From 6b3f7864ddcdf23d891c272cb7d4537ce6c2a0df Mon Sep 17 00:00:00 2001 From: jdeckerMS Date: Wed, 28 Sep 2016 09:44:03 -0700 Subject: [PATCH 01/87] rename for hello --- windows/keep-secure/TOC.md | 18 +- .../enable-phone-signin-to-pc-and-vpn.md | 2 +- .../keep-secure/hello-and-password-changes.md | 54 +++ .../hello-biometrics-in-enterprise.md | 91 ++++ .../keep-secure/hello-enable-phone-signin.md | 90 ++++ .../hello-errors-during-pin-creation.md | 239 +++++++++++ windows/keep-secure/hello-event-300.md | 54 +++ .../hello-implement-in-organization.md | 389 ++++++++++++++++++ .../hello-manage-identity-verification.md | 127 ++++++ .../hello-prepare-people-to-use.md | 116 ++++++ .../hello-why-pin-is-better-than-password.md | 76 ++++ ...microsoft-passport-in-your-organization.md | 2 +- windows/keep-secure/index.md | 4 +- ...y-verification-using-microsoft-passport.md | 2 +- ...microsoft-passport-and-password-changes.md | 2 +- ...oft-passport-errors-during-pin-creation.md | 2 +- windows/keep-secure/passport-event-300.md | 2 +- ...repare-people-to-use-microsoft-passport.md | 2 +- .../why-a-pin-is-better-than-a-password.md | 2 +- .../windows-10-enterprise-security-guides.md | 4 - .../windows-hello-in-enterprise.md | 2 +- 21 files changed, 1256 insertions(+), 24 deletions(-) create mode 100644 windows/keep-secure/hello-and-password-changes.md create mode 100644 windows/keep-secure/hello-biometrics-in-enterprise.md create mode 100644 windows/keep-secure/hello-enable-phone-signin.md create mode 100644 windows/keep-secure/hello-errors-during-pin-creation.md create mode 100644 windows/keep-secure/hello-event-300.md create mode 100644 windows/keep-secure/hello-implement-in-organization.md create mode 100644 windows/keep-secure/hello-manage-identity-verification.md create mode 100644 windows/keep-secure/hello-prepare-people-to-use.md create mode 100644 windows/keep-secure/hello-why-pin-is-better-than-password.md diff --git a/windows/keep-secure/TOC.md b/windows/keep-secure/TOC.md index c43b7b759f..e05c37aaec 100644 --- a/windows/keep-secure/TOC.md +++ b/windows/keep-secure/TOC.md @@ -1,14 +1,14 @@ # [Keep Windows 10 secure](index.md) ## [Block untrusted fonts in an enterprise](block-untrusted-fonts-in-enterprise.md) -## [Manage identity verification using Windows Hello for Business](manage-identity-verification-using-microsoft-passport.md) -### [Implement Windows Hello for Business in your organization](implement-microsoft-passport-in-your-organization.md) -### [Enable phone sign-in to PC or VPN](enable-phone-signin-to-pc-and-vpn.md) -### [Why a PIN is better than a password](why-a-pin-is-better-than-a-password.md) -### [Prepare people to use Windows Hello](prepare-people-to-use-microsoft-passport.md) -### [Windows Hello and password changes](microsoft-passport-and-password-changes.md) -### [Windows Hello errors during PIN creation](microsoft-passport-errors-during-pin-creation.md) -### [Event ID 300 - Windows Hello successfully created](passport-event-300.md) -### [Windows Hello biometrics in the enterprise](windows-hello-in-enterprise.md) +## [Manage identity verification using Windows Hello for Business](hello-manage-identity-verification.md) +### [Implement Windows Hello for Business in your organization](hello-implement-in-organization.md) +### [Enable phone sign-in to PC or VPN](hello-enable-phone-signin.md) +### [Why a PIN is better than a password](hello-why-pin-is-better-than-password.md) +### [Prepare people to use Windows Hello](hello-prepare-people-to-use.md) +### [Windows Hello and password changes](hello-and-password-changes.md) +### [Windows Hello errors during PIN creation](hello-errors-during-pin-creation.md) +### [Event ID 300 - Windows Hello successfully created](hello-event-300.md) +### [Windows Hello biometrics in the enterprise](hello-biometrics-in-enterprise.md) ## [Configure S/MIME for Windows 10 and Windows 10 Mobile](configure-s-mime.md) ## [Install digital certificates on Windows 10 Mobile](installing-digital-certificates-on-windows-10-mobile.md) ## [Device Guard deployment guide](device-guard-deployment-guide.md) diff --git a/windows/keep-secure/enable-phone-signin-to-pc-and-vpn.md b/windows/keep-secure/enable-phone-signin-to-pc-and-vpn.md index e3c6cbddf6..fab4f26f07 100644 --- a/windows/keep-secure/enable-phone-signin-to-pc-and-vpn.md +++ b/windows/keep-secure/enable-phone-signin-to-pc-and-vpn.md @@ -6,7 +6,7 @@ ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: jdeckerMS -localizationpriority: high +redirect_url: /hello-enable-phone-signin/ --- # Enable phone sign-in to PC or VPN diff --git a/windows/keep-secure/hello-and-password-changes.md b/windows/keep-secure/hello-and-password-changes.md new file mode 100644 index 0000000000..128f1ffe29 --- /dev/null +++ b/windows/keep-secure/hello-and-password-changes.md @@ -0,0 +1,54 @@ +--- +title: Windows Hello and password changes (Windows 10) +description: When you change your password on a device, you may need to sign in with a password on other devices to reset Hello. +ms.assetid: 83005FE4-8899-47A6-BEA9-C17CCA0B6B55 +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security +author: jdeckerMS +localizationpriority: high +--- +# Windows Hello and password changes + +**Applies to** +- Windows 10 +- Windows 10 Mobile + +When you set up Windows Hello, the PIN or biometric gesture that you use is specific to that device. You can set up Hello for the same account on multiple devices. If the PIN or biometric is configured as part of Windows Hello for Business, changing the account password will not impact sign-in or unlock with these gestures since it uses a key or certificate. However, if Windows Hello for Business is not deployed and the password for that account changes, you must provide the new password on each device to continue to use Hello. + +## Example + +Let's suppose that you have set up a PIN for your Microsoft account on **Device A**. You use your PIN to sign in on **Device A** and then change the password for your Microsoft account. +Because you were using **Device A** when you changed your password, the PIN on **Device A** will continue to work with no other action on your part. + +Suppose instead that you sign in on **Device B** and change your password for your Microsoft account. The next time that you try to sign in on **Device A** using your PIN, sign-in will fail because the account credentials that Hello on **Device A** knows will be outdated. +> **Note:**  This example also applies to an Active Directory account when [Windows Hello for Business is not implemented](implement-microsoft-passport-in-your-organization.md). +  +## How to update Hello after you change your password on another device + +1. When you try to sign in using your PIN or biometric, you will see the following message: **Your password was changed on a different device. You must sign in to this device once with your new password, and then you can sign in with your PIN.** +2. Click **OK.** +3. Click **Sign-in options**. +4. Click the **Password** button. +5. Sign in with new password. +6. The next time that you sign in, you can select **Sign-in options** and then select **PIN** to resume using your PIN. + +## Related topics + +[Manage identity verification using Windows Hello for Business](manage-identity-verification-using-microsoft-passport.md) + +[Implement Windows Hello for Business in your organization](implement-microsoft-passport-in-your-organization.md) + +[Enable phone sign-in to PC or VPN](enable-phone-signin-to-pc-and-vpn.md) + +[Why a PIN is better than a password](why-a-pin-is-better-than-a-password.md) + +[Prepare people to use Windows Hello](prepare-people-to-use-microsoft-passport.md) + +[Windows Hello errors during PIN creation](microsoft-passport-errors-during-pin-creation.md) + +[Event ID 300 - Windows Hello successfully created](passport-event-300.md) + +[Windows Hello biometrics in the enterprise](windows-hello-in-enterprise.md) +  \ No newline at end of file diff --git a/windows/keep-secure/hello-biometrics-in-enterprise.md b/windows/keep-secure/hello-biometrics-in-enterprise.md new file mode 100644 index 0000000000..ca368e846f --- /dev/null +++ b/windows/keep-secure/hello-biometrics-in-enterprise.md @@ -0,0 +1,91 @@ +--- +title: Windows Hello biometrics in the enterprise (Windows 10) +description: Windows Hello is the biometric authentication feature that helps strengthen authentication and helps to guard against potential spoofing through fingerprint matching and facial recognition. +ms.assetid: d3f27d94-2226-4547-86c0-65c84d6df8Bc +keywords: Windows Hello, enterprise biometrics +ms.prod: w10 +ms.mktglfcycl: explore +ms.sitesec: library +ms.pagetype: security +author: jdeckerMS +localizationpriority: high +--- + +# Windows Hello biometrics in the enterprise +**Applies to:** + +- Windows 10 + +Windows Hello is the biometric authentication feature that helps strengthen authentication and helps to guard against potential spoofing through fingerprint matching and facial recognition. + +> **Note:** When Windows 10 first shipped, it included Microsoft Passport and Windows Hello, which worked together to provide multi-factor authentication. To simplify deployment and improve supportability, Microsoft has combined these technologies into a single solution under the Windows Hello name. Customers who have already deployed these technologies will not experience any change in functionality. Customers who have yet to evaluate Windows Hello will find it easier to deploy due to simplified policies, documentation, and semantics. + +Because we realize your employees are going to want to use this new technology in your enterprise, we’ve been actively working with the device manufacturers to create strict design and performance recommendations that help to ensure that you can more confidently introduce Windows Hello biometrics into your organization. + +##How does Windows Hello work? +Windows Hello lets your employees use fingerprint or facial recognition as an alternative method to unlocking a device. With Windows Hello, authentication happens when the employee provides his or her unique biometric identifier while accessing the device-specific Windows Hello credentials. + +The Windows Hello authenticator works to authenticate and allow employees onto your enterprise network. Authentication doesn’t roam among devices, isn’t shared with a server, and can’t easily be extracted from a device. If multiple employees share a device, each employee will use his or her own biometric data on the device. + +## Why should I let my employees use Windows Hello? +Windows Hello provides many benefits, including: + +- It helps to strengthen your protections against credential theft. Because an attacker must have both the device and the biometric info or PIN, it’s much more difficult to gain access without the employee’s knowledge. + +- Employees get a simple authentication method (backed up with a PIN) that’s always with them, so there’s nothing to lose. No more forgetting passwords! + +- Support for Windows Hello is built into the operating system so you can add additional biometric devices and polices as part of a coordinated rollout or to individual employees or groups using Group Policy or Mobile Device Management (MDM) configurations service provider (CSP) policies.
For more info about the available Group Policies and MDM CSPs, see the [Implement Windows Hello for Business in your organization](implement-microsoft-passport-in-your-organization.md) topic. + +## Where is Microsoft Hello data stored? +The biometric data used to support Windows Hello is stored on the local device only. It doesn’t roam and is never sent to external devices or servers. This separation helps to stop potential attackers by providing no single collection point that an attacker could potentially compromise to steal biometric data. Additionally, even if an attacker was actually able to get the biometric data, it still can’t be easily converted to a form that could be recognized by the biometric sensor. + +## Has Microsoft set any device requirements for Windows Hello? +We’ve been working with the device manufacturers to help ensure a high-level of performance and protection is met by each sensor and device, based on these requirements: + +- **False Accept Rate (FAR).** Represents the instance a biometric identification solution verifies an unauthorized person. This is normally represented as a ratio of number of instances in a given population size, for example 1 in 100 000. This can also be represented as a percentage of occurrence, for example, 0.001%. This measurement is heavily considered the most important with regards to the security of the biometric algorithm. + +- **False Reject Rate (FRR).** Represents the instances a biometric identification solution fails to verify an authorized person correctly. Usually represented as a percentage, the sum of the True Accept Rate and False Reject Rate is 1. Can be with or without anti-spoofing or liveness detection. + +### Fingerprint sensor requirements +To allow fingerprint matching, you must have devices with fingerprint sensors and software. Fingerprint sensors, or sensors that use an employee’s unique fingerprint as an alternative log on option, can be touch sensors (large area or small area) or swipe sensors. Each type of sensor has its own set of detailed requirements that must be implemented by the manufacturer, but all of the sensors must include anti-spoofing measures (required) and a way to configure them (optional). + +**Acceptable performance range for small to large size touch sensors** + +- False Accept Rate (FAR): <0.001 – 0.002% + +- False Reject Rate (FRR) without Anti-spoofing or liveness detection: <5% + +- Effective, real world FRR with Anti-spoofing or liveness detection: <10% + +**Acceptable performance range for swipe sensors** + +- False Accept Rate (FAR): <0.002% + +- False Reject Rate (FRR) without Anti-spoofing or liveness detection: <5% + +- Effective, real world FRR with Anti-spoofing or liveness detection: <10% + +### Facial recognition sensors +To allow facial recognition, you must have devices with integrated special infrared (IR) sensors and software. Facial recognition sensors use special cameras that see in IR light, letting them tell the difference between a photo and a living person while scanning an employee’s facial features. These sensors, like the fingerprint sensors, must also include anti-spoofing measures (required) and a way to configure them (optional). + +- False Accept Rate (FAR): <0.001 + +- False Reject Rate (FRR) without Anti-spoofing or liveness detection: <5% + +- Effective, real world FRR with Anti-spoofing or liveness detection: <10% + +## Related topics +- [Manage identity verification using Windows Hello for Business](manage-identity-verification-using-microsoft-passport.md) +- [Implement Windows Hello for Business in your organization](implement-microsoft-passport-in-your-organization.md) +- [Microsoft Passport guide](microsoft-passport-guide.md) +- [Prepare people to use Windows Hello for Work](prepare-people-to-use-microsoft-passport.md) +- [PassportforWork CSP](https://go.microsoft.com/fwlink/p/?LinkId=708219) + +  + +  + + + + + diff --git a/windows/keep-secure/hello-enable-phone-signin.md b/windows/keep-secure/hello-enable-phone-signin.md new file mode 100644 index 0000000000..e3c6cbddf6 --- /dev/null +++ b/windows/keep-secure/hello-enable-phone-signin.md @@ -0,0 +1,90 @@ +--- +title: Enable phone sign-in to PC or VPN (Windows 10) +description: You can set policies to allow your users to sign in to a PC or VPN using their Windows 10 phone. +keywords: ["identity", "PIN", "biometric", "Hello"] +ms.prod: W10 +ms.mktglfcycl: deploy +ms.sitesec: library +author: jdeckerMS +localizationpriority: high +--- + +# Enable phone sign-in to PC or VPN + + +**Applies to** + +- Windows 10 +- Windows 10 Mobile + +In Windows 10, version 1607, your network users can use Windows Phone with Windows Hello to sign in to a PC, connect to VPN, and sign in to Office 365 in a browser. Phone sign-in uses Bluetooth, which means no need to wait for a phone call -- just unlock the phone and tap the app. + +![Sign in to a device](images/phone-signin-menu.png) + +> [!NOTE] +> Phone sign-in is currently limited to select Technology Adoption Program (TAP) participants. + +You can create a Group Policy or mobile device management (MDM) policy that will allow users to sign in to a work PC or their company's VPN using the credentials stored on their Windows 10 phone. + + ## Prerequisites + + - Both phone and PC must be running Windows 10, version 1607. + - The PC must be running Windows 10 Pro, Enterprise, or Education + - Both phone and PC must have Bluetooth. + - The **Microsoft Authenticator** app must be installed on the phone. + - The PC must be joined to an Active Directory domain that is connected to an Azure Active Directory (Azure AD) domain, or the PC must be joined to Azure AD. + - The phone must be joined to Azure AD or have a work account added. + - The VPN configuration profile must use certificate-based authentication. + +## Set policies + +To enable phone sign-in, you must enable the following policies using Group Policy or MDM. + +- Group Policy: **Computer Configuration** or **User Configuration** > **Policies** > **Administrative Templates** > **Windows Components** > **Windows Hello for Business** + - Enable **Use Windows Hello for Business** + - Enable **Phone Sign-in** +- MDM: + - Set **UsePassportForWork** to **True** + - Set **Remote\UseRemotePassport** to **True** + +## Configure VPN + +To enable phone sign-in to VPN, you must enable the [policy](#set-policies) for phone sign-in and ensure that VPN is configured as follows: + +- For inbox VPN, set up the VPN profile with Extensible Authentication Protocol (EAP) with the **Smart card or other certificate (TLS)** EAP type, also known as EAP-Transport Level Security (EAP-TLS). To exclusively access the VPN certificates on the phone, in the EAP filtering XML, add either **EKU** or **Issuer** (or both) filtering to make sure it picks only the Remote NGC certificate. +- For a Universal Windows Platform (UWP) VPN plug-in, add filtering criteria based on the 3rd party mechanism for the Remote NGC Certificate. + +## Get the app + +If you want to distribute the **Microsoft Authenticator** app, your organization must have set up Windows Store for Business, with Microsoft added as a [Line of Business (LOB) publisher](../manage/working-with-line-of-business-apps.md). + +[Tell people how to sign in using their phone.](prepare-people-to-use-microsoft-passport.md#bmk-remote) + + +## Related topics + +[Manage identity verification using Windows Hello for Business](manage-identity-verification-using-microsoft-passport.md) + +[Implement Windows Hello for Business in your organization](implement-microsoft-passport-in-your-organization.md) + +[Why a PIN is better than a password](why-a-pin-is-better-than-a-password.md) + +[Prepare people to use Windows Hello](prepare-people-to-use-microsoft-passport.md) + +[Windows Hello and password changes](microsoft-passport-and-password-changes.md) + +[Windows Hello errors during PIN creation](microsoft-passport-errors-during-pin-creation.md) + +[Event ID 300 - Windows Hello successfully created](passport-event-300.md) + +[Windows Hello biometrics in the enterprise](windows-hello-in-enterprise.md) + + +  + +  + + + + + diff --git a/windows/keep-secure/hello-errors-during-pin-creation.md b/windows/keep-secure/hello-errors-during-pin-creation.md new file mode 100644 index 0000000000..3e4fbfbedf --- /dev/null +++ b/windows/keep-secure/hello-errors-during-pin-creation.md @@ -0,0 +1,239 @@ +--- +title: Windows Hello errors during PIN creation (Windows 10) +description: When you set up Windows Hello in Windows 10, you may get an error during the Create a work PIN step. +ms.assetid: DFEFE22C-4FEF-4FD9-BFC4-9B419C339502 +keywords: PIN, error, create a work PIN +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security +author: jdeckerMS +localizationpriority: high +--- + +# Windows Hello errors during PIN creation + +**Applies to** +- Windows 10 +- Windows 10 Mobile + +When you set up Windows Hello in Windows 10, you may get an error during the **Create a PIN** step. This topic lists some of the error codes with recommendations for mitigating the problem. If you get an error code that is not listed here, contact Microsoft Support. + +## Where is the error code? + +The following image shows an example of an error during **Create a PIN**. + +![](images/pinerror.png) + +## Error mitigations + +When a user encounters an error when creating the work PIN, advise the user to try the following steps. Many errors can be mitigated by one of these steps. +1. Try to create the PIN again. Some errors are transient and resolve themselves. +2. Sign out, sign in, and try to create the PIN again. +3. Reboot the device and then try to create the PIN again. +4. Unjoin the device from Azure Active Directory (Azure AD), rejoin, and then try to create the PIN again. To unjoin a desktop PC, go to **Settings** > **System** > **About** and select **Disconnect from organization**. To unjoin a device running Windows 10 Mobile, you must [reset the device](https://go.microsoft.com/fwlink/p/?LinkId=715697). +5. On mobile devices, if you are unable to setup a PIN after multiple attempts, reset your device and start over. For help on how to reset your phone go to [Reset my phone](https://go.microsoft.com/fwlink/p/?LinkId=715697). +If the error occurs again, check the error code against the following table to see if there is another mitigation for that error. When no mitigation is listed in the table, contact Microsoft Support for assistance. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
HexCauseMitigation
0x801C044DAuthorization token does not contain device IDUnjoin the device from Azure AD and rejoin
0x80090036User cancelled an interactive dialogUser will be asked to try again
0x80090011The container or key was not foundUnjoin the device from Azure AD and rejoin
0x8009000FThe container or key already existsUnjoin the device from Azure AD and rejoin
0x8009002ANTE_NO_MEMORYClose programs which are taking up memory and try again.
0x80090005NTE_BAD_DATAUnjoin the device from Azure AD and rejoin
0x80090029TPM is not set up.Sign on with an administrator account. Click **Start**, type "tpm.msc", and select **tpm.msc Microsoft Common Console Document**. In the **Actions** pane, select **Prepare the TPM**.
0x80090031NTE_AUTHENTICATION_IGNOREDReboot the device. If the error occurs again after rebooting, [reset the TPM]( https://go.microsoft.com/fwlink/p/?LinkId=619969) or run [Clear-TPM](https://go.microsoft.com/fwlink/p/?LinkId=629650)
0x80090035Policy requires TPM and the device does not have TPM.Change the Passport policy to not require a TPM.
0x801C0003User is not authorized to enrollCheck if the user has permission to perform the operation​.
0x801C000ERegistration quota reached

Unjoin some other device that is currently joined using the same account or [increase the maximum number of devices per user](https://go.microsoft.com/fwlink/p/?LinkId=626933).

0x801C000FOperation successful but the device requires a rebootReboot the device.
0x801C0010The AIK certificate is not valid or trustedSign out and then sign in again.
0x801C0011The attestation statement of the transport key is invalidSign out and then sign in again.
0x801C0012Discovery request is not in a valid formatSign out and then sign in again.
0x801C0015The device is required to be joined to an Active Directory domain​Join the device to an Active Directory domain.
0x801C0016The federation provider configuration is emptyGo to [http://clientconfig.microsoftonline-p.net/FPURL.xml](http://clientconfig.microsoftonline-p.net/FPURL.xml) and verify that the file is not empty.
0x801C0017​The federation provider domain is emptyGo to [http://clientconfig.microsoftonline-p.net/FPURL.xml](http://clientconfig.microsoftonline-p.net/FPURL.xml) and verify that the FPDOMAINNAME element is not empty.
0x801C0018The federation provider client configuration URL is emptyGo to [http://clientconfig.microsoftonline-p.net/FPURL.xml](http://clientconfig.microsoftonline-p.net/FPURL.xml) and verify that the CLIENTCONFIG element contains a valid URL.
0x801C03E9Server response message is invalidSign out and then sign in again.
0x801C03EAServer failed to authorize user or device.Check if the token is valid and user has permission to register Passport keys.
0x801C03EBServer response http status is not validSign out and then sign in again.
0x801C03ECUnhandled exception from server.sign out and then sign in again.
0x801C03ED

Multi-factor authentication is required for a 'ProvisionKey' operation, but was not performed

+

-or-

+

Token was not found in the Authorization header

+

-or-

+

Failed to read one or more objects

+

-or-

The request sent to the server was invalid.

Sign out and then sign in again. If that doesn't resolve the issue, unjoin the device from Azure Active Directory (Azure AD) and rejoin.
0x801C03EEAttestation failedSign out and then sign in again.
0x801C03EFThe AIK certificate is no longer validSign out and then sign in again.
​0x801C044DUnable to obtain user tokenSign out and then sign in again. Check network and credentials.
0x801C044EFailed to receive user creds inputSign out and then sign in again.
+  +## Errors with unknown mitigation +For errors listed in this table, contact Microsoft Support for assistance. + +| Hex | Cause | +|-------------|-------------------------------------------------------------------------------------------------------| +| 0x80072f0c | Unknown | +| 0x80070057 | Invalid parameter or argument is passed | +| 0x80090027 | Caller provided wrong parameter. If third-party code receives this error they must change their code. | +| 0x8009002D | NTE\_INTERNAL\_ERROR | +| 0x80090020 | NTE\_FAIL | +| 0x801C0001 | ​ADRS server response is not in valid format | +| 0x801C0002 | Server failed to authenticate the user | +| 0x801C0006 | Unhandled exception from server | +| 0x801C000C | Discovery failed | +| 0x801C001B | ​The device certificate is not found | +| 0x801C000B | Redirection is needed and redirected location is not a well known server | +| 0x801C0019 | ​The federation provider client configuration is empty | +| 0x801C001A | The DRS endpoint in the federation provider client configuration is empty | +| 0x801C0013 | Tenant ID is not found in the token | +| 0x801C0014 | User SID is not found in the token | +| 0x801C03F1 | There is no UPN in the token | +| 0x801C03F0 | ​There is no key registered for the user | +| 0x801C03F1 | ​There is no UPN in the token | +| ​0x801C044C | There is no core window for the current thread | +  + +## Related topics + +[Manage identity verification using Windows Hello for Business](manage-identity-verification-using-microsoft-passport.md) + +[Implement Windows Hello for Business in your organization](implement-microsoft-passport-in-your-organization.md) + +[Enable phone sign-in to PC or VPN](enable-phone-signin-to-pc-and-vpn.md) + +[Why a PIN is better than a password](why-a-pin-is-better-than-a-password.md) + +[Prepare people to use Windows Hello](prepare-people-to-use-microsoft-passport.md) + +[Windows Hello and password changes](microsoft-passport-and-password-changes.md) + +[Event ID 300 - Windows Hello successfully created](passport-event-300.md) + +[Windows Hello biometrics in the enterprise](windows-hello-in-enterprise.md) \ No newline at end of file diff --git a/windows/keep-secure/hello-event-300.md b/windows/keep-secure/hello-event-300.md new file mode 100644 index 0000000000..25c9b86986 --- /dev/null +++ b/windows/keep-secure/hello-event-300.md @@ -0,0 +1,54 @@ +--- +title: Event ID 300 - Windows Hello successfully created (Windows 10) +description: This event is created when a Windows Hello for Business is successfully created and registered with Azure Active Directory (Azure AD). +ms.assetid: 0DD59E75-1C5F-4CC6-BB0E-71C83884FF04 +keywords: ngc +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security +author: jdeckerMS +localizationpriority: high +--- + +# Event ID 300 - Windows Hello successfully created + +**Applies to** +- Windows 10 +- Windows 10 Mobile + +This event is created when Windows Hello for Business is successfully created and registered with Azure Active Directory (Azure AD). Applications or services can trigger actions on this event. For example, a certificate provisioning service can listen to this event and trigger a certificate request. + +## Event details +| | | +|--------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| +| **Product:** | Windows 10 operating system | +| **ID:** | 300 | +| **Source:** | Microsoft Azure Device Registration Service | +| **Version:** | 10 | +| **Message:** | The NGC key was successfully registered. Key ID: {4476694e-8e3b-4ef8-8487-be21f95e6f07}. UPN:test@contoso.com. Attestation: ATT\_SOFT. Client request ID: . Server request ID: db2da6bd-3d70-4b9b-b26b-444f669902da. +Server response: {"kid":"4476694e-8e3b-4ef8-8487-be21f95e6f07","upn":"test@contoso.com"} | +  +## Resolve + +This is a normal condition. No further action is required. + +## Related topics + +[Manage identity verification using Windows Hello for Business](manage-identity-verification-using-microsoft-passport.md) + +[Implement Windows Hello for Business in your organization](implement-microsoft-passport-in-your-organization.md) + +[Enable phone sign-in to PC or VPN](enable-phone-signin-to-pc-and-vpn.md) + +[Why a PIN is better than a password](why-a-pin-is-better-than-a-password.md) + +[Prepare people to use Windows Hello](prepare-people-to-use-microsoft-passport.md) + +[Windows Hello and password changes](microsoft-passport-and-password-changes.md) + +[Windows Hello errors during PIN creation](microsoft-passport-errors-during-pin-creation.md) + +[Event ID 300 - Windows Hello successfully created](passport-event-300.md) + +[Windows Hello biometrics in the enterprise](windows-hello-in-enterprise.md) diff --git a/windows/keep-secure/hello-implement-in-organization.md b/windows/keep-secure/hello-implement-in-organization.md new file mode 100644 index 0000000000..b9e72308cc --- /dev/null +++ b/windows/keep-secure/hello-implement-in-organization.md @@ -0,0 +1,389 @@ +--- +title: Implement Windows Hello in your organization (Windows 10) +description: You can create a Group Policy or mobile device management (MDM) policy that will implement Windows Hello for Business on devices running Windows 10. +ms.assetid: 47B55221-24BE-482D-BD31-C78B22AC06D8 +keywords: identity, PIN, biometric, Hello +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security +author: jdeckerMS +localizationpriority: high +--- + +# Implement Windows Hello for Business in your organization + +**Applies to** +- Windows 10 +- Windows 10 Mobile + +You can create a Group Policy or mobile device management (MDM) policy that will implement Windows Hello on devices running Windows 10. + +>[!IMPORTANT] +>The Group Policy setting **Turn on PIN sign-in** does not apply to Windows Hello for Business. It still prevents or enables the creation of a convenience PIN for Windows 10, version 1507 and 1511. +> +>Beginning in version 1607, Windows Hello as a convenience PIN is disabled by default on all domain-joined computers. To enable a convenience PIN for Windows 10, version 1607, enable the Group Policy setting **Turn on convenience PIN sign-in**. +> +>Use **Windows Hello for Business** policy settings to manage PINs for Windows Hello for Business. +  +## Group Policy settings for Windows Hello for Business + +The following table lists the Group Policy settings that you can configure for Hello use in your workplace. These policy settings are available in both **User configuration** and **Computer Configuration** under **Policies** > **Administrative Templates** > **Windows Components** > **Windows Hello for Business**. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
PolicyOptions
Use Windows Hello for Business +

Not configured: Users can provision Windows Hello for Business, which encrypts their domain password.

+

Enabled: Device provisions Windows Hello for Business using keys or certificates for all users.

+

Disabled: Device does not provision Windows Hello for Business for any user.

+
Use a hardware security device +

Not configured: Windows Hello for Business will be provisioned using TPM if available, and will be provisioned using software if TPM is not available.

+

Enabled: Windows Hello for Business will only be provisioned using TPM.

+

Disabled: Windows Hello for Business will be provisioned using TPM if available, and will be provisioned using software if TPM is not available.

+
Use biometrics +

Not configured: Biometrics can be used as a gesture in place of a PIN.

+

Enabled: Biometrics can be used as a gesture in place of a PIN.

+

Disabled: Only a PIN can be used as a gesture.

+
PIN ComplexityRequire digits +

Not configured: Users must include a digit in their PIN.

+

Enabled: Users must include a digit in their PIN.

+

Disabled: Users cannot use digits in their PIN.

+
Require lowercase letters +

Not configured: Users cannot use lowercase letters in their PIN.

+

Enabled: Users must include at least one lowercase letter in their PIN.

+

Disabled: Users cannot use lowercase letters in their PIN.

+
Maximum PIN length +

Not configured: PIN length must be less than or equal to 127.

+

Enabled: PIN length must be less than or equal to the number you specify.

+

Disabled: PIN length must be less than or equal to 127.

+
Minimum PIN length +

Not configured: PIN length must be greater than or equal to 4.

+

Enabled: PIN length must be greater than or equal to the number you specify.

+

Disabled: PIN length must be greater than or equal to 4.

+
Expiration +

Not configured: PIN does not expire.

+

Enabled: PIN can be set to expire after any number of days between 1 and 730, or PIN can be set to never expire by setting policy to 0.

+

Disabled: PIN does not expire.

+
History +

Not configured: Previous PINs are not stored.

+

Enabled: Specify the number of previous PINs that can be associated to a user account that can't be reused.

+

Disabled: Previous PINs are not stored.

+
Note  Current PIN is included in PIN history.
+
 
+
Require special characters +

Not configured: Users cannot include a special character in their PIN.

+

Enabled: Users must include at least one special character in their PIN.

+

Disabled: Users cannot include a special character in their PIN.

+
Require uppercase letters +

Not configured: Users cannot include an uppercase letter in their PIN.

+

Enabled: Users must include at least one uppercase letter in their PIN.

+

Disabled: Users cannot include an uppercase letter in their PIN.

+
Phone Sign-in +

Use Phone Sign-in

+
Note  Applies to desktop only. Phone sign-in is currently limited to select Technology Adoption Program (TAP) participants.
+
 
+		 +

Not configured: Phone sign-in is disabled.

+

Enabled: Users can use a portable, registered device as a companion device for desktop authentication.

+

Disabled: Phone sign-in is disabled.

+
+ +## MDM policy settings for Windows Hello for Business + +The following table lists the MDM policy settings that you can configure for Windows Hello for Business use in your workplace. These MDM policy settings use the [PassportForWork configuration service provider (CSP)](https://go.microsoft.com/fwlink/p/?LinkId=692070). + +>[!IMPORTANT] +>Starting in Windows 10, version 1607, all devices only have one PIN associated with Windows Hello for Business. This means that any PIN on a device will be subject to the policies specified in the PassportForWork CSP. The values specified take precedence over any complexity rules set via Exchange ActiveSync (EAS) or the DeviceLock CSP. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
PolicyScopeDefaultOptions
UsePassportForWorkDeviceTrue +

True: Windows Hello for Business will be provisioned for all users on the device.

+

False: Users will not be able to provision Windows Hello for Business.

+
Note  If Windows Hello for Business is enabled, and then the policy is changed to False, users who previously set up Windows Hello for Business can continue to use it, but will not be able to set up Windows Hello for Business on other devices.
+
 
+
RequireSecurityDeviceDeviceFalse +

True: Windows Hello for Business will only be provisioned using TPM.

+

False: Windows Hello for Business will be provisioned using TPM if available, and will be provisioned using software if TPM is not available.

+
Biometrics +

UseBiometrics

+		Device False +

True: Biometrics can be used as a gesture in place of a PIN for domain sign-in.

+

False: Only a PIN can be used as a gesture for domain sign-in.

+
+

FacialFeaturesUser

+

EnhancedAntiSpoofing

+		DeviceNot configured +

Not configured: users can choose whether to turn on enhanced anti-spoofing.

+

True: Enhanced anti-spoofing is required on devices which support it.

+

False: Users cannot turn on enhanced anti-spoofing.

+
PINComplexity
Digits Device or user2 +

1: Numbers are not allowed.

+

2: At least one number is required.

+
Lowercase letters Device or user1 +

1: Lowercase letters are not allowed.

+

2: At least one lowercase letter is required.

+
Maximum PIN length Device or user127 +

Maximum length that can be set is 127. Maximum length cannot be less than minimum setting.

+
Minimum PIN lengthDevice or user4 +

Minimum length that can be set is 4. Minimum length cannot be greater than maximum setting.

+
Expiration Device or user0 +

Integer value specifies the period of time (in days) that a PIN can be used before the system requires the user to change it. The largest number you can configure for this policy setting is 730. The lowest number you can configure for this policy setting is 0. If this policy is set to 0, then the user’s PIN will never expire. +

+
HistoryDevice or user0 +

Integer value that specifies the number of past PINs that can be associated to a user account that can’t be reused. The largest number you can configure for this policy setting is 50. The lowest number you can configure for this policy setting is 0. If this policy is set to 0, then storage of previous PINs is not required. +

+
Special charactersDevice or user1 +

1: Special characters are not allowed.

+

2: At least one special character is required.

+
Uppercase lettersDevice or user1 +

1: Uppercase letters are not allowed

+

2: At least one uppercase letter is required

+
Remote +

UseRemotePassport

+
Note  Applies to desktop only. Phone sign-in is currently limited to select Technology Adoption Program (TAP) participants.
+
 
+		Device or userFalse +

True: Phone sign-in is enabled.

+

False: Phone sign-in is disabled.

