No newline at end of file
diff --git a/windows/deployment/planning/deployment-considerations-for-windows-to-go.md b/windows/deployment/planning/deployment-considerations-for-windows-to-go.md
index 51718fd6c5..bbc4a4bf6b 100644
--- a/windows/deployment/planning/deployment-considerations-for-windows-to-go.md
+++ b/windows/deployment/planning/deployment-considerations-for-windows-to-go.md
@@ -78,145 +78,27 @@ Wi-Fi network adapter drivers are one of the most important drivers to make sure
The following list of commonly used Wi-Fi network adapters that are not supported by the default drivers provided with Windows 10 is provided to help you ascertain whether or not you need to add drivers to your image.
-
-
-
-
-
-
-
-
-
-
Vendor name
-
Product description
-
HWID
-
Windows Update availability
-
-
-
Broadcom
-
802.11abgn Wireless SDIO adapter
-
sd\vid_02d0&pid_4330&fn_1
-
Contact the system OEM or Broadcom for driver availability.
-
-
-
Broadcom
-
802.11n Network Adapter
-
pci\ven_14e4&dev_4331&subsys_00d6106b&rev_02
-
Contact the system OEM or Broadcom for driver availability.
-
-
-
Broadcom
-
802.11n Network Adapter
-
pci\ven_14e4&dev_4331&subsys_00f5106b&rev_02
-
Contact the system OEM or Broadcom for driver availability.
-
-
-
Broadcom
-
802.11n Network Adapter
-
pci\ven_14e4&dev_4331&subsys_00ef106b&rev_02
-
Contact the system OEM or Broadcom for driver availability.
-
-
-
Broadcom
-
802.11n Network Adapter
-
pci\ven_14e4&dev_4331&subsys_00f4106b&rev_02
-
Contact the system OEM or Broadcom for driver availability.
-
-
-
Broadcom
-
802.11n Network Adapter
-
pci\ven_14e4&dev_4331&subsys_010e106b&rev_02
-
Contact the system OEM or Broadcom for driver availability.
-
-
-
Broadcom
-
802.11n Network Adapter
-
pci\ven_14e4&dev_4331&subsys_00e4106b&rev_02
-
Contact the system OEM or Broadcom for driver availability.
-
-
-
Broadcom
-
802.11n Network Adapter
-
pci\ven_14e4&dev_4331&subsys_433114e4&rev_02
-
Contact the system OEM or Broadcom for driver availability.
-
-
-
Broadcom
-
802.11n Network Adapter
-
pci\ven_14e4&dev_4331&subsys_010f106b&rev_02
-
Contact the system OEM or Broadcom for driver availability.
+|Vendor name|Product description|HWID|Windows Update availability|
+|--- |--- |--- |--- |
+|Broadcom|802.11abgn Wireless SDIO adapter|sd\vid_02d0&pid_4330&fn_1|Contact the system OEM or Broadcom for driver availability.|
+|Broadcom|802.11n Network Adapter|pci\ven_14e4&dev_4331&subsys_00d6106b&rev_02|Contact the system OEM or Broadcom for driver availability.|
+|Broadcom|802.11n Network Adapter|pci\ven_14e4&dev_4331&subsys_00f5106b&rev_02|Contact the system OEM or Broadcom for driver availability.|
+|Broadcom|802.11n Network Adapter|pci\ven_14e4&dev_4331&subsys_00ef106b&rev_02|Contact the system OEM or Broadcom for driver availability.|
+|Broadcom|802.11n Network Adapter|pci\ven_14e4&dev_4331&subsys_00f4106b&rev_02|Contact the system OEM or Broadcom for driver availability.|
+|Broadcom|802.11n Network Adapter|pci\ven_14e4&dev_4331&subsys_010e106b&rev_02|Contact the system OEM or Broadcom for driver availability.|
+|Broadcom|802.11n Network Adapter|pci\ven_14e4&dev_4331&subsys_00e4106b&rev_02|Contact the system OEM or Broadcom for driver availability.|
+|Broadcom|802.11n Network Adapter|pci\ven_14e4&dev_4331&subsys_433114e4&rev_02|Contact the system OEM or Broadcom for driver availability.|
+|Broadcom|802.11n Network Adapter|pci\ven_14e4&dev_4331&subsys_010f106b&rev_02|Contact the system OEM or Broadcom for driver availability.|
+|Marvell|Yukon 88E8001/8003/8010 PCI Gigabit Ethernet|pci\ven_11ab&dev_4320&subsys_811a1043|[32-bit driver](https://go.microsoft.com/fwlink/p/?LinkId=619080) [64-bit driver](https://go.microsoft.com/fwlink/p/?LinkId=619082)|
+|Marvell|Libertas 802.11b/g Wireless|pci\ven_11ab&dev_1faa&subsys_6b001385&rev_03|[32-bit driver](https://go.microsoft.com/fwlink/p/?LinkId=619128) [64-bit driver](https://go.microsoft.com/fwlink/p/?LinkId=619129)|
+|Qualcomm|Atheros AR6004 Wireless LAN Adapter|sd\vid_0271&pid_0401|[32-bit driver](https://go.microsoft.com/fwlink/p/?LinkId=619086) 64-bit driver not available|
+|Qualcomm|Atheros AR5BWB222 Wireless Network Adapter|pci\ven_168c&dev_0034&subsys_20031a56|[32-bit driver](https://go.microsoft.com/fwlink/p/?LinkId=619348) 64-bit driver not available|
+|Qualcomm|Atheros AR5BWB222 Wireless Network Adapter|pci\ven_168c&dev_0034&subsys_020a1028&rev_01|Contact the system OEM or Qualcom for driver availability.|
+|Qualcomm|Atheros AR5005G Wireless Network Adapter|pci\ven_168c&dev_001a&subsys_04181468&rev_01|[32-bit driver](https://go.microsoft.com/fwlink/p/?LinkId=619349)
[64-bit driver](https://go.microsoft.com/fwlink/p/?LinkId=619093)|
+|Ralink|Turbo Wireless LAN Card|pci\ven_1814&dev_0301&subsys_25611814&rev_00|[32-bit driver](https://go.microsoft.com/fwlink/p/?LinkId=619094)
[64-bit driver](https://go.microsoft.com/fwlink/p/?LinkId=619095)|
+|Ralink|Wireless LAN Card V1|pci\ven_1814&dev_0302&subsys_3a711186&rev_00|[32-bit driver](https://go.microsoft.com/fwlink/p/?LinkId=619097)
[64-bit driver](https://go.microsoft.com/fwlink/p/?LinkId=619098)|
+|Ralink|D-Link AirPlus G DWL-G510 Wireless PCI Adapter(rev.C)|pci\ven_1814&dev_0302&subsys_3c091186&rev_00|[32-bit driver](https://go.microsoft.com/fwlink/p/?LinkId=619099)
[64-bit driver](https://go.microsoft.com/fwlink/p/?LinkId=619100)|
IT administrators that want to target Windows To Go images for specific systems should test their images to ensure that the necessary system drivers are in the image, especially for critical functionality like Wi-Fi that is not supported by class drivers. Some consumer devices require OEM-specific driver packages, which may not be available on Windows Update. For more information on how to add a driver to a Windows Image, please refer to the [Basic Windows Deployment Step-by-Step Guide](/previous-versions/windows/it-pro/windows-8.1-and-8/hh825212(v=win.10)).
@@ -283,14 +165,13 @@ Windows To Go Startup Options is a setting available on Windows 10-based PCs tha
1. On the Start screen, type, type **Windows To Go Startup Options**, click **Settings** and, then press Enter.
- 
+ 
2. Select **Yes** to enable the startup options.
> [!TIP]
> If your computer is part of a domain, the Group Policy setting can be used to enable the startup options instead of the dialog.
-
3. Click **Save Changes**. If the User Account Control dialog box is displayed, confirm that the action it displays is what you want, and then click **Yes**.
### Change firmware settings
diff --git a/windows/deployment/planning/fixing-applications-by-using-the-sua-tool.md b/windows/deployment/planning/fixing-applications-by-using-the-sua-tool.md
index ea3a21ed29..c8cdbe2b03 100644
--- a/windows/deployment/planning/fixing-applications-by-using-the-sua-tool.md
+++ b/windows/deployment/planning/fixing-applications-by-using-the-sua-tool.md
@@ -37,33 +37,11 @@ On the user interface for the Standard User Analyzer (SUA) tool, you can apply f
3. On the **Mitigation** menu, click the command that corresponds to the action that you want to take. The following table describes the commands.
-
-
-
-
-
-
-
-
Mitigation menu command
-
Description
-
-
-
-
-
Apply Mitigations
-
Opens the Mitigate AppCompat Issues dialog box, in which you can select the fixes that you intend to apply to the application.
-
-
-
Undo Mitigations
-
Removes the application fixes that you just applied.
-
This option is available only after you apply an application fix and before you close the SUA tool. Alternatively, you can manually remove application fixes by using Programs and Features in Control Panel.
-
-
-
Export Mitigations as Windows Installer file
-
Exports your application fixes as a Windows® Installer (.msi) file, which can then be deployed to other computers that are running the application.
-
-
-
+ |Mitigation menu command|Description|
+ |--- |--- |
+ |**Apply Mitigations**|Opens the **Mitigate AppCompat Issues** dialog box, in which you can select the fixes that you intend to apply to the application.|
+ |**Undo Mitigations**|Removes the application fixes that you just applied.
This option is available only after you apply an application fix and before you close the SUA tool. Alternatively, you can manually remove application fixes by using **Programs and Features** in Control Panel.|
+ |**Export Mitigations as Windows Installer file**|Exports your application fixes as a Windows® Installer (.msi) file, which can then be deployed to other computers that are running the application.|
diff --git a/windows/deployment/planning/managing-application-compatibility-fixes-and-custom-fix-databases.md b/windows/deployment/planning/managing-application-compatibility-fixes-and-custom-fix-databases.md
index 3aac6db8f1..54b272cb6c 100644
--- a/windows/deployment/planning/managing-application-compatibility-fixes-and-custom-fix-databases.md
+++ b/windows/deployment/planning/managing-application-compatibility-fixes-and-custom-fix-databases.md
@@ -31,37 +31,14 @@ This section provides information about managing your application-compatibility
## In this section
-
-
As the Windows operating system evolves to support new technology and functionality, the implementations of some functions may change. This can cause problems for applications that relied upon the original implementation. You can avoid compatibility issues by using the Microsoft Windows Application Compatibility (Compatibility Fix) infrastructure to create a specific application fix for a particular version of an application.
After you determine that you will use compatibility fixes in your application-compatibility mitigation strategy, you must define a strategy to manage your custom compatibility-fix database. Typically, you can use one of two approaches:
This topic provides details about testing your application-mitigation packages, including recommendations about how to report your information and how to resolve any outstanding issues.
-
-
-
-
-
+|Topic|Description|
+|--- |--- |
+|[Understanding and Using Compatibility Fixes](understanding-and-using-compatibility-fixes.md)|As the Windows operating system evolves to support new technology and functionality, the implementations of some functions may change. This can cause problems for applications that relied upon the original implementation. You can avoid compatibility issues by using the Microsoft Windows Application Compatibility (Compatibility Fix) infrastructure to create a specific application fix for a particular version of an application.|
+|[Compatibility Fix Database Management Strategies and Deployment](compatibility-fix-database-management-strategies-and-deployment.md)|After you determine that you will use compatibility fixes in your application-compatibility mitigation strategy, you must define a strategy to manage your custom compatibility-fix database. Typically, you can use one of two approaches:|
+|[Testing Your Application Mitigation Packages](testing-your-application-mitigation-packages.md)|This topic provides details about testing your application-mitigation packages, including recommendations about how to report your information and how to resolve any outstanding issues.|
## Related topics
+
[Compatibility Administrator User's Guide](compatibility-administrator-users-guide.md)
[Using the Compatibility Administrator Tool](using-the-compatibility-administrator-tool.md)
diff --git a/windows/deployment/planning/searching-for-installed-compatibility-fixes-with-the-query-tool-in-compatibility-administrator.md b/windows/deployment/planning/searching-for-installed-compatibility-fixes-with-the-query-tool-in-compatibility-administrator.md
index 6135a8daf8..b225fd6214 100644
--- a/windows/deployment/planning/searching-for-installed-compatibility-fixes-with-the-query-tool-in-compatibility-administrator.md
+++ b/windows/deployment/planning/searching-for-installed-compatibility-fixes-with-the-query-tool-in-compatibility-administrator.md
@@ -105,8 +105,7 @@ You can use the **Fix Description** tab of the Query tool to add parameters that
The query runs and the results of the query are displayed in the lower pane.
-## Querying by Using the Fix Description Tab
-
+## Querying by Using the Advanced Tab
You can use the **Fix Description** tab of the Query tool to add additional SQL Server SELECT and WHERE clauses to your search criteria.
diff --git a/windows/deployment/planning/showing-messages-generated-by-the-sua-tool.md b/windows/deployment/planning/showing-messages-generated-by-the-sua-tool.md
index d4b510cd08..69a2bc6507 100644
--- a/windows/deployment/planning/showing-messages-generated-by-the-sua-tool.md
+++ b/windows/deployment/planning/showing-messages-generated-by-the-sua-tool.md
@@ -37,41 +37,12 @@ On the user interface for the Standard User Analyzer (SUA) tool, you can show th
3. On the **View** menu, click the command that corresponds to the messages that you want to see. The following table describes the commands.
-
-
-
-
-
-
-
-
View menu command
-
Description
-
-
-
-
-
Error Messages
-
When this command is selected, the user interface shows error messages that the SUA tool has generated. Error messages are highlighted in pink.
-
This command is selected by default.
-
-
-
Warning Messages
-
When this command is selected, the user interface shows warning messages that the SUA tool has generated. Warning messages are highlighted in yellow.
-
-
-
Information Messages
-
When this command is selected, the user interface shows informational messages that the SUA tool has generated. Informational messages are highlighted in green.
-
-
-
Detailed Information
-
When this command is selected, the user interface shows information that the SUA tool has generated, such as debug, stack trace, stop code, and severity information.
-
-
-
-
-
-
-
+|View menu command|Description|
+|--- |--- |
+|**Error Messages**|When this command is selected, the user interface shows error messages that the SUA tool has generated. Error messages are highlighted in pink.
This command is selected by default.|
+|**Warning Messages**|When this command is selected, the user interface shows warning messages that the SUA tool has generated. Warning messages are highlighted in yellow.|
+|**Information Messages**|When this command is selected, the user interface shows informational messages that the SUA tool has generated. Informational messages are highlighted in green.|
+|**Detailed Information**|When this command is selected, the user interface shows information that the SUA tool has generated, such as debug, stack trace, stop code, and severity information.|
diff --git a/windows/deployment/planning/sua-users-guide.md b/windows/deployment/planning/sua-users-guide.md
index 2d34aa8326..d3fad3aced 100644
--- a/windows/deployment/planning/sua-users-guide.md
+++ b/windows/deployment/planning/sua-users-guide.md
@@ -38,33 +38,9 @@ You can use SUA in either of the following ways:
## In this section
-
-
The Standard User Analyzer (SUA) Wizard works much like the SUA tool to evaluate User Account Control (UAC) issues. However, the SUA Wizard does not offer detailed analysis, and it cannot disable virtualization or elevate your permissions.
By using the Standard User Analyzer (SUA) tool, you can test your applications and monitor API calls to detect compatibility issues with the User Account Control (UAC) feature.
-
-
-
-
-
-
-
-
+|Topic|Description|
+|--- |--- |
+|[Using the SUA Wizard](using-the-sua-wizard.md)|The Standard User Analyzer (SUA) Wizard works much like the SUA tool to evaluate User Account Control (UAC) issues. However, the SUA Wizard does not offer detailed analysis, and it cannot disable virtualization or elevate your permissions.|
+|[Using the SUA Tool](using-the-sua-tool.md)|By using the Standard User Analyzer (SUA) tool, you can test your applications and monitor API calls to detect compatibility issues with the User Account Control (UAC) feature.|
diff --git a/windows/deployment/planning/tabs-on-the-sua-tool-interface.md b/windows/deployment/planning/tabs-on-the-sua-tool-interface.md
index d3c279c3eb..b1fcb63b8d 100644
--- a/windows/deployment/planning/tabs-on-the-sua-tool-interface.md
+++ b/windows/deployment/planning/tabs-on-the-sua-tool-interface.md
@@ -31,76 +31,15 @@ The tabs in the Standard User Analyzer (SUA) tool show the User Account Control
The following table provides a description of each tab on the user interface for the SUA tool.
-
-
-
-
-
-
-
-
Tab name
-
Description
-
-
-
-
-
App Info
-
Provides the following information for the selected application:
-
-
Debugging information
-
Error, warning, and informational messages (if they are enabled)
-
Options for running the application
-
-
-
-
File
-
Provides information about access to the file system.
-
For example, this tab might show an attempt to write to a file that only administrators can typically access.
-
-
-
Registry
-
Provides information about access to the system registry.
-
For example, this tab might show an attempt to write to a registry key that only administrators can typically access.
-
-
-
INI
-
Provides information about WriteProfile API issues.
-
For example, in the Calculator tool (Calc.exe) in Windows® XP, when you change the view from Standard to Scientific, Calc.exe calls the WriteProfile API to write to the Windows\Win.ini file. The Win.ini file is writable only for administrators.
-
-
-
Token
-
Provides information about access-token checking.
-
For example, this tab might show an explicit check for the Builtin\Administrators security identifier (SID) in the user's access token. This operation may not work for a standard user.
-
-
-
Privilege
-
Provides information about permissions.
-
For example, this tab might show an attempt to explicitly enable permissions that do not work for a standard user.
-
-
-
Name Space
-
Provides information about creation of system objects.
-
For example, this tab might show an attempt to create a new system object, such as an event or a memory map, in a restricted namespace. Applications that attempt this kind of operation do not function for a standard user.
-
-
-
Other Objects
-
Provides information related to applications accessing objects other than files and registry keys.
-
-
-
Process
-
Provides information about process elevation.
-
For example, this tab might show the use of the CreateProcess API to open an executable (.exe) file that, in turn, requires process elevation that will not function for a standard user.
-
-
-
-
-
-
-
-
-
-
-
-
-
+|Tab name|Description|
+|--- |--- |
+|App Info|Provides the following information for the selected application:
Debugging information
Error, warning, and informational messages (if they are enabled)
Options for running the application|
+|File|Provides information about access to the file system.
For example, this tab might show an attempt to write to a file that only administrators can typically access.|
+|Registry|Provides information about access to the system registry.
For example, this tab might show an attempt to write to a registry key that only administrators can typically access.|
+|INI|Provides information about WriteProfile API issues.
For example, in the Calculator tool (Calc.exe) in Windows® XP, when you change the view from **Standard** to **Scientific**, Calc.exe calls the WriteProfile API to write to the Windows\Win.ini file. The Win.ini file is writable only for administrators.|
+|Token|Provides information about access-token checking.
For example, this tab might show an explicit check for the Builtin\Administrators security identifier (SID) in the user's access token. This operation may not work for a standard user.|
+|Privilege|Provides information about permissions.
For example, this tab might show an attempt to explicitly enable permissions that do not work for a standard user.|
+|Name Space|Provides information about creation of system objects.
For example, this tab might show an attempt to create a new system object, such as an event or a memory map, in a restricted namespace. Applications that attempt this kind of operation do not function for a standard user.|
+|Other Objects|Provides information related to applications accessing objects other than files and registry keys.|
+|Process|Provides information about process elevation.
For example, this tab might show the use of the CreateProcess API to open an executable (.exe) file that, in turn, requires process elevation that will not function for a standard user.|
diff --git a/windows/deployment/planning/using-the-compatibility-administrator-tool.md b/windows/deployment/planning/using-the-compatibility-administrator-tool.md
index cb84beaa58..8847407f48 100644
--- a/windows/deployment/planning/using-the-compatibility-administrator-tool.md
+++ b/windows/deployment/planning/using-the-compatibility-administrator-tool.md
@@ -32,63 +32,17 @@ This section provides information about using the Compatibility Administrator to
## In this section
-
With the search functionality in Compatibility Administrator, you can locate specific executable (.exe) files with previously applied compatibility fixes, compatibility modes, or AppHelp messages. This is particularly useful if you are trying to identify applications with a specific compatibility fix or identifying which fixes are applied to a specific application.
The Compatibility Administrator tool uses the term fix to describe the combination of compatibility information added to a customized database for a specific application. This combination can include single application fixes, groups of fixes that work together as a compatibility mode, and blocking and non-blocking AppHelp messages.
Windows® provides several compatibility modes, groups of compatibility fixes found to resolve many common application-compatibility issues. While working with Compatibility Administrator, you might decide to group some of your individual compatibility fixes into a custom-compatibility mode, which you can then deploy and use on any of your compatibility databases.
The Compatibility Administrator tool enables you to create an AppHelp text message. This is a blocking or non-blocking message that appears when a user starts an application that you know has major functionality issues on the Windows® operating system.
The Events screen enables you to record and to view your activities in the Compatibility Administrator tool, provided that the screen is open while you perform the activities.
The Compatibility Administrator tool enables the creation and the use of custom-compatibility and standard-compatibility databases. Both the custom databases and the standard databases store the known compatibility fixes, compatibility modes, and AppHelp messages. They also store the required application-matching information for installation on your local computers.
-
-
-
-
-
-
-
-
-
-
+|Topic|Description|
+|--- |--- |
+|[Available Data Types and Operators in Compatibility Administrator](available-data-types-and-operators-in-compatibility-administrator.md)|The Compatibility Administrator tool provides a way to query your custom-compatibility databases.|
+|[Searching for Fixed Applications in Compatibility Administrator](searching-for-fixed-applications-in-compatibility-administrator.md)|With the search functionality in Compatibility Administrator, you can locate specific executable (.exe) files with previously applied compatibility fixes, compatibility modes, or AppHelp messages. This is particularly useful if you are trying to identify applications with a specific compatibility fix or identifying which fixes are applied to a specific application.|
+|[Searching for Installed Compatibility Fixes with the Query Tool in Compatibility Administrator](searching-for-installed-compatibility-fixes-with-the-query-tool-in-compatibility-administrator.md)|You can access the Query tool from within Compatibility Administrator. The Query tool provides the same functionality as using the Search feature.|
+|[Creating a Custom Compatibility Fix in Compatibility Administrator](creating-a-custom-compatibility-fix-in-compatibility-administrator.md)|The Compatibility Administrator tool uses the term fix to describe the combination of compatibility information added to a customized database for a specific application. This combination can include single application fixes, groups of fixes that work together as a compatibility mode, and blocking and non-blocking AppHelp messages.|
+|[Creating a Custom Compatibility Mode in Compatibility Administrator](creating-a-custom-compatibility-mode-in-compatibility-administrator.md)|Windows® provides several compatibility modes, groups of compatibility fixes found to resolve many common application-compatibility issues. While working with Compatibility Administrator, you might decide to group some of your individual compatibility fixes into a custom-compatibility mode, which you can then deploy and use on any of your compatibility databases.|
+|[Creating an AppHelp Message in Compatibility Administrator](creating-an-apphelp-message-in-compatibility-administrator.md)|The Compatibility Administrator tool enables you to create an AppHelp text message. This is a blocking or non-blocking message that appears when a user starts an application that you know has major functionality issues on the Windows® operating system.|
+|[Viewing the Events Screen in Compatibility Administrator](viewing-the-events-screen-in-compatibility-administrator.md)|The **Events** screen enables you to record and to view your activities in the Compatibility Administrator tool, provided that the screen is open while you perform the activities.|
+|[Enabling and Disabling Compatibility Fixes in Compatibility Administrator](enabling-and-disabling-compatibility-fixes-in-compatibility-administrator.md)|You can disable and enable individual compatibility fixes in your customized databases for testing and troubleshooting purposes.|
+|[Installing and Uninstalling Custom Compatibility Databases in Compatibility Administrator](installing-and-uninstalling-custom-compatibility-databases-in-compatibility-administrator.md)|The Compatibility Administrator tool enables the creation and the use of custom-compatibility and standard-compatibility databases. Both the custom databases and the standard databases store the known compatibility fixes, compatibility modes, and AppHelp messages. They also store the required application-matching information for installation on your local computers.|
diff --git a/windows/deployment/planning/using-the-sdbinstexe-command-line-tool.md b/windows/deployment/planning/using-the-sdbinstexe-command-line-tool.md
index 649a832f90..3369ff0c1e 100644
--- a/windows/deployment/planning/using-the-sdbinstexe-command-line-tool.md
+++ b/windows/deployment/planning/using-the-sdbinstexe-command-line-tool.md
@@ -1,6 +1,6 @@
---
title: Using the Sdbinst.exe Command-Line Tool (Windows 10)
-description: Learn how to deploy customized database (.sdb) files using the Sdbinst.exe Command-Line Tool. Review a list of command line options.
+description: Learn how to deploy customized database (.sdb) files using the Sdbinst.exe Command-Line Tool. Review a list of command-line options.
ms.assetid: c1945425-3f8d-4de8-9d2d-59f801f07034
ms.reviewer:
manager: laurawi
@@ -28,15 +28,16 @@ ms.topic: article
- Windows Server 2012
- Windows Server 2008 R2
-You must deploy your customized database (.sdb) files to other computers in your organization before your compatibility fixes, compatibility modes, and AppHelp messages are applied. You can deploy your customized database files in several ways, including by using a logon script, by using Group Policy, or by performing file copy operations.
+You must deploy your customized database (.sdb) files to other computers in your organization. That is, before your compatibility fixes, compatibility modes, and AppHelp messages are applied. You can deploy your customized database files in several ways. By using a logon script, by using Group Policy, or by performing file copy operations.
-After you deploy and store the customized databases on each of your local computers, you must register the database files. Until you register the database files, the operating system is unable to identify the available compatibility fixes when starting an application.
+After you deploy and store the customized databases on each of your local computers, you must register the database files.
+Until you register the database files, the operating system is unable to identify the available compatibility fixes when starting an application.
## Command-Line Options for Deploying Customized Database Files
Sample output from the command `Sdbinst.exe /?` in an elevated CMD window:
-```
+```console
Microsoft Windows [Version 10.0.14393]
(c) 2016 Microsoft Corporation. All rights reserved.
@@ -59,56 +60,15 @@ Sdbinst.exe \[-?\] \[-p\] \[-q\] \[-u\] \[-g\] \[-u filepath\] \[-g *GUID*\] \[-
The following table describes the available command-line options.
-
-
-
-
-
-
-
-
Option
-
Description
-
-
-
-
-
-?
-
Displays the Help for the Sdbinst.exe tool.
-
For example,
-
sdbinst.exe -?
-
-
-
-p
-
Allows SDBs installation with Patches
-
For example,
-
sdbinst.exe -p C:\Windows\AppPatch\Myapp.sdb
-
-
-
-q
-
Performs a silent installation with no visible window, status, or warning information. Fatal errors appear only in Event Viewer (Eventvwr.exe).
-
For example,
-
sdbinst.exe -q
-
-
-
-u filepath
-
Performs an uninstallation of the specified database.
-
For example,
-
sdbinst.exe -u C:\example.sdb
-
-
-
-g GUID
-
Specifies the customized database to uninstall by a globally unique identifier (GUID).
Specifies the customized database to uninstall by file name.
-
For example,
-
sdbinst.exe -n "My_Database"
-
-
-
+|Option|Description|
+|--- |--- |
+|-?|Displays the Help for the Sdbinst.exe tool.
For example, `sdbinst.exe -?`|
+|-p|Allows SDBs installation with Patches.
For example, `sdbinst.exe -p C:\Windows\AppPatch\Myapp.sdb`|
+|-q|Does a silent installation with no visible window, status, or warning information. Fatal errors appear only in Event Viewer (Eventvwr.exe).
For example, `sdbinst.exe -q`|
+|-u *filepath*|Does an uninstallation of the specified database.
For example, `sdbinst.exe -u C:\example.sdb`|
+|-g *GUID*|Specifies the customized database to uninstall by a globally unique identifier (GUID).
For example, `sdbinst.exe -g 6586cd8f-edc9-4ea8-ad94-afabea7f62e3`|
+|-n *"name"*|Specifies the customized database to uninstall by file name.
For example, `sdbinst.exe -n "My_Database"`|
## Related topics
+
[Compatibility Administrator User's Guide](compatibility-administrator-users-guide.md)
diff --git a/windows/deployment/planning/windows-10-deployment-considerations.md b/windows/deployment/planning/windows-10-deployment-considerations.md
index 90d0c547cb..4d8bf0ff3e 100644
--- a/windows/deployment/planning/windows-10-deployment-considerations.md
+++ b/windows/deployment/planning/windows-10-deployment-considerations.md
@@ -36,46 +36,13 @@ Windows 10 also introduces two additional scenarios that organizations should c
So how do you choose? At a high level:
-
-
-
-
-
-
-
-
Consider ...
-
For these scenarios
-
-
-
-
-
In-place upgrade
-
-
When you want to keep all (or at least most) existing applications
-
When you do not plan to significantly change the device configuration (for example, BIOS to UEFI) or operating system configuration (for example, x86 to x64, language changes, Administrators to non-Administrators, Active Directory domain consolidations)
-
To migrate from Windows 10 to a later Windows 10 release
-
-
-
-
Traditional wipe-and-load
-
-
When you upgrade significant numbers of applications along with the new Windows OS
-
When you make significant device or operating system configuration changes
-
When you “start clean”. For example, scenarios where it is not necessary to preserve existing apps or data (for example, call centers) or when you move from unmanaged to well-managed PCs
-
When you migrate from Windows Vista or other previous operating system versions
-
-
-
-
Dynamic provisioning
-
-
For new devices, especially in “choose your own device” scenarios when simple configuration (not reimaging) is all that is required
-
When used in combination with a management tool (for example, an MDM service like Microsoft Intune) that enables self-service installation of user-specific or role-specific apps
-
-
-
-
+| Consider ... | For these scenarios |
+|---|---|
+| In-place upgrade | - When you want to keep all (or at least most) existing applications - When you do not plan to significantly change the device configuration (for example, BIOS to UEFI) or operating system configuration (for example, x86 to x64, language changes, Administrators to non-Administrators, Active Directory domain consolidations) - To migrate from Windows 10 to a later Windows 10 release |
+| Traditional wipe-and-load | - When you upgrade significant numbers of applications along with the new Windows OS - When you make significant device or operating system configuration changes - When you “start clean”. For example, scenarios where it is not necessary to preserve existing apps or data (for example, call centers) or when you move from unmanaged to well-managed PCs - When you migrate from Windows Vista or other previous operating system versions |
+| Dynamic provisioning | - For new devices, especially in “choose your own device” scenarios when simple configuration (not reimaging) is all that is required. - When used in combination with a management tool (for example, an MDM service like Microsoft Intune) that enables self-service installation of user-specific or role-specific apps |
+
-
## Migration from previous Windows versions
For existing PCs running Windows 7 or Windows 8.1, in-place upgrade is the recommended method for Windows 10 deployment and should be used whenever possible. Although wipe-and-load (OS refresh) deployments are still fully supported (and necessary in some scenarios, as mentioned previously), in-place upgrade is simpler and faster, and enables a faster Windows 10 deployment overall.
@@ -105,7 +72,7 @@ In either of these scenarios, you can make a variety of configuration changes to
## Stay up to date
-For computers already running Windows 10 on the Semi-Annual Channel, new upgrades will be deployed two times per year. You can deploy these upgrades by using a variety of methods:
+For computers using the [General Availability Channel](../update/waas-overview.md#general-availability-channel), you can deploy these upgrades by using a variety of methods:
- Windows Update or Windows Update for Business, for devices where you want to receive updates directly from the Internet.
- Windows Server Update Services (WSUS), for devices configured to pull updates from internal servers after they are approved (deploying like an update).
diff --git a/windows/deployment/planning/windows-10-deprecated-features.md b/windows/deployment/planning/windows-10-deprecated-features.md
index c5160d884a..6f3f832a1c 100644
--- a/windows/deployment/planning/windows-10-deprecated-features.md
+++ b/windows/deployment/planning/windows-10-deprecated-features.md
@@ -1,5 +1,5 @@
---
-title: Windows 10 features we’re no longer developing
+title: Windows 10 features we're no longer developing
description: Review the list of features that are no longer being developed in Windows 10
ms.prod: w10
ms.mktglfcycl: plan
@@ -10,8 +10,10 @@ author: greg-lindsay
ms.author: greglin
manager: dougeby
ms.topic: article
+ms.collection: highpri
---
-# Windows 10 features we’re no longer developing
+
+# Windows 10 features we're no longer developing
> Applies to: Windows 10
diff --git a/windows/deployment/planning/windows-10-enterprise-faq-itpro.yml b/windows/deployment/planning/windows-10-enterprise-faq-itpro.yml
index 8ca699331f..a8e1aa8c67 100644
--- a/windows/deployment/planning/windows-10-enterprise-faq-itpro.yml
+++ b/windows/deployment/planning/windows-10-enterprise-faq-itpro.yml
@@ -103,7 +103,7 @@ sections:
- question: |
What are the servicing channels?
answer: |
- To align with the new method of delivering feature updates and quality updates in Windows 10, Microsoft introduced the concept of servicing channels to allow customers to designate how aggressively their individual devices are updated. For example, an organization may have test devices that the IT department can update with new features as soon as possible, and then specialized devices that require a longer feature update cycle to ensure continuity. With that in mind, Microsoft offers two servicing channels for Windows 10: Semi-Annual Channel, and Long-Term Servicing Channel (LTSC). For details about the versions in each servicing channel, see [Windows 10 release information](https://technet.microsoft.com/windows/release-info.aspx). For more information on each channel, see [servicing channels](../update/waas-overview.md#servicing-channels).
+ To align with the new method of delivering feature updates and quality updates in Windows 10, Microsoft introduced the concept of servicing channels to allow customers to designate how aggressively their individual devices are updated. For example, an organization may have test devices that the IT department can update with new features as soon as possible, and then specialized devices that require a longer feature update cycle to ensure continuity. With that in mind, Microsoft offers two servicing channels for Windows 10: General Availability Channel, and Long-Term Servicing Channel (LTSC). For details about the versions in each servicing channel, see [Windows 10 release information](https://technet.microsoft.com/windows/release-info.aspx). For more information on each channel, see [servicing channels](../update/waas-overview.md#servicing-channels).
- question: |
What tools can I use to manage Windows as a service updates?
diff --git a/windows/deployment/planning/windows-10-removed-features.md b/windows/deployment/planning/windows-10-removed-features.md
index a790a1e83a..79092a21ec 100644
--- a/windows/deployment/planning/windows-10-removed-features.md
+++ b/windows/deployment/planning/windows-10-removed-features.md
@@ -8,9 +8,10 @@ ms.sitesec: library
audience: itpro
author: greg-lindsay
ms.author: greglin
-manager: laurawi
+manager: dougeby
ms.topic: article
ms.custom: seo-marvel-apr2020
+ms.collection: highpri
---
# Features and functionality removed in Windows 10
@@ -60,7 +61,7 @@ The following features and functionalities have been removed from the installed
|Reader app | Functionality to be integrated into Microsoft Edge. | 1709 |
|Reading List | Functionality to be integrated into Microsoft Edge. | 1709 |
|Screen saver functionality in Themes | This functionality is disabled in Themes, and classified as **Removed** in this table. Screen saver functionality in Group Policies, Control Panel, and Sysprep continues to be functional. Lock screen features and policies are preferred. | 1709 |
-|Syskey.exe | Removing this nonsecure security feature. We recommend that users use BitLocker instead. For more information, see [4025993 Syskey.exe utility is no longer supported in Windows 10 RS3 and Windows Server 2016 RS3](https://support.microsoft.com/help/4025993/syskey-exe-utility-is-no-longer-supported-in-windows-10-rs3-and-window). | 1709 |
+|Syskey.exe | Removing this nonsecure security feature. We recommend that users use BitLocker instead. For more information, see [4025993 Syskey.exe utility is no longer supported in Windows 10 RS3 and Windows Server 2016 RS3](/troubleshoot/windows-server/identity/syskey-exe-utility-is-no-longer-supported). | 1709 |
|TCP Offload Engine | Removing this legacy code. This functionality was previously transitioned to the Stack TCP Engine. For more information, see [Why Are We Deprecating Network Performance Features?](https://blogs.technet.microsoft.com/askpfeplat/2017/06/13/why-are-we-deprecating-network-performance-features-kb4014193)| 1709 |
|Tile Data Layer |To be replaced by the Tile Store.| 1709 |
|Resilient File System (ReFS) (added: August 17, 2017)| Creation ability will be available in the following editions only: Windows 10 Enterprise and Windows 10 Pro for Workstations. Creation ability will be removed from all other editions. All other editions will have Read and Write ability. | 1709 |
diff --git a/windows/deployment/planning/windows-to-go-overview.md b/windows/deployment/planning/windows-to-go-overview.md
index 5dff0dda28..a35fdac4bf 100644
--- a/windows/deployment/planning/windows-to-go-overview.md
+++ b/windows/deployment/planning/windows-to-go-overview.md
@@ -135,93 +135,27 @@ When assessing the use of a PC as a host for a Windows To Go workspace you shoul
The following table details the characteristics that the host computer must have to be used with Windows To Go:
-
-
-
-
-
-
-
-
Item
-
Requirement
-
-
-
-
-
Boot process
-
Capable of USB boot
-
-
-
Firmware
-
USB boot enabled. (PCs certified for use with Windows 7 or later can be configured to boot directly from USB, check with the hardware manufacturer if you are unsure of the ability of your PC to boot from USB)
-
-
-
Processor architecture
-
Must support the image on the Windows To Go drive
-
-
-
External USB Hubs
-
Not supported; connect the Windows To Go drive directly to the host machine
-
-
-
Processor
-
1 Ghz or faster
-
-
-
RAM
-
2 GB or greater
-
-
-
Graphics
-
DirectX 9 graphics device with WDDM 1.2 or greater driver
-
-
-
USB port
-
USB 2.0 port or greater
-
-
-
+|Item|Requirement|
+|--- |--- |
+|Boot process|Capable of USB boot|
+|Firmware|USB boot enabled. (PCs certified for use with Windows 7 or later can be configured to boot directly from USB, check with the hardware manufacturer if you are unsure of the ability of your PC to boot from USB)|
+|Processor architecture|Must support the image on the Windows To Go drive|
+|External USB Hubs|Not supported; connect the Windows To Go drive directly to the host machine|
+|Processor|1 Ghz or faster|
+|RAM|2 GB or greater|
+|Graphics|DirectX 9 graphics device with WDDM 1.2 or greater driver|
+|USB port|USB 2.0 port or greater|
**Checking for architectural compatibility between the host PC and the Windows To Go drive**
In addition to the USB boot support in the BIOS, the Windows 10 image on your Windows To Go drive must be compatible with the processor architecture and the firmware of the host PC as shown in the table below.
-
-
-
-
-
-
-
-
-
Host PC Firmware Type
-
Host PC Processor Architecture
-
Compatible Windows To Go Image Architecture
-
-
-
-
-
Legacy BIOS
-
32-bit
-
32-bit only
-
-
-
Legacy BIOS
-
64-bit
-
32-bit and 64-bit
-
-
-
UEFI BIOS
-
32-bit
-
32-bit only
-
-
-
UEFI BIOS
-
64-bit
-
64-bit only
-
-
-
+|Host PC Firmware Type|Host PC Processor Architecture|Compatible Windows To Go Image Architecture|
+|--- |--- |--- |
+|Legacy BIOS|32-bit|32-bit only|
+|Legacy BIOS|64-bit|32-bit and 64-bit|
+|UEFI BIOS|32-bit|32-bit only|
+|UEFI BIOS|64-bit|64-bit only|
## Additional resources
diff --git a/windows/deployment/s-mode.md b/windows/deployment/s-mode.md
index be1b44ecc6..a4a9b96d26 100644
--- a/windows/deployment/s-mode.md
+++ b/windows/deployment/s-mode.md
@@ -7,14 +7,14 @@ ms.localizationpriority: medium
ms.prod: w10
ms.sitesec: library
ms.pagetype: deploy
-ms.reviewer:
-manager: laurawi
+manager: dougeby
ms.audience: itpro
author: greg-lindsay
ms.author: greglin
audience: itpro
ms.topic: article
ms.custom: seo-marvel-apr2020
+ms.collection: highpri
---
# Windows 10 in S mode - What is it?
diff --git a/windows/deployment/update/WIP4Biz-intro.md b/windows/deployment/update/WIP4Biz-intro.md
index ae8c69d273..b73c7cb293 100644
--- a/windows/deployment/update/WIP4Biz-intro.md
+++ b/windows/deployment/update/WIP4Biz-intro.md
@@ -1,7 +1,7 @@
---
title: Introduction to the Windows Insider Program for Business
description: In this article, you'll learn about the Windows Insider Program for Business and why IT Pros should join.
-keywords: updates, servicing, current, deployment, semi-annual channel, feature, quality, rings, insider, WiP4Biz, enterprise, rings, flight
+keywords: updates, servicing, current, deployment, General Availability Channel, semi-annual channel, feature, quality, rings, insider, WiP4Biz, enterprise, rings, flight
ms.custom: seo-marvel-apr2020
ms.prod: w10
ms.mktglfcycl: manage
@@ -22,7 +22,7 @@ ms.topic: article
> **Looking for information about Windows 10 for personal or home use?** See [Windows Update: FAQ](https://support.microsoft.com/help/12373/windows-update-faq)
-For many IT Pros, it's valuable to have visibility into feature updates early--before they’re available in the Semi-Annual Channel. With Windows 10, feature flighting enables participants in the Windows Insider Preview program can consume and deploy preproduction code to test devices, gaining early visibility into the next build. This is better for your organization because you can test the early builds of Windows 10 to discover possible issues with the code or with device and app compatibility in your organization before the update is ever publicly available. We at Microsoft also appreciate it because Insiders can report issues back to us in time for us to make improvements in a release before it is more generally available.
+For many IT Pros, it's valuable to have visibility into feature updates early--before they’re available in the General Availability Channel. With Windows 10, feature flighting enables participants in the Windows Insider Preview program can consume and deploy preproduction code to test devices, gaining early visibility into the next build. This is better for your organization because you can test the early builds of Windows 10 to discover possible issues with the code or with device and app compatibility in your organization before the update is ever publicly available. We at Microsoft also appreciate it because Insiders can report issues back to us in time for us to make improvements in a release before it is more generally available.
The Windows Insider Program for Business gives you the opportunity to:
@@ -35,7 +35,7 @@ The Windows Insider Program for Business gives you the opportunity to:
Microsoft recommends that all organizations have at least a few devices enrolled in the Windows Insider Program, to include the Windows Insider Program in their deployment plans, and to provide feedback on any issues they encounter to Microsoft via our Feedback Hub App.
-The Windows Insider Program doesn't replace Semi-Annual Channel deployments in an organization. Rather, it provides IT Pros and other interested parties with pre-release Windows builds that they can test and ultimately provide feedback on to Microsoft.
+The Windows Insider Program doesn't replace General Availability Channel deployments in an organization. Rather, it provides IT Pros and other interested parties with pre-release Windows builds that they can test and ultimately provide feedback on to Microsoft.
[](images/WIP4Biz_deployment.png)
Windows 10 Insider Preview builds enable organizations to prepare sooner for Windows Semi-Annual releases and reduce the overall validation effort required with traditional deployments.
@@ -52,12 +52,12 @@ Windows 10 Insider Preview builds offer organizations a valuable and exciting op
## Validate Insider Preview builds
Along with exploring new features, you also have the option to validate your apps and infrastructure on Insider Preview builds. This activity can play an important role in your [Windows 10 deployment strategy](/windows/deployment/update/waas-windows-insider-for-business). Early validation has several benefits:
-
-- Get a head start on your Windows validation process
-- Identify issues sooner to accelerate your Windows deployment
-- Engage Microsoft earlier for help with potential compatibility issues
-- Deploy Windows 10 Semi-Annual releases faster and more confidently
-- Maximize the 18-month support Window that comes with each Semi-Annual release.
+
+- Get a head start on your Windows validation process.
+- Identify issues sooner to accelerate your Windows deployment.
+- Engage Microsoft earlier for help with potential compatibility issues.
+- Deploy Windows 10 General Availability Channel releases faster and more confidently.
+- Maximize the support window that comes with each General Availability Channel release.
|Objective |Feature exploration|
|---------|---------|
diff --git a/windows/deployment/update/get-started-updates-channels-tools.md b/windows/deployment/update/get-started-updates-channels-tools.md
index f1d6c2488e..e628766463 100644
--- a/windows/deployment/update/get-started-updates-channels-tools.md
+++ b/windows/deployment/update/get-started-updates-channels-tools.md
@@ -1,22 +1,22 @@
---
title: Windows client updates, channels, and tools
description: Brief summary of the kinds of Windows updates, the channels they are served through, and the tools for managing them
-keywords: updates, servicing, current, deployment, semi-annual channel, feature, quality, rings, insider, tools
+keywords: updates, servicing, current, deployment, General Availability Channel, semi-annual channel, feature, quality, rings, insider, tools
ms.prod: w10
ms.mktglfcycl: manage
author: jaimeo
ms.localizationpriority: medium
ms.author: jaimeo
-ms.reviewer:
-manager: laurawi
+manager: dougeby
ms.topic: article
+ms.collection: highpri
---
# Windows client updates, channels, and tools
**Applies to**
-- Windows 10
+- Windows 10
- Windows 11
## How Windows updates work
@@ -35,7 +35,7 @@ version of the software.
We include information here about many different update types you'll hear about, but the two overarching types that you have the most direct control over are *feature updates* and *quality updates*.
-- **Feature updates:** Released as soon as they become available. Feature updates add new features and functionality to Windows 10. Because they are delivered frequently (rather than every 3-5 years), they are easier to manage.
+- **Feature updates:** Released annually. Feature updates add new features and functionality to Windows 10. Because they are delivered frequently (rather than every 3-5 years), they are easier to manage.
- **Quality updates:** Quality updates deliver both security and non-security fixes. Quality updates include security updates, critical updates, servicing stack updates, and driver updates. They are typically released on the second Tuesday of each month, though they can be released at any time. The second-Tuesday releases are the ones that focus on security updates. Quality updates are *cumulative*, so installing the latest quality update is sufficient to get all the available fixes for a specific feature update, including any out-of-band security fixes and any *servicing stack updates* that might have been released previously.
- **Servicing stack updates:** The "servicing stack" is the code component that actually installs Windows updates. From time to time, the servicing stack itself needs to be updated in order to function smoothly. If you don't install the latest servicing stack update, there's a risk that your device can't be updated with the latest Microsoft security fixes. Servicing stack updates are not necessarily included in *every* monthly quality update, and occasionally are released out of band to address a late-breaking issue. Always install the latest available quality update to catch any servicing stack updates that might have been released. The servicing stack also contains the "component-based servicing stack" (CBS), which is a key underlying component for several elements of Windows deployment, such as DISM, SFC, changing Windows features or roles, and repairing components. The CBS is a small component that typically does not have updates released every month. You can find a list of servicing stack updates at [Latest servicing stack updates](https://portal.msrc.microsoft.com/security-guidance/advisory/ADV990001). For more detail about servicing stack updates, see [Servicing stack updates](servicing-stack-updates.md).
- **Driver updates**: These update drivers applicable to your devices. Driver updates are turned off by default in Windows Server Update Services (WSUS), but for cloud-based update methods, you can control whether they are installed or not.
@@ -51,7 +51,7 @@ The first step of controlling when and how devices install updates is assigning
### General Availability Channel
-In the General Availability Channel, feature updates are available as soon as Microsoft releases them. As long as a device isn't set to defer feature updates, any device in this channel will install a feature update as soon as it's released. If you use Windows Update for Business, the channel provides three months of additional total deployment time before being required to update to the next release.
+In the General Availability Channel, feature updates are released annually. As long as a device isn't set to defer feature updates, any device in this channel will install a feature update as soon as it's released. If you use Windows Update for Business, the channel provides three months of additional total deployment time before being required to update to the next release.
### Windows Insider Program for Business
diff --git a/windows/deployment/update/how-windows-update-works.md b/windows/deployment/update/how-windows-update-works.md
index 821586a7d8..c4d62b04f1 100644
--- a/windows/deployment/update/how-windows-update-works.md
+++ b/windows/deployment/update/how-windows-update-works.md
@@ -8,9 +8,10 @@ itproauthor: jaimeo
author: jaimeo
ms.localizationpriority: medium
ms.author: jaimeo
-ms.reviewer:
-manager: laurawi
-ms.collection: M365-modern-desktop
+manager: dougeby
+ms.collection:
+ - M365-modern-desktop
+ - highpri
ms.topic: article
ms.custom: seo-marvel-apr2020
---
diff --git a/windows/deployment/update/media-dynamic-update.md b/windows/deployment/update/media-dynamic-update.md
index 01eadf3247..1ba07b05c8 100644
--- a/windows/deployment/update/media-dynamic-update.md
+++ b/windows/deployment/update/media-dynamic-update.md
@@ -8,9 +8,10 @@ itproauthor: jaimeo
author: SteveDiAcetis
ms.localizationpriority: medium
ms.author: jaimeo
-ms.reviewer:
-manager: laurawi
-ms.collection: M365-modern-desktop
+manager: dougeby
+ms.collection:
+ - M365-modern-desktop
+ - highpri
ms.topic: article
---
@@ -18,7 +19,7 @@ ms.topic: article
**Applies to**
-- Windows 10
+- Windows 10
- Windows 11
This topic explains how to acquire and apply Dynamic Update packages to existing Windows images *prior to deployment* and includes Windows PowerShell scripts you can use to automate this process.
diff --git a/windows/deployment/update/olympia/olympia-enrollment-guidelines.md b/windows/deployment/update/olympia/olympia-enrollment-guidelines.md
index 1c557d6128..91fc25dcd6 100644
--- a/windows/deployment/update/olympia/olympia-enrollment-guidelines.md
+++ b/windows/deployment/update/olympia/olympia-enrollment-guidelines.md
@@ -53,7 +53,7 @@ Choose one of the following two enrollment options:
This is the Bring Your Own Device (BYOD) method--your device will receive Olympia policies and features, but a new account will not be created. See [Set up Azure Active Directory registered Windows 10 devices](/azure/active-directory/device-management-azuread-registered-devices-windows10-setup) for additional information.
-1. Go to **Start > Settings > Accounts > Access work or school**. To see this setting, you need to have administrator rights to your device (see [local administrator](https://support.microsoft.com/instantanswers/5de907f1-f8ba-4fd9-a89d-efd23fee918c/create-a-local-user-or-administrator-account-in-windows-10)).
+1. Go to **Start > Settings > Accounts > Access work or school**. To see this setting, you need to have administrator rights to your device (see [local administrator](https://support.microsoft.com/windows/create-a-local-user-or-administrator-account-in-windows-20de74e0-ac7f-3502-a866-32915af2a34d)).
@@ -92,7 +92,7 @@ This is the Bring Your Own Device (BYOD) method--your device will receive Olympi
> [!NOTE]
> Make sure that you save your Pro license key before upgrading to the Enterprise edition. If the device gets disconnected from Olympia, you can use the Pro key to reactivate the license manually in the unlikely event that the license fails to downgrade back to Pro automatically. To reactivate manually, see [Upgrade by manually entering a product key](../../upgrade/windows-10-edition-upgrades.md#upgrade-by-manually-entering-a-product-key).
-1. Go to **Start > Settings > Accounts > Access work or school**. To see this setting, you need to have administrator rights to your device (see [local administrator](https://support.microsoft.com/instantanswers/5de907f1-f8ba-4fd9-a89d-efd23fee918c/create-a-local-user-or-administrator-account-in-windows-10)).
+1. Go to **Start > Settings > Accounts > Access work or school**. To see this setting, you need to have administrator rights to your device (see [local administrator](https://support.microsoft.com/windows/create-a-local-user-or-administrator-account-in-windows-20de74e0-ac7f-3502-a866-32915af2a34d)).
@@ -100,7 +100,7 @@ This is the Bring Your Own Device (BYOD) method--your device will receive Olympi
3. Click **Connect**, then click **Join this device to Azure Active Directory**.
- ![Joining device to Azure AD.]](images/2-3.png)
+ 
4. Enter your **Olympia corporate account** (e.g., username@olympia.windows.com). Click **Next**.
diff --git a/windows/deployment/update/prepare-deploy-windows.md b/windows/deployment/update/prepare-deploy-windows.md
index 3ea447d2c4..4614f94847 100644
--- a/windows/deployment/update/prepare-deploy-windows.md
+++ b/windows/deployment/update/prepare-deploy-windows.md
@@ -94,7 +94,7 @@ Enable update services on devices. Ensure that every device is running all the s
- Windows Management Service
- Windows Module Installer
- Windows Push Notification
-- Windows Security Center Service
+- Windows Security Service
- Windows Time Service
- Windows Update
- Windows Update Medic Service
diff --git a/windows/deployment/update/quality-updates.md b/windows/deployment/update/quality-updates.md
index 2f90ee99e0..2bd74d5b87 100644
--- a/windows/deployment/update/quality-updates.md
+++ b/windows/deployment/update/quality-updates.md
@@ -61,7 +61,7 @@ Some key considerations about OOB releases include:
## More information
-For additional details about the different types of Windows updates like critical, security, drivers, service packs, and more, please see the [Description of the standard terminology used to describe Microsoft software updates](https://support.microsoft.com/help/824684) and [Introducing a new deployment service for driver and firmware updates](https://techcommunity.microsoft.com/t5/windows-it-pro-blog/introducing-a-new-deployment-service-for-driver-and-firmware/ba-p/2176942).
+For additional details about the different types of Windows updates like critical, security, drivers, service packs, and more, please see the [Description of the standard terminology used to describe Microsoft software updates](/troubleshoot/windows-client/deployment/standard-terminology-software-updates) and [Introducing a new deployment service for driver and firmware updates](https://techcommunity.microsoft.com/t5/windows-it-pro-blog/introducing-a-new-deployment-service-for-driver-and-firmware/ba-p/2176942).
## Related topics
diff --git a/windows/deployment/update/safeguard-holds.md b/windows/deployment/update/safeguard-holds.md
index 0bb65fedd7..8ff5849aaa 100644
--- a/windows/deployment/update/safeguard-holds.md
+++ b/windows/deployment/update/safeguard-holds.md
@@ -14,8 +14,8 @@ ms.topic: article
**Applies to**
-- Windows 10
-- Windows 11
+- Windows 10
+- Windows 11
Microsoft uses quality and compatibility data to identify issues that might cause a Windows client feature update to fail or roll back. When we find such an issue, we might apply safeguard holds to the updating service to prevent affected devices from installing the update in order to safeguard them from these experiences. We also use safeguard holds when a customer, a partner, or Microsoft internal validation finds an issue that would cause severe impact (for example, rollback of the update, data loss, loss of connectivity, or loss of key functionality) and when a workaround is not immediately available.
diff --git a/windows/deployment/update/servicing-stack-updates.md b/windows/deployment/update/servicing-stack-updates.md
index 15a43dfe2f..079e41dff7 100644
--- a/windows/deployment/update/servicing-stack-updates.md
+++ b/windows/deployment/update/servicing-stack-updates.md
@@ -8,9 +8,10 @@ itproauthor: jaimeo
author: jaimeo
ms.localizationpriority: medium
ms.author: jaimeo
-ms.reviewer:
-manager: laurawi
-ms.collection: M365-modern-desktop
+manager: dougeby
+ms.collection:
+ - M365-modern-desktop
+ - highpri
ms.topic: article
ms.custom: seo-marvel-apr2020
---
@@ -20,7 +21,7 @@ ms.custom: seo-marvel-apr2020
**Applies to**
-- Windows 10
+- Windows 10
- Windows 11
## What is a servicing stack update?
diff --git a/windows/deployment/update/update-compliance-feature-update-status.md b/windows/deployment/update/update-compliance-feature-update-status.md
index 9613aaa41e..0632492b3e 100644
--- a/windows/deployment/update/update-compliance-feature-update-status.md
+++ b/windows/deployment/update/update-compliance-feature-update-status.md
@@ -48,7 +48,7 @@ Microsoft uses diagnostic data to determine whether devices that use Windows Upd
### Queries for safeguard holds
> [!TIP]
-> For a new Update Compliance report with additional information on safeguard holds, try the [Safeguard Holds report](/windows/deployment/update/update-compliance-safeguard-holds).
+> For a new Update Compliance report with additional information on safeguard holds for devices managed using the [Windows Update for Business deployment service](/windows/deployment/update/deployment-service-overview), try the [Safeguard Holds report](/windows/deployment/update/update-compliance-safeguard-holds).
The Feature Update Status report offers two queries to help you retrieve data related to safeguard holds. These queries show data for devices that are configured to send diagnostic data at the *Optional* level (previously *Full*). For Windows 10 devices, devices configured to send diagnostic data at *Enhanced* level are also included.
diff --git a/windows/deployment/update/update-compliance-get-started.md b/windows/deployment/update/update-compliance-get-started.md
index db61a26720..fc12dbcd1f 100644
--- a/windows/deployment/update/update-compliance-get-started.md
+++ b/windows/deployment/update/update-compliance-get-started.md
@@ -1,7 +1,6 @@
---
title: Get started with Update Compliance
-ms.reviewer:
-manager: laurawi
+manager: dougeby
description: Prerequisites, Azure onboarding, and configuring devices for Update Compliance
keywords: update compliance, oms, operations management suite, prerequisites, requirements, updates, upgrades, antivirus, antimalware, signature, log analytics, wdav
ms.prod: w10
@@ -11,7 +10,9 @@ audience: itpro
author: jaimeo
ms.author: jaimeo
ms.localizationpriority: medium
-ms.collection: M365-analytics
+ms.collection:
+ - M365-analytics
+ - highpri
ms.topic: article
---
@@ -19,7 +20,7 @@ ms.topic: article
**Applies to**
-- Windows 10
+- Windows 10
- Windows 11
> [!IMPORTANT]
diff --git a/windows/deployment/update/update-compliance-safeguard-holds.md b/windows/deployment/update/update-compliance-safeguard-holds.md
index a46fbed232..98221fda7c 100644
--- a/windows/deployment/update/update-compliance-safeguard-holds.md
+++ b/windows/deployment/update/update-compliance-safeguard-holds.md
@@ -22,11 +22,11 @@ ms.custom: seo-marvel-apr2020
- Windows 10
- Windows 11
-The Safeguard Holds report provides information about devices in your population that are affected by a [safeguard hold](/windows/deployment/update/safeguard-holds).
+The Safeguard Holds report provides information about devices in your population that are affected by a [safeguard hold](/windows/deployment/update/safeguard-holds).
Microsoft uses diagnostic data to determine whether devices that use Windows Update are ready for a feature update in order to ensure a smooth experience. When Microsoft determines a device is not ready to update due to a known issue, a *safeguard hold* is generated to delay the device's upgrade and protect the end-user experience. Safeguard holds are released over time as diagnostic data is analyzed and fixes are addressed. Details are provided on some, but not all safeguard holds on the Windows client release information pages for any given release.
-Update Compliance provides two views into the safeguard holds that apply to devices in your population. The report shows data for devices that are configured to send diagnostic data at the *Optional* level (previously *Full*). For Windows 10 devices, devices configured to send diagnostic data at *Enhanced* level are also included.
+As part of the Safeguard Holds report, Update Compliance provides aggregated and device-specific views into the safeguard holds that apply to devices in your population. These views will show data for all devices that are configured to send diagnostic data at the *Optional* level (previously *Full*). For Windows 10 devices, devices configured to send diagnostic data at *Enhanced* level are also included. If your devices are not sending the required diagnostic data, they will be excluded from these views.
The safeguard hold report can be found in a different location from the other Update Compliance reports. To access the safeguard hold report, follow the instructions below.
@@ -36,6 +36,8 @@ The safeguard hold report can be found in a different location from the other Up
4. In the left-hand menu, select **Workbooks**.
5. Under the subsection **WaaSUpdateInsights**, select the workbook named **Safeguard Holds**.
+This report shows information for devices that are managed using the [Windows Update for Business deployment service](/windows/deployment/update/deployment-service-overview). To view information about safeguard holds for other devices, you can use the workbook named **WaaSUpdateInsights** or the [queries for safeguard holds](/windows/deployment/update/update-compliance-feature-update-status) in the Feature Update Status report.
+
## Safeguard hold view
diff --git a/windows/deployment/update/waas-configure-wufb.md b/windows/deployment/update/waas-configure-wufb.md
index 0c557a1ac6..7d70012874 100644
--- a/windows/deployment/update/waas-configure-wufb.md
+++ b/windows/deployment/update/waas-configure-wufb.md
@@ -1,11 +1,12 @@
---
title: Configure Windows Update for Business
-ms.reviewer:
-manager: laurawi
+manager: dougeby
description: You can use Group Policy or your mobile device management (MDM) service to configure Windows Update for Business settings for your devices.
ms.prod: w10
ms.mktglfcycl: deploy
-ms.collection: m365initiative-coredeploy
+ms.collection:
+ - m365initiative-coredeploy
+ - highpri
audience: itpro
author: jaimeo
ms.localizationpriority: medium
@@ -18,7 +19,7 @@ ms.topic: article
**Applies to**
-- Windows 10
+- Windows 10
- Windows 11
- Windows Server 2016
- Windows Server 2019
diff --git a/windows/deployment/update/waas-delivery-optimization.md b/windows/deployment/update/waas-delivery-optimization.md
index 4bd4c62a37..9ebb4c84ec 100644
--- a/windows/deployment/update/waas-delivery-optimization.md
+++ b/windows/deployment/update/waas-delivery-optimization.md
@@ -1,6 +1,6 @@
---
title: Delivery Optimization for Windows client updates
-manager: laurawi
+manager: dougeby
description: This article provides information about Delivery Optimization, a peer-to-peer distribution method in Windows 10.
keywords: oms, operations management suite, wdav, updates, downloads, log analytics
ms.prod: w10
@@ -12,6 +12,7 @@ ms.author: jaimeo
ms.collection:
- M365-modern-desktop
- m365initiative-coredeploy
+- highpri
ms.topic: article
ms.custom: seo-marvel-apr2020
---
@@ -117,7 +118,7 @@ Delivery Optimization also communicates with its cloud service by using HTTP/HTT
#### What are the requirements if I use a proxy?
-For Delivery Optimization to successfully use the proxy, you should set up the proxy by using Windows proxy settings or Internet Explorer proxy settings. For details see [Using a proxy with Delivery Optimization](./delivery-optimization-proxy.md). Most content downloaded with Delivery Optimization uses byte range requests. Make sure your proxy allows byte range requests. For more information, see [Proxy requirements for Windows Update](https://support.microsoft.com/help/3175743/proxy-requirements-for-windows-update).
+For Delivery Optimization to successfully use the proxy, you should set up the proxy by using Windows proxy settings or Internet Explorer proxy settings. For details see [Using a proxy with Delivery Optimization](./delivery-optimization-proxy.md). Most content downloaded with Delivery Optimization uses byte range requests. Make sure your proxy allows byte range requests. For more information, see [Proxy requirements for Windows Update](/windows/deployment/update/windows-update-troubleshooting).
#### What hostnames should I allow through my firewall to support Delivery Optimization?
diff --git a/windows/deployment/update/waas-integrate-wufb.md b/windows/deployment/update/waas-integrate-wufb.md
index b5d5e02b67..4b5547147d 100644
--- a/windows/deployment/update/waas-integrate-wufb.md
+++ b/windows/deployment/update/waas-integrate-wufb.md
@@ -41,11 +41,13 @@ For Windows 10, version 1607 and later, devices can be configured to receive upd
- Admin has opted to put updates to Office and other products on WSUS
- Admin has also put 3rd party drivers on WSUS
-
Content
Metadata source
Payload source
Deferred?
-
Updates to Windows
Windows Update
Windows Update
Yes
-
Updates to Office and other products
WSUS
WSUS
No
-
Third-party drivers
WSUS
WSUS
No
-
+|Content|Metadata source|Payload source|Deferred?|
+|--- |--- |--- |--- |
+|Updates to Windows|Windows Update|Windows Update|Yes|
+|Updates to Office and other products|WSUS|WSUS|No|
+|Third-party drivers|WSUS|WSUS|No|
+
+
### Configuration example \#2: Excluding drivers from Windows quality updates using Windows Update for Business
@@ -55,13 +57,13 @@ For Windows 10, version 1607 and later, devices can be configured to receive upd
- Device is also configured to be managed by WSUS
- Admin has opted to put Windows Update drivers on WSUS
+|Content|Metadata source|Payload source|Deferred?|
+|--- |--- |--- |--- |
+|Updates to Windows (excluding drivers)|Windows Update|Windows Update|Yes|
+|Updates to Office and other products|WSUS|WSUS|No|
+|Drivers|WSUS|WSUS|No|
-
Content
Metadata source
Payload source
Deferred?
-
Updates to Windows (excluding drivers)
Windows Update
Windows Update
Yes
-
Updates to Office and other products
WSUS
WSUS
No
-
Drivers
WSUS
WSUS
No
-
-
+
### Configuration example \#3: Device configured to receive Microsoft updates
@@ -75,12 +77,13 @@ In this example, the deferral behavior for updates to Office and other non-Windo
- In a non-WSUS case, these updates would be deferred just as any update to Windows would be.
- However, with WSUS also configured, these updates are sourced from Microsoft but deferral policies are not applied.
+|Content|Metadata source|Payload source|Deferred?|
+|--- |--- |--- |--- |
+|Updates to Windows (excluding drivers)|Microsoft Update|Microsoft Update|Yes|
+|Updates to Office and other products|Microsoft Update|Microsoft Update|No|
+|Drivers, third-party applications|WSUS|WSUS|No|
-
Content
Metadata source
Payload source
Deferred?
-
Updates to Windows (excluding drivers)
Microsoft Update
Microsoft Update
Yes
-
Updates to Office and other products
Microsoft Update
Microsoft Update
No
-
Drivers, third-party applications
WSUS
WSUS
No
-
+
>[!NOTE]
> Because the admin enabled **Update/AllowMUUpdateService**, placing the content on WSUS was not needed for the particular device, as the device will always receive Microsoft Update content from Microsoft when configured in this manner.
@@ -89,7 +92,7 @@ In this example, the deferral behavior for updates to Office and other non-Windo
For Windows 10, version 1607, organizations already managing their systems with a Configuration Manager solution can also have their devices configured for Windows Update for Business (that is, setting deferral policies on those devices). Such devices will be visible in the Configuration Manager console, however they will appear with a detection state of **Unknown**.
-
+:::image type="content" alt-text="Example of unknown devices." source="images/wufb-sccm.png" lightbox="images/wufb-sccm.png":::
For more information, see [Integration with Windows Update for Business in Windows 10](/sccm/sum/deploy-use/integrate-windows-update-for-business-windows-10).
diff --git a/windows/deployment/update/waas-manage-updates-wsus.md b/windows/deployment/update/waas-manage-updates-wsus.md
index 8bfab4700e..3d2daa50ef 100644
--- a/windows/deployment/update/waas-manage-updates-wsus.md
+++ b/windows/deployment/update/waas-manage-updates-wsus.md
@@ -6,9 +6,9 @@ ms.mktglfcycl: manage
author: jaimeo
ms.localizationpriority: medium
ms.author: jaimeo
-ms.reviewer:
-manager: laurawi
+manager: dougeby
ms.topic: article
+ms.collection: highpri
---
# Deploy Windows client updates using Windows Server Update Services (WSUS)
@@ -16,7 +16,7 @@ ms.topic: article
**Applies to**
-- Windows 10
+- Windows 10
- Windows 11
> **Looking for consumer information?** See [Windows Update: FAQ](https://support.microsoft.com/help/12373/windows-update-faq)
@@ -60,7 +60,7 @@ When using WSUS to manage updates on Windows client devices, start by configurin
3. Right-click **Your_Domain**, and then select **Create a GPO in this domain, and Link it here**.
- 
+ 
>[!NOTE]
>In this example, the **Configure Automatic Updates** and **Intranet Microsoft Update Service Location** Group Policy settings are specified for the entire domain. This is not a requirement; you can target these settings to any security group by using Security Filtering or a specific OU.
@@ -73,13 +73,13 @@ When using WSUS to manage updates on Windows client devices, start by configurin
7. Right-click the **Configure Automatic Updates** setting, and then click **Edit**.
- 
+ 
8. In the **Configure Automatic Updates** dialog box, select **Enable**.
9. Under **Options**, from the **Configure automatic updating** list, select **3 - Auto download and notify for install**, and then click **OK**.
- 
+ 
>[!IMPORTANT]
> Use Regedit.exe to check that the following key is not enabled, because it can break Windows Store connectivity: Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\DoNotConnectToWindowsUpdateInternetLocations
@@ -91,12 +91,12 @@ When using WSUS to manage updates on Windows client devices, start by configurin
11. In the **Specify intranet Microsoft update service location** dialog box, select **Enable**.
-12. Under **Options**, in the **Set the intranet update service for detecting updates** and **Set the intranet statistics server** options, type http://Your_WSUS_Server_FQDN:PortNumber, and then select **OK**.
+12. Under **Options**, in the **Set the intranet update service for detecting updates** and **Set the intranet statistics server** options, type `http://Your_WSUS_Server_FQDN:PortNumber`, and then select **OK**.
>[!NOTE]
>The URL `http://CONTOSO-WSUS1.contoso.com:8530` in the following image is just an example. In your environment, be sure to use the server name and port number for your WSUS instance.
- 
+ 
>[!NOTE]
>The default HTTP port for WSUS is 8530, and the default HTTP over Secure Sockets Layer (HTTPS) port is 8531. (The other options are 80 and 443; no other ports are supported.)
@@ -116,7 +116,7 @@ You can use computer groups to target a subset of devices that have specific qua
2. Go to *Server_Name*\Computers\All Computers, and then click **Add Computer Group**.
- 
+ 
3. Type **Ring 2 Pilot Business Users** for the name, and then click **Add**.
@@ -144,7 +144,7 @@ When new computers communicate with WSUS, they appear in the **Unassigned Comput
2. Select both computers, right-click the selection, and then click **Change Membership**.
- 
+ 
3. In the **Set Computer Group Membership** dialog box, select the **Ring 2 Pilot Business Users** deployment ring, and then click **OK**.
@@ -162,7 +162,7 @@ Another way to add multiple computers to a deployment ring in the WSUS Administr
3. In the search results, select the computers, right-click the selection, and then click **Change Membership**.
- 
+ 
4. Select the **Ring 3 Broad IT** deployment ring, and then click **OK**.
@@ -179,7 +179,7 @@ The WSUS Administration Console provides a friendly interface from which you can
1. Open the WSUS Administration Console, and go to *Server_Name*\Options, and then click **Computers**.
- 
+ 
2. In the **Computers** dialog box, select **Use Group Policy or registry settings on computers**, and then click **OK**.
@@ -203,7 +203,7 @@ Now that WSUS is ready for client-side targeting, complete the following steps t
5. Right-click the **WSUS – Client Targeting – Ring 4 Broad Business Users** GPO, and then click **Edit**.
- 
+ 
6. In the Group Policy Management Editor, go to Computer Configuration\Policies\Administrative Templates\Windows Components\Windows Update.
@@ -213,7 +213,7 @@ Now that WSUS is ready for client-side targeting, complete the following steps t
9. In the **Target group name for this computer** box, type *Ring 4 Broad Business Users*. This is the name of the deployment ring in WSUS to which these computers will be added.
- 
+ 
> [!WARNING]
> The target group name must match the computer group name.
@@ -230,7 +230,7 @@ Now you’re ready to deploy this GPO to the correct computer security group for
3. Under **Security Filtering**, remove the default **AUTHENTICATED USERS** security group, and then add the **Ring 4 Broad Business Users** group.
- 
+ 
The next time the clients in the **Ring 4 Broad Business Users** security group receive their computer policy and contact WSUS, they will be added to the **Ring 4 Broad Business Users** deployment ring.
@@ -239,7 +239,7 @@ The next time the clients in the **Ring 4 Broad Business Users** security group
For clients that should have their feature updates approved as soon as they’re available, you can configure Automatic Approval rules in WSUS.
>[!NOTE]
->WSUS respects the client device's servicing branch. If you approve a feature update while it is still in one branch, such as Insider Preview, WSUS will install the update only on devices that are in that servicing branch. When Microsoft releases the build for Semi-Annual Channel (or General Availability Channel), the devices in that will install it. Windows Update for Business branch settings do not apply to feature updates through WSUS.
+>WSUS respects the client device's servicing branch. If you approve a feature update while it is still in one branch, such as Insider Preview, WSUS will install the update only on devices that are in that servicing branch. When Microsoft releases the build for the [General Availability Channel](waas-overview.md#general-availability-channel), the devices in that will install it. Windows Update for Business branch settings do not apply to feature updates through WSUS.
**To configure an Automatic Approval rule for Windows client feature updates and approve them for the Ring 3 Broad IT deployment ring**
@@ -251,7 +251,7 @@ This example uses Windows 10, but the process is the same for Windows 11.
3. In the **Add Rule** dialog box, select the **When an update is in a specific classification**, **When an update is in a specific product**, and **Set a deadline for the approval** check boxes.
- 
+ 
4. In the **Edit the properties** area, select **any classification**. Clear everything except **Upgrades**, and then click **OK**.
@@ -265,7 +265,7 @@ This example uses Windows 10, but the process is the same for Windows 11.
8. In the **Step 3: Specify a name** box, type **Windows 10 Upgrade Auto-approval for Ring 3 Broad IT**, and then click **OK**.
- 
+ 
9. In the **Automatic Approvals** dialog box, click **OK**.
@@ -300,7 +300,7 @@ To simplify the manual approval process, start by creating a software update vie
5. In the **Step 3: Specify a name** box, type **All Windows 10 Upgrades**, and then click **OK**.
- 
+ 
Now that you have the **All Windows 10 Upgrades** view, complete the following steps to manually approve an update for the **Ring 4 Broad Business Users** deployment ring:
@@ -308,21 +308,21 @@ Now that you have the **All Windows 10 Upgrades** view, complete the following s
2. Right-click the feature update you want to deploy, and then click **Approve**.
- 
+ 
3. In the **Approve Updates** dialog box, from the **Ring 4 Broad Business Users** list, select **Approved for Install**.
- 
+ 
4. In the **Approve Updates** dialog box, from the **Ring 4 Broad Business Users** list, click **Deadline**, click **One Week**, and then click **OK**.
- 
+ 
5. If the **Microsoft Software License Terms** dialog box opens, click **Accept**.
If the deployment is successful, you should receive a successful progress report.
- 
+ 
6. In the **Approval Progress** dialog box, click **Close**.
diff --git a/windows/deployment/update/waas-manage-updates-wufb.md b/windows/deployment/update/waas-manage-updates-wufb.md
index dea3bbba22..01e1e4742d 100644
--- a/windows/deployment/update/waas-manage-updates-wufb.md
+++ b/windows/deployment/update/waas-manage-updates-wufb.md
@@ -1,7 +1,6 @@
---
title: Windows Update for Business
-ms.reviewer:
-manager: laurawi
+manager: dougeby
description: Learn how Windows Update for Business lets you manage when devices receive updates from Windows Update.
ms.prod: w10
ms.mktglfcycl: manage
@@ -10,6 +9,7 @@ ms.localizationpriority: medium
ms.author: jaimeo
ms.topic: article
ms.custom: seo-marvel-apr2020
+ms.collection: highpri
---
# What is Windows Update for Business?
@@ -17,7 +17,7 @@ ms.custom: seo-marvel-apr2020
**Applies to**
-- Windows 10
+- Windows 10
- Windows 11
diff --git a/windows/deployment/update/waas-overview.md b/windows/deployment/update/waas-overview.md
index 5947bdc897..fb16b23675 100644
--- a/windows/deployment/update/waas-overview.md
+++ b/windows/deployment/update/waas-overview.md
@@ -1,15 +1,15 @@
---
title: Overview of Windows as a service
description: Windows as a service is a way to build, deploy, and service Windows. Learn how Windows as a service works.
-keywords: updates, servicing, current, deployment, semi-annual channel, feature, quality, rings, insider, tools
+keywords: updates, servicing, current, deployment, General Availability Channel, semi-annual channel, feature, quality, rings, insider, tools
ms.prod: w10
ms.mktglfcycl: manage
author: jaimeo
ms.localizationpriority: medium
ms.author: jaimeo
-ms.reviewer:
-manager: laurawi
+manager: dougeby
ms.topic: article
+ms.collection: highpri
---
# Overview of Windows as a service
@@ -17,7 +17,7 @@ ms.topic: article
**Applies to**
-- Windows 10
+- Windows 10
- Windows 11
> **Looking for consumer information?** See [Windows Update: FAQ](https://support.microsoft.com/help/12373/windows-update-faq)
@@ -90,9 +90,9 @@ There are three servicing channels. The [Windows Insider Program](#windows-insid
### General Availability Channel
-In the General Availability Channel, feature updates are available as soon as Microsoft releases them. This servicing model is ideal for pilot deployments and testing of feature updates and for users such as developers who need to work with the latest features immediately. Once the latest release has gone through pilot deployment and testing, you will be able to choose the timing at which it goes into broad deployment.
+In the General Availability Channel, feature updates are available annually. This servicing model is ideal for pilot deployments and testing of feature updates and for users such as developers who need to work with the latest features. Once the latest release has gone through pilot deployment and testing, you will be able to choose the timing at which it goes into broad deployment.
-When Microsoft officially releases a feature update, we make it available to any device not configured to defer feature updates so that those devices can immediately install it. Organizations that use Windows Server Update Services (WSUS), Microsoft Endpoint Configuration Manager, or Windows Update for Business, however, can defer feature updates to selective devices by withholding their approval and deployment. In this scenario, the content available for the Semi-Annual Channel will be available but not necessarily immediately mandatory, depending on the policy of the management system. For more details about servicing tools, see [Servicing tools](#servicing-tools).
+When Microsoft officially releases a feature update, we make it available to any device not configured to defer feature updates so that those devices can immediately install it. Organizations that use Windows Server Update Services (WSUS), Microsoft Endpoint Configuration Manager, or Windows Update for Business, however, can defer feature updates to selective devices by withholding their approval and deployment. In this scenario, the content available for the General Availability Channel will be available but not necessarily immediately mandatory, depending on the policy of the management system. For more details about servicing tools, see [Servicing tools](#servicing-tools).
> [!NOTE]
@@ -113,14 +113,14 @@ Specialized systems—such as devices that control medical equipment, point-of-s
Microsoft never publishes feature updates through Windows Update on devices that run Windows 10 Enterprise LTSC. Instead, it typically offers new LTSC releases every 2–3 years, and organizations can choose to install them as in-place upgrades or even skip releases over a 10-year life cycle.
> [!NOTE]
-> LTSC releases will support the currently released processors and chipsets at the time of release of the LTSC. As future CPU generations are released, support will be created through future LTSC releases that customers can deploy for those systems. For more information, see **Supporting the latest processor and chipsets on Windows** in [Lifecycle support policy FAQ - Windows Products](https://support.microsoft.com/help/18581/lifecycle-support-policy-faq-windows-products).
+> LTSC releases will support the currently released processors and chipsets at the time of release of the LTSC. As future CPU generations are released, support will be created through future LTSC releases that customers can deploy for those systems. For more information, see **Supporting the latest processor and chipsets on Windows** in [Lifecycle support policy FAQ - Windows Products](/lifecycle/faq/windows).
The Long-term Servicing Channel is available only in the Windows 10 Enterprise LTSC editions. This edition of Windows doesn’t include a number of applications, such as Microsoft Edge, Microsoft Store, Cortana (though limited search capabilities remain available), Microsoft Mail, Calendar, OneNote, Weather, News, Sports, Money, Photos, Camera, Music, and Clock. These apps are not supported in the Enterprise LTSC editions, even if you install by using sideloading.
### Windows Insider
-For many IT pros, gaining visibility into feature updates early--before they’re available to the Semi-Annual Channel — can be both intriguing and valuable for future end user communications as well as provide the means to test for any issues on the next General Availability release. Windows Insiders can consume and deploy preproduction code to their test machines, gaining early visibility into the next build. Testing the early builds helps both Microsoft and its customers because they have the opportunity to discover possible issues before the update is ever publicly available and can report it to Microsoft.
+For many IT pros, gaining visibility into feature updates early--before they’re available to the General Availability Channel — can be both intriguing and valuable for future end user communications as well as provide the means to test for any issues on the next General Availability release. Windows Insiders can consume and deploy preproduction code to their test machines, gaining early visibility into the next build. Testing the early builds helps both Microsoft and its customers because they have the opportunity to discover possible issues before the update is ever publicly available and can report it to Microsoft.
Microsoft recommends that all organizations have at least a few devices enrolled in the Windows Insider Program and provide feedback on any issues they encounter. For information about the Windows Insider Program for Business, go to [Windows Insider Program for Business](/windows-insider/at-work-pro/wip-4-biz-get-started).
@@ -130,7 +130,7 @@ Microsoft recommends that all organizations have at least a few devices enrolled
There are many tools you can use to service Windows as a service. Each option has its pros and cons, ranging from capabilities and control to simplicity and low administrative requirements. The following are examples of the servicing tools available to manage Windows as a service updates:
-- **Windows Update (stand-alone)** provides limited control over feature updates, with IT pros manually configuring the device to be in the Semi-Annual Channel. Organizations can target which devices defer updates by selecting the **Defer upgrades** check box in **Start\Settings\Update & Security\Advanced Options** on a Windows client device.
+- **Windows Update (stand-alone)** provides limited control over feature updates, with IT pros manually configuring the device to be in the General Availability Channel. Organizations can target which devices defer updates by selecting the **Defer upgrades** check box in **Start\Settings\Update & Security\Advanced Options** on a Windows client device.
- **Windows Update for Business** includes control over update deferment and provides centralized management using Group Policy or MDM. Windows Update for Business can be used to defer updates by up to 365 days, depending on the version. These deployment options are available to clients in the General Availability Channel. In addition to being able to use Group Policy to manage Windows Update for Business, either option can be configured without requiring any on-premises infrastructure by using Microsoft Intune.
- **Windows Server Update Services (WSUS)** provides extensive control over updates and is natively available in the Windows Server operating system. In addition to the ability to defer updates, organizations can add an approval layer for updates and choose to deploy them to specific computers or groups of computers whenever ready.
- **Microsoft Endpoint Configuration Manager** provides the greatest control over servicing Windows as a service. IT pros can defer updates, approve them, and have multiple options for targeting deployments and managing bandwidth usage and deployment times.
diff --git a/windows/deployment/update/waas-quick-start.md b/windows/deployment/update/waas-quick-start.md
index f9c793095d..3471f175df 100644
--- a/windows/deployment/update/waas-quick-start.md
+++ b/windows/deployment/update/waas-quick-start.md
@@ -1,15 +1,15 @@
---
title: Quick guide to Windows as a service (Windows 10)
description: In Windows 10, Microsoft has streamlined servicing to make operating system updates simpler to test, manage, and deploy.
-keywords: updates, servicing, current, deployment, semi-annual channel, feature, quality, rings, insider, tools
+keywords: updates, servicing, current, deployment, General Availability Channel, semi-annual channel, feature, quality, rings, insider, tools
ms.prod: w10
ms.mktglfcycl: manage
author: jaimeo
ms.localizationpriority: high
ms.author: jaimeo
-ms.reviewer:
-manager: laurawi
+manager: dougeby
ms.topic: article
+ms.collection: highpri
---
# Quick guide to Windows as a service
@@ -17,7 +17,7 @@ ms.topic: article
**Applies to**
-- Windows 10
+- Windows 10
- Windows 11
Here is a quick guide to the most important concepts in Windows as a service. For more information, see the [extensive set of documentation](index.md).
@@ -25,12 +25,13 @@ Here is a quick guide to the most important concepts in Windows as a service. Fo
## Definitions
Some new terms have been introduced as part of Windows as a service, so you should know what these terms mean.
-- **Feature updates** are released twice per year, around March and September. As the name suggests, these updates add new features, delivered in bite-sized chunks compared to the previous practice of Windows releases every 3-5 years.
+
+- **Feature updates** are released annually. As the name suggests, these updates add new features, delivered in bite-sized chunks compared to the previous practice of Windows releases every 3-5 years.
- **Quality updates** deliver both security and non-security fixes. They are typically released on the second Tuesday of each month, though they can be released at any time. Quality updates include security updates, critical updates, servicing stack updates, and driver updates. Quality updates are cumulative, so installing the latest quality update is sufficient to get all the available fixes for a specific Windows 10 feature update. The "servicing stack" is the code that installs other updates, so they are important to keep current. For more information, see [Servicing stack updates](servicing-stack-updates.md).
- **Insider Preview** builds are made available during the development of the features that will be shipped in the next feature update, enabling organizations to validate new features and confirm compatibility with existing apps and infrastructure, providing feedback to Microsoft on any issues encountered.
- **Servicing channels** allow organizations to choose when to deploy new features.
- - The **General Availability Channel** receives feature updates as they become available.
- - The **Long-Term Servicing Channel**, which meant only for specialized devices (which typically don't run Office) such as those that control medical equipment or ATM machines, receives new feature releases every two to three years.
+ - The **General Availability Channel** receives feature updates annually.
+ - The **Long-Term Servicing Channel**, which meant only for specialized devices (which typically don't run Office) such as those that control medical equipment or ATM machines, receives new feature releases every two to three years.
- **Deployment rings** are groups of devices used to initially pilot, and then to broadly deploy, each feature update in an organization.
See [Overview of Windows as a service](waas-overview.md) for more information.
@@ -51,6 +52,6 @@ To stay up to date, deploy feature updates at an appropriate time after their re
Extensive advanced testing isn’t required. Instead, only business-critical apps need to be tested, with the remaining apps validated through a series of pilot deployment rings. Once these pilot deployments have validated most apps, broad deployment can begin.
-This process repeats with each new feature update as they become available. These are small deployment projects, compared to the large projects that were necessary with the old three-to-five-year Windows release cycles.
+This process repeats with each new feature update. These are small deployment projects, compared to the large projects that were necessary with the old three-to-five-year Windows release cycles.
Other technologies such as BranchCache and Delivery Optimization, both peer-to-peer distribution tools, can help with the distribution of the feature update installation files.
diff --git a/windows/deployment/update/waas-restart.md b/windows/deployment/update/waas-restart.md
index c33db61e09..6f20c17750 100644
--- a/windows/deployment/update/waas-restart.md
+++ b/windows/deployment/update/waas-restart.md
@@ -6,11 +6,11 @@ ms.mktglfcycl: deploy
author: jaimeo
ms.localizationpriority: medium
ms.author: jaimeo
-ms.reviewer:
-manager: laurawi
+manager: dougeby
ms.topic: article
ms.custom:
- seo-marvel-apr2020
+ms.collection: highpri
---
# Manage device restarts after updates
@@ -18,7 +18,7 @@ ms.custom:
**Applies to**
-- Windows 10
+- Windows 10
> **Looking for consumer information?** See [Windows Update: FAQ](https://support.microsoft.com/help/12373/windows-update-faq)
diff --git a/windows/deployment/update/waas-servicing-channels-windows-10-updates.md b/windows/deployment/update/waas-servicing-channels-windows-10-updates.md
index cbf9133ff3..65880f7388 100644
--- a/windows/deployment/update/waas-servicing-channels-windows-10-updates.md
+++ b/windows/deployment/update/waas-servicing-channels-windows-10-updates.md
@@ -43,7 +43,7 @@ The General Availability Channel is the default servicing channel for all Window
>The LTSC edition is only available through the [Microsoft Volume Licensing Center](https://www.microsoft.com/Licensing/servicecenter/default.aspx).
>[!NOTE]
->Devices will automatically receive updates from the Semi-Annual Channel, unless they are configured to receive preview updates through the Windows Insider Program.
+>Devices will automatically receive updates from the General Availability Channel, unless they are configured to receive preview updates through the Windows Insider Program.
## Enroll devices in the Windows Insider Program
diff --git a/windows/deployment/update/waas-servicing-strategy-windows-10-updates.md b/windows/deployment/update/waas-servicing-strategy-windows-10-updates.md
index 3fda1c0024..3f7a279aaa 100644
--- a/windows/deployment/update/waas-servicing-strategy-windows-10-updates.md
+++ b/windows/deployment/update/waas-servicing-strategy-windows-10-updates.md
@@ -28,7 +28,7 @@ Here’s an example of what this process might look like:
- **Configure test devices.** Configure test devices in the Windows Insider Program so that Insiders can test feature updates before they’re available to the General Availability Channel. Typically, this population would be a few test devices that IT staff members use to evaluate pre-release builds of Windows. Microsoft provides current development builds to Windows Insider members approximately every week so that interested users can see the functionality Microsoft is adding. See the section Windows Insider for details on how to enroll in the Windows Insider Program for Business.
- **Identify excluded devices.** For some organizations, special-purpose devices such as those used to control factory or medical equipment or run ATMs require a stricter, less frequent feature update cycle than the General Availability Channel can offer. For those devices, install the Enterprise LTSC edition to avoid feature updates for up to 10 years. Identify these devices, and separate them from the phased deployment and servicing cycles to help remove confusion for your administrators and ensure that devices are handled correctly.
- **Recruit volunteers.** The purpose of testing a deployment is to receive feedback. One effective way to recruit pilot users is to request volunteers. When doing so, clearly state that you’re looking for feedback rather than people to just “try it out” and that there could be occasional issues involved with accepting feature updates right away. With Windows as a service, the expectation is that there should be few issues, but if an issue does arise, you want testers to let you know as soon as possible. When considering whom to recruit for pilot groups, be sure to include members who provide the broadest set of applications and devices to validate the largest number of apps and devices possible.
-- **Update Group Policy.** Each feature update includes new group policies to manage new features. If you use Group Policy to manage devices, the Group Policy Admin for the Active Directory domain will need to download an .admx package and copy it to their [Central Store](https://support.microsoft.com/help/929841/how-to-create-the-central-store-for-group-policy-administrative-templa) (or to the [PolicyDefinitions](/previous-versions/dotnet/articles/bb530196(v=msdn.10)) directory in the SYSVOL folder of a domain controller if not using a Central Store). You can manage new group policies from the latest release of Windows by using Remote Server Administration Tools. The ADMX download package is created at the end of each development cycle and then posted for download. To find the ADMX download package for a given Windows build, search for “ADMX download for Windows build xxxx”. For details about Group Policy management, see [How to create and manage the Central Store for Group Policy Administrative Templates in Windows](https://support.microsoft.com/help/3087759/how-to-create-and-manage-the-central-store-for-group-policy-administra)
+- **Update Group Policy.** Each feature update includes new group policies to manage new features. If you use Group Policy to manage devices, the Group Policy Admin for the Active Directory domain will need to download an .admx package and copy it to their [Central Store](/troubleshoot/windows-server/group-policy/create-central-store-domain-controller) (or to the [PolicyDefinitions](/previous-versions/dotnet/articles/bb530196(v=msdn.10)) directory in the SYSVOL folder of a domain controller if not using a Central Store). You can manage new group policies from the latest release of Windows by using Remote Server Administration Tools. The ADMX download package is created at the end of each development cycle and then posted for download. To find the ADMX download package for a given Windows build, search for “ADMX download for Windows build xxxx”. For details about Group Policy management, see [How to create and manage the Central Store for Group Policy Administrative Templates in Windows](/troubleshoot/windows-client/group-policy/create-and-manage-central-store)
- **Choose a servicing tool.** Decide which product you’ll use to manage the Windows updates in your environment. If you’re currently using Windows Server Update Services (WSUS) or Microsoft Endpoint Manager to manage your Windows updates, you can continue using those products to manage Windows 10 or Windows 11 updates. Alternatively, you can use Windows Update for Business. In addition to which product you’ll use, consider how you’ll deliver the updates. Multiple peer-to-peer options are available to make update distribution faster. For a comparison of tools, see [Servicing tools](waas-overview.md#servicing-tools).
- **Prioritize applications.** First, create an application portfolio. This list should include everything installed in your organization and any webpages your organization hosts. Next, prioritize this list to identify those apps that are the most business critical. Because the expectation is that application compatibility with new versions of Windows will be high, only the most business-critical applications should be tested before the pilot phase; everything else can be tested afterwards. For more information about identifying compatibility issues withe applications, see [Manage Windows upgrades with Upgrade Analytics](/mem/configmgr/desktop-analytics/overview).
diff --git a/windows/deployment/update/waas-wu-settings.md b/windows/deployment/update/waas-wu-settings.md
index 983dae6b61..3dc0059251 100644
--- a/windows/deployment/update/waas-wu-settings.md
+++ b/windows/deployment/update/waas-wu-settings.md
@@ -7,10 +7,10 @@ audience: itpro
ms.localizationpriority: medium
ms.audience: itpro
author: jaimeo
-ms.reviewer:
-manager: laurawi
+manager: dougeby
ms.topic: article
ms.custom: seo-marvel-apr2020
+ms.collection: highpri
---
# Manage additional Windows Update settings
@@ -18,7 +18,7 @@ ms.custom: seo-marvel-apr2020
**Applies to**
-- Windows 10
+- Windows 10
- Windows 11
diff --git a/windows/deployment/update/waas-wufb-group-policy.md b/windows/deployment/update/waas-wufb-group-policy.md
index 086e6b3841..8590d0c0cc 100644
--- a/windows/deployment/update/waas-wufb-group-policy.md
+++ b/windows/deployment/update/waas-wufb-group-policy.md
@@ -6,8 +6,10 @@ ms.mktglfcycl: manage
author: jaimeo
ms.localizationpriority: medium
ms.author: jaimeo
-ms.collection: m365initiative-coredeploy
-manager: laurawi
+ms.collection:
+ - m365initiative-coredeploy
+ - highpri
+manager: dougeby
ms.topic: article
---
@@ -16,7 +18,7 @@ ms.topic: article
**Applies to**
-- Windows 10
+- Windows 10
- Windows 11
> **Looking for consumer information?** See [Windows Update: FAQ](https://support.microsoft.com/help/12373/windows-update-faq)
@@ -31,7 +33,7 @@ To manage updates with Windows Update for Business as described in this article,
- Create Active Directory security groups that align with the deployment rings you use to phase deployment of updates.
- Allow access to the Windows Update service.
-- Download and install ADMX templates appropriate to your Windows 10 version. For more information, see [How to create and manage the Central Store for Group Policy Administrative Templates in Windows](https://support.microsoft.com/help/3087759) and [Step-By-Step: Managing Windows 10 with Administrative templates](/archive/blogs/canitpro/step-by-step-managing-windows-10-with-administrative-templates).
+- Download and install ADMX templates appropriate to your Windows 10 version. For more information, see [How to create and manage the Central Store for Group Policy Administrative Templates in Windows](/troubleshoot/windows-client/group-policy/create-and-manage-central-store) and [Step-By-Step: Managing Windows 10 with Administrative templates](/archive/blogs/canitpro/step-by-step-managing-windows-10-with-administrative-templates).
## Set up Windows Update for Business
@@ -42,10 +44,15 @@ Follow these steps on a device running the Remote Server Administration Tools or
### Set up a ring
1. Start Group Policy Management Console (gpmc.msc).
-2. Expand **Forest > Domains > *\**.
+
+2. Expand **Forest > Domains > *\*.
+
3. Right-click *\* and select **Create a GPO in this domain and link it here**.
-4. In the **New GPO** dialog box, enter *Windows Update for Business - Group 1* as the name of the new Group Policy Object.
+
+4. In the **New GPO** dialog box, enter **Windows Update for Business - Group 1** as the name of the new Group Policy Object.
+
5. Right-click the **"Windows Update for Business - Group 1"** object, and then select **Edit**.
+
6. In the Group Policy Management Editor, go to **Computer Configuration > Policies > Administrative Templates > Windows Components > Windows Update**. You are now ready to start assigning policies to this ring (group) of devices.
@@ -68,8 +75,11 @@ Drivers are automatically enabled because they are beneficial to device systems.
#### I want to receive pre-release versions of the next feature update
1. Ensure that you are enrolled in the Windows Insider Program for Business. This is a completely free program available to commercial customers to aid them in their validation of feature updates before they are released. Joining the program enables you to receive updates prior to their release as well as receive emails and content related to what is coming in the next updates.
+
2. Use Group Policy Management Console to go to: **Computer Configuration > Administrative Templates > Windows Components > Windows Update > Windows Update for Business > Manage preview builds** and set the policy to **Enable preview builds** for any of test devices you want to install pre-release builds.
+
3. Use Group Policy Management Console to go to **Computer Configuration > Administrative Templates > Windows Components > Windows Update > Windows Update for Business > Select when Preview Builds and feature updates are received**. In the **Options** pane, use the pulldown menu to select one of the preview builds. We recomment **Windows Insider Program Slow** for commercial customers using pre-release builds for validation.
+
4. Select **OK**.
#### I want to manage which released feature update my devices receive
@@ -83,19 +93,19 @@ A Windows Update for Business administrator can defer or pause updates. You can
In this example, there are three rings for quality updates. The first ring ("pilot") has a deferral period of 0 days. The second ring ("fast") has a deferral of five days. The third ring ("slow") has a deferral of ten days.
-
+:::image type="content" alt-text="illustration of devices divided into three rings." source="images/waas-wufb-3-rings.png" lightbox="images/waas-wufb-3-rings.png":::
When the quality update is released, it is offered to devices in the pilot ring the next time they scan for updates.
##### Five days later
The devices in the fast ring are offered the quality update the next time they scan for updates.
-
+:::image type="content" alt-text="illustration of devices with fast ring deployed." source="images/waas-wufb-fast-ring.png" lightbox="images/waas-wufb-fast-ring.png":::
##### Ten days later
Ten days after the quality update is released, it is offered to the devices in the slow ring the next time they scan for updates.
-
+:::image type="content" alt-text="illustration of devices with slow ring deployed." source="images/waas-wufb-slow-ring.png" lightbox="images/waas-wufb-slow-ring.png":::
If no problems occur, all of the devices that scan for updates will be offered the quality update within ten days of its release, in three waves.
@@ -103,11 +113,11 @@ If no problems occur, all of the devices that scan for updates will be offered t
In this example, some problem is discovered during the deployment of the update to the "pilot" ring.
-
+:::image type="content" alt-text="illustration of devices divided with pilot ring experiencing a problem." source="images/waas-wufb-pilot-problem.png" lightbox="images/waas-wufb-pilot-problem.png":::
At this point, the IT administrator can set a policy to pause the update. In this example, the admin selects the **Pause quality updates** check box.
-
+:::image type="content" alt-text="illustration of rings with pause quality update check box selected." source="images/waas-wufb-pause.png" lightbox="images/waas-wufb-pause.png":::
Now all devices are paused from updating for 35 days. When the pause is removed, they will be offered the *next* quality update, which ideally will not have the same issue. If there is still an issue, the IT admin can pause updates again.
diff --git a/windows/deployment/update/windows-as-a-service.md b/windows/deployment/update/windows-as-a-service.md
index 2e41bda86e..a034dba7a3 100644
--- a/windows/deployment/update/windows-as-a-service.md
+++ b/windows/deployment/update/windows-as-a-service.md
@@ -1,5 +1,5 @@
---
-title: Windows as a service
+title: Windows as a service
ms.prod: w10
ms.topic: landing-page
ms.manager: laurawi
@@ -26,21 +26,20 @@ Find the latest and greatest news on Windows 10 deployment and servicing.
**Discovering the Windows 10 Update history pages**
> [!VIDEO https://www.youtube-nocookie.com/embed/mTnAb9XjMPY]
-Everyone wins when transparency is a top priority. We want you to know when updates are available, as well as alert you to any potential issues you may encounter during or after you install an update. Bookmark the Windows release health dashboard for near real-time information on known issues, workarounds, and resolutions--as well as the current status of the latest feature update rollout.
+Everyone wins when transparency is a top priority. We want you to know when updates are available, as well as alert you to any potential issues you may encounter during or after you install an update. Bookmark the [Windows release health dashboard](/windows/release-health/) for near real-time information on known issues, workarounds, and resolutions--as well as the current status of the latest feature update rollout.
The latest news:
-
+
+- [How to get Extended Security Updates for eligible Windows devices](https://techcommunity.microsoft.com/t5/Windows-IT-Pro-Blog/How-to-get-Extended-Security-Updates-for-eligible-Windows/ba-p/917807) - October 17, 2019
+- [End of service reminders for Windows 10, versions 1703 and 1803](https://techcommunity.microsoft.com/t5/Windows-IT-Pro-Blog/End-of-service-reminders-for-Windows-10-versions-1703-and-1803/ba-p/903715) - October 9, 2019
+- [Using machine learning to improve the Windows 10 update experience](https://techcommunity.microsoft.com/t5/Windows-IT-Pro-Blog/Using-machine-learning-to-improve-the-Windows-10-update/ba-p/877860) - September 26, 2019
+- [Publishing pre-release Windows 10 feature updates to WSUS](https://techcommunity.microsoft.com/t5/Windows-IT-Pro-Blog/Publishing-pre-release-Windows-10-feature-updates-to-WSUS/ba-p/845054) - September 24, 2019
+- [New extended support dates for MDOP tools](https://techcommunity.microsoft.com/t5/Windows-IT-Pro-Blog/New-extended-support-dates-for-MDOP-tools/ba-p/837312) - September 4, 2019
+- [FastTrack for Windows 10 deployment and other migration resources](https://techcommunity.microsoft.com/t5/Windows-IT-Pro-Blog/FastTrack-for-Windows-10-deployment-and-other-migration/ba-p/800406) - August 12, 2019
+- [Tactical considerations for creating Windows deployment rings](https://techcommunity.microsoft.com/t5/Windows-IT-Pro-Blog/Tactical-considerations-for-creating-Windows-deployment-rings/ba-p/746979) - July 10, 2019
+- [Upgrading Windows 10 devices with installation media different than the original OS install language](https://techcommunity.microsoft.com/t5/Windows-IT-Pro-Blog/Upgrading-Windows-10-devices-with-installation-media-different/ba-p/746126) - July 9, 2019
+- [Moving to the next Windows 10 feature update for commercial customers](https://techcommunity.microsoft.com/t5/Windows-IT-Pro-Blog/Moving-to-the-next-Windows-10-feature-update-for-commercial/ba-p/732968) - July 1, 2019
+
[See more news](waas-morenews.md). You can also check out the [Windows 10 blog](https://techcommunity.microsoft.com/t5/Windows-10-Blog/bg-p/Windows10Blog).
@@ -49,20 +48,19 @@ Written by IT pros for IT pros, sharing real world examples and scenarios for Wi
-**NEW** Tactical considerations for creating Windows deployment rings
+[**NEW** Tactical considerations for creating Windows deployment rings](https://techcommunity.microsoft.com/t5/Windows-IT-Pro-Blog/Tactical-considerations-for-creating-Windows-deployment-rings/ba-p/746979)
-**NEW** Windows 10 Enterprise vs. Windows 10 Pro: Modern management considerations for your organization
+[**NEW** Windows 10 Enterprise vs. Windows 10 Pro: Modern management considerations for your organization](https://techcommunity.microsoft.com/t5/Windows-IT-Pro-Blog/Windows-10-Enterprise-vs-Windows-10-Pro-Modern-management/ba-p/720445)
-Deployment rings: The hidden [strategic] gem of Windows as a service
+[Deployment rings: The hidden [strategic] gem of Windows as a service](https://techcommunity.microsoft.com/t5/Windows-IT-Pro-Blog/Deployment-rings-The-hidden-strategic-gem-of-Windows-as-a/ba-p/659622)
-Classifying Windows updates in common deployment tools
+[Classifying Windows updates in common deployment tools](https://techcommunity.microsoft.com/t5/Windows-IT-Pro-Blog/Classifying-Windows-updates-in-common-deployment-tools/ba-p/331175)
-Express updates for Windows Server 2016 re-enabled for November 2018 update
-
+[Express updates for Windows Server 2016 re-enabled for November 2018 update](/windows-server/get-started/express-updates)
-2019 SHA-2 Code Signing Support requirement for Windows and WSUS
+[2019 SHA-2 Code Signing Support requirement for Windows and WSUS](https://support.microsoft.com/help/4472027/)
-Deploying Windows 10 Feature Updates to 24/7 Mission Critical Devices
+[What is Windows Update for Business?](waas-manage-updates-wufb.md)
## Discover
@@ -70,14 +68,14 @@ Learn more about Windows as a service and its value to your organization.
-Overview of Windows as a service
+[Overview of Windows as a service](waas-overview.md)
-Quick guide to Windows as a service
+[Quick guide to Windows as a service](waas-quick-start.md)
-What's new in Windows 10 deployment
+[What's new in Windows 10 deployment](../deploy-whats-new.md)
-How Microsoft IT deploys Windows 10
+[How Microsoft IT deploys Windows 10](https://channel9.msdn.com/events/Ignite/2015/BRK3303)
## Plan
@@ -85,15 +83,15 @@ Prepare to implement Windows as a service effectively using the right tools, pro
-Simplified updates
+[Simplified updates](https://www.microsoft.com/windowsforbusiness/simplified-updates)
-Windows 10 end user readiness
+[Windows 10 end user readiness](https://www.microsoft.com/itpro/windows-10/end-user-readiness)
-Ready for Windows
+[Ready for Windows](https://developer.microsoft.com/windows/ready-for-windows#/)
-Manage Windows upgrades with Upgrade Readiness
+[Manage Windows upgrades with Upgrade Readiness](/mem/configmgr/desktop-analytics/overview)
-Preparing your organization for a seamless Windows 10 deployment
+[Preparing your organization for a seamless Windows 10 deployment](https://www.microsoft.com/itshowcase/windows10deployment)
## Deploy
@@ -101,18 +99,18 @@ Secure your organization's deployment investment.
-Update Windows 10 in the enterprise
+[Update Windows 10 in the enterprise](index.md)
-Deploying as an in-place upgrade
+[Deploying as an in-place upgrade](https://www.microsoft.com/itshowcase/Article/Content/668/Deploying-Windows-10-at-Microsoft-as-an-inplace-upgrade)
-Configure Windows Update for Business
+[Configure Windows Update for Business](waas-configure-wufb.md)
-Express update delivery
+[Express update delivery](waas-optimize-windows-10-updates.md#express-update-delivery)
-Windows 10 deployment considerations
+[Windows 10 deployment considerations](../planning/windows-10-deployment-considerations.md)
## Microsoft Ignite 2018
-Looking to learn more? These informative session replays from Microsoft Ignite 2018 (complete with downloadable slide decks) can provide some great insights on Windows as a service. See [MyIgnite - Session catalog](https://myignite.techcommunity.microsoft.com/sessions).
\ No newline at end of file
+Looking to learn more? These informative session replays from Microsoft Ignite 2018 (complete with downloadable slide decks) can provide some great insights on Windows as a service. See [MyIgnite - Session catalog](https://myignite.techcommunity.microsoft.com/sessions).
diff --git a/windows/deployment/update/windows-update-error-reference.md b/windows/deployment/update/windows-update-error-reference.md
index 508a27d244..64be11a43d 100644
--- a/windows/deployment/update/windows-update-error-reference.md
+++ b/windows/deployment/update/windows-update-error-reference.md
@@ -9,10 +9,10 @@ author: jaimeo
ms.localizationpriority: medium
ms.audience: itpro
ms.date: 09/18/2018
-ms.reviewer:
-manager: laurawi
+manager: dougeby
ms.topic: article
ms.custom: seo-marvel-apr2020
+ms.collection: highpri
---
# Windows Update error codes by component
diff --git a/windows/deployment/update/windows-update-errors.md b/windows/deployment/update/windows-update-errors.md
index fc07839d42..fdb75805e5 100644
--- a/windows/deployment/update/windows-update-errors.md
+++ b/windows/deployment/update/windows-update-errors.md
@@ -8,9 +8,10 @@ itproauthor: jaimeo
ms.audience: itpro
author: jaimeo
ms.reviewer: kaushika
-manager: laurawi
+manager: dougeby
ms.topic: troubleshooting
ms.custom: seo-marvel-apr2020
+ms.collection: highpri
---
# Windows Update common errors and mitigation
@@ -98,7 +99,7 @@ The following table provides information about common errors you might run into
| Message | Description | Mitigation |
|---------|-------------|------------|
-| WU_E_SETUP_SKIP_UPDATE | An update to the Windows Update Agent was skipped due to a directive in the Wuident.cab file. | You might encounter this error when WSUS is not sending the self-update to the clients.
Review [KB920659](https://support.microsoft.com/help/920659/the-microsoft-windows-server-update-services-wsus-selfupdate-service-d) for instructions to resolve the issue. |
+| WU_E_SETUP_SKIP_UPDATE | An update to the Windows Update Agent was skipped due to a directive in the Wuident.cab file. | You might encounter this error when WSUS is not sending the self-update to the clients.