+
+ +>[!NOTE]   +> If policy is not configured to explicitly require letters or special characters, users will be restricted to creating a numeric PIN. +  +## Prerequisites + +You’ll need this software to set Windows Hello for Business policies in your enterprise. + ++++++ + + + + + + + + + + + + + + + + + + + + + + +
Windows Hello for Business modeAzure ADActive Directory (AD) on-premises (available with production release of Windows Server 2016)Azure AD/AD hybrid (available with production release of Windows Server 2016)
Key-based authenticationAzure AD subscription
    +
  • Active Directory Federation Service (AD FS) (Windows Server 2016)
    • +
  • A few Windows Server 2016 domain controllers on-site
    • +
  • Microsoft System Center 2012 R2 Configuration Manager SP2
    • +
    +
  • Azure AD subscription
    • +
  • [Azure AD Connect](https://go.microsoft.com/fwlink/p/?LinkId=616792)
    • +
  • A few Windows Server 2016 domain controllers on-site
    • +
  • A management solution, such as Configuration Manager, Group Policy, or MDM
    • +
  • Active Directory Certificate Services (AD CS) without Network Device Enrollment Service (NDES)
    • +
Certificate-based authentication
    +
  • Azure AD subscription
    • +
  • Intune or non-Microsoft mobile device management (MDM) solution
    • +
  • PKI infrastructure
    • +
    +
  • ADFS (Windows Server 2016)
    • +
  • Active Directory Domain Services (AD DS) Windows Server 2016 schema
    • +
  • PKI infrastructure
    • +
  • Configuration Manager SP2, Intune, or non-Microsoft MDM solution
    • +
    +
  • Azure AD subscription
    • +
  • [Azure AD Connect](https://go.microsoft.com/fwlink/p/?LinkId=616792)
    • +
  • AD CS with NDES
    • +
  • Configuration Manager for domain-joined certificate enrollment, or InTune for non-domain-joined devices, or a non-Microsoft MDM service that supports Passport for Work
    • +
+  +Configuration Manager and MDM provide the ability to manage Windows Hello for Business policy and to deploy and manage certificates protected by Windows Hello for Business. + +Azure AD provides the ability to register devices with your enterprise and to provision Windows Hello for Business for organization accounts. + + +## Windows Hello for BYOD + +Windows Hello can be managed on personal devices that your employees use for work purposes using MDM. On personal devices, users can create a personal Windows Hello PIN for unlocking the device and used this PIN for access to work resources. + +The PIN is managed using the same Windows Hello for Business policies that you can use to manage Windows Hello for Business on organization-owned devices. The PIN can also be managed using DeviceLock policy. DeviceLock policy can be used to control length, complexity, history, and expiration requirements and can be configured using the [Policy configuration service provider](https://go.microsoft.com/fwlink/p/?LinkID=623244). + +## Related topics + +[Windows Hello biometrics in the enterprise](windows-hello-in-enterprise.md) + +[Why a PIN is better than a password](why-a-pin-is-better-than-a-password.md) + +[Manage identity verification using Windows Hello for Business](manage-identity-verification-using-microsoft-passport.md) + +[Enable phone sign-in to PC or VPN](enable-phone-signin-to-pc-and-vpn.md) + +[Prepare people to use Windows Hello](prepare-people-to-use-microsoft-passport.md) + +[Windows Hello and password changes](microsoft-passport-and-password-changes.md) + +[Windows Hello errors during PIN creation](microsoft-passport-errors-during-pin-creation.md) + +[Event ID 300 - Windows Hello successfully created](passport-event-300.md) + +[Windows Hello biometrics in the enterprise](windows-hello-in-enterprise.md) +  \ No newline at end of file diff --git a/windows/keep-secure/hello-manage-identity-verification.md b/windows/keep-secure/hello-manage-identity-verification.md new file mode 100644 index 0000000000..71b7ad88c9 --- /dev/null +++ b/windows/keep-secure/hello-manage-identity-verification.md @@ -0,0 +1,127 @@ +--- +title: Manage identity verification using Windows Hello for Business (Windows 10) +description: In Windows 10, Windows Hello for Business replaces passwords with strong two-factor authentication on PCs and mobile devices. This authentication consists of a new type of user credential that is tied to a device and a biometric or PIN. +ms.assetid: 5BF09642-8CF5-4FBC-AC9A-5CA51E19387E +keywords: identity, PIN, biometric, Hello, passport +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security, mobile +author: jdeckerMS +localizationpriority: high +--- +# Manage identity verification using Windows Hello for Business + +**Applies to** +- Windows 10 +- Windows 10 Mobile + +In Windows 10, Windows Hello for Business replaces passwords with strong two-factor authentication on PCs and mobile devices. This authentication consists of a new type of user credential that is tied to a device and a biometric or PIN. + +>[!NOTE] +> When Windows 10 first shipped, it included Microsoft Passport and Windows Hello, which worked together to provide multi-factor authentication. To simplify deployment and improve supportability, Microsoft has combined these technologies into a single solution under the Windows Hello name. Customers who have already deployed these technologies will not experience any change in functionality. Customers who have yet to evaluate Windows Hello will find it easier to deploy due to simplified policies, documentation, and semantics. + +Hello addresses the following problems with passwords: +- Passwords can be difficult to remember, and users often reuse passwords on multiple sites. +- Server breaches can expose symmetric network credentials. +- Passwords can be subject to [replay attacks](https://go.microsoft.com/fwlink/p/?LinkId=615673). +- Users can inadvertently expose their passwords due to [phishing attacks](https://go.microsoft.com/fwlink/p/?LinkId=615674). + +Hello lets users authenticate to: +- a Microsoft account. +- an Active Directory account. +- a Microsoft Azure Active Directory (Azure AD) account. +- Identity Provider Services or Relying Party Services that support [Fast ID Online (FIDO) v2.0](https://go.microsoft.com/fwlink/p/?LinkId=533889) authentication + +After an initial two-step verification of the user during enrollment, Hello is set up on the user's device and the user is asked to set a gesture, which can be a biometric, such as a fingerprint, or a PIN. The user provides the gesture to verify their identity. Windows then uses Hello to authenticate users and help them to access protected resources and services. + +As an administrator in an enterprise or educational organization, you can create policies to manage Hello use on Windows 10-based devices that connect to your organization. + + + + +## The difference between Windows Hello and Windows Hello for Business + +- Individuals can create a PIN or biometric gesture on their personal devices for convenient sign-in. This use of Hello provides a layer of protection by being unique to the device on which it is set up, however it is not backed by certificate-based authentication. + +- Windows Hello for Business, which is configured by Group Policy or MDM policy, uses key-based or certificate-based authentication. + +- Currently Active Directory accounts using Windows Hello are not backed by key-based or certificate-based authentication. Support for key-based or certificate-based authentication is on the roadmap for a future release. + +## Benefits of Windows Hello + +Reports of identity theft and large-scale hacking are frequent headlines. Nobody wants to be notified that their user name and password have been exposed. + +You may wonder [how a PIN can help protect a device better than a password](why-a-pin-is-better-than-a-password.md). Passwords are shared secrets; they are entered on a device and transmitted over the network to the server. An intercepted account name and password can be used by anyone. Because they're stored on the server, a server breach can reveal those stored credentials. + +In Windows 10, Hello replaces passwords. The Hello provisioning process creates a cryptographic key pair bound to the Trusted Platform Module (TPM), if a device has a TPM, or in software. Access to these keys and obtaining a signature to validate user possession of the private key is enabled only by the PIN or biometric gesture. The two-step verification that takes place during Hello enrollment creates a trusted relationship between the identity provider and the user when the public portion of the public/private key pair is sent to an identity provider and associated with a user account. When a user enters the gesture on the device, the identify provider knows from the combination of Hello keys and gesture that this is a verified identity and provides an authentication token that allows Windows 10 to access resources and services. In addition, during the registration process, the attestation claim is produced for every identity provider to cryptographically prove that the Hello keys are tied to TPM. During registration, when the attestation claim is not presented to the identity provider, the identity provider must assume that the Hello key is created in software. + +![how authentication works in windows hello](images/authflow.png) + +Imagine that someone is looking over your shoulder as you get money from an ATM and sees the PIN that you enter. Having that PIN won't help them access your account because they don't have your ATM card. In the same way, learning your PIN for your device doesn't allow that attacker to access your account because the PIN is local to your specific device and doesn't enable any type of authentication from any other device. + +Hello helps protect user identities and user credentials. Because no passwords are used, it helps circumvent phishing and brute force attacks. It also helps prevent server breaches because Hello credentials are an asymmetric key pair, which helps prevent replay attacks when these keys are protected by TPMs. + +Hello also enables Windows 10 Mobile devices to be used as [a remote credential](prepare-people-to-use-microsoft-passport.md#bmk-remote) when signing into Windows 10 PCs. During the sign-in process, the Windows 10 PC can connect using Bluetooth to access Hello on the user’s Windows 10 Mobile device. Because users carry their phone with them, Hello makes implementing two-factor authentication across the enterprise less costly and complex than other solutions. + +> [!NOTE] +>  Phone sign-in is currently limited to select Technology Adoption Program (TAP) participants. + +  +## How Windows Hello for Business works: key points + +- Hello credentials are based on certificate or asymmetrical key pair. Hello credentials are bound to the device, and the token that is obtained using the credential is also bound to the device. +- Identify provider (such as Active Directory, Azure AD, or a Microsoft account) validates user identity and maps Hello's public key to a user account during the registration step. +- Keys can be generated in hardware (TPM 1.2 or 2.0 for enterprises, and TPM 2.0 for consumers) or software, based on the policy. +- Authentication is the two-factor authentication with the combination of a key or certificate tied to a device and something that the person knows (a PIN) or something that the person is (Windows Hello). The Hello gesture does not roam between devices and is not shared with the server; it is stored locally on a device. +- Private key never leaves a device. The authenticating server has a public key that is mapped to the user account during the registration process. +- PIN entry and biometric gesture both trigger Windows 10 to verify the user's identity and authenticate using Hello keys or certificates. +- Personal (Microsoft account) and corporate (Active Directory or Azure AD) accounts use a single container for keys. All keys are separated by identity providers' domains to help ensure user privacy. +- Certificate private keys can be protected by the Hello container and the Hello gesture. + + +## Comparing key-based and certificate-based authentication + +Windows Hello for Business can use either keys (hardware or software) or certificates with keys in hardware or software to confirm identity. Enterprises that have a public key infrastructure (PKI) for issuing and managing certificates can continue to use PKI in combination with Hello. Enterprises that do not use PKI or want to reduce the effort associated with managing certificates can rely on key-based credentials for Hello. + +Hardware-based keys, which are generated by TPM, provide the highest level of assurance. When the TPM is manufactured, an Endorsement Key (EK) certificate is resident in the TPM. This EK certificate creates a root trust for all other keys that are generated on this TPM. +EK certification is used to generate an attestation identity key (AIK) certificate issued by a Microsoft certificate authority. This AIK certificate can be used as an attestation claim to prove to identity providers that the Hello keys are generated on the same TPM. The Microsoft certificate authority (CA) generates the AIK certificate per device, per user, and per IDP to help ensure that user privacy is protected. + +When identity providers such as Active Directory or Azure AD enroll a certificate in Hello, Windows 10 will support the same set of scenarios as a smart card. When the credential type is a key, only key-based trust and operations will be supported. + +## Learn more + +[Introduction to Windows Hello](https://go.microsoft.com/fwlink/p/?LinkId=786649), video presentation on Microsoft Virtual Academy + +[What's new in Active Directory Domain Services (AD DS) in Windows Server Technical Preview](https://go.microsoft.com/fwlink/p/?LinkId=708533) + +[Windows Hello face authentication](https://go.microsoft.com/fwlink/p/?LinkId=626024) + +[Biometrics hardware guidelines](https://go.microsoft.com/fwlink/p/?LinkId=626995) + +[Windows 10: Disrupting the Revolution of Cyber-Threats with Revolutionary Security!](https://go.microsoft.com/fwlink/p/?LinkId=533890) + +[Windows 10: The End Game for Passwords and Credential Theft?](https://go.microsoft.com/fwlink/p/?LinkId=533891) + +[Authenticating identities without passwords through Microsoft Passport](https://go.microsoft.com/fwlink/p/?LinkId=616778) + +[Microsoft Passport guide](https://go.microsoft.com/fwlink/p/?LinkId=691928) + +## Related topics + +[Implement Windows Hello for Business in your organization](implement-microsoft-passport-in-your-organization.md) + +[Enable phone sign-in to PC or VPN](enable-phone-signin-to-pc-and-vpn.md) + +[Why a PIN is better than a password](why-a-pin-is-better-than-a-password.md) + +[Prepare people to use Windows Hello](prepare-people-to-use-microsoft-passport.md) + +[Windows Hello and password changes](microsoft-passport-and-password-changes.md) + +[Windows Hello errors during PIN creation](microsoft-passport-errors-during-pin-creation.md) + +[Event ID 300 - Windows Hello successfully created](passport-event-300.md) + +[Windows Hello biometrics in the enterprise](windows-hello-in-enterprise.md) +  diff --git a/windows/keep-secure/hello-prepare-people-to-use.md b/windows/keep-secure/hello-prepare-people-to-use.md new file mode 100644 index 0000000000..f6419c6ced --- /dev/null +++ b/windows/keep-secure/hello-prepare-people-to-use.md @@ -0,0 +1,116 @@ +--- +title: Prepare people to use Windows Hello (Windows 10) +description: When you set a policy to require Windows Hello for Business in the workplace, you will want to prepare people in your organization. +ms.assetid: 5270B416-CE31-4DD9-862D-6C22A2AE508B +keywords: identity, PIN, biometric, Hello +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security +author: jdeckerMS +localizationpriority: high +--- + +# Prepare people to use Windows Hello + +**Applies to** +- Windows 10 +- Windows 10 Mobile + +When you set a policy to require Windows Hello for Business in the workplace, you will want to prepare people in your organization by explaining how to use Hello. + +After enrollment in Hello, users should use their gesture (such as a PIN or fingerprint) for access to corporate resources. Their gesture is only valid on the enrolled device. + +Although the organization may require users to change their Active Directory or Azure Active Directory (AD) account password at regular intervals, changes to their passwords have no effect on Hello. + +People who are currently using virtual or physical smart cards for authentication can use their virtual smart card to verify their identity when they set up Hello. + +## On devices owned by the organization + +When someone sets up a new device, they are prompted to choose who owns the device. For corporate devices, they select **This device belongs to my organization**. + +![who owns this pc](images/corpown.png) + +Next, they select a way to connect. Tell the people in your enterprise which option they should pick here. + +![choose how you'll connect](images/connect.png) + +They sign in, and are then asked to verify their identity. People have options to choose from, such as a text message, phone call, or authentication app. After verification, they create their PIN. The **Create a PIN** screen displays any complexity requirements that you have set, such as minimum length. + +After Hello is set up, people use their PIN to unlock the device, and that will automatically log them on. + +## On personal devices + +People who want to access work resources on their personal devices can add a work or school account in **Settings** > **Accounts** > **Work or school**, and then sign in with work credentials. The person selects the method for receiving the verification code, such as text message or email. The verification code is sent and the person then enters the verification code. After verification, the person enters and confirms new PIN. The person can access any token-based resource using this device without being asked for credentials. + +People can go to **Settings** > **Accounts** > **Work or school**, select the work account, and then select **Unjoin** to remove the account from their device. + +## Using Windows Hello and biometrics + +If your policy allows it, people can use biometrics (fingerprint, iris, and facial recognition) with Windows Hello for Business, if the hardware supports it. + +![sign in to windows, apps, and services using fingerprint or face](images/hellosettings.png) + +## Use a phone to sign in to a PC or VPN + +If your enterprise enables phone sign-in, users can pair a phone running Windows 10 Mobile to a PC running Windows 10 and then use an app on the phone to sign in to the PC using their Windows Hello credentials. + +> [!NOTE] +> Phone sign-in is currently limited to select Technology Adoption Program (TAP) participants. + +  +**Prerequisites:** + +- Both phone and PC must be running Windows 10, version 1607. +- The PC must be running Windows 10 Pro, Enterprise, or Education +- Both phone and PC must have Bluetooth. +- The **Microsoft Authenticator** app must be installed on the phone. +- The PC must be joined to an Active Directory domain that is connected to an Azure Active Directory (Azure AD) domain, or the PC must be joined to Azure AD. +- The phone must be joined to Azure AD or have a work account added. +- The VPN configuration profile must use certificate-based authentication. + +**Pair the PC and phone** + +1. On the PC, go to **Settings** > **Devices** > **Bluetooth**. Tap the name of the phone and then tap **Pair** to begin pairing. + + ![bluetooth pairing](images/btpair.png) + +2. On the phone, go to **Settings** > **Devices** > **Bluetooth**, and verify that the passcode for **Pairing accessory** on the phone matches the passcode displayed on the PC, and then tap **ok**. + + ![bluetooth pairing passcode](images/bt-passcode.png) + +3. On the PC, tap **Yes**. + +**Sign in to PC using the phone** + + +1. Open the **Microsoft Authenticator** app, choose your account, and tap the name of the PC to sign in to. + > **Note: **  The first time that you run the **Microsoft Authenticator** app, you must add an account. + + ![select a device](images/phone-signin-device-select.png) +   +2. Enter the work PIN that you set up when you joined the phone to the cloud domain or added a work account. + +**Connect to VPN** + +You simply connect to VPN as you normally would. If the phone's certificates are being used, a notification will be pushed to the phone asking if you approve. If you click **allow** in the notification, you will be prompted for your PIN. After you enter your PIN, the VPN session will connect. + +## Related topics + +[Manage identity verification using Windows Hello for Business](manage-identity-verification-using-microsoft-passport.md) + +[Implement Windows Hello for Business in your organization](implement-microsoft-passport-in-your-organization.md) + +[Enable phone sign-in to PC or VPN](enable-phone-signin-to-pc-and-vpn.md) + +[Why a PIN is better than a password](why-a-pin-is-better-than-a-password.md) + +[Windows Hello and password changes](microsoft-passport-and-password-changes.md) + +[Windows Hello errors during PIN creation](microsoft-passport-errors-during-pin-creation.md) + +[Event ID 300 - Windows Hello successfully created](passport-event-300.md) + +[Windows Hello biometrics in the enterprise](windows-hello-in-enterprise.md) + + diff --git a/windows/keep-secure/hello-why-pin-is-better-than-password.md b/windows/keep-secure/hello-why-pin-is-better-than-password.md new file mode 100644 index 0000000000..4fb387f147 --- /dev/null +++ b/windows/keep-secure/hello-why-pin-is-better-than-password.md @@ -0,0 +1,76 @@ +--- +title: Why a PIN is better than a password (Windows 10) +description: Windows Hello in Windows 10 enables users to sign in to their device using a PIN. How is a PIN different from (and better than) a password . +ms.assetid: A6FC0520-01E6-4E90-B53D-6C4C4E780212 +keywords: pin, security, password, hello +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security +author: jdeckerMS +localizationpriority: high +--- + +# Why a PIN is better than a password + +**Applies to** +- Windows 10 +- Windows 10 Mobile + +Windows Hello in Windows 10 enables users to sign in to their device using a PIN. How is a PIN different from (and better than) a password? +On the surface, a PIN looks much like a password. A PIN can be a set of numbers, but enterprise policy might allow complex PINs that include special characters and letters, both upper-case and lower-case. Something like **t758A!** could be an account password or a complex Hello PIN. It isn't the structure of a PIN (length, complexity) that makes it better than a password, it's how it works. + + +## PIN is tied to the device +One important difference between a password and a Hello PIN is that the PIN is tied to the specific device on which it was set up. That PIN is useless to anyone without that specific hardware. Someone who steals your password can sign in to your account from anywhere, but if they steal your PIN, they'd have to steal your physical device too! + +Even you can't use that PIN anywhere except on that specific device. If you want to sign in on multiple devices, you have to set up Hello on each device. + +## PIN is local to the device + +A password is transmitted to the server -- it can be intercepted in transmission or stolen from a server. A PIN is local to the device -- it isn't transmitted anywhere and it isn't stored on the server. +When the PIN is created, it establishes a trusted relationship with the identity provider and creates an asymmetric key pair that is used for authentication. When you enter your PIN, it unlocks the authentication key and uses the key to sign the request that is sent to the authenticating server. +> **Note:**  For details on how Hello uses asymetric key pairs for authentication, see [Microsoft Passport guide](https://go.microsoft.com/fwlink/p/?LinkId=691928). +  +## PIN is backed by hardware + +The Hello PIN is backed by a Trusted Platform Module (TPM) chip, which is a secure crypto-processor that is designed to carry out cryptographic operations. The chip includes multiple physical security mechanisms to make it tamper resistant, and malicious software is unable to tamper with the security functions of the TPM. All Windows 10 Mobile phones and many modern laptops have TPM. + +User key material is generated and available within the Trusted Platform Module (TPM) of the user device, which protects it from attackers who want to capture the key material and reuse it. Because Hello uses asymmetrical key pairs, users credentials can’t be stolen in cases where the identity provider or websites the user accesses have been compromised. + +The TPM protects against a variety of known and potential attacks, including PIN brute-force attacks. After too many incorrect guesses, the device is locked. + +## PIN can be complex + +The Windows Hello for Business PIN is subject to the same set of IT management policies as a password, such as complexity, length, expiration, and history. Although we generally think of a PIN as a simple four-digit code, administrators can set [policies](implement-microsoft-passport-in-your-organization.md) for managed devices to require a PIN complexity similar to a password. You can require or block: special characters, uppercase characters, lowercase characters, and digits. + +## What if someone steals the laptop or phone? + +To compromise a Windows Hello credential that TPM protects, an attacker must have access to the physical device, and then must find a way to spoof the user’s biometrics or guess his or her PIN—and all of this must be done before TPM anti-hammer capabilities lock the device. +You can provide additional protection for laptops that don't have TPM by enablng BitLocker and setting a policy to limit failed sign-ins. + +**Configure BitLocker without TPM** +1. Use the Local Group Policy Editor (gpedit.msc) to enable the following policy: + + **Computer Configuration** > **Administrative Templates** > **Windows Components** > **BitLocker Drive Encryption** > **Operating System Drives** > **Require additional authentication at startup** + +2. In the policy option, select **Allow BitLocker without a compatible TPM**, and then click **OK.** +3. Go to Control Panel > **System and Security** > **BitLocker Drive Encryption** and select the operating system drive to protect. +**Set account lockout threshold** +1. Use the Local Group Policy Editor (gpedit.msc) to enable the following policy: + + **Computer Configuration** >**Windows Settings** ?**Security Settings** >**Account Policies** > **Account Lockout Policy** > **Account lockout threshold** + +2. Set the number of invalid logon attempts to allow, and then click OK. + +## Why do you need a PIN to use biometrics? +Windows Hello enables biometric sign-in for Windows 10: fingerprint, iris, or facial recognition. When you set up Windows Hello, you're asked to create a PIN first. This PIN enables you to sign in using the PIN when you can’t use your preferred biometric because of an injury or because the sensor is unavailable or not working properly. + +If you only had a biometric sign-in configured and, for any reason, were unable to use that method to sign in, you would have to sign in using your account and password, which doesn't provide you the same level of protection as Hello. + +## Related topics + +[Manage identity verification using Windows Hello for Business](manage-identity-verification-using-microsoft-passport.md) + +[Implement Windows Hello for Business in your organization](implement-microsoft-passport-in-your-organization.md) +  \ No newline at end of file diff --git a/windows/keep-secure/implement-microsoft-passport-in-your-organization.md b/windows/keep-secure/implement-microsoft-passport-in-your-organization.md index b9e72308cc..207fb70b38 100644 --- a/windows/keep-secure/implement-microsoft-passport-in-your-organization.md +++ b/windows/keep-secure/implement-microsoft-passport-in-your-organization.md @@ -8,7 +8,7 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security author: jdeckerMS -localizationpriority: high +redirect_url: /hello-implement-in-organization/ --- # Implement Windows Hello for Business in your organization diff --git a/windows/keep-secure/index.md b/windows/keep-secure/index.md index bae0757612..df9cc36137 100644 --- a/windows/keep-secure/index.md +++ b/windows/keep-secure/index.md @@ -18,7 +18,7 @@ Learn about keeping Windows 10 and Windows 10 Mobile secure. | - | - | | [Block untrusted fonts in an enterprise](block-untrusted-fonts-in-enterprise.md) | To help protect your company from attacks which may originate from untrusted or attacker controlled font files, we’ve created the Blocking Untrusted Fonts feature. Using this feature, you can turn on a global setting that stops your employees from loading untrusted fonts processed using the Graphics Device Interface (GDI) onto your network. Untrusted fonts are any font installed outside of the %windir%/Fonts directory. Blocking untrusted fonts helps prevent both remote (web-based or email-based) and local EOP attacks that can happen during the font file-parsing process. | | [Device Guard certification and compliance](device-guard-certification-and-compliance.md) | Device Guard is a combination of hardware and software security features that, when configured together, will lock a device down so that it can only run trusted applications. If the app isn’t trusted it can’t run, period. It also means that even if an attacker manages to get control of the Windows kernel, he or she will be much less likely to be able to run malicious executable code after the computer restarts because of how decisions are made about what can run and when. | -| [Manage identity verification using Windows Hello for Business](manage-identity-verification-using-microsoft-passport.md) | In Windows 10, Windows Hello replaces passwords with strong two-factor authentication on PCs and mobile devices. This authentication consists of a new type of user credential that is tied to a device and a biometric or PIN. | +| [Manage identity verification using Windows Hello for Business](hello-manage-identity-verification.md) | In Windows 10, Windows Hello replaces passwords with strong two-factor authentication on PCs and mobile devices. This authentication consists of a new type of user credential that is tied to a device and a biometric or PIN. | | [Configure S/MIME for Windows 10 and Windows 10 Mobile](configure-s-mime.md) | In Windows 10, S/MIME lets users encrypt outgoing messages and attachments so that only intended recipients who have a digital identification (ID), also known as a certificate, can read them. Users can digitally sign a message, which provides the recipients with a way to verify the identity of the sender and that the message hasn't been tampered with. | | [Install digital certificates on Windows 10 Mobile](installing-digital-certificates-on-windows-10-mobile.md) | Digital certificates bind the identity of a user or computer to a pair of keys that can be used to encrypt and sign digital information. Certificates are issued by a certification authority (CA) that vouches for the identity of the certificate holder, and they enable secure client communications with websites and services. | | [Protect derived domain credentials with Credential Guard](credential-guard.md) | Introduced in Windows 10 Enterprise, Credential Guard uses virtualization-based security to isolate secrets so that only privileged system software can access them. Unauthorized access to these secrets can lead to credential theft attacks, such as Pass-the-Hash or Pass-The-Ticket. Credential Guard prevents these attacks by protecting NTLM password hashes and Kerberos Ticket Granting Tickets. | @@ -29,7 +29,7 @@ Learn about keeping Windows 10 and Windows 10 Mobile secure. | [VPN profile options](vpn-profile-options.md) | Virtual private networks (VPN) let you give your users secure remote access to your company network. Windows 10 adds useful new VPN profile options to help you manage how users connect. | | [Windows security baselines](windows-security-baselines.md) | Learn why you should use security baselines in your organization. | | [Security technologies](security-technologies.md) | Learn more about the different security technologies that are available in Windows 10 and Windows 10 Mobile. | -| [Enterprise security guides](windows-10-enterprise-security-guides.md) | Get proven guidance to help you better secure and protect your enterprise by using technologies such as Credential Guard, Device Guard, Microsoft Passport, and Windows Hello. This section offers technology overviews and step-by-step guides. | +| [Enterprise security guides](windows-10-enterprise-security-guides.md) | Get proven guidance to help you better secure and protect your enterprise by using technologies such as Credential Guard and Device Guard. This section offers technology overviews and step-by-step guides. | | [Change history for Keep Windows 10 secure](change-history-for-keep-windows-10-secure.md) | This topic lists new and updated topics in the Keep Windows 10 secure documentation for [Windows 10 and Windows 10 Mobile](../index.md). |   ## Related topics diff --git a/windows/keep-secure/manage-identity-verification-using-microsoft-passport.md b/windows/keep-secure/manage-identity-verification-using-microsoft-passport.md index 71b7ad88c9..2987351774 100644 --- a/windows/keep-secure/manage-identity-verification-using-microsoft-passport.md +++ b/windows/keep-secure/manage-identity-verification-using-microsoft-passport.md @@ -8,7 +8,7 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security, mobile author: jdeckerMS -localizationpriority: high +redirect_url: /hello-manage-identity-verification/ --- # Manage identity verification using Windows Hello for Business diff --git a/windows/keep-secure/microsoft-passport-and-password-changes.md b/windows/keep-secure/microsoft-passport-and-password-changes.md index 128f1ffe29..3afb9ba4f4 100644 --- a/windows/keep-secure/microsoft-passport-and-password-changes.md +++ b/windows/keep-secure/microsoft-passport-and-password-changes.md @@ -7,7 +7,7 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security author: jdeckerMS -localizationpriority: high +redirect_url: /hello-and-password-changes/ --- # Windows Hello and password changes diff --git a/windows/keep-secure/microsoft-passport-errors-during-pin-creation.md b/windows/keep-secure/microsoft-passport-errors-during-pin-creation.md index 3e4fbfbedf..9241b0611d 100644 --- a/windows/keep-secure/microsoft-passport-errors-during-pin-creation.md +++ b/windows/keep-secure/microsoft-passport-errors-during-pin-creation.md @@ -8,7 +8,7 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security author: jdeckerMS -localizationpriority: high +redirect_url: /hello-errors-during-pin-creation/ --- # Windows Hello errors during PIN creation diff --git a/windows/keep-secure/passport-event-300.md b/windows/keep-secure/passport-event-300.md index 25c9b86986..0ff7b55583 100644 --- a/windows/keep-secure/passport-event-300.md +++ b/windows/keep-secure/passport-event-300.md @@ -8,7 +8,7 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security author: jdeckerMS -localizationpriority: high +redirect_url: /hello-event-300/ --- # Event ID 300 - Windows Hello successfully created diff --git a/windows/keep-secure/prepare-people-to-use-microsoft-passport.md b/windows/keep-secure/prepare-people-to-use-microsoft-passport.md index f6419c6ced..974d8cda4c 100644 --- a/windows/keep-secure/prepare-people-to-use-microsoft-passport.md +++ b/windows/keep-secure/prepare-people-to-use-microsoft-passport.md @@ -8,7 +8,7 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security author: jdeckerMS -localizationpriority: high +redirect_url: /hello-prepare-people-to-use/ --- # Prepare people to use Windows Hello diff --git a/windows/keep-secure/why-a-pin-is-better-than-a-password.md b/windows/keep-secure/why-a-pin-is-better-than-a-password.md index 4fb387f147..fb142b629d 100644 --- a/windows/keep-secure/why-a-pin-is-better-than-a-password.md +++ b/windows/keep-secure/why-a-pin-is-better-than-a-password.md @@ -8,7 +8,7 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security author: jdeckerMS -localizationpriority: high +redirect_url: /hello-why-pin-is-better-than-password/ --- # Why a PIN is better than a password diff --git a/windows/keep-secure/windows-10-enterprise-security-guides.md b/windows/keep-secure/windows-10-enterprise-security-guides.md index a5c487491c..0ed2aa1d28 100644 --- a/windows/keep-secure/windows-10-enterprise-security-guides.md +++ b/windows/keep-secure/windows-10-enterprise-security-guides.md @@ -34,10 +34,6 @@ Get proven guidance to help you better secure and protect your enterprise by usi

[Control the health of Windows 10-based devices](protect-high-value-assets-by-controlling-the-health-of-windows-10-based-devices.md)

This article details an end-to-end solution that helps you protect high-value assets by enforcing, controlling, and reporting the health of Windows 10-based devices.

- -

[Microsoft Passport guide](microsoft-passport-guide.md)

-

This guide describes the new Windows Hello and Microsoft Passport technologies that are part of the Windows 10 operating system. It highlights specific capabilities of these technologies that help mitigate threats from conventional credentials and provides guidance about how to design and deploy these technologies as part of your Windows 10 rollout.