Review [KB920659](/troubleshoot/windows-server/deployment/wsus-selfupdate-not-send-automatic-updates) for instructions to resolve the issue. |
## 0x80244007
diff --git a/windows/deployment/update/windows-update-logs.md b/windows/deployment/update/windows-update-logs.md
index 8ef6e625b4..3585846b66 100644
--- a/windows/deployment/update/windows-update-logs.md
+++ b/windows/deployment/update/windows-update-logs.md
@@ -7,10 +7,10 @@ audience: itpro
itproauthor: jaimeo
ms.audience: itpro
author: jaimeo
-ms.reviewer:
-manager: laurawi
+manager: dougeby
ms.topic: article
ms.custom: seo-marvel-apr2020
+ms.collection: highpri
---
# Windows Update log files
diff --git a/windows/deployment/update/windows-update-resources.md b/windows/deployment/update/windows-update-resources.md
index fd1d2c3d80..fedd94b39a 100644
--- a/windows/deployment/update/windows-update-resources.md
+++ b/windows/deployment/update/windows-update-resources.md
@@ -6,11 +6,11 @@ ms.mktglfcycl:
audience: itpro
ms.localizationpriority: medium
ms.audience: itpro
-ms.reviewer:
-manager: laurawi
+manager: dougeby
ms.topic: article
ms.author: jaimeo
author: jaimeo
+ms.collection: highpri
---
# Windows Update - additional resources
@@ -30,13 +30,13 @@ The following resources provide additional information about using Windows Updat
## WSUS Troubleshooting
-[Troubleshooting issues with WSUS client agents](https://support.microsoft.com/help/10132/)
+[Troubleshooting issues with WSUS client agents](/troubleshoot/mem/configmgr/troubleshoot-issues-with-wsus-client-agents)
-[How to troubleshoot WSUS](https://support.microsoft.com/help/4025764/)
+[How to troubleshoot WSUS](/troubleshoot/mem/configmgr/troubleshoot-wsus-connection-failures)
-[Error 80244007 when WSUS client scans for updates](https://support.microsoft.com/help/4096317/)
+[Error 80244007 when WSUS client scans for updates](/troubleshoot/mem/configmgr/error-80244007-when-wsus-client-scans-updates)
-[Updates may not be installed with Fast Startup in Windows 10](https://support.microsoft.com/help/4011287/)
+[Updates may not be installed with Fast Startup in Windows 10](/troubleshoot/windows-client/deployment/updates-not-install-with-fast-startup)
## How do I reset Windows Update components?
diff --git a/windows/deployment/update/windows-update-troubleshooting.md b/windows/deployment/update/windows-update-troubleshooting.md
index affb4df80e..50b478c5c9 100644
--- a/windows/deployment/update/windows-update-troubleshooting.md
+++ b/windows/deployment/update/windows-update-troubleshooting.md
@@ -7,10 +7,10 @@ audience: itpro
itproauthor: jaimeo
ms.audience: itpro
author: jaimeo
-ms.reviewer:
-manager: laurawi
+manager: dougeby
ms.topic: article
ms.custom: seo-marvel-apr2020
+ms.collection: highpri
---
# Windows Update troubleshooting
@@ -154,7 +154,7 @@ Go to Services.msc and ensure that Windows Firewall Service is enabled. Stopping
## Issues arising from configuration of conflicting policies
Windows Update provides a wide range configuration policy to control the behavior of the Windows Update service in a managed environment. While these policies let you configure the settings at a granular level, misconfiguration or setting conflicting policies may lead to unexpected behaviors.
-For more information, see [How to configure automatic updates by using Group Policy or registry settings](https://support.microsoft.com/help/328010/how-to-configure-automatic-updates-by-using-group-policy-or-registry-s) for more information.
+For more information, see [How to configure automatic updates by using Group Policy or registry settings](/windows/deployment/update/waas-wu-settings) for more information.
## Device cannot access update files
diff --git a/windows/deployment/upgrade/log-files.md b/windows/deployment/upgrade/log-files.md
index f7c75013e7..cedd5aed0e 100644
--- a/windows/deployment/upgrade/log-files.md
+++ b/windows/deployment/upgrade/log-files.md
@@ -1,7 +1,6 @@
---
title: Log files and resolving upgrade errors
-ms.reviewer:
-manager: laurawi
+manager: dougeby
ms.author: greglin
description: Learn how to interpret and analyze the log files that are generated during the Windows 10 upgrade process.
keywords: deploy, error, troubleshoot, windows, 10, upgrade, code, rollback, ITPro
@@ -14,12 +13,13 @@ audience: itpro
author: greg-lindsay
ms.localizationpriority: medium
ms.topic: article
+ms.collection: highpri
---
# Log files
**Applies to**
-- Windows 10
+- Windows 10
>[!NOTE]
>This is a 400 level topic (advanced).
@@ -29,48 +29,35 @@ ms.topic: article
Several log files are created during each phase of the upgrade process. These log files are essential for troubleshooting upgrade problems. By default, the folders that contain these log files are hidden on the upgrade target computer. To view the log files, configure Windows Explorer to view hidden items, or use a tool to automatically gather these logs. The most useful log is **setupact.log**. The log files are located in a different folder depending on the Windows Setup phase. Recall that you can determine the phase from the extend code.
>[!NOTE]
->Also see the [Windows Error Reporting](windows-error-reporting.md) section in this document for help locating error codes and log files.
+>Also see the [Windows Error Reporting](windows-error-reporting.md) section in this document for help locating error codes and log files.
The following table describes some log files and how to use them for troubleshooting purposes:
-
-
-
-
Log file
Phase: Location
Description
When to use
-
setupact.log
Down-Level: $Windows.~BT\Sources\Panther
Contains information about setup actions during the downlevel phase.
-
All down-level failures and starting point for rollback investigations. This is the most important log for diagnosing setup issues.
-
OOBE: $Windows.~BT\Sources\Panther\UnattendGC
-
Contains information about actions during the OOBE phase.
Investigating rollbacks that failed during OOBE phase and operations – 0x4001C, 0x4001D, 0x4001E, 0x4001F.
-
Rollback: $Windows.~BT\Sources\Rollback
Contains information about actions during rollback.
Investigating generic rollbacks - 0xC1900101.
-
Pre-initialization (prior to downlevel): Windows
Contains information about initializing setup.
If setup fails to launch.
-
Post-upgrade (after OOBE): Windows\Panther
Contains information about setup actions during the installation.
Investigate post-upgrade related issues.
-
setuperr.log
Same as setupact.log
Contains information about setup errors during the installation.
Review all errors encountered during the installation phase.
-
miglog.xml
Post-upgrade (after OOBE): Windows\Panther
Contains information about what was migrated during the installation.
Identify post upgrade data migration issues.
-
BlueBox.log
Down-Level: Windows\Logs\Mosetup
Contains information communication between setup.exe and Windows Update.
Use during WSUS and WU down-level failures or for 0xC1900107.
-Setupmem.dmp: If OS bug checks during upgrade, setup will attempt to extract a mini-dump.
-Setupapi: Device install issues - 0x30018
-Event logs: Generic rollbacks (0xC1900101) or unexpected reboots.
-
+|Log file |Phase: Location |Description |When to use|
+|---|---|---|---|
+|setupact.log|Down-Level: $Windows.~BT\Sources\Panther|Contains information about setup actions during the downlevel phase. |All down-level failures and starting point for rollback investigations. This is the most important log for diagnosing setup issues.|
+|setupact.log|OOBE: $Windows.~BT\Sources\Panther\UnattendGC|Contains information about actions during the OOBE phase.|Investigating rollbacks that failed during OOBE phase and operations – 0x4001C, 0x4001D, 0x4001E, 0x4001F.|
+|setupact.log|Rollback: $Windows.~BT\Sources\Rollback|Contains information about actions during rollback.|Investigating generic rollbacks - 0xC1900101.|
+|setupact.log|Pre-initialization (prior to downlevel): Windows|Contains information about initializing setup.|If setup fails to launch.|
+|setupact.log|Post-upgrade (after OOBE): Windows\Panther|Contains information about setup actions during the installation.|Investigate post-upgrade related issues.|
+|setuperr.log|Same as setupact.log|Contains information about setup errors during the installation.|Review all errors encountered during the installation phase.|
+|miglog.xml|Post-upgrade (after OOBE): Windows\Panther|Contains information about what was migrated during the installation.|Identify post upgrade data migration issues.|
+|BlueBox.log|Down-Level: Windows\Logs\Mosetup|Contains information communication between setup.exe and Windows Update.|Use during WSUS and WU down-level failures or for 0xC1900107.|
+|Supplemental rollback logs: Setupmem.dmp setupapi.dev.log Event logs (*.evtx)|$Windows.~BT\Sources\Rollback|Additional logs collected during rollback.|Setupmem.dmp: If OS bug checks during upgrade, setup will attempt to extract a mini-dump. Setupapi: Device install issues - 0x30018 Event logs: Generic rollbacks (0xC1900101) or unexpected reboots.|
## Log entry structure
A setupact.log or setuperr.log entry (files are located at C:\Windows) includes the following elements:
-
-
The date and time - 2016-09-08 09:20:05.
-
The log level - Info, Warning, Error, Fatal Error.
-
The logging components SP (setup platform), MIG (migration engine), and CONX (compatibility information) are particularly useful for troubleshooting Windows Setup errors.
-
-
The message - Operation completed successfully.
-
+1. **The date and time** - 2016-09-08 09:20:05.
+
+2. **The log level** - Info, Warning, Error, Fatal Error.
+
+3. **The logging component** - CONX, MOUPG, PANTHR, SP, IBSLIB, MIG, DISM, CSI, CBS.
+
+ The logging components SP (setup platform), MIG (migration engine), and CONX (compatibility information) are particularly useful for troubleshooting Windows Setup errors.
+
+4. **The message** - Operation completed successfully.
See the following example:
@@ -83,40 +70,45 @@ See the following example:
The following instructions are meant for IT professionals. Also see the [Upgrade error codes](upgrade-error-codes.md) section in this guide to familiarize yourself with [result codes](upgrade-error-codes.md#result-codes) and [extend codes](upgrade-error-codes.md#extend-codes).
- To analyze Windows Setup log files:
+To analyze Windows Setup log files:
-
-
Determine the Windows Setup error code. This code should be returned by Windows Setup if it is not successful with the upgrade process.
-
Based on the extend code portion of the error code, determine the type and location of a log files to investigate.
-
Open the log file in a text editor, such as notepad.
-
Using the result code portion of the Windows Setup error code, search for the result code in the file and find the last occurrence of the code. Alternatively search for the "abort" and abandoning" text strings described in step 7 below.
-
To find the last occurrence of the result code:
-
-
Scroll to the bottom of the file and click after the last character.
-
Click Edit.
-
Click Find.
-
Type the result code.
-
Under Direction select Up.
-
Click Find Next.
-
-
When you have located the last occurrence of the result code, scroll up a few lines from this location in the file and review the processes that failed just prior to generating the result code.
-
Search for the following important text strings:
-
-
Shell application requested abort
-
Abandoning apply due to error for object
-
-
Decode Win32 errors that appear in this section.
-
Write down the timestamp for the observed errors in this section.
-
Search other log files for additional information matching these timestamps or errors.
-
+1. Determine the Windows Setup error code. This code should be returned by Windows Setup if it is not successful with the upgrade process.
+
+2. Based on the [extend code](upgrade-error-codes.md#extend-codes) portion of the error code, determine the type and location of a [log files](#log-files) to investigate.
+
+3. Open the log file in a text editor, such as notepad.
+
+4. Using the [result code](upgrade-error-codes.md#result-codes) portion of the Windows Setup error code, search for the result code in the file and find the last occurrence of the code. Alternatively search for the "abort" and abandoning" text strings described in step 7 below.
+
+5. To find the last occurrence of the result code:
+
+ 1. Scroll to the bottom of the file and click after the last character.
+ 2. Click **Edit**.
+ 3. Click **Find**.
+ 4. Type the result code.
+ 5. Under **Direction** select **Up**.
+ 6. Click **Find Next**.
+
+6. When you have located the last occurrence of the result code, scroll up a few lines from this location in the file and review the processes that failed just prior to generating the result code.
+
+7. Search for the following important text strings:
+
+ * **Shell application requested abort**
+ * **Abandoning apply due to error for object**
+
+8. Decode Win32 errors that appear in this section.
+
+9. Write down the timestamp for the observed errors in this section.
+
+10. Search other log files for additional information matching these timestamps or errors.
For example, assume that the error code for an error is 0x8007042B - 0x2000D. Searching for "8007042B" reveals the following content from the setuperr.log file:
Some lines in the text below are shortened to enhance readability. The date and time at the start of each line (ex: 2016-10-05 15:27:08) is shortened to minutes and seconds, and the certificate file name which is a long text string is shortened to just "CN."
- setuperr.log content:
+**setuperr.log** content:
-
+```console
27:08, Error SP Error READ, 0x00000570 while gathering/applying object: File, C:\ProgramData\Microsoft\Crypto\RSA\S-1-5-18 [CN]. Will return 0[gle=0x00000570]
27:08, Error MIG Error 1392 while gathering object C:\ProgramData\Microsoft\Crypto\RSA\S-1-5-18 [CN]. Shell application requested abort![gle=0x00000570]
27:08, Error Gather failed. Last error: 0x00000000
@@ -125,21 +117,21 @@ Some lines in the text below are shortened to enhance readability. The date and
27:09, Error SP Operation failed: Migrate framework (Full). Error: 0x8007042B[gle=0x000000b7]
27:09, Error SP Operation execution failed: 13. hr = 0x8007042B[gle=0x000000b7]
27:09, Error SP CSetupPlatformPrivate::Execute: Execution of operations queue failed, abandoning. Error: 0x8007042B[gle=0x000000b7]
-
+```
The first line indicates there was an error **0x00000570** with the file **C:\ProgramData\Microsoft\Crypto\RSA\S-1-5-18 [CN]** (shown below):
-
+```console
27:08, Error SP Error READ, 0x00000570 while gathering/applying object: File, C:\ProgramData\Microsoft\Crypto\RSA\S-1-5-18 [CN]. Will return 0[gle=0x00000570]
-
+```
-The error 0x00000570 is a [Win32 error code](/openspecs/windows_protocols/ms-erref/18d8fbe8-a967-4f1c-ae50-99ca8e491d2d) corresponding to: ERROR_FILE_CORRUPT: The file or directory is corrupted and unreadable.
+The error 0x00000570 is a [Win32 error code](/openspecs/windows_protocols/ms-erref/18d8fbe8-a967-4f1c-ae50-99ca8e491d2d) corresponding to: ERROR_FILE_CORRUPT: The file or directory is corrupted and unreadable.
Therefore, Windows Setup failed because it was not able to migrate the corrupt file **C:\ProgramData\Microsoft\Crypto\RSA\S-1-5-18\[CN]**. This file is a local system certificate and can be safely deleted. Searching the setupact.log file for additional details, the phrase "Shell application requested abort" is found in a location with the same timestamp as the lines in setuperr.log. This confirms our suspicion that this file is the cause of the upgrade failure:
- setupact.log content:
+**setupact.log** content:
-
+```console
27:00, Info Gather started at 10/5/2016 23:27:00
27:00, Info [0x080489] MIG Setting system object filter context (System)
27:00, Info [0x0803e5] MIG Not unmapping HKCU\Software\Classes; it is not mapped
@@ -160,11 +152,11 @@ Therefore, Windows Setup failed because it was not able to migrate the corrupt f
27:08, Info Gather ended at 10/5/2016 23:27:08 with result 44
27:08, Info Leaving MigGather method
27:08, Error SP SPDoFrameworkGather: Gather operation failed. Error: 0x0000002C
-
+```console
>>> [Device Install (UpdateDriverForPlugAndPlayDevices) - PCI\VEN_8086&DEV_8C4F]
>>> Section start 2019/09/26 20:13:01.623
cmd: rundll32.exe "C:\WINDOWS\Installer\MSI6E4C.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_95972906 484 ChipsetWiX.CustomAction!Intel.Deployment.ChipsetWiX.CustomActions.InstallDrivers
@@ -248,9 +240,12 @@ Therefore, Windows Setup failed because it was not able to migrate the corrupt f
! ndv: No devices were updated.
<<< Section end 2019/09/26 20:13:01.759
<<< [Exit status: FAILURE(0xC1900101)]
-
+```
- This analysis indicates that the Windows upgrade error can be resolved by deleting the C:\ProgramData\Microsoft\Crypto\RSA\S-1-5-18\[CN] file. Note: In this example, the full, unshortened file name is C:\ProgramData\Microsoft\Crypto\RSA\S-1-5-18\be8228fb2d3cb6c6b0ccd9ad51b320b4_a43d512c-69f2-42de-aef9-7a88fabdaa3f.
+This analysis indicates that the Windows upgrade error can be resolved by deleting the C:\ProgramData\Microsoft\Crypto\RSA\S-1-5-18\[CN] file.
+
+> [!NOTE]
+> In this example, the full, unshortened file name is C:\ProgramData\Microsoft\Crypto\RSA\S-1-5-18\be8228fb2d3cb6c6b0ccd9ad51b320b4_a43d512c-69f2-42de-aef9-7a88fabdaa3f.
## Related topics
@@ -258,4 +253,4 @@ Therefore, Windows Setup failed because it was not able to migrate the corrupt f
[Windows 10 Enterprise system requirements](https://technet.microsoft.com/windows/dn798752.aspx)
[Windows 10 Specifications](https://www.microsoft.com/windows/Windows-10-specifications)
[Windows 10 IT pro forums](https://social.technet.microsoft.com/Forums/en-US/home?category=Windows10ITPro)
- [Fix Windows Update errors by using the DISM or System Update Readiness tool](https://support.microsoft.com/kb/947821)
\ No newline at end of file
+ [Fix Windows Update errors by using the DISM or System Update Readiness tool](/troubleshoot/windows-server/deployment/fix-windows-update-errors)
\ No newline at end of file
diff --git a/windows/deployment/upgrade/quick-fixes.md b/windows/deployment/upgrade/quick-fixes.md
index d9c4e34fd7..b82bc221dc 100644
--- a/windows/deployment/upgrade/quick-fixes.md
+++ b/windows/deployment/upgrade/quick-fixes.md
@@ -34,20 +34,25 @@ The Microsoft Virtual Agent provided by [Microsoft Support](https://support.micr
## List of fixes
-
-
Remove nonessential external hardware, such as docks and USB devices. More information.
-
Check the system drive for errors and attempt repairs. More information.
Update Windows so that all available recommended updates are installed, and ensure the computer is rebooted if this is necessary to complete installation of an update. More information.
-
Temporarily uninstall non-Microsoft antivirus software.
- More information.
+1. Remove nonessential external hardware, such as docks and USB devices. [More information](#remove-external-hardware).
-
Ensure that "Download and install updates (recommended)" is accepted at the start of the upgrade process. More information.
-
Verify at least 16 GB of free space is available to upgrade a 32-bit OS, or 20 GB for a 64-bit OS. More information.
-
+2. Check the system drive for errors and attempt repairs. [More information](#repair-the-system-drive).
+
+3. Run the Windows Update troubleshooter. [More information](#windows-update-troubleshooter).
+
+4. Attempt to restore and repair system files. [More information](#repair-system-files).
+
+5. Update Windows so that all available recommended updates are installed, and ensure the computer is rebooted if this is necessary to complete installation of an update. [More information](#update-windows).
+
+6. Temporarily uninstall non-Microsoft antivirus software. [More information](#uninstall-non-microsoft-antivirus-software).
+
+7. Uninstall all nonessential software. [More information](#uninstall-non-essential-software).
+
+8. Update firmware and drivers. [More information](#update-firmware-and-drivers).
+
+9. Ensure that "Download and install updates (recommended)" is accepted at the start of the upgrade process. [More information](#ensure-that-download-and-install-updates-is-selected).
+
+10. Verify at least 16 GB of free space is available to upgrade a 32-bit OS, or 20 GB for a 64-bit OS. [More information](#verify-disk-space).
## Step by step instructions
@@ -81,14 +86,20 @@ The system drive is the drive that contains the [system partition](/windows-hard
To check and repair errors on the system drive:
1. Click **Start**.
-2. Type **command**.
-3. Right-click **Command Prompt** and then left-click **Run as administrator**.
-4. If you are prompted by UAC, click **Yes**.
-5. Type **chkdsk /F** and press ENTER.
-6. When you are prompted to schedule a check the next time the system restarts, type **Y**.
-7. See the following example
- ```
+2. Type **command**.
+
+3. Right-click **Command Prompt** and then left-click **Run as administrator**.
+
+4. If you are prompted by UAC, click **Yes**.
+
+5. Type **chkdsk /F** and press ENTER.
+
+6. When you are prompted to schedule a check the next time the system restarts, type **Y**.
+
+7. See the following example.
+
+ ```console
C:\WINDOWS\system32>chkdsk /F
The type of the file system is NTFS.
Cannot lock current drive.
@@ -123,12 +134,16 @@ This fix is also described in detail at [answers.microsoft.com](https://answers.
To check and repair system files:
1. Click **Start**.
+
2. Type **command**.
+
3. Right-click **Command Prompt** and then left-click **Run as administrator**.
+
4. If you are prompted by UAC, click **Yes**.
+
5. Type **sfc /scannow** and press ENTER. See the following example:
- ```
+ ```console
C:\>sfc /scannow
Beginning system scan. This process will take some time.
@@ -140,7 +155,7 @@ To check and repair system files:
```
6. If you are running Windows 8.1 or later, type **DISM.exe /Online /Cleanup-image /Restorehealth** and press ENTER (the DISM command options are not available for Windows 7). See the following example:
- ```
+ ```console
C:\>DISM.exe /Online /Cleanup-image /Restorehealth
Deployment Image Servicing and Management tool
@@ -215,7 +230,7 @@ In the previous example, there is 703 GB of available free space on the system d
To free up additional space on the system drive, begin by running Disk Cleanup. You can access Disk Cleanup by right-clicking the hard drive icon and then clicking Properties. See the following example:
-
+:::image type="content" alt-text="Disk cleanup." source="../images/cleanup.png":::
For instructions to run Disk Cleanup and other suggestions to free up hard drive space, see [Tips to free up drive space on your PC](https://support.microsoft.com/help/17421/windows-free-up-drive-space).
@@ -240,4 +255,4 @@ If you downloaded the SetupDiag.exe program to your computer, then copied it to
[Windows 10 Enterprise system requirements](https://technet.microsoft.com/windows/dn798752.aspx)
[Windows 10 Specifications](https://www.microsoft.com/windows/Windows-10-specifications)
[Windows 10 IT pro forums](https://social.technet.microsoft.com/Forums/en-US/home?category=Windows10ITPro)
- [Fix Windows Update errors by using the DISM or System Update Readiness tool](https://support.microsoft.com/kb/947821)
\ No newline at end of file
+ [Fix Windows Update errors by using the DISM or System Update Readiness tool](/troubleshoot/windows-server/deployment/fix-windows-update-errors)
\ No newline at end of file
diff --git a/windows/deployment/upgrade/resolution-procedures.md b/windows/deployment/upgrade/resolution-procedures.md
index 9752ac670c..608df22ec5 100644
--- a/windows/deployment/upgrade/resolution-procedures.md
+++ b/windows/deployment/upgrade/resolution-procedures.md
@@ -1,7 +1,6 @@
---
title: Resolution procedures - Windows IT Pro
-ms.reviewer:
-manager: laurawi
+manager: dougeby
ms.author: greglin
description: Discover general troubleshooting procedures for dealing with 0xC1900101, the generic rollback code thrown when something goes wrong during a Windows 10 upgrade.
keywords: deploy, error, troubleshoot, windows, 10, upgrade, code, rollback, ITPro
@@ -13,12 +12,13 @@ audience: itpro
author: greg-lindsay
ms.localizationpriority: medium
ms.topic: article
+ms.collection: highpri
---
# Resolution procedures
**Applies to**
-- Windows 10
+- Windows 10
> [!NOTE]
> This is a 200 level topic (moderate).
@@ -45,7 +45,7 @@ See the following general troubleshooting procedures associated with a result co
| :--- | :--- | :--- |
| 0xC1900101 - 0x20004 | Uninstall antivirus applications. Remove all unused SATA devices. Remove all unused devices and drivers. Update drivers and BIOS. | Windows Setup encountered an error during the SAFE_OS with the INSTALL_RECOVERY_ENVIRONMENT operation. This is generally caused by out-of-date drivers. |
| 0xC1900101 - 0x2000c | Disconnect all peripheral devices that are connected to the system, except for the mouse, keyboard and display. Contact your hardware vendor to obtain updated device drivers. Ensure that "Download and install updates (recommended)" is accepted at the start of the upgrade process. | Windows Setup encountered an unspecified error during Wim apply in the WinPE phase. This is generally caused by out-of-date drivers |
-| 0xC1900101 - 0x20017 | Ensure that all that drivers are updated. Open the Setuperr.log and Setupact.log files in the %windir%\Panther directory, and then locate the problem drivers. For more information, see [Windows Vista, Windows 7, Windows Server 2008 R2, Windows 8.1, and Windows 10 setup log file locations](https://support.microsoft.com/en-us/help/927521/windows-vista-windows-7-windows-server-2008-r2-windows-8-1-and-windows). Update or uninstall the problem drivers. | A driver has caused an illegal operation. Windows was not able to migrate the driver, resulting in a rollback of the operating system. This is a SafeOS boot failure, typically caused by drivers or non-Microsoft disk encryption software. |
+| 0xC1900101 - 0x20017 | Ensure that all that drivers are updated. Open the Setuperr.log and Setupact.log files in the %windir%\Panther directory, and then locate the problem drivers. For more information, see [Windows Vista, Windows 7, Windows Server 2008 R2, Windows 8.1, and Windows 10 setup log file locations](/troubleshoot/windows-client/deployment/windows-setup-log-file-locations). Update or uninstall the problem drivers. | A driver has caused an illegal operation. Windows was not able to migrate the driver, resulting in a rollback of the operating system. This is a SafeOS boot failure, typically caused by drivers or non-Microsoft disk encryption software. |
| 0xC1900101 - 0x30018 | Disconnect all peripheral devices that are connected to the system, except for the mouse, keyboard and display. Contact your hardware vendor to obtain updated device drivers. Ensure that "Download and install updates (recommended)" is accepted at the start of the upgrade process. | A device driver has stopped responding to setup.exe during the upgrade process. |
| 0xC1900101 - 0x3000D | Disconnect all peripheral devices that are connected to the system, except for the mouse, keyboard and display. Update or uninstall the display driver. | Installation failed during the FIRST_BOOT phase while attempting the MIGRATE_DATA operation. This can occur due to a problem with a display driver. |
| 0xC1900101 - 0x4000D | Check supplemental rollback logs for a setupmem.dmp file, or event logs for any unexpected reboots or errors. Review the rollback log and determine the stop code. The rollback log is located in the $Windows.~BT\Sources\Rollback folder. An example analysis is shown below. This example is not representative of all cases:
Info SP Crash 0x0000007E detected Info SP Module name : Info SP Bugcheck parameter 1 : 0xFFFFFFFFC0000005 Info SP Bugcheck parameter 2 : 0xFFFFF8015BC0036A Info SP Bugcheck parameter 3 : 0xFFFFD000E5D23728 Info SP Bugcheck parameter 4 : 0xFFFFD000E5D22F40 Info SP Cannot recover the system. Info SP Rollback: Showing splash window with restoring text: Restoring your previous version of Windows.
Typically, there is a dump file for the crash to analyze. If you are not equipped to debug the dump, then attempt the following basic troubleshooting procedures:
1. Make sure you have enough disk space. 2. If a driver is identified in the bug check message, disable the driver or check with the manufacturer for driver updates. 3. Try changing video adapters. 4. Check with your hardware vendor for any BIOS updates. 5. Disable BIOS memory options such as caching or shadowing. | A rollback occurred due to a driver configuration issue. Installation failed during the second boot phase while attempting the MIGRATE_DATA operation. This can occur because of incompatible drivers. |
@@ -69,196 +69,40 @@ See the following general troubleshooting procedures associated with a result co
## Other result codes
-
-
-
-
Error code
-
Cause
-
Mitigation
-
-
-
-
0xC1800118
-
WSUS has downloaded content that it cannot use due to a missing decryption key.
Setup.exe has detected that the machine does not meet the minimum system requirements.
-
Ensure the system you are trying to upgrade meets the minimum system requirements. See Windows 10 specifications for information.
-
-
-
-
0x80090011
-
A device driver error occurred during user data migration.
-
Contact your hardware vendor and get all the device drivers updated. It is recommended to have an active internet connection during upgrade process.
- Ensure that "Download and install updates (recommended)" is accepted at the start of the upgrade process.
-
-
-
0xC7700112
-
Failure to complete writing data to the system drive, possibly due to write access failure on the hard disk.
-
This issue is resolved in the latest version of Upgrade Assistant.
- Ensure that "Download and install updates (recommended)" is accepted at the start of the upgrade process.
-
-
-
-
0x80190001
-
An unexpected error was encountered while attempting to download files required for upgrade.
-
To resolve this issue, download and run the media creation tool. See Download windows 10.
-
-
-
-
0x80246007
-
The update was not downloaded successfully.
-
Attempt other methods of upgrading the operating system.
-Download and run the media creation tool. See Download windows 10.
- Attempt to upgrade using .ISO or USB.
-Note Windows 10 Enterprise isn’t available in the media creation tool. For more information, go to the Volume Licensing Service Center.
-
-
-
-
0x80244018
-
Your machine is connected through a proxy server.
-
Make sure Automatically Detect Settings is selected in internet options. (Control Panel > Internet Options > Connections > LAN Settings).
-
-
-
-
0xC1900201
-
The system did not pass the minimum requirements to install the update.
-
Contact the hardware vendor to get the latest updates.
-
-
-
0x80240017
-
The upgrade is unavailable for this edition of Windows.
-
Administrative policies enforced by your organization might be preventing the upgrade. Contact your IT administrator.
-
-
-
-
0x80070020
-
The existing process cannot access the file because it is being used by another process.
-
Use the MSCONFIG tool to perform a clean boot on the machine and then try to perform the update again. For more information, see How to perform a clean boot in Windows.
-
-
-
0x80070522
-
The user doesn’t have required privilege or credentials to upgrade.
-
Ensure that you have signed in as a local administrator or have local administrator privileges.
-
-
-
0xC1900107
-
A cleanup operation from a previous installation attempt is still pending and a system reboot is required in order to continue the upgrade.
-
-
Restart the device and run setup again. If restarting the device does not resolve the issue, then use the Disk Cleanup utility and clean up the temporary files as well as the System files. For more information, see Disk cleanup in Windows 10.
-
-
-
0xC1900209
-
The user has chosen to cancel because the system does not pass the compatibility scan to install the update. Setup.exe will report this error when it can upgrade the machine with user data but cannot migrate installed applications.
This error is specific to upgrades using System Center 2012 Configuration Manager R2 SP1 CU3 (5.00.8238.1403)
-
Analyze the SMSTS.log and verify that the upgrade is failing on "Apply Operating system" Phase: Error 80072efe DownloadFileWithRanges() failed. 80072efe. ApplyOperatingSystem (0x0760)
- The error 80072efe means that the connection with the server was terminated abnormally.
- To resolve this issue, try the OS Deployment test on a client in same VLAN as the Configuration Manager server. Check the network configuration for random client-server connection issues happening on the remote VLAN.
-
-
-
-
-
0x80240FFF
-
Occurs when update synchronization fails. It can occur when you are using Windows Server Update Services on its own or when it is integrated with Microsoft Endpoint Configuration Manager. If you enable update synchronization before you install hotfix 3095113, WSUS doesn't recognize the Upgrades classification and instead treats the upgrade like a regular update.
-
You can prevent this by installing hotfix 3095113 before you enable update synchronization. However, if you have already run into this problem, do the following:
-
-
Occurs when update synchronization fails because you do not have hotfix 3095113 installed before you enable update synchronization. Specifically, the CopyToCache operation fails on clients that have already downloaded the upgrade because Windows Server Update Services has bad metadata related to the upgrade. It can occur when you are using standalone Windows Server Update Services or when WSUS is integrated with Microsoft Endpoint Configuration Manager.
-
Use the following steps to repair Windows Server Update Services. You must run these steps on each WSUS server that synched metadata before you installed the hotfix.
-
-
Stop the Windows Update service. Sign in as a user with administrative privileges, and then do the following:
-
-
Open Administrative Tools from the Control Panel.
-
Double-click Services.
-
Find the Windows Update service, right-click it, and then select Stop. If prompted, enter your credentials.
-
-
-
Delete all files and folders under c:\Windows\SoftwareDistribution\DataStore.
-
Restart the Windows Update service.
-
-
-
-
-
+|Error code|Cause|Mitigation|
+|--- |--- |--- |
+|0xC1800118|WSUS has downloaded content that it cannot use due to a missing decryption key.|See [Steps to resolve error 0xC1800118](/archive/blogs/wsus/resolving-error-0xc1800118) for information.|
+|0xC1900200|Setup.exe has detected that the machine does not meet the minimum system requirements.|Ensure the system you are trying to upgrade meets the minimum system requirements. See [Windows 10 specifications](https://www.microsoft.com/windows/windows-10-specifications) for information.|
+|0x80090011|A device driver error occurred during user data migration.|Contact your hardware vendor and get all the device drivers updated. It is recommended to have an active internet connection during upgrade process.
Ensure that "Download and install updates (recommended)" is accepted at the start of the upgrade process.|
+|0xC7700112|Failure to complete writing data to the system drive, possibly due to write access failure on the hard disk.|This issue is resolved in the latest version of Upgrade Assistant.
Ensure that "Download and install updates (recommended)" is accepted at the start of the upgrade process.|
+|0x80190001|An unexpected error was encountered while attempting to download files required for upgrade.|To resolve this issue, download and run the media creation tool. See [Download windows 10](https://www.microsoft.com/software-download/windows10).|
+|0x80246007|The update was not downloaded successfully.|Attempt other methods of upgrading the operating system.
Download and run the media creation tool. See [Download windows 10](https://www.microsoft.com/software-download/windows10).
Attempt to upgrade using .ISO or USB.
**Note:** Windows 10 Enterprise isn’t available in the media creation tool. For more information, go to the [Volume Licensing Service Center](https://www.microsoft.com/licensing/servicecenter/default.aspx).|
+|0x80244018|Your machine is connected through a proxy server.|Make sure Automatically Detect Settings is selected in internet options. (Control Panel > Internet Options > Connections > LAN Settings).|
+|0xC1900201|The system did not pass the minimum requirements to install the update.|Contact the hardware vendor to get the latest updates.|
+|0x80240017|The upgrade is unavailable for this edition of Windows.|Administrative policies enforced by your organization might be preventing the upgrade. Contact your IT administrator.|
+|0x80070020|The existing process cannot access the file because it is being used by another process.|Use the MSCONFIG tool to perform a clean boot on the machine and then try to perform the update again. For more information, see [How to perform a clean boot in Windows](https://support.microsoft.com/kb/929135).|
+|0x80070522|The user doesn’t have required privilege or credentials to upgrade.|Ensure that you have signed in as a local administrator or have local administrator privileges.|
+|0xC1900107|A cleanup operation from a previous installation attempt is still pending and a system reboot is required in order to continue the upgrade.|Restart the device and run setup again. If restarting the device does not resolve the issue, then use the Disk Cleanup utility and clean up the temporary files as well as the System files. For more information, see [Disk cleanup in Windows 10](https://support.microsoft.com/instantanswers/8fef4121-711b-4be1-996f-99e02c7301c2/disk-cleanup-in-windows-10).|
+|0xC1900209|The user has chosen to cancel because the system does not pass the compatibility scan to install the update. Setup.exe will report this error when it can upgrade the machine with user data but cannot migrate installed applications.|Incompatible software is blocking the upgrade process. Uninstall the application and try the upgrade again. See [Windows 10 Pre-Upgrade Validation using SETUP.EXE](/archive/blogs/mniehaus/windows-10-pre-upgrade-validation-using-setup-exe) for more information.
You can also download the Windows Assessment and Deployment Kit (ADK) for Windows 10 and install Application Compatibility Tools.|
+|0x8007002|This error is specific to upgrades using System Center 2012 Configuration Manager R2 SP1 CU3 (5.00.8238.1403)|Analyze the SMSTS.log and verify that the upgrade is failing on "Apply Operating system" Phase: Error 80072efe DownloadFileWithRanges() failed. 80072efe. ApplyOperatingSystem (0x0760)
The error 80072efe means that the connection with the server was terminated abnormally.
To resolve this issue, try the OS Deployment test on a client in same VLAN as the Configuration Manager server. Check the network configuration for random client-server connection issues happening on the remote VLAN.|
+|0x80240FFF|Occurs when update synchronization fails. It can occur when you are using Windows Server Update Services on its own or when it is integrated with Microsoft Endpoint Configuration Manager. If you enable update synchronization before you install hotfix 3095113, WSUS doesn't recognize the Upgrades classification and instead treats the upgrade like a regular update.|You can prevent this by installing hotfix 3095113 before you enable update synchronization. However, if you have already run into this problem, do the following:
Disable the Upgrades classification.
Install hotfix 3095113.
Delete previously synched updates.
Enable the Upgrades classification.
Perform a full synch.
For detailed information on how to run these steps check out How to delete upgrades in WSUS.|
+|0x8007007E|Occurs when update synchronization fails because you do not have hotfix 3095113 installed before you enable update synchronization. Specifically, the CopyToCache operation fails on clients that have already downloaded the upgrade because Windows Server Update Services has bad metadata related to the upgrade. It can occur when you are using standalone Windows Server Update Services or when WSUS is integrated with Microsoft Endpoint Configuration Manager.|Use the following steps to repair Windows Server Update Services. You must run these steps on each WSUS server that synched metadata before you installed the hotfix.
Stop the Windows Update service.
Sign in as a user with administrative privileges, and then do the following:
Open Administrative Tools from the Control Panel.
Double-click Services.
Find the Windows Update service, right-click it, and then select Stop. If prompted, enter your credentials.
Delete all files and folders under c:\Windows\SoftwareDistribution\DataStore.
Restart the Windows Update service.|
## Other error codes
-
-
-
Error Codes
Cause
Mitigation
-
0x80070003- 0x20007
-
This is a failure during SafeOS phase driver installation.
-
-
This error occurs if the ISO file's metadata is corrupt.
"Re-download the ISO/Media and re-attempt the upgrade.
-
-Alternatively, re-create installation media the [Media Creation Tool](https://www.microsoft.com/software-download/windows10).
-
-
An unspecified error occurred in the SafeOS phase during WIM apply. This can be caused by an outdated driver or disk corruption.
-
Run checkdisk to repair the file system. For more information, see the quick fixes section in this guide.
- Update drivers on the computer, and select "Download and install updates (recommended)" during the upgrade process. Disconnect devices other than the mouse, keyboard and display.
-
0xC1900200 - 0x20008
-
-
The computer doesn’t meet the minimum requirements to download or upgrade to Windows 10.
-
-See Windows 10 Specifications and verify the computer meets minimum requirements.
-
-Review logs for [compatibility information](/archive/blogs/askcore/using-the-windows-10-compatibility-reports-to-understand-upgrade-issues).
-
0x80070004 - 0x3000D
-
This is a problem with data migration during the first boot phase. There are multiple possible causes.
-
-
Installation failed in the SECOND_BOOT phase with an error during PRE_OOBE operation.
-
This is a generic error that occurs during the OOBE phase of setup. See the 0xC1900101 section of this guide and review general troubleshooting procedures described in that section.
-
0x80070005 - 0x4000D
-
The installation failed in the SECOND_BOOT phase with an error in during MIGRATE_DATA operation. This error indicates that access was denied while attempting to migrate data.
-
Analyze log files to determine the data point that is reporting access denied.
-
0x80070004 - 0x50012
-
Windows Setup failed to open a file.
-
Analyze log files to determine the data point that is reporting access problems.
These errors indicate the computer does not have enough free space available to install the upgrade.
-
To upgrade a computer to Windows 10, it requires 16 GB of free hard drive space for a 32-bit OS, and 20 GB for a 64-bit OS. If there is not enough space, attempt to free up drive space before proceeding with the upgrade.
-
-> [!NOTE]
-> If your device allows it, you can use an external USB drive for the upgrade process. Windows setup will back up the previous version of Windows to a USB external drive. The external drive must be at least 8GB (16GB is recommended). The external drive should be formatted using NTFS. Drives that are formatted in FAT32 may run into errors due to FAT32 file size limitations. USB drives are preferred over SD cards because drivers for SD cards are not migrated if the device does not support Connected Standby.
-
-
-
+| Error Codes | Cause | Mitigation |
+| --- | --- | --- |
+|0x80070003- 0x20007|This is a failure during SafeOS phase driver installation.|[Verify device drivers](/windows-hardware/drivers/install/troubleshooting-device-and-driver-installations) on the computer, and [analyze log files](log-files.md#analyze-log-files) to determine the problem driver.|
+|0x8007025D - 0x2000C|This error occurs if the ISO file's metadata is corrupt.|Re-download the ISO/Media and re-attempt the upgrade
Alternatively, re-create installation media the [Media Creation Tool](https://www.microsoft.com/software-download/windows10).|
+|0x80070490 - 0x20007|An incompatible device driver is present.|[Verify device drivers](/windows-hardware/drivers/install/troubleshooting-device-and-driver-installations) on the computer, and [analyze log files](log-files.md#analyze-log-files) to determine the problem driver.|
+|0xC1900101 - 0x2000c|An unspecified error occurred in the SafeOS phase during WIM apply. This can be caused by an outdated driver or disk corruption.|Run checkdisk to repair the file system. For more information, see the [quick fixes](quick-fixes.md) section in this guide. Update drivers on the computer, and select "Download and install updates (recommended)" during the upgrade process. Disconnect devices other than the mouse, keyboard and display.|
+|0xC1900200 - 0x20008|The computer doesn’t meet the minimum requirements to download or upgrade to Windows 10.|See [Windows 10 Specifications](https://www.microsoft.com/windows/windows-10-specifications) and verify the computer meets minimum requirements.
Review logs for [compatibility information](/archive/blogs/askcore/using-the-windows-10-compatibility-reports-to-understand-upgrade-issues).|
+|0xC1900200 - 0x20008|The computer doesn’t meet the minimum requirements to download or upgrade to Windows 10.
See [Windows 10 Specifications](https://www.microsoft.com/windows/windows-10-specifications) and verify the computer meets minimum requirements.
Review logs for [Windows 10 Specifications](https://www.microsoft.com/windows/windows-10-specifications).||
+|0x80070004 - 0x3000D|This is a problem with data migration during the first boot phase. There are multiple possible causes.|[Analyze log files](log-files.md#analyze-log-files) to determine the issue.|
+|0xC1900101 - 0x4001E|Installation failed in the SECOND_BOOT phase with an error during PRE_OOBE operation.|This is a generic error that occurs during the OOBE phase of setup. See the [0xC1900101](#0xc1900101) section of this guide and review general troubleshooting procedures described in that section.|
+|0x80070005 - 0x4000D|The installation failed in the SECOND_BOOT phase with an error in during MIGRATE_DATA operation. This error indicates that access was denied while attempting to migrate data.|[Analyze log files](log-files.md#analyze-log-files) to determine the data point that is reporting access denied.|
+|0x80070004 - 0x50012|Windows Setup failed to open a file.|[Analyze log files](log-files.md#analyze-log-files) to determine the data point that is reporting access problems.|
+|0xC190020e 0x80070070 - 0x50011 0x80070070 - 0x50012 0x80070070 - 0x60000|These errors indicate the computer does not have enough free space available to install the upgrade.|To upgrade a computer to Windows 10, it requires 16 GB of free hard drive space for a 32-bit OS, and 20 GB for a 64-bit OS. If there is not enough space, attempt to [free up drive space](https://support.microsoft.com/help/17421/windows-free-up-drive-space) before proceeding with the upgrade.
**Note:** If your device allows it, you can use an external USB drive for the upgrade process. Windows setup will back up the previous version of Windows to a USB external drive. The external drive must be at least 8GB (16GB is recommended). The external drive should be formatted using NTFS. Drives that are formatted in FAT32 may run into errors due to FAT32 file size limitations. USB drives are preferred over SD cards because drivers for SD cards are not migrated if the device does not support Connected Standby.
|
## Modern setup errors
@@ -344,6 +188,6 @@ Also see the following sequential list of modern setup (mosetup) error codes wit
- [Windows 10 Enterprise system requirements](https://technet.microsoft.com/windows/dn798752.aspx)
- [Windows 10 Specifications](https://www.microsoft.com/windows/Windows-10-specifications)
- [Windows 10 IT pro forums](https://social.technet.microsoft.com/Forums/home?category=Windows10ITPro)
-- [Fix Windows Update errors by using the DISM or System Update Readiness tool](https://support.microsoft.com/kb/947821)
+- [Fix Windows Update errors by using the DISM or System Update Readiness tool](/troubleshoot/windows-server/deployment/fix-windows-update-errors)
- [Win 7 to Win 10 upgrade error (0x800707E7 - 0x3000D)](https://answers.microsoft.com/en-us/windows/forum/all/win-7-to-win-10-upgrade-error-0x800707e7-0x3000d/1273bc1e-8a04-44d4-a6b2-808c9feeb020))
- [Win 10 upgrade error: User profile suffix mismatch, 0x800707E7 - 0x3000D](https://answers.microsoft.com/en-us/windows/forum/windows_10-windows_install/win-10-upgrade-error-user-profile-suffix-mismatch/0f006733-2af5-4b42-a2d4-863fad05273d?page=3)
diff --git a/windows/deployment/upgrade/resolve-windows-10-upgrade-errors.md b/windows/deployment/upgrade/resolve-windows-10-upgrade-errors.md
index 24ed5c4e2b..e1749e6b58 100644
--- a/windows/deployment/upgrade/resolve-windows-10-upgrade-errors.md
+++ b/windows/deployment/upgrade/resolve-windows-10-upgrade-errors.md
@@ -1,7 +1,6 @@
---
title: Resolve Windows 10 upgrade errors - Windows IT Pro
-ms.reviewer:
-manager: laurawi
+manager: dougeby
ms.author: greglin
description: Resolve Windows 10 upgrade errors for ITPros. Technical information for IT professionals to help diagnose Windows setup errors.
keywords: deploy, error, troubleshoot, windows, 10, upgrade, code, rollback, ITPro
@@ -13,12 +12,13 @@ audience: itpro
author: greg-lindsay
ms.localizationpriority: medium
ms.topic: article
+ms.collection: highpri
---
# Resolve Windows 10 upgrade errors : Technical information for IT Pros
**Applies to**
-- Windows 10
+- Windows 10
>[!IMPORTANT]
>This article contains technical instructions for IT administrators. If you are not an IT administrator, try some of the [quick fixes](quick-fixes.md) described in this article then contact [Microsoft Support](https://support.microsoft.com/contactus/) starting with the Virtual Agent. To talk to a person about your issue, click **Get started** to interact with the Virtual Agent, then enter "Talk to a person" two times. The Virtual Agent can also help you to resolve many Windows upgrade issues. Also see: [Get help with Windows 10 upgrade and installation errors](https://support.microsoft.com/help/10587/windows-10-get-help-with-upgrade-installation-errors) and [Submit Windows 10 upgrade errors using Feedback Hub](submit-errors.md).
@@ -61,5 +61,5 @@ See the following topics in this article:
[Windows 10 Enterprise system requirements](https://technet.microsoft.com/windows/dn798752.aspx)
[Windows 10 Specifications](https://www.microsoft.com/windows/Windows-10-specifications)
[Windows 10 IT pro forums](https://social.technet.microsoft.com/Forums/en-US/home?category=Windows10ITPro)
- [Fix Windows Update errors by using the DISM or System Update Readiness tool](https://support.microsoft.com/kb/947821)
+ [Fix Windows Update errors by using the DISM or System Update Readiness tool](/troubleshoot/windows-server/deployment/fix-windows-update-errors)
\ No newline at end of file
diff --git a/windows/deployment/upgrade/setupdiag.md b/windows/deployment/upgrade/setupdiag.md
index 1e87d9bff7..9a69049140 100644
--- a/windows/deployment/upgrade/setupdiag.md
+++ b/windows/deployment/upgrade/setupdiag.md
@@ -1,7 +1,6 @@
---
title: SetupDiag
-ms.reviewer:
-manager: laurawi
+manager: dougeby
ms.author: greglin
description: SetupDiag works by examining Windows Setup log files. This article shows how to use the SetupDiag tool to diagnose Windows Setup errors.
keywords: deploy, troubleshoot, windows, 10, upgrade, update, setup, diagnose
@@ -14,12 +13,13 @@ audience: itpro
author: greg-lindsay
ms.localizationpriority: medium
ms.topic: article
+ms.collection: highpri
---
# SetupDiag
**Applies to**
-- Windows 10
+- Windows 10
>[!NOTE]
>This is a 300 level topic (moderate advanced).
diff --git a/windows/deployment/upgrade/troubleshoot-upgrade-errors.md b/windows/deployment/upgrade/troubleshoot-upgrade-errors.md
index d8183e1f62..f81c8e5e88 100644
--- a/windows/deployment/upgrade/troubleshoot-upgrade-errors.md
+++ b/windows/deployment/upgrade/troubleshoot-upgrade-errors.md
@@ -1,7 +1,6 @@
---
title: Troubleshoot Windows 10 upgrade errors - Windows IT Pro
-ms.reviewer:
-manager: laurawi
+manager: dougeby
ms.author: greglin
description: Understanding the Windows 10 upgrade process can help you troubleshoot errors when something goes wrong. Find out more with this guide.
keywords: deploy, error, troubleshoot, windows, 10, upgrade, code, rollback, ITPro
@@ -18,7 +17,7 @@ ms.topic: article
# Troubleshooting upgrade errors
**Applies to**
-- Windows 10
+- Windows 10
> [!NOTE]
> This is a 300 level topic (moderately advanced).
@@ -86,7 +85,7 @@ When performing an operating system upgrade, Windows Setup uses phases described
**Figure 1**: Phases of a successful Windows 10 upgrade (uninstall is not shown):
-
+:::image type="content" alt-text="Upgrade process." source="../images/upgrade-process.png" lightbox="../images/upgrade-process.png":::
DU = Driver/device updates.
OOBE = Out of box experience.
@@ -98,4 +97,4 @@ WIM = Windows image (Microsoft)
[Windows 10 Enterprise system requirements](https://technet.microsoft.com/windows/dn798752.aspx)
[Windows 10 Specifications](https://www.microsoft.com/windows/Windows-/ifications)
[Windows 10 IT pro forums](https://social.technet.microsoft.com/Forums/en-US/home?category=Windows10ITPro)
- [Fix Windows Update errors by using the DISM or System Update Readiness tool](https://support.microsoft.com/kb/947821)
\ No newline at end of file
+ [Fix Windows Update errors by using the DISM or System Update Readiness tool](/troubleshoot/windows-server/deployment/fix-windows-update-errors)
\ No newline at end of file
diff --git a/windows/deployment/upgrade/upgrade-error-codes.md b/windows/deployment/upgrade/upgrade-error-codes.md
index 93173e687a..95f6cd4f49 100644
--- a/windows/deployment/upgrade/upgrade-error-codes.md
+++ b/windows/deployment/upgrade/upgrade-error-codes.md
@@ -1,7 +1,6 @@
---
title: Upgrade error codes - Windows IT Pro
-ms.reviewer:
-manager: laurawi
+manager: dougeby
ms.author: greglin
description: Understand the error codes that may come up if something goes wrong during the Windows 10 upgrade process.
keywords: deploy, error, troubleshoot, windows, 10, upgrade, code, rollback, ITPro
@@ -13,18 +12,19 @@ audience: itpro
author: greg-lindsay
ms.localizationpriority: medium
ms.topic: article
+ms.collection: highpri
---
# Upgrade error codes
**Applies to**
-- Windows 10
+- Windows 10
>[!NOTE]
->This is a 400 level topic (advanced).
+>This is a 400 level topic (advanced).
+>
>See [Resolve Windows 10 upgrade errors](resolve-windows-10-upgrade-errors.md) for a full list of topics in this article.
-
If the upgrade process is not successful, Windows Setup will return two codes:
1. **A result code**: The result code corresponds to a specific Win32 or NTSTATUS error.
@@ -39,7 +39,7 @@ Note: If only a result code is returned, this can be because a tool is being use
## Result codes
-A result code of **0xC1900101** is generic and indicates that a rollback occurred. In most cases, the cause is a driver compatibility issue. To troubleshoot a failed upgrade that has returned a result code of 0xC1900101, analyze the extend code to determine the Windows Setup phase, and see the [Resolution procedures](resolution-procedures.md) section later in this article.
+A result code of **0xC1900101** is generic and indicates that a rollback occurred. In most cases, the cause is a driver compatibility issue. To troubleshoot a failed upgrade that has returned a result code of 0xC1900101, analyze the extend code to determine the Windows Setup phase, and see the [Resolution procedures](resolution-procedures.md) section later in this article.
The following set of result codes are associated with [Windows Setup](/windows-hardware/manufacture/desktop/windows-setup-command-line-options) compatibility warnings:
@@ -88,74 +88,64 @@ Extend codes can be matched to the phase and operation when an error occurred. T
The following tables provide the corresponding phase and operation for values of an extend code:
-
+### Extend code: phase
-
+|Hex|Operation|
+|--- |--- |
+|0|SP_EXECUTION_OP_UNKNOWN|
+|1|SP_EXECUTION_OP_COPY_PAYLOAD|
+|2|SP_EXECUTION_OP_DOWNLOAD_UPDATES|
+|3|SP_EXECUTION_OP_INSTALL_UPDATES|
+|4|SP_EXECUTION_OP_INSTALL_RECOVERY_ENVIRONMENT|
+|5|SP_EXECUTION_OP_INSTALL_RECOVERY_IMAGE|
+|6|SP_EXECUTION_OP_REPLICATE_OC|
+|7|SP_EXECUTION_OP_INSTALL_DRIVERS|
+|8|SP_EXECUTION_OP_PREPARE_SAFE_OS|
+|9|SP_EXECUTION_OP_PREPARE_ROLLBACK|
+|A|SP_EXECUTION_OP_PREPARE_FIRST_BOOT|
+|B|SP_EXECUTION_OP_PREPARE_OOBE_BOOT|
+|C|SP_EXECUTION_OP_APPLY_IMAGE|
+|D|SP_EXECUTION_OP_MIGRATE_DATA|
+|E|SP_EXECUTION_OP_SET_PRODUCT_KEY|
+|F|SP_EXECUTION_OP_ADD_UNATTEND|
+
+|Hex|Operation|
+|--- |--- |
+|10|SP_EXECUTION_OP_ADD_DRIVER|
+|11|SP_EXECUTION_OP_ENABLE_FEATURE|
+|12|SP_EXECUTION_OP_DISABLE_FEATURE|
+|13|SP_EXECUTION_OP_REGISTER_ASYNC_PROCESS|
+|14|SP_EXECUTION_OP_REGISTER_SYNC_PROCESS|
+|15|SP_EXECUTION_OP_CREATE_FILE|
+|16|SP_EXECUTION_OP_CREATE_REGISTRY|
+|17|SP_EXECUTION_OP_BOOT|
+|18|SP_EXECUTION_OP_SYSPREP|
+|19|SP_EXECUTION_OP_OOBE|
+|1A|SP_EXECUTION_OP_BEGIN_FIRST_BOOT|
+|1B|SP_EXECUTION_OP_END_FIRST_BOOT|
+|1C|SP_EXECUTION_OP_BEGIN_OOBE_BOOT|
+|1D|SP_EXECUTION_OP_END_OOBE_BOOT|
+|1E|SP_EXECUTION_OP_PRE_OOBE|
+|1F|SP_EXECUTION_OP_POST_OOBE|
+|20|SP_EXECUTION_OP_ADD_PROVISIONING_PACKAGE|
For example: An extend code of **0x4000D**, represents a problem during phase 4 (**0x4**) with data migration (**000D**).
## Related topics
-[Windows 10 FAQ for IT professionals](../planning/windows-10-enterprise-faq-itpro.yml)
- [Windows 10 Enterprise system requirements](https://technet.microsoft.com/windows/dn798752.aspx)
- [Windows 10 Specifications](https://www.microsoft.com/windows/Windows-/ifications)
- [Windows 10 IT pro forums](https://social.technet.microsoft.com/Forums/en-US/home?category=Windows10ITPro)
- [Fix Windows Update errors by using the DISM or System Update Readiness tool](https://support.microsoft.com/kb/947821)
\ No newline at end of file
+[Windows 10 FAQ for IT professionals](../planning/windows-10-enterprise-faq-itpro.yml)
+[Windows 10 Enterprise system requirements](https://technet.microsoft.com/windows/dn798752.aspx)
+[Windows 10 Specifications](https://www.microsoft.com/windows/windows-10-specifications)
+[Microsoft Windows Q & A](/answers/products/windows)
+[Fix Windows Update errors by using the DISM or System Update Readiness tool](/troubleshoot/windows-server/deployment/fix-windows-update-errors)
diff --git a/windows/deployment/upgrade/windows-10-edition-upgrades.md b/windows/deployment/upgrade/windows-10-edition-upgrades.md
index 1de5b11aa3..4505749b15 100644
--- a/windows/deployment/upgrade/windows-10-edition-upgrades.md
+++ b/windows/deployment/upgrade/windows-10-edition-upgrades.md
@@ -1,9 +1,8 @@
---
title: Windows 10 edition upgrade (Windows 10)
-description: With Windows 10, you can quickly upgrade from one edition of Windows 10 to another, provided the upgrade path is supported.
+description: With Windows 10, you can quickly upgrade from one edition of Windows 10 to another, provided the upgrade path is supported.
ms.assetid: A7642E90-A3E7-4A25-8044-C4E402DC462A
-ms.reviewer:
-manager: laurawi
+manager: dougeby
ms.author: greglin
ms.prod: w10
ms.mktglfcycl: deploy
@@ -13,19 +12,20 @@ ms.pagetype: mobile
audience: itpro
author: greg-lindsay
ms.topic: article
+ms.collection: highpri
---
# Windows 10 edition upgrade
**Applies to**
-- Windows 10
+- Windows 10
-With Windows 10, you can quickly upgrade from one edition of Windows 10 to another, provided the upgrade path is supported. For information on what edition of Windows 10 is right for you, see [Compare Windows 10 Editions](https://go.microsoft.com/fwlink/p/?LinkID=690882). For a comprehensive list of all possible upgrade paths to Windows 10, see [Windows 10 upgrade paths](windows-10-upgrade-paths.md). Downgrading the edition of Windows is discussed in the [License expiration](#license-expiration) section on this page.
+With Windows 10, you can quickly upgrade from one edition of Windows 10 to another, provided the upgrade path is supported. For information on what edition of Windows 10 is right for you, see [Compare Windows 10 Editions](https://go.microsoft.com/fwlink/p/?LinkID=690882). For a comprehensive list of all possible upgrade paths to Windows 10, see [Windows 10 upgrade paths](windows-10-upgrade-paths.md). Downgrading the edition of Windows is discussed in the [License expiration](#license-expiration) section on this page.
For a list of operating systems that qualify for the Windows 10 Pro Upgrade or Windows 10 Enterprise Upgrade through Microsoft Volume Licensing, see [Windows 10 Qualifying Operating Systems](https://download.microsoft.com/download/2/d/1/2d14fe17-66c2-4d4c-af73-e122930b60f6/Windows10-QOS.pdf).
-The following table shows the methods and paths available to change the edition of Windows 10 that is running on your computer.
+The following table shows the methods and paths available to change the edition of Windows 10 that is running on your computer.
> [!NOTE]
> The reboot requirement for upgrading from Pro to Enterprise was removed in version 1607.
@@ -135,6 +135,7 @@ Downgrading from any edition of Windows 10 to Windows 7, 8, or 8.1 by entering a
### Scenario example
Downgrading from Enterprise
+
- Original edition: **Professional OEM**
- Upgrade edition: **Enterprise**
- Valid downgrade paths: **Pro, Pro for Workstations, Pro Education, Education**
@@ -143,102 +144,24 @@ You can move directly from Enterprise to any valid destination edition. In this
### Supported Windows 10 downgrade paths
-✔ = Supported downgrade path
- S = Supported; Not considered a downgrade or an upgrade
-[blank] = Not supported or not a downgrade
+✔ = Supported downgrade path
-
-
-
-
Destination edition
-
-
-
-
-
Home
-
Pro
-
Pro for Workstations
-
Pro Education
-
Education
-
Enterprise LTSC
-
Enterprise
-
-
-
Starting edition
-
-
-
Home
-
-
-
-
-
-
-
-
-
-
Pro
-
-
-
-
-
-
-
-
-
-
Pro for Workstations
-
-
-
-
-
-
-
-
-
-
Pro Education
-
-
-
-
-
-
-
-
-
-
Education
-
-
✔
-
✔
-
✔
-
-
-
S
-
-
-
Enterprise LTSC
-
-
-
-
-
-
-
-
-
-
Enterprise
-
-
✔
-
✔
-
✔
-
S
-
-
-
-
+S = Supported; Not considered a downgrade or an upgrade
+
+[blank] = Not supported or not a downgrade
+
+**Destination Edition: (Starting)**
+
+|Edition|Home|Pro|Pro for Workstations|Pro Education|Education|Enterprise LTSC|Enterprise|
+|--- |--- |--- |--- |--- |--- |--- |--- |
+|Home||||||||
+|Pro||||||||
+|Pro for Workstations||||||||
+|Pro Education||||||||
+|Education||✔|✔|✔|||S|
+|Enterprise LTSC||||||||
+|Enterprise||✔|✔|✔|S|||
->
> **Windows N/KN**: Windows "N" and "KN" SKUs follow the same rules shown above.
Some slightly more complex scenarios are not represented by the table above. For example, you can perform an upgrade from Pro to Pro for Workstation on a computer with an embedded Pro key using a Pro for Workstation license key, and then later downgrade this computer back to Pro with the firmware-embedded key. The downgrade is allowed but only because the pre-installed OS is Pro.
@@ -247,4 +170,4 @@ Some slightly more complex scenarios are not represented by the table above. For
[Windows 10 upgrade paths](./windows-10-upgrade-paths.md)
[Windows 10 volume license media](../windows-10-media.md)
-[Windows 10 Subscription Activation](/windows/deployment/windows-10-enterprise-subscription-activation)
\ No newline at end of file
+[Windows 10 Subscription Activation](/windows/deployment/windows-10-enterprise-subscription-activation)
diff --git a/windows/deployment/upgrade/windows-10-upgrade-paths.md b/windows/deployment/upgrade/windows-10-upgrade-paths.md
index c50df27515..19f8ab5ad8 100644
--- a/windows/deployment/upgrade/windows-10-upgrade-paths.md
+++ b/windows/deployment/upgrade/windows-10-upgrade-paths.md
@@ -1,7 +1,6 @@
---
title: Windows 10 upgrade paths (Windows 10)
-ms.reviewer:
-manager: laurawi
+manager: dougeby
ms.author: greglin
description: You can upgrade to Windows 10 from a previous version of Windows if the upgrade path is supported.
ms.prod: w10
@@ -12,12 +11,14 @@ ms.pagetype: mobile
audience: itpro
author: greg-lindsay
ms.topic: article
+ms.collection: highpri
---
# Windows 10 upgrade paths
+
**Applies to**
-- Windows 10
+- Windows 10
## Upgrade paths
@@ -25,194 +26,73 @@ This topic provides a summary of available upgrade paths to Windows 10. You can
If you are also migrating to a different edition of Windows, see [Windows 10 edition upgrade](windows-10-edition-upgrades.md). Methods and supported paths are described on this page to change the edition of Windows. These methods require that you input a license or product key for the new Windows edition prior to starting the upgrade process. Edition downgrade is also supported for some paths, but please note that applications and settings are not maintained when the Windows edition is downgraded.
-> **Windows 10 version upgrade**: You can directly upgrade any semi-annual channel version of Windows 10 to a newer, supported semi-annual channel version of Windows 10, even if it involves skipping versions. Work with your account representative if your current version of Windows is out of support. See the [Windows lifecycle fact sheet](https://support.microsoft.com/help/13853/windows-lifecycle-fact-sheet) for availability and service information.
->
-> In-place upgrade from Windows 7, Windows 8.1, or [Windows 10 semi-annual channel](/windows/release-health/release-information) to Windows 10 LTSC is not supported. **Note**: Windows 10 LTSC 2015 did not block this upgrade path. This was corrected in the Windows 10 LTSC 2016 release, which will now only allow data-only and clean install options. You can upgrade from Windows 10 LTSC to Windows 10 semi-annual channel, provided that you upgrade to the same or a newer build version. For example, Windows 10 Enterprise 2016 LTSB can be upgraded to Windows 10 Enterprise version 1607 or later. Upgrade is supported using the in-place upgrade process (using Windows setup). You will need to use the Product Key switch if you want to keep your apps. If you don't use the switch the option 'Keep personal files and apps' will be grayed out. The command line would be **setup.exe /pkey xxxxx-xxxxx-xxxxx-xxxxx-xxxxx**, using your relevant Windows 10 SAC product key. For example, if using a KMS, the command line would be **setup.exe /pkey NPPR9-FWDCX-D2C8J-H872K-2YT43**.
->
-> **Windows N/KN**: Windows "N" and "KN" SKUs (editions without media-related functionality) follow the same upgrade paths shown below. If the pre-upgrade and post-upgrade editions are not the same type (e.g. Windows 8.1 Pro N to Windows 10 Pro), personal data will be kept but applications and settings will be removed during the upgrade process.
->
-> **Windows 8.0**: You cannot upgrade directly from Windows 8.0 to Windows 10. To upgrade from Windows 8.0, you must first install the [Windows 8.1 update](https://support.microsoft.com/help/15356/windows-8-install-update-kb-2919355).
+- **Windows 10 version upgrade**: You can directly upgrade any General Availability Channel version of Windows 10 to a newer, supported General Availability Channel version of Windows 10, even if it involves skipping versions. Work with your account representative if your current version of Windows is out of support. See the [Windows lifecycle fact sheet](/lifecycle/faq/windows) for availability and service information.
+
+- **In-place upgrade from Windows 7, Windows 8.1, or [Windows 10 General Availability Channel](/windows/release-health/release-information)** to Windows 10 LTSC is not supported. Windows 10 LTSC 2015 did not block this in-place upgrade path. This issue was corrected in the Windows 10 LTSC 2016 release, which only allows data-only and clean install options.
+
+ You can upgrade from Windows 10 LTSC to Windows 10 General Availability Channel, provided that you upgrade to the same or a newer build version. For example, Windows 10 Enterprise 2016 LTSB can be upgraded to Windows 10 Enterprise version 1607 or later. Upgrade is supported using the in-place upgrade process (using Windows setup). You will need to use the Product Key switch if you want to keep your apps. If you don't use the switch, the option **Keep personal files and apps** option is grayed out. The command line would be `setup.exe /pkey xxxxx-xxxxx-xxxxx-xxxxx-xxxxx`, using your relevant Windows 10 SAC product key. For example, if using a KMS, the command line would be `setup.exe /pkey NPPR9-FWDCX-D2C8J-H872K-2YT43`.
+
+- **Windows N/KN**: Windows "N" and "KN" SKUs (editions without media-related functionality) follow the same upgrade paths shown below. If the pre-upgrade and post-upgrade editions are not the same type (e.g. Windows 8.1 Pro N to Windows 10 Pro), personal data will be kept but applications and settings will be removed during the upgrade process.
+
+- **Windows 8.0**: You cannot upgrade directly from Windows 8.0 to Windows 10. To upgrade from Windows 8.0, you must first install the [Windows 8.1 update](https://support.microsoft.com/help/15356/windows-8-install-update-kb-2919355).
+
+## Windows 10
+
+✔ = Full upgrade is supported including personal data, settings, and applications.
-✔ = Full upgrade is supported including personal data, settings, and applications.
D = Edition downgrade; personal data is maintained, applications and settings are removed.
-
-
-
-
-
-
Windows 10 Home
-
Windows 10 Pro
-
Windows 10 Pro Education
-
Windows 10 Education
-
Windows 10 Enterprise
-
-
-
Windows 7
-
-
-
Starter
-
✔
-
✔
-
✔
-
✔
-
-
-
-
Home Basic
-
✔
-
✔
-
✔
-
✔
-
-
-
-
Home Premium
-
✔
-
✔
-
✔
-
✔
-
-
-
-
Professional
-
D
-
✔
-
✔
-
✔
-
✔
-
-
-
Ultimate
-
D
-
✔
-
✔
-
✔
-
✔
-
-
-
Enterprise
-
-
-
-
✔
-
✔
-
-
-
Windows 8.1
-
-
-
(Core)
-
✔
-
✔
-
✔
-
✔
-
-
-
-
Connected
-
✔
-
✔
-
✔
-
✔
-
-
-
-
Pro
-
D
-
✔
-
✔
-
✔
-
✔
-
-
-
Pro Student
-
D
-
✔
-
✔
-
✔
-
✔
-
-
-
Pro WMC
-
D
-
✔
-
✔
-
✔
-
✔
-
-
-
Enterprise
-
-
-
-
✔
-
✔
-
-
-
Embedded Industry
-
-
-
-
-
✔
-
-
-
Windows RT
-
-
-
-
-
-
-
-
Windows Phone 8.1
-
-
-
-
-
-
-
-
Windows 10
-
-
-
Home
-
-
✔
-
✔
-
✔
-
-
-
-
Pro
-
D
-
-
✔
-
✔
-
✔
-
-
-
Education
-
-
-
-
-
D
-
-
-
Enterprise
-
-
-
-
✔
-
-
-
+---
+| | Windows 10 Home | Windows 10 Pro | Windows 10 Pro Education | Windows 10 Education | Windows 10 Enterprise |
+|---|---|---|---|---|---|
+| **Home** | | ✔ | ✔ | ✔ | |
+| **Pro** | D | | ✔ | ✔ | ✔ |
+| **Education** | | | | | D |
+| **Enterprise** | | | | ✔ | |
+---
+
+## Windows 8.1
+
+✔ = Full upgrade is supported including personal data, settings, and applications.
+
+D = Edition downgrade; personal data is maintained, applications and settings are removed.
+
+---
+| | Windows 10 Home | Windows 10 Pro | Windows 10 Pro Education | Windows 10 Education | Windows 10 Enterprise |
+|---|---|---|---|---|---|
+| **(Core)** | ✔ | ✔ | ✔ | ✔ | |
+| **Connected** | ✔ | ✔ | ✔ | ✔ | |
+| **Pro** | D | ✔ | ✔ | ✔ | ✔ |
+| **Pro Student** | D | ✔ | ✔ | ✔ | ✔ |
+| **Pro WMC** | D | ✔ | ✔ | ✔ | ✔ |
+| **Enterprise** | | | | ✔ | ✔ |
+| **Embedded Industry** | | | | | ✔ |
+
+---
+
+## Windows 7
+
+✔ = Full upgrade is supported including personal data, settings, and applications.
+
+D = Edition downgrade; personal data is maintained, applications and settings are removed.
+
+---
+| | Windows 10 Home | Windows 10 Pro | Windows 10 Pro Education | Windows 10 Education | Windows 10 Enterprise |
+|---|---|---|---|---|---|
+| **Starter** | ✔ | ✔ | ✔ | ✔ | |
+| **Home Basic** | ✔ | ✔ | ✔ | ✔ | |
+| **Home Premium** | ✔ | ✔ | ✔ | ✔ | |
+| **Professional** | D | ✔ | ✔ | ✔ | ✔ |
+| **Ultimate** | D | ✔ | ✔ | ✔ | ✔ |
+| **Enterprise** | | | | ✔ | ✔ |
+
+---
## Related Topics
-[Windows 10 deployment scenarios](../windows-10-deployment-scenarios.md)
-[Windows upgrade and migration considerations](windows-upgrade-and-migration-considerations.md)
-[Windows 10 edition upgrade](windows-10-edition-upgrades.md)
\ No newline at end of file
+[Windows 10 deployment scenarios](../windows-10-deployment-scenarios.md)
+
+[Windows upgrade and migration considerations](windows-upgrade-and-migration-considerations.md)
+
+[Windows 10 edition upgrade](windows-10-edition-upgrades.md)
diff --git a/windows/deployment/upgrade/windows-error-reporting.md b/windows/deployment/upgrade/windows-error-reporting.md
index 50aad1782d..74fb942b19 100644
--- a/windows/deployment/upgrade/windows-error-reporting.md
+++ b/windows/deployment/upgrade/windows-error-reporting.md
@@ -32,7 +32,7 @@ To use Windows PowerShell, type the following commands from an elevated Windows
> [!IMPORTANT]
> The following source will be available only if you have updated from a previous version of Windows 10 to a new version. If you installed the current version and have not updated, the source named **WinSetupDiag02** will be unavailable.
-```Powershell
+```powershell
$events = Get-WinEvent -FilterHashtable @{LogName="Application";ID="1001";Data="WinSetupDiag02"}
$event = [xml]$events[0].ToXml()
$event.Event.EventData.Data
@@ -43,7 +43,8 @@ To use Event Viewer:
2. Click **Find**, and then search for **winsetupdiag02**.
3. Double-click the event that is highlighted.
-Note: For legacy operating systems, the Event Name was WinSetupDiag01.
+> [!NOTE]
+> For legacy operating systems, the Event Name was WinSetupDiag01.
Ten parameters are listed in the event:
@@ -63,7 +64,7 @@ Ten parameters are listed in the event:
The event will also contain links to log files that can be used to perform a detailed diagnosis of the error. An example of this event from a successful upgrade is shown below.
-
+:::image type="content" alt-text="Windows Error Reporting." source="../images/event.png" lightbox="../images/event.png":::
## Related topics
@@ -71,4 +72,4 @@ The event will also contain links to log files that can be used to perform a det
[Windows 10 Enterprise system requirements](https://technet.microsoft.com/windows/dn798752.aspx)
[Windows 10 Specifications](https://www.microsoft.com/windows/Windows-10-specifications)
[Windows 10 IT pro forums](https://social.technet.microsoft.com/Forums/en-US/home?category=Windows10ITPro)
-[Fix Windows Update errors by using the DISM or System Update Readiness tool](https://support.microsoft.com/kb/947821)
\ No newline at end of file
+[Fix Windows Update errors by using the DISM or System Update Readiness tool](/troubleshoot/windows-server/deployment/fix-windows-update-errors)
\ No newline at end of file
diff --git a/windows/deployment/usmt/offline-migration-reference.md b/windows/deployment/usmt/offline-migration-reference.md
index 3406fdc071..25d44a98a8 100644
--- a/windows/deployment/usmt/offline-migration-reference.md
+++ b/windows/deployment/usmt/offline-migration-reference.md
@@ -16,7 +16,6 @@ ms.topic: article
# Offline Migration Reference
-
Offline migration enables the ScanState tool to run inside a different Windows® operating system than the Windows operating system from which ScanState is gathering files and settings. There are two primary offline scenarios:
- **Windows PE.** The ScanState tool can be run from within Windows PE, gathering files and settings from the offline Windows operating system on that machine.
@@ -33,7 +32,6 @@ When you use User State Migration Tool (USMT) 10.0 to gather and restore user s
## In This topic
-
- [What Will Migrate Offline?](#bkmk-whatwillmigrate)
- [What Offline Environments are Supported?](#bkmk-offlineenvironments)
@@ -48,7 +46,6 @@ When you use User State Migration Tool (USMT) 10.0 to gather and restore user s
## What Will Migrate Offline?
-
The following user data and settings migrate offline, similar to an online migration:
- Data and registry keys specified in MigXML
@@ -67,42 +64,18 @@ For exceptions to what you can migrate offline, see [What Does USMT Migrate?](us
## What Offline Environments are Supported?
-
The following table defines the supported combination of online and offline operating systems in USMT.
-
-
-
-
-
-
-
-
Running Operating System
-
Offline Operating System
-
-
-
-
-
WinPE 5.0 or greater, with the MSXML library
-
Windows Vista, Windows 7, Windows 8, Windows 10
-
-
-
Windows 7, Windows 8, Windows 10
-
Windows.old directory
-
-
-
-
-
+|Running Operating System|Offline Operating System|
+|--- |--- |
+|WinPE 5.0 or greater, with the MSXML library|Windows Vista, Windows 7, Windows 8, Windows 10|
+|Windows 7, Windows 8, Windows 10|Windows.old directory|
**Note**
It is possible to run the ScanState tool while the drive remains encrypted by suspending Windows BitLocker Drive Encryption before booting into WinPE. For more information, see [this Microsoft site](/previous-versions/windows/it-pro/windows-7/ee424315(v=ws.10)).
-
-
## User-Group Membership and Profile Control
-
User-group membership is not preserved during offline migrations. You must configure a **<ProfileControl>** section in the Config.xml file to specify the groups that the migrated users should be made members of. The following example places all migrated users into the Users group:
``` xml
@@ -125,84 +98,27 @@ For information about the format of a Config.xml file, see [Config.xml File](usm
## Command-Line Options
-
An offline migration can either be enabled by using a configuration file on the command line, or by using one of the following command line options:
-
-
-
-
-
-
-
-
-
Component
-
Option
-
Description
-
-
-
-
-
ScanState.exe
-
/offline:<path to offline.xml>
-
This command-line option enables the offline-migration mode and requires a path to an Offline.xml configuration file.
-
-
-
ScanState.exe
-
/offlineWinDir:<Windows directory>
-
This command-line option enables the offline-migration mode and starts the migration from the location specified. It is only for use in WinPE offline scenarios where the migration is occurring from a Windows directory.
-
-
-
ScanState.exe
-
/OfflineWinOld:<Windows.old directory>
-
This command-line option enables the offline migration mode and starts the migration from the location specified. It is only intended to be used in Windows.old migration scenarios, where the migration is occurring from a Windows.old directory.
-
-
-
+|Component|Option|Description|
+|--- |--- |--- |
+|ScanState.exe|**/offline:***<path to offline.xml>*|This command-line option enables the offline-migration mode and requires a path to an Offline.xml configuration file.|
+|ScanState.exe|**/offlineWinDir:***<Windows directory>*|This command-line option enables the offline-migration mode and starts the migration from the location specified. It is only for use in WinPE offline scenarios where the migration is occurring from a Windows directory.|
+|ScanState.exe|**/OfflineWinOld:***<Windows.old directory>*|This command-line option enables the offline migration mode and starts the migration from the location specified. It is only intended to be used in Windows.old migration scenarios, where the migration is occurring from a Windows.old directory.|
-
-
-You can use only one of the **/offline**,**/offlineWinDir** , or **/OfflineWinOld** command-line options at a time; USMT does not support using more than one together.
+You can use only one of the **/offline**, **/offlineWinDir**, or **/OfflineWinOld** command-line options at a time; USMT does not support using more than one together.
## Environment Variables
-
The following system environment variables are necessary in the scenarios outlined below.
-
-
-
-
-
-
-
-
-
Variable
-
Value
-
Scenario
-
-
-
-
-
USMT_WORKING_DIR
-
Full path to a working directory
-
Required when USMT binaries are located on read-only media, which does not support the creation of log files or temporary storage. To set the system environment variable, at a command prompt type the following:
-
Set USMT_WORKING_DIR=[path to working directory]
-
-
-
MIG_OFFLINE_PLATFORM_ARCH
-
32 or 64
-
While operating offline, this environment variable defines the architecture of the offline system, if the system does not match the WinPE and Scanstate.exe architecture. This environment variable enables the 32-bit ScanState application to gather data from a computer with 64-bit architecture, or the 64-bit ScanState application to gather data from a computer with 32-bit architecture. This is required when auto-detection of the offline architecture doesn't function properly, for example, when the source system is running a 64-bit version of Windows XP. For example, to set this system environment variable for a 32-bit architecture, at a command prompt type the following:
-
Set MIG_OFFLINE_PLATFORM_ARCH=32
-
-
-
-
-
+|Variable|Value|Scenario|
+|--- |--- |--- |
+|USMT_WORKING_DIR|Full path to a working directory|Required when USMT binaries are located on read-only media, which does not support the creation of log files or temporary storage. To set the system environment variable, at a command prompt type the following:
Set USMT_WORKING_DIR=[path to working directory]
|
+|MIG_OFFLINE_PLATFORM_ARCH|32 or 64|While operating offline, this environment variable defines the architecture of the offline system, if the system does not match the WinPE and Scanstate.exe architecture. This environment variable enables the 32-bit ScanState application to gather data from a computer with 64-bit architecture, or the 64-bit ScanState application to gather data from a computer with 32-bit architecture. This is required when auto-detection of the offline architecture doesn't function properly, for example, when the source system is running a 64-bit version of Windows XP. For example, to set this system environment variable for a 32-bit architecture, at a command prompt type the following:
Set MIG_OFFLINE_PLATFORM_ARCH=32
|
## Offline.xml Elements
-
Use an offline.xml file when running the ScanState tool on a computer that has multiple Windows directories. The offline.xml file specifies which directories to scan for windows files. An offline.xml file can be used with the /offline option as an alternative to specifying a single Windows directory path with the /offlineDir option.
### <offline>
@@ -256,8 +172,4 @@ The following XML example illustrates some of the elements discussed earlier in
## Related topics
-
[Plan Your Migration](usmt-plan-your-migration.md)
-
-
-
diff --git a/windows/deployment/usmt/understanding-migration-xml-files.md b/windows/deployment/usmt/understanding-migration-xml-files.md
index e59e727ee5..f6a8ab4221 100644
--- a/windows/deployment/usmt/understanding-migration-xml-files.md
+++ b/windows/deployment/usmt/understanding-migration-xml-files.md
@@ -16,14 +16,12 @@ ms.topic: article
# Understanding Migration XML Files
-
-You can modify the behavior of a basic User State Migration Tool (USMT)10.0 migration by using XML files; these files provide instructions on where and how the USMT tools should gather and apply files and settings. USMT includes three XML files that you can use to customize a basic migration: the MigDocs.xml and MigUser.xml files, which modify how files are discovered on the source computer, and the MigApps.xml file, which is required in order to migrate supported application settings. You can also create and edit custom XML files and a Config.xml file to further customize your migration.
+You can modify the behavior of a basic User State Migration Tool (USMT) 10.0 migration by using XML files; these files provide instructions on where and how the USMT tools should gather and apply files and settings. USMT includes three XML files that you can use to customize a basic migration: the MigDocs.xml and MigUser.xml files, which modify how files are discovered on the source computer, and the MigApps.xml file, which is required in order to migrate supported application settings. You can also create and edit custom XML files and a Config.xml file to further customize your migration.
This topic provides an overview of the default and custom migration XML files and includes guidelines for creating and editing a customized version of the MigDocs.xml file. The MigDocs.xml file uses the new **GenerateDocPatterns** function available in USMT to automatically find user documents on a source computer.
## In This topic
-
[Overview of the Config.xml file](#bkmk-config)
[Overview of the MigApp.xml file](#bkmk-migapp)
@@ -50,27 +48,20 @@ This topic provides an overview of the default and custom migration XML files an
## Overview of the Config.xml file
+The Config.xml file is the configuration file created by the `/genconfig` option of the ScanState tool; it can be used to modify which operating-system components are migrated by USMT. The Config.xml file can be used with other XML files, such as in the following example: `scanstate /i:migapps.xml /i:migdocs.xml /genconfig:c:\myFolder\config.xml`. When used this way, the Config.xml file tightly controls aspects of the migration, including user profiles, data, and settings, without modifying or creating other XML files. For more information about the Config.xml file, see [Customize USMT XML Files](usmt-customize-xml-files.md) and [Config.xml File](usmt-configxml-file.md).
-The Config.xml file is the configuration file created by the `/genconfig` option of the ScanState tool; it can be used to modify which operating-system components are migrated by USMT. The Config.xml file can be used in conjunction with other XML files, such as in the following example: `scanstate /i:migapps.xml /i:migdocs.xml /genconfig:c:\myFolder\config.xml`. When used this way, the Config.xml file tightly controls aspects of the migration, including user profiles, data, and settings, without modifying or creating other XML files. For more information about the Config.xml file, see [Customize USMT XML Files](usmt-customize-xml-files.md) and [Config.xml File](usmt-configxml-file.md).
-
-**Note**
-When modifying the XML elements in the Config.xml file, you should edit an element and set the **migrate** property to **no**, rather than deleting the element from the file. If you delete the element instead of setting the property, the component may still be migrated by rules in other XML files.
-
-
+> [!NOTE]
+> When modifying the XML elements in the Config.xml file, you should edit an element and set the **migrate** property to **no**, rather than deleting the element from the file. If you delete the element instead of setting the property, the component may still be migrated by rules in other XML files.
## Overview of the MigApp.xml file
-
The MigApp.xml file installed with USMT includes instructions to migrate the settings for the applications listed in [What Does USMT Migrate?](usmt-what-does-usmt-migrate.md). You must include the MigApp.xml file when using the ScanState and LoadState tools, by using the `/i` option in order to migrate application settings. The MigDocs.xml and MigUser.xml files do not migrate application settings. You can create a custom XML file to include additional applications. For more information, see [Customize USMT XML Files](usmt-customize-xml-files.md).
-**Important**
-The MigApps.xml file will only detect and migrate .pst files that are linked to Microsoft Office Outlook. See the [Sample migration rules for customized versions of XML files](#bkmk-samples) section of this document for more information about migrating .pst files that are not linked to Outlook.
-
-
+> [!Important]
+> The MigApps.xml file will only detect and migrate .pst files that are linked to Microsoft Office Outlook. For more information about migrating .pst files that are not linked to Outlook, see the [Sample migration rules for customized versions of XML files](#bkmk-samples).
## Overview of the MigDocs.xml file
-
The MigDocs.xml file uses the new **GenerateDocPatterns** helper function to create instructions for USMT to migrate files from the source computer, based on the location of the files. You can use the MigDocs.xml file with the ScanState and LoadState tools to perform a more targeted migration than using USMT without XML instructions.
The default MigDocs.xml file migrates the following:
@@ -141,12 +132,11 @@ You can also use the **/genmigxml** option with the ScanState tool to review and
## Overview of the MigUser.xml file
-
-The MigUser.xml file includes instructions for USMT to migrate user files based on file name extensions. You can use the MigUser.xml file with the ScanState and LoadState tools to perform a more targeted migration than using USMT without XML instructions. The MigUser.xml file will gather all files from the standard user-profile folders, as well as any files on the computer with the specified file name extensions.
+The MigUser.xml file includes instructions for USMT to migrate user files based on file name extensions. You can use the MigUser.xml file with the ScanState and LoadState tools to perform a more targeted migration than using USMT without XML instructions. The MigUser.xml file will gather all files from the standard user-profile folders, and any files on the computer with the specified file name extensions.
The default MigUser.xml file migrates the following:
-- All files from the standard user-profile folders which are described as:
+- All files from the standard user-profile folders, which are described as:
- CSIDL\_MYVIDEO
@@ -166,7 +156,7 @@ The default MigUser.xml file migrates the following:
- Files with the following extensions:
- .qdf, .qsd, .qel, .qph, .doc\*, .dot\*, .rtf, .mcw, .wps, .scd, .wri, .wpd, .xl\*, .csv, .iqy, .dqy, .oqy, .rqy, .wk\*, .wq1, .slk, .dif, .ppt\*, .pps\*, .pot\*, .sh3, .ch3, .pre, .ppa, .txt, .pst, .one\*, .vl\*, .vsd, .mpp, .or6, .accdb, .mdb, .pub
+ `.qdf`, `.qsd`, `.qel`, `.qph`, `.doc\*`, `.dot\*`, `.rtf`, `.mcw`, `.wps`, `.scd`, `.wri`, `.wpd`, `.xl\*`, `.csv`, `.iqy`, `.dqy`, `.oqy`, `.rqy`, `.wk\*`, `.wq1`, `.slk`, `.dif`, `.ppt\*`, `.pps\*`, `.pot\*`, `.sh3`, `.ch3`, `.pre`, `.ppa`, `.txt`, `.pst`, `.one\*`, `.vl\*`, `.vsd`, `.mpp`, `.or6`, `.accdb`, `.mdb`, `.pub`
The default MigUser.xml file does not migrate the following:
@@ -180,62 +170,30 @@ The default MigUser.xml file does not migrate the following:
You can make a copy of the MigUser.xml file and modify it to include or exclude standard user-profile folders and file name extensions. If you know all of the extensions for the files you want to migrate from the source computer, use the MigUser.xml file to move all of your relevant data, regardless of the location of the files. However, this may result in a migration that contains more files than intended. For example, if you choose to migrate all .jpg files, you may migrate image files such as thumbnails and logos from legacy applications that are installed on the source computer.
-**Note**
-Each file name extension you include in the rules within the MigUser.xml file increases the amount of time needed for the ScanState tool to gather the files for the migration. If you are migrating more than three hundred file types, you may experience a slow migration. For more information about other ways to organize the migration of your data, see the [Using multiple XML files](#bkmk-multiple) section of this document.
-
-
+> [!NOTE]
+> Each file name extension you include in the rules within the MigUser.xml file increases the amount of time needed for the ScanState tool to gather the files for the migration. If you are migrating more than 300 file types, you may experience a slow migration. For more information about other ways to organize the migration of your data, see the [Using multiple XML files](#bkmk-multiple) section of this document.
## Using multiple XML files
-
You can use multiple XML files with the ScanState and LoadState tools. Each of the default XML files included with or generated by USMT is configured for a specific component of the migration. You can also use custom XML files to supplement these default files with additional migration rules.
-
-
-
-
-
-
-
-
XML migration file
-
Modifies the following components:
-
-
-
-
-
Config.xml file
-
Operating-system components such as desktop wallpaper and background theme.
-
You can also overload config.xml to include some application and document settings by generating the config.xml file with the other default XML files. For more information, see Customize USMT XML Files and Config.xml File.
-
-
-
MigApps.xml file
-
Applications settings.
-
-
-
MigUser.xml or MigDocs.xml files
-
User files and profile settings.
-
-
-
Custom XML files
-
Application settings, user profile settings, or user files, beyond the rules contained in the other XML files.
-
-
-
-
-
+|XML migration file|Modifies the following components:|
+|--- |--- |
+|Config.xml file|Operating-system components such as desktop wallpaper and background theme. You can also overload config.xml to include some application and document settings by generating the config.xml file with the other default XML files. For more information, see [Customize USMT XML Files](usmt-customize-xml-files.md) and [Config.xml File](usmt-configxml-file.md).|
+|MigApps.xml file|Applications settings.|
+|MigUser.xml or MigDocs.xml files|User files and profile settings.|
+|Custom XML files|Application settings, user profile settings, or user files, beyond the rules contained in the other XML files.|
For example, you can use all of the XML migration file types for a single migration, as in the following example:
-```
+```console
Scanstate /config:c:\myFolder\config.xml /i:migapps.xml /i:migdocs.xml /i:customrules.xml
```
### XML rules for migrating user files
-**Important**
-You should not use the MigUser.xml and MigDocs.xml files together in the same command. Using both XML files can result in duplication of some migrated files. This occurs when conflicting target-location instructions are given in each XML file. The target file will be stored once during the migration, but will be applied by each XML file to a different location on the destination computer.
-
-
+> [!IMPORTANT]
+> You should not use the MigUser.xml and MigDocs.xml files together in the same command. Using both XML files can result in duplication of some migrated files. This occurs when conflicting target-location instructions are given in each XML file. The target file will be stored once during the migration, but will be applied by each XML file to a different location on the destination computer.
If your data set is unknown or if many files are stored outside of the standard user-profile folders, the MigDocs.xml is a better choice than the MigUser.xml file, because the MigDocs.xml file will gather a broader scope of data. The MigDocs.xml file migrates folders of data based on location. The MigUser.xml file migrates only the files with the specified file name extensions.
@@ -243,13 +201,10 @@ If you want more control over the migration, you can create custom XML files. Se
## Creating and editing a custom XML file
-
You can use the **/genmigxml** command-line option to determine which files will be included in your migration. The **/genmigxml** option creates a file in a location you specify, so that you can review the XML rules and make modifications as necessary.
-**Note**
-If you reinstall USMT, the default migration XML files will be overwritten and any customizations you make directly to these files will be lost. Consider creating separate XML files for your custom migration rules and saving them in a secure location.
-
-
+> [!NOTE]
+> If you reinstall USMT, the default migration XML files will be overwritten and any customizations you make directly to these files will be lost. Consider creating separate XML files for your custom migration rules and saving them in a secure location.
To generate the XML migration rules file for a source computer:
@@ -259,14 +214,14 @@ To generate the XML migration rules file for a source computer:
3. At the command prompt, type:
- ```
+ ```console
cd /d
scanstate.exe /genmigxml:
```
Where *<USMTpath>* is the location on your source computer where you have saved the USMT files and tools, and *<filepath.xml>* is the full path to a file where you can save the report. For example, type:
- ```
+ ```console
cd /d c:\USMT
scanstate.exe /genmigxml:"C:\Documents and Settings\USMT Tester\Desktop\genMig.xml"
```
@@ -275,46 +230,27 @@ To generate the XML migration rules file for a source computer:
The MigDocs.xml file calls the **GenerateDocPatterns** function, which takes three Boolean values. You can change the settings to modify the way the MigDocs.xml file generates the XML rules for migration.
-
-
-
-
-
-
-
-
-
Setting
-
Value
-
Default Value
-
-
-
-
-
ScanProgramFiles
-
The ScanProgramFiles argument is valid only when the GenerateDocPatterns function is called in a system context. This argument determines whether or not to scan the Program Files directory to gather registered file name extensions for known applications.
-
For example, when set to TRUE, the function discovers and migrates .doc files under the Microsoft Office directory, because .doc is a file name extension registered to a Microsoft Office application. The GenerateDocPatterns function generates this inclusion pattern for .doc files:
If a child folder of an included folder contains an installed application, ScanProgramFiles will also create an exclusion rule for the child folder. All folders under the application folder will be scanned recursively for registered file name extensions.
-
False
-
-
-
IncludePatterns
-
The IncludePatterns argument determines whether to generate exclude or include patterns in the XML. When this argument is set to TRUE, the GenerateDocPatterns function generates include patterns and the function must be added under the <include> element. Changing this argument to FALSE generates exclude patterns and the function must be added under the <exclude> element.
-
True
-
-
-
SystemDrive
-
The SystemDrive argument determines whether to generate patterns for all fixed drives or only for the system drive. Changing this argument to TRUE restricts all patterns to the system drive.
-
False
-
-
-
+- `ScanProgramFiles`: This argument is valid only when the **GenerateDocPatterns** function is called in a system context. This argument determines whether or not to scan the Program Files directory to gather registered file name extensions for known applications.
-
+ **Default value**: False
+
+ For example, when set to **TRUE**, the function discovers and migrates .doc files under the Microsoft Office directory, because .doc is a file name extension registered to a Microsoft Office application. The **GenerateDocPatterns** function generates this inclusion pattern for `.doc` files:
+
+ `C:\Program Files\Microsoft Office[.doc]`
+
+ If a child folder of an included folder contains an installed application, ScanProgramFiles will also create an exclusion rule for the child folder. All folders under the application folder will be scanned recursively for registered file name extensions.
+
+- `IncludePatterns`: This argument determines whether to generate exclude or include patterns in the XML. When this argument is set to **TRUE**, the **GenerateDocPatterns** function generates include patterns and the function must be added under the `` element. Changing this argument to **FALSE** generates exclude patterns and the function must be added under the `` element.
+
+ **Default value**: True
+
+- `SystemDrive`: This argument determines whether to generate patterns for all fixed drives or only for the system drive. Changing this argument to **TRUE** restricts all patterns to the system drive.
+
+ **Default value**: False
**Usage:**
-```
+```console
MigXmlHelper.GenerateDocPatterns ("", "", "")
```
@@ -400,42 +336,24 @@ The user context includes rules for data in the User Profiles directory. When ca
- FOLDERID\_RecordedTV
-**Note**
-Rules contained in a component that is assigned the user context will be run for each user profile on the computer. Files that are scanned multiple times by the MigDocs.xml files will only be copied to the migration store once; however, a large number of rules in the user context can slow down the migration. Use the system context when it is applicable.
+> [!NOTE]
+> Rules contained in a component that is assigned the user context will be run for each user profile on the computer. Files that are scanned multiple times by the MigDocs.xml files will only be copied to the migration store once; however, a large number of rules in the user context can slow down the migration. Use the system context when it is applicable.
-
+ ### Sample migration rules for customized versions of XML files
-### Sample migration rules for customized versions of XML files
-
-**Note**
-For best practices and requirements for customized XML files in USMT, see [Customize USMT XML Files](usmt-customize-xml-files.md) and [General Conventions](usmt-general-conventions.md).
-
-
+> [!NOTE]
+> For best practices and requirements for customized XML files in USMT, see [Customize USMT XML Files](usmt-customize-xml-files.md) and [General Conventions](usmt-general-conventions.md).
### Exclude rules usage examples
In the examples below, the source computer has a .txt file called "new text document" in a directory called "new folder". The default MigDocs.xml behavior migrates the new text document.txt file and all files contained in the "new folder" directory. The rules generated by the function are:
-
-
-
-
-
-
-
-
Rule 1
-
<pattern type="File">d:\new folder[new text document.txt]</pattern>
-
-
-
Rule 2
-
<pattern type="File">d:\new folder[]</pattern>
-
-
-
+| Rule | Syntax |
+|--- |--- |
+|Rule 1|`d:\new folder[new text document.txt]`|
+|Rule 2|`d:\new folder[]`|
-
-
-To exclude the new text document.txt file as well as any .txt files in "new folder", you can do the following:
+To exclude the new text document.txt file and any .txt files in "new folder", you can do the following:
**Example 1: Exclude all .txt files in a folder**
@@ -513,30 +431,17 @@ For locations outside the user profile, such as the Program Files folder, you ca
For more examples of include rules that you can use in custom migration XML files, see [Include Files and Settings](usmt-include-files-and-settings.md).
-**Note**
-For more information about the order of precedence for XML migration rules, see [Conflicts and Precedence](usmt-conflicts-and-precedence.md).
-
-
+> [!NOTE]
+> For more information about the order of precedence for XML migration rules, see [Conflicts and Precedence](usmt-conflicts-and-precedence.md).
## Next steps
-
-You can include additional rules for the migration in the MigDocs.xml file or other XML migration files. For example, you can use the <locationModify> element to move files from the folder where they were gathered to a different folder, when they are applied to the destination computer.
+You can include additional rules for the migration in the MigDocs.xml file or other XML migration files. For example, you can use the `` element to move files from the folder where they were gathered to a different folder, when they are applied to the destination computer.
You can use an XML schema (MigXML.xsd) file to validate the syntax of your customized XML files. For more information, see [USMT Resources](usmt-resources.md).
## Related topics
-
[Exclude Files and Settings](usmt-exclude-files-and-settings.md)
[Include Files and Settings](usmt-include-files-and-settings.md)
-
-
-
-
-
-
-
-
-
diff --git a/windows/deployment/usmt/usmt-choose-migration-store-type.md b/windows/deployment/usmt/usmt-choose-migration-store-type.md
index 6985683c08..871da5bf3b 100644
--- a/windows/deployment/usmt/usmt-choose-migration-store-type.md
+++ b/windows/deployment/usmt/usmt-choose-migration-store-type.md
@@ -16,51 +16,19 @@ ms.topic: article
# Choose a Migration Store Type
-
One of the main considerations for planning your migration is to determine which migration store type best meets your needs. As part of these considerations, determine how much space is required to run the User State Migration Tool (USMT) 10.0 components on your source and destination computers, and how much space is needed to create and host the migration store, whether you are using a local share, network share, or storage device. The final consideration is ensuring that user date integrity is maintained by encrypting the migration store.
## In This Section
-
-
Learn about the using migration store encryption to protect user data integrity during a migration.
-
-
-
-
-
+| Link | Description |
+|--- |--- |
+|[Migration Store Types Overview](migration-store-types-overview.md)|Choose the migration store type that works best for your needs and migration scenario.|
+|[Estimate Migration Store Size](usmt-estimate-migration-store-size.md)|Estimate the amount of disk space needed for computers in your organization based on information about your organization's infrastructure.|
+|[Hard-Link Migration Store](usmt-hard-link-migration-store.md)|Learn about hard-link migration stores and the scenarios in which they are used.|
+|[Migration Store Encryption](usmt-migration-store-encryption.md)|Learn about the using migration store encryption to protect user data integrity during a migration.|
## Related topics
-
[Plan Your Migration](usmt-plan-your-migration.md)
[User State Migration Tool (USMT) How-to topics](usmt-how-to.md)
-
-
-
-
-
-
-
-
-
diff --git a/windows/deployment/usmt/usmt-command-line-syntax.md b/windows/deployment/usmt/usmt-command-line-syntax.md
index 85adbc467d..0631a98022 100644
--- a/windows/deployment/usmt/usmt-command-line-syntax.md
+++ b/windows/deployment/usmt/usmt-command-line-syntax.md
@@ -16,40 +16,12 @@ ms.topic: article
# User State Migration Tool (USMT) Command-line Syntax
-
The User State Migration Tool (USMT) 10.0 migrates user files and settings during large deployments of Windows. To improve and simplify the migration process, USMT captures desktop, network, and application settings in addition to a user's files. USMT then migrates these items to a new Windows installation.
## In This Section
-
-
Lists the command-line options for using the UsmtUtils tool.
-
-
-
-
-
-
-
-
-
-
-
-
-
-
+| Link | Description |
+|--- |--- |
+|[ScanState Syntax](usmt-scanstate-syntax.md)|Lists the command-line options for using the ScanState tool.|
+|[LoadState Syntax](usmt-loadstate-syntax.md)|Lists the command-line options for using the LoadState tool.|
+|[UsmtUtils Syntax](usmt-utilities.md)|Lists the command-line options for using the UsmtUtils tool.|
diff --git a/windows/deployment/usmt/usmt-configxml-file.md b/windows/deployment/usmt/usmt-configxml-file.md
index 084c869c9a..ed444aa11e 100644
--- a/windows/deployment/usmt/usmt-configxml-file.md
+++ b/windows/deployment/usmt/usmt-configxml-file.md
@@ -16,10 +16,8 @@ ms.topic: article
# Config.xml File
-
## Config.xml File
-
The Config.xml file is an optional User State Migration Tool (USMT) 10.0 file that you can create using the **/genconfig** option with the ScanState.exe tool. If you want to include all of the default components, and do not want to change the default store-creation or profile-migration behavior, you do not need to create a Config.xml file.
However, if you are satisfied with the default migration behavior defined in the MigApp.xml, MigUser.xml and MigDocs.xml files, but you want to exclude certain components, you can create and modify a Config.xml file and leave the other .xml files unchanged. For example, you must create and modify the Config.xml file if you want to exclude any of the operating-system settings that are migrated. It is necessary to create and modify this file if you want to change any of the default store-creation or profile-migration behavior.
@@ -31,11 +29,8 @@ For more information about using the Config.xml file with other migration files,
**Note**
To exclude a component from the Config.xml file, set the **migrate** value to **"no"**. Deleting the XML tag for the component from the Config.xml file will not exclude the component from your migration.
-
-
## In this topic
-
In USMT there are new migration policies that can be configured in the Config.xml file. For example, you can configure additional **<ErrorControl>**, **<ProfileControl>**, and **<HardLinkStoreControl>** options. The following elements and parameters are for use in the Config.xml file only.
[<Policies>](#bkmk-policies)
@@ -74,14 +69,12 @@ In USMT there are new migration policies that can be configured in the Config.xm
## <Policies>
-
The **<Policies>** element contains elements that describe the policies that USMT follows while creating a migration store. Valid children of the **<Policies>** element are **<ErrorControl>** and **<HardLinkStoreControl>**. The **<Policies>** element is a child of **<Configuration>**.
Syntax: ``
## <ErrorControl>
-
The **<ErrorControl>** element is an optional element you can configure in the Config.xml file. The configurable **<ErrorControl>** rules support only the environment variables for the operating system that is running and the currently logged-on user. As a workaround, you can specify a path using the (\*) wildcard character.
- **Number of occurrences**: Once for each component
@@ -108,10 +101,8 @@ Additionally, the order in the **<ErrorControl>** section implies priority
```
-**Important**
-The configurable **<ErrorControl>** rules support only the environment variables for the operating system that is running and the currently logged-on user. As a workaround, you can specify a path using the (\*) wildcard character.
-
-
+> [!IMPORTANT]
+> The configurable **<ErrorControl>** rules support only the environment variables for the operating system that is running and the currently logged-on user. As a workaround, you can specify a path using the (\*) wildcard character.
### <fatal>
@@ -125,35 +116,14 @@ The **<fatal>** element is not required.
Syntax: ``*<pattern>*``
-
-
-
-
-
-
-
-
-
Parameter
-
Required
-
Value
-
-
-
-
-
errorCode
-
No
-
"any" or "specify system error message here"
-
-
-
-
-
+|Parameter|Required|Value|
+|--- |--- |--- |
+|errorCode|No|"any" or "*specify system error message here*"|
You use the **<fatal>** element to specify that errors matching a specific pattern should cause USMT to halt the migration.
## <fileError>
-
The **<fileError>** element is not required.
- **Number of occurrences**: Once for each component
@@ -168,7 +138,6 @@ You use the **<fileError>** element to represent the behavior associated w
## <nonFatal>
-
The **<nonFatal>** element is not required.
- **Number of occurrences**: Once for each component
@@ -179,35 +148,14 @@ The **<nonFatal>** element is not required.
Syntax: ``*<pattern>*``
-
-
-
-
-
-
-
-
-
Parameter
-
Required
-
Value
-
-
-
-
-
<errorCode>
-
No
-
"any" or "specify system error message here". If system error messages are not specified, the default behavior applies the parameter to all system error messages.
-
-
-
-
-
+|Parameter|Required|Value|
+|--- |--- |--- |
+|**<errorCode>**|No|"any" or "*specify system error message here*". If system error messages are not specified, the default behavior applies the parameter to all system error messages.|
You use the **<nonFatal>** element to specify that errors matching a specific pattern should not cause USMT to halt the migration.
## <registryError>
-
The <registryError>element is not required.
- **Number of occurrences**: Once for each component
@@ -218,35 +166,14 @@ The <registryError>element is not required.
Syntax: ``
-
-
-
-
-
-
-
-
-
Parameter
-
Required
-
Value
-
-
-
-
-
<errorCode>
-
No
-
"any" or "specify system error message here". If system error messages are not specified, the default behavior applies the parameter to all system error messages.
-
-
-
-
-
+|Parameter|Required|Value|
+|--- |--- |--- |
+|**<errorCode>**|No|"any" or "*specify system error message here*". If system error messages are not specified, the default behavior applies the parameter to all system error messages.|
You use the **<registryError>** element to specify that errors matching a specific pattern should not cause USMT to halt the migration.
## <HardLinkStoreControl>
-
The **<HardLinkStoreControl>** element contains elements that describe how to handle files during the creation of a hard-link migration store. Its only valid child is **<fileLocked>**.
Syntax: ``
@@ -261,10 +188,8 @@ Syntax: ``
The **<HardLinkStoreControl>** sample code below specifies that hard links can be created to locked files only if the locked file resides somewhere under C:\\Users\\. Otherwise, a file-access error occurs when a locked file is encountered that cannot be copied, even though is technically possible for the link to be created.
-**Important**
-The **<ErrorControl>** section can be configured to conditionally ignore file access errors, based on the file’s location.
-
-
+> [!IMPORTANT]
+> The **<ErrorControl>** section can be configured to conditionally ignore file access errors, based on the file’s location.
``` xml
@@ -282,84 +207,49 @@ The **<ErrorControl>** section can be configured to conditionally ignore f
## <fileLocked>
-
The **<fileLocked>** element contains elements that describe how to handle files that are locked for editing. The rules defined by the **<fileLocked>** element are processed in the order in which they appear in the XML file.
Syntax: ``
## <createHardLink>
-
The **<createHardLink>** element defines a standard MigXML pattern that describes file paths where hard links should be created, even if the file is locked for editing by another application.
Syntax: ``*<pattern>*``
## <errorHardLink>
-
The **<errorHardLink>** element defines a standard MigXML pattern that describes file paths where hard links should not be created if the file is locked for editing by another application. USMT will attempt to copy files under these paths into the migration store. However, if that is not possible, **Error\_Locked** is thrown. This is a standard Windows application programming interface (API) error that can be captured by the **<ErrorControl>** section to either cause USMT to skip the file or abort the migration.
Syntax: ``*<pattern>*``
## <ProfileControl>
-
This element is used to contain other elements that establish rules for migrating profiles, users, and policies around local group membership during the migration. **<ProfileMigration>** is a child of **<Configuration>**.
Syntax: <`ProfileControl> `
## <localGroups>
-
This element is used to contain other elements that establish rules for how to migrate local groups. **<localGroups>** is a child of **<ProfileControl>**.
Syntax: ``
## <mappings>
-
This element is used to contain other elements that establish mappings between groups.
Syntax: ``
## <changeGroup>
-
This element describes the source and destination groups for a local group membership change during the migration. It is a child of **<localGroups>**. The following parameters are defined:
-
-
-
-
-
-
-
-
-
Parameter
-
Required
-
Value
-
-
-
-
-
From
-
Yes
-
A valid local group on the source machine that contains users selected for migration on the command line.
-
-
-
To
-
Yes
-
A local group that the users are to be moved to during the migration.
-
-
-
appliesTo
-
Yes
-
nonmigratedUsers, migratedUsers, AllUsers. This value defines which users the change group operation should apply to.
-
-
-
-
-
+|Parameter|Required|Value|
+|--- |--- |--- |
+|From|Yes|A valid local group on the source machine that contains users selected for migration on the command line.|
+|To|Yes|A local group that the users are to be moved to during the migration.|
+|appliesTo|Yes|nonmigratedUsers, migratedUsers, AllUsers. This value defines which users the change group operation should apply to.|
The valid and required children of **<changeGroup>** are **<include>** and **<exclude>**. Although both can be children at the same time, only one is required.
@@ -367,21 +257,18 @@ Syntax: ``
## <include>
-
This element specifies that its required child, *<pattern>*, should be included in the migration.
Syntax: ````
## <exclude>
-
This element specifies that its required child, *<pattern>*, should be excluded from the migration.
Syntax: ``` `
## Sample Config.xml File
-
Refer to the following sample Config.xml file for additional details about items you can choose to exclude from a migration.
```xml
@@ -577,14 +464,4 @@ Refer to the following sample Config.xml file for additional details about items
## Related topics
-
[USMT XML Reference](usmt-xml-reference.md)
-
-
-
-
-
-
-
-
-
diff --git a/windows/deployment/usmt/usmt-conflicts-and-precedence.md b/windows/deployment/usmt/usmt-conflicts-and-precedence.md
index c7dc4a18ce..1236299462 100644
--- a/windows/deployment/usmt/usmt-conflicts-and-precedence.md
+++ b/windows/deployment/usmt/usmt-conflicts-and-precedence.md
@@ -16,7 +16,6 @@ ms.topic: article
# Conflicts and Precedence
-
When you include, exclude, and reroute files and settings, it is important to know how User State Migration Tool (USMT) 10.0 deals with conflicts and precedence. When working with USMT, the following are the most important conflicts and precedence guidelines to keep in mind.
- **If there are conflicting rules within a component, the most specific rule is applied.** However, the <unconditionalExclude> rule is an exception because it takes precedence over all others. Directory names take precedence over file extensions. For examples, see [What happens when there are conflicting include and exclude rules?](#bkmk1) and the first example in [Include and exclude precedence examples](#precexamples)****later in this topic.
@@ -33,7 +32,6 @@ When you include, exclude, and reroute files and settings, it is important to kn
## In this topic
-
**General**
- [What is the relationship between rules that are located within different components?](#bkmk2)
@@ -60,7 +58,6 @@ When you include, exclude, and reroute files and settings, it is important to kn
## General
-
### What is the relationship between rules that are located within different components?
Only rules inside the same component can affect each other, depending on specificity, except for the <unconditionalExclude> rule. Rules that are in different components do not affect each other. If there is an <include> rule in one component and an identical <exclude> rule in another component, the data will be migrated because the two rules are independent of each other.