-

[Windows 10 Mobile security guide](windows-10-mobile-security-guide.md)

This guide provides a detailed description of the most important security features in the Windows 10 Mobile operating system—identity access and control, data protection, malware resistance, and app platform security.

diff --git a/windows/keep-secure/windows-hello-in-enterprise.md b/windows/keep-secure/windows-hello-in-enterprise.md index ca368e846f..d4cb4df71e 100644 --- a/windows/keep-secure/windows-hello-in-enterprise.md +++ b/windows/keep-secure/windows-hello-in-enterprise.md @@ -8,7 +8,7 @@ ms.mktglfcycl: explore ms.sitesec: library ms.pagetype: security author: jdeckerMS -localizationpriority: high +redirect_url: /hello-biometrics-in-enterprise/ --- # Windows Hello biometrics in the enterprise From eabadc71f7c2d73345f8fc3658b0182d83d06432 Mon Sep 17 00:00:00 2001 From: jdeckerMS Date: Wed, 28 Sep 2016 09:59:07 -0700 Subject: [PATCH 02/87] fix redirects --- windows/keep-secure/enable-phone-signin-to-pc-and-vpn.md | 2 +- .../implement-microsoft-passport-in-your-organization.md | 2 +- .../manage-identity-verification-using-microsoft-passport.md | 2 +- windows/keep-secure/microsoft-passport-and-password-changes.md | 2 +- .../microsoft-passport-errors-during-pin-creation.md | 2 +- windows/keep-secure/passport-event-300.md | 2 +- windows/keep-secure/prepare-people-to-use-microsoft-passport.md | 2 +- windows/keep-secure/why-a-pin-is-better-than-a-password.md | 2 +- windows/keep-secure/windows-hello-in-enterprise.md | 2 +- 9 files changed, 9 insertions(+), 9 deletions(-) diff --git a/windows/keep-secure/enable-phone-signin-to-pc-and-vpn.md b/windows/keep-secure/enable-phone-signin-to-pc-and-vpn.md index fab4f26f07..38fb8a9fef 100644 --- a/windows/keep-secure/enable-phone-signin-to-pc-and-vpn.md +++ b/windows/keep-secure/enable-phone-signin-to-pc-and-vpn.md @@ -6,7 +6,7 @@ ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: jdeckerMS -redirect_url: /hello-enable-phone-signin/ +redirect_url: /hello-enable-phone-signin --- # Enable phone sign-in to PC or VPN diff --git a/windows/keep-secure/implement-microsoft-passport-in-your-organization.md b/windows/keep-secure/implement-microsoft-passport-in-your-organization.md index 207fb70b38..a8ac5e3d46 100644 --- a/windows/keep-secure/implement-microsoft-passport-in-your-organization.md +++ b/windows/keep-secure/implement-microsoft-passport-in-your-organization.md @@ -8,7 +8,7 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security author: jdeckerMS -redirect_url: /hello-implement-in-organization/ +redirect_url: /hello-implement-in-organization --- # Implement Windows Hello for Business in your organization diff --git a/windows/keep-secure/manage-identity-verification-using-microsoft-passport.md b/windows/keep-secure/manage-identity-verification-using-microsoft-passport.md index 2987351774..2b9656fb8f 100644 --- a/windows/keep-secure/manage-identity-verification-using-microsoft-passport.md +++ b/windows/keep-secure/manage-identity-verification-using-microsoft-passport.md @@ -8,7 +8,7 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security, mobile author: jdeckerMS -redirect_url: /hello-manage-identity-verification/ +redirect_url: /hello-manage-identity-verification --- # Manage identity verification using Windows Hello for Business diff --git a/windows/keep-secure/microsoft-passport-and-password-changes.md b/windows/keep-secure/microsoft-passport-and-password-changes.md index 3afb9ba4f4..7eddfa84a4 100644 --- a/windows/keep-secure/microsoft-passport-and-password-changes.md +++ b/windows/keep-secure/microsoft-passport-and-password-changes.md @@ -7,7 +7,7 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security author: jdeckerMS -redirect_url: /hello-and-password-changes/ +redirect_url: /hello-and-password-changes --- # Windows Hello and password changes diff --git a/windows/keep-secure/microsoft-passport-errors-during-pin-creation.md b/windows/keep-secure/microsoft-passport-errors-during-pin-creation.md index 9241b0611d..a0d5c75f85 100644 --- a/windows/keep-secure/microsoft-passport-errors-during-pin-creation.md +++ b/windows/keep-secure/microsoft-passport-errors-during-pin-creation.md @@ -8,7 +8,7 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security author: jdeckerMS -redirect_url: /hello-errors-during-pin-creation/ +redirect_url: /hello-errors-during-pin-creation --- # Windows Hello errors during PIN creation diff --git a/windows/keep-secure/passport-event-300.md b/windows/keep-secure/passport-event-300.md index 0ff7b55583..1c0937e186 100644 --- a/windows/keep-secure/passport-event-300.md +++ b/windows/keep-secure/passport-event-300.md @@ -8,7 +8,7 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security author: jdeckerMS -redirect_url: /hello-event-300/ +redirect_url: /hello-event-300 --- # Event ID 300 - Windows Hello successfully created diff --git a/windows/keep-secure/prepare-people-to-use-microsoft-passport.md b/windows/keep-secure/prepare-people-to-use-microsoft-passport.md index 974d8cda4c..4cb911fcc0 100644 --- a/windows/keep-secure/prepare-people-to-use-microsoft-passport.md +++ b/windows/keep-secure/prepare-people-to-use-microsoft-passport.md @@ -8,7 +8,7 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security author: jdeckerMS -redirect_url: /hello-prepare-people-to-use/ +redirect_url: /hello-prepare-people-to-use --- # Prepare people to use Windows Hello diff --git a/windows/keep-secure/why-a-pin-is-better-than-a-password.md b/windows/keep-secure/why-a-pin-is-better-than-a-password.md index fb142b629d..7eac794a90 100644 --- a/windows/keep-secure/why-a-pin-is-better-than-a-password.md +++ b/windows/keep-secure/why-a-pin-is-better-than-a-password.md @@ -8,7 +8,7 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security author: jdeckerMS -redirect_url: /hello-why-pin-is-better-than-password/ +redirect_url: /hello-why-pin-is-better-than-password --- # Why a PIN is better than a password diff --git a/windows/keep-secure/windows-hello-in-enterprise.md b/windows/keep-secure/windows-hello-in-enterprise.md index d4cb4df71e..39a3d66e35 100644 --- a/windows/keep-secure/windows-hello-in-enterprise.md +++ b/windows/keep-secure/windows-hello-in-enterprise.md @@ -8,7 +8,7 @@ ms.mktglfcycl: explore ms.sitesec: library ms.pagetype: security author: jdeckerMS -redirect_url: /hello-biometrics-in-enterprise/ +redirect_url: /hello-biometrics-in-enterprise --- # Windows Hello biometrics in the enterprise From ce99cd5ace1566496998ed2e12c6133ec82da2bb Mon Sep 17 00:00:00 2001 From: jdeckerMS Date: Wed, 28 Sep 2016 10:10:55 -0700 Subject: [PATCH 03/87] try no slash + .md --- windows/keep-secure/windows-hello-in-enterprise.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/keep-secure/windows-hello-in-enterprise.md b/windows/keep-secure/windows-hello-in-enterprise.md index 39a3d66e35..4de96f0e5a 100644 --- a/windows/keep-secure/windows-hello-in-enterprise.md +++ b/windows/keep-secure/windows-hello-in-enterprise.md @@ -8,7 +8,7 @@ ms.mktglfcycl: explore ms.sitesec: library ms.pagetype: security author: jdeckerMS -redirect_url: /hello-biometrics-in-enterprise +redirect_url: hello-biometrics-in-enterprise.md --- # Windows Hello biometrics in the enterprise From 0285a32c9f14909c55311adb0e4fda20f18bc74d Mon Sep 17 00:00:00 2001 From: jdeckerMS Date: Wed, 28 Sep 2016 10:40:41 -0700 Subject: [PATCH 04/87] try with folder name --- windows/keep-secure/windows-hello-in-enterprise.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/keep-secure/windows-hello-in-enterprise.md b/windows/keep-secure/windows-hello-in-enterprise.md index 4de96f0e5a..149b94e6f4 100644 --- a/windows/keep-secure/windows-hello-in-enterprise.md +++ b/windows/keep-secure/windows-hello-in-enterprise.md @@ -8,7 +8,7 @@ ms.mktglfcycl: explore ms.sitesec: library ms.pagetype: security author: jdeckerMS -redirect_url: hello-biometrics-in-enterprise.md +redirect_url: /keep-secure/hello-biometrics-in-enterprise.md --- # Windows Hello biometrics in the enterprise From d573f75324addf29a154f25feb5f6a7af3ab726e Mon Sep 17 00:00:00 2001 From: jdeckerMS Date: Wed, 28 Sep 2016 10:50:21 -0700 Subject: [PATCH 05/87] last try --- windows/keep-secure/windows-hello-in-enterprise.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/keep-secure/windows-hello-in-enterprise.md b/windows/keep-secure/windows-hello-in-enterprise.md index 149b94e6f4..39a3d66e35 100644 --- a/windows/keep-secure/windows-hello-in-enterprise.md +++ b/windows/keep-secure/windows-hello-in-enterprise.md @@ -8,7 +8,7 @@ ms.mktglfcycl: explore ms.sitesec: library ms.pagetype: security author: jdeckerMS -redirect_url: /keep-secure/hello-biometrics-in-enterprise.md +redirect_url: /hello-biometrics-in-enterprise --- # Windows Hello biometrics in the enterprise From ff21abb8fc811821078e1cf1e2d883028252ca7d Mon Sep 17 00:00:00 2001 From: jdeckerMS Date: Wed, 28 Sep 2016 11:40:29 -0700 Subject: [PATCH 06/87] add new topic, interlinks --- windows/keep-secure/TOC.md | 1 + ...ange-history-for-keep-windows-10-secure.md | 6 + .../enable-phone-signin-to-pc-and-vpn.md | 2 +- .../keep-secure/hello-and-password-changes.md | 25 ++-- .../hello-biometrics-in-enterprise.md | 13 +- .../keep-secure/hello-enable-phone-signin.md | 24 ++-- .../hello-errors-during-pin-creation.md | 62 ++++----- windows/keep-secure/hello-event-300.md | 38 +++--- windows/keep-secure/hello-how-it-works.md | 126 ++++++++++++++++++ .../hello-implement-in-organization.md | 29 ++-- .../hello-manage-identity-verification.md | 25 ++-- .../hello-prepare-people-to-use.md | 25 ++-- .../hello-why-pin-is-better-than-password.md | 13 +- ...microsoft-passport-in-your-organization.md | 4 +- ...y-verification-using-microsoft-passport.md | 41 +++--- ...microsoft-passport-and-password-changes.md | 2 +- ...oft-passport-errors-during-pin-creation.md | 2 +- .../keep-secure/microsoft-passport-guide.md | 2 +- windows/keep-secure/passport-event-300.md | 2 +- ...repare-people-to-use-microsoft-passport.md | 2 +- .../why-a-pin-is-better-than-a-password.md | 2 +- .../windows-hello-in-enterprise.md | 2 +- 22 files changed, 275 insertions(+), 173 deletions(-) create mode 100644 windows/keep-secure/hello-how-it-works.md diff --git a/windows/keep-secure/TOC.md b/windows/keep-secure/TOC.md index e05c37aaec..03e7c2cb11 100644 --- a/windows/keep-secure/TOC.md +++ b/windows/keep-secure/TOC.md @@ -1,6 +1,7 @@ # [Keep Windows 10 secure](index.md) ## [Block untrusted fonts in an enterprise](block-untrusted-fonts-in-enterprise.md) ## [Manage identity verification using Windows Hello for Business](hello-manage-identity-verification.md) +### [How Windows Hello for Business works](hello-how-it-works.md) ### [Implement Windows Hello for Business in your organization](hello-implement-in-organization.md) ### [Enable phone sign-in to PC or VPN](hello-enable-phone-signin.md) ### [Why a PIN is better than a password](hello-why-pin-is-better-than-password.md) diff --git a/windows/keep-secure/change-history-for-keep-windows-10-secure.md b/windows/keep-secure/change-history-for-keep-windows-10-secure.md index 6dc8ea8b8c..fa21d8f325 100644 --- a/windows/keep-secure/change-history-for-keep-windows-10-secure.md +++ b/windows/keep-secure/change-history-for-keep-windows-10-secure.md @@ -12,6 +12,12 @@ author: brianlic-msft # Change history for Keep Windows 10 secure This topic lists new and updated topics in the [Keep Windows 10 secure](index.md) documentation for [Windows 10 and Windows 10 Mobile](../index.md). +## Octoboer 2016 + +| New or changed topic | Description | +| --- | --- | +| Microsoft Passport guide | Content merged into [Manage identity verification using Windows Hello for Business](hello-manage-identity-verification.md) topics | + ## September 2016 | New or changed topic | Description | diff --git a/windows/keep-secure/enable-phone-signin-to-pc-and-vpn.md b/windows/keep-secure/enable-phone-signin-to-pc-and-vpn.md index 38fb8a9fef..064dd48a63 100644 --- a/windows/keep-secure/enable-phone-signin-to-pc-and-vpn.md +++ b/windows/keep-secure/enable-phone-signin-to-pc-and-vpn.md @@ -6,7 +6,7 @@ ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library author: jdeckerMS -redirect_url: /hello-enable-phone-signin +redirect_url: https://technet.microsoft.com/en-us/itpro/windows/keep-secure/hello-enable-phone-signin --- # Enable phone sign-in to PC or VPN diff --git a/windows/keep-secure/hello-and-password-changes.md b/windows/keep-secure/hello-and-password-changes.md index 128f1ffe29..4388fd73dc 100644 --- a/windows/keep-secure/hello-and-password-changes.md +++ b/windows/keep-secure/hello-and-password-changes.md @@ -36,19 +36,12 @@ Suppose instead that you sign in on **Device B** and change your password for yo ## Related topics -[Manage identity verification using Windows Hello for Business](manage-identity-verification-using-microsoft-passport.md) - -[Implement Windows Hello for Business in your organization](implement-microsoft-passport-in-your-organization.md) - -[Enable phone sign-in to PC or VPN](enable-phone-signin-to-pc-and-vpn.md) - -[Why a PIN is better than a password](why-a-pin-is-better-than-a-password.md) - -[Prepare people to use Windows Hello](prepare-people-to-use-microsoft-passport.md) - -[Windows Hello errors during PIN creation](microsoft-passport-errors-during-pin-creation.md) - -[Event ID 300 - Windows Hello successfully created](passport-event-300.md) - -[Windows Hello biometrics in the enterprise](windows-hello-in-enterprise.md) -  \ No newline at end of file +- [Manage identity verification using Windows Hello for Business](hello-manage-identity-verification.md) +- [How Windows Hello for Business works](hello-how-it-works.md) +- [Implement Windows Hello for Business in your organization](hello-implement-in-organization.md) +- [Enable phone sign-in to PC or VPN](hello-enable-phone-signin.md) +- [Why a PIN is better than a password](hello-why-pin-is-better-than-password.md) +- [Prepare people to use Windows Hello](hello-prepare-people-to-use.md) +- [Windows Hello errors during PIN creation](hello-errors-during-pin-creation.md) +- [Event ID 300 - Windows Hello successfully created](hello-event-300.md) +- [Windows Hello biometrics in the enterprise](hello-biometrics-in-enterprise.md) \ No newline at end of file diff --git a/windows/keep-secure/hello-biometrics-in-enterprise.md b/windows/keep-secure/hello-biometrics-in-enterprise.md index ca368e846f..98a4f449cf 100644 --- a/windows/keep-secure/hello-biometrics-in-enterprise.md +++ b/windows/keep-secure/hello-biometrics-in-enterprise.md @@ -75,10 +75,15 @@ To allow facial recognition, you must have devices with integrated special infra - Effective, real world FRR with Anti-spoofing or liveness detection: <10% ## Related topics -- [Manage identity verification using Windows Hello for Business](manage-identity-verification-using-microsoft-passport.md) -- [Implement Windows Hello for Business in your organization](implement-microsoft-passport-in-your-organization.md) -- [Microsoft Passport guide](microsoft-passport-guide.md) -- [Prepare people to use Windows Hello for Work](prepare-people-to-use-microsoft-passport.md) +- [Manage identity verification using Windows Hello for Business](hello-manage-identity-verification.md) +- [How Windows Hello for Business works](hello-how-it-works.md) +- [Implement Windows Hello for Business in your organization](hello-implement-in-organization.md) +- [Enable phone sign-in to PC or VPN](hello-enable-phone-signin.md) +- [Why a PIN is better than a password](hello-why-pin-is-better-than-password.md) +- [Prepare people to use Windows Hello](hello-prepare-people-to-use.md) +- [Windows Hello and password changes](hello-and-password-changes.md) +- [Windows Hello errors during PIN creation](hello-errors-during-pin-creation.md) +- [Event ID 300 - Windows Hello successfully created](hello-event-300.md) - [PassportforWork CSP](https://go.microsoft.com/fwlink/p/?LinkId=708219)   diff --git a/windows/keep-secure/hello-enable-phone-signin.md b/windows/keep-secure/hello-enable-phone-signin.md index e3c6cbddf6..e6cd471753 100644 --- a/windows/keep-secure/hello-enable-phone-signin.md +++ b/windows/keep-secure/hello-enable-phone-signin.md @@ -63,21 +63,15 @@ If you want to distribute the **Microsoft Authenticator** app, your organization ## Related topics -[Manage identity verification using Windows Hello for Business](manage-identity-verification-using-microsoft-passport.md) - -[Implement Windows Hello for Business in your organization](implement-microsoft-passport-in-your-organization.md) - -[Why a PIN is better than a password](why-a-pin-is-better-than-a-password.md) - -[Prepare people to use Windows Hello](prepare-people-to-use-microsoft-passport.md) - -[Windows Hello and password changes](microsoft-passport-and-password-changes.md) - -[Windows Hello errors during PIN creation](microsoft-passport-errors-during-pin-creation.md) - -[Event ID 300 - Windows Hello successfully created](passport-event-300.md) - -[Windows Hello biometrics in the enterprise](windows-hello-in-enterprise.md) +- [Manage identity verification using Windows Hello for Business](hello-manage-identity-verification.md) +- [How Windows Hello for Business works](hello-how-it-works.md) +- [Implement Windows Hello for Business in your organization](hello-implement-in-organization.md) +- [Why a PIN is better than a password](hello-why-pin-is-better-than-password.md) +- [Prepare people to use Windows Hello](hello-prepare-people-to-use.md) +- [Windows Hello and password changes](hello-and-password-changes.md) +- [Windows Hello errors during PIN creation](hello-errors-during-pin-creation.md) +- [Event ID 300 - Windows Hello successfully created](hello-event-300.md) +- [Windows Hello biometrics in the enterprise](hello-biometrics-in-enterprise.md)   diff --git a/windows/keep-secure/hello-errors-during-pin-creation.md b/windows/keep-secure/hello-errors-during-pin-creation.md index 3e4fbfbedf..6d2998ebfd 100644 --- a/windows/keep-secure/hello-errors-during-pin-creation.md +++ b/windows/keep-secure/hello-errors-during-pin-creation.md @@ -197,43 +197,37 @@ If the error occurs again, check the error code against the following table to s ## Errors with unknown mitigation For errors listed in this table, contact Microsoft Support for assistance. -| Hex | Cause | -|-------------|-------------------------------------------------------------------------------------------------------| -| 0x80072f0c | Unknown | +| Hex | Cause | +|-------------|---------| +| 0x80072f0c | Unknown | | 0x80070057 | Invalid parameter or argument is passed | | 0x80090027 | Caller provided wrong parameter. If third-party code receives this error they must change their code. | -| 0x8009002D | NTE\_INTERNAL\_ERROR | -| 0x80090020 | NTE\_FAIL | -| 0x801C0001 | ​ADRS server response is not in valid format | -| 0x801C0002 | Server failed to authenticate the user | -| 0x801C0006 | Unhandled exception from server | -| 0x801C000C | Discovery failed | -| 0x801C001B | ​The device certificate is not found | -| 0x801C000B | Redirection is needed and redirected location is not a well known server | -| 0x801C0019 | ​The federation provider client configuration is empty | -| 0x801C001A | The DRS endpoint in the federation provider client configuration is empty | -| 0x801C0013 | Tenant ID is not found in the token | -| 0x801C0014 | User SID is not found in the token | -| 0x801C03F1 | There is no UPN in the token | -| 0x801C03F0 | ​There is no key registered for the user | -| 0x801C03F1 | ​There is no UPN in the token | -| ​0x801C044C | There is no core window for the current thread | +| 0x8009002D | NTE\_INTERNAL\_ERROR | +| 0x80090020 | NTE\_FAIL | +| 0x801C0001 | ​ADRS server response is not in valid format | +| 0x801C0002 | Server failed to authenticate the user | +| 0x801C0006 | Unhandled exception from server | +| 0x801C000C | Discovery failed | +| 0x801C001B | ​The device certificate is not found | +| 0x801C000B | Redirection is needed and redirected location is not a well known server | +| 0x801C0019 | ​The federation provider client configuration is empty | +| 0x801C001A | The DRS endpoint in the federation provider client configuration is empty | +| 0x801C0013 | Tenant ID is not found in the token | +| 0x801C0014 | User SID is not found in the token | +| 0x801C03F1 | There is no UPN in the token | +| 0x801C03F0 | ​There is no key registered for the user | +| 0x801C03F1 | ​There is no UPN in the token | +| ​0x801C044C | There is no core window for the current thread |   ## Related topics -[Manage identity verification using Windows Hello for Business](manage-identity-verification-using-microsoft-passport.md) - -[Implement Windows Hello for Business in your organization](implement-microsoft-passport-in-your-organization.md) - -[Enable phone sign-in to PC or VPN](enable-phone-signin-to-pc-and-vpn.md) - -[Why a PIN is better than a password](why-a-pin-is-better-than-a-password.md) - -[Prepare people to use Windows Hello](prepare-people-to-use-microsoft-passport.md) - -[Windows Hello and password changes](microsoft-passport-and-password-changes.md) - -[Event ID 300 - Windows Hello successfully created](passport-event-300.md) - -[Windows Hello biometrics in the enterprise](windows-hello-in-enterprise.md) \ No newline at end of file +- [Manage identity verification using Windows Hello for Business](hello-manage-identity-verification.md) +- [How Windows Hello for Business works](hello-how-it-works.md) +- [Implement Windows Hello for Business in your organization](hello-implement-in-organization.md) +- [Enable phone sign-in to PC or VPN](hello-enable-phone-signin.md) +- [Why a PIN is better than a password](hello-why-pin-is-better-than-password.md) +- [Prepare people to use Windows Hello](hello-prepare-people-to-use.md) +- [Windows Hello and password changes](hello-and-password-changes.md) +- [Event ID 300 - Windows Hello successfully created](hello-event-300.md) +- [Windows Hello biometrics in the enterprise](hello-biometrics-in-enterprise.md) \ No newline at end of file diff --git a/windows/keep-secure/hello-event-300.md b/windows/keep-secure/hello-event-300.md index 25c9b86986..a366e3a402 100644 --- a/windows/keep-secure/hello-event-300.md +++ b/windows/keep-secure/hello-event-300.md @@ -20,12 +20,12 @@ localizationpriority: high This event is created when Windows Hello for Business is successfully created and registered with Azure Active Directory (Azure AD). Applications or services can trigger actions on this event. For example, a certificate provisioning service can listen to this event and trigger a certificate request. ## Event details -| | | -|--------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| -| **Product:** | Windows 10 operating system | -| **ID:** | 300 | -| **Source:** | Microsoft Azure Device Registration Service | -| **Version:** | 10 | + +| **Product:** | Windows 10 operating system | +| --- | --- | +| **ID:** | 300 | +| **Source:** | Microsoft Azure Device Registration Service | +| **Version:** | 10 | | **Message:** | The NGC key was successfully registered. Key ID: {4476694e-8e3b-4ef8-8487-be21f95e6f07}. UPN:test@contoso.com. Attestation: ATT\_SOFT. Client request ID: . Server request ID: db2da6bd-3d70-4b9b-b26b-444f669902da. Server response: {"kid":"4476694e-8e3b-4ef8-8487-be21f95e6f07","upn":"test@contoso.com"} |   @@ -35,20 +35,12 @@ This is a normal condition. No further action is required. ## Related topics -[Manage identity verification using Windows Hello for Business](manage-identity-verification-using-microsoft-passport.md) - -[Implement Windows Hello for Business in your organization](implement-microsoft-passport-in-your-organization.md) - -[Enable phone sign-in to PC or VPN](enable-phone-signin-to-pc-and-vpn.md) - -[Why a PIN is better than a password](why-a-pin-is-better-than-a-password.md) - -[Prepare people to use Windows Hello](prepare-people-to-use-microsoft-passport.md) - -[Windows Hello and password changes](microsoft-passport-and-password-changes.md) - -[Windows Hello errors during PIN creation](microsoft-passport-errors-during-pin-creation.md) - -[Event ID 300 - Windows Hello successfully created](passport-event-300.md) - -[Windows Hello biometrics in the enterprise](windows-hello-in-enterprise.md) +- [Manage identity verification using Windows Hello for Business](hello-manage-identity-verification.md) +- [How Windows Hello for Business works](hello-how-it-works.md) +- [Implement Windows Hello for Business in your organization](hello-implement-in-organization.md) +- [Enable phone sign-in to PC or VPN](hello-enable-phone-signin.md) +- [Why a PIN is better than a password](hello-why-pin-is-better-than-password.md) +- [Prepare people to use Windows Hello](hello-prepare-people-to-use.md) +- [Windows Hello and password changes](hello-and-password-changes.md) +- [Windows Hello errors during PIN creation](hello-errors-during-pin-creation.md) +- [Windows Hello biometrics in the enterprise](hello-biometrics-in-enterprise.md) diff --git a/windows/keep-secure/hello-how-it-works.md b/windows/keep-secure/hello-how-it-works.md new file mode 100644 index 0000000000..d8b890e784 --- /dev/null +++ b/windows/keep-secure/hello-how-it-works.md @@ -0,0 +1,126 @@ +--- +title: How Windows Hello for Business works (Windows 10) +description: tbd +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security +author: jdeckerMS +localizationpriority: high +--- +# How Windows Hello for Business works + +**Applies to** +- Windows 10 +- Windows 10 Mobile + +To use Windows Hello to sign in with an identity provider (IDP), a user needs a configured device, which means that the Windows Hello life cycle starts when you configure a device for Windows Hello use. When the device is set up, its user can use the device to authenticate to services. In this section, we explore how device registration works, what happens when a user requests authentication, how key material is stored and processed, and which servers and infrastructure components are involved in different parts of this process. + +## Register a new user or device + +A goal of Windows Hello is to allow a user to open a brand-new device, securely join an organizational network to download and manage organizational data, and create a new Hello gesture to secure the device. Microsoft refers to the process of setting up a device for use with Windows Hello as registration. + +> [!NOTE] +>This is separate from the organizational configuration required to use Windows Hello with Active Directory or Azure AD; that configuration is discussed later in this guide. This configuration must be completed before users can begin to register. + + The registration process works like this: + +1. The user configures an account on the device. This account can be a local account on the device, a domain account stored in the on-premises Active Directory domain, a Microsoft account, or an Azure AD account. For a new device, this step may be as simple as logging on with a Microsoft account. Logging on with a Microsoft account on a Windows 10 device automatically sets up Windows Hello on the device; users don’t have to do anything extra to enable it. +2. To log on using that account, the user has to enter the existing credentials for it. The IDP that “owns” the account receives the credentials and authenticates the user. This IDP authentication may include the use of an existing second authentication factor, or proof. For example, a user who registers a new device by using an Azure AD account will have to provide an SMS-based proof that Azure AD sends. +3. When the user has provided the proof to the IDP, the user enables PIN authentication (Figure 1). The PIN will be associated with this particular credential. + +When the user sets the PIN, it becomes usable immediately + +Remember that Windows Hello depends on pairing a device and a credential, so the PIN chosen is associated only with the combination of the active account and that specific device. The PIN must comply with whatever length and complexity policy the account administrator has configured; this policy is enforced on the device side. Other registration scenarios that Windows Hello supports are: + +- A user who upgrades from the Windows 8.1 operating system will log on by using his or her existing enterprise password. That triggers MFA from the IDP side; after receiving and returning a proof, such as a text message or voice code, the IDP authenticates the user to the upgraded Windows 10 device, and the user can set his or her PIN. +- A user who typically uses a smart card to log on will be prompted to set up a PIN the first time he or she logs on to a Windows 10 device the user has not previously logged on to. +- A user who typically uses a virtual smart card to log on will be prompted to set up a PIN the first time he or she logs on to a Windows 10 device the user has not previously logged on to. + +When the user has completed this process, Windows Hello generates a new public–private key pair on the device. The TPM generates and stores this private key; if the device doesn’t have a TPM, the private key is encrypted and stored in software. This initial key is referred to as the protector key. It’s associated only with a single gesture; in other words, if a user registers a PIN, a fingerprint, and a face on the same device, each of those gestures will have a unique protector key. The protector key securely wraps the authentication key for a specific container. Each container has only one authentication key, but there can be multiple copies of that key wrapped with different unique protector keys (each of which is associated with a unique gesture). Windows Hello also generates an administrative key that the user or administrator can use to reset credentials, when necessary. In addition to the protector key, TPM-enabled devices generate a block of data that contains attestations from the TPM. + +At this point, the user has a PIN gesture defined on the device and an associated protector key for that PIN gesture. That means he or she is able to securely log on to the device with the PIN and thus that he or she can establish a trusted session with the device to add support for a biometric gesture as an alternative for the PIN. When you add a biometric gesture, it follows the same basic sequence: the user authenticates to the system by using his or her PIN, and then registers the new biometric (“smile for the camera!”), after which Windows generates a unique key pair and stores it securely. Future logons can then use either the PIN or the registered biometric gestures. + +## What’s a container? + +You’ll often hear the term container used in reference to MDM solutions. Windows Hello uses the term, too, but in a slightly different way. Container in this context is shorthand for a logical grouping of key material or data. Windows 10 supports two containers: the default container holds user key material for personal accounts, including key material associated with the user’s Microsoft account or with other consumer identity providers, and the enterprise container holds credentials associated with a workplace or school account. + +The enterprise container exists only on devices that have been registered with an organization; it contains key material for the enterprise IDP, such as on-premises Active Directory or Azure AD. The enterprise container contains only key data for Active Directory or Azure AD. If the enterprise container is present on a device, it’s unlocked separately from the default container, which maintains separation of data and access across personal and enterprise credentials and services. For example, a user who uses a biometric gesture to log on to a managed computer can separately unlock his or her personal container by entering a PIN when logging on to make a purchase from a website. These containers are logically separate. Organizations don’t have any control over the credentials users store in the default container, and applications that authenticate against services in the default container can’t use credentials from the enterprise container. However, individual Windows applications can use the Windows Hello application programming interfaces (APIs) to request access to credentials as appropriate, so that both consumer and LOB applications can be enhanced to take advantage of Windows Hello. + +It’s important to keep in mind that there are no physical containers on disk, in the registry, or elsewhere. Containers are logical units used to group related items. The keys, certificates, and credentials Windows Hello stores are protected without the creation of actual containers or folders. + +Each container actually contains a set of keys, some of which are used to protect other keys. Figure 3 shows an example: the protector key is used to encrypt the authentication key, and the authentication key is used to encrypt the individual keys stored in the container. + +![Each logical container holds one or more sets of keys](images/passport-fig3-logicalcontainer.png) + +Containers can contain several types of key material: + +- An authentication key, which is always an asymmetric public–private key pair. This key pair is generated during registration. It must be unlocked each time it’s accessed, by using either the user’s PIN or a previously generated biometric gesture. The authentication key exists until the user resets the PIN, at which time a new key will be generated. When the new key is generated, all the key material that the old key previously protected must be decrypted and re-encrypted using the new key. +- Virtual smart card keys are generated when a virtual smart card is generated and stored securely in the container. They’re available whenever the user’s container is unlocked. +- Secure/Multipurpose Internet Mail Extensions (S/MIME) keys and certificates, which a certification authority (CA) generates. The keys associated with the user’s S/MIME certificate can be stored in a Windows Hello container so they’re available to the user whenever the container is unlocked. +- The IDP key. These keys can be either symmetric or asymmetric, depending on which IDP you use. A single container may contain zero or more IDP keys, with some restrictions (for example, the enterprise container can contain zero or one IDP keys). IDP keys are stored in the container as illustrated in Figure 3. For certificate-based Windows Hello for Work, when the container is unlocked, applications that require access to the IDP key or key pair can request access. IDP keys are used to sign or encrypt authentication requests or tokens sent from this machine to the IDP. IDP keys are typically long lived but could have a shorter lifetime than the authentication key. Microsoft accounts, Active Directory accounts, and Azure AD accounts all require the use of asymmetric key pairs. The device generates public and private keys, registers the public key with the IDP (which stores it for later verification), and securely stores the private key. For enterprises, the IDP keys can be generated in two ways: + - The IDP key pair can be associated with an enterprise CA through the Windows Network Device Enrollment Service (NDES), described more fully in Network Device Enrollment Service Guidance. In this case, Windows Hello requests a new certificate with the same key as the certificate from the existing PKI. This option lets organizations that have an existing PKI continue to use it where appropriate. Given that many applications, such as popular virtual private network systems, require the use of certificates, when you deploy Windows Hello in this mode, it allows a faster transition away from user passwords while still preserving certificate-based functionality. This option also allows the enterprise to store additional certificates in the protected container. + - The IDP can generate the IDP key pair directly, which allows quick, lower-overhead deployment of Windows Hello in environments that don’t have or need a PKI. + +## How keys are protected + +Any time key material is generated, it must be protected against attack. The most robust way to do this is through specialized hardware. There’s a long history of using hardware security modules (HSMs) to generate, store, and process keys for security-critical applications. Smart cards are a special type of HSM, as are devices that are compliant with the Trusted Computing Group TPM standard. Wherever possible, the Windows Hello for Work implementation takes advantage of onboard TPM hardware to generate, store, and process keys. However, Windows Hello and Windows Hello for Work do not require an onboard TPM. Administrators can choose to allow key operations in software, in which case any user who has (or can escalate to) administrative rights on the machine can use the IDP keys to sign requests. As an alternative, in some scenarios, devices that don’t have a TPM can be remotely authenticated by using a device that does have a TPM, in which case all the sensitive operations are performed with the TPM and no key material is exposed. + +Whenever possible, Microsoft recommends the use of TPM hardware. The TPM protects against a variety of known and potential attacks, including PIN brute-force attacks. The TPM provides an additional layer of protection after an account lockout, too. When the TPM has locked the key material, the user will have to reset the PIN (which means he or she will have to use MFA to reauthenticate to the IDP before the IDP allows him or her to re-register). Resetting the PIN means that all keys and certificates encrypted with the old key material will be removed. + + +## Authentication + +When a user wants to access protected key material — perhaps to use an Internet site that requires a logon or to access protected resources on a corporate intranet — the authentication process begins with the user entering a PIN or biometric gesture to unlock the device, a process sometimes called releasing the key. Think of it like using a physical key to unlock a door: before you can unlock the door, you need to remove the key from your pocket or purse. On a personal device that’s connected to an organizational network, users will use their personal PIN or biometric to release the key; on a device joined to an on-premises or Azure AD domain, they will use the organizational PIN. This process unlocks the protector key for the primary container on the device. When that container is unlocked, applications (and thus the user) can use whatever IDP keys reside inside the container. + +These keys are used to sign requests that are sent to the IDP, requesting access to specified resources. It’s important to understand that although the keys are unlocked, applications cannot use them at will. Applications can use specific APIs to request operations that require key material for particular actions (for example, decrypt an email message or log on to a website). Access through these APIs doesn’t require explicit validation through a user gesture, and the key material isn’t exposed to the requesting application. Rather, the application asks for authentication, encryption, or decryption, and the Windows Hello layer handles the actual work and returns the results. Where appropriate, an application can request a forced authentication even on an unlocked device. Windows prompts the user to reenter the PIN or perform an authentication gesture, which adds an extra level of protection for sensitive data or actions. For example, you can configure the Windows Store to require reauthentication any time a user purchases an application, even though the same account and PIN or gesture were already used to unlock the device. + +The actual authentication