@@ -129,7 +126,6 @@ USMT does not distinguish the .xml files based on their name or content. It proc
## The <include> and <exclude> rules
-
### What happens when there are conflicting <include> and <exclude> rules?
If there are conflicting rules within a component, the most specific rule is applied, except with the <unconditionalExclude> rule, which takes precedence over all other rules. If the rules are equally specific, then the data will be not be migrated. For example if you exclude a file, and include the same file, the file will not be migrated. If there are conflicting rules within different components, the rules do not affect each other because each component is processed independently.
@@ -159,212 +155,35 @@ These examples explain how USMT deals with <include> and <exclude> r
### Including and excluding files
-
-
-
-
-
-
-
-
-
If you have the following code in the same component
-
Resulting behavior
-
Explanation
-
-
-
-
-
-
Include rule: <pattern type="File">C:\Dir1* []</pattern>
| Migrates all files and subfolders in Dir1 (including all .txt files in C:). | The <exclude> rule does not affect the migration because the <include> rule is more specific. |
+|
Include rule: <pattern type="File">C:\Dir1* []</pattern>
| Nothing will be migrated. | The rules are equally specific, so the <exclude> rule takes precedence over the <include> rule. |
+|
Include rule: C:\Dir1* [.txt]
Exclude rule: C:\Dir1\Dir2* []
| Migrates the .txt files in Dir1 and the .txt files from subfolders other than Dir2. No files are migrated from Dir2 or its subfolders. | Both rules are processed as intended. |
+|
Include rule: C:\Dir1\Dir2* []
Exclude rule: C:\Dir1* [.txt]
| Migrates all files and subfolders of Dir2, except the .txt files from Dir1 and any subfolders of Dir1 (including Dir2). | Both rules are processed as intended. |
-
-
-
-
-
-
-
-
-
-
-
If you have the following code in different components
-
Resulting behavior
-
Explanation
-
-
-
-
-
Component 1:
-
-
Include rule: <pattern type="File">C:\Dir1* []</pattern>
Migrates all files and subfolders of C:\Dir1\ (including C:\Dir1\Dir2).
-
Rules that are in different components do not affect each other, except for the <unconditionalExclude> rule. Therefore, in this example, although some .txt files were excluded when Component 1 was processed, they were included when Component 2 was processed.
-
-
-
Component 1:
-
-
Include rule: C:\Dir1\Dir2* []
-
-
Component 2:
-
-
Exclude rule: C:\Dir1* [.txt]
-
-
Migrates all files and subfolders from Dir2 except the .txt files in C:\Dir1 and its subfolders.
-
Both rules are processed as intended.
-
-
-
Component 1:
-
-
Exclude rule: C:\Dir1\Dir2* []
-
-
Component 2:
-
-
Include rule: C:\Dir1* [.txt]
-
-
Migrates all .txt files in Dir1 and any subfolders.
-
Component 1 does not contain an <include> rule, so the <exclude> rule is not processed.
-
-
-
-
-
+| If you have the following code in different components | Resulting behavior | Explanation |
+|-----|----|----|
+| Component 1:
Include rule: <pattern type="File">C:\Dir1* []</pattern>
| Migrates all files and subfolders of C:\Dir1\ (including C:\Dir1\Dir2). | Rules that are in different components do not affect each other, except for the <unconditionalExclude> rule. Therefore, in this example, although some .txt files were excluded when Component 1 was processed, they were included when Component 2 was processed. |
+| Component 1:
Include rule: C:\Dir1\Dir2* []
Component 2:
Exclude rule: C:\Dir1* [.txt]
| Migrates all files and subfolders from Dir2 except the .txt files in C:\Dir1 and its subfolders. | Both rules are processed as intended. |
+| Component 1:
Exclude rule: C:\Dir1\Dir2* []
Component 2:
Include rule: C:\Dir1* [.txt]
| Migrates all .txt files in Dir1 and any subfolders. | Component 1 does not contain an <include> rule, so the <exclude> rule is not processed. |
### Including and excluding registry objects
-
-
-
-
-
-
-
-
-
If you have the following code in the same component
-
Resulting behavior
-
Explanation
-
-
-
-
-
-
Include rule: HKLM\Software\Microsoft\Command Processor* []
| Migrates only DefaultColor in HKLM\Software\Microsoft\Command Processor. | DefaultColor is migrated because the <include> rule is more specific than the <exclude> rule. |
+|
Include rule: HKLM\Software\Microsoft\Command Processor [DefaultColor]
Migrates all the keys/values under HKLM\Software\Microsoft\Command Processor.
-
Rules that are in different components do not affect each other, except for the <unconditionalExclude> rule. Therefore, in this example, the objects that were excluded when Component 1 was processed were included when Component 2 was processed.
-
-
-
-
-
+| If you have the following code in different components | Resulting behavior | Explanation |
+|-----|-----|-----|
+| Component 1:
Include rule: HKLM\Software\Microsoft\Command Processor [DefaultColor]
| Migrates all the keys/values under HKLM\Software\Microsoft\Command Processor. | Rules that are in different components do not affect each other, except for the <unconditionalExclude> rule. Therefore, in this example, the objects that were excluded when Component 1 was processed were included when Component 2 was processed. |
## File collisions
-
### What is the default behavior when there are file collisions?
If there is not a <merge> rule, the default behavior for the registry is for the source to overwrite the destination. The default behavior for files is for the source to be renamed incrementally: for example, OriginalFileName(1).OriginalExtension, OriginalFileName(2).OriginalExtension, and so on.
@@ -399,67 +218,49 @@ You have a custom .xml file that contains the following code:
```
-For this example, the following table describes the resulting behavior if you add the code in the first column to your custom .xml file.
+For this example, the following information describes the resulting behavior if you add the code to your custom .xml file.
-
During ScanState, all the files will be added to the store.
-
During LoadState, the following will occur:
-
-
C:\Data\SampleA.txt will be restored.
-
C:\Data\SampleB.txt will be restored, overwriting the existing file on the destination computer.
-
C:\Data\Folder\SampleB.txt will not be restored.
-
-
-
-
+**Example 1**
-
+```xml
+
+
+ c:\data* []
+
+
+```
+
+**Result**: During ScanState, all the files will be added to the store. During LoadState, only C:\Data\SampleA.txt will be restored.
+
+**Example 2**
+
+```xml
+
+
+ c:\data* []
+
+
+```
+
+**Result**: During ScanState, all the files will be added to the store.
+During LoadState, all the files will be restored, overwriting the existing files on the destination computer.
+
+**Example 3**
+
+```xml
+
+
+ c:\data\ [*]
+
+
+```
+
+**Result**: During ScanState, all the files will be added to the store. During LoadState, the following will occur:
+
+- C:\Data\SampleA.txt will be restored.
+- C:\Data\SampleB.txt will be restored, overwriting the existing file on the destination computer.
+- C:\Data\Folder\SampleB.txt will not be restored.
## Related topics
-
[USMT XML Reference](usmt-xml-reference.md)
-
-
-
-
-
-
-
-
-
diff --git a/windows/deployment/usmt/usmt-custom-xml-examples.md b/windows/deployment/usmt/usmt-custom-xml-examples.md
index 5096af5a77..7d31c9bdbb 100644
--- a/windows/deployment/usmt/usmt-custom-xml-examples.md
+++ b/windows/deployment/usmt/usmt-custom-xml-examples.md
@@ -15,26 +15,8 @@ ms.topic: article
# Custom XML Examples
-
-**Note**
-Because the tables in this topic are wide, you may need to adjust the width of its window.
-
-
-
-## In This Topic:
-
-
-- [Example 1: Migrating an Unsupported Application](#example)
-
-- [Example 2: Migrating the My Videos Folder](#example2)
-
-- [Example 3: Migrating Files and Registry Keys](#example3)
-
-- [Example 4: Migrating Specific Folders from Various Locations](#example4)
-
## Example 1: Migrating an Unsupported Application
-
The following is a template for the sections that you need to migrate your application. The template is not functional on its own, but you can use it to write your own .xml file.
``` xml
@@ -103,37 +85,23 @@ The following is a template for the sections that you need to migrate your appli
## Example 2: Migrating the My Videos Folder
+The following sample is a custom .xml file named CustomFile.xml that migrates My Videos for all users, if the folder exists on the source computer.
-The following is a custom .xml file named CustomFile.xml that migrates My Videos for all users, if the folder exists on the source computer.
+- **Sample condition**: Verifies that My Videos exists on the source computer:
-
Filters out the shortcuts in My Videos that do not resolve on the destination computer. This has no effect on files that are not shortcuts. For example, if there is a shortcut in My Videos on the source computer that points to C:\Folder1, that shortcut will be migrated only if C:\Folder1 exists on the destination computer. However, all other files, such as .mp3 files, migrate without any filtering.
+ `MigXmlHelper.DoesObjectExist("File","%CSIDL_MYVIDEO%")`
-
+- **Sample filter**: Filters out the shortcuts in My Videos that do not resolve on the destination computer:
+
+ ``
+
+ This has no effect on files that are not shortcuts. For example, if there is a shortcut in My Videos on the source computer that points to C:\Folder1, that shortcut will be migrated only if C:\Folder1 exists on the destination computer. However, all other files, such as .mp3 files, migrate without any filtering.
+
+- **Sample pattern**: Migrates My Videos for all users:
+
+ `%CSIDL_MYVIDEO%* [*]`
+
+**XML file**
```xml
@@ -160,41 +128,25 @@ The following is a custom .xml file named CustomFile.xml that migrates My Videos
## Example 3: Migrating Files and Registry Keys
+The sample patterns describe the behavior in the following example .xml file.
-This table describes the behavior in the following example .xml file.
+- **Sample pattern**: Migrates all instances of the file Usmttestfile.txt from all sub-directories under `%ProgramFiles%\USMTTestFolder`:
-
Migrates the entire registry hive under HKLM\Software\USMTTESTKEY.
-
-
-
+ `%ProgramFiles%\USMTTestFolder* [USMTTestFile.txt]`
-
+- **Sample pattern**: Migrates the whole directory under `%ProgramFiles%\USMTDIRTestFolder`:
+
+ `%ProgramFiles%\USMTDIRTestFolder* []`
+
+- **Sample pattern**: Migrates all instances of MyKey under `HKCU\Software\USMTTESTKEY`:
+
+ `HKCU\Software\USMTTESTKEY* [MyKey]`
+
+- **Sample pattern**: Migrates the entire registry hive under `HKLM\Software\USMTTESTKEY`:
+
+ `HKLM\Software\USMTTESTKEY* []`
+
+**XML file**
``` xml
@@ -230,7 +182,7 @@ This table describes the behavior in the following example .xml file.
## Example 4: Migrating Specific Folders from Various Locations
-The behavior for this custom .xml file is described within the <`displayName`> tags in the code.
+The behavior for this custom .xml file is described within the `` tags in the code.
``` xml
@@ -257,12 +209,12 @@ The behavior for this custom .xml file is described within the <`displayName`
Component to migrate all user documents except Sample.doc
-
+ C:\UserDocuments\* [*]
-
+ C:\UserDocuments\ [Sample.doc]
@@ -277,9 +229,9 @@ The behavior for this custom .xml file is described within the <`displayName`
-
-
-
+
+
+
@@ -291,8 +243,8 @@ The behavior for this custom .xml file is described within the <`displayName`
- C:\*\Presentations\* [*]
- C:\Presentations\* [*]
+ C:\*\Presentations\* [*]
+ C:\Presentations\* [*]
@@ -303,16 +255,6 @@ The behavior for this custom .xml file is described within the <`displayName`
## Related topics
-
[USMT XML Reference](usmt-xml-reference.md)
[Customize USMT XML Files](usmt-customize-xml-files.md)
-
-
-
-
-
-
-
-
-
diff --git a/windows/deployment/usmt/usmt-determine-what-to-migrate.md b/windows/deployment/usmt/usmt-determine-what-to-migrate.md
index 418f73f68c..608624844a 100644
--- a/windows/deployment/usmt/usmt-determine-what-to-migrate.md
+++ b/windows/deployment/usmt/usmt-determine-what-to-migrate.md
@@ -24,30 +24,12 @@ To reduce complexity and increase standardization, your organization should cons
## In This Section
-
Determine and locate the standard, company-specified, and non-standard locations of the file types, files, folders, and settings that you want to migrate.
-
-
-
+| Link | Description |
+|--- |--- |
+|[Identify Users](usmt-identify-users.md)|Use command-line options to specify which users to migrate and how they should be migrated.|
+|[Identify Applications Settings](usmt-identify-application-settings.md)|Determine which applications you want to migrate and prepare a list of application settings to be migrated.|
+|[Identify Operating System Settings](usmt-identify-operating-system-settings.md)|Use migration to create a new standard environment on each of the destination computers.|
+|[Identify File Types, Files, and Folders](usmt-identify-file-types-files-and-folders.md)|Determine and locate the standard, company-specified, and non-standard locations of the file types, files, folders, and settings that you want to migrate.|
## Related topics
diff --git a/windows/deployment/usmt/usmt-hard-link-migration-store.md b/windows/deployment/usmt/usmt-hard-link-migration-store.md
index 45c699be37..02c53344c8 100644
--- a/windows/deployment/usmt/usmt-hard-link-migration-store.md
+++ b/windows/deployment/usmt/usmt-hard-link-migration-store.md
@@ -16,12 +16,10 @@ ms.topic: article
# Hard-Link Migration Store
-
-A *hard-link migration store* enables you to perform an in-place migration where all user state is maintained on the computer while the old operating system is removed and the new operating system is installed; this is why it is best suited for the computer-refresh scenario. Use of a hard-link migration store for a computer-refresh scenario drastically improves migration performance and significantly reduces hard-disk utilization, reduces deployment costs and enables entirely new migration scenarios.
+A *hard-link migration store* enables you to perform an in-place migration where all user state is maintained on the computer while the old operating system is removed and the new operating system is installed; this is why it is best suited for the computer-refresh scenario. Use of a hard-link migration store for a computer-refresh scenario drastically improves migration performance and significantly reduces hard-disk utilization, reduces deployment costs, and enables entirely new migration scenarios.
## In this topic
-
[When to Use a Hard-Link Migration](#bkmk-when)
[Understanding a Hard-Link Migration](#bkmk-understandhardlinkmig)
@@ -46,7 +44,6 @@ A *hard-link migration store* enables you to perform an in-place migration where
## When to Use a Hard-Link Migration
-
You can use a hard-link migration store when your planned migration meets both of the following criteria:
- You are upgrading the operating system on existing hardware rather than migrating to new computers.
@@ -57,32 +54,27 @@ You cannot use a hard-link migration store if your planned migration includes an
- You are migrating data from one computer to a second computer.
-- You are migrating data from one volume on a computer to another volume, for example from C: to D:.
+- You are migrating data from one volume on a computer to another volume, for example from `C:` to `D:`.
- You are formatting or repartitioning the disk outside of Windows Setup, or specifying a disk format or repartition during Windows Setup that will remove the migration store.
## Understanding a Hard-Link Migration
-
The hard-link migration store is created using the command-line option, **/hardlink**, and is equivalent to other migration-store types. However, it differs in that hard links are utilized to keep files stored on the source computer during the migration. Keeping the files in place on the source computer eliminates the redundant work of duplicating files. It also enables the performance benefits and reduction in disk utilization that define this scenario.
When you create a hard link, you give an existing file an additional path. For instance, you could create a hard link to c:\\file1.txt called c:\\hard link\\myFile.txt. These are two paths to the same file. If you open c:\\file1.txt, make changes, and save the file, you will see those changes when you open c:\\hard link\\myFile.txt. If you delete c:\\file1.txt, the file still exists on your computer as c:\\hardlink\\myFile.txt. You must delete both references to the file in order to delete the file.
-**Note**
-A hard link can only be created for a file on the same volume. If you copy a hard-link migration store to another drive or external device, the files, and not the links, are copied, as in a non-compressed migration-store scenario.
+> [!NOTE]
+> A hard link can only be created for a file on the same volume. If you copy a hard-link migration store to another drive or external device, the files, and not the links, are copied, as in a non-compressed migration-store scenario.
-
-
-For more information about hard links, please see [Hard Links and Junctions](/windows/win32/fileio/hard-links-and-junctions)
+For more information about hard links, see [Hard Links and Junctions](/windows/win32/fileio/hard-links-and-junctions)
In most aspects, a hard-link migration store is identical to an uncompressed migration store. It is located where specified by the Scanstate command-line tool and you can view the contents of the store by using Windows® Explorer. Once created, it can be deleted or copied to another location without changing user state. Restoring a hard-link migration store is similar to restoring any other migration store; however, as with creating the store, the same hard-link functionality is used to keep files in-place.
As a best practice, we recommend that you delete the hard-link migration store after you confirm that the Loadstate tool has successfully migrated the files. Since Loadstate has created new paths to the files on your new installation of a Windows operating system, deleting the hard links in the migration store will only delete one path to the files and will not delete the actual files or the paths to them from your new operating system.
-**Important**
-Using the **/c** option will force the Loadstate tool to continue applying files when non-fatal errors occur. If you use the **/c** option, you should verify that no errors are reported in the logs before deleting the hard-link migration store in order to avoid data loss.
-
-
+> [!IMPORTANT]
+> Using the **/c** option will force the Loadstate tool to continue applying files when non-fatal errors occur. If you use the **/c** option, you should verify that no errors are reported in the logs before deleting the hard-link migration store in order to avoid data loss.
Keeping the hard-link migration store can result in additional disk space being consumed or problems with some applications for the following reasons:
@@ -92,22 +84,17 @@ Keeping the hard-link migration store can result in additional disk space being
- Editing the file by using different paths simultaneously may result in data corruption.
-**Important**
-The read-only file attribute on migrated files is lost when the hard-link migration store is deleted. This is due to a limitation in NTFS file system hard links.
-
-
+> [!IMPORTANT]
+> The read-only file attribute on migrated files is lost when the hard-link migration store is deleted. This is due to a limitation in NTFS file system hard links.
## Hard-Link Migration Scenario
-
For example, a company has decided to deploy Windows 10 on all of their computers. Each employee will keep the same computer, but the operating system on each computer will be updated.
1. An administrator runs the ScanState command-line tool on each computer, specifying the **/hardlink** command-line option. The ScanState tool saves the user state to a hard-link migration store on each computer, improving performance by reducing file duplication, except in certain specific instances.
- **Note**
- As a best practice, we recommend that you do not create your hard-link migration store until just before you perform the migration in order to migrate the latest versions of your files. You should not use your software applications on the computer after creating the migration store until you have finished migrating your files with Loadstate.
-
-
+ > [!NOTE]
+ > As a best practice, we recommend that you do not create your hard-link migration store until just before you perform the migration in order to migrate the latest versions of your files. You should not use your software applications on the computer after creating the migration store until you have finished migrating your files with Loadstate.
2. On each computer, an administrator installs the company's standard operating environment (SOE), which includes Windows 7 and other applications the company currently uses.
@@ -115,19 +102,18 @@ For example, a company has decided to deploy Windows 10 on all of their compute
> [!NOTE]
> During the update of a domain-joined computer, the profiles of users whose SID cannot be resolved will not be migrated. When using a hard-link migration store, it could cause a data loss.
-
-## Hard-Link Migration Store Details
+## Hard-Link Migration Store Details
This section provides details about hard-link migration stores.
### Hard Disk Space
-The **/hardlink** command-line option proceeds with creating the migration store only if there is 250 megabytes (MB) of free space on the hard disk. Provided that every volume involved in the migration is formatted as NTFS, 250 MB should be enough space to ensure success for almost every hard-link migration, regardless on the size of the migration.
+The **/hardlink** command-line option proceeds with creating the migration store only if there are 250 megabytes (MB) of free space on the hard disk. If every volume involved in the migration is formatted as NTFS, 250 MB should be enough space to ensure success for almost every hard-link migration, regardless on the size of the migration.
### Hard-Link Store Size Estimation
-It is not necessary to estimate the size of a hard-link migration store. Estimating the size of a migration store is only useful in scenarios where the migration store is very large, and on NTFS volumes the hard-link migration store will require much less incremental space than other store options. The only case where the local store can be quite large is when non-NTFS file systems exist on the system and contain data being migrated. Since NTFS has been the default file system format for Windows XP and newer operating systems, this situation is unusual.
+It is not necessary to estimate the size of a hard-link migration store. Estimating the size of a migration store is only useful in scenarios where the migration store is large, and on NTFS volumes the hard-link migration store will require much less incremental space than other store options. The only case where the local store can be large is when non-NTFS file systems exist on the system and contain data being migrated. Since NTFS has been the default file system format for Windows XP and newer operating systems, this situation is unusual.
### Migration Store Path on Multiple Volumes
@@ -161,57 +147,27 @@ Files that are locked by an application or the operating system are handled diff
Files that are locked by the operating system cannot remain in place and must be copied into the hard-link migration store. As a result, selecting many operating-system files for migration significantly reduces performance during a hard-link migration. As a best practice, we recommend that you do not migrate any files out of the \\Windows directory, which minimizes performance-related issues.
-Files that are locked by an application are treated the same in hard-link migrations as in other scenarios when the volume shadow-copy service is not being utilized. The volume shadow-copy service cannot be used in conjunction with hard-link migrations. However, by modifying the new **<HardLinkStoreControl>** section in the Config.xml file, it is possible to enable the migration of files locked by an application.
+Files that are locked by an application are treated the same in hard-link migrations as in other scenarios when the volume shadow-copy service is not being utilized. The volume shadow-copy service cannot be used with hard-link migrations. However, by modifying the new `` section in the Config.xml file, it is possible to enable the migration of files locked by an application.
-**Important**
-There are some scenarios in which modifying the **<HardLinkStoreControl>** section in the Config.xml file makes it more difficult to delete a hard-link migration store. In these scenarios, you must use USMTutils.exe to schedule the migration store for deletion on the next restart.
-
-
+> [!IMPORTANT]
+> There are some scenarios in which modifying the `` section in the Config.xml file makes it more difficult to delete a hard-link migration store. In these scenarios, you must use USMTutils.exe to schedule the migration store for deletion on the next restart.
## XML Elements in the Config.xml File
-
A new section in the Config.xml file allows optional configuration of some of the hard-link migration behavior introduced with the **/HardLink** option.
-
-
-
-
-
-
-
-
<Policies>
-
This element contains elements that describe the policies that USMT follows while creating a migration store.
-
-
-
<HardLinkStoreControl>
-
This element contains elements that describe how to handle files during the creation of a hard link migration store.
-
-
-
<fileLocked>
-
This element contains elements that describe how to handle files that are locked for editing.
-
-
-
<createHardLink>
-
This element defines a standard MigXML pattern that describes file paths where hard links should be created, even if the file is locked for editing by another application.
This element defines a standard MigXML pattern that describes file paths where hard links should not be created, if the file is locked for editing by another application.
-
<errorHardLink> [pattern] </errorHardLink>
-
-
-
+| Element | Description |
+|--- |--- |
+| `` | This element contains elements that describe the policies that USMT follows while creating a migration store. |
+| `` | This element contains elements that describe how to handle files during the creation of a hard link migration store. |
+| `` | This element contains elements that describe how to handle files that are locked for editing. |
+| `` | This element defines a standard MigXML pattern that describes file paths where hard links should be created, even if the file is locked for editing by another application.
Syntax: `` [pattern] `` |
+| `` | This element defines a standard MigXML pattern that describes file paths where hard links should not be created, if the file is locked for editing by another application.
`` [pattern] `` |
-
+> [!IMPORTANT]
+> You must use the **/nocompress** option with the **/HardLink** option.
-**Important**
-You must use the **/nocompress** option with the **/HardLink** option.
-
-
-
-The following XML sample specifies that files locked by an application under the \\Users directory can remain in place during the migration. It also specifies that locked files that are not located in the \\Users directory should result in the **File in Use** error. It is important to exercise caution when specifying the paths using the **File in Use<createhardlink>** tag in order to minimize scenarios that make the hard-link migration store more difficult to delete.
+The following XML sample specifies that files locked by an application under the \\Users directory can remain in place during the migration. It also specifies that locked files that are not located in the \\Users directory should result in the **File in Use** error. It is important to exercise caution when specifying the paths using the **File in Use``** tag in order to minimize scenarios that make the hard-link migration store more difficult to delete.
``` xml
@@ -226,8 +182,4 @@ The following XML sample specifies that files locked by an application under the
## Related topics
-
[Plan Your Migration](usmt-plan-your-migration.md)
-
-
-
diff --git a/windows/deployment/usmt/usmt-loadstate-syntax.md b/windows/deployment/usmt/usmt-loadstate-syntax.md
index 77e214976c..42f918560d 100644
--- a/windows/deployment/usmt/usmt-loadstate-syntax.md
+++ b/windows/deployment/usmt/usmt-loadstate-syntax.md
@@ -16,29 +16,10 @@ ms.topic: article
# LoadState Syntax
-
This topic discusses the **LoadState** command syntax and options available with it.
-## In this topic
-
-
-[Before You Begin](#before)
-
-[Syntax](#bkmk-s)
-
-[Storage Options](#bkmk-st)
-
-[Migration Rule Options](#bkmk-mig)
-
-[Monitoring Options](#bkmk-mon)
-
-[User Options](#bkmk-user)
-
-[Incompatible Command-Line Options](#bkmk-cloi)
-
## Before You Begin
-
Before you run the **LoadState** command, note the following:
- To ensure that all operating system settings migrate, we recommend that you run the **LoadState** commands in administrator mode from an account with administrative credentials.
@@ -55,7 +36,6 @@ Before you run the **LoadState** command, note the following:
## Syntax
-
This section explains the syntax and usage of the command-line options available when you use the **LoadState** command. The options can be specified in any order. If the option contains a parameter, you can specify either a colon or space separator.
The **LoadState** command's syntax is:
@@ -71,390 +51,66 @@ For example, to decrypt the store and migrate the files and settings to a comput
USMT provides the following options that you can use to specify how and where the migrated data is stored.
-
-
-
-
-
-
-
-
Command-Line Option
-
Description
-
-
-
-
-
StorePath
-
Indicates the folder where the files and settings data are stored. You must specify StorePath when using the LoadState command. You cannot specify more than one StorePath.
-
-
-
/decrypt/key:KeyString
-
or
-
/decrypt/key:"Key String"
-
or
-
/decrypt/keyfile:[Path</em>]FileName
-
Decrypts the store with the specified key. With this option, you will need to specify the encryption key in one of the following ways:
-
-
/key:KeyString specifies the encryption key. If there is a space in KeyString, you must surround the argument with quotation marks.
-
/keyfile:FilePathAndName specifies a text (.txt) file that contains the encryption key
-
-
KeyString cannot exceed 256 characters.
-
The /key and /keyfile options cannot be used on the same command line.
-
The /decrypt and /nocompress options cannot be used on the same command line.
-
-Important
Use caution with this option, because anyone who has access to the LoadState command-line script will also have access to the encryption key.
The /decrypt option accepts a command-line parameter to define the encryption strength specified for the migration store encryption. For more information about supported encryption algorithms, see Migration Store Encryption.
-
-
-
/hardlink
-
Enables user-state data to be restored from a hard-link migration store. The /nocompress parameter must be specified with /hardlink option.
-
-
-
/nocompress
-
Specifies that the store is not compressed. You should only use this option in testing environments. We recommend that you use a compressed store during your actual migration. This option cannot be used with the /decrypt option.
-
-
+| Command-Line Option | Description |
+|--- |--- |
+| `StorePath` | Indicates the folder where the files and settings data are stored. You must specify *StorePath* when using the **LoadState** command. You cannot specify more than one *StorePath*. |
+| `/decrypt /key`:*KeyString* or `/decrypt /key`:"*Key String*" or `/decrypt /keyfile`:[*Path*]*FileName* | Decrypts the store with the specified key. With this option, you will need to specify the encryption key in one of the following ways:
`/key:`*KeyString* specifies the encryption key. If there is a space in *KeyString*, you must surround the argument with quotation marks.
`/keyfile:`*FilePathAndName* specifies a text (.txt) file that contains the encryption key
*KeyString* cannot exceed 256 characters. The `/key` and `/keyfile` options cannot be used on the same command line. The `/decrypt` and `/nocompress` options cannot be used on the same command line.
**Important** Use caution with this option, because anyone who has access to the **LoadState** command-line script will also have access to the encryption key.
For example: `loadstate /i:migapp.xml /i:migdocs.xml \server\share\migration\mystore /decrypt /key:mykey` |
+| `/decrypt:`*"encryption strength"* | The `/decrypt` option accepts a command-line parameter to define the encryption strength specified for the migration store encryption. For more information about supported encryption algorithms, see [Migration Store Encryption](usmt-migration-store-encryption.md). |
+| `/hardlink` | Enables user-state data to be restored from a hard-link migration store. The `/nocompress` parameter must be specified with `/hardlink` option. |
+| `/nocompress` | Specifies that the store is not compressed. You should only use this option in testing environments. We recommend that you use a compressed store during your actual migration. This option cannot be used with the `/decrypt` option. For example: `loadstate /i:migapp.xml /i:migdocs.xml \server\share\migration\mystore /nocompress` |
## Migration Rule Options
-
USMT provides the following options to specify what files you want to migrate.
-
-
-
-
-
-
-
-
Command-Line Option
-
Description
-
-
-
-
-
/i:[Path]FileName
-
(include)
-
Specifies an .xml file that contains rules that define what state to migrate. You can specify this option multiple times to include all of your .xml files (MigApp.xml, MigSys.xml, MigDocs.xml and any custom .xml files that you create). Path can be either a relative or full path. If you do not specify the Path variable, then FileName must be located in the current directory.
-
For more information about which files to specify, see the "XML files" section of the Frequently Asked Questions topic.
-
-
-
/config:[Path]FileName
-
Specifies the Config.xml file that the LoadState command should use. You cannot specify this option more than once on the command line. Path can be either a relative or full path. If you do not specify the Path variable, then the FileName must be located in the current directory.
-
This example migrates the files and settings based on the rules in the Config.xml, MigDocs.xml, and MigApp.xml files:
This option enables you to specify the location of the default .xml files and then launch your migration. If no path is specified, USMT will use the directory where the USMT binaries are located. The /auto option has the same effect as using the following options: /i:MigDocs.xml/i:MigApp.xml /v:5.
-
-
-
-
-
+| Command-Line Option | Description |
+|--- |--- |
+| `/i`:[*Path*]*FileName* | **(include)** Specifies an .xml file that contains rules that define what state to migrate. You can specify this option multiple times to include all of your .xml files (MigApp.xml, MigSys.xml, MigDocs.xml and any custom .xml files that you create). *Path* can be either a relative or full path. If you do not specify the *Path* variable, then *FileName* must be located in the current directory.
For more information about which files to specify, see the "XML files" section of the [Frequently Asked Questions](usmt-faq.yml) topic. |
+| `/config:`[*Path*]*FileName* | Specifies the Config.xml file that the **LoadState** command should use. You cannot specify this option more than once on the command line. *Path* can be either a relative or full path. If you do not specify the *Path* variable, then the *FileName* must be located in the current directory.
This example migrates the files and settings based on the rules in the Config.xml, MigDocs.xml, and MigApp.xml files:
`loadstate \server\share\migration\mystore /config:config.xml /i:migdocs.xml /i:migapp.xml /v:5 /l:loadstate.log` |
+| `/auto:`*"path to script files"* | This option enables you to specify the location of the default .xml files and then launch your migration. If no path is specified, USMT will use the directory where the USMT binaries are located. The `/auto` option has the same effect as using the following options: `/i:MigDocs.xml` `/i:MigApp.xml /v:5`. |
## Monitoring Options
-
USMT provides several command-line options that you can use to analyze problems that occur during migration.
-
-
-
-
-
-
-
-
Command-Line Option
-
Description
-
-
-
-
-
/l:[Path]FileName
-
Specifies the location and name of the LoadState log. You cannot store any of the log files in StorePath. Path can be either a relative or full path. If you do not specify the Path variable, then the log will be created in the current directory. You can specify the /v option to adjust the amount of output.
-
If you run the LoadState command from a shared network resource, you must specify this option or USMT will fail with the error: "USMT was unable to create the log file(s)". To fix this issue, use the /l:load.log option.
-
-
-
/v:<VerbosityLevel>
-
(Verbosity)
-
Enables verbose output in the LoadState log file. The default value is 0.
-
You can set the VerbosityLevel to one of the following levels:
Creates the optional progress log. You cannot store any of the log files in StorePath. Path can be either a relative or full path. If you do not specify the Path variable, then FileName will be created in the current directory.
When this option is specified, the LoadState command will continue to run, even if non-fatal errors occur. Any files or settings that cause an error are logged in the progress log. For example, if there is a large file that will not fit on the computer, the LoadState command will log an error and continue with the migration. Without the /c option, the LoadState command will exit on the first error. You can use the new <ErrorControl> section in the Config.xml file to specify which file or registry read/write errors can be safely ignored and which might cause the migration to fail. This enables the /c command-line option to safely skip all input/output (I/O) errors in your environment. In addition, the /genconfig option now generates a sample <ErrorControl> section that is enabled by specifying error messages and desired behaviors in the Config.xml file.
-
-
-
/r:<TimesToRetry>
-
(Retry)
-
Specifies the number of times to retry when an error occurs while migrating the user state from a server. The default is three times. This option is useful in environments where network connectivity is not reliable.
-
While restoring the user state, the /r option will not recover data that is lost due to a network-hardware failure, such as a faulty or disconnected network cable, or when a virtual private network (VPN) connection fails. The retry option is intended for large, busy networks where connectivity is satisfactory, but communication latency is a problem.
-
-
-
/w:<SecondsBeforeRetry>
-
(Wait)
-
Specifies the time to wait, in seconds, before retrying a network file operation. The default is 1 second.
-
-
-
/? or /help
-
Displays Help on the command line.
-
-
-
-
-
+| Command-Line Option | Description |
+|--- |--- |
+| `/l:`[*Path*]*FileName* | Specifies the location and name of the **LoadState** log. You cannot store any of the log files in *StorePath*. *Path* can be either a relative or full path. If you do not specify the *Path* variable, then the log will be created in the current directory. You can specify the **/v** option to adjust the amount of output.
If you run the **LoadState** command from a shared network resource, you must specify this option or USMT will fail with the error: "USMT was unable to create the log file(s)". To fix this issue, use the **/l:load.log** option. |
+| `/v:`*``* | **(Verbosity)**
Enables verbose output in the LoadState log file. The default value is 0. You can set the *VerbosityLevel* to one of the following levels:
**0** - Only the default errors and warnings are enabled.
**1** - Enables verbose output.
**4** - Enables error and status output.
**5** - Enables verbose and status output.
**8** - Enables error output to a debugger.
**9** - Enables verbose output to a debugger.
**12** - Enables error and status output to a debugger.
**13** - Enables verbose, status, and debugger output.
For example: `loadstate \server\share\migration\mystore /v:5 /i:migdocs.xml /i:migapp.xml` |
+| `/progress:`[*Path*]*FileName* | Creates the optional progress log. You cannot store any of the log files in *StorePath*. *Path* can be either a relative or full path. If you do not specify the *Path* variable, then *FileName* will be created in the current directory.
For example: `loadstate /i:migapp.xml /i:migdocs.xml \server\share\migration\mystore /progress:prog.log /l:loadlog.log` |
+| `/c` | When this option is specified, the **LoadState** command will continue to run, even if non-fatal errors occur. Any files or settings that cause an error are logged in the progress log. For example, if there is a large file that will not fit on the computer, the **LoadState** command will log an error and continue with the migration. Without the **/c** option, the **LoadState** command will exit on the first error. You can use the new <**ErrorControl**> section in the Config.xml file to specify which file or registry read/write errors can be safely ignored and which might cause the migration to fail. This enables the **/c** command-line option to safely skip all input/output (I/O) errors in your environment. In addition, the **/genconfig** option now generates a sample <**ErrorControl**> section that is enabled by specifying error messages and desired behaviors in the Config.xml file. |
+| `/r:`*``* | **(Retry)**
Specifies the number of times to retry when an error occurs while migrating the user state from a server. The default is three times. This option is useful in environments where network connectivity is not reliable.
While restoring the user state, the **/r** option will not recover data that is lost due to a network-hardware failure, such as a faulty or disconnected network cable, or when a virtual private network (VPN) connection fails. The retry option is intended for large, busy networks where connectivity is satisfactory, but communication latency is a problem. |
+| `/w:`*``* | **(Wait)**
Specifies the time to wait, in seconds, before retrying a network file operation. The default is 1 second. |
+| `/?` or `/help` | Displays Help on the command line. |
## User Options
-
By default, all users are migrated. The only way to specify which users to include and exclude is by using the following options. You cannot exclude users in the migration .xml files or by using the Config.xml file. For more information, see [Identify Users](usmt-identify-users.md).
-
-
-
-
-
-
-
-
Command-Line Option
-
Description
-
-
-
-
-
/all
-
Migrates all of the users on the computer.
-
USMT migrates all user accounts on the computer, unless you specifically exclude an account with the /ue or /uel options. For this reason, you do not need to specify this option on the command line. However, if you choose to use the /all option, you cannot also use the /ui, /ue or /uel options.
-
-
-
/ui:DomainName<em>UserName
-
or
-
/ui:"DomainName<em>User Name"
-
or
-
/ui:ComputerName<em>LocalUserName
-
(User include)
-
Migrates the specified user. By default, all users are included in the migration. Therefore, this option is helpful only when used with the /ue option. You can specify multiple /ui options, but you cannot use the /ui option with the /all option. DomainName and UserName can contain the asterisk () wildcard character. When you specify a user name that contains spaces, you will need to surround it with quotations marks.
-
For example:
-
-
To include only User2 from the Corporate domain, type:
-
/ue:* /ui:corporate\user2
-
-
-Note
If a user is specified for inclusion with the /ui option, and also is specified to be excluded with either the /ue or /uel options, the user will be included in the migration.
-
-
-
-
-
For more examples, see the descriptions of the /uel, /ue, and /ui options in this table.
-
-
-
/uel:<NumberOfDays>
-
or
-
/uel:<YYYY/MM/DD>
-
or
-
/uel:0
-
(User exclude based on last logon)
-
Migrates only the users that logged onto the source computer within the specified time period, based on the Last Modified date of the Ntuser.dat file on the source computer. The /uel option acts as an include rule. For example, the /uel:30 option migrates users who logged on, or whose user account was modified, within the last 30 days from the date when the ScanState command is run. You can specify a number of days or you can specify a date. You cannot use this option with the /all option. USMT retrieves the last logon information from the local computer, so the computer does not need to be connected to the network when you run this option. In addition, if a domain user has logged onto another computer, that logon instance is not considered by USMT.
-
-Note
The /uel option is not valid in offline migrations.
-
-
-
-
-
Examples:
-
-
/uel:0 migrates accounts that were logged on to the source computer when the ScanState command was run.
-
/uel:90 migrates users who have logged on, or whose accounts have been otherwise modified, within the last 90 days.
-
/uel:1 migrates users whose accounts have been modified within the last 24 hours.
-
/uel:2002/1/15 migrates users who have logged on or whose accounts have been modified since January 15, 2002.
Excludes the specified users from the migration. You can specify multiple /ue options but you cannot use the /ue option with the /all option. DomainName and UserName can contain the asterisk () wildcard character. When you specify a user name that contains spaces, you will need to surround it with quotation marks.
For more examples, see the descriptions of the /uel, /ue, and /ui options in this table.
-
-
-
/md:OldDomain:NewDomain
-
or
-
/md:LocalComputerName:NewDomain
-
(move domain)
-
Specifies a new domain for the user. Use this option to change the domain for users on a computer or to migrate a local user to a domain account. OldDomain may contain the asterisk () wildcard character.
-
You can specify this option more than once. You may want to specify multiple /md options if you are consolidating users across multiple domains to a single domain. For example, you could specify the following to consolidate the users from the Corporate and FarNorth domains into the Fabrikam domain: /md:corporate:fabrikam and /md:farnorth:fabrikam.
-
If there are conflicts between two /md commands, the first rule that you specify is applied. For example, if you specify the /md:corporate:fabrikam and /md:corporate:farnorth commands, then Corporate users would be mapped to the Fabrikam domain.
-
-Note
If you specify an OldDomain that did not exist on the source computer, the LoadState command will appear to complete successfully, without an error or warning. However, in this case, users will not be moved to NewDomain but will remain in their original domain. For example, if you misspell "contoso" and you specify "/md:contso:fabrikam", the users will remain in contoso on the destination computer.
Specifies a new user name for the specified user. If the store contains more than one user, you can specify multiple /mu options. You cannot use wildcard characters with this option.
Specifies that if a user account is a local (non-domain) account, and it does not exist on the destination computer, USMT will create the account on the destination computer but it will be disabled. To enable the account, you must also use the /lae option.
-
If the /lac option is not specified, any local user accounts that do not already exist on the destination computer will not be migrated.
-
Password is the password for the newly created account. An empty password is used by default.
-
-Caution
Use the Password variable with caution because it is provided in plain text and can be obtained by anyone with access to the computer that is running the LoadState command.
-
Also, if the computer has multiple users, all migrated users will have the same password.
-
+| Command-Line Option | Description |
+|--- |--- |
+| `/all` | Migrates all of the users on the computer.
USMT migrates all user accounts on the computer, unless you specifically exclude an account with the **/ue** or **/uel** options. For this reason, you do not need to specify this option on the command line. However, if you choose to use the **/all** option, you cannot also use the **/ui**, **/ue** or **/uel** options. |
+| `/ui:`*DomainName UserName* or `/ui:`*"DomainName User Name"* or `/ui:`*ComputerName LocalUserName* | **(User include)**
Migrates the specified user. By default, all users are included in the migration. Therefore, this option is helpful only when used with the **/ue** option. You can specify multiple **/ui** options, but you cannot use the **/ui** option with the **/all** option. *DomainName* and *UserName* can contain the asterisk () wildcard character. When you specify a user name that contains spaces, you will need to surround it with quotations marks. For example:
To include only User2 from the Corporate domain, type: `/ue:* /ui:corporate\user2`
**Note** If a user is specified for inclusion with the **/ui** option, and also is specified to be excluded with either the **/ue** or **/uel** options, the user will be included in the migration.
For more examples, see the descriptions of the **/uel**, **/ue**, and **/ui** options in this table. |
+| `/uel:`*``* or `/uel:`*``* or `/uel:0` | **(User exclude based on last logon)**
Migrates only the users that logged onto the source computer within the specified time period, based on the **Last Modified** date of the Ntuser.dat file on the source computer. The **/uel** option acts as an include rule. For example, the **/uel:30** option migrates users who logged on, or whose user account was modified, within the last 30 days from the date when the ScanState command is run. You can specify a number of days or you can specify a date. You cannot use this option with the **/all** option. USMT retrieves the last logon information from the local computer, so the computer does not need to be connected to the network when you run this option. In addition, if a domain user has logged onto another computer, that logon instance is not considered by USMT.
**Note** The **/uel** option is not valid in offline migrations.
Examples:
`/uel:0` migrates accounts that were logged on to the source computer when the **ScanState** command was run.
`/uel:90` migrates users who have logged on, or whose accounts have been otherwise modified, within the last 90 days.
`/uel:1` migrates users whose accounts have been modified within the last 24 hours.
`/uel:2002/1/15` migrates users who have logged on or whose accounts have been modified since January 15, 2002.
For example: `loadstate /i:migapp.xml /i:migdocs.xml \server\share\migration\mystore /uel:0` |
+| `/ue`:*DomainName UserName* or `/ue`*"DomainName User Name"* or `/ue`:*ComputerName LocalUserName* | **(User exclude)**
Excludes the specified users from the migration. You can specify multiple **/ue** options but you cannot use the **/ue** option with the **/all** option. *DomainName* and *UserName* can contain the asterisk () wildcard character. When you specify a user name that contains spaces, you will need to surround it with quotation marks.
For example: `loadstate /i:migapp.xml /i:migdocs.xml \server\share\migration\mystore /ue:contoso\user1` For more examples, see the descriptions of the **/uel**, **/ue**, and **/ui** options in this table. |
+| `/md:`*OldDomain*:*NewDomain* or `/md:`*LocalComputerName:NewDomain* | **(move domain)** Specifies a new domain for the user. Use this option to change the domain for users on a computer or to migrate a local user to a domain account. *OldDomain* may contain the asterisk () wildcard character.
You can specify this option more than once. You may want to specify multiple **/md** options if you are consolidating users across multiple domains to a single domain. For example, you could specify the following to consolidate the users from the Corporate and FarNorth domains into the Fabrikam domain: `/md:corporate:fabrikam` and `/md:farnorth:fabrikam`.
If there are conflicts between two **/md** commands, the first rule that you specify is applied. For example, if you specify the `/md:corporate:fabrikam` and `/md:corporate:farnorth` commands, then Corporate users would be mapped to the Fabrikam domain.
**Note** If you specify an *OldDomain* that did not exist on the source computer, the **LoadState** command will appear to complete successfully, without an error or warning. However, in this case, users will not be moved to *NewDomain* but will remain in their original domain. For example, if you misspell "contoso" and you specify "/md:contso:fabrikam", the users will remain in contoso on the destination computer.
For example: `loadstate /i:migapp.xml /i:migdocs.xml \server\share\migration\mystore` ` /progress:prog.log /l:load.log /md:contoso:fabrikam` |
+| `/mu:`*OldDomain OldUserName*:[*NewDomain*]*NewUserName* or `/mu:`*OldLocalUserName*:*NewDomain NewUserName* | Specifies a new user name for the specified user. If the store contains more than one user, you can specify multiple **/mu** options. You cannot use wildcard characters with this option.
Specifies that if a user account is a local (non-domain) account, and it does not exist on the destination computer, USMT will create the account on the destination computer but it will be disabled. To enable the account, you must also use the **/lae** option.
If the **/lac** option is not specified, any local user accounts that do not already exist on the destination computer will not be migrated.
*Password* is the password for the newly created account. An empty password is used by default.
**Caution** Use the *Password* variable with caution because it is provided in plain text and can be obtained by anyone with access to the computer that is running the **LoadState** command. Also, if the computer has multiple users, all migrated users will have the same password.
For example: `loadstate /i:migapp.xml /i:migdocs.xml \server\share\migration\mystore` For instructions, see [Migrate User Accounts](usmt-migrate-user-accounts.md). |
+| `/lae` | **(local account enable)**
Enables the account that was created with the **/lac** option. You must specify the **/lac** option with this option.
For example: `loadstate /i:migapp.xml /i:migdocs.xml \server\share\migration\mystore` `/progress:prog.log /l:load.log /lac:password /lae`
For instructions, see [Migrate User Accounts](usmt-migrate-user-accounts.md). |
### Examples for the /ui and /ue options
The following examples apply to both the **/ui** and **/ue** options. You can replace the **/ue** option with the **/ui** option to include, rather than exclude, the specified users.
-
-
-
-
-
-
-
-
Behavior
-
Command
-
-
-
-
-
Exclude the user named User One in the Corporate domain.
-
/ue:"corporate\user one"
-
-
-
Exclude the user named User1 in the Corporate domain.
-
/ue:corporate\user1
-
-
-
Exclude the local user named User1.
-
/ue:%computername%\user1
-
-
-
Exclude all domain users.
-
/ue:Domain
-
-
-
Exclude all local users.
-
/ue:%computername%
-
-
-
Exclude users in all domains named User1, User2, and so on.
-
/ue:\user
-
-
-
-
-
+| Behavior | Command |
+|--- |--- |
+| Exclude the user named User One in the Corporate domain. | `/ue:"corporate\user one"` |
+| Exclude the user named User1 in the Corporate domain. | `/ue:corporate\user1` |
+| Exclude the local user named User1. | `/ue:%computername%\user1` |
+| Exclude all domain users. | `/ue:Domain` |
+| Exclude all local users. | `/ue:%computername%` |
+| Exclude users in all domains named User1, User2, and so on. | `/ue:\user` |
### Using the Options Together
@@ -464,247 +120,46 @@ You can use the **/uel**, **/ue** and **/ui** options together to migrate only t
**The /uel option takes precedence over the /ue option.** If a user has logged on within the specified time period set by the **/uel** option, that user's profile will be migrated even if they are excluded by using the **/ue** option. For example, if you specify `/ue:contoso\user1 /uel:14`, the User1 will be migrated if they have logged on to the computer within the last 14 days.
-
-
-
-
-
-
-
-
Behavior
-
Command
-
-
-
-
-
Include only User2 from the Fabrikam domain and exclude all other users.
-
/ue:* /ui:fabrikam\user2
-
-
-
Include only the local user named User1 and exclude all other users.
-
/ue:* /ui:user1
-
-
-
Include only the domain users from Contoso, except Contoso\User1.
-
This behavior cannot be completed using a single command. Instead, to migrate this set of users, you will need to specify the following:
-
-
Using the ScanState command-line tool, type: /ue:* /ui:contoso
-
Using the LoadState command-line tool, type: /ue:contoso\user1
-
-
-
-
Include only local (non-domain) users.
-
/ue: /ui:%computername%*
-
-
-
-
-
+| Behavior | Command |
+|--- |--- |
+| Include only User2 from the Fabrikam domain and exclude all other users. | `/ue:* /ui:fabrikam\user2` |
+| Include only the local user named User1 and exclude all other users. | `/ue:* /ui:user1` |
+| Include only the domain users from Contoso, except Contoso\User1. | This behavior cannot be completed using a single command. Instead, to migrate this set of users, you will need to specify the following:
Using the **ScanState** command-line tool, type: `/ue:* /ui:contoso`
Using the **LoadState** command-line tool, type: `/ue:contoso\user1`
|
+| Include only local (non-domain) users. | `/ue: /ui:%computername%*` |
## Incompatible Command-Line Options
-
The following table indicates which command-line options are not compatible with the **LoadState** command. If the table entry for a particular combination is blank, the options are compatible and you can use them together. The X symbol means that the options are not compatible. For example, you cannot use the **/nocompress** option with the **/encrypt** option.
-
-
-
-
-
-
-
-
-
-
-
Command-Line Option
-
/keyfile
-
/nocompress
-
/genconfig
-
/all
-
-
-
-
-
/i
-
-
-
-
-
-
-
/v
-
-
-
-
-
-
-
/nocompress
-
-
N/A
-
X
-
-
-
-
/key
-
X
-
-
X
-
-
-
-
/decrypt
-
Required*
-
X
-
X
-
-
-
-
/keyfile
-
N/A
-
-
X
-
-
-
-
/l
-
-
-
-
-
-
-
/progress
-
-
-
X
-
-
-
-
/r
-
-
-
X
-
-
-
-
/w
-
-
-
X
-
-
-
-
/c
-
-
-
X
-
-
-
-
/p
-
-
-
X
-
N/A
-
-
-
/all
-
-
-
X
-
-
-
-
/ui
-
-
-
X
-
X
-
-
-
/ue
-
-
-
X
-
X
-
-
-
/uel
-
-
-
X
-
X
-
-
-
/genconfig
-
-
-
N/A
-
-
-
-
/config
-
-
-
X
-
-
-
-
StorePath
-
-
-
-
-
-
-
/md
-
-
-
-
-
-
-
/mu
-
-
-
-
-
-
-
/lae
-
-
-
-
-
-
-
/lac
-
-
-
-
-
-
-
-
-
-
-**Note**
-You must specify either the **/key** or **/keyfile** option with the **/encrypt** option.
-
+| Command-Line Option | /keyfile | /nocompress | /genconfig | /all |
+|--- |--- |--- |--- |--- |
+| **/i** | | | | |
+| **/v** | | | | |
+| **/nocompress** | | N/A | X | |
+| **/key** | X | | X | |
+| **/decrypt** | Required* | X | X | |
+| **/keyfile** | N/A | | X | |
+| **/l** | | | | |
+| **/progress** | | | X | |
+| **/r** | | | X | |
+| **/w** | | | X | |
+| **/c** | | | X | |
+| **/p** | | | X | N/A |
+| **/all** | | | X | |
+| **/ui** | | | X | X |
+| **/ue** | | | X | X |
+| **/uel** | | | X | X |
+| **/genconfig** | | | N/A | |
+| **/config** | | | X | |
+| *StorePath* | | | | |
+| **/md** | | | | |
+| **/mu** | | | | |
+| **/lae** | | | | |
+| **/lac** | | | | |
+> [!NOTE]
+> You must specify either the **/key** or **/keyfile** option with the **/encrypt** option.
## Related topics
-
[XML Elements Library](usmt-xml-elements-library.md)
-
-
-
-
-
-
-
-
-
diff --git a/windows/deployment/usmt/usmt-log-files.md b/windows/deployment/usmt/usmt-log-files.md
index 63fcf4af6f..3d42379783 100644
--- a/windows/deployment/usmt/usmt-log-files.md
+++ b/windows/deployment/usmt/usmt-log-files.md
@@ -16,7 +16,6 @@ ms.topic: article
# Log Files
-
You can use User State Migration Tool (USMT) 10.0 logs to monitor your migration and to troubleshoot errors and failed migrations. This topic describes the available command-line options to enable USMT logs, and new XML elements that configure which types of errors are fatal and should halt the migration, which types are non-fatal and should be skipped so that the migration can continue.
[Log Command-Line Options](#bkmk-commandlineoptions)
@@ -31,66 +30,25 @@ You can use User State Migration Tool (USMT) 10.0 logs to monitor your migratio
## Log Command-Line Options
-
The following table describes each command-line option related to logs, and it provides the log name and a description of what type of information each log contains.
-
-
-
-
-
-
-
-
-
Command line Option
-
File Name
-
Description
-
-
-
-
-
/l[Path]FileName
-
Scanstate.log or LoadState.log
-
Specifies the path and file name of the ScanState.log or LoadState log.
-
-
-
/progress[Path]FileName
-
Specifies the path and file name of the Progress log.
-
Provides information about the status of the migration, by percentage complete.
Specifies the path and file name of the Listfiles log.
-
Provides a list of the files that were migrated.
-
-
-
Set the environment variable MIG_ENABLE_DIAG to a path to an XML file.
-
USMTDiag.xml
-
The diagnostic log contains detailed system environment information, user environment information, and information about the migration units (migunits) being gathered and their contents.
-
-
-
+|Command line Option|File Name|Description|
+|--- |--- |--- |
+|**/l** *[Path]FileName*|Scanstate.log or LoadState.log|Specifies the path and file name of the ScanState.log or LoadState log.|
+|**/progress** *[Path]FileName*|Specifies the path and file name of the Progress log.|Provides information about the status of the migration, by percentage complete.|
+|**/v** *[VerbosityLevel]*|Not applicable|See the "Monitoring Options" section in [ScanState Syntax](usmt-scanstate-syntax.md).|
+|**/listfiles** *[Path]FileName*|Specifies the path and file name of the Listfiles log.|Provides a list of the files that were migrated.|
+|Set the environment variable MIG_ENABLE_DIAG to a path to an XML file.|USMTDiag.xml|The diagnostic log contains detailed system environment information, user environment information, and information about the migration units (migunits) being gathered and their contents.|
-
-
-**Note**
-You cannot store any of the log files in *StorePath*. If you do, the log will be overwritten when USMT is run.
-
-
+> [!NOTE]
+> You cannot store any of the log files in *StorePath*. If you do, the log will be overwritten when USMT is run.
## ScanState and LoadState Logs
-
ScanState and LoadState logs are text files that are create when you run the ScanState and LoadState tools. You can use these logs to help monitor your migration. The content of the log depends on the command-line options that you use and the verbosity level that you specify. For more information about verbosity levels, see Monitoring Options in [ScanState Syntax](usmt-scanstate-syntax.md).
## Progress Log
-
You can create a progress log using the **/progress** option. External tools, such as Microsoft System Center Operations Manager 2007, can parse the progress log to update your monitoring systems. The first three fields in each line are fixed as follows:
- **Date:** Date, in the format of *day* *shortNameOfTheMonth* *year*. For example: 08 Jun 2006.
@@ -101,137 +59,34 @@ You can create a progress log using the **/progress** option. External tools, su
The remaining fields are key/value pairs as indicated in the following table.
-
-
-
-
-
-
-
-
Key
-
Value
-
-
-
-
-
program
-
ScanState.exe or LoadState.exe.
-
-
-
productVersion
-
The full product version number of USMT.
-
-
-
computerName
-
The name of the source or destination computer on which USMT was run.
-
-
-
commandLine
-
The full command used to run USMT.
-
-
-
PHASE
-
Reports that a new phase in the migration is starting. This can be one of the following:
-
-
Initializing
-
Scanning
-
Collecting
-
Saving
-
Estimating
-
Applying
-
-
-
-
detectedUser
-
-
For the ScanState tool, these are the users USMT detected on the source computer that can be migrated.
-
For the LoadState tool, these are the users USMT detected in the store that can be migrated.
-
-
-
-
includedInMigration
-
Defines whether the user profile/component is included for migration. Valid values are Yes or No.
-
-
-
forUser
-
Specifies either of the following:
-
-
The user state being migrated.
-
This Computer, meaning files and settings that are not associated with a user.
-
-
-
-
detectedComponent
-
Specifies a component detected by USMT.
-
-
For ScanState, this is a component or application that is installed on the source computer.
-
For LoadState, this is a component or application that was detected in the store.
-
-
-
-
totalSizeInMBToTransfer
-
Total size of the files and settings to migrate in megabytes (MB).
-
-
-
totalPercentageCompleted
-
Total percentage of the migration that has been completed by either ScanState or LoadState.
-
-
-
collectingUser
-
Specifies which user ScanState is collecting files and settings for.
-
-
-
totalMinutesRemaining
-
Time estimate, in minutes, for the migration to complete.
-
-
-
error
-
Type of non-fatal error that occurred. This can be one of the following:
-
-
UnableToCopy: Unable to copy to store because the disk on which the store is located is full.
-
UnableToOpen: Unable to open the file for migration because the file is opened in non-shared mode by another application or service.
-
UnableToCopyCatalog: Unable to copy because the store is corrupted.
-
UnableToAccessDevice: Unable to access the device.
-
UnableToApply: Unable to apply the setting to the destination computer.
-
-
-
-
objectName
-
The name of the file or setting that caused the non-fatal error.
-
-
-
action
-
Action taken by USMT for the non-fatal error. The values are:
-
-
Ignore: Non-fatal error ignored and the migration continued because the /c option was specified on the command line.
-
Abort: Stopped the migration because the /c option was not specified.
-
-
-
-
errorCode
-
The errorCode or return value.
-
-
-
numberOfIgnoredErrors
-
The total number of non-fatal errors that USMT ignored.
-
-
-
message
-
The message corresponding to the errorCode.
-
-
-
-
-
+| Key | Value |
+|-----|-------|
+| program | ScanState.exe or LoadState.exe. |
+| productVersion | The full product version number of USMT. |
+| computerName | The name of the source or destination computer on which USMT was run. |
+| commandLine | The full command used to run USMT. |
+| PHASE | Reports that a new phase in the migration is starting. This can be one of the following:
Initializing
Scanning
Collecting
Saving
Estimating
Applying
|
+| detectedUser |
For the ScanState tool, these are the users USMT detected on the source computer that can be migrated.
For the LoadState tool, these are the users USMT detected in the store that can be migrated.
|
+| includedInMigration | Defines whether the user profile/component is included for migration. Valid values are Yes or No. |
+| forUser | Specifies either of the following:
The user state being migrated.
*This Computer*, meaning files and settings that are not associated with a user.
|
+| detectedComponent | Specifies a component detected by USMT.
For ScanState, this is a component or application that is installed on the source computer.
For LoadState, this is a component or application that was detected in the store.
|
+| totalSizeInMBToTransfer | Total size of the files and settings to migrate in megabytes (MB). |
+| totalPercentageCompleted | Total percentage of the migration that has been completed by either ScanState or LoadState. |
+| collectingUser | Specifies which user ScanState is collecting files and settings for. |
+| totalMinutesRemaining | Time estimate, in minutes, for the migration to complete. |
+| error | Type of non-fatal error that occurred. This can be one of the following:
**UnableToCopy**: Unable to copy to store because the disk on which the store is located is full.
**UnableToOpen**: Unable to open the file for migration because the file is opened in non-shared mode by another application or service.
**UnableToCopyCatalog**: Unable to copy because the store is corrupted.
**UnableToAccessDevice**: Unable to access the device.
**UnableToApply**: Unable to apply the setting to the destination computer.
|
+| objectName | The name of the file or setting that caused the non-fatal error. |
+| action | Action taken by USMT for the non-fatal error. The values are:
**Ignore**: Non-fatal error ignored and the migration continued because the **/c** option was specified on the command line.
**Abort**: Stopped the migration because the **/c** option was not specified.
|
+| errorCode | The errorCode or return value. |
+| numberOfIgnoredErrors | The total number of non-fatal errors that USMT ignored. |
+| message | The message corresponding to the errorCode. |
## List Files Log
-
The List files log (Listfiles.txt) provides a list of the files that were migrated. This list can be used to troubleshoot XML issues or can be retained as a record of the files that were gathered into the migration store. The List Files log is only available for ScanState.exe.
## Diagnostic Log
-
You can obtain the diagnostic log by setting the environment variable MIG\_ENABLE\_DIAG to a path to an XML file.
The diagnostic log contains:
@@ -244,7 +99,6 @@ The diagnostic log contains:
## Using the Diagnostic Log
-
The diagnostic log is essentially a report of all the migration units (migunits) included in the migration. A migunit is a collection of data that is identified by the component it is associated with in the XML files. The migration store is made up of all the migunits in the migration. The diagnostic log can be used to verify which migunits were included in the migration and can be used for troubleshooting while authoring migration XML files.
The following examples describe common scenarios in which you can use the diagnostic log.
@@ -253,7 +107,7 @@ The following examples describe common scenarios in which you can use the diagno
Let's imagine that we have the following directory structure and that we want the "data" directory to be included in the migration along with the "New Text Document.txt" file in the "New Folder." The directory of **C:\\data** contains:
-```
+```console
01/21/2009 10:08 PM .
01/21/2009 10:08 PM ..
01/21/2009 10:08 PM New Folder
@@ -264,7 +118,7 @@ Let's imagine that we have the following directory structure and that we want th
The directory of **C:\\data\\New Folder** contains:
-```
+```console
01/21/2009 10:08 PM .
01/21/2009 10:08 PM ..
01/21/2009 10:08 PM 0 New Text Document.txt
@@ -295,7 +149,7 @@ To migrate these files you author the following migration XML:
However, upon testing the migration you notice that the "New Text Document.txt" file isn't included in the migration. To troubleshoot this failure, the migration can be repeated with the environment variable MIG\_ENABLE\_DIAG set such that the diagnostic log is generated. Upon searching the diagnostic log for the component "DATA1", the following XML section is discovered:
-``` xml
+```xml
@@ -316,13 +170,13 @@ Analysis of this XML section reveals the migunit that was created when the migra
An analysis of the XML elements reference topic reveals that the <pattern> tag needs to be modified as follows:
-``` xml
+```xml
c:\data\* [*]
```
When the migration is preformed again with the modified tag, the diagnostic log reveals the following:
-``` xml
+```xml
@@ -347,7 +201,7 @@ This diagnostic log confirms that the modified <pattern> value enables the
In this scenario, you have the following directory structure and you want all files in the "data" directory to migrate, except for text files. The **C:\\Data** folder contains:
-```
+```console
Directory of C:\Data
01/21/2009 10:08 PM .
@@ -360,7 +214,7 @@ Directory of C:\Data
The **C:\\Data\\New Folder\\** contains:
-```
+```console
01/21/2009 10:08 PM .
01/21/2009 10:08 PM ..
01/21/2009 10:08 PM 0 New Text Document.txt
@@ -397,7 +251,7 @@ You author the following migration XML:
However, upon testing the migration you notice that all the text files are still included in the migration. In order to troubleshoot this issue, the migration can be performed with the environment variable MIG\_ENABLE\_DIAG set so that the diagnostic log is generated. Upon searching the diagnostic log for the component "DATA1", the following XML section is discovered:
-``` xml
+```xml
@@ -454,7 +308,7 @@ Upon reviewing the diagnostic log, you confirm that the files are still migratin
Your revised migration XML script excludes the files from migrating, as confirmed in the diagnostic log:
-``` xml
+```xml
@@ -484,11 +338,3 @@ Your revised migration XML script excludes the files from migrating, as confirme
[LoadState Syntax](usmt-loadstate-syntax.md)
-
-
-
-
-
-
-
-
diff --git a/windows/deployment/usmt/usmt-migration-store-encryption.md b/windows/deployment/usmt/usmt-migration-store-encryption.md
index c10a7ba4f3..6ba4824bdc 100644
--- a/windows/deployment/usmt/usmt-migration-store-encryption.md
+++ b/windows/deployment/usmt/usmt-migration-store-encryption.md
@@ -16,62 +16,24 @@ ms.topic: article
# Migration Store Encryption
-
This topic discusses User State Migration Tool (USMT) 10.0 options for migration store encryption to protect the integrity of user data during a migration.
## USMT Encryption Options
-
USMT enables support for stronger encryption algorithms, called Advanced Encryption Standard (AES), in several bit-level options. AES is a National Institute of Standards and Technology (NIST) specification for the encryption of electronic data.
The encryption algorithm you choose must be specified for both the **ScanState** and the **LoadState** commands, so that these commands can create or read the store during encryption and decryption. The new encryption algorithms can be specified on the **ScanState** and the **LoadState** command lines by using the **/encrypt**:*"encryptionstrength"* and the **/decrypt**:*"encryptionstrength"* command-line options. All of the encryption application programming interfaces (APIs) used by USMT are available in Windows 7, Windows 8, and Windows 10 operating systems. However, export restrictions might limit the set of algorithms that are available to computers in certain locales. You can use the Usmtutils.exe file to determine which encryption algorithms are available to the computers' locales before you begin the migration.
The following table describes the command-line encryption options in USMT.
-
This option and argument specify that the migration store is encrypted and which algorithm to use. When the algorithm argument is not provided, the ScanState tool employs the 3DES algorithm.
This option and argument specify that the store must be decrypted and which algorithm to use. When the algorithm argument is not provided, the LoadState tool employs the 3DES algorithm.
-
-
-
-
-
+|Component|Option|Description|
+|--- |--- |--- |
+|**ScanState**|**/encrypt**<*AES, AES_128, AES_192, AES_256, 3DES, 3DES_112*>|This option and argument specify that the migration store is encrypted and which algorithm to use. When the algorithm argument is not provided, the **ScanState** tool employs the 3DES algorithm.|
+|**LoadState**|**/decrypt**<*AES, AES_128, AES_192, AES_256, 3DES, 3DES_112*>|This option and argument specify that the store must be decrypted and which algorithm to use. When the algorithm argument is not provided, the **LoadState** tool employs the 3DES algorithm.|
**Important**
Some encryption algorithms may not be available on your systems. You can verify which algorithms are available by running the UsmtUtils command with the **/ec** option. For more information see [UsmtUtils Syntax](usmt-utilities.md)
-
-
## Related topics
-
[Plan Your Migration](usmt-plan-your-migration.md)
-
-
-
-
-
-
-
-
-
diff --git a/windows/deployment/usmt/usmt-overview.md b/windows/deployment/usmt/usmt-overview.md
index 6e27022a54..d3c30b002d 100644
--- a/windows/deployment/usmt/usmt-overview.md
+++ b/windows/deployment/usmt/usmt-overview.md
@@ -1,9 +1,8 @@
---
title: User State Migration Tool (USMT) Overview (Windows 10)
-description: Learn about using User State Migration Tool (USMT) 10.0 to streamline and simplify user state migration during large deployments of Windows operating systems.
+description: Learn about using User State Migration Tool (USMT) 10.0 to streamline and simplify user state migration during large deployments of Windows operating systems.
ms.assetid: 3b649431-ad09-4b17-895a-3fec7ac0a81f
-ms.reviewer:
-manager: laurawi
+manager: dougeby
ms.author: greglin
ms.prod: w10
ms.mktglfcycl: deploy
@@ -12,6 +11,7 @@ audience: itpro
author: greg-lindsay
ms.date: 10/16/2017
ms.topic: article
+ms.collection: highpri
---
# User State Migration Tool (USMT) Overview
diff --git a/windows/deployment/usmt/usmt-plan-your-migration.md b/windows/deployment/usmt/usmt-plan-your-migration.md
index 7ea0c4d341..3090fc7efd 100644
--- a/windows/deployment/usmt/usmt-plan-your-migration.md
+++ b/windows/deployment/usmt/usmt-plan-your-migration.md
@@ -16,7 +16,6 @@ ms.topic: article
# Plan Your Migration
-
Before you use the User State Migration Tool (USMT) 10.0 to perform your migration, we recommend that you plan your migration carefully. Planning can help your migration proceed smoothly and can reduce the risk of migration failure.
In migration planning, both organizations and individuals must first identify what to migrate, including user settings, applications and application settings, and personal data files and folders. Identifying the applications to migrate is especially important so that you can avoid capturing data about applications that may be phased out.
@@ -25,48 +24,14 @@ One of the most important requirements for migrating settings and data is restor
## In This Section
-
-
Test your migration before you deploy Windows to all users.
-
-
-
-
-
+| Link | Description |
+|--- |--- |
+|[Common Migration Scenarios](usmt-common-migration-scenarios.md)|Determine whether you will perform a refresh migration or a replace migration.|
+|[What Does USMT Migrate?](usmt-what-does-usmt-migrate.md)|Learn which applications, user data, and operating system components USMT migrates.|
+|[Choose a Migration Store Type](usmt-choose-migration-store-type.md)|Choose an uncompressed, compressed, or hard-link migration store.|
+|[Determine What to Migrate](usmt-determine-what-to-migrate.md)|Identify user accounts, application settings, operating system settings, and files that you want to migrate inside your organization.|
+|[Test Your Migration](usmt-test-your-migration.md)|Test your migration before you deploy Windows to all users.|
## Related topics
-
[USMT XML Reference](usmt-xml-reference.md)
-
-
-
-
-
-
-
-
-
diff --git a/windows/deployment/usmt/usmt-recognized-environment-variables.md b/windows/deployment/usmt/usmt-recognized-environment-variables.md
index dfb923bbd4..6e522e003e 100644
--- a/windows/deployment/usmt/usmt-recognized-environment-variables.md
+++ b/windows/deployment/usmt/usmt-recognized-environment-variables.md
@@ -2,8 +2,7 @@
title: Recognized Environment Variables (Windows 10)
description: Learn how to use environment variables to identify folders that may be different on different computers.
ms.assetid: 2b0ac412-e131-456e-8f0c-c26249b5f3df
-ms.reviewer:
-manager: laurawi
+manager: dougeby
ms.author: greglin
ms.prod: w10
ms.mktglfcycl: deploy
@@ -12,6 +11,7 @@ audience: itpro
author: greg-lindsay
ms.date: 04/19/2017
ms.topic: article
+ms.collection: highpri
---
# Recognized Environment Variables
@@ -31,441 +31,112 @@ When using the XML files MigDocs.xml, MigApp.xml, and MigUser.xml, you can use e
You can use these variables within sections in the .xml files with `context=UserAndSystem`, `context=User`, and `context=System`.
-
-
-
-
-
-
-
-
Variable
-
Explanation
-
-
-
-
-
ALLUSERSAPPDATA
-
Same as CSIDL_COMMON_APPDATA.
-
-
-
ALLUSERSPROFILE
-
Refers to %PROFILESFOLDER%\Public or %PROFILESFOLDER%\all users.
-
-
-
COMMONPROGRAMFILES
-
Same as CSIDL_PROGRAM_FILES_COMMON.
-
-
-
COMMONPROGRAMFILES(X86)
-
Refers to the C:\Program Files (x86)\Common Files folder on 64-bit systems.
-
-
-
CSIDL_COMMON_ADMINTOOLS
-
Version 10.0. The file-system directory that contains administrative tools for all users of the computer.
-
-
-
CSIDL_COMMON_ALTSTARTUP
-
The file-system directory that corresponds to the non-localized Startup program group for all users.
-
-
-
CSIDL_COMMON_APPDATA
-
The file-system directory that contains application data for all users. A typical path Windows is C:\ProgramData.
-
-
-
CSIDL_COMMON_DESKTOPDIRECTORY
-
The file-system directory that contains files and folders that appear on the desktop for all users. A typical Windows® XP path is C:\Documents and Settings\All Users\Desktop. A typical path is C:\Users\Public\Desktop.
-
-
-
CSIDL_COMMON_DOCUMENTS
-
The file-system directory that contains documents that are common to all users. A typical path in Windows XP is C:\Documents and Settings\All Users\Documents. A typical path is C:\Users\Public\Documents.
-
-
-
CSIDL_COMMON_FAVORITES
-
The file-system directory that serves as a common repository for favorites common to all users. A typical path is C:\Users\Public\Favorites.
-
-
-
CSIDL_COMMON_MUSIC
-
The file-system directory that serves as a repository for music files common to all users. A typical path is C:\Users\Public\Music.
-
-
-
CSIDL_COMMON_PICTURES
-
The file-system directory that serves as a repository for image files common to all users. A typical path is C:\Users\Public\Pictures.
-
-
-
CSIDL_COMMON_PROGRAMS
-
The file-system directory that contains the directories for the common program groups that appear on the Start menu for all users. A typical path is C:\ProgramData\Microsoft\Windows\Start Menu\Programs.
-
-
-
CSIDL_COMMON_STARTMENU
-
The file-system directory that contains the programs and folders which appear on the Start menu for all users. A typical path in Windows is C:\ProgramData\Microsoft\Windows\Start Menu.
-
-
-
CSIDL_COMMON_STARTUP
-
The file-system directory that contains the programs that appear in the Startup folder for all users. A typical path in Windows XP is C:\Documents and Settings\All Users\Start Menu\Programs\Startup. A typical path is C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup.
-
-
-
CSIDL_COMMON_TEMPLATES
-
The file-system directory that contains the templates that are available to all users. A typical path is C:\ProgramData\Microsoft\Windows\Templates.
-
-
-
CSIDL_COMMON_VIDEO
-
The file-system directory that serves as a repository for video files common to all users. A typical path is C:\Users\Public\Videos.
-
-
-
CSIDL_DEFAULT_APPDATA
-
Refers to the Appdata folder inside %DEFAULTUSERPROFILE%.
-
-
-
CSIDL_DEFAULT_LOCAL_APPDATA
-
Refers to the local Appdata folder inside %DEFAULTUSERPROFILE%.
-
-
-
CSIDL_DEFAULT_COOKIES
-
Refers to the Cookies folder inside %DEFAULTUSERPROFILE%.
-
-
-
CSIDL_DEFAULT_CONTACTS
-
Refers to the Contacts folder inside %DEFAULTUSERPROFILE%.
-
-
-
CSIDL_DEFAULT_DESKTOP
-
Refers to the Desktop folder inside %DEFAULTUSERPROFILE%.
-
-
-
CSIDL_DEFAULT_DOWNLOADS
-
Refers to the Downloads folder inside %DEFAULTUSERPROFILE%.
-
-
-
CSIDL_DEFAULT_FAVORITES
-
Refers to the Favorites folder inside %DEFAULTUSERPROFILE%.
-
-
-
CSIDL_DEFAULT_HISTORY
-
Refers to the History folder inside %DEFAULTUSERPROFILE%.
-
-
-
CSIDL_DEFAULT_INTERNET_CACHE
-
Refers to the Internet Cache folder inside %DEFAULTUSERPROFILE%.
-
-
-
CSIDL_DEFAULT_PERSONAL
-
Refers to the Personal folder inside %DEFAULTUSERPROFILE%.
-
-
-
CSIDL_DEFAULT_MYDOCUMENTS
-
Refers to the My Documents folder inside %DEFAULTUSERPROFILE%.
-
-
-
CSIDL_DEFAULT_MYPICTURES
-
Refers to the My Pictures folder inside %DEFAULTUSERPROFILE%.
-
-
-
CSIDL_DEFAULT_MYMUSIC
-
Refers to the My Music folder inside %DEFAULTUSERPROFILE%.
-
-
-
CSIDL_DEFAULT_MYVIDEO
-
Refers to the My Videos folder inside %DEFAULTUSERPROFILE%.
-
-
-
CSIDL_DEFAULT_RECENT
-
Refers to the Recent folder inside %DEFAULTUSERPROFILE%.
-
-
-
CSIDL_DEFAULT_SENDTO
-
Refers to the Send To folder inside %DEFAULTUSERPROFILE%.
-
-
-
CSIDL_DEFAULT_STARTMENU
-
Refers to the Start Menu folder inside %DEFAULTUSERPROFILE%.
-
-
-
CSIDL_DEFAULT_PROGRAMS
-
Refers to the Programs folder inside %DEFAULTUSERPROFILE%.
-
-
-
CSIDL_DEFAULT_STARTUP
-
Refers to the Startup folder inside %DEFAULTUSERPROFILE%.
-
-
-
CSIDL_DEFAULT_TEMPLATES
-
Refers to the Templates folder inside %DEFAULTUSERPROFILE%.
-
-
-
CSIDL_DEFAULT_QUICKLAUNCH
-
Refers to the Quick Launch folder inside %DEFAULTUSERPROFILE%.
-
-
-
CSIDL_FONTS
-
A virtual folder containing fonts. A typical path is C:\Windows\Fonts.
-
-
-
CSIDL_PROGRAM_FILESX86
-
The Program Files folder on 64-bit systems. A typical path is C:\Program Files(86).
-
-
-
CSIDL_PROGRAM_FILES_COMMONX86
-
A folder for components that are shared across applications on 64-bit systems. A typical path is C:\Program Files(86)\Common.
-
-
-
CSIDL_PROGRAM_FILES
-
The Program Files folder. A typical path is C:\Program Files.
-
-
-
CSIDL_PROGRAM_FILES_COMMON
-
A folder for components that are shared across applications. A typical path is C:\Program Files\Common.
-
-
-
CSIDL_RESOURCES
-
The file-system directory that contains resource data. A typical path is C:\Windows\Resources.
-
-
-
CSIDL_SYSTEM
-
The Windows System folder. A typical path is C:\Windows\System32.
-
-
-
CSIDL_WINDOWS
-
The Windows directory or system root. This corresponds to the %WINDIR% or %SYSTEMROOT% environment variables. A typical path is C:\Windows.
-
-
-
DEFAULTUSERPROFILE
-
Refers to the value in HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList [DefaultUserProfile].
-
-
-
PROFILESFOLDER
-
Refers to the value in HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList [ProfilesDirectory].
-
-
-
PROGRAMFILES
-
Same as CSIDL_PROGRAM_FILES.
-
-
-
PROGRAMFILES(X86)
-
Refers to the C:\Program Files (x86) folder on 64-bit systems.
-
-
-
SYSTEM
-
Refers to %WINDIR%\system32.
-
-
-
SYSTEM16
-
Refers to %WINDIR%\system.
-
-
-
SYSTEM32
-
Refers to %WINDIR%\system32.
-
-
-
SYSTEMPROFILE
-
Refers to the value in HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-18 [ProfileImagePath].
-
-
-
SYSTEMROOT
-
Refers to the root of the system drive.
-
-
-
WINDIR
-
Refers to the Windows folder located on the system drive.
-
-
-
-
-
+|Variable|Explanation|
+|--- |--- |
+|**ALLUSERSAPPDATA**|Same as **CSIDL_COMMON_APPDATA**.|
+|**ALLUSERSPROFILE**|Refers to %**PROFILESFOLDER**%\Public or %**PROFILESFOLDER**%\all users.|
+|**COMMONPROGRAMFILES**|Same as **CSIDL_PROGRAM_FILES_COMMON**.|
+|**COMMONPROGRAMFILES**(X86)|Refers to the C:\Program Files (x86)\Common Files folder on 64-bit systems.|
+|**CSIDL_COMMON_ADMINTOOLS**|Version 10.0. The file-system directory that contains administrative tools for all users of the computer.|
+|**CSIDL_COMMON_ALTSTARTUP**|The file-system directory that corresponds to the non-localized Startup program group for all users.|
+|**CSIDL_COMMON_APPDATA**|The file-system directory that contains application data for all users. A typical path Windows is C:\ProgramData.|
+|**CSIDL_COMMON_DESKTOPDIRECTORY**|The file-system directory that contains files and folders that appear on the desktop for all users. A typical Windows® XP path is C:\Documents and Settings\All Users\Desktop. A typical path is C:\Users\Public\Desktop.|
+|**CSIDL_COMMON_DOCUMENTS**|The file-system directory that contains documents that are common to all users. A typical path in Windows XP is C:\Documents and Settings\All Users\Documents. A typical path is C:\Users\Public\Documents.|
+|**CSIDL_COMMON_FAVORITES**|The file-system directory that serves as a common repository for favorites common to all users. A typical path is C:\Users\Public\Favorites.|
+|**CSIDL_COMMON_MUSIC**|The file-system directory that serves as a repository for music files common to all users. A typical path is C:\Users\Public\Music.|
+|**CSIDL_COMMON_PICTURES**|The file-system directory that serves as a repository for image files common to all users. A typical path is C:\Users\Public\Pictures.|
+|**CSIDL_COMMON_PROGRAMS**|The file-system directory that contains the directories for the common program groups that appear on the **Start** menu for all users. A typical path is C:\ProgramData\Microsoft\Windows\Start Menu\Programs.|
+|**CSIDL_COMMON_STARTMENU**|The file-system directory that contains the programs and folders which appear on the **Start** menu for all users. A typical path in Windows is C:\ProgramData\Microsoft\Windows\Start Menu.|
+|**CSIDL_COMMON_STARTUP**|The file-system directory that contains the programs that appear in the Startup folder for all users. A typical path in Windows XP is C:\Documents and Settings\All Users\Start Menu\Programs\Startup. A typical path is C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup.|
+|**CSIDL_COMMON_TEMPLATES**|The file-system directory that contains the templates that are available to all users. A typical path is C:\ProgramData\Microsoft\Windows\Templates.|
+|**CSIDL_COMMON_VIDEO**|The file-system directory that serves as a repository for video files common to all users. A typical path is C:\Users\Public\Videos.|
+|**CSIDL_DEFAULT_APPDATA**|Refers to the Appdata folder inside %**DEFAULTUSERPROFILE**%.|
+|C**SIDL_DEFAULT_LOCAL_APPDATA**|Refers to the local Appdata folder inside %**DEFAULTUSERPROFILE**%.|
+|**CSIDL_DEFAULT_COOKIES**|Refers to the Cookies folder inside %**DEFAULTUSERPROFILE**%.|
+|**CSIDL_DEFAULT_CONTACTS**|Refers to the Contacts folder inside %**DEFAULTUSERPROFILE**%.|
+|**CSIDL_DEFAULT_DESKTOP**|Refers to the Desktop folder inside %**DEFAULTUSERPROFILE**%.|
+|**CSIDL_DEFAULT_DOWNLOADS**|Refers to the Downloads folder inside %**DEFAULTUSERPROFILE**%.|
+|**CSIDL_DEFAULT_FAVORITES**|Refers to the Favorites folder inside %**DEFAULTUSERPROFILE**%.|
+|**CSIDL_DEFAULT_HISTORY**|Refers to the History folder inside %**DEFAULTUSERPROFILE**%.|
+|**CSIDL_DEFAULT_INTERNET_CACHE**|Refers to the Internet Cache folder inside %**DEFAULTUSERPROFILE**%.|
+|**CSIDL_DEFAULT_PERSONAL**|Refers to the Personal folder inside %**DEFAULTUSERPROFILE**%.|
+|**CSIDL_DEFAULT_MYDOCUMENTS**|Refers to the My Documents folder inside %**DEFAULTUSERPROFILE**%.|
+|**CSIDL_DEFAULT_MYPICTURES**|Refers to the My Pictures folder inside %**DEFAULTUSERPROFILE**%.|
+|**CSIDL_DEFAULT_MYMUSIC**|Refers to the My Music folder inside %**DEFAULTUSERPROFILE**%.|
+|**CSIDL_DEFAULT_MYVIDEO**|Refers to the My Videos folder inside %**DEFAULTUSERPROFILE**%.|
+|**CSIDL_DEFAULT_RECENT**|Refers to the Recent folder inside %**DEFAULTUSERPROFILE**%.|
+|**CSIDL_DEFAULT_SENDTO**|Refers to the Send To folder inside %**DEFAULTUSERPROFILE**%.|
+|**CSIDL_DEFAULT_STARTMENU**|Refers to the Start Menu folder inside %**DEFAULTUSERPROFILE**%.|
+|**CSIDL_DEFAULT_PROGRAMS**|Refers to the Programs folder inside %**DEFAULTUSERPROFILE**%.|
+|**CSIDL_DEFAULT_STARTUP**|Refers to the Startup folder inside %**DEFAULTUSERPROFILE**%.|
+|**CSIDL_DEFAULT_TEMPLATES**|Refers to the Templates folder inside %**DEFAULTUSERPROFILE**%.|
+|**CSIDL_DEFAULT_QUICKLAUNCH**|Refers to the Quick Launch folder inside %**DEFAULTUSERPROFILE**%.|
+|**CSIDL_FONTS**|A virtual folder containing fonts. A typical path is C:\Windows\Fonts.|
+|**CSIDL_PROGRAM_FILESX86**|The Program Files folder on 64-bit systems. A typical path is C:\Program Files(86).|
+|**CSIDL_PROGRAM_FILES_COMMONX86**|A folder for components that are shared across applications on 64-bit systems. A typical path is C:\Program Files(86)\Common.|
+|**CSIDL_PROGRAM_FILES**|The Program Files folder. A typical path is C:\Program Files.|
+|**CSIDL_PROGRAM_FILES_COMMON**|A folder for components that are shared across applications. A typical path is C:\Program Files\Common.|
+|**CSIDL_RESOURCES**|The file-system directory that contains resource data. A typical path is C:\Windows\Resources.|
+|**CSIDL_SYSTEM**|The Windows System folder. A typical path is C:\Windows\System32.|
+|**CSIDL_WINDOWS**|The Windows directory or system root. This corresponds to the %**WINDIR**% or %**SYSTEMROOT**% environment variables. A typical path is C:\Windows.|
+|**DEFAULTUSERPROFILE**|Refers to the value in **HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList [DefaultUserProfile]**.|
+|**PROFILESFOLDER**|Refers to the value in **HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList [ProfilesDirectory]**.|
+|**PROGRAMFILES**|Same as **CSIDL_PROGRAM_FILES**.|
+|**PROGRAMFILES(X86)**|Refers to the C:\Program Files (x86) folder on 64-bit systems.|
+|**SYSTEM**|Refers to %**WINDIR**%\system32.|
+|**SYSTEM16**|Refers to %**WINDIR**%\system.|
+|**SYSTEM32**|Refers to %**WINDIR**%\system32.|
+|**SYSTEMPROFILE**|Refers to the value in **HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-18 [ProfileImagePath]**.|
+|**SYSTEMROOT**|Refers to the root of the system drive.|
+|**WINDIR**|Refers to the Windows folder located on the system drive.|
## Variables that are recognized only in the user context
-
You can use these variables in the .xml files within sections with `context=User` and `context=UserAndSystem`.
-
-
-
-
-
-
-
-
Variable
-
Explanation
-
-
-
-
-
APPDATA
-
Same as CSIDL_APPDATA.
-
-
-
CSIDL_ADMINTOOLS
-
The file-system directory that is used to store administrative tools for an individual user. The Microsoft® Management Console (MMC) saves customized consoles to this directory, which roams with the user profile.
-
-
-
CSIDL_ALTSTARTUP
-
The file-system directory that corresponds to the user's non-localized Startup program group.
-
-
-
CSIDL_APPDATA
-
The file-system directory that serves as a common repository for application-specific data. A typical path is C:\Documents and Settings\username\Application Data or C:\Users\username\AppData\Roaming.
-
-
-
CSIDL_BITBUCKET
-
The virtual folder that contains the objects in the user's Recycle Bin.
-
-
-
CSIDL_CDBURN_AREA
-
The file-system directory acting as a staging area for files waiting to be written to CD. A typical path is C:\Users\username\AppData\Local\Microsoft\Windows\MasteredBurning\Disc Burning.
-
-
-
CSIDL_CONNECTIONS
-
The virtual folder representing Network Connections that contains network and dial-up connections.
-
-
-
CSIDL_CONTACTS
-
This refers to the Contacts folder in %CSIDL_PROFILE%.
-
-
-
CSIDL_CONTROLS
-
The virtual folder that contains icons for the Control Panel items.
-
-
-
CSIDL_COOKIES
-
The file-system directory that serves as a common repository for Internet cookies. A typical path is C:\Users\username\AppData\Roaming\Microsoft\Windows\Cookies.
-
-
-
CSIDL_DESKTOP
-
The virtual folder representing the Windows desktop.
-
-
-
CSIDL_DESKTOPDIRECTORY
-
The file-system directory used to physically store file objects on the desktop, which should not be confused with the desktop folder itself. A typical path is C:\Users\username\Desktop.
-
-
-
CSIDL_DRIVES
-
The virtual folder representing My Computer that contains everything on the local computer: storage devices, printers, and Control Panel. The folder may also contain mapped network drives.
-
-
-
CSIDL_FAVORITES
-
The file-system directory that serves as a common repository for the user's favorites. A typical path is C:\Users\Username\Favorites.
-
-
-
CSIDL_HISTORY
-
The file-system directory that serves as a common repository for Internet history items.
-
-
-
CSIDL_INTERNET
-
A virtual folder for Internet Explorer.
-
-
-
CSIDL_INTERNET_CACHE
-
The file-system directory that serves as a common repository for temporary Internet files. A typical path is C:\Users\username\AppData\Local\Microsoft\Windows\Temporary Internet Files
-
-
-
CSIDL_LOCAL_APPDATA
-
The file-system directory that serves as a data repository for local, non-roaming applications. A typical path is C:\Users\username\AppData\Local.
-
-
-
CSIDL_MYDOCUMENTS
-
The virtual folder representing My Documents.A typical path is C:\Users\Username\Documents.
-
-
-
CSIDL_MYMUSIC
-
The file-system directory that serves as a common repository for music files. A typical path is C:\Users\Username\Music.
-
-
-
CSIDL_MYPICTURES
-
The file-system directory that serves as a common repository for image files. A typical path is C:\Users\Username\Pictures.
-
-
-
CSIDL_MYVIDEO
-
The file-system directory that serves as a common repository for video files. A typical path is C:\Users\Username\Videos.
-
-
-
CSIDL_NETHOOD
-
A file-system directory that contains the link objects that may exist in the My Network Places virtual folder. It is not the same as CSIDL_NETWORK, which represents the network namespace root. A typical path is C:\Users\Username\AppData\Roaming\Microsoft\Windows\Network Shortcuts.
-
-
-
CSIDL_NETWORK
-
A virtual folder representing My Network Places, the root of the network namespace hierarchy.
-
-
-
CSIDL_PERSONAL
-
The virtual folder representing the My Documents desktop item. This is equivalent to CSIDL_MYDOCUMENTS.
-
A typical path is C:\Documents and Settings\username\My Documents.
-
-
-
CSIDL_PLAYLISTS
-
The virtual folder used to store play albums, typically C:\Users\username\My Music\Playlists.
-
-
-
CSIDL_PRINTERS
-
The virtual folder that contains installed printers.
-
-
-
CSIDL_PRINTHOOD
-
The file-system directory that contains the link objects that can exist in the Printers virtual folder. A typical path is C:\Users\username\AppData\Roaming\Microsoft\Windows\Printer Shortcuts.
-
-
-
CSIDL_PROFILE
-
The user's profile folder. A typical path is C:\Users\Username.
-
-
-
CSIDL_PROGRAMS
-
The file-system directory that contains the user's program groups, which are themselves file-system directories. A typical path is C:\Users\Username\AppData\Roaming\Microsoft\Windows\Start Menu\Programs.
-
-
-
CSIDL_RECENT
-
The file-system directory that contains shortcuts to the user's most recently used documents. A typical path is C:\Users\Username\AppData\Roaming\Microsoft\Windows\Recent.
-
-
-
CSIDL_SENDTO
-
The file-system directory that contains Send To menu items. A typical path is C:\Users\username\AppData\Roaming\Microsoft\Windows\SendTo.
-
-
-
CSIDL_STARTMENU
-
The file-system directory that contains Start menu items. A typical path in Windows XP is C:\Documents and Settings\username\Start Menu. A typical path in Windows Vista, Windows 7, or Windows 8 is C:\Users\Username\AppData\Roaming\Microsoft\Windows\Start Menu.
-
-
-
CSIDL_STARTUP
-
The file-system directory that corresponds to the user's Startup program group. A typical path is C:\Users\Username\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup.
-
-
-
CSIDL_TEMPLATES
-
The file-system directory that serves as a common repository for document templates. A typical path is C:\Users\username\AppData\Roaming\Microsoft\Windows\Templates.
-
-
-
HOMEPATH
-
Same as the standard environment variable.
-
-
-
TEMP
-
The temporary folder on the computer. A typical path is %USERPROFILE%\AppData\Local\Temp.
-
-
-
TMP
-
The temporary folder on the computer. A typical path is %USERPROFILE%\AppData\Local\Temp.
-
-
-
USERPROFILE
-
Same as CSIDL_PROFILE.
-
-
-
USERSID
-
Represents the current user-account security identifier (SID). For example,
-
S-1-5-21-1714567821-1326601894-715345443-1026.
-
-
-
-
-
+|Variable|Explanation|
+|--- |--- |
+|**APPDATA**|Same as **CSIDL_APPDATA**.|
+|**CSIDL_ADMINTOOLS**|The file-system directory that is used to store administrative tools for an individual user. The Microsoft® Management Console (MMC) saves customized consoles to this directory, which roams with the user profile.|
+|**CSIDL_ALTSTARTUP**|The file-system directory that corresponds to the user's non-localized Startup program group.|
+|**CSIDL_APPDATA**|The file-system directory that serves as a common repository for application-specific data. A typical path is C:\Documents and Settings\username\Application Data or C:\Users\username\AppData\Roaming.|
+|**CSIDL_BITBUCKET**|The virtual folder that contains the objects in the user's Recycle Bin.|
+|**CSIDL_CDBURN_AREA**|The file-system directory acting as a staging area for files waiting to be written to CD. A typical path is C:\Users\username\AppData\Local\Microsoft\Windows\MasteredBurning\Disc Burning.|
+|**CSIDL_CONNECTIONS**|The virtual folder representing Network Connections that contains network and dial-up connections.|
+|**CSIDL_CONTACTS**|This refers to the Contacts folder in %**CSIDL_PROFILE**%.|
+|**CSIDL_CONTROLS**|The virtual folder that contains icons for the Control Panel items.|
+|**CSIDL_COOKIES**|The file-system directory that serves as a common repository for Internet cookies. A typical path is C:\Users\username\AppData\Roaming\Microsoft\Windows\Cookies.|
+|**CSIDL_DESKTOP**|The virtual folder representing the Windows desktop.|
+|**CSIDL_DESKTOPDIRECTORY**|The file-system directory used to physically store file objects on the desktop, which should not be confused with the desktop folder itself. A typical path is C:\Users\username\Desktop.|
+|**CSIDL_DRIVES**|The virtual folder representing My Computer that contains everything on the local computer: storage devices, printers, and Control Panel. The folder may also contain mapped network drives.|
+|**CSIDL_FAVORITES**|The file-system directory that serves as a common repository for the user's favorites. A typical path is C:\Users\Username\Favorites.|
+|**CSIDL_HISTORY**|The file-system directory that serves as a common repository for Internet history items.|
+|**CSIDL_INTERNET**|A virtual folder for Internet Explorer.|
+|**CSIDL_INTERNET_CACHE**|The file-system directory that serves as a common repository for temporary Internet files. A typical path is C:\Users\username\AppData\Local\Microsoft\Windows\Temporary Internet Files|
+|**CSIDL_LOCAL_APPDATA**|The file-system directory that serves as a data repository for local, non-roaming applications. A typical path is C:\Users\username\AppData\Local.|
+|**CSIDL_MYDOCUMENTS**|The virtual folder representing My Documents.A typical path is C:\Users\Username\Documents.|
+|**CSIDL_MYMUSIC**|The file-system directory that serves as a common repository for music files. A typical path is C:\Users\Username\Music.|
+|**CSIDL_MYPICTURES**|The file-system directory that serves as a common repository for image files. A typical path is C:\Users\Username\Pictures.|
+|**CSIDL_MYVIDEO**|The file-system directory that serves as a common repository for video files. A typical path is C:\Users\Username\Videos.|
+|**CSIDL_NETHOOD**|A file-system directory that contains the link objects that may exist in the My Network Places virtual folder. It is not the same as CSIDL_NETWORK, which represents the network namespace root. A typical path is C:\Users\Username\AppData\Roaming\Microsoft\Windows\Network Shortcuts.|
+|**CSIDL_NETWORK**|A virtual folder representing My Network Places, the root of the network namespace hierarchy.|
+|**CSIDL_PERSONAL**|The virtual folder representing the My Documents desktop item. This is equivalent to **CSIDL_MYDOCUMENTS**. A typical path is C:\Documents and Settings\username\My Documents.|
+|**CSIDL_PLAYLISTS**|The virtual folder used to store play albums, typically C:\Users\username\My Music\Playlists.|
+|**CSIDL_PRINTERS**|The virtual folder that contains installed printers.|
+|**CSIDL_PRINTHOOD**|The file-system directory that contains the link objects that can exist in the Printers virtual folder. A typical path is C:\Users\username\AppData\Roaming\Microsoft\Windows\Printer Shortcuts.|
+|**CSIDL_PROFILE**|The user's profile folder. A typical path is C:\Users\Username.|
+|**CSIDL_PROGRAMS**|The file-system directory that contains the user's program groups, which are themselves file-system directories. A typical path is C:\Users\Username\AppData\Roaming\Microsoft\Windows\Start Menu\Programs.|
+|**CSIDL_RECENT**|The file-system directory that contains shortcuts to the user's most recently used documents. A typical path is C:\Users\Username\AppData\Roaming\Microsoft\Windows\Recent.|
+|**CSIDL_SENDTO**|The file-system directory that contains **Send To** menu items. A typical path is C:\Users\username\AppData\Roaming\Microsoft\Windows\SendTo.|
+|**CSIDL_STARTMENU**|The file-system directory that contains **Start** menu items. A typical path in Windows XP is C:\Documents and Settings\username\Start Menu. A typical path in Windows Vista, Windows 7, or Windows 8 is C:\Users\Username\AppData\Roaming\Microsoft\Windows\Start Menu.|
+|**CSIDL_STARTUP**|The file-system directory that corresponds to the user's Startup program group. A typical path is C:\Users\Username\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup.|
+|**CSIDL_TEMPLATES**|The file-system directory that serves as a common repository for document templates. A typical path is C:\Users\username\AppData\Roaming\Microsoft\Windows\Templates.|
+|**HOMEPATH**|Same as the standard environment variable.|
+|**TEMP**|The temporary folder on the computer. A typical path is %**USERPROFILE**%\AppData\Local\Temp.|
+|**TMP**|The temporary folder on the computer. A typical path is %**USERPROFILE**%\AppData\Local\Temp.|
+|**USERPROFILE**|Same as **CSIDL_PROFILE**.|
+|**USERSID**|Represents the current user-account security identifier (SID). For example, S-1-5-21-1714567821-1326601894-715345443-1026.|
## Related topics
-
[USMT XML Reference](usmt-xml-reference.md)
-
-
-
-
-
-
-
-
-
diff --git a/windows/deployment/usmt/usmt-reference.md b/windows/deployment/usmt/usmt-reference.md
index 7e00f19577..a24a5da4cd 100644
--- a/windows/deployment/usmt/usmt-reference.md
+++ b/windows/deployment/usmt/usmt-reference.md
@@ -16,63 +16,22 @@ ms.topic: article
# User State Migration Toolkit (USMT) Reference
-
## In This Section
-
-
Find requirements, best practices, and other considerations for performing a migration offline.
-
-
-
-
-
+| Link | Description |
+|--- |--- |
+|[USMT Requirements](usmt-requirements.md)|Describes operating system, hardware, and software requirements, and user prerequisites.|
+|[USMT Best Practices](usmt-best-practices.md)|Discusses general and security-related best practices when using USMT.|
+|[How USMT Works](usmt-how-it-works.md)|Learn about the processes behind the ScanState and LoadState tools.|
+|[Plan Your Migration](usmt-plan-your-migration.md)|Choose what to migrate and the best migration scenario for your enterprise.|
+|[User State Migration Tool (USMT) Command-line Syntax](usmt-command-line-syntax.md)|Explore command-line options for the ScanState, LoadState, and UsmtUtils tools.|
+|[USMT XML Reference](usmt-xml-reference.md)|Learn about customizing a migration with XML files.|
+|[Offline Migration Reference](offline-migration-reference.md)|Find requirements, best practices, and other considerations for performing a migration offline.|
## Related topics
-
[User State Migration Tool (USMT) Overview Topics](usmt-topics.md)
[User State Migration Tool (USMT) How-to topics](usmt-how-to.md)
[User State Migration Tool (USMT) Troubleshooting](usmt-troubleshooting.md)
-
-
-
-
-
-
-
-
-
diff --git a/windows/deployment/usmt/usmt-requirements.md b/windows/deployment/usmt/usmt-requirements.md
index 1bb916cf7a..5df90fe4bb 100644
--- a/windows/deployment/usmt/usmt-requirements.md
+++ b/windows/deployment/usmt/usmt-requirements.md
@@ -16,10 +16,8 @@ ms.topic: article
# USMT Requirements
-
## In This Topic
-
- [Supported Operating Systems](#bkmk-1)
- [Windows PE](#windows-pe)
- [Credentials](#credentials)
@@ -30,77 +28,35 @@ ms.topic: article
## Supported Operating Systems
-
The User State Migration Tool (USMT) 10.0 does not have any explicit RAM or CPU speed requirements for either the source or destination computers. If your computer complies with the system requirements of the operating system, it also complies with the requirements for USMT. You need an intermediate store location large enough to hold all of the migrated data and settings, and the same amount of hard disk space on the destination computer for the migrated files and settings.
The following table lists the operating systems supported in USMT.
-
+|Operating Systems|ScanState (source computer)|LoadState (destination computer)|
+|--- |--- |--- |
+|32-bit versions of Windows 7|✔️|✔️|
+|64-bit versions of Windows 7|✔️|✔️|
+|32-bit versions of Windows 8|✔️|✔️|
+|64-bit versions of Windows 8|✔️|✔️|
+|32-bit versions of Windows 10|✔️|✔️|
+|64-bit versions of Windows 10|✔️|✔️|
-
-
-
-
-
-
-
-
Operating Systems
-
ScanState (source computer)
-
LoadState (destination computer)
-
-
-
-
-
32-bit versions of Windows 7
-
X
-
X
-
-
-
64-bit versions of Windows 7
-
X
-
X
-
-
-
32-bit versions of Windows 8
-
X
-
X
-
-
-
64-bit versions of Windows 8
-
X
-
X
-
-
-
32-bit versions of Windows 10
-
X
-
X
-
-
-
64-bit versions of Windows 10
-
X
-
X
-
-
-
-
-
-
-**Note**
-You can migrate a 32-bit operating system to a 64-bit operating system. However, you cannot migrate a 64-bit operating system to a 32-bit operating system.
+> [!NOTE]
+> You can migrate a 32-bit operating system to a 64-bit operating system. However, you cannot migrate a 64-bit operating system to a 32-bit operating system.
USMT does not support any of the Windows Server® operating systems, Windows 2000, Windows XP, or any of the starter editions for Windows Vista or Windows 7.
USMT for Windows 10 should not be used for migrating from Windows 7 to Windows 8.1. It is meant to migrate to Windows 10.
-For more information about previous releases of the USMT tools, see [User State Migration Tool (USMT) 4.0 User’s Guide](/previous-versions/windows/server/dd560801(v=ws.10)).
+For more information about previous releases of the USMT tools, see [User State Migration Tool (USMT) 4.0 User’s Guide](/previous-versions/windows/server/dd560801(v=ws.10)).
## Windows PE
-- **Must use latest version of Window PE.** For example, to migrate to Windows 10, you'll need Windows PE 5.1. For more info, see [What's New in Windows PE](/windows-hardware/manufacture/desktop/whats-new-in-windows-pe-s14).
+- **Must use latest version of Windows PE.** For example, to migrate to Windows 10, you'll need Windows PE 5.1. For more info, see [What's New in Windows PE](/windows-hardware/manufacture/desktop/whats-new-in-windows-pe-s14).
## Credentials
-- **Run as administrator**
- When manually running the **ScanState** and **LoadState** tools on Windows 7, Windows 8 or Windows 10 you must run them from an elevated command prompt to ensure that all specified users are migrated. If you do not run USMT from an elevated prompt, only the user profile that is logged on will be included in the migration.
+- **Run as administrator**
+ When manually running the **ScanState** and **LoadState** tools on Windows 7, Windows 8, or Windows 10 you must run them from an elevated command prompt to ensure that all specified users are migrated. If you do not run USMT from an elevated prompt, only the user profile that is logged on will be included in the migration.
To open an elevated command prompt:
@@ -110,8 +66,8 @@ To open an elevated command prompt:
3. Right-click **cmd** or **Command Prompt**, and then click **Run as administrator**.
4. If the current user is not already an administrator, you will be prompted to enter administrator credentials.
-**Important**
-You must run USMT using an account with full administrative permissions, including the following privileges:
+> [!IMPORTANT]
+> You must run USMT using an account with full administrative permissions, including the following privileges:
- SeBackupPrivilege (Back up files and directories)
- SeDebugPrivilege (Debug programs)
@@ -119,11 +75,10 @@ You must run USMT using an account with full administrative permissions, includi
- SeSecurityPrivilege (Manage auditing and security log)
- SeTakeOwnership Privilege (Take ownership of files or other objects)
-
## Config.xml
- **Specify the /c option and <ErrorControl> settings in the Config.xml file.**
- USMT will fail if it cannot migrate a file or setting, unless you specify the **/c** option. When you specify the **/c** option, USMT logs an error each time it encounters a file that is in use that did not migrate, but the migration will not be interrupted. In USMT, you can specify in the Config.xml file which types of errors should allow the migration to continue, and which should cause the migration to fail. For more information about error reporting, and the **<ErrorControl>** element, see [Config.xml File](usmt-configxml-file.md), [Log Files](usmt-log-files.md), and [XML Elements Library](usmt-xml-elements-library.md).
+ USMT will fail if it cannot migrate a file or setting, unless you specify the **/c** option. When you specify the **/c** option, USMT logs an error each time it encounters a file that is in use that did not migrate, but the migration will not be interrupted. In USMT, you can specify in the Config.xml file, which types of errors should allow the migration to continue, and which should cause the migration to fail. For more information about error reporting, and the **<ErrorControl>** element, see [Config.xml File](usmt-configxml-file.md), [Log Files](usmt-log-files.md), and [XML Elements Library](usmt-xml-elements-library.md).
## LoadState
@@ -132,12 +87,10 @@ You must run USMT using an account with full administrative permissions, includi
## Hard-Disk Requirements
-
Ensure that there is enough available space in the migration-store location and on the source and destination computers. For more information, see [Estimate Migration Store Size](usmt-estimate-migration-store-size.md).
## User Prerequisites
-
This documentation assumes that IT professionals using USMT understand command-line tools. The documentation also assumes that IT professionals using USMT to author MigXML rules understand the following:
- The navigation and hierarchy of the Windows registry.
@@ -147,10 +100,6 @@ This documentation assumes that IT professionals using USMT understand command-l
## Related topics
-
[Plan Your Migration](usmt-plan-your-migration.md)
[Estimate Migration Store Size](usmt-estimate-migration-store-size.md)
[User State Migration Tool (USMT) Overview Topics](usmt-topics.md)
-
-
-
diff --git a/windows/deployment/usmt/usmt-return-codes.md b/windows/deployment/usmt/usmt-return-codes.md
index 44089d6d19..b10a808b61 100644
--- a/windows/deployment/usmt/usmt-return-codes.md
+++ b/windows/deployment/usmt/usmt-return-codes.md
@@ -16,14 +16,12 @@ ms.topic: article
# Return Codes
-
This topic describes User State Migration Tool (USMT) 10.0 return codes and error messages. Also included is a table listing the USMT return codes with their associated mitigation steps. In addition, this topic provides tips to help you use the logfiles to determine why you received an error.
Understanding the requirements for running USMT can help minimize errors in your USMT migrations. For more information, see [USMT Requirements](usmt-requirements.md).
## In This Topic
-
[USMT Return Codes](#bkmk-returncodes)
[USMT Error Messages](#bkmk-errormessages)
@@ -32,7 +30,6 @@ Understanding the requirements for running USMT can help minimize errors in your
## USMT Return Codes
-
If you encounter an error in your USMT migration, you can use return codes and the more specific information provided in the associated USMT error messages to troubleshoot the issue and to identify mitigation steps.
Return codes are grouped into the following broad categories that describe their area of error reporting:
@@ -51,731 +48,231 @@ As a best practice, we recommend that you set verbosity level to 5, **/v**:5
## USMT Error Messages
-
Error messages provide more detailed information about the migration problem than the associated return code. For example, the **ScanState**, **LoadState**, or **USMTUtils** tool might return a code of "11” (for “USMT\_INVALID\_PARAMETERS") and a related error message that reads "/key and /keyfile both specified". The error message is displayed at the command prompt and is identified in the **ScanState**, **LoadState**, or **USMTUtils** log files to help you determine why the return code was received.
You can obtain more information about any listed Windows application programming interface (API) system error codes by typing **net helpmsg** on the command line and, then typing the error code number. For more information about System Error Codes, see [this Microsoft Web site](/windows/win32/debug/system-error-codes--0-499-).
## Troubleshooting Return Codes and Error Messages
+The following information lists each return code by numeric value, along with the associated error messages and suggested troubleshooting actions.
-The following table lists each return code by numeric value, along with the associated error messages and suggested troubleshooting actions.
+- **0: USMT_SUCCESS**
+ - **Error message**: Successful run
-
-
-
-
-
-
-
-
-
-
-
Return code value
-
Return code
-
Error message
-
Troubleshooting, mitigation, workarounds
-
Category
-
-
-
-
-
0
-
USMT_SUCCESS
-
Successful run
-
Not applicable
-
Success or Cancel
-
-
-
1
-
USMT_DISPLAY_HELP
-
Command line help requested
-
Not applicable
-
Success or Cancel
-
-
-
2
-
USMT_STATUS_CANCELED
-
Gather was aborted because of an EFS file
-
Not applicable
-
-
-
-
-
-
User chose to cancel (such as pressing CTRL+C)
-
Not applicable
-
Success or Cancel
-
-
-
3
-
USMT_WOULD_HAVE_FAILED
-
At least one error was skipped as a result of /c
-
Review ScanState, LoadState, or UsmtUtils log for details about command-line errors.