process works like this: + +1. The client sends an empty authentication request to the IDP. (This is merely for the handshake process.) +2. The IDP returns a challenge, known as a nonce. +3. The device signs the nonce with the appropriate private key. +4. The device returns the original nonce, the signed nonce, and the ID of the key used to sign the nonce. +5. The IDP fetches the public key that the key ID specified, uses it to verify the signature on the nonce, and verifies that the nonce the device returned matches the original. +6. If all the checks in step 5 succeed, the IDP returns two data items: a symmetric key, which is encrypted with the device’s public key, and a security token, which is encrypted with the symmetric key. +7. The device uses its private key to decrypt the symmetric key, and then uses that symmetric key to decrypt the token. +8. The device makes a normal authentication request for the original resource, presenting the token from the IDP as its proof of authentication. + +When the IDP validates the signature, it is verifying that the request came from the specified user and device. The private key specific to the device signs the nonce, which allows the IDP to determine the identity of the requesting user and device so that it can apply policies for content access based on user, device type, or both together. For example, an IDP could allow access to one set of resources only from mobile devices and a different set from desktop devices. + +Remote unlock, which is planned for a future release of Windows 10, builds on these scenarios by enabling seamless remote authentication from a mobile device as a second factor. For example, suppose that you’re visiting another office at your company and you need to borrow a computer there temporarily, but you don’t want to potentially expose your credentials to capture. Rather than type in your credentials, you can click other user on the Windows 10 logon screen, type your user name, pick the tile for remote authentication, and use an app on your phone, which you already unlocked by using its built-in facial-recognition sensors. The phone and computer are paired and handshake via Bluetooth, you type your authentication PIN on the phone, and the computer gets confirmation of your identity from the IDP. All this happens without typing a password anywhere or typing your PIN on the PC. + +## The infrastructure + +Windows Hello depends on having compatible IDPs available to it. As of this writing, that means you have four deployment possibilities: + +- Use an existing Windows-based PKI centered around Active Directory Certificate Services. This option requires additional infrastructure, including a way to issue certificates to devices. You can use NDES to register devices directly, Microsoft System Center Configuration Manager or later for on-premises environments, or Microsoft Intune where it’s available to manage mobile device participation in Windows Hello. +- You can configure Windows Server 2016 domain controllers to act as IDPs for Windows Hello. In this mode, the Windows Server 2016 domain controllers act as IDPs alongside any existing Windows Server 2008 R2 or later domain controllers. There is no requirement to replace all existing domain controllers, merely to introduce at least one Windows Server 2016 domain controller per Active Directory site and update the forest Active Directory Domain Services (AD DS) schema to Windows Server 2016 Technical Preview. +- The normal discovery mechanism that clients use to find domain controllers and global catalogs relies on Domain Name System (DNS) SRV records, but those records don’t contain version data. Windows 10 computers will query DNS for SRV records to find all available Active Directory servers, and then query each server to identify those that can act as Windows Hello IDPs. The number of authentication requests your users generate, where your users are located, and the design of your network all drive the number of Windows Server 2016 domain controllers required. +- Azure AD can act as an IDP either by itself or alongside an on-premises AD DS forest. Organizations that use Azure AD can register devices directly without having to join them to a local domain by using the capabilities the Azure AD Device Registration service provides. In addition to the IDP, Windows Hello requires an MDM system. This system can be the cloud-based Intune if you use Azure AD, or an on-premises System Center Configuration Manager deployment that meets the system requirements described in the Deployment requirements section of this document. + + + + + + + + + + + + + + + +## Related topics + +- [Manage identity verification using Windows Hello for Business](hello-manage-identity-verification.md) +- [Implement Windows Hello for Business in your organization](hello-implement-in-organization.md) +- [Enable phone sign-in to PC or VPN](hello-enable-phone-signin.md) +- [Why a PIN is better than a password](hello-why-pin-is-better-than-password.md) +- [Prepare people to use Windows Hello](hello-prepare-people-to-use.md) +- [Windows Hello and password changes](hello-and-password-changes.md) +- [Windows Hello errors during PIN creation](hello-errors-during-pin-creation.md) +- [Event ID 300 - Windows Hello successfully created](hello-event-300.md) +- [Windows Hello biometrics in the enterprise](hello-biometrics-in-enterprise.md) \ No newline at end of file diff --git a/windows/keep-secure/hello-implement-in-organization.md b/windows/keep-secure/hello-implement-in-organization.md index b9e72308cc..7429667875 100644 --- a/windows/keep-secure/hello-implement-in-organization.md +++ b/windows/keep-secure/hello-implement-in-organization.md @@ -300,6 +300,8 @@ The following table lists the MDM policy settings that you can configure for Win   ## Prerequisites +To deploy Windows Hello for Business, in some modes you must add Windows Server 2016 domain controllers to your Active Directory environment, but you don’t have to replace or remove your existing Active Directory servers — the servers required for Windows Hello for Business build on and add capability to your existing infrastructure. You don’t have to change the domain or forest functional level, and you can either add on-premises servers or use Azure Active Directory to deploy Windows Hello for Business in your network. + You’ll need this software to set Windows Hello for Business policies in your enterprise. @@ -369,21 +371,12 @@ The PIN is managed using the same Windows Hello for Business policies that you c ## Related topics -[Windows Hello biometrics in the enterprise](windows-hello-in-enterprise.md) - -[Why a PIN is better than a password](why-a-pin-is-better-than-a-password.md) - -[Manage identity verification using Windows Hello for Business](manage-identity-verification-using-microsoft-passport.md) - -[Enable phone sign-in to PC or VPN](enable-phone-signin-to-pc-and-vpn.md) - -[Prepare people to use Windows Hello](prepare-people-to-use-microsoft-passport.md) - -[Windows Hello and password changes](microsoft-passport-and-password-changes.md) - -[Windows Hello errors during PIN creation](microsoft-passport-errors-during-pin-creation.md) - -[Event ID 300 - Windows Hello successfully created](passport-event-300.md) - -[Windows Hello biometrics in the enterprise](windows-hello-in-enterprise.md) -  \ No newline at end of file +- [Manage identity verification using Windows Hello for Business](hello-manage-identity-verification.md) +- [How Windows Hello for Business works](hello-how-it-works.md) +- [Enable phone sign-in to PC or VPN](hello-enable-phone-signin.md) +- [Why a PIN is better than a password](hello-why-pin-is-better-than-password.md) +- [Prepare people to use Windows Hello](hello-prepare-people-to-use.md) +- [Windows Hello and password changes](hello-and-password-changes.md) +- [Windows Hello errors during PIN creation](hello-errors-during-pin-creation.md) +- [Event ID 300 - Windows Hello successfully created](hello-event-300.md) +- [Windows Hello biometrics in the enterprise](hello-biometrics-in-enterprise.md) \ No newline at end of file diff --git a/windows/keep-secure/hello-manage-identity-verification.md b/windows/keep-secure/hello-manage-identity-verification.md index 71b7ad88c9..d1c4c0da7c 100644 --- a/windows/keep-secure/hello-manage-identity-verification.md +++ b/windows/keep-secure/hello-manage-identity-verification.md @@ -79,6 +79,7 @@ Hello also enables Windows 10 Mobile devices to be used as [a remote credential - Personal (Microsoft account) and corporate (Active Directory or Azure AD) accounts use a single container for keys. All keys are separated by identity providers' domains to help ensure user privacy. - Certificate private keys can be protected by the Hello container and the Hello gesture. +For details, see [How Windows Hello for Business works](hello-how-it-works.md). ## Comparing key-based and certificate-based authentication @@ -109,19 +110,13 @@ When identity providers such as Active Directory or Azure AD enroll a certificat ## Related topics -[Implement Windows Hello for Business in your organization](implement-microsoft-passport-in-your-organization.md) - -[Enable phone sign-in to PC or VPN](enable-phone-signin-to-pc-and-vpn.md) - -[Why a PIN is better than a password](why-a-pin-is-better-than-a-password.md) - -[Prepare people to use Windows Hello](prepare-people-to-use-microsoft-passport.md) - -[Windows Hello and password changes](microsoft-passport-and-password-changes.md) - -[Windows Hello errors during PIN creation](microsoft-passport-errors-during-pin-creation.md) - -[Event ID 300 - Windows Hello successfully created](passport-event-300.md) - -[Windows Hello biometrics in the enterprise](windows-hello-in-enterprise.md) +- [How Windows Hello for Business works](hello-how-it-works.md) +- [Implement Windows Hello for Business in your organization](hello-implement-in-organization.md) +- [Enable phone sign-in to PC or VPN](hello-enable-phone-signin.md) +- [Why a PIN is better than a password](hello-why-pin-is-better-than-password.md) +- [Prepare people to use Windows Hello](hello-prepare-people-to-use.md) +- [Windows Hello and password changes](hello-and-password-changes.md) +- [Windows Hello errors during PIN creation](hello-errors-during-pin-creation.md) +- [Event ID 300 - Windows Hello successfully created](hello-event-300.md) +- [Windows Hello biometrics in the enterprise](hello-biometrics-in-enterprise.md)   diff --git a/windows/keep-secure/hello-prepare-people-to-use.md b/windows/keep-secure/hello-prepare-people-to-use.md index f6419c6ced..2991666df4 100644 --- a/windows/keep-secure/hello-prepare-people-to-use.md +++ b/windows/keep-secure/hello-prepare-people-to-use.md @@ -97,20 +97,13 @@ You simply connect to VPN as you normally would. If the phone's certificates are ## Related topics -[Manage identity verification using Windows Hello for Business](manage-identity-verification-using-microsoft-passport.md) - -[Implement Windows Hello for Business in your organization](implement-microsoft-passport-in-your-organization.md) - -[Enable phone sign-in to PC or VPN](enable-phone-signin-to-pc-and-vpn.md) - -[Why a PIN is better than a password](why-a-pin-is-better-than-a-password.md) - -[Windows Hello and password changes](microsoft-passport-and-password-changes.md) - -[Windows Hello errors during PIN creation](microsoft-passport-errors-during-pin-creation.md) - -[Event ID 300 - Windows Hello successfully created](passport-event-300.md) - -[Windows Hello biometrics in the enterprise](windows-hello-in-enterprise.md) - +- [Manage identity verification using Windows Hello for Business](hello-manage-identity-verification.md) +- [How Windows Hello for Business works](hello-how-it-works.md) +- [Implement Windows Hello for Business in your organization](hello-implement-in-organization.md) +- [Enable phone sign-in to PC or VPN](hello-enable-phone-signin.md) +- [Why a PIN is better than a password](hello-why-pin-is-better-than-password.md) +- [Windows Hello and password changes](hello-and-password-changes.md) +- [Windows Hello errors during PIN creation](hello-errors-during-pin-creation.md) +- [Event ID 300 - Windows Hello successfully created](hello-event-300.md) +- [Windows Hello biometrics in the enterprise](hello-biometrics-in-enterprise.md) diff --git a/windows/keep-secure/hello-why-pin-is-better-than-password.md b/windows/keep-secure/hello-why-pin-is-better-than-password.md index 4fb387f147..ad4f77ab13 100644 --- a/windows/keep-secure/hello-why-pin-is-better-than-password.md +++ b/windows/keep-secure/hello-why-pin-is-better-than-password.md @@ -70,7 +70,12 @@ If you only had a biometric sign-in configured and, for any reason, were unable ## Related topics -[Manage identity verification using Windows Hello for Business](manage-identity-verification-using-microsoft-passport.md) - -[Implement Windows Hello for Business in your organization](implement-microsoft-passport-in-your-organization.md) -  \ No newline at end of file +- [Manage identity verification using Windows Hello for Business](hello-manage-identity-verification.md) +- [How Windows Hello for Business works](hello-how-it-works.md) +- [Implement Windows Hello for Business in your organization](hello-implement-in-organization.md) +- [Enable phone sign-in to PC or VPN](hello-enable-phone-signin.md) +- [Prepare people to use Windows Hello](hello-prepare-people-to-use.md) +- [Windows Hello and password changes](hello-and-password-changes.md) +- [Windows Hello errors during PIN creation](hello-errors-during-pin-creation.md) +- [Event ID 300 - Windows Hello successfully created](hello-event-300.md) +- [Windows Hello biometrics in the enterprise](hello-biometrics-in-enterprise.md) \ No newline at end of file diff --git a/windows/keep-secure/implement-microsoft-passport-in-your-organization.md b/windows/keep-secure/implement-microsoft-passport-in-your-organization.md index a8ac5e3d46..8939418730 100644 --- a/windows/keep-secure/implement-microsoft-passport-in-your-organization.md +++ b/windows/keep-secure/implement-microsoft-passport-in-your-organization.md @@ -8,7 +8,7 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security author: jdeckerMS -redirect_url: /hello-implement-in-organization +redirect_url: https://technet.microsoft.com/en-us/itpro/windows/keep-secure/hello-implement-in-organization --- # Implement Windows Hello for Business in your organization @@ -300,6 +300,8 @@ The following table lists the MDM policy settings that you can configure for Win   ## Prerequisites +To deploy Windows Hello for Business, in some modes you must add Windows Server 2016 domain controllers to your Active Directory environment, but you don’t have to replace or remove your existing Active Directory servers — the servers required for Windows Hello for Business build on and add capability to your existing infrastructure. You don’t have to change the domain or forest functional level, and you can either add on-premises servers or use Azure Active Directory to deploy Windows Hello for Business in your network. + You’ll need this software to set Windows Hello for Business policies in your enterprise.
diff --git a/windows/keep-secure/manage-identity-verification-using-microsoft-passport.md b/windows/keep-secure/manage-identity-verification-using-microsoft-passport.md index 2b9656fb8f..b73f0dbc9d 100644 --- a/windows/keep-secure/manage-identity-verification-using-microsoft-passport.md +++ b/windows/keep-secure/manage-identity-verification-using-microsoft-passport.md @@ -8,7 +8,7 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security, mobile author: jdeckerMS -redirect_url: /hello-manage-identity-verification +redirect_url: https://technet.microsoft.com/en-us/itpro/windows/keep-secure/hello-manage-identity-verification --- # Manage identity verification using Windows Hello for Business @@ -37,7 +37,14 @@ After an initial two-step verification of the user during enrollment, Hello is s As an administrator in an enterprise or educational organization, you can create policies to manage Hello use on Windows 10-based devices that connect to your organization. + ## Biometric sign-in + Windows Hello provides reliable, fully integrated biometric authentication based on facial recognition or fingerprint matching. Hello uses a combination of special infrared (IR) cameras and software to increase accuracy and guard against spoofing. Major hardware vendors are shipping devices that have integrated Windows Hello-compatible cameras, and fingerprint reader hardware can be used or added to devices that don’t currently have it. On devices that support Windows Hello, an easy biometric gesture unlocks users’ credentials. + + - **Facial recognition**. This type uses special cameras that see in IR light, which allows them to reliably tell the difference between a photograph or scan and a living person. Several vendors are shipping external cameras that incorporate this technology, and major laptop manufacturers are incorporating it into their devices, as well. +- **Fingerprint recognition**. This type uses a capacitive fingerprint sensor to scan your fingerprint. Fingerprint readers have been available for Windows computers for years, but the current generation of sensors is significantly more reliable and less error-prone. Most existing fingerprint readers (whether external or integrated into laptops or USB keyboards) work with Windows 10. + +Biometric data used to implement Windows Hello is stored securely on the local device only. It doesn’t roam and is never sent to external devices or servers. Because Windows Hello only stores biometric identification data on the device, there’s no single collection point an attacker can compromise to steal biometric data. ## The difference between Windows Hello and Windows Hello for Business @@ -67,8 +74,9 @@ Hello also enables Windows 10 Mobile devices to be used as [a remote credential > [!NOTE] >  Phone sign-in is currently limited to select Technology Adoption Program (TAP) participants. -  -## How Windows Hello for Business works: key points + + +### How Windows Hello for Business works : Key points - Hello credentials are based on certificate or asymmetrical key pair. Hello credentials are bound to the device, and the token that is obtained using the credential is also bound to the device. - Identify provider (such as Active Directory, Azure AD, or a Microsoft account) validates user identity and maps Hello's public key to a user account during the registration step. @@ -79,6 +87,7 @@ Hello also enables Windows 10 Mobile devices to be used as [a remote credential - Personal (Microsoft account) and corporate (Active Directory or Azure AD) accounts use a single container for keys. All keys are separated by identity providers' domains to help ensure user privacy. - Certificate private keys can be protected by the Hello container and the Hello gesture. +For a detailed explanation, see [How Windows Hello for Business works](hello-how-it-works.md). ## Comparing key-based and certificate-based authentication @@ -109,19 +118,13 @@ When identity providers such as Active Directory or Azure AD enroll a certificat ## Related topics -[Implement Windows Hello for Business in your organization](implement-microsoft-passport-in-your-organization.md) - -[Enable phone sign-in to PC or VPN](enable-phone-signin-to-pc-and-vpn.md) - -[Why a PIN is better than a password](why-a-pin-is-better-than-a-password.md) - -[Prepare people to use Windows Hello](prepare-people-to-use-microsoft-passport.md) - -[Windows Hello and password changes](microsoft-passport-and-password-changes.md) - -[Windows Hello errors during PIN creation](microsoft-passport-errors-during-pin-creation.md) - -[Event ID 300 - Windows Hello successfully created](passport-event-300.md) - -[Windows Hello biometrics in the enterprise](windows-hello-in-enterprise.md) -  +- [Manage identity verification using Windows Hello for Business](hello-manage-identity-verification.md) +- [How Windows Hello for Business works](hello-how-it-works.md) +- [Implement Windows Hello for Business in your organization](hello-implement-in-organization.md) +- [Enable phone sign-in to PC or VPN](hello-enable-phone-signin.md) +- [Why a PIN is better than a password](hello-why-pin-is-better-than-password.md) +- [Prepare people to use Windows Hello](hello-prepare-people-to-use.md) +- [Windows Hello and password changes](hello-and-password-changes.md) +- [Windows Hello errors during PIN creation](hello-errors-during-pin-creation.md) +- [Event ID 300 - Windows Hello successfully created](hello-event-300.md) +- [Windows Hello biometrics in the enterprise](hello-biometrics-in-enterprise.md) \ No newline at end of file diff --git a/windows/keep-secure/microsoft-passport-and-password-changes.md b/windows/keep-secure/microsoft-passport-and-password-changes.md index 7eddfa84a4..3fa30f4786 100644 --- a/windows/keep-secure/microsoft-passport-and-password-changes.md +++ b/windows/keep-secure/microsoft-passport-and-password-changes.md @@ -7,7 +7,7 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security author: jdeckerMS -redirect_url: /hello-and-password-changes +redirect_url: https://technet.microsoft.com/en-us/itpro/windows/keep-secure/hello-and-password-changes --- # Windows Hello and password changes diff --git a/windows/keep-secure/microsoft-passport-errors-during-pin-creation.md b/windows/keep-secure/microsoft-passport-errors-during-pin-creation.md index a0d5c75f85..61f8335040 100644 --- a/windows/keep-secure/microsoft-passport-errors-during-pin-creation.md +++ b/windows/keep-secure/microsoft-passport-errors-during-pin-creation.md @@ -8,7 +8,7 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security author: jdeckerMS -redirect_url: /hello-errors-during-pin-creation +redirect_url: https://technet.microsoft.com/en-us/itpro/windows/keep-secure/hello-errors-during-pin-creation --- # Windows Hello errors during PIN creation diff --git a/windows/keep-secure/microsoft-passport-guide.md b/windows/keep-secure/microsoft-passport-guide.md index d4bd6e4d33..d921444e45 100644 --- a/windows/keep-secure/microsoft-passport-guide.md +++ b/windows/keep-secure/microsoft-passport-guide.md @@ -8,7 +8,7 @@ ms.mktglfcycl: plan ms.sitesec: library ms.pagetype: security author: challum -localizationpriority: high +redirect_url: https://technet.microsoft.com/en-us/itpro/windows/keep-secure/hello-implement-in-organization --- # Microsoft Passport guide diff --git a/windows/keep-secure/passport-event-300.md b/windows/keep-secure/passport-event-300.md index 1c0937e186..80298cf4fe 100644 --- a/windows/keep-secure/passport-event-300.md +++ b/windows/keep-secure/passport-event-300.md @@ -8,7 +8,7 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security author: jdeckerMS -redirect_url: /hello-event-300 +redirect_url: https://technet.microsoft.com/en-us/itpro/windows/keep-secure/hello-event-300 --- # Event ID 300 - Windows Hello successfully created diff --git a/windows/keep-secure/prepare-people-to-use-microsoft-passport.md b/windows/keep-secure/prepare-people-to-use-microsoft-passport.md index 4cb911fcc0..cde8099b99 100644 --- a/windows/keep-secure/prepare-people-to-use-microsoft-passport.md +++ b/windows/keep-secure/prepare-people-to-use-microsoft-passport.md @@ -8,7 +8,7 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security author: jdeckerMS -redirect_url: /hello-prepare-people-to-use +redirect_url: https://technet.microsoft.com/en-us/itpro/windows/keep-secure/hello-prepare-people-to-use --- # Prepare people to use Windows Hello diff --git a/windows/keep-secure/why-a-pin-is-better-than-a-password.md b/windows/keep-secure/why-a-pin-is-better-than-a-password.md index 7eac794a90..5fccb990f7 100644 --- a/windows/keep-secure/why-a-pin-is-better-than-a-password.md +++ b/windows/keep-secure/why-a-pin-is-better-than-a-password.md @@ -8,7 +8,7 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security author: jdeckerMS -redirect_url: /hello-why-pin-is-better-than-password +redirect_url: https://technet.microsoft.com/en-us/itpro/windows/keep-secure/hello-why-pin-is-better-than-password --- # Why a PIN is better than a password diff --git a/windows/keep-secure/windows-hello-in-enterprise.md b/windows/keep-secure/windows-hello-in-enterprise.md index 39a3d66e35..09380ebe1f 100644 --- a/windows/keep-secure/windows-hello-in-enterprise.md +++ b/windows/keep-secure/windows-hello-in-enterprise.md @@ -8,7 +8,7 @@ ms.mktglfcycl: explore ms.sitesec: library ms.pagetype: security author: jdeckerMS -redirect_url: /hello-biometrics-in-enterprise +redirect_url: https://technet.microsoft.com/en-us/itpro/windows/keep-secure/hello-biometrics-in-enterprise --- # Windows Hello biometrics in the enterprise From 1bbc16e3b30e5fcf152823f13cf5527294bd6a8d Mon Sep 17 00:00:00 2001 From: jdeckerMS Date: Wed, 28 Sep 2016 12:22:35 -0700 Subject: [PATCH 07/87] tweak how it works for rs1 --- windows/keep-secure/hello-how-it-works.md | 41 +++++++++++------------ 1 file changed, 19 insertions(+), 22 deletions(-) diff --git a/windows/keep-secure/hello-how-it-works.md b/windows/keep-secure/hello-how-it-works.md index d8b890e784..c8100862aa 100644 --- a/windows/keep-secure/hello-how-it-works.md +++ b/windows/keep-secure/hello-how-it-works.md @@ -1,6 +1,6 @@ --- title: How Windows Hello for Business works (Windows 10) -description: tbd +description: Explains registration, authentication, key material, and infrastructure for Windows Hello for Business. ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library @@ -14,42 +14,40 @@ localizationpriority: high - Windows 10 - Windows 10 Mobile -To use Windows Hello to sign in with an identity provider (IDP), a user needs a configured device, which means that the Windows Hello life cycle starts when you configure a device for Windows Hello use. When the device is set up, its user can use the device to authenticate to services. In this section, we explore how device registration works, what happens when a user requests authentication, how key material is stored and processed, and which servers and infrastructure components are involved in different parts of this process. +To use Windows Hello to sign in with an identity provider (IDP), a user needs a configured device, which means that the Windows Hello life cycle starts when you register a new user or device. When the device is set up, its user can use the device to authenticate to services. This topic explains how device registration works, what happens when a user requests authentication, how key material is stored and processed, and which servers and infrastructure components are involved in different parts of this process. ## Register a new user or device A goal of Windows Hello is to allow a user to open a brand-new device, securely join an organizational network to download and manage organizational data, and create a new Hello gesture to secure the device. Microsoft refers to the process of setting up a device for use with Windows Hello as registration. > [!NOTE] ->This is separate from the organizational configuration required to use Windows Hello with Active Directory or Azure AD; that configuration is discussed later in this guide. This configuration must be completed before users can begin to register. +>This is separate from the organizational configuration required to use Windows Hello with Active Directory or Azure Active Directory (Azure AD); that configuration information is in [Implement Windows Hello for Business in your organization](hello-implement-in-organization.md). Organizational configuration must be completed before users can begin to register. The registration process works like this: -1. The user configures an account on the device. This account can be a local account on the device, a domain account stored in the on-premises Active Directory domain, a Microsoft account, or an Azure AD account. For a new device, this step may be as simple as logging on with a Microsoft account. Logging on with a Microsoft account on a Windows 10 device automatically sets up Windows Hello on the device; users don’t have to do anything extra to enable it. -2. To log on using that account, the user has to enter the existing credentials for it. The IDP that “owns” the account receives the credentials and authenticates the user. This IDP authentication may include the use of an existing second authentication factor, or proof. For example, a user who registers a new device by using an Azure AD account will have to provide an SMS-based proof that Azure AD sends. -3. When the user has provided the proof to the IDP, the user enables PIN authentication (Figure 1). The PIN will be associated with this particular credential. - -When the user sets the PIN, it becomes usable immediately +1. The user configures an account on the device. This account can be a local account on the device, a domain account stored in the on-premises Active Directory domain, a Microsoft account, or an Azure AD account. For a new device, this step may be as simple as signing in with a Microsoft account. Signing in with a Microsoft account on a Windows 10 device automatically sets up Windows Hello on the device; users don’t have to do anything extra to enable it. +2. To sign in using that account, the user has to enter the existing credentials for it. The IDP that “owns” the account receives the credentials and authenticates the user. This IDP authentication may include the use of an existing second authentication factor, or proof. For example, a user who registers a new device by using an Azure AD account will have to provide an SMS-based proof that Azure AD sends. +3. When the user has provided the proof to the IDP, the user enables PIN authentication. The PIN will be associated with this particular credential. When the user sets the PIN, it becomes usable immediately Remember that Windows Hello depends on pairing a device and a credential, so the PIN chosen is associated only with the combination of the active account and that specific device. The PIN must comply with whatever length and complexity policy the account administrator has configured; this policy is enforced on the device side. Other registration scenarios that Windows Hello supports are: -- A user who upgrades from the Windows 8.1 operating system will log on by using his or her existing enterprise password. That triggers MFA from the IDP side; after receiving and returning a proof, such as a text message or voice code, the IDP authenticates the user to the upgraded Windows 10 device, and the user can set his or her PIN. -- A user who typically uses a smart card to log on will be prompted to set up a PIN the first time he or she logs on to a Windows 10 device the user has not previously logged on to. -- A user who typically uses a virtual smart card to log on will be prompted to set up a PIN the first time he or she logs on to a Windows 10 device the user has not previously logged on to. +- A user who upgrades from the Windows 8.1 operating system will sign in by using the existing enterprise password. That triggers MFA from the IDP side; after receiving and returning a proof, such as a text message or voice code, the IDP authenticates the user to the upgraded Windows 10 device, and the user can set his or her PIN. +- A user who typically uses a smart card to sign in will be prompted to set up a PIN the first time he or she signs in to a Windows 10 device the user has not previously signed in to. +- A user who typically uses a virtual smart card to sign in will be prompted to set up a PIN the first time he or she signs in to a Windows 10 device the user has not previously signed in to. When the user has completed this process, Windows Hello generates a new public–private key pair on the device. The TPM generates and stores this private key; if the device doesn’t have a TPM, the private key is encrypted and stored in software. This initial key is referred to as the protector key. It’s associated only with a single gesture; in other words, if a user registers a PIN, a fingerprint, and a face on the same device, each of those gestures will have a unique protector key. The protector key securely wraps the authentication key for a specific container. Each container has only one authentication key, but there can be multiple copies of that key wrapped with different unique protector keys (each of which is associated with a unique gesture). Windows Hello also generates an administrative key that the user or administrator can use to reset credentials, when necessary. In addition to the protector key, TPM-enabled devices generate a block of data that contains attestations from the TPM. -At this point, the user has a PIN gesture defined on the device and an associated protector key for that PIN gesture. That means he or she is able to securely log on to the device with the PIN and thus that he or she can establish a trusted session with the device to add support for a biometric gesture as an alternative for the PIN. When you add a biometric gesture, it follows the same basic sequence: the user authenticates to the system by using his or her PIN, and then registers the new biometric (“smile for the camera!”), after which Windows generates a unique key pair and stores it securely. Future logons can then use either the PIN or the registered biometric gestures. +At this point, the user has a PIN gesture defined on the device and an associated protector key for that PIN gesture. That means he or she is able to securely sign in to the device with the PIN and thus that he or she can establish a trusted session with the device to add support for a biometric gesture as an alternative for the PIN. When you add a biometric gesture, it follows the same basic sequence: the user authenticates to the system by using his or her PIN, and then registers the new biometric (“smile for the camera!”), after which Windows generates a unique key pair and stores it securely. Future sign-ins can then use either the PIN or the registered biometric gestures. -## What’s a container? +## What’s a container? -You’ll often hear the term container used in reference to MDM solutions. Windows Hello uses the term, too, but in a slightly different way. Container in this context is shorthand for a logical grouping of key material or data. Windows 10 supports two containers: the default container holds user key material for personal accounts, including key material associated with the user’s Microsoft account or with other consumer identity providers, and the enterprise container holds credentials associated with a workplace or school account. +You’ll often hear the term *container* used in reference to mobile device management (MDM) solutions. Windows Hello uses the term, too, but in a slightly different way. Container in this context is shorthand for a logical grouping of key material or data. Windows 10 Hello uses a single container that holds user key material for personal accounts, including key material associated with the user’s Microsoft account or with other consumer identity providers, and credentials associated with a workplace or school account. -The enterprise container exists only on devices that have been registered with an organization; it contains key material for the enterprise IDP, such as on-premises Active Directory or Azure AD. The enterprise container contains only key data for Active Directory or Azure AD. If the enterprise container is present on a device, it’s unlocked separately from the default container, which maintains separation of data and access across personal and enterprise credentials and services. For example, a user who uses a biometric gesture to log on to a managed computer can separately unlock his or her personal container by entering a PIN when logging on to make a purchase from a website. These containers are logically separate. Organizations don’t have any control over the credentials users store in the default container, and applications that authenticate against services in the default container can’t use credentials from the enterprise container. However, individual Windows applications can use the Windows Hello application programming interfaces (APIs) to request access to credentials as appropriate, so that both consumer and LOB applications can be enhanced to take advantage of Windows Hello. +The container holds enterprise credentials only on devices that have been registered with an organization; it contains key material for the enterprise IDP, such as on-premises Active Directory or Azure AD. It’s important to keep in mind that there are no physical containers on disk, in the registry, or elsewhere. Containers are logical units used to group related items. The keys, certificates, and credentials Windows Hello stores are protected without the creation of actual containers or folders. -Each container actually contains a set of keys, some of which are used to protect other keys. Figure 3 shows an example: the protector key is used to encrypt the authentication key, and the authentication key is used to encrypt the individual keys stored in the container. +The container actually contains a set of keys, some of which are used to protect other keys. The following image shows an example: the protector key is used to encrypt the authentication key, and the authentication key is used to encrypt the individual keys stored in the container. ![Each logical container holds one or more sets of keys](images/passport-fig3-logicalcontainer.png) @@ -58,22 +56,22 @@ Containers can contain several types of key material: - An authentication key, which is always an asymmetric public–private key pair. This key pair is generated during registration. It must be unlocked each time it’s accessed, by using either the user’s PIN or a previously generated biometric gesture. The authentication key exists until the user resets the PIN, at which time a new key will be generated. When the new key is generated, all the key material that the old key previously protected must be decrypted and re-encrypted using the new key. - Virtual smart card keys are generated when a virtual smart card is generated and stored securely in the container. They’re available whenever the user’s container is unlocked. - Secure/Multipurpose Internet Mail Extensions (S/MIME) keys and certificates, which a certification authority (CA) generates. The keys associated with the user’s S/MIME certificate can be stored in a Windows Hello container so they’re available to the user whenever the container is unlocked. -- The IDP key. These keys can be either symmetric or asymmetric, depending on which IDP you use. A single container may contain zero or more IDP keys, with some restrictions (for example, the enterprise container can contain zero or one IDP keys). IDP keys are stored in the container as illustrated in Figure 3. For certificate-based Windows Hello for Work, when the container is unlocked, applications that require access to the IDP key or key pair can request access. IDP keys are used to sign or encrypt authentication requests or tokens sent from this machine to the IDP. IDP keys are typically long lived but could have a shorter lifetime than the authentication key. Microsoft accounts, Active Directory accounts, and Azure AD accounts all require the use of asymmetric key pairs. The device generates public and private keys, registers the public key with the IDP (which stores it for later verification), and securely stores the private key. For enterprises, the IDP keys can be generated in two ways: - - The IDP key pair can be associated with an enterprise CA through the Windows Network Device Enrollment Service (NDES), described more fully in Network Device Enrollment Service Guidance. In this case, Windows Hello requests a new certificate with the same key as the certificate from the existing PKI. This option lets organizations that have an existing PKI continue to use it where appropriate. Given that many applications, such as popular virtual private network systems, require the use of certificates, when you deploy Windows Hello in this mode, it allows a faster transition away from user passwords while still preserving certificate-based functionality. This option also allows the enterprise to store additional certificates in the protected container. +- The IDP key. These keys can be either symmetric or asymmetric, depending on which IDP you use. A single container may contain zero or more IDP keys, with some restrictions (for example, the enterprise container can contain zero or one IDP keys). IDP keys are stored in the container. For certificate-based Windows Hello for Work, when the container is unlocked, applications that require access to the IDP key or key pair can request access. IDP keys are used to sign or encrypt authentication requests or tokens sent from this device to the IDP. IDP keys are typically long-lived but could have a shorter lifetime than the authentication key. Microsoft accounts, Active Directory accounts, and Azure AD accounts all require the use of asymmetric key pairs. The device generates public and private keys, registers the public key with the IDP (which stores it for later verification), and securely stores the private key. For enterprises, the IDP keys can be generated in two ways: + - The IDP key pair can be associated with an enterprise Certificate Authority (CA) through the Windows Network Device Enrollment Service (NDES), described more fully in [Network Device Enrollment Service Guidance](https://technet.microsoft.com/library/hh831498.aspx). In this case, Windows Hello requests a new certificate with the same key as the certificate from the existing PKI. This option lets organizations that have an existing PKI continue to use it where appropriate. Given that many applications, such as popular virtual private network systems, require the use of certificates, when you deploy Windows Hello in this mode, it allows a faster transition away from user passwords while still preserving certificate-based functionality. This option also allows the enterprise to store additional certificates in the protected container. - The IDP can generate the IDP key pair directly, which allows quick, lower-overhead deployment of Windows Hello in environments that don’t have or need a PKI. ## How keys are protected -Any time key material is generated, it must be protected against attack. The most robust way to do this is through specialized hardware. There’s a long history of using hardware security modules (HSMs) to generate, store, and process keys for security-critical applications. Smart cards are a special type of HSM, as are devices that are compliant with the Trusted Computing Group TPM standard. Wherever possible, the Windows Hello for Work implementation takes advantage of onboard TPM hardware to generate, store, and process keys. However, Windows Hello and Windows Hello for Work do not require an onboard TPM. Administrators can choose to allow key operations in software, in which case any user who has (or can escalate to) administrative rights on the machine can use the IDP keys to sign requests. As an alternative, in some scenarios, devices that don’t have a TPM can be remotely authenticated by using a device that does have a TPM, in which case all the sensitive operations are performed with the TPM and no key material is exposed. +Any time key material is generated, it must be protected against attack. The most robust way to do this is through specialized hardware. There’s a long history of using hardware security modules (HSMs) to generate, store, and process keys for security-critical applications. Smart cards are a special type of HSM, as are devices that are compliant with the Trusted Computing Group TPM standard. Wherever possible, the Windows Hello for Work implementation takes advantage of onboard TPM hardware to generate, store, and process keys. However, Windows Hello and Windows Hello for Work do not require an onboard TPM. Administrators can choose to allow key operations in software, in which case any user who has (or can escalate to) administrative rights on the device can use the IDP keys to sign requests. As an alternative, in some scenarios, devices that don’t have a TPM can be remotely authenticated by using a device that does have a TPM, in which case all the sensitive operations are performed with the TPM and no key material is exposed. Whenever possible, Microsoft recommends the use of TPM hardware. The TPM protects against a variety of known and potential attacks, including PIN brute-force attacks. The TPM provides an additional layer of protection after an account lockout, too. When the TPM has locked the key material, the user will have to reset the PIN (which means he or she will have to use MFA to reauthenticate to the IDP before the IDP allows him or her to re-register). Resetting the PIN means that all keys and certificates encrypted with the old key material will be removed. ## Authentication -When a user wants to access protected key material — perhaps to use an Internet site that requires a logon or to access protected resources on a corporate intranet — the authentication process begins with the user entering a PIN or biometric gesture to unlock the device, a process sometimes called releasing the key. Think of it like using a physical key to unlock a door: before you can unlock the door, you need to remove the key from your pocket or purse. On a personal device that’s connected to an organizational network, users will use their personal PIN or biometric to release the key; on a device joined to an on-premises or Azure AD domain, they will use the organizational PIN. This process unlocks the protector key for the primary container on the device. When that container is unlocked, applications (and thus the user) can use whatever IDP keys reside inside the container. +When a user wants to access protected key material — perhaps to use an Internet site that requires a sign-in or to access protected resources on a corporate intranet — the authentication process begins with the user entering a PIN or biometric gesture to unlock the device, a process sometimes called releasing the key. Think of it like using a physical key to unlock a door: before you can unlock the door, you need to remove the key from your pocket or purse. On a personal device that’s connected to an organizational network, users will use their personal PIN or biometric to release the key; on a device joined to an on-premises or Azure AD domain, they will use the organizational PIN. This process unlocks the protector key for the container on the device. When that container is unlocked, applications (and thus the user) can use whatever IDP keys reside inside the container. -These keys are used to sign requests that are sent to the IDP, requesting access to specified resources. It’s important to understand that although the keys are unlocked, applications cannot use them at will. Applications can use specific APIs to request operations that require key material for particular actions (for example, decrypt an email message or log on to a website). Access through these APIs doesn’t require explicit validation through a user gesture, and the key material isn’t exposed to the requesting application. Rather, the application asks for authentication, encryption, or decryption, and the Windows Hello layer handles the actual work and returns the results. Where appropriate, an application can request a forced authentication even on an unlocked device. Windows prompts the user to reenter the PIN or perform an authentication gesture, which adds an extra level of protection for sensitive data or actions. For example, you can configure the Windows Store to require reauthentication any time a user purchases an application, even though the same account and PIN or gesture were already used to unlock the device. +These keys are used to sign requests that are sent to the IDP, requesting access to specified resources. It’s important to understand that although the keys are unlocked, applications cannot use them at will. Applications can use specific APIs to request operations that require key material for particular actions (for example, decrypt an email message or sign in to a website). Access through these APIs doesn’t require explicit validation through a user gesture, and the key material isn’t exposed to the requesting application. Rather, the application asks for authentication, encryption, or decryption, and the Windows Hello layer handles the actual work and returns the results. Where appropriate, an application can request a forced authentication even on an unlocked device. Windows prompts the user to reenter the PIN or perform an authentication gesture, which adds an extra level of protection for sensitive data or actions. For example, you can configure the Windows Store to require reauthentication any time a user purchases an application, even though the same account and PIN or gesture were already used to unlock the device. The actual authentication process works like this: @@ -88,7 +86,6 @@ The actual authentication process works like this: When the IDP validates the signature, it is verifying that the request came from the specified user and device. The private key specific to the device signs the nonce, which allows the IDP to determine the identity of the requesting user and device so that it can apply policies for content access based on user, device type, or both together. For example, an IDP could allow access to one set of resources only from mobile devices and a different set from desktop devices. -Remote unlock, which is planned for a future release of Windows 10, builds on these scenarios by enabling seamless remote authentication from a mobile device as a second factor. For example, suppose that you’re visiting another office at your company and you need to borrow a computer there temporarily, but you don’t want to potentially expose your credentials to capture. Rather than type in your credentials, you can click other user on the Windows 10 logon screen, type your user name, pick the tile for remote authentication, and use an app on your phone, which you already unlocked by using its built-in facial-recognition sensors. The phone and computer are paired and handshake via Bluetooth, you type your authentication PIN on the phone, and the computer gets confirmation of your identity from the IDP. All this happens without typing a password anywhere or typing your PIN on the PC. ## The infrastructure From 52e4a2523385625917db82fd8b676bd7f6e242fd Mon Sep 17 00:00:00 2001 From: jdeckerMS Date: Wed, 28 Sep 2016 12:48:09 -0700 Subject: [PATCH 08/87] done --- .../hello-implement-in-organization.md | 44 +++++++++++++++++-- 1 file changed, 41 insertions(+), 3 deletions(-) diff --git a/windows/keep-secure/hello-implement-in-organization.md b/windows/keep-secure/hello-implement-in-organization.md index 7429667875..42ecfedf3d 100644 --- a/windows/keep-secure/hello-implement-in-organization.md +++ b/windows/keep-secure/hello-implement-in-organization.md @@ -363,11 +363,49 @@ Configuration Manager and MDM provide the ability to manage Windows Hello for Bu Azure AD provides the ability to register devices with your enterprise and to provision Windows Hello for Business for organization accounts. -## Windows Hello for BYOD +## Approaches for a Windows Hello for Business deployment -Windows Hello can be managed on personal devices that your employees use for work purposes using MDM. On personal devices, users can create a personal Windows Hello PIN for unlocking the device and used this PIN for access to work resources. +Different organizations will necessarily take different approaches to the deployment of Windows Hello depending on their capabilities and needs, but there is only one strategy: deploy Windows Hello for Business throughout the organization to get maximum protection for the maximum number of devices and resources. Organizations can take one of three basic routes to accomplish that strategy: + +- Deploy Windows Hello for Business everywhere according to whatever device or user deployment strategy works best for the organization. +- Deploy Windows Hello for Business first to high-value or high-risk targets, by using conditional access policies to restrict access to key resources only to users who hold strong authentication credentials. +- Blend Windows Hello for Business into an existing multi-factor environment, using it as an additional form of strong authentication alongside physical or virtual smart cards. + +### Deploy Windows Hello for Business everywhere + +In this approach, you deploy Windows Hello throughout the organization in a coordinated rollout. In some ways, this method is similar to any other desktop deployment project; the only real difference is that you must already have the Windows Hello infrastructure in place to support device registration before you can start using Windows Hello on Windows 10 devices. + +You can still upgrade to Windows 10 or add new Windows 10 devices without changing your infrastructure. You just can’t use Windows Hello for Business on a device until the device joins Azure AD and receives the appropriate policy. The major benefit of this approach is that it provides uniform protection for all parts of the organization. Sophisticated attackers have shown a great deal of skill in breaching large organizations by identifying weak points in their security, including users and systems that don’t have high-value information but that can be exploited to get it. Applying consistent protection across every device that an attacker could use to access enterprise data is excellent protection against these types of attacks. + +The downside to this approach is its complexity. Smaller organizations may find that managing the rollout of a new operating system across all devices is beyond the scope of their experience and capability. For these organizations, users can self-upgrade, and new users may end up with Windows 10 because they get new devices when they join. Larger organizations, especially those that are highly decentralized or have operations across many physical sites, may have more deployment knowledge and resources but face the challenge of coordinating rollout efforts across a larger user base and footprint. + +For more information about desktop deployment of Windows 10, visit the [Windows 10 TechCenter](https://technet.microsoft.com/windows/mt240567). + +One key aspect of this deployment strategy is how to get Windows 10 in users’ hands. Because different organizations have wildly differing strategies to refresh hardware and software, there’s no one-size-fits-all strategy. For example, some organizations pursue a coordinated strategy that puts new desktop operating systems in users’ hands every 2–3 years on existing hardware, supplementing with new hardware only where and when required. Others tend to replace hardware and deploy whatever version of the Windows client operating system ships on the purchased devices. In both cases, there are typically separate deployment cycles for servers and server operating systems, and the desktop and server cycles may or may not be coordinated. + +In addition to the issue of Windows 10 deployment to users, you must consider how and when (or if!) you’ll deploy biometric devices to users. Because Windows Hello can take advantage of multiple biometric identifiers, you have a flexible range of device options, which includes the purchase of new devices that incorporate your selected biometric, seeding select users with appropriate devices, rollout of biometric devices as part of a scheduled hardware refresh and using PIN gestures until users get devices, or relying on remote unlock as a second authentication factor. + +### Deploy to high-value or high-risk targets + +This strategy takes into account the fact that in most networks, not every asset is equally protected or equally valuable. There are two ways to think about this. One is that you can focus on protecting the users and services that are most at risk of compromise because of their value. Examples include sensitive internal databases or the user accounts of your key executives. The other option is that you can focus on areas of your network that are the most vulnerable, such as users who travel frequently (and thus run a higher risk of lost or stolen devices or drive-by credential theft). Either way, the strategy is the same: selectively and quickly deploy Windows Hello to protect specific people and resources. For example, you might issue new Windows 10 devices with biometric sensors to all users who need access to a sensitive internal database, and then deploy the minimum required infrastructure to support Windows Hello–secured access to that database for those users. +One of the key design capabilities of Windows Hello for Business is that it supports Bring Your Own Device (BYOD) environments by allowing users to register their own devices with the organizational IDP (whether on premises, hybrid, or Azure AD). You may be able to take advantage of this capability to quickly deploy Windows Hello to protect your most vulnerable users or assets, ideally by using biometrics as an additional safety measure for the most valuable potential targets. + +### Blend Windows Hello with your infrastructure + +Organizations that have already invested in smart cards, virtual smart cards, or token-based systems can still benefit from Windows Hello. Of those organizations, many use physical tokens and smart cards to protect only critical assets because of the expense and complexity of their deployment. Windows Hello offers a valuable complement to these systems because it protects users who currently rely on reusable credentials; protection of all users’ credentials is an important step toward blunting attacks that seek to leverage compromise of any credential into a widespread breach. This approach also gives you a great deal of flexibility in scheduling and deployment. Some enterprises have deployed multi-use smart cards that provide building-access control, access to copiers or other office equipment, stored value for lunchroom purchases, remote network access, and other services. Deployment of Windows Hello in such environments doesn’t prevent you from continuing to use smart cards for these services. You can leave the existing smart card infrastructure in place for its existing use cases, and then register desktop and mobile devices in Windows Hello and use Windows Hello to secure access to network and Internet resources. This approach requires a more complicated infrastructure and a greater degree of organizational maturity because it requires you to link your existing PKI with an enrollment service and Windows Hello itself. + +Smart cards can act as a useful complement to Windows Hello in another important way: to bootstrap the initial logon for Windows Hello registration. When a user registers with Windows Hello on a device, part of that registration process requires a conventional logon. Rather than using a traditional password, organizations that have previously deployed the necessary infrastructure for smart cards or virtual smart cards can allow their users to register new devices by logging on with a smart card or virtual smart card. After the user has proved his or her identity to the organizational IDP with the smart card, the user can set up a PIN and proceed to use Windows Hello for future logons. + +### Choose a rollout method + +Which rollout method you choose depends on several factors: + +- How many devices you need to deploy. This number has a huge influence on your overall deployment. A global rollout for 75,000 users has different requirements than a phased rollout for groups of 200–300 users in different cities. +- How quickly you want to deploy Windows Hello for Business protection. This is a classic cost–benefit tradeoff. You have to balance the security benefits of Windows Hello for Business against the cost and time required to deploy it broadly, and different organizations may make entirely different decisions depending on how they rate the costs and benefits involved. Getting the broadest possible Windows Hello coverage in the shortest time possible maximizes security benefits. +- The type of devices you want to deploy. Windows device manufacturers are aggressively introducing new devices optimized for Windows 10, leading to the possibility that you might deploy Windows Hello first on newly purchased tablets and portable devices, and then deploy it on the desktop as part of your normal refresh cycle. +- What your current infrastructure looks like. The individual version of Windows Hello doesn’t require changes to your Active Directory environment, but to support Windows Hello for Business, you may need a compatible MDM system. Depending on the size and composition of your network, mobile enrollment and management services deployment may be a major project in its own right. +- Your plans for the cloud. If you’re already planning a move to the cloud, Azure AD eases the process of Windows Hello for Business deployment, because you can use Azure AD as an IDP alongside your existing on-premises AD DS setup without making significant changes to your on-premises environment. Future versions of Windows Hello for Business will support the ability to simultaneously register devices that are already members of an on-premises AD DS domain in an Azure AD partition so that they use Windows Hello for Business from the cloud. Hybrid deployments that combine AD DS with Azure AD give you the ability to keep machine authentication and policy management against your local AD DS domain while providing the full set of Windows Hello for Business services (and Microsoft Office 365 integration) for your users. If you plan to use on-premises AD DS only, then the design and configuration of your on-premises environment will dictate what kind of changes you may need to make. -The PIN is managed using the same Windows Hello for Business policies that you can use to manage Windows Hello for Business on organization-owned devices. The PIN can also be managed using DeviceLock policy. DeviceLock policy can be used to control length, complexity, history, and expiration requirements and can be configured using the [Policy configuration service provider](https://go.microsoft.com/fwlink/p/?LinkID=623244). ## Related topics From 5209f44deded2d1df74fa772f0ee3164a09e3905 Mon Sep 17 00:00:00 2001 From: jdeckerMS Date: Wed, 28 Sep 2016 12:52:24 -0700 Subject: [PATCH 09/87] save again --- .../hello-implement-in-organization.md | 21 ++++++++++++++----- 1 file changed, 16 insertions(+), 5 deletions(-) diff --git a/windows/keep-secure/hello-implement-in-organization.md b/windows/keep-secure/hello-implement-in-organization.md index 42ecfedf3d..581174a4f4 100644 --- a/windows/keep-secure/hello-implement-in-organization.md +++ b/windows/keep-secure/hello-implement-in-organization.md @@ -400,11 +400,22 @@ Smart cards can act as a useful complement to Windows Hello in another important Which rollout method you choose depends on several factors: -- How many devices you need to deploy. This number has a huge influence on your overall deployment. A global rollout for 75,000 users has different requirements than a phased rollout for groups of 200–300 users in different cities. -- How quickly you want to deploy Windows Hello for Business protection. This is a classic cost–benefit tradeoff. You have to balance the security benefits of Windows Hello for Business against the cost and time required to deploy it broadly, and different organizations may make entirely different decisions depending on how they rate the costs and benefits involved. Getting the broadest possible Windows Hello coverage in the shortest time possible maximizes security benefits. -- The type of devices you want to deploy. Windows device manufacturers are aggressively introducing new devices optimized for Windows 10, leading to the possibility that you might deploy Windows Hello first on newly purchased tablets and portable devices, and then deploy it on the desktop as part of your normal refresh cycle. -- What your current infrastructure looks like. The individual version of Windows Hello doesn’t require changes to your Active Directory environment, but to support Windows Hello for Business, you may need a compatible MDM system. Depending on the size and composition of your network, mobile enrollment and management services deployment may be a major project in its own right. -- Your plans for the cloud. If you’re already planning a move to the cloud, Azure AD eases the process of Windows Hello for Business deployment, because you can use Azure AD as an IDP alongside your existing on-premises AD DS setup without making significant changes to your on-premises environment. Future versions of Windows Hello for Business will support the ability to simultaneously register devices that are already members of an on-premises AD DS domain in an Azure AD partition so that they use Windows Hello for Business from the cloud. Hybrid deployments that combine AD DS with Azure AD give you the ability to keep machine authentication and policy management against your local AD DS domain while providing the full set of Windows Hello for Business services (and Microsoft Office 365 integration) for your users. If you plan to use on-premises AD DS only, then the design and configuration of your on-premises environment will dictate what kind of changes you may need to make. +- **How many devices you need to deploy**. This number has a huge influence on your overall deployment. A global rollout for 75,000 users has different requirements than a phased rollout for groups of 200–300 users in different cities. +- **How quickly you want to deploy Windows Hello for Business protection**. This is a classic cost–benefit tradeoff. You have to balance the security benefits of Windows Hello for Business against the cost and time required to deploy it broadly, and different organizations may make entirely different decisions depending on how they rate the costs and benefits involved. Getting the broadest possible Windows Hello coverage in the shortest time possible maximizes security benefits. +- **The type of devices you want to deploy**. Windows device manufacturers are aggressively introducing new devices optimized for Windows 10, leading to the possibility that you might deploy Windows Hello first on newly purchased tablets and portable devices, and then deploy it on the desktop as part of your normal refresh cycle. +-** What your current infrastructure looks like**. The individual version of Windows Hello doesn’t require changes to your Active Directory environment, but to support Windows Hello for Business, you may need a compatible MDM system. Depending on the size and composition of your network, mobile enrollment and management services deployment may be a major project in its own right. +- **Your plans for the cloud**. If you’re already planning a move to the cloud, Azure AD eases the process of Windows Hello for Business deployment, because you can use Azure AD as an IDP alongside your existing on-premises AD DS setup without making significant changes to your on-premises environment. Future versions of Windows Hello for Business will support the ability to simultaneously register devices that are already members of an on-premises AD DS domain in an Azure AD partition so that they use Windows Hello for Business from the cloud. Hybrid deployments that combine AD DS with Azure AD give you the ability to keep machine authentication and policy management against your local AD DS domain while providing the full set of Windows Hello for Business services (and Microsoft Office 365 integration) for your users. If you plan to use on-premises AD DS only, then the design and configuration of your on-premises environment will dictate what kind of changes you may need to make. + +## How to use Windows Hello for Business with Azure Ad + +There are three scenarios for using Windows Hello for Business in Azure AD–only organizations: + +- **Organizations that use the version of Azure AD included with Office 365**. For these organizations, no additional work is necessary. When Windows 10 was released to general availability, Microsoft changed the behavior of the Office 365 Azure AD stack. When a user selects the option to join a work or school network, the device is automatically joined to the Office 365 tenant’s directory partition, a certificate is issued for the device, and it becomes eligible for Office 365 MDM if the tenant has subscribed to that feature. In addition, the user will be prompted to log on and, if MFA is enabled, to enter an MFA proof that Azure AD sends to his or her phone. +- **Organizations that use the free tier of Azure AD**. For these organizations, Microsoft has not enabled automatic domain join to Azure AD. Organizations that have signed up for the free tier have the option to enable or disable this feature, so automatic domain join won’t be enabled unless and until the organization’s administrators decide to enable it. When that feature is enabled, devices that join the Azure AD domain by using the Connect to work or school dialog box will be automatically registered with Windows Hello for Business support, but previously joined devices will not be registered. +- **Organizations that have subscribed to Azure AD Premium** have access to the full set of Azure AD MDM features. These features include controls to manage Windows Hello for Business. You can set policies to disable or force the use of Windows Hello for Business, require the use of a TPM, and control the length and strength of PINs set on the device. + +If you want to use Windows Hello for Business with certificates, you’ll need a device registration system. That means that you set up Configuration Manager Technical Preview, Intune, or a compatible non-Microsoft MDM system and enable it to enroll devices. This is a prerequisite step to use Windows Hello for Business with certificates, no matter the IDP, because the enrollment system is responsible for provisioning the devices with the necessary certificates. Set Microsoft Passport policies + ## Related topics From d4a6d04cd317e6c8d8accdeb7dcf91628ec6c24f Mon Sep 17 00:00:00 2001 From: jdeckerMS Date: Wed, 28 Sep 2016 12:59:17 -0700 Subject: [PATCH 10/87] remove passport guide from toc --- windows/keep-secure/TOC.md | 1 - 1 file changed, 1 deletion(-) diff --git a/windows/keep-secure/TOC.md b/windows/keep-secure/TOC.md index 03e7c2cb11..6b32fa5ae4 100644 --- a/windows/keep-secure/TOC.md +++ b/windows/keep-secure/TOC.md @@ -841,7 +841,6 @@ ###### [Verify That Network Traffic Is Authenticated](verify-that-network-traffic-is-authenticated.md) ## [Enterprise security guides](windows-10-enterprise-security-guides.md) ### [Control the health of Windows 10-based devices](protect-high-value-assets-by-controlling-the-health-of-windows-10-based-devices.md) -### [Microsoft Passport guide](microsoft-passport-guide.md) ### [Windows 10 Mobile security guide](windows-10-mobile-security-guide.md) ### [Windows 10 security overview](windows-10-security-guide.md) ## [Change history for Keep Windows 10 secure](change-history-for-keep-windows-10-secure.md) From 477ba51a8840907c1f03c7cfadcb90f043079d5e Mon Sep 17 00:00:00 2001 From: jdeckerMS Date: Wed, 28 Sep 2016 13:09:10 -0700 Subject: [PATCH 11/87] fix heading --- windows/keep-secure/hello-implement-in-organization.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/keep-secure/hello-implement-in-organization.md b/windows/keep-secure/hello-implement-in-organization.md index 581174a4f4..3b5dc82dca 100644 --- a/windows/keep-secure/hello-implement-in-organization.md +++ b/windows/keep-secure/hello-implement-in-organization.md @@ -406,7 +406,7 @@ Which rollout method you choose depends on several factors: -** What your current infrastructure looks like**. The individual version of Windows Hello doesn’t require changes to your Active Directory environment, but to support Windows Hello for Business, you may need a compatible MDM system. Depending on the size and composition of your network, mobile enrollment and management services deployment may be a major project in its own right. - **Your plans for the cloud**. If you’re already planning a move to the cloud, Azure AD eases the process of Windows Hello for Business deployment, because you can use Azure AD as an IDP alongside your existing on-premises AD DS setup without making significant changes to your on-premises environment. Future versions of Windows Hello for Business will support the ability to simultaneously register devices that are already members of an on-premises AD DS domain in an Azure AD partition so that they use Windows Hello for Business from the cloud. Hybrid deployments that combine AD DS with Azure AD give you the ability to keep machine authentication and policy management against your local AD DS domain while providing the full set of Windows Hello for Business services (and Microsoft Office 365 integration) for your users. If you plan to use on-premises AD DS only, then the design and configuration of your on-premises environment will dictate what kind of changes you may need to make. -## How to use Windows Hello for Business with Azure Ad +## How to use Windows Hello for Business with Azure Active Directory There are three scenarios for using Windows Hello for Business in Azure AD–only organizations: From d3e6ef44dcf221cda000adfc903c6da1daa06161 Mon Sep 17 00:00:00 2001 From: jdeckerMS Date: Wed, 28 Sep 2016 13:11:56 -0700 Subject: [PATCH 12/87] added missing section --- windows/keep-secure/hello-manage-identity-verification.md | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/windows/keep-secure/hello-manage-identity-verification.md b/windows/keep-secure/hello-manage-identity-verification.md index d1c4c0da7c..6321911004 100644 --- a/windows/keep-secure/hello-manage-identity-verification.md +++ b/windows/keep-secure/hello-manage-identity-verification.md @@ -37,7 +37,14 @@ After an initial two-step verification of the user during enrollment, Hello is s As an administrator in an enterprise or educational organization, you can create policies to manage Hello use on Windows 10-based devices that connect to your organization. + ## Biometric sign-in + Windows Hello provides reliable, fully integrated biometric authentication based on facial recognition or fingerprint matching. Hello uses a combination of special infrared (IR) cameras and software to increase accuracy and guard against spoofing. Major hardware vendors are shipping devices that have integrated Windows Hello-compatible cameras, and fingerprint reader hardware can be used or added to devices that don’t currently have it. On devices that support Windows Hello, an easy biometric gesture unlocks users’ credentials. + + - **Facial recognition**. This type uses special cameras that see in IR light, which allows them to reliably tell the difference between a photograph or scan and a living person. Several vendors are shipping external cameras that incorporate this technology, and major laptop manufacturers are incorporating it into their devices, as well. +- **Fingerprint recognition**. This type uses a capacitive fingerprint sensor to scan your fingerprint. Fingerprint readers have been available for Windows computers for years, but the current generation of sensors is significantly more reliable and less error-prone. Most existing fingerprint readers (whether external or integrated into laptops or USB keyboards) work with Windows 10. + +Biometric data used to implement Windows Hello is stored securely on the local device only. It doesn’t roam and is never sent to external devices or servers. Because Windows Hello only stores biometric identification data on the device, there’s no single collection point an attacker can compromise to steal biometric data. ## The difference between Windows Hello and Windows Hello for Business From d8ed643be770d31b7c681cf34717e004e96919ef Mon Sep 17 00:00:00 2001 From: jdeckerMS Date: Wed, 28 Sep 2016 13:55:11 -0700 Subject: [PATCH 13/87] fix list format --- windows/keep-secure/hello-manage-identity-verification.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/keep-secure/hello-manage-identity-verification.md b/windows/keep-secure/hello-manage-identity-verification.md index 6321911004..ca6b032a8f 100644 --- a/windows/keep-secure/hello-manage-identity-verification.md +++ b/windows/keep-secure/hello-manage-identity-verification.md @@ -41,7 +41,7 @@ As an administrator in an enterprise or educational organization, you can create Windows Hello provides reliable, fully integrated biometric authentication based on facial recognition or fingerprint matching. Hello uses a combination of special infrared (IR) cameras and software to increase accuracy and guard against spoofing. Major hardware vendors are shipping devices that have integrated Windows Hello-compatible cameras, and fingerprint reader hardware can be used or added to devices that don’t currently have it. On devices that support Windows Hello, an easy biometric gesture unlocks users’ credentials. - - **Facial recognition**. This type uses special cameras that see in IR light, which allows them to reliably tell the difference between a photograph or scan and a living person. Several vendors are shipping external cameras that incorporate this technology, and major laptop manufacturers are incorporating it into their devices, as well. +- **Facial recognition**. This type uses special cameras that see in IR light, which allows them to reliably tell the difference between a photograph or scan and a living person. Several vendors are shipping external cameras that incorporate this technology, and major laptop manufacturers are incorporating it into their devices, as well. - **Fingerprint recognition**. This type uses a capacitive fingerprint sensor to scan your fingerprint. Fingerprint readers have been available for Windows computers for years, but the current generation of sensors is significantly more reliable and less error-prone. Most existing fingerprint readers (whether external or integrated into laptops or USB keyboards) work with Windows 10. Biometric data used to implement Windows Hello is stored securely on the local device only. It doesn’t roam and is never sent to external devices or servers. Because Windows Hello only stores biometric identification data on the device, there’s no single collection point an attacker can compromise to steal biometric data. From 94a68957be304c0eded2890899e66d05b69bec46 Mon Sep 17 00:00:00 2001 From: jdeckerMS Date: Thu, 3 Nov 2016 10:17:09 -0700 Subject: [PATCH 14/87] fix bookmark links --- windows/keep-secure/hello-implement-in-organization.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/windows/keep-secure/hello-implement-in-organization.md b/windows/keep-secure/hello-implement-in-organization.md index 3b5dc82dca..7afc1c03e9 100644 --- a/windows/keep-secure/hello-implement-in-organization.md +++ b/windows/keep-secure/hello-implement-in-organization.md @@ -131,7 +131,7 @@ The following table lists the Group Policy settings that you can configure for H - +
Phone Sign-inPhone Sign-in