-
-
-
-
11
-
USMT_INVALID_PARAMETERS
-
/all conflicts with /ui, /ue or /uel
-
Review ScanState log or LoadState log for details about command-line errors.
-
-
-
-
-
-
/auto expects an optional parameter for the script folder
-
Review ScanState log or LoadState log for details about command-line errors.
-
-
-
-
-
-
/encrypt can't be used with /nocompress
-
Review ScanState log or LoadState log for details about command-line errors.
-
-
-
-
-
-
/encrypt requires /key or /keyfile
-
Review ScanState log or LoadState log for details about command-line errors.
-
-
-
-
-
-
/genconfig can't be used with most other options
-
Review ScanState log or LoadState log for details about command-line errors.
-
-
-
-
-
-
/genmigxml can't be used with most other options
-
Review ScanState log or LoadState log for details about command-line errors.
-
-
-
-
-
-
/hardlink requires /nocompress
-
Review ScanState log or LoadState log for details about command-line errors.
-
-
-
-
-
-
/key and /keyfile both specified
-
Review ScanState log or LoadState log for details about command-line errors.
-
-
-
-
-
-
/key or /keyfile used without enabling encryption
-
Review ScanState log or LoadState log for details about command-line errors.
-
-
-
-
-
-
/lae is only used with /lac
-
Review ScanState log or LoadState log for details about command-line errors.
-
-
-
-
-
-
/listfiles cannot be used with /p
-
Review ScanState log or LoadState log for details about command-line errors.
-
-
-
-
-
-
/offline requires a valid path to an XML file describing offline paths
-
Review ScanState log or LoadState log for details about command-line errors.
-
-
-
-
-
-
/offlinewindir requires a valid path to offline windows folder
-
Review ScanState log or LoadState log for details about command-line errors.
-
-
-
-
-
-
/offlinewinold requires a valid path to offline windows folder
-
Review ScanState log or LoadState log for details about command-line errors.
-
-
-
-
-
-
A command was already specified
-
Verify that the command-line syntax is correct and that there are no duplicate commands.
-
-
-
-
-
-
An option argument is missing
-
Review ScanState log or LoadState log for details about command-line errors.
-
-
-
-
-
-
An option is specified more than once and is ambiguous
-
Review ScanState log or LoadState log for details about command-line errors.
-
-
-
-
-
-
By default /auto selects all users and uses the highest log verbosity level. Switches like /all, /ui, /ue, /v are not allowed.
-
Review ScanState log or LoadState log for details about command-line errors.
-
-
-
-
-
-
Command line arguments are required. Specify /? for options.
-
Review ScanState log or LoadState log for details about command-line errors.
-
-
-
-
-
-
Command line option is not valid
-
Review ScanState log or LoadState log for details about command-line errors.
-
-
-
-
-
-
EFS parameter specified is not valid for /efs
-
Review ScanState log or LoadState log for details about command-line errors.
-
-
-
-
-
-
File argument is invalid for /genconfig
-
Review ScanState log or LoadState log for details about command-line errors.
-
-
-
-
-
-
File argument is invalid for /genmigxml
-
Review ScanState log or LoadState log for details about command-line errors.
-
-
-
-
-
-
Invalid space estimate path. Check the parameters and/or file system permissions
-
Review ScanState log or LoadState log for details about command-line errors.
-
-
-
-
-
-
List file path argument is invalid for /listfiles
-
Review ScanState log or LoadState log for details about command-line errors.
-
-
-
-
-
-
Retry argument must be an integer
-
Review ScanState log or LoadState log for details about command-line errors.
-
-
-
-
-
-
Settings store argument specified is invalid
-
Review ScanState log or LoadState log for details about command-line errors. Make sure that the store path is accessible and that the proper permission levels are set.
-
-
-
-
-
-
Specified encryption algorithm is not supported
-
Review ScanState log or LoadState log for details about command-line errors.
-
-
-
-
-
-
The /efs:hardlink requires /hardlink
-
Review ScanState log or LoadState log for details about command-line errors.
-
-
-
-
-
-
The /targetWindows7 option is only available for Windows XP, Windows Vista, and Windows 7
-
Review ScanState log or LoadState log for details about command-line errors.
-
-
-
-
-
-
The store parameter is required but not specified
-
Review ScanState log or LoadState log for details about command-line errors.
-
-
-
-
-
-
The source-to-target domain mapping is invalid for /md
-
Review ScanState log or LoadState log for details about command-line errors.
-
-
-
-
-
-
The source-to-target user account mapping is invalid for /mu
-
Review ScanState log or LoadState log for details about command-line errors.
-
-
-
-
-
-
Undefined or incomplete command line option
-
Review ScanState log or LoadState log for details about command-line errors.
-
Invalid Command Lines
-
-
-
-
-
Use /nocompress, or provide an XML file path with /p"pathtoafile" to get a compressed store size estimate
-
Review ScanState log or LoadState log for details about command-line errors.
-
-
-
-
-
-
User exclusion argument is invalid
-
Review ScanState log or LoadState log for details about command-line errors.
-
-
-
-
-
-
Verbosity level must be specified as a sum of the desired log options: Verbose (0x01), Record Objects (0x04), Echo to debug port (0x08)
-
Review ScanState log or LoadState log for details about command-line errors.
-
-
-
-
-
-
Volume shadow copy feature is not supported with a hardlink store
-
Review ScanState log or LoadState log for details about command-line errors.
-
-
-
-
-
-
Wait delay argument must be an integer
-
Review ScanState log or LoadState log for details about command-line errors.
-
-
-
-
12
-
USMT_ERROR_OPTION_PARAM_TOO_LARGE
-
Command line arguments cannot exceed 256 characters
-
Review ScanState log or LoadState log for details about command-line errors.
-
Invalid Command Lines
-
-
-
-
-
Specified settings store path exceeds the maximum allowed length of 256 characters
-
Review ScanState log or LoadState log for details about command-line errors.
-
-
-
-
13
-
USMT_INIT_LOGFILE_FAILED
-
Log path argument is invalid for /l
-
When /l is specified in the ScanState command line, USMT validates the path. Verify that the drive and other information, for example file system characters, are correct.
-
Invalid Command Lines
-
-
-
14
-
USMT_ERROR_USE_LAC
-
Unable to create a local account because /lac was not specified
-
When creating local accounts, the command-line options /lac and /lae should be used.
-
Invalid Command Lines
-
-
-
26
-
USMT_INIT_ERROR
-
Multiple Windows installations found
-
Listfiles.txt could not be created. Verify that the location you specified for the creation of this file is valid.
-
Setup and Initialization
-
-
-
-
-
Software malfunction or unknown exception
-
Check all loaded .xml files for errors, common error when using /I to load the Config.xml file.
-
-
-
-
-
-
Unable to find a valid Windows directory to proceed with requested offline operation; Check if offline input file is present and has valid entries
-
Verify that the offline input file is present and that it has valid entries. USMT could not find valid offline operating system. Verify your offline directory mapping.
-
-
-
-
27
-
USMT_INVALID_STORE_LOCATION
-
A store path can't be used because an existing store exists; specify /o to overwrite
-
Specify /o to overwrite an existing intermediate or migration store.
-
Setup and Initialization
-
-
-
-
-
A store path is missing or has incomplete data
-
Make sure that the store path is accessible and that the proper permission levels are set.
-
-
-
-
-
-
An error occurred during store creation
-
Make sure that the store path is accessible and that the proper permission levels are set. Specify /o to overwrite an existing intermediate or migration store.
-
-
-
-
-
-
An inappropriate device such as a floppy disk was specified for the store
-
Make sure that the store path is accessible and that the proper permission levels are set.
-
-
-
-
-
-
Invalid store path; check the store parameter and/or file system permissions
-
Invalid store path; check the store parameter and/or file system permissions
-
-
-
-
-
-
The file layout and/or file content is not recognized as a valid store
-
Make sure that the store path is accessible and that the proper permission levels are set. Specify /o to overwrite an existing intermediate or migration store.
-
-
-
-
-
-
The store path holds a store incompatible with the current USMT version
-
Make sure that the store path is accessible and that the proper permission levels are set.
-
-
-
-
-
-
The store save location is read-only or does not support a requested storage option
-
Make sure that the store path is accessible and that the proper permission levels are set.
-
-
-
-
28
-
USMT_UNABLE_GET_SCRIPTFILES
-
Script file is invalid for /i
-
Check all specified migration .xml files for errors. This is a common error when using /i to load the Config.xml file.
-
Setup and Initialization
-
-
-
-
-
Unable to find a script file specified by /i
-
Verify the location of your script files, and ensure that the command-line options are correct.
-
-
-
-
29
-
USMT_FAILED_MIGSTARTUP
-
A minimum of 250 MB of free space is required for temporary files
-
Verify that the system meets the minimum temporary disk space requirement of 250 MB. As a workaround, you can set the environment variable USMT_WORKING_DIR=<path> to redirect the temporary files working directory.
-
Setup and Initialization
-
-
-
-
-
Another process is preventing migration; only one migration tool can run at a time
-
Check the ScanState log file for migration .xml file errors.
-
-
-
-
-
-
Failed to start main processing, look in log for system errors or check the installation
-
Check the ScanState log file for migration .xml file errors.
-
-
-
-
-
-
Migration failed because of an XML error; look in the log for specific details
-
Check the ScanState log file for migration .xml file errors.
-
-
-
-
-
-
Unable to automatically map the drive letters to match the online drive letter layout; Use /offline to provide a mapping table
-
Check the ScanState log file for migration .xml file errors.
-
-
-
-
31
-
USMT_UNABLE_FINDMIGUNITS
-
An error occurred during the discover phase; the log should have more specific information
-
Check the ScanState log file for migration .xml file errors.
-
Setup and Initialization
-
-
-
32
-
USMT_FAILED_SETMIGRATIONTYPE
-
An error occurred processing the migration system
-
Check the ScanState log file for migration .xml file errors, or use online Help by typing /? on the command line.
-
Setup and Initialization
-
-
-
33
-
USMT_UNABLE_READKEY
-
Error accessing the file specified by the /keyfile parameter
-
Check the ScanState log file for migration .xml file errors, or use online Help by typing /? on the command line.
-
Setup and Initialization
-
-
-
-
-
The encryption key must have at least one character
-
Check the ScanState log file for migration .xml file errors, or use online Help by typing /? on the command line.
-
-
-
-
34
-
USMT_ERROR_INSUFFICIENT_RIGHTS
-
Directory removal requires elevated privileges
-
Log on as Administrator, and run with elevated privileges.
-
Setup and Initialization
-
-
-
-
-
No rights to create user profiles; log in as Administrator; run with elevated privileges
-
Log on as Administrator, and run with elevated privileges.
-
-
-
-
-
-
No rights to read or delete user profiles; log in as Administrator, run with elevated privileges
-
Log on as Administrator, and run with elevated privileges.
-
-
-
-
35
-
USMT_UNABLE_DELETE_STORE
-
A reboot is required to remove the store
-
Reboot to delete any files that could not be deleted when the command was executed.
-
Setup and Initialization
-
-
-
-
-
A store path can't be used because it contains data that could not be overwritten
-
A migration store could not be deleted. If you are using a hardlink migration store you might have a locked file in it. You should manually delete the store, or use USMTUtils /rd command to delete the store.
-
-
-
-
-
-
There was an error removing the store
-
Review ScanState log or LoadState log for details about command-line errors.
-
-
-
-
36
-
USMT_ERROR_UNSUPPORTED_PLATFORM
-
Compliance check failure; please check the logs for details
-
Investigate whether there is an active temporary profile on the system.
-
Setup and Initialization
-
-
-
-
-
Use of /offline is not supported during apply
-
The /offline command was not used while running in the Windows Preinstallation Environment (WinPE).
-
-
-
-
-
-
Use /offline to run gather on this platform
-
The /offline command was not used while running in WinPE.
-
-
-
-
37
-
USMT_ERROR_NO_INVALID_KEY
-
The store holds encrypted data but the correct encryption key was not provided
-
Verify that you have included the correct encryption /key or /keyfile.
-
Setup and Initialization
-
-
-
38
-
USMT_ERROR_CORRUPTED_NOTENCRYPTED_STORE
-
An error occurred during store access
-
Review ScanState log or LoadState log for details about command-line errors. Make sure that the store path is accessible and that the proper permission levels are set.
-
Setup and Initialization
-
-
-
39
-
USMT_UNABLE_TO_READ_CONFIG_FILE
-
Error reading Config.xml
-
Review ScanState log or LoadState log for details about command-line errors in the Config.xml file.
-
Setup and Initialization
-
-
-
-
-
File argument is invalid for /config
-
Check the command line you used to load the Config.xml file. You can use online Help by typing /? on the command line.
-
-
-
-
40
-
USMT_ERROR_UNABLE_CREATE_PROGRESS_LOG
-
Error writing to the progress log
-
The Progress log could not be created. Verify that the location is valid and that you have write access.
-
Setup and Initialization
-
-
-
-
-
Progress log argument is invalid for /progress
-
The Progress log could not be created. Verify that the location is valid and that you have write access.
-
-
-
-
41
-
USMT_PREFLIGHT_FILE_CREATION_FAILED
-
Can't overwrite existing file
-
The Progress log could not be created. Verify that the location is valid and that you have write access.
-
Setup and Initialization
-
-
-
-
-
Invalid space estimate path. Check the parameters and/or file system permissions
-
Review ScanState log or LoadState log for details about command-line errors.
USMT exited but can continue with the /c command-line option, with the optional configurable <ErrorControl> section or by using the /vsc command-line option.
-
Non-fatal Errors
-
-
-
71
-
USMT_INIT_OPERATING_ENVIRONMENT_FAILED
-
A Windows Win32 API error occurred
-
Data transfer has begun, and there was an error during the creation of migration store or during the apply phase. Review the ScanState log or LoadState log for details.
-
Fatal Errors
-
-
-
-
-
An error occurred when attempting to initialize the diagnostic mechanisms such as the log
-
Data transfer has begun, and there was an error during the creation of migration store or during the apply phase. Review the ScanState log or LoadState log for details.
-
-
-
-
-
-
Failed to record diagnostic information
-
Data transfer has begun, and there was an error during the creation of migration store or during the apply phase. Review the ScanState log or LoadState log for details.
-
-
-
-
-
-
Unable to start. Make sure you are running USMT with elevated privileges
-
Exit USMT and log in again with elevated privileges.
-
-
-
-
72
-
USMT_UNABLE_DOMIGRATION
-
An error occurred closing the store
-
Data transfer has begun, and there was an error during migration-store creation or during the apply phase. Review the ScanState log or LoadState log for details.
-
Fatal Errors
-
-
-
-
-
An error occurred in the apply process
-
Data transfer has begun, and there was an error during migration-store creation or during the apply phase. Review the ScanState log or LoadState log for details.
-
-
-
-
-
-
An error occurred in the gather process
-
Data transfer has begun, and there was an error during migration-store creation or during the apply phase. Review the ScanState log or LoadState log for details.
-
-
-
-
-
-
Out of disk space while writing the store
-
Data transfer has begun, and there was an error during migration-store creation or during the apply phase. Review the ScanState log or LoadState log for details.
-
-
-
-
-
-
Out of temporary disk space on the local system
-
Data transfer has begun, and there was an error during migration-store creation or during the apply phase. Review the ScanState log or LoadState log for details.
-
-
-
-
+- **1: USMT_DISPLAY_HELP**
+ - **Error message**: Command line help requested
-
+- **2: USMT_STATUS_CANCELED**
+ - **Error message**:
+ - Gather was aborted because of an EFS file
+ - User chose to cancel (such as pressing CTRL+C)
+
+- **3: USMT_WOULD_HAVE_FAILED**
+ - **Error message**: At least one error was skipped as a result of /c.
+ - **Troubleshooting, mitigation, workarounds**: Review ScanState, LoadState, or UsmtUtils log for details about command-line errors.
+
+- **11: USMT_INVALID_PARAMETERS**
+
+ | Error message | Troubleshooting, mitigation, workarounds |
+ | --- | --- |
+ | /all conflicts with /ui, /ue or /uel | Review ScanState log or LoadState log for details about command-line errors. |
+ | /auto expects an optional parameter for the script folder | Review ScanState log or LoadState log for details about command-line errors. |
+ | /encrypt can't be used with /nocompress | Review ScanState log or LoadState log for details about command-line errors. |
+ | /encrypt requires /key or /keyfile | Review ScanState log or LoadState log for details about command-line errors. |
+ | /genconfig can't be used with most other options | Review ScanState log or LoadState log for details about command-line errors. |
+ | /genmigxml can't be used with most other options | Review ScanState log or LoadState log for details about command-line errors. |
+ | /hardlink requires /nocompress | Review ScanState log or LoadState log for details about command-line errors. |
+ | /key and /keyfile both specified | Review ScanState log or LoadState log for details about command-line errors. |
+ | /key or /keyfile used without enabling encryption | Review ScanState log or LoadState log for details about command-line errors. |
+ | /lae is only used with /lac | Review ScanState log or LoadState log for details about command-line errors. |
+ | /listfiles cannot be used with /p | Review ScanState log or LoadState log for details about command-line errors. |
+ | /offline requires a valid path to an XML file describing offline paths | Review ScanState log or LoadState log for details about command-line errors. |
+ | /offlinewindir requires a valid path to offline windows folder | Review ScanState log or LoadState log for details about command-line errors. |
+ | /offlinewinold requires a valid path to offline windows folder | Review ScanState log or LoadState log for details about command-line errors. |
+ | A command was already specified | Verify that the command-line syntax is correct and that there are no duplicate commands. |
+ | An option argument is missing | Review ScanState log or LoadState log for details about command-line errors. |
+ | An option is specified more than once and is ambiguous | Review ScanState log or LoadState log for details about command-line errors. |
+ | By default /auto selects all users and uses the highest log verbosity level. Switches like /all, /ui, /ue, /v are not allowed. | Review ScanState log or LoadState log for details about command-line errors. |
+ | Command line arguments are required. Specify /? for options. | Review ScanState log or LoadState log for details about command-line errors. |
+ | Command line option is not valid | Review ScanState log or LoadState log for details about command-line errors. |
+ | EFS parameter specified is not valid for /efs | Review ScanState log or LoadState log for details about command-line errors. |
+ | File argument is invalid for /genconfig | Review ScanState log or LoadState log for details about command-line errors. |
+ | File argument is invalid for /genmigxml | Review ScanState log or LoadState log for details about command-line errors. |
+ | Invalid space estimate path. Check the parameters and/or file system permissions | Review ScanState log or LoadState log for details about command-line errors. |
+ | List file path argument is invalid for /listfiles | Review ScanState log or LoadState log for details about command-line errors. |
+ | Retry argument must be an integer | Review ScanState log or LoadState log for details about command-line errors. |
+ | Settings store argument specified is invalid | Review ScanState log or LoadState log for details about command-line errors. Make sure that the store path is accessible and that the proper permission levels are set. |
+ | Specified encryption algorithm is not supported | Review ScanState log or LoadState log for details about command-line errors. |
+ | The /efs:hardlink requires /hardlink | Review ScanState log or LoadState log for details about command-line errors. |
+ | The /targetWindows7 option is only available for Windows XP, Windows Vista, and Windows 7 | Review ScanState log or LoadState log for details about command-line errors. |
+ | The store parameter is required but not specified | Review ScanState log or LoadState log for details about command-line errors. |
+ | The source-to-target domain mapping is invalid for /md | Review ScanState log or LoadState log for details about command-line errors. |
+ | The source-to-target user account mapping is invalid for /mu | Review ScanState log or LoadState log for details about command-line errors. |
+ | Undefined or incomplete command line option | Review ScanState log or LoadState log for details about command-line errors.
Category: Invalid Command Lines|
+ | Use /nocompress, or provide an XML file path with /p"pathtoafile" to get a compressed store size estimate | Review ScanState log or LoadState log for details about command-line errors. |
+ | User exclusion argument is invalid | Review ScanState log or LoadState log for details about command-line errors. |
+ | Verbosity level must be specified as a sum of the desired log options: Verbose (0x01), Record Objects (0x04), Echo to debug port (0x08) | Review ScanState log or LoadState log for details about command-line errors. |
+ | Volume shadow copy feature is not supported with a hardlink store | Review ScanState log or LoadState log for details about command-line errors. |
+ | Wait delay argument must be an integer | Review ScanState log or LoadState log for details about command-line errors. |
+
+- **12: USMT_ERROR_OPTION_PARAM_TOO_LARGE**
+
+ | Error message | Troubleshooting, mitigation, workarounds |
+ | --- | --- |
+ | Command line arguments cannot exceed 256 characters | Review ScanState log or LoadState log for details about command-line errors.
Category: Invalid Command Lines |
+ | Specified settings store path exceeds the maximum allowed length of 256 characters | Review ScanState log or LoadState log for details about command-line errors. |
+
+- **13: USMT_INIT_LOGFILE_FAILED**
+ - **Error message**: Log path argument is invalid for /l
+ - **Troubleshooting, mitigation, workarounds**: When /l is specified in the ScanState command line, USMT validates the path. Verify that the drive and other information, for example file system characters, are correct.
+ - **Category**: Invalid Command Lines
+
+- **14: USMT_ERROR_USE_LAC**
+ - **Error message**: Unable to create a local account because /lac was not specified
+ - **Troubleshooting, mitigation, workarounds**: When creating local accounts, the command-line options /lac and /lae should be used.
+ - **Category**: Invalid Command Lines
+
+- **26: USMT_INIT_ERROR**
+
+ | Error message | Troubleshooting, mitigation, workarounds |
+ | --- | --- |
+ | Multiple Windows installations found | Listfiles.txt could not be created. Verify that the location you specified for the creation of this file is valid.
Category: Setup and Initialization |
+ | Software malfunction or unknown exception | Check all loaded .xml files for errors, common error when using /I to load the Config.xml file. |
+ | Unable to find a valid Windows directory to proceed with requested offline operation; Check if offline input file is present and has valid entries | Verify that the offline input file is present and that it has valid entries. USMT could not find valid offline operating system. Verify your offline directory mapping. |
+
+- **27: USMT_INVALID_STORE_LOCATION**
+
+ | Error message | Troubleshooting, mitigation, workarounds |
+ | --- | --- |
+ | A store path can't be used because an existing store exists; specify /o to overwrite | Specify /o to overwrite an existing intermediate or migration store.
Category: Setup and Initialization |
+ | A store path is missing or has incomplete data | Make sure that the store path is accessible and that the proper permission levels are set. |
+ | An error occurred during store creation | Make sure that the store path is accessible and that the proper permission levels are set. Specify /o to overwrite an existing intermediate or migration store. |
+ | An inappropriate device such as a floppy disk was specified for the store | Make sure that the store path is accessible and that the proper permission levels are set. |
+ | Invalid store path; check the store parameter and/or file system permissions | Invalid store path; check the store parameter and/or file system permissions. |
+ | The file layout and/or file content is not recognized as a valid store | Make sure that the store path is accessible and that the proper permission levels are set. Specify /o to overwrite an existing intermediate or migration store. |
+ | The store path holds a store incompatible with the current USMT version | Make sure that the store path is accessible and that the proper permission levels are set. |
+ | The store save location is read-only or does not support a requested storage option | Make sure that the store path is accessible and that the proper permission levels are set. |
+
+- **28: USMT_UNABLE_GET_SCRIPTFILES**
+
+ | Error message | Troubleshooting, mitigation, workarounds |
+ | --- | --- |
+ | Script file is invalid for /i | Check all specified migration .xml files for errors. This is a common error when using /i to load the Config.xml file.
Category: Setup and Initialization |
+ | Unable to find a script file specified by /i | Verify the location of your script files, and ensure that the command-line options are correct. |
+
+- **29: USMT_FAILED_MIGSTARTUP**
+
+ | Error message | Troubleshooting, mitigation, workarounds |
+ | --- | --- |
+ | A minimum of 250 MB of free space is required for temporary files | Verify that the system meets the minimum temporary disk space requirement of 250 MB. As a workaround, you can set the environment variable `USMT_WORKING_DIR=` to redirect the temporary files working directory.
Category: Setup and Initialization |
+ | Another process is preventing migration; only one migration tool can run at a time | Check the ScanState log file for migration .xml file errors. |
+ | Failed to start main processing, look in log for system errors or check the installation | Check the ScanState log file for migration .xml file errors. |
+ | Migration failed because of an XML error; look in the log for specific details | Check the ScanState log file for migration .xml file errors. |
+ | Unable to automatically map the drive letters to match the online drive letter layout; Use /offline to provide a mapping table | Check the ScanState log file for migration .xml file errors. |
+
+- **31: USMT_UNABLE_FINDMIGUNITS**
+
+ - **Error message**: An error occurred during the discover phase; the log should have more specific information
+ - **Troubleshooting, mitigation, workarounds**: Check the ScanState log file for migration .xml file errors.
+ - **Category**: Setup and Initialization
+
+- **32: USMT_FAILED_SETMIGRATIONTYPE**
+ - **Error message**: An error occurred processing the migration system
+ - **Troubleshooting, mitigation, workarounds**: Check the ScanState log file for migration .xml file errors, or use online Help by typing /? on the command line.
+ - **Category**: Setup and Initialization
+
+- **33: USMT_UNABLE_READKEY**
+
+ | Error message | Troubleshooting, mitigation, workarounds |
+ | --- | --- |
+ | Error accessing the file specified by the /keyfile parameter | Check the ScanState log file for migration .xml file errors, or use online Help by typing /? on the command line.
Category: Setup and Initialization |
+ | The encryption key must have at least one character | Check the ScanState log file for migration .xml file errors, or use online Help by typing /? on the command line. |
+
+- **34: USMT_ERROR_INSUFFICIENT_RIGHTS**
+
+ | Error message | Troubleshooting, mitigation, workarounds |
+ | --- | --- |
+ | Directory removal requires elevated privileges | Log on as Administrator, and run with elevated privileges.
Category: Setup and Initialization |
+ | No rights to create user profiles; log in as Administrator; run with elevated privileges | Log on as Administrator, and run with elevated privileges. |
+ | No rights to read or delete user profiles; log in as Administrator, run with elevated privileges | Log on as Administrator, and run with elevated privileges. |
+
+- **35: USMT_UNABLE_DELETE_STORE**
+
+ | Error message | Troubleshooting, mitigation, workarounds |
+ | --- | --- |
+ | A reboot is required to remove the store | Reboot to delete any files that could not be deleted when the command was executed.
Category: Setup and Initialization |
+ | A store path can't be used because it contains data that could not be overwritten | A migration store could not be deleted. If you are using a hardlink migration store you might have a locked file in it. You should manually delete the store, or use **USMTUtils /rd** command to delete the store. |
+ | There was an error removing the store | Review ScanState log or LoadState log for details about command-line errors. |
+
+- **36: USMT_ERROR_UNSUPPORTED_PLATFORM**
+
+ | Error message | Troubleshooting, mitigation, workarounds |
+ | --- | --- |
+ | Compliance check failure; please check the logs for details | Investigate whether there is an active temporary profile on the system.
Category: Setup and Initialization |
+ | Use of /offline is not supported during apply | The **/offline** command was not used while running in the Windows Preinstallation Environment (WinPE). |
+ | Use /offline to run gather on this platform | The **/offline** command was not used while running in WinPE. |
+
+- **37: USMT_ERROR_NO_INVALID_KEY**
+ - **Error message**: The store holds encrypted data but the correct encryption key was not provided
+ - **Troubleshooting, mitigation, workarounds**: Verify that you have included the correct encryption /key or /keyfile.
+ - **Category**: Setup and Initialization
+
+- **38: USMT_ERROR_CORRUPTED_NOTENCRYPTED_STORE**
+ - **Error message**: An error occurred during store access
+ - **Troubleshooting, mitigation, workarounds**: Review ScanState log or LoadState log for details about command-line errors. Make sure that the store path is accessible and that the proper permission levels are set.
+ - **Category**: Setup and Initialization
+
+- **39: USMT_UNABLE_TO_READ_CONFIG_FILE**
+
+ | Error message | Troubleshooting, mitigation, workarounds |
+ | --- | --- |
+ | Error reading Config.xml | Review ScanState log or LoadState log for details about command-line errors in the Config.xml file.
Category: Setup and Initialization |
+ | File argument is invalid for /config | Check the command line you used to load the Config.xml file. You can use online Help by typing /? on the command line. |
+
+- **40: USMT_ERROR_UNABLE_CREATE_PROGRESS_LOG**
+
+ | Error message | Troubleshooting, mitigation, workarounds |
+ | --- | --- |
+ | Error writing to the progress log | The Progress log could not be created. Verify that the location is valid and that you have write access.
Category: Setup and Initialization |
+ | Progress log argument is invalid for /progress | The Progress log could not be created. Verify that the location is valid and that you have write access. |
+
+- **41: USMT_PREFLIGHT_FILE_CREATION_FAILED**
+
+ | Error message | Troubleshooting, mitigation, workarounds |
+ | --- | --- |
+ | Can't overwrite existing file | The Progress log could not be created. Verify that the location is valid and that you have write access.
Category: Setup and Initialization |
+ | Invalid space estimate path. Check the parameters and/or file system permissions | Review ScanState log or LoadState log for details about command-line errors. |
+
+- **42: USMT_ERROR_CORRUPTED_STORE**
+ - **Error message**: The store contains one or more corrupted files
+ - **Troubleshooting, mitigation, workarounds**: Review UsmtUtils log for details about the corrupted files. For information on how to extract the files that are not corrupted, see [Extract Files from a Compressed USMT Migration Store](usmt-extract-files-from-a-compressed-migration-store.md).
+
+- **61: USMT_MIGRATION_STOPPED_NONFATAL**
+ - **Error message**: Processing stopped due to an I/O error
+ - **Troubleshooting, mitigation, workarounds**: USMT exited but can continue with the /c command-line option, with the optional configurable <ErrorControl> section or by using the /vsc command-line option.
+ - **Category**: Non-fatal Errors
+
+- **71: USMT_INIT_OPERATING_ENVIRONMENT_FAILED**
+
+ | Error message | Troubleshooting, mitigation, workarounds |
+ | --- | --- |
+ | A Windows Win32 API error occurred | Data transfer has begun, and there was an error during the creation of migration store or during the apply phase. Review the ScanState log or LoadState log for details.
Category: Fatal Errors |
+ | An error occurred when attempting to initialize the diagnostic mechanisms such as the log | Data transfer has begun, and there was an error during the creation of migration store or during the apply phase. Review the ScanState log or LoadState log for details. |
+ | Failed to record diagnostic information | Data transfer has begun, and there was an error during the creation of migration store or during the apply phase. Review the ScanState log or LoadState log for details. |
+ | Unable to start. Make sure you are running USMT with elevated privileges | Exit USMT and log in again with elevated privileges. |
+
+- **72: USMT_UNABLE_DOMIGRATION**
+
+ | Error message | Troubleshooting, mitigation, workarounds |
+ | --- | --- |
+ | An error occurred closing the store | Data transfer has begun, and there was an error during migration-store creation or during the apply phase. Review the ScanState log or LoadState log for details.
Category: Fatal Errors|
+ | An error occurred in the apply process | Data transfer has begun, and there was an error during migration-store creation or during the apply phase. Review the ScanState log or LoadState log for details. |
+ | An error occurred in the gather process | Data transfer has begun, and there was an error during migration-store creation or during the apply phase. Review the ScanState log or LoadState log for details. |
+ | Out of disk space while writing the store | Data transfer has begun, and there was an error during migration-store creation or during the apply phase. Review the ScanState log or LoadState log for details. |
+ | Out of temporary disk space on the local system | Data transfer has begun, and there was an error during migration-store creation or during the apply phase. Review the ScanState log or LoadState log for details. |
## Related topics
-
[User State Migration Tool (USMT) Troubleshooting](usmt-troubleshooting.md)
[Log Files](usmt-log-files.md)
-
-
-
diff --git a/windows/deployment/usmt/usmt-scanstate-syntax.md b/windows/deployment/usmt/usmt-scanstate-syntax.md
index eaaf29d214..37fb5cbc81 100644
--- a/windows/deployment/usmt/usmt-scanstate-syntax.md
+++ b/windows/deployment/usmt/usmt-scanstate-syntax.md
@@ -16,12 +16,10 @@ ms.topic: article
# ScanState Syntax
-
The ScanState command is used with the User State Migration Tool (USMT) 10.0 to scan the source computer, collect the files and settings, and create a store.
## In This Topic
-
[Before You Begin](#bkmk-beforeyoubegin)
[Syntax](#bkmk-syntax)
@@ -40,7 +38,6 @@ The ScanState command is used with the User State Migration Tool (USMT) 10.0 to
## Before You Begin
-
Before you run the **ScanState** command, note the following:
- To ensure that all operating system settings migrate, in most cases you must run the **ScanState** commands in administrator mode from an account with administrative credentials.
@@ -59,7 +56,6 @@ Before you run the **ScanState** command, note the following:
## Syntax
-
This section explains the syntax and usage of the **ScanState** command-line options. The options can be specified in any order. If the option contains a parameter, you can use either a colon or a space separator.
The **ScanState** command's syntax is:
@@ -76,80 +72,20 @@ To create an encrypted store using the Config.xml file and the default migration
## Storage Options
-
-
-
-
-
-
-
-
-
Command-Line Option
-
Description
-
-
-
-
-
StorePath
-
Indicates a folder where files and settings will be saved. Note that StorePath cannot be C:\. You must specify the StorePath option in the ScanState command, except when using the /genconfig option. You cannot specify more than one StorePath location.
-
-
-
/apps
-
Scans the image for apps and includes them and their associated registry settings.
-
-
-
/ppkg [<FileName>]
-
Exports to a specific file location.
-
-
-
/o
-
Required to overwrite any existing data in the migration store or Config.xml file. If not specified, the ScanState command will fail if the migration store already contains data. You cannot use this option more than once on a command line.
-
-
-
/vsc
-
This option enables the volume shadow-copy service to migrate files that are locked or in use. This command-line option eliminates most file-locking errors that are typically encountered by the <ErrorControl> section.
-
This option can be used only with the ScanState executable file and cannot be combined with the /hardlink option.
-
-
-
/hardlink
-
Enables the creation of a hard-link migration store at the specified location. The /nocompress option must be specified with the /hardlink option.
-
-
-
/encrypt [{/key:<KeyString> | /keyfile:<file>]}
-
Encrypts the store with the specified key. Encryption is disabled by default. With this option, you will need to specify the encryption key-in one of the following ways:
-
-
/key:KeyString specifies the encryption key. If there is a space in KeyString, you will need to surround KeyString with quotation marks.
-
/keyfile:FilePathAndName specifies a text (.txt) file that contains the encryption key.
-
-
We recommend that KeyString be at least eight characters long, but it cannot exceed 256 characters. The /key and /keyfile options cannot be used on the same command line. The /encrypt and /nocompress options cannot be used on the same command line.
-
-Important
You should use caution with this option, because anyone who has access to the ScanState command-line script will also have access to the encryption key.
-
-
-
-
-
The following example shows the ScanState command and the /key option:
The /encrypt option accepts a command-line parameter to define the encryption strength to be used for encryption of the migration store. For more information about supported encryption algorithms, see Migration Store Encryption.
-
-
-
/nocompress
-
Disables compression of data and saves the files to a hidden folder named "File" at StorePath\USMT. Compression is enabled by default. Combining the /nocompress option with the /hardlink option generates a hard-link migration store. You can use the uncompressed store to view what USMT stored, troubleshoot a problem, or run an antivirus utility against the files. You should use this option only in testing environments, because we recommend that you use a compressed store during your actual migration, unless you are combining the /nocompress option with the /hardlink option.
-
The /nocompress and /encrypt options cannot be used together in one statement on the command line. However, if you do choose to migrate an uncompressed store, the LoadState command will migrate each file directly from the store to the correct location on the destination computer without a temporary location.
-
-
+| Command-Line Option | Description |
+|-----|-----|
+| *StorePath* | Indicates a folder where files and settings will be saved. Note that *StorePath* cannot be **C:\**. You must specify the *StorePath* option in the **ScanState** command, except when using the **/genconfig** option. You cannot specify more than one *StorePath* location. |
+| **/apps** | Scans the image for apps and includes them and their associated registry settings. |
+| **/ppkg** [*<FileName>*] | Exports to a specific file location. |
+| **/o** | Required to overwrite any existing data in the migration store or Config.xml file. If not specified, the **ScanState** command will fail if the migration store already contains data. You cannot use this option more than once on a command line. |
+| **/vsc** | This option enables the volume shadow-copy service to migrate files that are locked or in use. This command-line option eliminates most file-locking errors that are typically encountered by the **<ErrorControl>** section.
This option can be used only with the ScanState executable file and cannot be combined with the **/hardlink** option. |
+| **/hardlink** | Enables the creation of a hard-link migration store at the specified location. The **/nocompress** option must be specified with the **/hardlink** option. |
+| **/encrypt** [{**/key:** *<KeyString>* | **/keyfile**:*<file>*]} | Encrypts the store with the specified key. Encryption is disabled by default. With this option, you will need to specify the encryption key-in one of the following ways:
**/key:** *KeyString* specifies the encryption key. If there is a space in *KeyString*, you will need to surround *KeyString* with quotation marks.
**/keyfile:** *FilePathAndName* specifies a text (.txt) file that contains the encryption key.
We recommend that *KeyString* be at least eight characters long, but it cannot exceed 256 characters. The **/key** and **/keyfile** options cannot be used on the same command line. The **/encrypt** and **/nocompress** options cannot be used on the same command line.
**Important** You should use caution with this option, because anyone who has access to the **ScanState** command-line script will also have access to the encryption key.
The following example shows the ScanState command and the **/key** option: `scanstate /i:migdocs.xml /i:migapp.xml \server\share\migration\mystore /encrypt /key:mykey` |
+| **/encrypt**:*<EncryptionStrength>* | The **/encrypt** option accepts a command-line parameter to define the encryption strength to be used for encryption of the migration store. For more information about supported encryption algorithms, see [Migration Store Encryption](usmt-migration-store-encryption.md). |
+| **/nocompress** | Disables compression of data and saves the files to a hidden folder named "File" at *StorePath*\USMT. Compression is enabled by default. Combining the **/nocompress** option with the **/hardlink** option generates a hard-link migration store. You can use the uncompressed store to view what USMT stored, troubleshoot a problem, or run an antivirus utility against the files. You should use this option only in testing environments, because we recommend that you use a compressed store during your actual migration, unless you are combining the **/nocompress** option with the **/hardlink** option.
The **/nocompress** and **/encrypt** options cannot be used together in one statement on the command line. However, if you do choose to migrate an uncompressed store, the **LoadState** command will migrate each file directly from the store to the correct location on the destination computer without a temporary location.
For example: `scanstate /i:migdocs.xml /i:migapp.xml \server\share\migration\mystore /nocompress` |
## Run the ScanState Command on an Offline Windows System
-
You can run the **ScanState** command in Windows Preinstallation Environment (WinPE). In addition, USMT supports migrations from previous installations of Windows contained in Windows.old directories. The offline directory can be a Windows directory when you run the **ScanState** command in WinPE or a Windows.old directory when you run the **ScanState** command in Windows.
There are several benefits to running the **ScanState** command on an offline Windows image, including:
@@ -172,445 +108,87 @@ There are several benefits to running the **ScanState** command on an offline Wi
## Offline Migration Options
-
-
-
-
-
-
-
-
-
Command-Line Option
-
Definition
-
-
-
-
-
/offline:"path to an offline.xml file"
-
This option is used to define a path to an offline .xml file that might specify other offline migration options, for example, an offline Windows directory or any domain or folder redirection required in your migration.
-
-
-
/offlinewindir:"path to a Windows directory"
-
This option specifies the offline Windows directory that the ScanState command gathers user state from. The offline directory can be Windows.old when you run the ScanState command in Windows or a Windows directory when you run the ScanState command in WinPE.
-
-
-
/offlinewinold:"Windows.old directory"
-
This command-line option enables the offline migration mode and starts the migration from the location specified. It is only intended to be used in Windows.old migration scenarios, where the migration is occurring from a Windows.old directory.
-
-
-
-
-
+|Command-Line Option|Definition|
+|--- |--- |
+|**/offline:** *"path to an offline.xml file"*|This option is used to define a path to an offline .xml file that might specify other offline migration options, for example, an offline Windows directory or any domain or folder redirection required in your migration.|
+|**/offlinewindir:** *"path to a Windows directory"*|This option specifies the offline Windows directory that the **ScanState** command gathers user state from. The offline directory can be Windows.old when you run the **ScanState** command in Windows or a Windows directory when you run the **ScanState** command in WinPE.|
+|**/offlinewinold:** *"Windows.old directory"*|This command-line option enables the offline migration mode and starts the migration from the location specified. It is only intended to be used in Windows.old migration scenarios, where the migration is occurring from a Windows.old directory.|
## Migration Rule Options
-
USMT provides the following options to specify what files you want to migrate.
-
-
-
-
-
-
-
-
Command-Line Option
-
Description
-
-
-
-
-
/i:[Path]FileName
-
(include)
-
Specifies an .xml file that contains rules that define what user, application, or system state to migrate. You can specify this option multiple times to include all of your .xml files (MigApp.xml, MigDocs.xml, and any custom .xml files that you create). Path can be either a relative or full path. If you do not specify the Path variable, then FileName must be located in the current directory. For more information about which files to specify, see the "XML Files" section of the Frequently Asked Questions topic.
-
-
-
/genconfig:[Path]FileName
-
(Generate Config.xml)
-
Generates the optional Config.xml file, but does not create a migration store. To ensure that this file contains every component, application and setting that can be migrated, you should create this file on a source computer that contains all the components, applications, and settings that will be present on the destination computers. In addition, you should specify the other migration .xml files, using the /i option, when you specify this option.
-
After you create this file, you will need to make use of it with the ScanState command using the /config option.
-
The only options that you can specify with this option are the /i, /v, and /l options. You cannot specify StorePath, because the /genconfig option does not create a store. Path can be either a relative or full path. If you do not specify the Path variable, then FileName will be created in the current directory.
-
Examples:
-
-
The following example creates a Config.xml file in the current directory:
Specifies the Config.xml file that the ScanState command should use to create the store. You cannot use this option more than once on the command line. Path can be either a relative or full path. If you do not specify the Path variable, then FileName must be located in the current directory.
-
The following example creates a store using the Config.xml file, MigDocs.xml, and MigApp.xml files:
This option enables you to specify the location of the default .xml files and then begin the migration. If no path is specified, USMT will reference the directory where the USMT binaries are located. The /auto option has the same effect as using the following options: /i: MigDocs.xml/i:MigApp.xml /v:5.
-
-
-
/genmigxml:path to a file
-
This option specifies that the ScanState command should use the document finder to create and export an .xml file that defines how to migrate all of the files on the computer on which the ScanState command is running.
-
-
-
/targetwindows8
-
Optimizes Scanstate.exe when using USMT 10.0 to migrate a user state to Windows 8 or Windows 8.1 instead of Windows 10. You should use this command-line option in the following scenarios:
-
-
To create a Config.xml file by using the /genconfig option. Using the /targetwindows8 option optimizes the Config.xml file so that it only contains components that relate to Windows 8 or Windows 8.1.
-
To create a migration store. Using the /targetwindows8 option ensures that the ScanState tool gathers the correct set of operating system settings. Without the /targetwindows8 command-line option, some settings can be lost during the migration.
-
-
-
-
/targetwindows7
-
Optimizes Scanstate.exe when using USMT 10.0 to migrate a user state to Windows 7 instead of Windows 10. You should use this command-line option in the following scenarios:
-
-
To create a Config.xml file by using the /genconfig option. Using the /targetwindows7 option optimizes the Config.xml file so that it only contains components that relate to Windows 7.
-
To create a migration store. Using the /targetwindows7 option ensures that the ScanState tool gathers the correct set of operating system settings. Without the /targetwindows7 command-line option, some settings can be lost during the migration.
-
-
-
-
/localonly
-
Migrates only files that are stored on the local computer, regardless of the rules in the .xml files that you specify on the command line. You should use this option when you want to exclude the data from removable drives on the source computer, such as USB flash drives (UFDs), some external hard drives, and so on, and when there are network drives mapped on the source computer. If the /localonly option is not specified, then the ScanState command will copy files from these removable or network drives into the store.
-
Anything that is not considered a fixed drive by the OS will be excluded by /localonly. In some cases large external hard drives are considered fixed drives. These drives can be explicitly excluded from migration by using a custom.xml file. For more information about how to exclude all files on a specific drive, see Exclude Files and Settings.
-
The /localonly command-line option includes or excludes data in the migration as identified in the following table:
Specifies an .xml file that contains rules that define what user, application, or system state to migrate. You can specify this option multiple times to include all of your .xml files (MigApp.xml, MigDocs.xml, and any custom .xml files that you create). *Path* can be either a relative or full path. If you do not specify the *Path* variable, then *FileName* must be located in the current directory. For more information about which files to specify, see the "XML Files" section of the [Frequently Asked Questions](usmt-faq.yml) topic. |
+| **/genconfig:**[*Path*]*FileName* | (Generate **Config.xml**)
Generates the optional Config.xml file, but does not create a migration store. To ensure that this file contains every component, application and setting that can be migrated, you should create this file on a source computer that contains all the components, applications, and settings that will be present on the destination computers. In addition, you should specify the other migration .xml files, using the **/i** option, when you specify this option.
After you create this file, you will need to make use of it with the **ScanState** command using the **/config** option.
The only options that you can specify with this option are the **/i**, **/v**, and **/l** options. You cannot specify *StorePath*, because the **/genconfig** option does not create a store. *Path* can be either a relative or full path. If you do not specify the *Path* variable, then *FileName* will be created in the current directory.
Examples:
The following example creates a Config.xml file in the current directory: `scanstate /i:migapp.xml /i:migdocs.xml /genconfig:config.xml /v:13`
|
+| **/config:**[*Path*]*FileName* | Specifies the Config.xml file that the **ScanState** command should use to create the store. You cannot use this option more than once on the command line. *Path* can be either a relative or full path. If you do not specify the *Path* variable, then *FileName* must be located in the current directory.
The following example creates a store using the Config.xml file, MigDocs.xml, and MigApp.xml files: `scanstate \server\share\migration\mystore /config:config.xml /i:migdocs.xml /i:migapp.xml /v:13 /l:scan.log`
The following example migrates the files and settings to the destination computer using the **Config.xml**, **MigDocs.xml**, and **MigApp.xml** files: `loadstate \server\share\migration\mystore /config:config.xml /i:migdocs.xml /i:migapp.xml /v:13 /l:load.log` |
+| **/auto:** *path to script files* | This option enables you to specify the location of the default .xml files and then begin the migration. If no path is specified, USMT will reference the directory where the USMT binaries are located. The **/auto** option has the same effect as using the following options: **/i: MigDocs.xml** **/i:MigApp.xml /v:5**. |
+| **/genmigxml:** *path to a file* | This option specifies that the **ScanState** command should use the document finder to create and export an .xml file that defines how to migrate all of the files on the computer on which the **ScanState** command is running. |
+| **/targetwindows8** | Optimizes Scanstate.exe when using USMT 10.0 to migrate a user state to Windows 8 or Windows 8.1 instead of Windows 10. You should use this command-line option in the following scenarios:
**To create a Config.xml file by using the /genconfig option.** Using the **/targetwindows8** option optimizes the Config.xml file so that it only contains components that relate to Windows 8 or Windows 8.1.
**To create a migration store.** Using the **/targetwindows8** option ensures that the ScanState tool gathers the correct set of operating system settings. Without the **/targetwindows8** command-line option, some settings can be lost during the migration.
|
+| **/targetwindows7** | Optimizes Scanstate.exe when using USMT 10.0 to migrate a user state to Windows 7 instead of Windows 10. You should use this command-line option in the following scenarios:
**To create a Config.xml file by using the /genconfig option.** Using the **/targetwindows7** option optimizes the Config.xml file so that it only contains components that relate to Windows 7.
**To create a migration store.** Using the **/targetwindows7** option ensures that the ScanState tool gathers the correct set of operating system settings. Without the **/targetwindows7** command-line option, some settings can be lost during the migration.
|
+| **/localonly** | Migrates only files that are stored on the local computer, regardless of the rules in the .xml files that you specify on the command line. You should use this option when you want to exclude the data from removable drives on the source computer, such as USB flash drives (UFDs), some external hard drives, and so on, and when there are network drives mapped on the source computer. If the **/localonly** option is not specified, then the **ScanState** command will copy files from these removable or network drives into the store.
Anything that is not considered a fixed drive by the OS will be excluded by **/localonly**. In some cases large external hard drives are considered fixed drives. These drives can be explicitly excluded from migration by using a custom.xml file. For more information about how to exclude all files on a specific drive, see [Exclude Files and Settings](usmt-exclude-files-and-settings.md).
The **/localonly** command-line option includes or excludes data in the migration as identified in the following:
**Removable drives such as a USB flash drive** - Excluded
**Network drives** - Excluded
**Fixed drives** - Included
|
## Monitoring Options
-
USMT provides several options that you can use to analyze problems that occur during migration.
-> [!NOTE]
+> [!NOTE]
> The ScanState log is created by default, but you can specify the name and location of the log with the **/l** option.
-
-
-
-
-
-
-
-
-
-
Command-Line Option
-
Description
-
-
-
-
-
/listfiles:<FileName>
-
You can use the /listfiles command-line option with the ScanState command to generate a text file that lists all of the files included in the migration.
-
-
-
/l:[Path]FileName
-
Specifies the location and name of the ScanState log.
-
You cannot store any of the log files in StorePath. Path can be either a relative or full path. If you do not specify the Path variable, then the log will be created in the current directory. You can use the /v option to adjust the amount of output.
-
If you run the ScanState or LoadState commands from a shared network resource, you must specify this option or USMT will fail with the following error: "USMT was unable to create the log file(s)". To fix this issue, use the /l: scan.log command.
-
-
-
/v:<VerbosityLevel>
-
(Verbosity)
-
Enables verbose output in the ScanState log file. The default value is 0.
-
You can set the VerbosityLevel to one of the following levels:
Creates the optional progress log. You cannot store any of the log files in StorePath. Path can be either a relative or full path. If you do not specify the Path variable, then FileName will be created in the current directory.
When this option is specified, the ScanState command will continue to run, even if non-fatal errors occur. Any files or settings that cause an error are logged in the progress log. For example, if there is a large file that will not fit in the store, the ScanState command will log an error and continue with the migration. In addition, if a file is open or in use by an application, USMT may not be able to migrate the file and will log an error. Without the /c option, the ScanState command will exit on the first error.
-
You can use the new <ErrorControl> section in the Config.xml file to specify which file or registry read/write errors can be safely ignored and which might cause the migration to fail. This enables the /c command-line option to safely skip all input/output (I/O) errors in your environment. In addition, the /genconfig option now generates a sample <ErrorControl> section that is enabled by specifying error messages and desired behaviors in the Config.xml file.
-
-
-
/r:<TimesToRetry>
-
(Retry)
-
Specifies the number of times to retry when an error occurs while saving the user state to a server. The default is three times. This option is useful in environments where network connectivity is not reliable.
-
While storing the user state, the /r option will not be able to recover data that is lost due to a network-hardware failure, such as a faulty or disconnected network cable, or when a virtual private network (VPN) connection fails. The retry option is intended for large, busy networks where connectivity is satisfactory, but communication latency is a problem.
-
-
-
/w:<SecondsBeforeRetry>
-
(Wait)
-
Specifies the time to wait, in seconds, before retrying a network file operation. The default is 1 second.
-
-
-
/p:<pathToFile>
-
When the ScanState command runs, it will create an .xml file in the path specified. This .xml file includes improved space estimations for the migration store. The following example shows how to create this .xml file:
To preserve the functionality of existing applications or scripts that require the previous behavior of USMT, you can use the /p option, without specifying "pathtoafile", in USMT. If you specify only the /p option, the storage space estimations are created in the same manner as with USMT3.x releases.
-
-
-
/? or /help
-
Displays Help at the command line.
-
-
-
-
-
+| Command-Line Option | Description |
+|-----|-----|
+| **/listfiles**:<FileName> | You can use the **/listfiles** command-line option with the **ScanState** command to generate a text file that lists all of the files included in the migration. |
+| **/l:**[*Path*]*FileName* | Specifies the location and name of the ScanState log.
You cannot store any of the log files in *StorePath*. *Path* can be either a relative or full path. If you do not specify the *Path* variable, then the log will be created in the current directory. You can use the **/v** option to adjust the amount of output.
If you run the **ScanState** or **LoadState** commands from a shared network resource, you must specify this option or USMT will fail with the following error: "USMT was unable to create the log file(s)". To fix this issue, use the /**l: scan.log** command. |
+| **/v:***<VerbosityLevel>* | **(Verbosity)**
Enables verbose output in the ScanState log file. The default value is 0.
You can set the *VerbosityLevel* to one of the following levels:
**0** - Only the default errors and warnings are enabled.
**1** - Enables verbose output.
**4** - Enables error and status output.
**5** - Enables verbose and status output.
**8** - Enables error output to a debugger.
**9** - Enables verbose output to a debugger.
**12** - Enables error and status output to a debugger.
**13** - Enables verbose, status, and debugger output.
For example: `scanstate \server\share\migration\mystore /v:13 /i:migdocs.xml /i:migapp.xml`|
+| /**progress**:[*Path*]*FileName* | Creates the optional progress log. You cannot store any of the log files in *StorePath*. *Path* can be either a relative or full path. If you do not specify the *Path* variable, then *FileName* will be created in the current directory.
For example: `scanstate /i:migapp.xml /i:migdocs.xml \server\share\migration\mystore /progress:prog.log /l:scanlog.log` |
+| **/c** | When this option is specified, the **ScanState** command will continue to run, even if non-fatal errors occur. Any files or settings that cause an error are logged in the progress log. For example, if there is a large file that will not fit in the store, the **ScanState** command will log an error and continue with the migration. In addition, if a file is open or in use by an application, USMT may not be able to migrate the file and will log an error. Without the **/c** option, the **ScanState** command will exit on the first error.
You can use the new <**ErrorControl**> section in the Config.xml file to specify which file or registry read/write errors can be safely ignored and which might cause the migration to fail. This enables the /**c** command-line option to safely skip all input/output (I/O) errors in your environment. In addition, the /**genconfig** option now generates a sample <**ErrorControl**> section that is enabled by specifying error messages and desired behaviors in the Config.xml file. |
+| **/r:***<TimesToRetry>* | **(Retry)**
Specifies the number of times to retry when an error occurs while saving the user state to a server. The default is three times. This option is useful in environments where network connectivity is not reliable.