Use Phone Sign-in

Note  Applies to desktop only. Phone sign-in is currently limited to select Technology Adoption Program (TAP) participants.
@@ -289,8 +289,8 @@ The following table lists the MDM policy settings that you can configure for Win 		Device or user False -

True: Phone sign-in is enabled.

-

False: Phone sign-in is disabled.

+

True: Phone sign-in is enabled.

+

False: Phone sign-in is disabled.
From b41c487dd345624379ff4cbf5f4a7f84d06f55ad Mon Sep 17 00:00:00 2001 From: GITMichiko Date: Wed, 18 Jan 2017 09:31:22 -0800 Subject: [PATCH 15/87] Update credential-guard.md Add new requirements section --- windows/keep-secure/credential-guard.md | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/windows/keep-secure/credential-guard.md b/windows/keep-secure/credential-guard.md index a92cf8f9f5..96afd50094 100644 --- a/windows/keep-secure/credential-guard.md +++ b/windows/keep-secure/credential-guard.md @@ -38,7 +38,11 @@ Here's a high-level overview on how the LSA is isolated by using virtualization- ![Credential Guard overview](images/credguard.png) -## Hardware and software requirements +## Requirements + +For Credential Guard to provide protections, the computers you are protecting must meet certain baseline hardware, firmware, and software requirements which we will refer to as "Hardware and software requirements". Additionally Credential Guard blocks specific authentication capabilities, so applications which require blocked capabilities will break. We will refer to this as "Application requirements". Beyond that, computers can meet additional hardware and firmware requirements, and receive additional protection—those computers will be more hardened against certain threats. To keep this section brief, those will be in Security Considerations. + +### Hardware and software requirements To deploy Credential Guard, the computers you are protecting must meet certain baseline hardware, firmware, and software requirements. Beyond that, computers can meet additional hardware and firmware requirements, and receive additional protection—those computers will be more hardened against certain threats. From 28429c18d5c8750c08f692c2e538ae28c3194347 Mon Sep 17 00:00:00 2001 From: Jan Backstrom Date: Wed, 18 Jan 2017 12:31:22 -0800 Subject: [PATCH 16/87] Surface Data Eraser updates --- devices/surface/images/sda-fig5-erase.png | Bin 282123 -> 75757 bytes .../surface/microsoft-surface-data-eraser.md | 41 ++++++++---------- 2 files changed, 18 insertions(+), 23 deletions(-) diff --git a/devices/surface/images/sda-fig5-erase.png b/devices/surface/images/sda-fig5-erase.png index cf8abe7dced1b0accee901076d142d788e2bf051..8ac3e174a7f5a026d2683a4152f83336999cdb50 100644 GIT binary patch literal 75757 zcmY&i7!3Tj5b)X+ih}L3BICaZ1Da zVSofZqJ{s01jQiyvQjA&LAg*My)i?BUC=LjkRGM)!5qjh>nY6>0;HKpj0uq&2O>f@ z4*LNz;{laVsYHl^)V_l-Or-m{Kuh$X?~JnVl4;`3G`h)ESMSuXz>5K>J_V$))<>wnTu7i8#l zPs3&QXGPt*9S4DO<1m5Q-oCj_qEt>!vPU2xP-Z%axz3M~Cbg)74WQiP71dk2|6(JW7u&MDyuY`%B-JmhsXwaf z{chT;+pYR$_3Xp@`gp(9xkKj9tnDuj^|aMHekW7-bt)b{$YAXtM*Ou2@#B?Xj-+4G zphb-aV^{u*ee{p?-?z+#B;msG)C1(RA4WTybYMvSO*T-q1wVvm9DT92A>@NJC7PO3 z_s$~-bkk3WQs7NImmK70A{lQF0_pr9V^A8c6BvR6fqvxr(^L!L z-}T_ob;Eq^fnMuDeAQzQ5+>{K6-EfVErREF{4W zg`rou8HLXd^+g{pyN9aXA0A3*7!F;ZcqI(NAVQ5a8V)-x_=&hj0_sa78PP}>hCGRM z9Ge7_LWB~LvIM~mpTj4vP%W|6IG$k;bHHmzyEs##f2};^kdz~p4dPX+ zltZ?K-y2TVxI%sL7wv{;hjJAr(kB#>P?J%UU6Lp!`bx(7c?F&W9x_P2my#r*Sh}8~ z_49K-jsY`MsG0;F>B5&7bVfAKFp+)^vM=Ex%#2V$Ih|`F5KB_Jup&Qc4$lnR?9sgH$f@=7dJ>^* z%Cze2*s=Ig$`Rz9D-v=DX5dhmDHU!84lIr-t}9Mes?1;9xk%h0rSBX}r>Tc&sA;y! zYBY^BUYK#C2uV^&6iN6rj7lY?e@iz?5tVP1$CP49bQHZS#gthTcT3>^C6_6eX8k%< z#8)&e;VBL+H7&MP68Phz{uU0S-Y3&1C-O%=w?=ojeUJ#z5Vy{aj@S~pEX3KLt)HT1 zV%f`urY-f2pe>TGv?Py9ghh%)wNBwS(L?}tH`V?r(@7Tokg6!<)+b^Eb+A8*(2x|R7Nxjp%p`Qyq2jXQdJ#eq z)=xg}`$~pV%R>CTwjZutHboby*_}Fm*)q088}1#4FJHYG-<000UyAOKBdeHo+QP>V;~`8rpSY6m4w-Rk%0OCo?Yuya(=* zj~PwXrqHIASauuH$Ef?wvlKJt#7(hHTO0##!y?0_1I8Fq_!%N0xIi&v{I*e}d4Lf3M}S#zkf)ma>;`-VlfHMh zG8!_*sa7mjHx;^;KI&g$^FQ!AZ~zb96TiH;u{l*=FkoZ;JSmei(gt ze9VA~{Kz3pA;bNJ{53y;pFF&XyP^fSSB)QPm(PWM=e7u83dICe1nl=z5StC3#a0kM z9;QylO`4+w|MEFnn19?XTp|5 zv}g!rZzO1bdc>c_wX?aC4X_l_?Y9I`mc+KpAj_<0aA#wsyAWA3^Ko}D1;)q4+6$Kw z|4e8!Juy8naTzN&4z7J4u!(G9Bus)Gv8;=aDjC8{;Ief&_{(XO<$#QKu5{uZMtlUbAFgAMv@O_b!)l!Fu$8|3AcdgM)& z`t$n-(N)Hj398k$z($dlf-c_XcH^Rv$q60-r9Vn{N-s+67qjaP`ioCCGZ*-t?GLPH z^Q)Tek8k`VovX?a%0K5#=8eIU;JQbF%J9lKiv0@AK^D236Z&1Tz-3&Z^O=gb0IJ# zV6+fUzeyL%P)rAF8fdo4jq}eeoNRc!im!e{&1B_OcbB?V8Zlov4wy?Yy_x!*m6YY} z!|=SOx0>JRd1yGfX@P2c*^1`0JuCVVdC1ewGpTjc>~vGRx{t2fteRfMt!sVabi(_d zFef+Emf4nG*`j6Ha^ca@;A!%BjGxUhxqjE-evS39FrUrEx88B`Hl2(Jt4ndnb4GPd#<@xoGt<<;3gz|KtZP7 zz8bR7uL69N$WTJzCkW(04g&cFf!j1DN=$Ovw2_@<5bMn3HMEq4l5F`qu3SQK_O#XG)szcTkH@~W(+)!mtd;a^0j=y? z-p5Qw)Az&e%v)Z^3$h^Lyc7Zgg1T5Y#_HAcxF9>ua;~gN^-$Dr2LqAV7?_wfCKGrJ zx}7p2B9K{GS;eJNy1L)k*w}y@PfwmU*UN*I21}3|FQI~h!WH-pRIbqwAwd>UTAG-Y z^f^ilqS<~IhA;*;V`8wo8sPG;Xg?Oy=h1O3KRenwrukCKU7Y z^ItjbK%ss9WBWTxHHJS5HgVsI(>r3>Jidsq@JOsnLR$AH@CrR z%>0_?>WcXM+7c_KdxLkafFYXEn9Z-8M5rn0jRq>g7llRra}7mCx*$Qpqp56oP3^4Zi%9}b52eH^o#5ReQSE{bd46xag(_@g zOEB)Ime|o?rOD$j31S{(pYYjJlMAJT&n~cP8?m$)s)Ls7kIue=;l>B@`47t;WUf&KJG*pfWnCsb_3ynchGd7%=Jh zOL26{l2hl!HJ-zGXT3V^p>uh(SzC_8%={PYcH3@goH^Phi<|AG_;ex7KOPeqxyp6`G&@T~DV~VUkobFa>qum|1IJXf z9KI6#D7s}>vHK`uT!?#yG$g@JdV~j`hh}6F5wxgwURWe8^Sh`@i+XQoptmiGEX5y_ z_Jqhq|7Qfj)I;r-S6(+K;3t6-$Ohb&V&=M;pF-v~@MP;^NhN`fz z5LDmTxO4jqvg6Joqok}e975qGta+1=lIk_7+kOO7)6*Mow7Y}q8yW_jPwY5%_O5Ou zUVis(CI>Bkn(p%IW8g-;OUm^{@hJ7uyvX{ZGXlvZ*X4do(Yc^9nIkY&mE1(iONgpd zmD1YE&CJYvba_e1$QWbCIbOu5n{SR+Qc`l%8vWONJex10r$;E8-+MHPR<+sr6pNgk zoRytDJ~cJ$uep+{>eSgYIR=WQa_(ZlJM0lpAxCHEKO5Fj#%?)5h+hJ|-Bv60$5DZ% zojyUnX>9iFaQ_qBC(AHH(m&c%`1*7+;rz)K2^l5##n-HJQMc&BB$(c+izxw6*4#md8Gp1d|n}gsbU!3}U0l@wEILp!n z@bl}CK(b+hoVskuytMkS$ZBGtz{*ro8QjQZ8C23gJx76z6{sbKK^Q0~!f^DBs6x;s z5_tM~Vn=k4{1VnL)xyG>WLV(u!p4jhN?qQZx0fdt(JjdyK6adk*`AkaJe$uGTwR+j zhmU;rZ*OlO2i zc9rYdoPn_2EDe6sVXSW|djUUg?+i?17!LmpIP1@dCaY7x!fUC#NNr-MOa>b&r3aR^qYXnN8&SCe+9mZzxrF_ zeCZ9^riyaX=;MX5v$ZvifHOiiU!)c`-1t5$Sk?_MWwHY^OQ-$mA$#rq)T8lNWMd!O z7BCxH(32PG(^l^FQx{$I7BdHZWZa4dTR`-09Pxh~wn2we%FnapyDf4#P@j7a=P-y? zq|}kMM^6_AZOC~vxr9~9c68ISRqm^FN>b2BNzpn4G{cCV)>@YM`MA+e$8mRCrXx|$ zS1i@Dg&a3K;RYU#idRYx9<0Mq#M3gBoI&Ez#q_A4`1q}9;)V`k3yc2!#lT|(v!}tR z&kw%zw`Nbzw-#SUE@RqdT)5}|olRueJv#&)*L4y;T;_C%A~#<2H58RVEY{ZgO+AGA zJWsyXu|c~{N9>wn9ODR5TGZ_lvACq}p73pfUO8cq|_fPx#`;OqMVm3;O1at4wW@@u@8w3X( zdZW*mP|wuEc@2sc2fDS+1QBssw$zoCm9p(RjD3B5cXxNw|Ni{|Fh*TnT}DoB_Yu6@ z>CNNr?oLKQF}u1dEh~#MGBP3~BeQk;%<28Ys;H>=^yUKt3kwhR33Rs75II8i$*pdA z9AHfgu9O?_3ZIxkv(Eyr`4bZpFWLuZ5_`axxid=0$?2lWw5>CUh=`26{8Cm{X4y=-wjoSYTzYO-E!TneLG#-Pg(e6T!^Lbgj8YuF2E*Qo*lIEjUPB1}z5 zNjbiQRtjKl6Ucx)gPen7(JpYnAPyOyUBblVuaS|_xcRgZv-z+4R*Z9Vi|z)q?!`Z^ zi2oNMJ!LQ!35UAc%6YMVj9k#6B4eq~eSsFrkHb+2kgEK$6KGO^hVGxcUMQcSz*=J# z9-@R^g_;E9+{SsF(?d9&g1Gf2EZp%6kpV+48mE=Xc~mw~KG4hYfA*7|`2~ zlCqPAlbLB;ha9Gpmiy9&*wPKB(_+ex0? zvSgL2#Xd9E-gB3+6BB45Kb@-3b(<6cl23vb7BpYJe3@QdMT{H>FdT~RF=NfIt3x-b z!!jN8{ot3);@&U#(^6avCn_o`AuSy^V$=)3xqgirQ3MH;kf5F2ci`2? z=udmhvQ=_lO-)VpvQ;`WJ=R#P{qc$n1v+TBvwyx!_4+98CWnoWj{x|BHkb1NA~-k% zgxS5An3&K310hRGT9=D8>LQ-6C^$$koLRC~o1FxR*bM*vUG5IWe8$CvFPo1D34uvW zOw27Rf?Z!<=RYJPjv!&sX%E}j&`C^A7Dj`j(`-ZvAR=OA#h^%l2e@*zMg_+mvnZoIi#w%hgI98k_@Qp*J>7?a<&2H7FF7 zw(brh`>#r9mCg;)mHV{Cyx{K*pYZFW5%`^o%aM5r%L+oi*@M>;+O16*N9w~V$WkT_ zA8^!aU-Hv-XkH8*K~b4>#w3m^KN&T?1Lu>X;e*vCb9)X2ln@`65MN7c=)~x3Wk`p8 zVA)l>C$_}TeOeRWXVK#c+s%Vr%kWpP?&G~}<+8-PGpnr|V{$@Vcqo_~=g9&blM37IXariT<3F5kF%&g-jB{K5LP;mPasT&u#iJf0TOTQm?^f*H2Rt7YG& z>(hL*Y`XF^n)H4<|L=Esdv5OH93@#W>BNjj4VehzyS zEi}JfX~pc6Lbci~2J&(%8^>6>?duFmxQT;H1b#}yY8H*!RG$v?W zUig5ZOd^S4c!L0hmU__R(6<)GH=gMs_66+zG=jc$@H4k5MUL98rTJdg4}ZYECDGXJgjtKhg3Z9Geb&{%)^!igyOD$g z!uPc7`R#H0G9vFT>2gV^1BR(*XfHmiFfWzm@VvEmMZ?1Q%Z>goMqPaRm~Sy3n6qSb zUmSkQ)c&EoKEu7*3I6f{w%s52Rh#~}pW@YpjK8I*@&iil4pDWu(8j_%|*G+lzrY&wEdo#`wPr zZ6xuj#LZq}Ng1Qm=cG#02c%#*1gu8{o1)9Bw} zw{$@PAXdoYt5IFJt;8HhT%5hHABcKssw@1;PZ{$6elTI&PKEx{P38UMl^L{uPLS}} z0-Nul;~+x_ox8a!wt6c1$xbdmT}!T)Reop>2B+9RY=mEn819Qh01+`|SUCOORE_{F z$jIG^I5{Q7@M5i{+4VA8?f}pdfF!V-bwOh4Xe=mz1jVMLz=Hl$4GxZu-Z%8>wNRD| zjs9OP%D*^wH9;Ct=yhhzJ9Ugm6G| z)NF0(HTr(|G+NBl!1!fx+6T-pEYy;g2BSw?ud3Z;av_0OLPBbh@i|6UX;28_`y?eL zYu{c(vhN}y5GKAtjc_*Azr|Ykf^O_%z6nf%s##1Y&2Ik7r=ar2#$-P4m&5~S8PR>= zc;g4Xn4KKljfh|n79k-&NkP%cO>b{6>oH8AKZIUhULF!CGAv9Fl)7wnz!5kz4606J zF}0W_-!x(#F`l?y6STlaLlcaWmZjbE_V$LnQX{Oas!HM5==9DoHZgfQ`?s;d5c+t& zIs~c)vNsdR>i%Tj>iK4W+@!8%B7>uDZ_mi2K||f$or}lqifC+V$`mCukY1-fm7Id2 zHYf-R#!sCN3&s!N-Zh2NDYZc2VFA%mP=r9}`TP6(FcL8^L<6-gGn-FEbCOZg(X3{l z6=8GWHR9E+KxXFVJsTaKd2`3pYime=XEHu6lgaD;#r0xsW-p7wmJkqv)9dR|K$amQ zCx`ZYIE!mKJUoO1d3boRf(iJ&a3%utml`I&Oo+*(BLQNa(Y^$ zQZb{KYDs|PoFUJFUWGS zl9-ef(xc;{PsiS#X)>FyOwy4%i;9l!j`}0hh}Hei?_-O%#Vss)jUO@E4poh2JAj=< zMMZVx32C)lD~jHvQ2~tf2jFTgRA`1ur!eTRHd^1fw5_9nngL-A(38KE*rM{CkfQQG zG&Jy{3Hc&oV`GVJd&9!u)abAPcWb2MQLh75=qYe;um2w&kZz2E07xXJ{O??)ZoPi{ zU$$kZJm1poOBss(JvE3|_RCz*k551H1#KbrjoqQ(MQB234B%B1#`I{z<`vkam~u&p zh@mjX1&yi`LlBU50)Ii#@pD5k!YMlMo?Nq}O?Wb>*6C;(k;NUPRLDiVSOPxXz}EH>-g=g-8ESoHBvPi}46Iy%`PX8m5M zV>F|vveHtizcOhgW6AUhJ%O-@M7|&3P3Tx))32n50Zg0O`^9Ow&9!R1vAkU7`Sz zxF{zroe+$OEv2lSwB|JT)8TnPB~%OX6z7_{ip{Aa;I`_v#XFPLJib|rK@a7={8{LQ+a9q9V+6eNMa0WjQ@Zu}BvA*Iz`GzEISrDJBXE zu@Dpj8b3gYk33!P0;F9vzo0;*asriP%Wpi3M^#Enij10Cveo4rFL(ctcjnI@GV}S; zB)5(YP%ss3hv(x3NR)RnGGKI77%+iLxgo~@I%oAv;Zi> zAB~;fOZoV8_74m!_qOZzg@F9CxSdOtR8$a%Y&-6g$;imU7EhCE42PsL*sZOgzY7BU zhEk_WHJMSDVR?D^lSGrvIvFV`>7IsKUU4y%V9of;{hde0Y`$oupO@gqZHr$yK$(Y| zP5?L$AKHyePfz!|Sy|Bl6JlUvkI8v6klVJMv)i|=GkZQ*T?6Not>f)s6|z!URyJBD zi(9$Tc9S7IJRES1N$52j6YJ|)f#2eQDND-8B)Z=oNQ#OE177kd|DoMVrX25e5Ri(b zg@pWp$*XtybO0{eSSFVv88NZYMav-}IP(JT(B{SyfkArIbSis-?{Q585Eo4+=C5j3 zZoB|2)~X{@>q0F+R6!Q`Tl$^)A#G9Fp*3R|BKJeS;=94S;fF!KK)(5@ZTb3h6G1d1 z6~pR4E9Gs)wzqJ1N7(b0UK>)cA8z+&ucUHPxbKVNZaLOgA1Wj` zi)+rR>yglEdB-(`XF@-~ce$l$z@FeEJA05pVMf822 zEqs3|lIx2j_3v6!SEu->o66PXxW#n2Ht>C});A&X+yW`7;BkZz#vI$eIN|WE^mo0I z^IrK$`O7k6iUO0&|5Qmu^ZzcRqKsQ?Y}1`@&&M6aA6($a(5b45x9uv4t1_8=afU4$ zj(_uMu4A(2T}NgGS9|>>IGCRyJRe~We4q4-1C+nJyT6}%g9D-mXCAhMQrXJ3eP(CJ z#YqlDm>embj=wBz2EmJQA&z@KqEn88Z_`+|?-wDb%s<|*Xp_3jzpvC$UTGyEW=G!g zJ%ywDApa1B){=LMhqpU#@DNQxRO@bYxwk#sV_l=+!B-9WH)o?`wLcUUc44(mm5SQDIfsD9X}<|ZTe*tr z&<2U$VQ=|yAy4G#wZ8suL)UKft?OUYw(4iAm-Dq}a9bd%K)J#i8HDe>^3xV%^F9`O zpa4u=?BY&d=vkGqS?ng^AzT*o# z?{16h1Q8jr?!_>G9OoUu`?jAHnJUu zqvz#+dcQ{PFdW4->|FJ|i?e&X-+Tl6{s^+$lhD(d%8qKPS<|>&Hr#mw|2%W-nXvUe ztpZPQlp5v$KG*}smA?$ zL~7Uec04X~+s*nfW`ACPv$NY+XOf@WnYlM5)r?M#fE(&@(^h4Ild`611EK4K&+8^! z;A5Ittr1BqD&Wa&*W3W?GCT~&8*Q4yHbk=1q;_AI^E?K=W4aFgmX66Y8WVEB2jkkd z{g1k1?7zdBF#h*8rOV6L)b8WW1fnY6tIY55%$&biu$ZSu506C$mteiV!_+v<{w9v} zU{_W-37$|c_kLkiiqmIJEpWYK^{Lo)b-~RL{rcM&We(1zt!*cK2FK~T^4CxN9`!ZS z@mbasY4jSbR*r@f>4HtZmJ31A-dTT10>&zwl#`esntVE#MC`}tDd;p!D2gl>1hq2V zmtOAtH#(x;E*dN+n6R+$AbgL>-L8aEc@~S2U-u~eeONFF0y$`T32(PJ&$DQ`e{2up zPfh83LGL>pbN6VJ%~sl0>4kej=16UBUTW`SV0b9X!obcTma=PMnVfuBWTZzvcYU(! zx~CH5ioqF3MCJd!ps!km)o8`!-u2$Fbq)9S!dCh33&FbE^I=ZL((Y#x(w|?^4Ikip zbKd_%2;nI$OUZYxqKV1_`|Uqu0WSMqbHYWbhoBUl0K`Y^S1LQ?>DZLGgy{1R)|$nQ z!=s~+Ed93@(_gNmO^F{(2;#SBS2}`Gm#SuvdhSz|_DBZhqWnVy^f7F+mhpz*5L@@} zJAHfWhdhKiLthwRZ-8DfBk>OFZn!PzT*zM+V;`7Xud&alxtP-v!+>PkE%mzMDQgq+j7nIc8mbpyBvFKM;*OCt|JvFoWu6~TI2Jp#ZTa_`~{`p3S(>fap^*MKjnqTomei$DZPYs_rGN8 z3E_JupHQpP75QEaESWq8K|WOkLNkznY5(_v9p`ts+Jx$Na$*7Ex9-j!t~Z|pQ8i$p zh3a2z^$@$G@?L>JfN2a;13N1G`UUDv*8@}k+&jpyJ-BGQL>al9FH70jj@0fhD=Q2C z{o80bmiTO~B>|v}^6Ki6DGb_S4O%fEO4-a@z`FF>soO}8k2gqBzwdv1Upsf%b!fTr z==dQjIA;wy|ko8=yfI3=I!jvX490x*!4O)2|m^R80`;7SFbgK2dvcB z1CFkq)B9SZ5x^S#;EJ=z?Ouafk~$UteFnApQUZ9^`&j zGbEg-?XkZ<(&u=HP*d}F3YW#m#JvUSx&iv^otH3X@8Dn*U~o{eLY=!FfV?mQsPum& zFI0ioY9xGi8A9Jz`?ijTkFE3BSp}eqg(3J?HVdzs5g9wYR@pQbhX{`o*(-V`@I~NL zgW*)j4_)6)&Km}Zb{y|A`WJA1rmcZ@SNRP8DuunhJu*M?_4W0qVLu2+Ja3CH=;)9q zlw@R3dz#0osW=dSjK`88o)?%JEapdfgBeoZ@yt2P(Bu^qK6L~9_-L(#1?YDu*KWh| z10(|Pmj2O90W1ixT7QU%)jAz3fJ`Qs%g6w=1>L=<>pL;8syhML-7NsyJ!fhTvzu2| zl~+|A0vJD+#~sxa?=6z9_dR9?hwb0W%IN%jlFp|c#Q#(((9M9)Ve{k1QoB0~P_G4= zB9@0(JnqaG+Rm75I-gBO$HvkGeEI84CP>K1gIzb=LwEEdwMIolEdjT@)_Rp4i$QBR zo?N>5qV*K05Ry|;hPrNgb66D+i-auMYG(rRuGQ~@0qyMWa(O*{$Hm1x+w9t`L`O&O zn<)@CU#uhmv;!#{TM}R+Xfa>|O%@cSq=A431PB9hDJcYCN6}Wb&tB946j&ycbLN5( z7=}pbr=&4UOUvWwyg)v6dOEs)Jl-`3Zsf!ETh>G{&3H#}UI0Kb;aVhVx_I9#B0BSnK z?zAf9W_N+g-))K(n;e7KZ0)~bW5af5*mk-PzBSlx5)$b}&*FH4AFLHR08eCf^D`bP zE$wNhZUH}60qs`>8fsV%w%OXn)3$+>pXkb-;<8z>-j145n@tddQ za68kSrOamYd4_brfG)c}_~|w3tLKQZHx5IXn!SKf^$!k)Xz@@2Rq=M<`7STZra28& zLO*aGqYVdt6LWE;iAG`pDi8^jpPvtMJ4iEiyPFXonVN#tJ6))N0C(=iOBYvE6z1mo zrKjT^u5x61UbMi(FwxLN?2n~DRs$84>O+h5$Pl-kaLP}!adB}EE;>3J!2&>3 zKbf8Kq&E4-cnirpAyraEAlz`=T4cl~yM ze~(N!HOAQWm03p-!;+mIII4iOHuU9g>TOum!7t_npz^I`T6cjpZ{C>yE+TN!@;Mkdq9=|JTAesq1~COS-gM2;SQf;dj4PT``;A! zzZZa)nTNazc$yNL8ZPr+UDDyO?Ba}nU*&QfjIT*5#H41bZIobC%rCcXJljx3PGBRB zE36?K(?cO{kD@cy2-A&Fph}`|cTZA4=z9b2@=rOKOd^e@pYr5@9WTdjGfgXRGd)`v zqQ7!EAgEt|p}dH1?eFiWUD=#h3RP%vFn%7diXR&tjt#KHT=K>om|o)QqrHSWlN z7V5pyXzeNF%u5Iqg7YUX*ZTJlgi%iZ+X}uVG2(>od$qdaz-m+-d20ejNKA4sP~5q` z8DrF~eL#*1b2$Tlj;bSmAARoId@hXK1_HcS(X?^nxp5$6PYgTt{vf~>6)5AvZnFmW zL};Q3Bna0vdssv)y6)ZUYU9X{gvZ;%sl$IIiU*QCLV+-8?k%Y45be(g89=j_;%%-s zq_v%0^;F++3}v<($)>NCuP(&{q%~lA9(IB+SgOo-2cw_~N0}vlHdxK!g}#8eUCzu9 zbYq74R&Be^o8AFS4`@_iHJ^p*=Dp%@K2ZYQDjE1>q(=GT?IOAXUXGu0{M~Mhz#uRh zy`E2iRZ^l*h(H(x?VHmEQ4;HDWtnWm!aQ$;JQ68J4|%~^Gc4qlq$8Bk?@OBqiVXq7j6GNnqI@G z6U1h{a+e?U1oXG5w>XgJvZbu3H(IF^s_$I84UdoS1!L>z0f~|SeCfm0hQ_4d}lwXyIiqU?}Y}Aug z`4%lQ+O{14AfsIa=F#g0xldZnQA3CWn;DaUKwC`(7D@=MlCie7RurlH{V#AFXVBP(X95mchz!Tqe-=f9^v?b~ zb$!fPhRo6SPWzA(W9>FT=y6wZkXt;)as^GL!ho>TTHZS)4qQ|@;_ENi>$ zNqF;_PO7ReeQ_kTxDi6{A=Q9v7(8{5{I^gKVHVH*vAdtmi1)(|flxo~B(T5A{0R+HU+t~mlB=LvZG`*6I=bNF^Q z=P^?!@wpmTPF4Zrhz7aHyd^ zZ+GqO-hjOSZiVA?2KTrQJCPxxfhUs+(roPZecxTxok;&xUu^p(nUL%4sn&pCV7T3f zdXF(}+jUHx%;o5{3W)V)uni6$UbZ(@=hLTF=Ri_%A_^ER`dP;dNy+J^Du$1@M-M5p zeJKJC9Bzz*sZiU_8AB8}Kl3@gArxBQJG0IAk2hPs6ak|!hL6*#?>@YoSzGI;^l-h% z(VN~o5D*a}q4l=?h$~fQR9BUX;@7j%&?)O(x}U$~t99u#S=M*h>TWRATU+j5u9fs1 zA4lYiI%~*A+v2yJnwn_119fVf7SYhd3B~r?=t)FW)kNxoIn(j#(H!36)s1BO6;uQT zueXML5!eAmIrV3k!h;9z`y8+Q)vqjKLwtl~T@*htL_#&ZLqcA3rltf=uO801-+N$J zHtQuHh9l4^Wq}5QtX3bVqW1TfLhDPKlXNtIsB`XB#}L8wM*Vz8%n%atu;JjuLGp(4 z_vhBxLh`K6ZetsTg*G>xY6^91GOfzd1-p#pJX}M=_CccVofi-V1e7yFK&m z@4gS3|Kqs%ZOMA!-{qMKPG{UBv|4e}-+wDS?7V#N1ir>O)R)-jfi9D$2%BRnYc4WY zY;B1)OY^(cQto3&*JHNqYKLZ%<3oA0Tx#xZ6yJ{J!cnuT{%6g`qbK0M(8OB}LoYU$ zgcPc>8M>@9q7V1Frvx++YdbtoUk!&|o0{|k2{mO=UY|&vj`Ohv938fzd2W)c|v(}U|yRx+@feuLe0@d ziU7Jmeck~YDFWc^fm@-V=KtQ84?Em5ds{kP0CLiE%2&3N75uk9lGr+pnj9U_*9NIP zs;Bk<`R?LZ$Q9i~tRG{`uaLv3s)yz9z+%#v6`-CjT1Il_vYp{>8w}JF zUe6Xb)WA%S=97>%Fw^*2trg!!d9RzBPd8TBkkZLq!p8g#sxfqae|yxl4pc$G#4W)T zTSi5~{UO#{5OeYnfjKu?D3!7>S|W(=Nu{lEDp92@O}oMEvsT(=5Ii|Gk8XhF4J(m%&Lz+3?9KJi#{3!zSivZ!zKTfPQ zzQ^C#?pp!%o-MBo2j&G|_QO{cR%`PV>*{J=yFY4IC{Mqm+8my#SC~&%Yh1cm3W57j zlVjfx1?V9#(F?|kicZ~v5xDuinm_p89|e|L6l3b7Fe@4x%@v<+q_c9;OLxho%!Cr+ z^P@y?Y-@K1k6*PG27g8qLWlO@*?zp+P4Q_MS6mOU*=A2xsm=J}3%usCv9nv3qCWj8 zI<4Q*qaXKqmDe?#%6>on#{K6O*^mJE#O}`w3+ou=vXiU5kp;f@J#_jtp>G-%8(%Nl z=U#Tol%?^|XjqDutUyloB#H%UA6wk>DYPK<2Uot#PFmY((QZ1?``b@wOs zW~YntBHiCP+YJ`ajWaEE?T?Sq=3*VERHN1gK&`m#4_ z#q#!@fr=|&O>H-{K4TV|t^6DHe6^>2eLh^t;ZX&{q8z<@-u)sYr+#^8n0<>noF+bR zvM?^BSIgye6ubKp2>{+*_+g$7pLD@?Ls(y4!;^9a&FUU-NEuq%9d{OML9kEz*d1lS zx!vZb_<*+tlK}nt*qb-gc^;nI`JzDIjOj?H23rUHrGeQ7??-zq8eev$_S-4q)K5FR zp3oeId+gOk-M(65?$_%f55~tFV&d(cQQh-_4MeUVCR&P8qlL$}338RM&R9lEFJ2#r z0aryqPcZ@-`h{K<{k%`P8;j?5-S2Pir)*o?>l-r# zt-tkWhH#|SQXiuF#2;8m&+N<$F>_I6G4HtW2gzK{Yx&W4-|tSKSDQ|!7)W}VH)fiu z?pu^AN*@DxzP?x4FVLOhK3)1YTuu#3*dUSOND0M}aA#(gcco^@u5Y%xzn^CFrn&My zi0Hbm7rtT9mz(z6(3k!q*7lvJ$ujv$;kgBI>Q1LDmBMs$hBH<7RxZ*P(m5r%JE)=~ z2=aQ&LXpcVMfOdk%DV(-^S!vAu5x^M(yh5+m{D=@XfonFoTekbQV+5wwpv5^uc`W!lN_} zt~Qj(YBo(irq|YCUSCHbU}D&IRjAeWpKRhpGIe6n*XtHV8=NQ+L`U9sP=+XjYYZ#+ z7b=z8!8RM$QFw)Lh;!STw)2RCZ!gD<6mkp4Qvy|Q+kFjPCQd_4YqS^Y6ZI-F&(qwB$dJl*)nZSCYwy#b<^zYif`xzw~7i*ui(oHcFV;DbH=Xn zT}12y0hp%Mh)t)2OBg>)S|{9HpSJY{VLqyZiMi*wztrh$JRf{ml!zHXzUpm=QG56d zoR7)R!~nS?64nB;7ux^ahM{5q|F=KF5P`oS>4z3Vdyf`w|3&QfpneVu)!h@gcwn~a zaeA}Bbmn;wD!|7Cd`wk4EQhNAlRt}Vx9rF0F9fLMYwhU}|Ht#Wg{4~&>dn{XI`7-A z7b&nDpK;-G5(n}(n_y&1fx`lI7FwVqY=ai*jzDg+Q)5KlrBN0YwdrIj$xBElSiS|* zie61GI7`;r-0VuPqIh_d@4p<}uhy!#X0z0$T7(Bfke^=<(~-{B;QX*NK+J+Zn&|I& zId9Cu^47H0>b&9Qsj=R=a?;8tNBwk6SpjV~Pg9XLsUtuloT0E<-7_0tTIKsvkM%?t z(>U;a)u(Y@OgtU+?t1ZWAJ|SB_h&A=-+a^-`5a+;H`})JDYsrVg}Yq`Qgdt+9P@4~|A<7FtvW{_lp(=)Ic z-dh~GZPc({&Ni810x-ObWVjXiQ(Hy&tC9n9i6JFhnaqDz-UOpiQ zVo4nX%F!7}<)?Tcly46NhBh1SLrt$ef!v*5Egv^!s+#8komigUeetnOP2awu0`=K3 z-e;qY2X2>t?t|F2B?=2}_^i{te7ssyAHFZtWaRtWP`Yg@i{arj*9#T*9eCdb-&diw z9b&8G!$`$3!owpJ3hRkMZSrBQ&Y0*FX8ZRp#*Z#ViTPSw15KMJZXT^k*f_-%lav%R zBqZf`te@sQxDKim zFpb_x*2LKKE*iu4_S*?Wtrz}SQX2s3VeRD7^-NH|0Lp!d6V zgH?8I%J0A868`{vZ%9N0^RlZ7*{XTnqddP~H{rZKm8S(omOdj&{xQojZRUl2sbGB*v+B#gPqdA)& z4y=thbiEkH9uo0f=ZodpK#BfDYy${JeT!R96NrqjloeuTk;|Om+&rYPm0~Q>Z>+F%!dQRXy@w)8;IZ0$kjz_TVq^~MexX` z|6xQH`wi7At`kpD35Z3+{x!h8b#9pi+H zKKXNx2j1F?HY2Ijti)cdzYKMy1G_Hf$gf{?`#9F9^IcbKYqOag_hH!I@;=I-R8R;c zXUng$qme-`beRRTn=E``qyP>T{ujL=_^-Xezm9h17ujr9tH(zN5^9&jo%p1(+Io$` zi#G-0RPQTSZtb6`jrXF|FAhBW6fu*|0-SLk9+FFn;L}8N?$IYxZ{~7yUtcl{wK@28 zfGIRt#^5VZJ7ZUWRqIHxWd zH^@)cpY7k;7Bks4laucGc1i?tpHXWaihpb4+3Mf7)5qr>U0Jkd&`%uRh~o5Fa{Fbu z87|<>rRLr5`8OOF*W=`5LiK#A;?4!;=-BM13b9bkk!?lTwotslh&|)!S}EE*zL40u z5n@RptmJARBfhq$H7|GZgUY*YB~Hrjij+{%SW;eit@Zs74=Xe7(|5`#rtzGLDOFQi zs0so4<+Y*=fl2%(yvaMlXS)o4_WG^N#_VIBv{EL88*+p^syK;Tt9AKy;rx44c0W)p z#g#!y$L5ruqH^T#z-C2U*er>-Rrvmbl*gZEHQsyL2bM-+2dBzf2|wAdSh}Uv94L;g zt0_{@)_Pq#Scvf)t$Q!7YrLJG_?p)at~yZ- zqu%r|9fmz2_KabV^bG<%tP7FSA|>(4(S}!Z7%qmdi8;vpl z{CKk!Y%^uuBz~rnbqUOHnCOQwJL9nN*7(*n{yA&-NW0W#RxS8})8E5qAW6f9%Fy;D zN(o5m@l>q>DQ!OR(!cx5IbP!q8rEl@u_YkC8XOkJ!pr*}${>Gi1%HDs1WF^ur-xgh zg}dYnWgn=T1-H+)^)F5Tcr#LFM$RG^oow9snTSD*&Nn}wE0(KwG}+M55VCpcH3sZg z)oWb&y2URX7L$fl2+r+?U>C9-9yKo~Z%h^ff%6k+Jc1&m$5HUSQfeoFbqBF@i5We*73wD%2L5 z^ggk=>+^RY2fp^za^%j7C1Yb_sQt~l5V6z*CPLZ4`|et&z?9KK$EO7^{-Ds%G_(Gi z&-t<3TE?+>>ZQiSz}1|CEbw+2VZ&798$6Q4&-bl9W2ykvEmy555p$p+fN&5Bc@)Wz zm^Hek4MPx>t6Te>fP|!5jiVg~W$>B6L^?8W|4jwueKs)H8bz55nO7ARm1z413Aebo zo%N+`?&Y8ELt*5u2$X(svaKh+e=>uD9f8urhYxe1 zR6w8v3F5zd!+L7IfBP~*35bZeil;y^fs<`hcO;FG>vM7L)>dXUrpganCX8I$nFcX8 z;NR^BcYhJ+CW5-JA_ZhnGcz z>BEK^Mz0iHs$f-Pgom_z>Eqnq z!3eX0xs{r9-*Mkv$~$}g%+s@`rW`UK|G_-}lYaFID5oJn1EI%3cnfoL#olM`4%XG) zXU7XQcD<=m%Tp-vu}T|(#jG%)tsP~^oXbD>4GC!)Uznt6TS0V=9D!05=$itS)1;RL zcKI|#4S)%VEKSx58yFZY9DRscHTR?II7NR-9%=qr#!BEH!p}DH?a>TGk zrGU-&yVgShszoW10R$qDI3>E4-bvxKHW~xpVB`*ea{f8NM$xtiCqc8 z{rMVqB{uwXUglB3p!mOi+h6iZCXj?d0a(w6n?Fg8fG+wlf?gC|coXv2=Rz;+a*JWs zJ9j=XNrh~7-0g+}Db5@l}KEIKUYae zNYtQ0x?@&k)cV0#$ZZPZFso2$BkiPXFBpqO7HEfC)#FgKbi#)P(BCO zw$GuKtCAyf&=cxuZ|mHGZaBw+MXq*T!CC$WbOOhrtYe*$Pegx-?RnHMI)`742QY zSB8dNTE;{98q@=-MY^@1==w9HWmC(QWN@%P(Jj0WbZ@;qyeY8)HBzAeizR7*P7DDv ztgxT>6o*%F9C1++e;yU+R9Ad6y-G{ljzuEk+rNB| zBpHl=D678}+$zTJQWFxWt#iD{M0mkvfopz>;XLJaFyr_@qr@=aC=NG7qxAWnSp$@+9)dSUTsLYDOh>-5I4pD+{4O?tl2WT>sr`K0ku`PveXDB< zSy7PvLEa}OhW9TU0ZRnE1d0tFfiVgFf-Ay90`(aW0sRGNpRa(7ZK9{@|+(YeKN4Rp?EtdbT(RL_iE>E!HcZR z@KMv6^NVuxm;bzZWA{zF%zQ8eEG#NEHn4quTPREf%4Tp=kSm}u#I2XPo4;sncpVm= zf`c>dO~rv{zVo_m?&>Qrf3zEfPoSy)}Q1as_&ON9!tKMd#&0t%6IsP)5; zH2nPe>_^;GyZ_IbWVx7IDml*sz_PHWw_Ihxnwo!SKBI-nxN+l#O0LSKxc2!{jrzkW z-o(%d@pGEEb}1;T*YQa1Z{IcUVC3KkhC1$q%@M4v7`PR7&)ZXbcnY+ugqQO5Mc`%q z$JSW+`3Ixz;+_U^X0WT~(}4N%DPq$qIw z3tD;Y^M(W2%Ai(JDlwEY1}3VD=?e&3c`>1 zmPlr|V@}O7b^wBZ0G=!`z0%ibL>IpSyr2!f&dVc^=&EFiVUsH)C_61Qi}fESLe8I4 z+R%{cVA7+=?ZF)`u6OVP04*DfKokZuV)ncE1^`TSNYwK_3aF|Q+)2d6!TIEd0Fj?X zRCJ;yQ@7TA#{Sz!VD*Tf?UM7G4x%fK`s_H2#_Febtj8Prbh})eZC| zQ{d^`jtd3#Mu7PF;Ts?vCBT&v-T!jz{0I*X{Zlb!-G1QrS zoqg)(vcIbFcQDVyI}+ee_jn4$l`E31A6SATBC=o%-HtEgA9ver; zduSlxF#O%gLQ+!lso$clASj?sz-O)gE_nmQ6;fJS`QR%ofQ&(D@CN8>4k93=Wqa`8 zGZ;N60|Z^x>Ckgh?}rr+8nHB)2oO;wfdpKi;7O9tbiD)^`XPuiI>~DQ@uqfDH85Q*tVseKc7M>uy5(1OT#=+4_QCtaxLExDH!v?b_O@;(40nqe3 zkhI)>DM5B{y=F(@cz=y>DU1ZY#HiQc0)R(YL5@{i%!{@{^impm{{_JBT`#+Cf~HYLM^n^YoO>j?EnG!l@)W@f-i~Xh_zv=fJvZlzvkjk8P{4uMP=g-)>X1!$VHP_knY{KT}n70)lpFL&wZ!&<+6i3dG6>Oo@ayIjRM z>{!vDgZTMcPJz@vPlT;2l37L}(xPbxh-08h;0E|jp8t@3|b}OWP|waBwF#w6VSRVn{UlFnFD4rht!Js?ozKggeG^CM{nv; z#SxhD{1YG+x4DuF?B}WFt1H*;4QUyl1LWzj1+vM@e3v9I@2)x?9Wegct^?L}mj_bu z^Yk98CE}t9pqJVuTsP_X$af1QTkGH8EB{k}{#wit_yL_KdG((i^8e?)xn0IqL7{6I zwyEF9(L3g=m*4)`y(o2A*y6u#MRzeVXH0qNiS?B^){;ie^76<2OoqV)hI$rL2hVc{ zsI-F1gGOWChmKaJavSEAXVhe?=SijQv$X7-^Bq_UEJ~MA?0N3EiQRQD23PH1lX%yq z>+TK>Xsz~^fC)BEOSBUx`S@B=L5G%qli^H89v2sn`g!M>4Pa8;<=Sgu(&rs|k%F$S zuE{W8*;$3KlsYsw4ks*J9hnU$7KE{njQRB^zO}Rp0pYv0bSU1=kUG(w;hTD6-VX)Mb za$%kn5E%Fz_&alDtw!i=RBexiN|CNk6nK;hy14Vj@rj8XXjAYh7fn#SsCouFSg#D` zUhqkE3Cy;wPH_NS^9O)}fR8{+A?QdkSxXBW;U-`JV}BIwi$tgf$L@&E`j-??*zDijC$89=znhRlPu3`B#wbU84p zhWo1{_6#7gg_zKKpbncs$cwaC!DdGa!c**Roe)qWTaHx_!|h5|jH=;bS`vf>z_{i` zXCS2z0$HJU>!ShxfPfnh9%!CVLh}YlH4sA(WmhYtL;E#|tZiNIpkGfUr`l~8D<*gx z==QM$y8!JeKv!s&2dEM8WmVi}zD7;`76#BQ`tQt)Ul^^x=vpb@2NJZ_u^$5QW8m3B zDB+24O-oHRa3>@d#1=-_WntkGA;>+ONjkV~+(hLwNT)j&;Uj?Bq>PMi0zVT2|KcNzGf1#x z5d5ShKr2D--bH)a);T#$10U@}`7vCN9YC+)t5=s0DH$1Z#NN*C2I6?QY4BB@D;lD> z%f)7Wy@XriC?JGqlkoL>%K-SInhbA*Hc3JpN`b^ptJ{?4PFN6`~SoYh9p&J0DvAd0EEkb?|kVr zDp6m8<$4pj>2>*aTXgU0A8Q-zLVAA4n7u=k0Qb*(b#SU=OF+bjug-amkG3r0d6Ox? zfJNz6I~UMx049KaNd)p9g+h6bS8RwwV$bm)j!lssQ$o~z_x(;yO%40an~%@wNazIL z=a4B!u|9JYXItKh-v1N#_?RKe2zIXUM5fDq8IS_eIJ(RKrPKb?@!rbVbw3`hil^a< zP!ay_vY`OtT4oqJ5P(LavaW{J529)Y&R%9dy=w31m=5}97}^v-)>$X0_IE%<4u`%v zozM~tQG%V_yh!cEFgo1;AHseq7%}ypsmayTEDDnic?If(?T2b=YPX)J2gL);ndQ?{ z)+2_w&6%G@cRsZ=H@~I3e%;B(oiTQ5w( zelo_tIYdQ7khr_1p0M+AP~V5F9AOI?Bfei4pZX#1IJ|8s`NmFT0LLo|MZjskQH1W z+jr7qLsSUTF;iK9Lg0xbP8DbV{CUJ0^~77^`1trkQBjf3uoHNGwy4&d2X3;mL8rDK z+8|gNRMCTFdha=)a2P-H-^D4OisnN0bNELmC+%w* z)y~}Lk0-wKUnRml`f-JnlrgFQn}bQNdP(Z(L>}xm;n(&~P8qPP!;}DxY|Qn~het=f zAn)LSDW{;Jkxla2|1@sXH_-SG4&mygVuoByHl)SuN1K`g-bph<51l}y2MFgaFp^Vg zN#4i7r)OvL8@;eWn%_u?iXxYimj2Lc)VKQ3XQAUN4DR+Dor3y|?$xX$Z}dEx!_0%H z4EFT&Y#AH-0x7e5UQ26h&wwi%RkSfP^AMKK_8APma-lHbS1<|=F)`hKHpCP>g?$Ye z1v+_4l*I$?avrYiaJkfWJ}Iw_-!uXg?{wvxAnF2<85 znm@;fiu0Z3)-Ed*@2TG~d(3rKG?aaV{&8OoyF}v9=Jl15hWl2nudPCbC8W*Hbq5uk zv_hVs>XA0g_p}lt8G0X(g2M$`x9MFQ+5XIDM;@7;Lz)mO1HkDqLHcslYzFx>R%tI<)65l3d9YdWkna)=S zG3@WNMd~jjNyzU@j10c7k#$5CyV$0mbrqxMQoZ8P*BxXPhxD>OF=AqIhON)(`)jB| z9kIl+#h18ikyuo|s zm-*=JV&2Z?49Z0h{ny`Ny4WJ?Q^U6m85qc*pHag`9ae=USqK$Us7=Pa$*J~uv{$*& zq;IJdkvtnE5B%i-d=Ue0E$5TgYmebXvM5a~{KCn6M zSH)vyy*?|Y>^;O4c^RM7Ok6y2z4uXido1Ph!6f;zki+BSL%Zp$Bwq%fIU8blY`oa{ z_9oiSH+YwX973v$HsYgiO14hEu(~W@^?5(cwDU7|Yksr&HMaJ}B=TEoRIlkpFH(4*@9# z?R{iu(86_>-RsjEJgKXLA&T=ZzJoNzzj^i7we^>u>z_FD-BH_US4t1MamMfBsUcJ{KzYTCVqN+q&@xe{GD@ zsw^f#d`P$38GEWMr=|3E@%#2%pV!&l!y0Ez&>Lm@RzN5I)j)$urQhY(e)1A=+6EfX zEDUmP`WW<|m~7|YU$V?Niddid%~$`ucAoIjohM~7C5AL;;!gEHg6P5U{7iz?akXg6&vj8@8He*^En4X)UQww_&~I>zaCXca@$ z6CrUi`lUXcY&8;gUG4adzqdw34YA+f%~IzdE$5tGzC^@un+gL58>y@FMTz%(D;3l& zPR6I^p|T1I?LYtek)QDJ4~c>Mr)ccQ(wLPtSnYA453UBfRrgLP41LF|;9^rC4Zq(0 zJAM8)U&97!Wf2FPbbaE*-zq0gud6&fWSTk&GthFY<^xO2;ZOn7?rukwXst(RRV8lmD2fRMoo?DfJEzxkmL7`F6DV&5ZC}p4&7-I5A-cC0 z6%}*(Jj2yH-r(cY@OnJ~4&~XVVKW;HQbIz)c3M$PpNZm1|BEEsvj^g}FnVcjcPS2w zP<4k7P#1~fUV#Sces|FhDiqVj!NW^y9ECdHIy{W?mOQk5MRr# z_P%(YSPpT;TIuUvrZs5kR33EfxyOI~dcZJKc@)9e@!sf{UV;}nVG#^jJVopBcyD)A z1^187G?F;MhCgB|KBM%ollKU)nYcCkL55x{gp&MdFqebS_x$h?UDST}`lL?!&H`nq za-xXx{?+bJFFr22xrgA0RtO4XSq$G=!|)aLchr|4p zt&kv@wyl=EC81E^@)f+uqA1G$o+nA^y{@igFQ`@fMoKx;Mv@s*i1tJ#wZGroo}G;*TMfT1IU?6S z|L0HBn}uOLDKD*xp!>hari{+q?R*jw4M(a6sPv}ZQJx=eF?nuE(6uM&r6NGku7h?*1itY@%!(=l#oHyUS;%GS6vdGCmig=!uyhpW{ znaO$fruuky@2#Ld*HtWXz1lOMDgMXcquM`YLiRzm`4}aS^a?b2qz&pU(AoYBx-(x1FMX4r+!&l#<1-RFXSt2*_w zM(*!mVPeIsDUX$t9|=1z4gXywioVTF(e*1V1aoJHT+hShS$@Kkn{>>XXv_sLz+p+UX$n67yFXXB253ar|fjM8dV2+YAv$5KV zIbK|`%12KqGuCRX@o2G|JeG^BSvu_bc6$uDo6mU;ov=@$?X+(Y35|rHhbp=s@5Qym zL^;oOZ5Hnx)|odX(Yuk%OdX$Ic$~)zrJh3=TOlDH%;Z$1FgQPDiWgLd60eE<#PTnbJ?3~Y8t;~DU!>@Fd4Nb_UPE%v(8;TOrenGU_Fg>D}>Udu(i+Q+_*(mssS*syEct z)e|`ym?c(*B=S@ZjfjJkQ%XynyY`lpXF3diU@|gEzRO(b==Hg^I*OC8!7PnZD>9ck zKzgbH$6OPVmI-yNuw?SuzNue=WGQf@iEG`=BDWe1Iy%82^kwiSb(-tqrV}T+P5^1U zHUTrt@v0l+4QrF!HTWzn7;o@as&z{Do12PLD9fU)^)(~J}f@pD%80v*8TI*MO7%F&nS2R7J`~bcr3alsp@vaxiR-qcCXGH zn3)4I0*wYS@xK^2C4k_OTQjI?^zwr{SJ*XG)Zb^f#y*QrtI$~Q!C+T?+SndPZC0*R z{aGfWY=|{6@pKt(ZTzZ4y$>~UI!E3VPR*FFr)X=ZybaV~|Ct%h6Wb@=hYu~Lh}rkY zABSAGPm%QR7Go~6QN$;@Nx>y+I`Vw3Kr5^K$@;KjqsIZ&%wkfg?Vh>8flgVrtcU9o zswCll*z{ky-``)B{EQv_X;Z49u0AQz%it&OhUvJ@WtoFf-!A`7pQYia-};2#2Nu6l zlm4V4`U$!HDU0Ed9(^V01~$czmmv-dNJ&Wp>&Z${zoOe*$EBwqlWTtk5T+8Z3v+XTUU0HMsKDVe9CD%B}ysO9HV`97Vx~2xdtBdJuImSF6fd_cf_C#4R~x#E0QlJ3SAXD3QRExG7v9t4eB>Y~r3 zm}}KNb=(e>pmuml{?6c|0G0DnJulHtlIk>2stk+%E?@H8RsQulkhtB`%jqvW?W>AezO;?UM;P=TXeVc^D+aEj;5u^FJ7Lfe)1mr@**45mK`)D zQ_d*wry5>2)=)@|Hb=!ZH!0NPr&Bfontea;s()OWDvSG2K^c~)1X$s$&resg{tm$-~d`+1F*N5;Fd+mgpm2`OjeT)CX{ zmBz=*mg~HvT-QG1yR4Fi2r^3e+)(V#lsk>ndn{=155CXYOMmf;{OHJYjGcv-;Z`H5 z{94hY19@@yoyNVm%M3Fb1khkt%FRq`FhZ>FmUF9HK-o0ABK_LY-rwM2M>De9TCCCc zBsTY{LK8(qFR_xRc(}}qwMQ%eHJupsJ_+)-KU^1<@;f;UdO(aTIq|*CFjupj;_c-y zT23cf5|StObEJ!Ea1z&prBCX{txS@wA}`iz9%;6K#tNTPjcTvljJc0fEu`Yf;slCk z`}+004Z9x3`MTYByQSdKl%}o(CJ{&3t8}jJA;-VMs^h=`Q;z_hVvk z8O$>_mY*#3Nu_6W>kr>1+h1YZ4y7Kp@!4N(GZZWjP_-?7F0C1ji@!+QcM;kvYdZ9F zK(F9)MTCZ1$#0#OKTG&??OEw8aq1r&aBOUVCL1B{o8&F$%AK~7TUCQ+*?ayRsw}%xcu&8uw#go>PbXL9yijCF5Mq`z z%L^27^DhmV@+P0+ULJjWIe5eTXnRyl$Xx|>=I57c^WsJM0VnqdtZ0#(^9135_IftO z=;KPu-hDpBYF_8X`i)7PU*Ru3bxMX4DySdG>0aDNk0Q;N`T3rQN^>Tix3(=Wdhc6PT*NO%ZhV{vU&baN>T13qL@myYa6#eEtK0fK0$m@{J5N!Nz@xGs` z-;LkkE_WAbskO${&=;uRpqCJK#%DPLa8PPJsxl{k#_jbBK9Ta?N)>e8$vhOht;^N- zDA4qzF%~*}ogC8%GWLC7Qa#Xsu?CG#G-X5IBKy4j*7!FK4?bS#>j_1v-aIR*#jaT^ z5oC4b)l}zj`}A`E?t1@j_6r#|Up^b2odpgQ=4j>Ox&FT(oX4CX;QxWy|Ia}E|ApEA zO|AR~zW@7UAf@2{CS3mg@!##he?EoV+Lo)?1zV1kE%TtTw-k6Y>Jp0HOzhR9~L=wO_YtEUH)^HvnQ6Z z7B1>>5VC8M6uf(~!Flkzwi^HJ)YoCLY%f9N(&`wVzNt;7OU=Pu$2t&6ir@5;S7k!EXaI zQPN%Uqr1%voOVpgJ`wbQ5H9@;B$Ix3c!Ht>2&|rXLt3X`{SQ`px@m+Cs<2T$=E_V{ zDDW1Kce0-LX4*_*1Kxoxy{4$9E=t#5G3l?k0jq+_w)i0eOA4iJo_odTkThG5K~^4X zeVnXWQqosZ{AHU_ccHkRm}7R3UhVN})>MJkDDVW9+vhr3)35V_g9!7o1*{h*#d1Ot}ijIZ?#MRux1M8duBY_3$bGB1VIo3gN|R8 z90Sh1m}h3jNK>v6dG-|B@Ri@I=Eu5*sm}|Yt?DOqJcvlG1ioM>D(W{8q^w#DQCPXy zV}cATI%+iGBYUPjq%+E#78UG7T&$BF&Ggqa?dsB)ZIAES&IPr&*kRC%KL6`}NNVf! za+G-x<-((s{k|$m`~theX3+-Hhdg!!^G+Xv$&VJv&<1x`&#*3hcdcDf752O)^@MJK zi_c#WjJH1dvOc`AF-U(U)dy|_`cXBX15VYTqxFv2^>b%W&Pfj*hxws=vJC>7KsS~p ztrXe)=_`M!!@GaRa2_{zCy?`8*W(AE>~j`#v`xZLcYP{^P4SLep|#FAiQ&g#YwXGV zPrNx%u_*^@oU?hV!Hxx*OkPKK-gCxzcY?Ps(BfRS7;Y2-u->oXig7Pf$$(y}{p>wECOa{Ql3@X@H9;MP|y5n_HU27 zwAe*PKq2dM4x42nqNgZXX-%RXkn1>LVqL-^3^`1G=)ber#7{5M*)BGDTXGG@ikyVtX z$iSkTPxE6~ZFgh7-M`wUX{$X>>ad+hZiGZ!WtL6BbR}Bs(OzvyadC|iXEdb4;9<4- z87&hq>PIxLK9hMIl(FmnMGUHh#YM5wmVX~WWn$0Wm3>mn>TGy)3RY5EV( z*djthN%8QKeSAt<7RQD7G@X+I2XM$yW;4qr0^B~COCPwcq-no>mK;7zvB@1F&zciN=?lqS_Jc5`}p?q<`h zQL!^psR6ng6)*`8%JT`xK9LYD;J0HccFg&B%l()FvH-imWf_wC$+FZOOnu)R2t9mq z6l-c8Ys=AwrFwq4Bl6tvW1R2T_ix>H82gfRAsf$~h-ISdqgrG<-^rU_|4HD=Ui+i} zO_$n)V#eKfI~FkQd;Dc+?AhkC$F+QMYwLlKB=V7mQqL{BH03X`+t(9QE;1ZMM9ZCU zu!BU(uUsZBN7?s}XsF)@oZ}?soo^MDq<4J(Z+Y{S-j}Y(M~$^L{<2QLEnZ3Z26?y! zl^Ko9Z1D7%w|}m23qTAhvve8chJ+0_~mV&Jl!h%UK`}F|#Kxqd zP1M$(z3#X+`FB^D8*aUfCMzm)Ir?qix|u-)>k@ zky5N;Qi$`48~z7+NsD33TKC}H&-_dig$d_xq(vdEU?bVp)fTAwC@`q3Y<0X_aUkwJ zva#crz)!)FgD7Zuz{XwtSfF%JAk+dweA$OluzpMeHKA z*{9?755L0p;wDOqi;ESXE-*a*zS~|P&Zj)`L)m?+jkiOKm~)f5Daohq)S~9HM>b?8 zM&FlQPoA4oC-M05w3dSz^1;zz+2}CfK%o8gV^7+%FT*Pe&=v2fEsi~9;>LS0cj8Ar z1h1E$Pygnd?z$dHFRuIX=X}eJjzwJJD`QQUuVFVf6TYY_)bWcKf`r3fQJK-D&32v! zjE5KJ_0vBLtNW6CaEFShRhe+#2u`L47rWZI;7LbNE!zBMjOQ9C;-SOK&QW^Em3;Lc zzUwZ2P$)U89{`mC4M^B6cmXs&o}wByg~UT;Z@FY-Ji|?vVB1aohSsQ29D)8!vu+`` zzB;GJ8Z?~w#B;rbuwnp&S z?W*NL`Kc5vbWrp$ywM#%C^6H}7W$1=pz)4Pc>**gV6x)Hubz_(pm1m`^IX3Tymt3iLgkJKn!ueksu>-Z8x zc66gc3X;fA_z-ai0mzGn)$c_g^e^Vm=XaI7xQL|xZn$_zj8y9VaMHuR7+~9W6K;+` zs?G&g<{o1IJSE0i$4_SPy@MR9M@)KlX)-y6@A>@TPB;&7&#p}PBaR5}UMU*eVHpyg zV@TBN@7lV8JlGPa{CVm@Ac7--ft+AG{Yt-w+w(Kihy)?G>T`dM=;I>gZ%cI$=dtJw z41H2xQD@D}!i#IZFCPrAV(6FhCmKe%bg@n}f2KEf@RlYCq(^G%3VLJ%PjZprZU22bKk;F6=Rs-B585|Edk~u-4Dx`}3u~J);Zi z?{CrLHJDkP-ov*Za^;deC=$k3vkcd;?0b=K;9&8)Y6239KI>W^rs-D$_c;7&t;Q#@)XBs%eUhZ zKFd7UB51f_;Yo{6qB3lj^+Jr^e}&Nz_XdT(R&HJ7x|cscmnm_z#!swV_rE5oR_;Dh zZVuj5R3ep+@JtfS{&5~sx|Sn^@%vJJe-}k)T-Uvj(eLwOzDgG3Wc9C*BSgDP|EAld zdnfJCtBRdYoqPi+3w0^}ICq-*>xg*nX#BAIvt>1DDvL8?VJlNBVwNfL2$j91u=^*P zCtDo85(sSpO2iqncxfPM&^=;u$lYAMeZ6c!504k4J}K92MR@3R?ZKW?>B3rRCIcpW z&haTdmZ_P8qB%XrX1PL!=-0%lfzN8cuX!6ec<1hYK5%1f~FH%#!|6*e=hQ{$|h_I<3YOPB?3tvQun2JaUCaJ z?-l-ud?&Hug?XG5Z2XMXT?5}vlU;0Vwl6D!8r?6lxJ58c432~ii|M{9rG2>gDwAlt z!mjn1XZ@5%+aby6=Jz(^u2?rwSL%Acb=*KV`gc_(FU>Dlu?oad7+Xx6Q&n}Sz0Wav zKhExSFWh&*_$h+Iyud=L8;t-$|Itt5`9CcD4j(N)$icri7f9jKC^M5tFEyU0e+Az! zpg8>c+V^3($i}3o)iu&(VVA0AbWWS|ze-jAwZZ+bAOEL5Re)KfrdVy;JfY)rBjPRI z0S)*Mi+{+FV)Gd1nXa>w2pX1H4HY`1EeguM6m0gh&AYy0<_};OG#Vd)k8Z z;hyz44N`0|eEVbPf=R_uX*Xcdzk@StYs3f~OmeIy9t3R8RGs99bfCr}}KE3C98jzvU7irsdM(d1`@*R1a*$U$a7%M;U{ zul?-`oJNNCAKoWW7MnpXGj|HdGbDqs)ZQJq^Xe6rSKSZRxu;5N@uq=ESOV99qbsOE zD}wlfI^c(434#DKl_l=_U1Oq5#iVc$<(d8kbyoUmF^(_DTW;|2ktITn;+e_E3nskF zbd1P7===Iv(2fZs*#>nMi;0P83Y_bK+?SlUK$1hrtr-nmFtgDzvwI+ohNI$`^z`)F zz6kJO^vK%V-|76!9}0qkN5Iif1$jzTS{gG(GN`KiprPU=1f-bZ2%6c)4z-iAwfZ%y^UrP1W%-`NmN`43DuH7#N^q3!I^F#D+dL=R_YZS^=UpPxtWm zs;ZWLPBAet1Q=R7ZD~`$ew_t!;5NlS?$%?DSvY5?Z;S{IojP{Dza|6!#&lKE{s107xd zC1Tt+B1N9iycKQV@XZfnJJUa~;G9}o;%oO15!x=gYL->|bFV)s>awg?4&g8Cp|l+XPV&m^i;xlBmahjAU>)z_yQ? zs{vA~X_t$=eJbe6+(9&O3E@^R_J#W_fjBY!V9F;6QS$T@f$qSqD5inFatpN((62(* zf|h1<%Vt=T_Z*j$FeT9a2w=`aJm|#Yfk62blwQ&8E-ORN`hS6v<~eA*!x+R9znXM+ zF;h{+UVL6HR?nu8sK&U4^mzLYVeIltcwm?l_f#U37)!JkRo9avkO%lZhJ5cX)MzKj z8TEXJFjXc;yHb!fEK_oc9b^P?AtWFDIxn~~bLA>Zx!C-c5|UI_(c-c5?Q=ru8O zfq|W`2trU?(K<3J?erysca{4z8IB}BYVT^;W*~?2FH?YVyrq2w0t;>6n>TN;KsSMb zK;B_y`Qa1PYp1BYQb7_1v?F$bNzZyF%e{y`> zc91x-U17HTnj10dPMj#bGzCJhB)4w*8aIerS4%t&tgrFv`?}sR^}^T(o-oKg`m;!Y z53gYW0J!x<%AE=M-{umsLL61C=4a9wHU*nFCU`3GS1L7+jSoIF+L2JO* z*VhM7K0cU?C?6=94~M|ahMhlib4^% z7o1rh(cTO?$G1gw#{@t$mIO5#NNw(-rOnSi-}4)>lm^KgSR&h(tDt{lfb}c^dRirr zSFJ+hd=Py$fQl=UM^Ee>gE;-#SS7UC7DW(vS4rp`to+sJ2~rOpUAfNF4IUheG&2Nr zsjhHhJQ!^tC?`|Unjoc=e?$!7eC4kqx11du9+{f5!{ZSFQQdK=2gBOhdUJnY8ualX zG$cfV;3TI`jzL#w1lt0Uwf4ZnVwL5xe>==^wvhfBQ}0mAV^AkvqBd^0^W zlZl_75+ZXm_z~CyqYwlF%0JMfgbZxfOXJ!9ih_cO!7Go z1|s$!XpX=ANa1Vk2DHrw%Ke)upNs3ztXl?b0VI=KOTEnFbzZd4IAU{ivmQD**zPPm zJEywaF&0vGFB z9ShyuEguV+rsWa4$_=a>iTYl9hs zi66N4Ab8*-kXDzw8`B4^pxp?-jY?S;l^xr`y8OHi;=0HzBcRL==4(VDN)W4Crlyk6 zs#XNJ^UBb1zkjb2oGL!zb-bLlT>`kS7k)dp3)+TOecqOXm!MN}+>^b(z{SO7lj6D4 zDPZ3~M{#o&7Yj#g(MnWAq^0${DK0M7r+h+}?S)SHh4-ZPj`nhDIVhAk$l%|PSh6C~ zpq_%(B;}0Ogx-~x9>>F| z0+hcUtLE3o_im{V*D|0sXWO5H<&|=;_JW!|l)#+RN5GItN1rW)9)Vmzk>^ZU%K(ld zpg-460z$%?US3QM=0LzmdxiSTqvp`{jg9snGVNjSOlp1q3>97>rMiYfef#jOG~)?? zSwSOc5IOz{GahI*^^h(%6qVchz~{`Y?M4q2J5`Z^B&sTJW6Um zfeZ(>gJZh(XjwV58z#V9dxPo%s`KuNB>Q%RE zHQ>RL6b`*D3+lMd%y8x2Jhz`O<4p4fU;3N4W@^6c_R)p04ftUG8lV`E;@Rw=x>N?$Un? z`V0pTo8Lk+Aw&c=7YT<$Ew1hrHBW)h82aXx{kWKho}TpU?;C4A5|5gQ@rj5!k2G|k zs|`+^EGQ;`FPNH}3w-nDQnAArJ&Nz?vMxRW!CU#4=hwHk@KAtt31G%CNE+PRqrAWN zggZhL#-oTGiM%6-iF3* z@F7=C42F-YRFeeCVa*UTb^faIC3bc~6rbm&MdJ6zzt4`v!{&!;)=f;9NXAR~`9k~N z8<6NACLxhAHGMPM0%9(#Fv$b#L9|h)((&~OYa=5gGm(^NK`S*>9rP!`_k~tH%%}!q zDK@s*3g#hL_(l`IV*(V|Rq636&$*ul6E!}_kHK(la1ORLc>V=(J#7+Wu~791qf z4nKE#MO0L@!l%Bz{+e#Vo3Rs^=a~37q8Xa8=X&&}p=2q_kOPL7L+B{CRZVjC>;N|A ztNjf09h<^a0CfWLQ}?W9e^9-UhuyHb&_nUO9*GBR4>2v_bbKk_69p_oS0$)99}+|J zQ!CsxPRJd1K;(dc@idzEcC#I4S}lREgPgnd=AynUZ=70W+}KZRrwX z%#xT8A`0e7047LBF(Og{ee zWse{1fuPEdYif%bZR4^u5Z<}2j_Qq1%tANbHIo`~7!4T-;A9HiU?Rk{Kq)*2d4#vn z+L|ctDZpb=lVdOeu;*u{(uLnwN1#h_XOgp`F*>0!+2Oh5? zFcEWyh^rU(#p?2y04}1sp-Tx{patF+m6#X;80-nv@>jI0YZIbjrd0^dYd1lQ2!gvX znA`}ht8W3=fV*x6kOdkRq&IKgd;{&o$nbNBcJclE{1Bc2f-hyAQ$Tf23*Af*zA5e< zF7#vsfBeV+GsuahH>`#Ml6c-vNQQ{AQ+W~`oo+dr6)phvKwgtz_jF-?0mNejmmA>V z@H>u+M|6tsxJQJnZ!bOot>FykjF#5c&Z7w!g(1Jk;sy=Ge|odXs;aBa_-K25PQ;!r zN39Vd+Gl~l%e+_5kVIX|XFS1f_27gMnEt09*$L1B6^|h;M9_$84Ro(LZA{+*)YI`m zn1;vDAMVy+q9%9bqv9(@8Q5<>VM?fKBA-m@BTWOrGmJMWX?Tt00V_p=J_|tSjva4L zPcsO&U~mo@#IesngW|hu8`9mkHC`NsX&+7DS- zW?&FDPeZw39*hFOrrB*+6!c>6)rvJ1*kms+aCCTcL&%0g)(Rd;;nNlU9OG*Jnp0@0 zg|mkT7_e+)6`J{efe-=Qy)@V%928)p7HHKJ?)zLiu>*)(&OLe@@Z1K3#RusS)%^Tw zrH=X`Zf6pL>+a@;$Y-UdrA5cYTy`IV!8v>oB`gn@kii_OJJ3v=Eb0i8YrQg4uB<`R zFS}Z52mq-L7U-6ZsjdU1gEL^co52AJrQA^hlntU2Vi}I@)J%wbu9?y#qlSw2Mn4XnIi6(0m;6RicB*qs*YA&;+(&z4r8&0`PMS zY{xm@G>Eg24+1c92F^(${IBMN2hs3rL0E+Vh&(jd15M2sq3S?5)iZEW_Jy_pw9c{Z)pVJNQDJj*%KFrb z3(JA1)mg@yC@`?!+qMD9{OS7`nPUgjL&Blk`3=A!B*+0G<2lkw4t>p=lk#8W9s!jF zWKirXaXDBFn8ETHTP+T^3r>z7s07c4+{YAmnKKQIjD)vVF0iXcO++wCcu|4iMJrHl z1@3Fc2(bjD9+b^i5h}_$&2f;W4=+4E3^V$Me z;fLrTf?|y3*=)wjx4_@HWUV;o6y z4ziq8kN9iIO`eQyaxlv=_5cA=XllWAx2c1`azpaB0*J z5jy(`<4rWm*w`554~#T)TRr<_{1Um$CtP>%63`Yp=aY|f>GEY<*jX|VG^5()?csS6ACzyz_ugS3GfNG?3_5wZ@5h((Z0ZTyg#LKtKSNK zulDZ_fvknlBB&zWssT04e<0a!IavIRxmau_oG${4X7#cW?6`$kH<)Bx>D!7` zG54#6&GL(B{F!6wYl}6n162U`^v_cT$Ot)=uGCu(zUr$=j5&k*_1xx-FoX#DIXup# zRS7iw6QEGU`pCZk8AQ(xIenZ2aABa}*e3G3CwchNWlv6dS;vjgWZ)oKK~mEgAI8SB zoj!~5y=u_}2tnAVfsZ_v6+n9y$o_o+#w4eoiHT`0nm6YaDZ(uSZi?>&t}6{7tdOz$ zFHPWG?hV_CJOF{NJM!|BC{CTc)YLtgU8o6?O`pI$(l3ylJ9lnVk`iL0#o^EH678&V z9vO9@*Cl&wN$G2+%NMUwqsq?tIp&`aIQXEtr=!I>Yr0yX3 zYd*$uGWhTRk#71Qol*ZkRhIvwwDR9?|82VZAN^NVLgbZCSG-(dBd(G_xteG=DB}!l z+-F3TapqQ?e}-}3zoYtCF2+q+RbELDD%Pxwrcgt>4^F<8cH%le`iy`iK-zHr*xbS0 z(S@d5V>qE<>${a?MOqTm#F*7%s|>|+baY7`K+NBR=JL?=T=RgN79Aq*OjTnv357}oRTzLna2inc;`0-yO@Iiku)7gzJ zErei>6<|!$$(Gy3=4Jz^h5(<|?pTx$*%d$tlYSBtq|}^mz&Nl}2hRb*1$oM6B_%sj znn7Tq11{peTsx-)E(DMTKd39Aq+zw*^ev(fw{3=ohaUlyhKtneX#D{Jj%moWApP!u zqPP2nZNV-eaLILPU?rPt1gtbjKKg?cX_#*$i&P76BsF&rAqCd}gWn5)IzVs)sGKM` zjgF3Ld~>yd_-+zThu zh7r)-LG3SuM+1_p5rm*lzWVUP+;MQpX7Feg%(S(&k$Z$q24^Yl)Q)MS*ycGv&9@Nk zDD0q}oa(`eBXIvyzbydzgKVx-P!mGH93ZyaeG8DMV*q83R)B18H9v!RVGzipB08Za znRcK$gYrj`Wbo+NXZH8^VGc+G;+KG`ukkoSM*ac!SqGTze&*fiHSJ4Jzz6~p0j1%D zQLcy8#8Y4~K%=Dv;sP9K^eOhw&*w!{V8TEeQXNtu2J;JRYms2J%^?=B9xdkwqY?y> z{aeuQLvk$;sqjM<^!F_|!!3Y0IBT34_#erC;Qb3z)gitzhmTB5PL60oglkjL3t9UE zfl=4ndmb*=2q+7M($BpJntsy2(Jim6AWA`upltH=1UgyHLWF~=g9|q?Sb>HE;!Gj3 zMQ~0?L_{+@4u0ET*HHctyaKv91Ct(R^cO1Blq`0TB;Sfv!kTBGDU|@h4M0$XsldlEx^Buscke4qJ zF9(EC5NNCMV^&8iAcXhN&E=MrlPd%@Cp}4cknCH$ATtQ=CKNuTbgni-;F9ZYNHL;- zjJeP{0$9NbyYKYA9FS$Ob~e(;|B6NG72wkpi6C%6i10J24xSVmHpBZuNgyJ0_4KB| z;R5BruZ*~}YnqwFpnPEp=%W5}Cb$RF<><>*2)08=K(MTP*A?4N^b`&NQ5rlT+D_!bO8K zZXe?QrXvL}-{T#ft_&%b+S3y;fTolnR0VK8bP9Ae?to^@Ee0=ije6pBGCk#S_ly0x5UWE2*VY{S5!yV zAh1@n+h;BG58V!l{2P!w?xXmO2zfy~j-c9{6?}O1>(~Pq>-eP6v6uO@(=V ziwFT$<#);qE2j%>1vdluQ&r)p&`HGF4(3IyucNX1Gm*r^#C%?*R^OAUVU=D)M4W-A z*>n_*Y#+!RLB=P#_%Ih_W0Qc7S0MDqF$MEy3TKQul3-zBp%p@yy4T8A@#?_wbwTjb z1)&EWN(7ce1kzU@w6mLCz>hV-_G?5H03BZh@uvV}^!Y~z2I7G-2(yIb-L=~AQAqzL z1qT!1)h#bC55Zw>E&v)C3|$aE_>=crIk~yNfx^=TlOm|<4Vrp6KpqR!B0mFp9YItM zu$gwi%5@D4Xp_T%v4j}Mlrv6wI~zt)GD!JW{dPNV2q01y3OFnl;pwKWOw^i)=RqWA z01E0Z?(Q_la0{)lu=d)_z{}-;#IAr8;MqbZm~7hyzPcUmtO=c_)(XZf322NI;JZ3g zMAtaBewRDFZ}+7fg(cMmXBL44hVwT>N|xsDfN9MENH@I!Yp4gX%whoq%TvFni4Eq6 z6qJ@;Y^6j&mb11HNX3v=ILM}eeJ@0Yfq*VVpq$L^pneUkxj?Qq*P%VkuDwo0`n44e zLRih_S(@#TvFv*G?3sLRh08(_+oz0jO(*_d~mpcz3dJww)^E-yS?2 z!!d=WKHr)K8dmU4^0IN}PitgTK~vG3<%}38u64DxE_`j#2XbTxY{k7GJ$?Pq9$FM4 zqx1+2_4!DU3abN3qZu}2|QIjG@1{u?zZcnIw09^koClK zGmL=3G;BdD*moJ27TXg2Qb6XBEsz+0+3xKJf=ojY4O{O00vezY#EAJ&T@9c$K}00z z=;-*{69NiLP$}c{^b^9QlY*@COX_PH(z|vY;akwp?*|t6E8JCRE7U(d2Fln1*hhs0 z*c&1savTq}2IPH^lCAPEId2G?R}TnfygH~LLRP8~j-4Q;6wkC4yQvano;F&x0Gt1U z);#GFR6j`rfm?u{l0~R>p!a3Kf1iUXI4F(mek5H03UtjbaOE3$9wS3Tbx>yl&i}`v z>!Va8#VH~(kRuSzEI|*{Es`tH*QciA(~KMR;*(ADA~<+shui%XH&4K3pn_?|&lTNjd90Ab`i}Ay8!i z`iI;qrw}hsbJi3zU^nMfet)?Oe3_u|hJaxqc+`5p9nD%~Vq#*zvdO*w*>?CDRuz0^ zBSJa>21`C}x!kD3cR2WE@jl!aya4R3#hfss4y5@2t^6(?np%_m^%mlF<)^kw|veY1Qr*>EPbO& z)FD!{6V3tuTO_HO-CrbPJ&;2uiP=ZB&_dFN7;Y3?%{3}gL=+pq^Ylm{APd>-{?G+0 zkRk+eKtvU_%a{Z@C>p^;-U~9&)omNrfKN93gD*WdH#fQ#PA{aWNLvzf0Ixo!TBB+B z^1corpQYo4E}2|yx$J(~w;Ht7?duQ@+WR2sWO?})dPk2|mX}SRJPCu8ZtN6kATAU+ z6>Z1H!~oi1%|m@)!PC#xuA2Bz8xO8T;6|9jd;WuXb{`fvVjYKf;esV`Z!;9$%K)1T zFpGWZJy^<4?G7jqL_@N#wnR%MOEak|1DJS5I0;p|{kFoefImTj5OIv-B1{`2)|cs4zV>^+x=iw;GV; zn)q}E=nuPJYPKb}8@(4{XCPqXJ+-q7vW-DvF3}I-It%k({r%L}uU{{+%AFd5&}c-l zYz`#p==&XkL!M@MRH7dNkxl!i>ZzURYbMpP$Ph8k6N>u|_ts9^tBb%z z$bjuFfI1wYni}9Z0&s}RVxgho@V=L<2RVQUC~ZKdPrxbnI6aX7nAEfmG`cxpa;PuF z0jc3;k|5ZkU?