While storing the user state, the **/r** option will not be able to recover data that is lost due to a network-hardware failure, such as a faulty or disconnected network cable, or when a virtual private network (VPN) connection fails. The retry option is intended for large, busy networks where connectivity is satisfactory, but communication latency is a problem. |
+| **/w:***<SecondsBeforeRetry>* | **(Wait)**
Specifies the time to wait, in seconds, before retrying a network file operation. The default is 1 second. |
+| **/p:***<pathToFile>* | When the **ScanState** command runs, it will create an .xml file in the path specified. This .xml file includes improved space estimations for the migration store. The following example shows how to create this .xml file: `Scanstate.exe C:\MigrationLocation [additional parameters]` `/p:"C:\MigrationStoreSize.xml"`
For more information, see [Estimate Migration Store Size](usmt-estimate-migration-store-size.md).
To preserve the functionality of existing applications or scripts that require the previous behavior of USMT, you can use the **/p** option, without specifying *"pathtoafile"*, in USMT. If you specify only the **/p** option, the storage space estimations are created in the same manner as with USMT3.x releases. |
+| /**?** or /**help** | Displays Help at the command line. |
## User Options
-
By default, all users are migrated. The only way to specify which users to include and exclude is by using the following options. You cannot exclude users in the migration .xml files or using the Config.xml file. For more information, see [Identify Users](usmt-identify-users.md) and [Migrate User Accounts](usmt-migrate-user-accounts.md).
-
-
-
-
-
-
-
-
Command-Line Option
-
Description
-
-
-
-
-
/all
-
Migrates all of the users on the computer.
-
USMT migrates all user accounts on the computer, unless you specifically exclude an account with either the /ue or /uel options. For this reason, you do not need to specify this option on the command line. However, if you choose to specify the /all option, you cannot also use the /ui, /ue or /uel options.
-
-
-
/ui:<DomainName>\<UserName>
-
or
-
/ui:<ComputerName>\<LocalUserName>
-
(User include)
-
Migrates the specified users. By default, all users are included in the migration. Therefore, this option is helpful only when used with the /ue or /uel options. You can specify multiple /ui options, but you cannot use the /ui option with the /all option. DomainName and UserName can contain the asterisk () wildcard character. When you specify a user name that contains spaces, you will need to surround it with quotation marks.
-
-Note
If a user is specified for inclusion with the /ui option, and also is specified to be excluded with either the /ue or /uel options, the user will be included in the migration.
-
-
-
-
-
For example:
-
-
To include only User2 from the Fabrikam domain, type:
-
/ue:*\* /ui:fabrikam\user2
-
To migrate all users from the Fabrikam domain, and only the user accounts from other domains that have been active or otherwise modified in the last 30 days, type:
-
/uel:30 /ui:fabrikam\*
-
In this example, a user account from the Contoso domain that was last modified two months ago will not be migrated.
-
-
For more examples, see the descriptions of the /ue and /ui options in this table.
-
-
-
/uel:<NumberOfDays>
-
or
-
/uel:<YYYY/MM/DD>
-
or
-
/uel:0
-
(User exclude based on last logon)
-
Migrates the users that logged on to the source computer within the specified time period, based on the Last Modified date of the Ntuser.dat file on the source computer. The /uel option acts as an include rule. For example, the /uel:30 option migrates users who logged on, or whose account was modified, within the last 30 days from the date when the ScanState command is run.
-
You can specify a number of days or you can specify a date. You cannot use this option with the /all option. USMT retrieves the last logon information from the local computer, so the computer does not need to be connected to the network when you run this option. In addition, if a domain user has logged on to another computer, that logon instance is not considered by USMT.
-
-Note
The /uel option is not valid in offline migrations.
-
-
-
-
-
-
/uel:0 migrates any users who are currently logged on.
-
/uel:90 migrates users who have logged on, or whose accounts have been otherwise modified, within the last 90 days.
-
/uel:1 migrates users whose account has been modified within the last 24 hours.
-
/uel:2002/1/15 migrates users who have logged on or been modified January 15, 2002 or afterwards.
Excludes the specified users from the migration. You can specify multiple /ue options. You cannot use this option with the /all option. <DomainName> and <UserName> can contain the asterisk () wildcard character. When you specify a user name that contains spaces, you need to surround it with quotation marks.
-
-
+| Command-Line Option | Description |
+|-----|-----|
+| /**all** | Migrates all of the users on the computer.
USMT migrates all user accounts on the computer, unless you specifically exclude an account with either the /**ue** or /**uel** options. For this reason, you do not need to specify this option on the command line. However, if you choose to specify the /**all** option, you cannot also use the /**ui**, /**ue** or /**uel** options. |
+| /**ui**:*<DomainName>*\*<UserName>* or /**ui**:*<ComputerName>*\*<LocalUserName>* | **(User include)**
Migrates the specified users. By default, all users are included in the migration. Therefore, this option is helpful only when used with the /**ue** or /**uel** options. You can specify multiple /**ui** options, but you cannot use the /**ui** option with the /**all** option. *DomainName* and *UserName* can contain the asterisk () wildcard character. When you specify a user name that contains spaces, you will need to surround it with quotation marks.
**Note** If a user is specified for inclusion with the /**ui** option, and also is specified to be excluded with either the /**ue** or /**uel** options, the user will be included in the migration.
For example:
To include only User2 from the Fabrikam domain, type: `/ue:*\* /ui:fabrikam\user2`
To migrate all users from the Fabrikam domain, and only the user accounts from other domains that have been active or otherwise modified in the last 30 days, type: `/uel:30 /ui:fabrikam\*` In this example, a user account from the Contoso domain that was last modified two months ago will not be migrated.
For more examples, see the descriptions of the /**ue** and /**ui** options in this table. |
+| /**uel**:*<NumberOfDays>* or /**uel**:*<YYYY/MM/DD>* or **/uel:0** | **(User exclude based on last logon)**
Migrates the users that logged on to the source computer within the specified time period, based on the **Last Modified** date of the Ntuser.dat file on the source computer. The /**uel** option acts as an include rule. For example, the **/uel:30** option migrates users who logged on, or whose account was modified, within the last 30 days from the date when the ScanState command is run.
You can specify a number of days or you can specify a date. You cannot use this option with the /**all** option. USMT retrieves the last logon information from the local computer, so the computer does not need to be connected to the network when you run this option. In addition, if a domain user has logged on to another computer, that logon instance is not considered by USMT.
**Note** The /**uel** option is not valid in offline migrations.
**/uel:0** migrates any users who are currently logged on.
**/uel:90** migrates users who have logged on, or whose accounts have been otherwise modified, within the last 90 days.
**/uel:1** migrates users whose account has been modified within the last 24 hours.
**/uel:2002/1/15** migrates users who have logged on or been modified January 15, 2002 or afterwards.
Excludes the specified users from the migration. You can specify multiple /**ue** options. You cannot use this option with the /**all** option. *<DomainName>* and *<UserName>* can contain the asterisk () wildcard character. When you specify a user name that contains spaces, you need to surround it with quotation marks.
For example: `scanstate /i:migdocs.xml /i:migapp.xml \\server\share\migration\mystore /ue:contoso\user1` |
## How to Use /ui and /ue
-
The following examples apply to both the /**ui** and /**ue** options. You can replace the /**ue** option with the /**ui** option to include, rather than exclude, the specified users.
-
-
-
-
-
-
-
-
Behavior
-
Command
-
-
-
-
-
Exclude the user named User One in the Fabrikam domain.
-
/ue:"fabrikam\user one"
-
-
-
Exclude the user named User1 in the Fabrikam domain.
-
/ue:fabrikam\user1
-
-
-
Exclude the local user named User1.
-
/ue:%computername%\user1
-
-
-
Exclude all domain users.
-
/ue:Domain\*
-
-
-
Exclude all local users.
-
/ue:%computername%\*
-
-
-
Exclude users in all domains named User1, User2, and so on.
-
/ue:*\user*
-
-
-
-
-
+|Behavior|Command|
+|--- |--- |
+|Exclude the user named User One in the Fabrikam domain.|`/ue:"fabrikam\user one"`|
+|Exclude the user named User1 in the Fabrikam domain.|`/ue:fabrikam\user1`|
+|Exclude the local user named User1.|`/ue:%computername%\user1`|
+|Exclude all domain users.|`/ue:Domain\*`|
+|Exclude all local users.|`/ue:%computername%\*`|
+|Exclude users in all domains named User1, User2, and so on.|`/ue:*\user*`|
## Using the Options Together
-
You can use the /**uel**, /**ue** and /**ui** options together to migrate only the users that you want migrated.
The /**ui** option has precedence over the /**ue** and /**uel** options. If a user is specified to be included using the /**ui** option, and also specified to be excluded using either the /**ue** or /**uel** options, the user will be included in the migration. For example, if you specify `/ui:contoso\* /ue:contoso\user1`, then User1 will be migrated, because the /**ui** option takes precedence over the /**ue** option.
The /**uel** option takes precedence over the /**ue** option. If a user has logged on within the specified time period set by the /**uel** option, that user’s profile will be migrated even if they are excluded by using the /**ue** option. For example, if you specify `/ue:fixed\user1 /uel:14`, the User1 will be migrated if they have logged on to the computer within the last 14 days.
-
-
-
-
-
-
-
-
Behavior
-
Command
-
-
-
-
-
Include only User2 from the Fabrikam domain and exclude all other users.
-
/ue:*\* /ui:fabrikam\user2
-
-
-
Include only the local user named User1 and exclude all other users.
-
/ue:*\* /ui:user1
-
-
-
Include only the domain users from Contoso, except Contoso\User1.
-
This behavior cannot be completed using a single command. Instead, to migrate this set of users, you will need to specify the following:
-
-
On the ScanState command line, type: /ue:*\* /ui:contoso\*
-
On the LoadState command line, type: /ue:contoso\user1
-
-
-
-
Include only local (non-domain) users.
-
/ue:*\* /ui:%computername%\*
-
-
-
-
-
+|Behavior|Command|
+|--- |--- |
+|Include only User2 from the Fabrikam domain and exclude all other users.|`/ue:*\* /ui:fabrikam\user2`|
+|Include only the local user named User1 and exclude all other users.|`/ue:*\* /ui:user1`|
+|Include only the domain users from Contoso, except Contoso\User1.|This behavior cannot be completed using a single command. Instead, to migrate this set of users, you will need to specify the following:
On the **ScanState** command line, type: `/ue:*\* /ui:contoso\*`
On the **LoadState** command line, type: `/ue:contoso\user1`
|
+|Include only local (non-domain) users.|`/ue:*\* /ui:%computername%\*`|
## Encrypted File Options
-
You can use the following options to migrate encrypted files. In all cases, by default, USMT fails if an encrypted file is found unless you specify an /**efs** option. To migrate encrypted files, you must change the default behavior.
For more information, see [Migrate EFS Files and Certificates](usmt-migrate-efs-files-and-certificates.md).
@@ -618,245 +196,49 @@ For more information, see [Migrate EFS Files and Certificates](usmt-migrate-efs-
> [!NOTE]
> EFS certificates will be migrated automatically when migrating to Windows 7, Windows 8 or Windows 10. Therefore, you should specify the /**efs:copyraw** option with the **ScanState** command to migrate the encrypted files
-
> [!CAUTION]
> Take caution when migrating encrypted files. If you migrate an encrypted file without also migrating the certificate, end users will not be able to access the file after the migration.
-
-
-
-
-
-
-
-
-
-
Command-Line Option
-
Explanation
-
-
-
-
-
/efs:hardlink
-
Creates a hard link to the EFS file instead of copying it. Use only with the /hardlink and the /nocompress options.
-
-
-
/efs:abort
-
Causes the ScanState command to fail with an error code, if an Encrypting File System (EFS) file is found on the source computer. Enabled by default.
-
-
-
/efs:skip
-
Causes the ScanState command to ignore EFS files.
-
-
-
/efs:decryptcopy
-
Causes the ScanState command to decrypt the file, if possible, before saving it to the migration store, and to fail if the file cannot be decrypted. If the ScanState command succeeds, the file will be unencrypted in the migration store, and once you run the LoadState command, the file will be copied to the destination computer.
-
-
-
/efs:copyraw
-
Causes the ScanState command to copy the files in the encrypted format. The files will be inaccessible on the destination computer until the EFS certificates are migrated. EFS certificates will be automatically migrated; however, by default USMT fails if an encrypted file is found, unless you specify an /efs option. Therefore you should specify the /efs:copyraw option with the ScanState command to migrate the encrypted file. Then, when you run the LoadState command, the encrypted file and the EFS certificate will be automatically migrated.
All files must be encrypted if the parent folder is encrypted. If the encryption attribute on a file inside an encrypted folder has been removed, the file will be encrypted during the migration using the credentials of the account used to run the LoadState tool. For more information, see Migrate EFS Files and Certificates.
-
-
-
-
-
-
-
-
-
+| Command-Line Option | Explanation |
+|----|----|
+| **/efs:hardlink** | Creates a hard link to the EFS file instead of copying it. Use only with the **/hardlink** and the **/nocompress** options. |
+| **/efs:abort** | Causes the **ScanState** command to fail with an error code, if an Encrypting File System (EFS) file is found on the source computer. Enabled by default. |
+| **/efs:skip** | Causes the **ScanState** command to ignore EFS files. |
+| /**efs:decryptcopy** | Causes the **ScanState** command to decrypt the file, if possible, before saving it to the migration store, and to fail if the file cannot be decrypted. If the **ScanState** command succeeds, the file will be unencrypted in the migration store, and once you run the **LoadState** command, the file will be copied to the destination computer. |
+| **/efs:copyraw** | Causes the **ScanState** command to copy the files in the encrypted format. The files will be inaccessible on the destination computer until the EFS certificates are migrated. EFS certificates will be automatically migrated; however, by default USMT fails if an encrypted file is found, unless you specify an **/efs** option. Therefore you should specify the **/efs:copyraw** option with the **ScanState** command to migrate the encrypted file. Then, when you run the **LoadState** command, the encrypted file and the EFS certificate will be automatically migrated.
For example: `ScanState /i:migdocs.xml /i:migapp.xml \server\share\migration\mystore /efs:copyraw`
**Important** All files must be encrypted if the parent folder is encrypted. If the encryption attribute on a file inside an encrypted folder has been removed, the file will be encrypted during the migration using the credentials of the account used to run the LoadState tool. For more information, see [Migrate EFS Files and Certificates](usmt-migrate-efs-files-and-certificates.md).
|
## Incompatible Command-Line Options
-
The following table indicates which command-line options are not compatible with the **ScanState** command. If the table entry for a particular combination is blank, the options are compatible and you can use them together. The X symbol means that the options are not compatible. For example, you cannot use the **/nocompress** option with the **/encrypt** option.
-
-
-
-
-
-
-
-
-
-
-
Command-Line Option
-
/keyfile
-
/nocompress
-
/genconfig
-
/all
-
-
-
-
-
/i
-
-
-
-
-
-
-
/o
-
-
-
-
-
-
-
/v
-
-
-
-
-
-
-
/nocompress
-
-
-
-
N/A
-
-
-
/localonly
-
-
-
X
-
-
-
-
/key
-
X
-
-
X
-
-
-
-
/encrypt
-
Required*
-
X
-
X
-
-
-
-
/keyfile
-
N/A
-
-
X
-
-
-
-
/l
-
-
-
-
-
-
-
/progress
-
-
-
X
-
-
-
-
/r
-
-
-
X
-
-
-
-
/w
-
-
-
X
-
-
-
-
/c
-
-
-
X
-
-
-
-
/p
-
-
-
X
-
N/A
-
-
-
/all
-
-
-
X
-
-
-
-
/ui
-
-
-
X
-
X
-
-
-
/ue
-
-
-
X
-
X
-
-
-
/uel
-
-
-
X
-
X
-
-
-
/efs:<option>
-
-
-
X
-
-
-
-
/genconfig
-
-
-
N/A
-
-
-
-
/config
-
-
-
X
-
-
-
-
<StorePath>
-
-
-
X
-
-
-
-
-
+|Command-Line Option|/keyfile|/nocompress|/genconfig|/all|
+|--- |--- |--- |--- |--- |
+|**/i**|||||
+|**/o**|||||
+|**/v**|||||
+|/**nocompress**||||N/A|
+|/**localonly**|||X||
+|/**key**|X||X||
+|/**encrypt**|Required*|X|X||
+|/**keyfile**|N/A||X||
+|/**l**|||||
+|/**progress**|||X||
+|/**r**|||X||
+|/**w**|||X||
+|/**c**|||X||
+|/**p**|||X|N/A|
+|/**all**|||X||
+|/**ui**|||X|X|
+|/**ue**|||X|X|
+|/**uel**|||X|X|
+|/**efs**:*<option>*|||X||
+|/**genconfig**|||N/A||
+|/**config**|||X||
+|*<StorePath>*|||X||
> [!NOTE]
> You must specify either the /**key** or /**keyfile** option with the /**encrypt** option.
-
-
## Related topics
-
[XML Elements Library](usmt-xml-elements-library.md)
-
diff --git a/windows/deployment/usmt/usmt-troubleshooting.md b/windows/deployment/usmt/usmt-troubleshooting.md
index 1a2fbc4401..7a4bedbd54 100644
--- a/windows/deployment/usmt/usmt-troubleshooting.md
+++ b/windows/deployment/usmt/usmt-troubleshooting.md
@@ -16,46 +16,20 @@ ms.topic: article
# User State Migration Tool (USMT) Troubleshooting
-
The following table describes topics that address common User State Migration Tool (USMT) 10.0 issues and questions. These topics describe tools that you can use to troubleshoot issues that arise during your migration.
## In This Section
-
-
-
-
+| Link | Description |
+|--- |--- |
+|[Common Issues](usmt-common-issues.md)|Find troubleshooting solutions for common problems in USMT.|
+|[Frequently Asked Questions](usmt-faq.yml)|Find answers to questions about how to use USMT.|
+|[Log Files](usmt-log-files.md)|Learn how to enable logging to help you troubleshoot issues in USMT.|
+|[Return Codes](usmt-return-codes.md)|Learn how to use return codes to identify problems in USMT.|
+|[USMT Resources](usmt-resources.md)|Find more information and support for using USMT.|
## Related topics
-
[USMT Best Practices](usmt-best-practices.md)
[User State Migration Tool (USMT) Overview Topics](usmt-topics.md)
@@ -63,12 +37,3 @@ The following table describes topics that address common User State Migration To
[User State Migration Tool (USMT) How-to topics](usmt-how-to.md)
[User State Migration Toolkit (USMT) Reference](usmt-reference.md)
-
-
-
-
-
-
-
-
-
diff --git a/windows/deployment/usmt/usmt-utilities.md b/windows/deployment/usmt/usmt-utilities.md
index d87666c8b6..0824d0f77f 100644
--- a/windows/deployment/usmt/usmt-utilities.md
+++ b/windows/deployment/usmt/usmt-utilities.md
@@ -16,7 +16,6 @@ ms.topic: article
# UsmtUtils Syntax
-
This topic describes the syntax for the utilities available in User State Migration Tool (USMT) 10.0 through the command-line interface. These utilities:
- Improve your ability to determine cryptographic options for your migration.
@@ -29,7 +28,6 @@ This topic describes the syntax for the utilities available in User State Migrat
## In This Topic
-
[Usmtutils.exe](#bkmk-usmtutils-exe)
[Verify Options](#bkmk-verifyoptions)
@@ -38,162 +36,34 @@ This topic describes the syntax for the utilities available in User State Migrat
## Usmtutils.exe
-
The following table lists command-line options for USMTutils.exe. The sections that follow provide further command-line options for the **/verify** and the **/extract** options.
The syntax for UsmtUtils.exe is:
usmtutils \[/ec | /rd *<storeDir>* | /verify *<filepath>* \[options\] | /extract *<filepath>* *<destinationPath>* \[options\]\]
-
-
-
-
-
-
-
-
Command-line Option
-
Description
-
-
-
-
-
/ec
-
Returns a list of supported cryptographic algorithms (AlgIDs) on the current system. You can use this on a destination computer to determine which algorithm to use with the /encrypt command before you run the ScanState tool on the source computer.
-
-
-
/rd<storeDir>
-
Removes the directory path specified by the <storeDir> argument on the computer. You can use this command to delete hard-link migration stores that cannot otherwise be deleted at a command prompt due to a sharing lock. If the migration store spans multiple volumes on a given drive, it will be deleted from all of these volumes.
-
For example:
-
usmtutils /rd D:\MyHardLinkStore
-
-
-
/y
-
Overrides the accept deletions prompt when used with the /rd option. When you use the /y option with the /rd option, you will not be prompted to accept the deletions before USMT deletes the directories.
-
-
-
/verify
-
Returns information on whether the compressed migration store is intact or whether it contains corrupted files or a corrupted catalog.
-
See Verify Options for syntax and options to use with /verify.
-
-
-
/extract
-
Recovers files from a compressed USMT migration store.
-
See Extract Options for syntax and options to use with /extract.
-
-
-
-
-
+|Command-line Option|Description|
+|--- |--- |
+|**/ec**|Returns a list of supported cryptographic algorithms (AlgIDs) on the current system. You can use this on a destination computer to determine which algorithm to use with the **/encrypt** command before you run the ScanState tool on the source computer.|
+|**/rd** *<storeDir>* |Removes the directory path specified by the *<storeDir>* argument on the computer. You can use this command to delete hard-link migration stores that cannot otherwise be deleted at a command prompt due to a sharing lock. If the migration store spans multiple volumes on a given drive, it will be deleted from all of these volumes.
For example: `usmtutils /rd D:\MyHardLinkStore`|
+|**/y**|Overrides the accept deletions prompt when used with the **/rd** option. When you use the **/y** option with the **/rd** option, you will not be prompted to accept the deletions before USMT deletes the directories.|
+|**/verify**|Returns information on whether the compressed migration store is intact or whether it contains corrupted files or a corrupted catalog.
See [Verify Options](#bkmk-verifyoptions) for syntax and options to use with **/verify**.|
+|**/extract**|Recovers files from a compressed USMT migration store.
See [Extract Options](#bkmk-extractoptions) for syntax and options to use with **/extract**.|
## Verify Options
-
Use the **/verify** option when you want to determine whether a compressed migration store is intact or whether it contains corrupted files or a corrupted catalog. For more information on how to use the **/verify** option, see [Verify the Condition of a Compressed Migration Store](verify-the-condition-of-a-compressed-migration-store.md).
The syntax for **/verify** is:
usmtutils /verify\[:*<reportType>*\] *<filePath>* \[/l:*<logfile>*\] \[/v:*VerbosityLevel*\] \[/decrypt \[:*<AlgID>*\] {/key:*<keystring>* | /keyfile:*<filename>*}\]
-
-
-
-
-
-
-
-
Command-line Option
-
Description
-
-
-
-
-
<reportType>
-
Specifies whether to report on all files, corrupted files only, or the status of the catalog.
-
-
Summary. Returns both the number of files that are intact and the number of files that are corrupted in the migration store. If no algorithm is specified, the summary report is displayed as a default.
-
all. Returns a tab-delimited list of all of the files in the compressed migration store and the status for each file. Each line contains the file name followed by a tab spacing, and either “CORRUPTED” or “OK” depending on the status of the file. The last entry reports the corruption status of the "CATALOG" of the store. A catalog file contains metadata for all files in a migration store. The LoadState tool requires a valid catalog file in order to open the migration store. Returns "OK" if the catalog file is intact and LoadState can open the migration store and "CORRUPTED" if the migration store is corrupted.
-
failureonly. Returns a tab-delimited list of only the files that are corrupted in the compressed migration store.
-
Catalog. Returns only the status of the catalog file.
-
-
-
-
/l:
-
<logfilePath>
-
Specifies the location and name of the log file.
-
-
-
/v:<VerbosityLevel>
-
(Verbosity)
-
Enables verbose output in the UsmtUtils log file. The default value is 0.
-
You can set the VerbosityLevel to one of the following levels:
-
-
-
-
-
-
-
-
Level
-
Explanation
-
-
-
-
-
0
-
Only the default errors and warnings are enabled.
-
-
-
1
-
Enables verbose output.
-
-
-
4
-
Enables error and status output.
-
-
-
5
-
Enables verbose and status output.
-
-
-
8
-
Enables error output to a debugger.
-
-
-
9
-
Enables verbose output to a debugger.
-
-
-
12
-
Enables error and status output to a debugger.
-
-
-
13
-
Enables verbose, status, and debugger output.
-
-
-
-
-
-
-
/decrypt<AlgID>/:<KeyString>
-
or
-
/decrypt<AlgID>/:<“Key String”>
-
or
-
/decrypt:<AlgID>/keyfile:<FileName>
-
Specifies that the /encrypt option was used to create the migration store with the ScanState tool. To decrypt the migration store, specify a /key or /keyfile option as follows:
-
-
<AlgID> specifies the cryptographic algorithm that was used to create the migration store on the ScanState command line. If no algorithm is specified, ScanState and UsmtUtils use the 3DES algorithm as a default.
-
<AlgID> valid values include: AES_128, AES_192, AES_256, 3DES, or 3DES_112.
-
/key:<KeyString> specifies the encryption key. If there is a space in <KeyString>, you must surround the argument with quotation marks.
-
/keyfile: <FileName> specifies the location and name of a text (.txt) file that contains the encryption key.
-
-
+| Command-line Option | Description |
+|-----|--------|
+| *<reportType>* | Specifies whether to report on all files, corrupted files only, or the status of the catalog.
**Summary**. Returns both the number of files that are intact and the number of files that are corrupted in the migration store. If no algorithm is specified, the summary report is displayed as a default.
**all**. Returns a tab-delimited list of all of the files in the compressed migration store and the status for each file. Each line contains the file name followed by a tab spacing, and either “CORRUPTED” or “OK” depending on the status of the file. The last entry reports the corruption status of the "CATALOG" of the store. A catalog file contains metadata for all files in a migration store. The LoadState tool requires a valid catalog file in order to open the migration store. Returns "OK" if the catalog file is intact and LoadState can open the migration store and "CORRUPTED" if the migration store is corrupted.
**failureonly**. Returns a tab-delimited list of only the files that are corrupted in the compressed migration store.
**Catalog**. Returns only the status of the catalog file.
|
+| **/l:** *<logfilePath>* | Specifies the location and name of the log file. |
+| **/v:** *<VerbosityLevel>* | **(Verbosity)**
Enables verbose output in the UsmtUtils log file. The default value is 0.
You can set the *VerbosityLevel* to one of the following levels:
**0** - Only the default errors and warnings are enabled.
**1** - Enables verbose output.
**4** - Enables error and status output.
**5** - Enables verbose and status output.
**8** - Enables error output to a debugger.
**9** - Enables verbose output to a debugger.
**12** - Enables error and status output to a debugger.
**13** - Enables verbose, status, and debugger output.
|
+| **/decrypt** *<AlgID>* **/**:*<KeyString>* or **/decrypt** *<AlgID>* **/**:*<“Key String”>* or **/decrypt:** *<AlgID>* **/keyfile**:*<FileName>* | Specifies that the **/encrypt** option was used to create the migration store with the ScanState tool. To decrypt the migration store, specify a **/key** or **/keyfile** option as follows:
*<AlgID>* specifies the cryptographic algorithm that was used to create the migration store on the ScanState command line. If no algorithm is specified, ScanState and UsmtUtils use the 3DES algorithm as a default. *<AlgID>* valid values include: AES_128, AES_192, AES_256, 3DES, or 3DES_112.
**/key:** *<KeyString>* specifies the encryption key. If there is a space in *<KeyString>*, you must surround the argument with quotation marks.
**/keyfile**: *<FileName>* specifies the location and name of a text (.txt) file that contains the encryption key.
For more information about supported encryption algorithms, see [Migration Store Encryption](usmt-migration-store-encryption.md) |
Some examples of **/verify** commands:
@@ -214,116 +84,16 @@ The syntax for **/extract** is:
/extract *<filePath>* *<destinationPath>* \[/i:*<includePattern>*\] \[/e: *<excludePattern>*\] \[/l: *<logfile>*\] \[/v: *VerbosityLevel>*\] \[/decrypt\[:*<AlgID>*\] {key: *<keystring>* | /keyfile: *<filename>*}\] \[/o\]
-
-
-
-
-
-
-
-
Command-line Option
-
Description
-
-
-
-
-
<filePath>
-
Path to the USMT migration store.
-
For example:
-
D:\MyMigrationStore\USMT\store.mig
-
-
-
<destinationPath>
-
Path to the folder where the tool puts the individual files.
-
-
-
/i:<includePattern>
-
Specifies a pattern for files to include in the extraction. You can specify more than one pattern. Separate patterns with a comma or a semicolon. You can use /i: <includePattern> and /e: <excludePattern> options in the same command. When both include and exclude patterns are used on the command line, include patterns take precedence over exclude patterns.
-
-
-
/e:<excludePattern>
-
Specifies a pattern for files to omit from the extraction. You can specify more than one pattern. Separate patterns with a comma or a semicolon. You can use /i: <includePattern> and /e: <excludePattern> options in the same command. When both include and exclude patterns are used on the command line, include patterns take precedence over exclude patterns.
-
-
-
/l:<logfilePath>
-
Specifies the location and name of the log file.
-
-
-
/v:<VerbosityLevel>
-
(Verbosity)
-
Enables verbose output in the UsmtUtils log file. The default value is 0.
-
You can set the VerbosityLevel to one of the following levels:
-
-
-
-
-
-
-
-
Level
-
Explanation
-
-
-
-
-
0
-
Only the default errors and warnings are enabled.
-
-
-
1
-
Enables verbose output.
-
-
-
4
-
Enables error and status output.
-
-
-
5
-
Enables verbose and status output.
-
-
-
8
-
Enables error output to a debugger.
-
-
-
9
-
Enables verbose output to a debugger.
-
-
-
12
-
Enables error and status output to a debugger.
-
-
-
13
-
Enables verbose, status, and debugger output.
-
-
-
-
-
-
-
/decrypt<AlgID>/key:<KeyString>
-
or
-
/decrypt<AlgID>/:<“Key String”>
-
or
-
/decrypt:<AlgID>/keyfile:<FileName>
-
Specifies that the /encrypt option was used to create the migration store with the ScanState tool. To decrypt the migration store, you must also specify a /key or /keyfile option as follows:
-
-
<AlgID> specifies the cryptographic algorithm that was used to create the migration store on the ScanState command line. If no algorithm is specified, ScanState and UsmtUtils use the 3DES algorithm as a default.
-
<AlgID> valid values include: AES_128, AES_192, AES_256, 3DES, or 3DES_112.
-
/key: <KeyString> specifies the encryption key. If there is a space in <KeyString>, you must surround the argument with quotation marks.
-
/keyfile:<FileName> specifies a text (.txt) file that contains the encryption key
-
-
+| Command-line Option | Description |
+|-------|-----|
+| *<filePath>* | Path to the USMT migration store.
For example: `D:\MyMigrationStore\USMT\store.mig` |
+| *<destinationPath>* | Path to the folder where the tool puts the individual files. |
+| **/i**:*<includePattern>* | Specifies a pattern for files to include in the extraction. You can specify more than one pattern. Separate patterns with a comma or a semicolon. You can use **/i**: *<includePattern>* and **/e**: *<excludePattern>* options in the same command. When both include and exclude patterns are used on the command line, include patterns take precedence over exclude patterns. |
+| **/e**:*<excludePattern>* | Specifies a pattern for files to omit from the extraction. You can specify more than one pattern. Separate patterns with a comma or a semicolon. You can use **/i**: *<includePattern>* and **/e**: *<excludePattern>* options in the same command. When both include and exclude patterns are used on the command line, include patterns take precedence over exclude patterns. |
+| **/l**:*<logfilePath>* | Specifies the location and name of the log file. |
+| **/v:***<VerbosityLevel>* | **(Verbosity)**
Enables verbose output in the UsmtUtils log file. The default value is 0.
You can set the *VerbosityLevel* to one of the following levels:
**0** - Only the default errors and warnings are enabled.
**1** - Enables verbose output.
**4** - Enables error and status output.
**5** - Enables verbose and status output.
**8** - Enables error output to a debugger.
**9** - Enables verbose output to a debugger.
**12** - Enables error and status output to a debugger.
**13** - Enables verbose, status, and debugger output.
|
+| **/decrypt***<AlgID>***/key**:*<KeyString>* or **/decrypt***<AlgID>***/**:*<“Key String”>* or **/decrypt:***<AlgID>***/keyfile**:*<FileName>* | Specifies that the **/encrypt** option was used to create the migration store with the ScanState tool. To decrypt the migration store, you must also specify a **/key** or **/keyfile** option as follows:
*<AlgID>* specifies the cryptographic algorithm that was used to create the migration store on the ScanState command line. If no algorithm is specified, ScanState and UsmtUtils use the 3DES algorithm as a default. *<AlgID>* valid values include: AES_128, AES_192, AES_256, 3DES, or 3DES_112.
**/key**: *<KeyString>* specifies the encryption key. If there is a space in *<KeyString>*, you must surround the argument with quotation marks.
**/keyfile**:*<FileName>* specifies a text (.txt) file that contains the encryption key
For more information about supported encryption algorithms, see [Migration Store Encryption](usmt-migration-store-encryption.md). |
+| **/o** | Overwrites existing output files. |
Some examples of **/extract** commands:
@@ -337,16 +107,6 @@ Some examples of **/extract** commands:
## Related topics
-
[User State Migration Tool (USMT) Command-line Syntax](usmt-command-line-syntax.md)
[Return Codes](usmt-return-codes.md)
-
-
-
-
-
-
-
-
-
diff --git a/windows/deployment/usmt/usmt-what-does-usmt-migrate.md b/windows/deployment/usmt/usmt-what-does-usmt-migrate.md
index c9c2d3cd28..c8660b4b6d 100644
--- a/windows/deployment/usmt/usmt-what-does-usmt-migrate.md
+++ b/windows/deployment/usmt/usmt-what-does-usmt-migrate.md
@@ -16,10 +16,8 @@ ms.topic: article
# What does USMT migrate?
-
## In this topic
-
- [Default migration scripts](#bkmk-defaultmigscripts)
- [User Data](#bkmk-3)
@@ -32,7 +30,6 @@ ms.topic: article
## Default migration scripts
-
The User State Migration Tool (USMT) 10.0 is designed so that an IT engineer can precisely define migrations using the USMT .xml scripting language. USMT provides the following sample scripts:
- **MigApp.XML.** Rules to migrate application settings.
@@ -41,25 +38,23 @@ The User State Migration Tool (USMT) 10.0 is designed so that an IT engineer ca
- **MigUser.XML.** Rules to migrate user profiles and user data.
- MigUser.xml gathers everything in a user’s profile and then does a file extension- based search of most of the system for other user data. If data doesn’t match either of these criteria, the data won’t be migrated. For the most part, this file describes a "core" migration.
+ MigUser.xml gathers everything in a user’s profile and then does a file extension- based search of most of the system for other user data. If data doesn’t match either of these criteria, the data won’t be migrated. For the most part, this file describes a "core" migration.
- The following data does not migrate with MigUser.xml:
+ The following data does not migrate with MigUser.xml:
- - Files outside the user profile that don’t match one of the file extensions in MigUser.xml.
-
- - Access control lists (ACLs) for folders outside the user profile.
+ - Files outside the user profile that don’t match one of the file extensions in MigUser.xml.
+ - Access control lists (ACLs) for folders outside the user profile.
## User data
-
This section describes the user data that USMT migrates by default, using the MigUser.xml file. It also defines how to migrate ACLs.
- **Folders from each user profile.** When you specify the MigUser.xml file, USMT migrates everything in a user’s profiles including the following:
- My Documents, My Video, My Music, My Pictures, desktop files, Start menu, Quick Launch settings, and Favorites.
+ My Documents, My Video, My Music, My Pictures, desktop files, Start menu, Quick Launch settings, and Favorites.
- >[!IMPORTANT]
- >Starting in Windows 10, version 1607 the USMT does not migrate the Start menu layout. To migrate a user's Start menu, you must export and then import settings using the Windows PowerShell cmdlets **Export-StartLayout** and **Import-StartLayout**. For more information, see [USMT common issues](./usmt-common-issues.md#usmt-does-not-migrate-the-start-layout).
+ > [!IMPORTANT]
+ > Starting in Windows 10, version 1607 the USMT does not migrate the Start menu layout. To migrate a user's Start menu, you must export and then import settings using the Windows PowerShell cmdlets **Export-StartLayout** and **Import-StartLayout**. For more information, see [USMT common issues](./usmt-common-issues.md#usmt-does-not-migrate-the-start-layout).
- **Folders from the All Users and Public profiles.** When you specify the MigUser.xml file, USMT also migrates the following from the **All Users** profile in Windows® XP, or the **Public** profile in Windows Vista, Windows 7, or Windows 8:
@@ -77,25 +72,20 @@ This section describes the user data that USMT migrates by default, using the Mi
- Shared Favorites
-- **File types.** When you specify the MigUser.xml file, the ScanState tool searches the fixed drives, collects and then migrates files with any of the following file extensions:
+- **File types.** When you specify the MigUser.xml file, the ScanState tool searches the fixed drives, collects, and then migrates files with any of the following file extensions:
- **.accdb, .ch3, .csv, .dif, .doc\*, .dot\*, .dqy, .iqy, .mcw, .mdb\*, .mpp, .one\*, .oqy, .or6, .pot\*, .ppa, .pps\*, .ppt\*, .pre, .pst, .pub, .qdf, .qel, .qph, .qsd, .rqy, .rtf, .scd, .sh3, .slk, .txt, .vl\*, .vsd, .wk\*, .wpd, .wps, .wq1, .wri, .xl\*, .xla, .xlb, .xls\*.**
+ **.accdb, .ch3, .csv, .dif, .doc\*, .dot\*, .dqy, .iqy, .mcw, .mdb\*, .mpp, .one\*, .oqy, .or6, .pot\*, .ppa, .pps\*, .ppt\*, .pre, .pst, .pub, .qdf, .qel, .qph, .qsd, .rqy, .rtf, .scd, .sh3, .slk, .txt, .vl\*, .vsd, .wk\*, .wpd, .wps, .wq1, .wri, .xl\*, .xla, .xlb, .xls\*.**
- **Note**
- The asterisk (\*) stands for zero or more characters.
-
-
+ > [!NOTE]
+ > The asterisk (\*) stands for zero or more characters.
- **Access control lists.** USMT migrates ACLs for specified files and folders from computers running both Windows® XP and Windows Vista. For example, if you migrate a file named File1.txt that is read-only for User1 and read/write for User2, these settings will still apply on the destination computer after the migration.
-**Important**
-To migrate ACLs, you must specify the directory to migrate in the MigUser.xml file. Using file patterns like \*.doc will not migrate a directory. The source ACL information is migrated only when you explicitly specify the directory. For example, `c:\test docs`.
-
-
+> [!IMPORTANT]
+> To migrate ACLs, you must specify the directory to migrate in the MigUser.xml file. Using file patterns like \*.doc will not migrate a directory. The source ACL information is migrated only when you explicitly specify the directory. For example, `c:\test docs`.
## Operating-system components
-
USMT migrates operating-system components to a destination computer from computers running Windows 7 and Windows 8
The following components are migrated by default using the manifest files:
@@ -150,229 +140,72 @@ The following components are migrated by default using the manifest files:
\* These settings are not available for an offline migration. For more information, see [Offline Migration Reference](offline-migration-reference.md).
-**Important**
-This list may not be complete. There may be additional components that are migrated.
+> [!IMPORTANT]
+> This list may not be complete. There may be additional components that are migrated.
-
-
-**Note**
-Some settings, such as fonts, are not applied by the LoadState tool until after the destination computer has been restarted. For this reason, restart the destination computer after you run the LoadState tool.
-
-
+> [!NOTE]
+> Some settings, such as fonts, are not applied by the LoadState tool until after the destination computer has been restarted. For this reason, restart the destination computer after you run the LoadState tool.
## Supported applications
-
Although it is not required for all applications, it is good practice to install all applications on the destination computer before restoring the user state. Installing applications before migrating settings helps to ensure that the migrated settings are not overwritten by the application installers.
-**Note**
-The versions of installed applications must match on the source and destination computers. USMT does not support migrating the settings of an earlier version of an application to a later version, except for Microsoft Office.
-
-
-
-**Note**
-USMT migrates only the settings that have been used or modified by the user. If there is an application setting on the source computer that was not touched by the user, the setting may not migrate.
-
-
+> [!NOTE]
+>
+> - The versions of installed applications must match on the source and destination computers. USMT does not support migrating the settings of an earlier version of an application to a later version, except for Microsoft Office.
+> - USMT migrates only the settings that have been used or modified by the user. If there is an application setting on the source computer that was not touched by the user, the setting may not migrate.
When you specify the MigApp.xml file, USMT migrates the settings for the following applications:
-
-
-
-
-
-
-
-
Product
-
Version
-
-
-
-
-
Adobe Acrobat Reader
-
9
-
-
-
AOL Instant Messenger
-
6.8
-
-
-
Adobe Creative Suite
-
2
-
-
-
Adobe Photoshop CS
-
8, 9
-
-
-
Adobe ImageReady CS
-
-
-
-
Apple iTunes
-
6, 7, 8
-
-
-
Apple QuickTime Player
-
5, 6, 7
-
-
-
Apple Safari
-
3.1.2
-
-
-
Google Chrome
-
beta
-
-
-
Google Picasa
-
3
-
-
-
Google Talk
-
beta
-
-
-
IBM Lotus 1-2-3
-
9
-
-
-
IBM Lotus Notes
-
6,7, 8
-
-
-
IBM Lotus Organizer
-
5
-
-
-
IBM Lotus WordPro
-
9.9
-
-
-
Intuit Quicken Deluxe
-
2009
-
-
-
Money Plus Business
-
2008
-
-
-
Money Plus Home
-
2008
-
-
-
Mozilla Firefox
-
3
-
-
-
Microsoft Office
-
2003, 2007, 2010
-
-
-
Microsoft Office Access®
-
2003, 2007, 2010
-
-
-
Microsoft Office Excel®
-
2003, 2007, 2010
-
-
-
Microsoft Office FrontPage®
-
2003, 2007, 2010
-
-
-
Microsoft Office OneNote®
-
2003, 2007, 2010
-
-
-
Microsoft Office Outlook®
-
2003, 2007, 2010
-
-
-
Microsoft Office PowerPoint®
-
2003, 2007, 2010
-
-
-
Microsoft Office Publisher
-
2003, 2007, 2010
-
-
-
Microsoft Office Word
-
2003, 2007, 2010
-
-
-
Opera Software Opera
-
9.5
-
-
-
Microsoft Outlook Express
-
(only mailbox file)
-
-
-
Microsoft Project
-
2003, 2007
-
-
-
Microsoft Office Visio®
-
2003, 2007
-
-
-
RealPlayer Basic
-
11
-
-
-
Sage Peachtree
-
2009
-
-
-
Skype
-
3.8
-
-
-
Windows Live Mail
-
12, 14
-
-
-
Windows Live Messenger
-
8.5, 14
-
-
-
Windows Live MovieMaker
-
14
-
-
-
Windows Live Photo Gallery
-
12, 14
-
-
-
Windows Live Writer
-
12, 14
-
-
-
Windows Mail
-
(Windows 7 and 8)
-
-
-
Microsoft Works
-
9
-
-
-
Yahoo Messenger
-
9
-
-
-
Microsoft Zune™ Software
-
3
-
-
-
-
-
+|Product|Version|
+|--- |--- |
+|Adobe Acrobat Reader|9|
+|AOL Instant Messenger|6.8|
+|Adobe Creative Suite|2|
+|Adobe Photoshop CS|8, 9|
+|Adobe ImageReady CS||
+|Apple iTunes|6, 7, 8|
+|Apple QuickTime Player|5, 6, 7|
+|Apple Safari|3.1.2|
+|Google Chrome|beta|
+|Google Picasa|3|
+|Google Talk|beta|
+|IBM Lotus 1-2-3|9|
+|IBM Lotus Notes|6,7, 8|
+|IBM Lotus Organizer|5|
+|IBM Lotus WordPro|9.9|
+|Intuit Quicken Deluxe|2009|
+|Money Plus Business|2008|
+|Money Plus Home|2008|
+|Mozilla Firefox|3|
+|Microsoft Office|2003, 2007, 2010|
+|Microsoft Office Access®|2003, 2007, 2010|
+|Microsoft Office Excel®|2003, 2007, 2010|
+|Microsoft Office FrontPage®|2003, 2007, 2010|
+|Microsoft Office OneNote®|2003, 2007, 2010|
+|Microsoft Office Outlook®|2003, 2007, 2010|
+|Microsoft Office PowerPoint®|2003, 2007, 2010|
+|Microsoft Office Publisher|2003, 2007, 2010|
+|Microsoft Office Word|2003, 2007, 2010|
+|Opera Software Opera|9.5|
+|Microsoft Outlook Express|(only mailbox file)|
+|Microsoft Project|2003, 2007|
+|Microsoft Office Visio®|2003, 2007|
+|RealPlayer Basic|11|
+|Sage Peachtree|2009|
+|Skype|3.8|
+|Windows Live Mail|12, 14|
+|Windows Live Messenger|8.5, 14|
+|Windows Live MovieMaker|14|
+|Windows Live Photo Gallery|12, 14|
+|Windows Live Writer|12, 14|
+|Windows Mail|(Windows 7 and 8)|
+|Microsoft Works|9|
+|Yahoo Messenger|9|
+|Microsoft Zune™ Software|3|
## What USMT does not migrate
-
The following is a list of the settings that USMT does not migrate. If you are having a problem that is not listed here, see [Common Issues](usmt-common-issues.md).
### Application settings
@@ -417,8 +250,4 @@ Starting in Windows 10, version 1607 the USMT does not migrate the Start menu la
## Related topics
-
[Plan your migration](usmt-plan-your-migration.md)
-
-
-
diff --git a/windows/deployment/usmt/usmt-xml-elements-library.md b/windows/deployment/usmt/usmt-xml-elements-library.md
index c97dfbadb0..7077db2d80 100644
--- a/windows/deployment/usmt/usmt-xml-elements-library.md
+++ b/windows/deployment/usmt/usmt-xml-elements-library.md
@@ -16,13 +16,10 @@ ms.topic: article
# XML Elements Library
-
-
-This topic describes the XML elements and helper functions that you can employ to author migration .xml files to use with User State Migration Tool (USMT). It is assumed that you understand the basics of XML. .
+This topic describes the XML elements and helper functions that you can employ to author migration .xml files to use with User State Migration Tool (USMT). It is assumed that you understand the basics of XML.
## In this topic
-
In addition to XML elements and helper functions, this topic describes how to specify encoded locations and locations patterns, functions that are for internal USMT use only, and the version tags that you can use with helper functions.
- [Elements and helper functions](#elements)
@@ -37,88 +34,14 @@ In addition to XML elements and helper functions, this topic describes how to sp
## Elements and Helper Functions
-
The following table describes the XML elements and helper functions you can use with USMT.
-
-
-
+| Elements A-K | Elements L-Z | Helper functions |
+|-----|----|-----|
+| [<addObjects>](#addobjects) [<attributes>](#attribute) [<bytes>](#bytes) [<commandLine>](#commandline) [<component>](#component) [<condition>](#condition) [<conditions>](#conditions) [<content>](#content) [<contentModify>](#contentmodify) [<description>](#description) [<destinationCleanup>](#destinationcleanup) [<detect>](#detect) [<detects>](#detects) [<detection>](#detection) [<displayName>](#displayname) [<environment>](#bkmk-environment) [<exclude>](#exclude) [<excludeAttributes>](#excludeattributes) [<extensions>](#extensions) [<extension>](#extension) [<externalProcess>](#externalprocess) [<icon>](#icon) [<include>](#include) [<includeAttribute>](#includeattributes) | [<library>](#library) [<location>](#location) [<locationModify>](#locationmodify) [<_locDefinition>](#locdefinition) [<manufacturer>](#manufacturer) [<merge>](#merge) [<migration>](#migration) [<namedElements>](#namedelements) [<object>](#object) [<objectSet>](#objectset) [<path>](#path) [<paths>](#paths) [<pattern>](#pattern) [<processing>](#processing) [<plugin>](#plugin) [<role>](#role) [<rules>](#rules) [<script>](#script) [<text>](#text) [<unconditionalExclude>](#unconditionalexclude) [<variable>](#variable) [<version>](#version) [<windowsObjects>](#windowsobjects) | [<condition> functions](#conditionfunctions) [<content> functions](#contentfunctions) [<contentModify> functions](#contentmodifyfunctions) [<include> and <exclude> filter functions](#persistfilterfunctions) [<locationModify> functions](#locationmodifyfunctions) [<merge> functions](#mergefunctions) [<script> functions](#scriptfunctions) [Internal USMT functions](#internalusmtfunctions) |
## <addObjects>
-
The <addObjects> element emulates the existence of one or more objects on the source computer. The child <object> elements provide the details of the emulated objects. If the content is a <script> element, the result of the invocation will be an array of objects.
- **Number of occurrences:** unlimited
@@ -131,13 +54,14 @@ The <addObjects> element emulates the existence of one or more objects on
Syntax:
-<addObjects>
-
-</addObjects>
+```xml
+
+
+```
The following example is from the MigApp.xml file:
-``` xml
+```xml
-
-Application | Include PinToStart to display an app on the Start screen. For apps pinned to the Start screen, identify a tile size (small, medium, or large), and a location. The size of a small tile is 1 column x 1 row, a medium tile is 2 x 2, and a large tile is 4 x 2. For the tile location, the first value indicates the column and the second value indicates the row. A value of 0 (zero) indicates the first column, a value of 1 indicates the second column, and so on. Include autoRun as an attribute to configure the application to run automatically.
-
-Application example:
-```xml
-
-**NEW** Tactical considerations for creating Windows deployment rings
+[**NEW** Tactical considerations for creating Windows deployment rings](https://techcommunity.microsoft.com/t5/Windows-IT-Pro-Blog/Tactical-considerations-for-creating-Windows-deployment-rings/ba-p/746979)
-**NEW** Windows 10 Enterprise vs. Windows 10 Pro: Modern management considerations for your organization
+[**NEW** Windows 10 Enterprise vs. Windows 10 Pro: Modern management considerations for your organization](https://techcommunity.microsoft.com/t5/Windows-IT-Pro-Blog/Windows-10-Enterprise-vs-Windows-10-Pro-Modern-management/ba-p/720445)
-Deployment rings: The hidden [strategic] gem of Windows as a service
+[Deployment rings: The hidden [strategic] gem of Windows as a service](https://techcommunity.microsoft.com/t5/Windows-IT-Pro-Blog/Deployment-rings-The-hidden-strategic-gem-of-Windows-as-a/ba-p/659622)
-Classifying Windows updates in common deployment tools
+[Classifying Windows updates in common deployment tools](https://techcommunity.microsoft.com/t5/Windows-IT-Pro-Blog/Classifying-Windows-updates-in-common-deployment-tools/ba-p/331175)
-Express updates for Windows Server 2016 re-enabled for November 2018 update
-
+[Express updates for Windows Server 2016 re-enabled for November 2018 update](/windows-server/get-started/express-updates)
-2019 SHA-2 Code Signing Support requirement for Windows and WSUS
+[2019 SHA-2 Code Signing Support requirement for Windows and WSUS](https://support.microsoft.com/help/4472027/)
-Deploying Windows 10 Feature Updates to 24/7 Mission Critical Devices
+[What is Windows Update for Business?](waas-manage-updates-wufb.md)
## Discover
@@ -70,14 +68,14 @@ Learn more about Windows as a service and its value to your organization.
-Overview of Windows as a service
+[Overview of Windows as a service](waas-overview.md)
-Quick guide to Windows as a service
+[Quick guide to Windows as a service](waas-quick-start.md)
-What's new in Windows 10 deployment
+[What's new in Windows 10 deployment](../deploy-whats-new.md)
-How Microsoft IT deploys Windows 10
+[How Microsoft IT deploys Windows 10](https://channel9.msdn.com/events/Ignite/2015/BRK3303)
## Plan
@@ -85,15 +83,15 @@ Prepare to implement Windows as a service effectively using the right tools, pro
-Simplified updates
+[Simplified updates](https://www.microsoft.com/windowsforbusiness/simplified-updates)
-Windows 10 end user readiness
+[Windows 10 end user readiness](https://www.microsoft.com/itpro/windows-10/end-user-readiness)
-Ready for Windows
+[Ready for Windows](https://developer.microsoft.com/windows/ready-for-windows#/)
-Manage Windows upgrades with Upgrade Readiness
+[Manage Windows upgrades with Upgrade Readiness](/mem/configmgr/desktop-analytics/overview)
-Preparing your organization for a seamless Windows 10 deployment
+[Preparing your organization for a seamless Windows 10 deployment](https://www.microsoft.com/itshowcase/windows10deployment)
## Deploy
@@ -101,18 +99,18 @@ Secure your organization's deployment investment.
-Update Windows 10 in the enterprise
+[Update Windows 10 in the enterprise](index.md)
-Deploying as an in-place upgrade
+[Deploying as an in-place upgrade](https://www.microsoft.com/itshowcase/Article/Content/668/Deploying-Windows-10-at-Microsoft-as-an-inplace-upgrade)
-Configure Windows Update for Business
+[Configure Windows Update for Business](waas-configure-wufb.md)
-Express update delivery
+[Express update delivery](waas-optimize-windows-10-updates.md#express-update-delivery)
-Windows 10 deployment considerations
+[Windows 10 deployment considerations](../planning/windows-10-deployment-considerations.md)
## Microsoft Ignite 2018
-Looking to learn more? These informative session replays from Microsoft Ignite 2018 (complete with downloadable slide decks) can provide some great insights on Windows as a service. See [MyIgnite - Session catalog](https://myignite.techcommunity.microsoft.com/sessions).
\ No newline at end of file
+Looking to learn more? These informative session replays from Microsoft Ignite 2018 (complete with downloadable slide decks) can provide some great insights on Windows as a service. See [MyIgnite - Session catalog](https://myignite.techcommunity.microsoft.com/sessions).
diff --git a/windows/deployment/update/windows-update-error-reference.md b/windows/deployment/update/windows-update-error-reference.md
index 508a27d244..64be11a43d 100644
--- a/windows/deployment/update/windows-update-error-reference.md
+++ b/windows/deployment/update/windows-update-error-reference.md
@@ -9,10 +9,10 @@ author: jaimeo
ms.localizationpriority: medium
ms.audience: itpro
ms.date: 09/18/2018
-ms.reviewer:
-manager: laurawi
+manager: dougeby
ms.topic: article
ms.custom: seo-marvel-apr2020
+ms.collection: highpri
---
# Windows Update error codes by component
diff --git a/windows/deployment/update/windows-update-errors.md b/windows/deployment/update/windows-update-errors.md
index fc07839d42..fdb75805e5 100644
--- a/windows/deployment/update/windows-update-errors.md
+++ b/windows/deployment/update/windows-update-errors.md
@@ -8,9 +8,10 @@ itproauthor: jaimeo
ms.audience: itpro
author: jaimeo
ms.reviewer: kaushika
-manager: laurawi
+manager: dougeby
ms.topic: troubleshooting
ms.custom: seo-marvel-apr2020
+ms.collection: highpri
---
# Windows Update common errors and mitigation
@@ -98,7 +99,7 @@ The following table provides information about common errors you might run into
| Message | Description | Mitigation |
|---------|-------------|------------|
-| WU_E_SETUP_SKIP_UPDATE | An update to the Windows Update Agent was skipped due to a directive in the Wuident.cab file. | You might encounter this error when WSUS is not sending the self-update to the clients.