~xjtbTl)8H(K$pb`WLfuI`GN&VoB%ySK(L8`p>&H}>~te@KgRQ``j zcSjTm(@-OkF`&ZpfS2w7DQs$QAAt4ZxElKZP)!iRzckf2s^HK<>4FHWyB(w3$7^=uariGM|AQ>^p6f|~spM{tXjy(R~!F-tBsSPFpVJ-k!)qzv)Qr?4&e-pD`u zZxPYx9U~3}O z1Mm!>)OQi$2FUK?A)g84x`DO+^(hiez2#yL@aqt~%UfH2Dj%DI?f$OrDbQ_DR!jwm zqaG^pnk1bezX0c|ndAi^PM|OlzK)#fwoso>F>Dmqm0@aF{|3+iv>g1K{plKH)0Cf9 z4;;_Y+$^uaLBZ~7rU8X&g;f?`|I6HGdQ7Tid5;CbuQDMr*0!Q{A-+s&;YmUyEaO!&$(k<*9Vgyd zEp$V1((|0Na38WGb<%dfOUSM}IhiV7O)jy)qa}X(l9Ygo9sh?n1?;ivc0mGd-j z5heg)gcPb`0JsrAl^_LKAb6|#p#@PZMFmOvH)BDF*^g ziwp|^miPtGDUh&VUmX(zqw@%W2V|x4%M-7ul7gRVw(5m5$OpB>2tAQ@+wFWACfTbL zuMX;`Ah3!6HymmZ?6tdmka3d!ylwU=)q^|$z&Q|P=Rl2z9q?f6Gmu}15Ox^dPw{p8 z0U5`y#&=?`?D4x#*5N$1w7g?4^U9Fj5Kj4Te;hoRPRileOi>Vz`ieK?<)4P9tLT4B zTrh(YBPpmtk>L-~`RC##lGVlIE$5tI8Bs@aEXMK~<8=P^1c_XA^GlJzs4g1Q;O&KY z0^KwI&GS7yC%+cql@E(EukduW{a5gYJpHu@bWwF`c*}1j?NU!}(wZ`(M#u{WYijHs zwa4Uy)GYgqj;|*n?#Bd5yQA=5om9i#-!iP^6aSJeqPj3+v zU{On%k(DwTtB-uf4sn->{F(X(Ki;fMUi5PuY)#9SVm`~~=u?@Br%T}9|MMfmm;4bb zpHULj7XFa2&p|d`4o@9BZjLPk4c1tX$2K+x_g;-bZ6mGy%4J0!At9lkH&|04Cp_C0 zeKc&S=O2NSm{IUin^#^RS2gR@NN1l1$MgzLJWPc+Qy_!-N|=aiDuEi1XNe~;y|Rrf zfznpu4H;RA#KRd-I31DU4ZqmOl0Z1b=YMM{a%72v2$cwGu-blxx*3td>-J=I-*8kv z^A1w_A7@f@e&nr9I4M6@=Y^}9o4Zu!d~td|yI>!^zCmJGad|Df(jDiy#4{Kp3SUiw5u{2=(jb0R z@CpvXMNK-Rd(7QKygDG1zQ0{I7 z&{bb*pS6A`to)6&m6dT=rl`QyNwr~Ox;Wh@9d%_XftW!Z%6%ye>d~WeQ_dzOlOCy) zC~Ri}QFoePZR@-D0Y#RcCUm#Wt{T3dT4cU;d5#}_$<*4&eo0&MK4k-xNIhLU`y$Zk z?byTLVHXL`GQ~8IUc^tAA|j74VH6`2_hv5%j-*(R&~0J+XQ}tkqp1T22BhWjO|mWy z6%mx9aqe2(dcel6pdWD&?Sl8sbxM}Cj$n2Bwwo5`YWN2{Wl%V&sPo=rqro*YntOIq zYL7|jisksw`K$PP2IFiS>x9}@7Y@@mp|i9k z!X-c@!GEkWtG#s~w=U)?1{b~0hn~jgtp(z`H{}fK$D%*IFx!rSsKa{AzaQ<=wycLT z>Ev`nAg`Qp?L1d0?$^gS<}K@5bF&tg+#P1L%xP$9sHe<_MmlxkVcT6Yk>o+)V#MT< z1UCEkZ2HQhdJ>Dd=bOoFsCQ?TU_4~anakCtcCRGO7#K{OhW46y(VakaaxKT4vC5%$`*I?JjcG;7fjfYWO~_pz%-ke-AS8G>e?lJ?a0vddl-f zwYfVbVNI#VbL+^SpMs)h?|4eiyx;efu(TA5H$0eskiNwm5qsgZK$t&z?da936Un1n z>dZBcr{2s<|NIK9xrM`3%pZ-s)m85gwpymYuJL^G<++_^bG$GgB_Y;R>$T(e!Pjvd zWz~&d5jZ~d8S{ybCZu<7v0MBql>G8D(K~IFw5tHJkOUAwGx2<>_y)qI|?VUAK;}bAxnnxg? zP2ey=_(3fWAI9=|GBh>OF03rJNBmhHsxOH{84^r(CB^7Bzr0W(5;JS@IUR-Gz6Ob% z)}{HC?>iof@)kKCKv1Yge|5S+i&|gLNjOC8>ALuB*Gc=~8i~Qf23j4~o902{Ok7-f z&o&ss*D*?UN2Z7_1ci={?%PV#bvkccF7POH^)0cLey@Pt%hstYFzdz7vUyMjD#Dr-I&3jTIWVtiI#s z8O?Aq&CFCdU?YF#G7Pfgt&3iHcDtv_^MGyTua;>W<*Mjo^7VcGF{ghX;v^J?vI8d_ zjlNUep&Gv^Zm+cpPZ^c`rFDvciYuew>mj^ZMYepL{*0GaU3hBa(Z_|Ai0c;vsB~Z3{}};!--jfri(wZn3(68+nbbaB--vGgY?Q((v^}$eT~4wA*y-VumUgvv z{yW|I^ZRS`!uvNljSWd_U0)6!yBz(;e_z@AUjF09kESkrMgFV_gEwAotEAMph^Tbj zbUe*><5(Rhm2f8~EcQ`zIghiMa6c4*P9J6E=6cd!RoSF|C{yeHyJ(dDPisNJBv(GJ z-$}b$3d1|?lmW3kO(jBme20m7@9Z;YsD6*Q_>5V@^K73n^@j0+9 zPDpSCMH7uoViQlD&mI+f%h8)%ZOhf4MV9-+mY(*+27fdvxa7wWTjRUC+j2P8S4+|s z(wh}fdlF+nKUSsJ8wVHV4x-nWjfgzOa^L;u7-L)#YnkRoZ}D{L8>n1l-do1G?KWN8 z8ku1586Om^g=*QZUzd($@0A=&6RX%rE3*8q{@zl>W+_BES05urYK}>fFML#&XQa8` z^b%7UQWs1?M^&yY>G>4^25F{QFUjC zNeI1d`=>_~gy_c~8+}8ccElYhhMt^Y7(p_LcjN^LMoiHz=b_F6%Or^uN4kR*(Hh~F zD8^fC5B7rC*b>JF9u~Z*I^(`PDZ3xVib;v)yA>WTlrCgHRJTOS#9eZ)GrlhRO5I|g ze`F*kXKjQdVr~9=1;I~#^UQA-dAc|*H0Y{H*@T1%`n{7wjA@f-B+Ste;0JoN4@xC% zBWhKCz8h_-jO-aSXnF9_|CY;a_VGUtnzE@@!P?q7CNz19%z3I|5Mo#i7fioFUfl2t z4Bz>WZN?{=nxMraT=yAhl4@*^jbV^DT;g7U&sEu*@J^Y!X6LgS6FuHP?_yzd8M$v~ zUy)}%g(o!K2elubxwJIA&i8o5+)wuYR+{0RdTjSz^-Yaw5PpfhP~}5*^CnhwIP1|J zr6*kplUUCa*0s(A*9e#ZPub*0xuw(4lQz?$vb<8!LR^0@^;&b`SG=cd@eS|Zm76@i z_VDiQ)9(zX!$Nt@vXdRuc~i58Zp;g_N)>^72_vtgdb2S*CKFlAz;qY7oDRoTt zm50~L`B@sBQcoH!+}-oE77kqUVw_sf=25pA{<6*ceCKYhE`LP;2Mf#f<((&>Cv^Qd zP0aI%q0}?aFlGa$eU=AgJ@{B2kQ07QPt&*+2QR$!us^$3x7LH-#XJr1&LKS<4_dtJ z>;*-l&eM1N_#8W`o;y!y(4}OM`#2=b{F>&Ax3UDQ$_eudHXqazrpKx~Cs(+c7TOyl znu%L?cge4+DBFnpbWARFzWK@bB3Q7>k2lcMv%M2^ljOoKlFxN)tUJ%q;^NVPQfL0z z=1_idk4t+a<Sa?o>p_l2`-ij7aJytJ6DhJ}JY z+?(_5$w=uQte24_Oqa51OV+YIQm0c64V@-T=tx*t00+Y7z$kjxQmvXnczPxEenv|Z z-|OpF;__ALf|3O1R($73drWTn9u3^g`2CfRU0r0i?5iM?lut^T12@YOlbFD0xr_o8 zlz&6HM1^0yuKIk*dk?S8xbkhUcd;@19gscf-3@aX+b4Zjp{s|ZrWVuv#6N$Rt|775 znS7mErXG8cqld+qxq*O&1NP3_Nz0BDo%Df3e!~RMYOmhES^2ysaa2H?>lV~iZGQaV z{NN8L7{P=2x?bVDu|gL#Cn_ZHpe(P@*f}C-?Lb&a7Y`+Di}smjX4W*()k_j#e0{FH zz3Q~oJ{Ei1EvB@Fk6rY}wmW#(-e&IYq>>WxWBro-U3NL9;cz;J-o=TDD)EFHQ*O({ zaV!Zu-?uIdU*nD_Gl-xcjf%Q{gBwRmDv#G_vPVjAuw{H4QxzEOVzif@-s|?Z-`Qv> zDCoUf`sd4|Gk6UTFUV z`KC=Kx3*tIGPdXP;bKPoFR4Dv?=IsZ9wGGF#a3y4Pv@2zFO6`NL6xIRJY8Dig;e5S zzgWk?E5B6a!Xf%cz~`Iz>grhC$#IJfXvR!D!ORfyIi`DB4%$|*(sOX|@I5IptP}Uv z4i)qiph;gFpEHn37Q)faiTc=Ae7)@U7fmO#CqFK&t}S=%h2dd3?+oNraSME1`zC|; z#_$$T$knUu1fvas0n5MVM#MlEe|L4RVe%s}`Rs@dL|LLDvJZ=|O=#kwo)c|tf_UoA z=U}3Vmao=7Teo0hu6kAPgPN-1>P&T(H}(d`ER8Fd92{ce)KLID)KkfmZat8syXkpe zx2(HL_j3~-qu-i$+AjQKb0cA_QL=oC*MGrklZy>XcUb>5 z<1*OJC`z^e*m1TO|GWWSA(=wniG2OvUX_u(`G36nKi=}+uVS`7z0p8jzy9m|1SuH} z?!Z7@e|BA_(y5`OJ~s$7xmKCs6_~f4)}DYkp0;+~K(5fmlY4&$2x#%1t_Yl_9_~QE z7yyC0_ui*75IcmdsS>NJ;*-)48rQ;}cr6Rdcaa+w;=5t!xpN>AR+r(Yx%Bvj8j-j+ z;m{D~ptuqu!2Jk@(^SfIF;UR=pIkjTwQt?`;6XEJ<}prAuDcOWJ@|<0-~i8d;v_Ne zA<12p&QwZ}il(F?l2`1L2mq6~zZzBgUK~T5W57`Xw^aW;;37A<{8MV0qAQpE@1@LM zkDzNjmJlyTu{DXgC@|;S8(h!P%)PGWnd!@cAhR@kdbHMJ z!*c6#V1{^7A^K`lguIcW8p+FZ{%cdmX!-LxLJ{d8QSu0b|kA?>#2{&OOj z6TOKh3XV)L>*rj=j+Eg9LN;vT8v&yP>CIb8HsSP^jB7*u*I~1GLS|ID@+lyBO-2fe ztxohLN=h+T#G#Rf*MFfW!1tKV&(U#4s3ShE0Vo3BgR3s)=y_Go@zPRF-Ork%`7Tzz zOmrkN@pYak>aNrxV5E$O^<~h z6{n|b-G&UaJ-lfnpD(O$W^K6r{oAn>5rPtNjBoJTBivnE$exrDHM7FHGSR~Kv-a+Nb@W<7)l>@eE4fEwIm(Poim)E0D#PKeeo|DPjThPPHd9akb zabu=s!LYhRNA^`P`0JoDm>SnYGyqU&I*n?;W9IB?eRf+YTD$0!`DN`#3geAjR zuc2W9aUa{|S~P3pr~8{l+5P0a#_JPvoq~o{ZKh_dfm~GNG(3C{KVLrZ^ny^s;`Uk; zWzej}_-cAO#0H5b4)vBj-RQOS#e!H4I@^KQM^ICNUU=myZci_VE~rZPJ8qs_POWej z_j6c=Hm*h}>@8-Ic+?gjaoQaloG{j^_*agXH>mF;oqnkh?*z#O+VdCal7*ss`KTSY zt)ZYK{Fp`R@sGt>-{T`eyP-==8Dgy()!$r~=UdQ=F|Kx&S8L<*OcrM3Xia+3+xsAl zGHXA-xZis<$iz3=L?wcr->`Cb@zC3YPaMP+Y>R(zrKIpHg;A~si~e@)|;VTPnQUI)VyCAbZIM!&)gwWU^jNG113MeK)_KmKj3)D2MJ1lGF~;%&ij)dvT#Y+k z9oy@9DmeorbDWr5?_Tb$xgO%&i)|@7HKBUN*U%f&tw*0s>$`d`F)O46j8Zt|LI}JmL?~TiAmi!bI8l+gh~z8lTy^=6sT};KW7aZ z9PCWMe#7-=mOvyWL#Yo6fuZKQwC$-+pFgwM*L$Fn&@rJqG{Rt_k|NrvlPwjL%@rlc zLCM@bAq4woVm*`NmfoSyA4>PdC0ZIQ46`{_43CKD5*vO<#GGUF#T!w1w?su@0MKIU zVqXQGhf!bcTeENz10|*6Ls_ui*opfxpJyA|VmV?ax2N#<9=*VDy_ChV8*L+)T1T5M z>+;Bd|T4U zAzBTlidKoso-l}RVgrS6YOY>VXI|W2d~lEs%*Mefz?^tWIhpsqK3g1A{QQQxMupGF z1W}IpXPNwi&IFV^@hs=#rz~|rxIV#~y63Tq;ixY<3BBV50c*k_vh_KSh+@+PHLe!N zrLuA1f*^-K+1y0=PgmXO%aEw3>rTUHZtQYTFk6&sO?J^$6dYDqmp~hL@A$S+rN7US zzuoWI4H3IZSw@s$Wy?tS;GjokV_P)FyXE7b;W)n#>yXbPjFOD|2Ua{NGJ|+ryaQpX z^9^O*B<7`leg_p|Pun<1g1~4H*uBLP*@=c0l z{+F=}@eA)-Avs+^#5s9pn_D)ujO8B8Ep$75zfMXpC>t7*H_&@7JKH>YUMP~gwW>8Av?Af~6_Lz;N zcXuMrkkXaD&*vT723?uaa;3D}hAH81JX?O>axAJt-%)Xg&#EZzMT(YycRqL6$I7?(23xq@;CEO4=^piF<=)L%$)7|G3jH7sRk z$wliigQ&8X7aRry;fru0ras=iJK0cdX2`;l7vHU+v;S7E?gdG&)6s4WXna5JUg#!B z7MY6|DbZJwxKbB*{NY|j4H`96lU9jG6rQU~DtlaNFFlYGGtm;^tl~pLVo31z$E(4- zjfw9mTOtsd$kx{NeM~Y?Qdf#zDma;=G0w2<-*+0XGHmrIwG+>uG@TqYQ9}K*7oP2N z2BPJj^C({x6}UisH8M87g}^PKNj~rVnaS)QrKN__CMC+DFz;?&+3p(FR><&;{fM@4 z(6;xd1n!v@rDA=D>jz6kKPY(|}H;VfD8nP5!pAx#2#L%RqjuAKMXXbyF zqT%>EW@%j{^-|^s+>;aMz7brP`E{lC@#;DgKc@?04h~5MB%(JQYcPhVMQ@(#)eR=3 zJmuB!Pl?otj$!;~gNFFUb}f?Z?JdZn;i7NdTw)nUoLpuaK3_M#6(s8rf5W*pm|`w| zM__vNmg&4|dx(ZIsmYi~)6ZzK+@OnWXEt`@B@Hph$xCW#>H|6Apl;P-Q(3+qhan@g zkp)M~c8!ZloFXEK?AtSqRAXzJ(k9|6pUyK3zel#jZ`|+~bKftGr{V3ISV$AjwxDI_ zQFA!=Gb)UxV&meIrN}*+e~-?_o%X8q^=(-juP0E(>3chZf~6dNaI4C*kzhPB%~AQ2 z2;1f9z5@%kas@@d+deJ+ijk6OiVAMv0@flU!@CR_EFV5a?H{|pQK2~zyX5Z}$olUt zJ8?TPIHJVG{nUDL7G}i#=K!AS-2HDrj_H>z&&o1f3SosYa>qxfTUXQhWO_A=Ty5sN zclH)W?l4Q8V6lTaQ#L~OhjUB2ed?I3+ad!PbLqvxf=POl7a~Zxq{)ZyvuCSLo;^*- zk2CR`v%MtP8O2&x<=JxbyU6MEo7-vi?Qr_$ej`#xKChiat2~a}-J@!}floL$^w~{`9PlReTxjGPVlGX$*>%mj;$d1@dsy zkWr>XZH>;femE|3u>3PVhIJKK3L-Z%4S$O^s{qw!8035Ea&RIw+8#?@V(T+rq0ime z_i;ko8}n-9Tijcv*scudU1zZhSMt3RrtE9pdgARyOkuUYd1$rO_Q&hQ7>a+P9qP1N zXm!G>pd{|7#IAk4mBmDn2@jX{EaSf9;a8;#LDk-iCrA*UKMpf$*^_I}ug($7_E3E4 zH}uJvOilCL52G<0+~uuBLvL>0^ujZ zg5dm5Fsvo3(1Gbk;d}A%xlZw}!Gvt$(bAR9?_YX*Ju<|7INjxfm7UHqqUePtE!#3O zo>=l5%8Y+iOrOs+kY4P?mO;Q@*z;$m50A(rBc7|Zk5}_W*-KNiVmTt;(K22grgmD< z^6l;GgL7xm{VzGxm1itk$WIEt6p;EXU1V|e+}Z@$6@s%Y^JcrdqdoNj8BcC%3%)0- z*5x1H^V~#{(QJCr7TH`_(|H^2cYHPLbgReEMIBx6dhe~=D9hxEx%ri>{;CQKRg%eJ zAeHw?-D)scXgv@=O_w-Gxx@<1%mJENvs`;Lyd6u9<@zaC$@U&(2eA0Po-VK0px)ay z-#qbw*-?u(70-^lFAb_JN z+ScD5+v_&HL^kx>a#dfq?ChU`d&*+00omFF9wUbbPWH00-emR;Jgci%#)zOuJ=TaD zdi%m!RX26~IQLICh%{=du-Gt~ti$77hCyqnOZPmWpsgFxxH&PHu=mklxq0h*dRkf9 zlrE*vwKR#&6^8u-r;^X%ARnu2)0NgKEGq19Bh7o~OXk4#LPo%IqAaYa!|PhNN{{FX z^A|3a?hC#RE_joih6crx3!v%LiT?ZA)Ba8W<`eb16N7`geFN>WRZ=g!;(2@4rckwK zkFn*qAezPu3Cut}!{$699=$mwjEjEamjwJPF{W0wf1(SFh8fy~T?w0wbI1t*-ZWVX_x_wq8|&W?$#3KXq=?sv{k55oNx7-%@T zxjjo!2M+O&liKet=K5>pygMyFOruy8BR6-?y|_`LFOZJEUaE9TsiOM&A)h3stw%|T zKdnZsmF1HxirLxM5XJsWG4G)@IM3x>!gO4v9!AYG# zMLg^!F3yHy{DbELOOKX(GJWr2y- z>7=x0Ey>^e!t|2SK8Ft_yWhX-DkI}_<76=pS}3z?FEh`~yu0^TCx72Z#D~doY)YC06k!n59iJargdNLSBBnnFAKzuemuKOH&PGMp1O};y>LK)~hy~g~F zAzkAMe)ID0FMW>on_w`DO)7o7AHetmCu}*@cqzBZdix({WrW>fS5lr9rELK;o<&{M znJ`B|D;J^i`27oDV0tgnWIm0UViNAEfgPoy}T*`C7(><|od7 z@6;h-5Sl!hn(CDc;Xk1~=kWLX^-Z5=x186BqH3iyN^>$zya#!Bigk6@(%#WoO^iLf4zdR7?EGB#~029LHzv9nk*r zUahq=I4Kv%E5=kn)go=BboxNMr)zt^IwA@UoeY_>5*H{SD6|Ri@0i zbNJZVK&pN#xVk{G(nLy6-Mm`ca^ZaDiTw}%NENyI(O{pnw77RSYipx?ihd|t=5jD+wz5DZbeq^rBco=cl(0#X89gjo__?15fBuCO8mv%oGU?e;tX$gZO{iFT_X_PkVFpc{kKr(okDgm2CyH z&`!_Pj@>pe@cS(>yU@)~#id~W637Gc_VyOvm0^Cvs=M}b;K$c|)o=dh5^egO#PIdp zE@Ysx+B^P^;CtZr&%Z) zU?#kY$>f2{s&Ngzadpfqu7{KSFm}RfA@XCX8D3N}>1@yGgncxFs0UN=a1WC2G@WVb zft(s99l8+ao26Wdtp`^-%jD2}d=?>vwP{Se6U|{PQl}l%ldUW`qN1x%98>_AX!>0J zpVa@9WHhsR?kGfu+vb&Yr)*u+7+ zNw>&X^R+JX`1-}D>1qEa`5D)-QIEukh}XUtar74Zsl5%!?Dx*jKZ_)gm`(HE<5@pB zZe5DMN>+eo<$H2*eNv`nBPTb&up)CpNvXx@Mb(1`0aiW!Pz+L7Cb~XLGPyuBG=gVi z1L29%!mXR@e2$LkrDjY}s9<&{6y-RP%#%_p^`;LeFRx0HliIO!9nHKti_a+8MX(Lb zSKj+T0*yERzk1;Fl)@QID04rQ{CBhL^HTnIYgJ|ab2{z3*RKd@&efw2i(Nrig?wtN zWrN4)(KW4(p;}9optie&1_m>HE=Cq?auYRl!3%Bm1&_}_wZezS>MDfNd;C2HTWV*P z$S=pd)_#GIfnjDVnB2@`?%iSZPG9ffJ(K>aoD~bF$VG>V9 z?1jeTBbI#li=6&m%alrj06C-evZH15k6Z>ICTDfN2{opOk_QA}Zwe#WyvNZ5DI@$R zzjgYa?97>a50kiax#A$FzS%z{>ZqENn~iD-KOW4%dBsB15;4P-g)+I9Cd@Sxx3%rz zfr2?8D)H-ank_I>BA~*>(*w8>E$PT~7enX0Ews0C$BJi2vB1Il&I}`9Y)b83)(4uY_v`lpH z5n>NGq=Nrh+G#2Oj?8sSy%f^a#G~!0Z(4p1u$5 zeVF~IR{n(c*nsKgteGbHgZLn=Y=7mr@~G7{-UCsahCnqkGULebM8ROkW@zphDvNZi zukc}jw9(Z4`*r!X9c9*xx0^VagO<^lFj)h%}`{*+l$|lXQ>aKH5wXD6^24mvAHjd#s zgA#He&(Wv#|I$baQ=-+OcUiYJ5nTKAHr zE)fe$`uxrk=H1i+M__XkN^Oa84!#NQ}mWfd1>W7A+jE&^XB(UitTY=itK{QX`g^iZ1AiaGV& zn$gMc-U}vUIq>Nba=5W_8u^M)#PNd&tLlR+QuM0fyjG}h_%nioGJ@8~l#`o@$U@ba z30Uzz;QRF`wElU8|B>VLH0}*uQ(sI;vfpxoAjb~&XzzcOb|%nVu5Z78%rl9MNp=Hi zFcp%FrClkM3{mFDkQ7px%8()&5F#NYV$<+z^?X0`HP11uIM+h!p+VdGW%rNyOlezAh3}K=#>V^KCB=#4 zOOcPH;SuQA#q1w==DJuz=-wm^^~#VmZ+t;8Z`ds+o2S@}nA zi{x}4@xHUOG~&z`dY>PBMNnv52E~`vrOFyVlyMIXr8fL%V$D7~aOOoKYWSgdzvSOn zh}w0c^XU3;P`>FdzrfZY2S)Dd{SmhsSXlbpRy@?blqxRmsi>-x+<(+GRD|y7scl_$H>~fUeD|jy$?GTBF{}UuEk* zD`eN0;S&9NTMev+BKdpWWvVKCs&(KfcEP>MZKbrYaGa3*@UIpw7MZDyhMeCz4Sy;) z@afEjseZow^4f~)s+{+>vNYb_qvY=Pr9N-?N3yKE-HoC%@=lU*LqD8KMPAhHX6-34 z%+1;uek|!`!|%y2lKW^>x|uk`g^$VZuDU$_II{cJaFt)z(i^c)Q)_USg0cnISnU)& z%gUf&Z6)cra3L`5@E69TP~g1{)9Z5_?sWYf;zw7LXUopO7IOz8Df_YF#_RRUo)Td^ zE1Rx!baXts-mIuJ-V?woV_Igf_A{E9c`KV!HL=^-BO_b3 zqwDhcF}r>Kc{h)7{{-v3jQr4F91H^6GuM4m@%Cot<2y9}P$F%M%?nwKZN1pwFRE0F z>3&xXVwHM2eUKjRv^5RwEJ(hPat@vIi!|&C&a&YfYJ9E)$nb6$AH0A<=>A*5Ij)tB zIT!M~MqY_@w^!q#Y<8|y(wG+dT;Nk-t!y`PT;(47+i%T&eV_L}^KD7o&EDRA$m7th z`Dv@4l{DvPSs7}+HKV&S@A2d4sorNfaXn?9#+vpnVHQor^G2x8OaSbSJWA*wcF3^{ zudj%Fq~B-7-CG|$^>ds2ts@DSU59_X9G%~;*$Y|*T`%)Tc~_VaU_ z;*h!Da{7XK)9UsPB{guZ*_Z7cY z4cJ%Lxo%;VW%8|5aXdfdxN>jWXDf|2I-I8$`f1OPkB+6j-RoxZSmUVEJG+pVU8!af z3j#Cag73y=&YoP!JSbcqAajnL4jpUL_{HS?Xs3GC6`!^kj2ZtuU{RepP9LHSRrvY6AqI|HZQNMIy(QwBS;5}DE&1%HYYa6+es+Ix zmfd37>s-;E`RQHuo4`OXC;Q;L`P+QhCcoVrlx4N5lwM+Bn`TueC(}GrW9+iUK05wo z_!X`bzRnziG8$XfGIy13Sm@3TD2d#BNyh5)nD^{e;h!_S0c^jn%*1Z*YSft-$8%eG zwr6O%Miab$2=Q0)@T^mJ|FHF0e~NCy!0VZzNj#^Ris|bmRSR05BT|@DXDA4ndLevf zh)+uMOs@Wvg0qK^RXqVUnwB>$1oID6M@gSV&xuDwbJfoN$UPk5>kFLEst<;#dVFjV z{z>BzJ7IF3I`!?_#~o?xZbN72)Gwd@^8LB$*R8S4o6I;vR&CZ1H<4exDP)PC{>`Jp}oAymxe6L(NYf-Aj(K~FMh9~fgd}HOrN31kwe-F4V&q^+Eo^gv` z+z|qWYwD&yy*J0JsH%lu0|PuU7@4|%EdP<`#)IaodoK6?*qmR|NAK{0Z%}F7pCe8{ zwq0}C()t5;$M=R9ya;H@I+k_-f5F_p!w*ApwG}S|Ia(S2gg@&;|0(n?TXGTe{HO#E z;F0t?F40IIZLRsGXhm*J8~;4_omb(nKht{jV=r0ypvBMC7ii5*nWh$Rz&DK96qF5@ zk0PyQnvw?e-iy&60!c&+%2s2RG7NPXK*Hz1_3Yj;*3R-cVJYL1$SXY+&KVIkRhJz2 zxLYLj8=tJd9mdT~v(=$KKd`H$;pJ<#7=Ep=uOE)Gld-k!kMqBzbPToL9FJGfIkk4Z z;g+oPeLs(_x_A6nP3q|Hfq?@twH$YtXSzz5a5jFDuFo%KUWAcqXLC=y@N4dBLAq-z zUYKrwWDqg1^W-gMW#{9kdOvsXJY{}WChN>W^9j4Gapx|@4cCj^iuhQWn6jdi+?_T! z{xmJ3c_8ZZ`GeBWkDnG+@Qb%Kzr60?TXg=g63j^lO{Ju=ypoRZ+@QRHB}(PkB4fhe z+*#kpx_7QxnsUl|xmF^`!6RBxPpRU>fg+kU5!Zy-msbz9-FDb9^NA~~ZhaXe@1;zW zBE3g#>B(E!=Nh~3IV?#J)72N&^VO99Gk!F;4wG-+TP?nI#|dj8E^8g|&k@-naP(=o zu;TeeQ>9aF*ZNvFoWEfEN*YhHAFP`BSkh$_lyFI;ih4HM$BtI+r=F6APh?`idlQ$i zLa4=0(?O3`3C4N>t&m=~tr*xo`NQRHfg7b(&+rf33Iy- z;bPm`=1XtiR$b*iBa8XrGf<<7nv)>v$OzRa=GmUD*{CD}W54?PW1wVKWFNPQlD;G+ zedEs3JF}uot1LE!OTC`!n|4VH4XnRfT6R7j0P+v{>}40mdSqm}-rTnE`0||Hq(F9J z_?fiLwa0x}d~4T8Uv3tzLjUeXRQZ8>JLNtGc0P6S+a8FCx&62v?-b;P&d%hXOxpTy z`oCSa{g0;cc{%Kanx@(>*o}NEjE@}6$^L^Ku!eZKNvtOWp z6rHm46>ioO)K7CZD<78>h|%-5?DJ`r_{nal{q|kw%9a-29z6KfS-;rrw!ys;w@=RM zXFf|i`TxCodvsX*iI={ULo*62HZO!mmO{f`8;#7R)?e^c_DPa)jQVU?m~%2|@1HH~ zdB^&oj>k~DX~o#D0ngWGXU6B-c2anNsMPaWfdX^uL$My=%(r8iG*6#aetl`m>@&VA zx5<|CNcwmtr=XM7Odk`#xQiDD50wXeoj-rd?!mql<~=GKPIZ@h-mNzC8T(Z1_QgQ4 zr~J$9>#wVzdK}{pc?J^>4wfU?uT)?0ZgM>FteRm@O{UZe$8lU$OU>&otDCG>)Pp{{AD#2SB%#SvE${cU+!ZN<~@uS;LRyTZVPBK+ANPD1+ zt|m|MH@h@WF46JKeN?0j1XWz03b({5>m3U0|JY zWx9BD>TA2;PUXcCx12n>qxrOqT#<8JLbc*-mnZf9XwNO- z>pM+d|IDR5`1C8_bX=(O$3m~WN5?95{p|9L_jKHJdh(Iy$o4;PML(83I&+~K>d3|O zaxc1yqI-Jg%Up)|-rTQJy*>5vuBXq$hy3|Z>iYHI$ZyJBqTt(=x18 zH8BY^DG(4+kgr%}VPP8Yeqjl%bQSj+*{`o&zF6COa?(Dlpi{SJve>OlwXA&7wCHa` z@juTRLL}%i%oH!RKeE?wD`j-_x#6LKrasAO`faDLURBc$aZze-KQk22A5(fQeaHNy zVbMrM>rl$hrB(J3(-=rUO=NL0n;k}_NTrab)9DR9&KBb`}dcbSq z;pcO|)*A|L_@=frD4rFqxmsmap~p>=sDGcgTD02OC&Zz-i@t!p&{iCl1 zy1k6%Hd@L$6f5Oi-f!T=(p!H{_Hv4E_R151eX}aDOQM-)-Mq?{_OsKz`MwmjWK128 z4)PIJTSbLZAKqM#!Iqfj3pkzP^X3?%Im_zhY8+*EX;y2C9=_t^%~a$k=yGpRoa3OG zOL`!Uz-(N|YJRFcTG=+EoU3GE&yZt!g~6i3!h;3XuOp9~70y0Oi*F32S++;Po_yd= zO@__Ban$A2nL%vxr$#$z)pk%b6JwS%^VIzU_1L}C&u^mB)ng-+)?nD{?+a%HVt;L% zzUL~yJR?Q9GTdNO+r8jVQIVIkZycZ`>8YXTsEXqXbM?-*ZYbw4!E}z@KaBidb5^9IL$?UIjHY+57V=K zZ2Zoym@THM+&g;Yz3J?ycN8rR?>kX0x*LhAOw=oyLdtySG;7wIY^h0}^tDtKwf=i& z!^#+%(YB>>s#5$|VL`cP-GtRT7T>&bM}EqYHiuQshgxWfoBKO{%8}YR;eCZ_rIqHa zq{__BjVg#sQruMg;M@6D`;lV{({E{~clZ3XnLMdY|3*VJ+wb^k{cm$0xYW$Nj2@N$ zxc_@UozLN|?W^O1XUAEsydIS=+!=hkz^h4>wuNm=$sSPjdN1i!{$pa1@{!vrpyuwk zRY-UxNITD)7LO(9l<@lQqV7;n+6U%%=biNb^8I?jLU8sXGnK)pyKAZBig#{ed)VNF z#x(7M$1BUz72i0`IX_1InG5!9Y;3H({z6`Mo_VUdBE$S|8O3gvz+A?L&6T}efy>P$ z9-OnOGSB2PqYIQ3-K#3de#$(GopC@Xe4Vhs@t9FATFrN^-izjiOo6{=f3YtGUP^c= zJ}x^SOx5U^pO$`T6?@fVf2HmkzpajyH)38nZx`@xUdl>#-q7vdFPi9Ugg3e{h3iyW??3vN_RPX)`?bC4t9gV`4g8DT$CzeXV0+uj8vWe z>sahp^Qahgl|J)PSw&9znm4WsW{1qCG|VL)z0S)ObSr!m_M%dnh23eg!iTZO-p^x_ z{lj}v_H7*1M=x3Umj4iqXZoKO) zR25L3T#$I8x6VsgaPcLhW{tLKl3D-A97k7rNwFFbP8WgL)Oc=Sna;ZX-WwORF6yewVCE}lWw^k;i# zBXp}cTC-=PgZX`Hs6>wM-!i4L#W<L_j(Rk?1-YXIrX=yW*55ooZ{PZ9 zvE@eOL0xX^nThJtG2MbHyEeDP*-Gdd2`JmCM(lZ160WYU6 zT(W&2m>E%iYOu30{6?khL)(~3qp8|=uJrR%@42QPGZ?Ufzs&cMJo8=pURK|2g5fXq zRioc>?(-|x^|sEa+_ki^WindQZ|bn;+Du*^+PeYKUkp=(r3O29wwYVn-OM_eGAq%x zt9!8F!mNw=Pou-hFM3+@@90Ip-!sc1I=H50NZaC#);_uVbF)fO_BA@k4hvrAVdHuC zyJ7v;cvjoN`b)HGG^3ksNVpo~BCWayvKJI>*6K?hU{=1y-tRT6o;@vm-pI56(xd6W zV>mC+lxi1`CiJGi_&S(6OchCgvl7PnS%><^q=@9Cs;XKa z{gVXHk8#`S{GZQl{8#M%pP%X&Gh0@@{|;lQ=)l1@Os9g9lX+FnWexJ$zK-m-%Wtjz z_dRZM7Tp^S=D(zMeR|~g$aO36b$k1sJxe*fa{KZ(cGDxZyX^m&Qbq87xa?jObE(Ho z7sq-Pe9-3R|Luc%YU)4KrLoVC5&Cm&NjtQ^#}ei|IRyo&|H>W5n03Hk1dS|^OEeS@ z1wW^~3zJ3Q6X+lim~+-U3pBRX!FEzvTt5_ksSN?L;Om*K?=&2=(l!Zl~T&OLUx zb4FKaBviudPY*tW+Nto$)4`9m4o?#cBAC3opw$TI!mgYc=`s6i2-`iv!Njv& zc<$aN+kcv%>Ai3QUA31?N=&EZFn` zSOQYR3x$h%uq|gGGy}Ne5at!UhrBw152n?^vXz+67t{TD;0K=6VJ1@Fhzlh{eU6|lG7^^78`h$XbE<3Q&d@EqAh)<~mdZhyLuzn|SO!(fymZ%1HOvK_-Mp;6FnSc|( zZh{)SP|#TfpIbYyeQ=`!;av9VotaM^ytA(NA9<+TcehM}d=R*XTfqe8TW5h3JYfQG zO^EH3+1dq|!V)uJ*uJ_l{YCcS$Ps3y>F1{KIE5pVKg_}I19G9o?Eq>gsF6lSMid37 zPXe?c9-nYXJ?-wU1=~9rcwJ7<&RW7h@8O~3YaZnq32ImxgicggTwD#(Aq-3#;6B$k zIC#>)0=C}G5B1h;I#$dJXKuJYZQB>Qi6!o!_*ZTLfuJqNiiueseDTQNz;7?1*{*kR z@G2~RuUUXq3R|fNAVz>SLy+ zyWy53j~|c4QW6pSh<^~iNg(`)2^$39R_!>YBic#umnu9vzzGv71|Sg% zi;67Z)!6^}c~6fhJlj^h9eI~6di1H|hI7m^Zomv3LYMwF}Tg*MhCgURcb4I#(L4@!(}7H2cTaVDBcZ+=n0a+ z-28r2Jxn~8ty;wi6Me<)+r=(U4Z~0V?qKktG=ja*#bc|FLkTd}Aq^IP#2Z;ap4eCi z237-4CZF;tt>5b02yJ2pRS0KtJ>Vu51Y$= z#N*6;I0$BvtEHuNO>IK|H64TnPcKZbqa5yA%@fbE{rlz8bKtiJr!2eHhupZAL0}J6 z!O@l?)=3151JkW27+z}kc9whXh=n(}RXzLGlP$a0gF{0D@qs*)ZC|bQ@bG9fNL%yQ zUpH>tFgKWi`ECHv4uWkB)z!3E?-6aE;K&C6QawzTb6f`xjd9>nSuPp)GMbiMSWy9M zW8hZ*N=em~z=P|=*7=EDGp&8T5HUyw;gg;E8>kK(ST}Fn@Wr`z6$LP*|GVu&a1;1zJyhCA~1 zOz=G2WNc)lmiqSUWe@m8mX?+hS16e*SaQOf6_gUD01X;AOTqLQz_a`CZzP_Ha7Moj zpV+Gd#3e4|@#}J3*a_CDeE(RYK!_J`YEOXE7v&4jv*1q)F!6>H_b#}UlO>OTUTrM@d*FZ7?{*pO)c{RAqGO$j= zKj!d4gA3Bu4gUcL=X)rM59@^M?*vRF0iF;;LN`C$}S0xeR@&4ucio(J|b2ykKj%GF65q?4* zqyOEz!Z2@JKNSXhNchfm3xB)rgR6jJ2R_5T1QUgeg+Sr~OdXE#0N9%L1GBov+Inq9 zMh0=G@A$kYz3qhJSZ-dPCOjTxU`IxwU&Ayz^@GhxsYVA^8mp7WiXD6+a=cQ#IF-Sj ztj0-6+`6sHR4&#>b==-5EG(@5NS}pZ5GN*f!EQT{Q$%vA8D?Xc9l8jsZn|u<3N09- z^Rfmw=DL4-BZd>k93I!?6eAQDkfG=(_^NZk?HFt5(?GmW;J)N)tozdovu+fe7E+tR zYr;t|fRbD{43qjfUNR665)GkA@ zQ|X*Je6u~2(GK5;H%qS=bG|ZKsM2IyuX5S%8}V+*oymyHH*K=PhNiu0^(hYD6|GC| z^hSGqH*i!}?7p+{J6=$6t#|~ zlzJmvsZMcH22^26SUTgIgFQN`G#*U%*?d3F!oF6~^36{_n)!DMn~6)d+faKzTwGis z*CG-II89caQ%!pXx>V*L{i@c7A_FS@k8`9C9QOM``)^9BJ}>tV=Rs|ZftvvQ{-0mitZ!$xhtF^)d`wc z-oP|)4V@MOYz-C}LFEzz0^U4#6gi+dte)ZAxC3m^HTF^5Ir;g!abTT>pBG`)ARD`V z!2TNVhRZOAw15dBK&AfLUaKmPYOX61h z1|%9mGvEV?xVyXOo(5hU_y!^JTR7o&driex!Tq#E& zUNh{P6QQW@?oSy*STHC$W5ejnu}V1#zJS-@j?L&BA)$8}XOiEMEYs+=Y_s@<$#-VM z@E**-A>Y)}a%;sF)2IWniZ{tGY&Oo_rTrG{-?p^FSCD~RU%=2^^oQDV#OO#QLhLnp zHZSVIt$BewvKrQu))sJ*B{t9GhyVO}q<@wCQWK0}CF1bSbA5d&zGcfQK_0Vmp8+c7 zC6c7IzkZF5nj@F60LH_TdXKwz{W;cyggj<#+d(&N2Ta}A19tiy;B-|{IWY3iLC6TI<@-~xqPNA3Y5Mpv z4*zLC-_POUCVc){ASo)T92|bK@EtaeRq>k5K@H-Q8#X^b{~ozzG$;+k+L4W!*<2~^ zAYUrLU0MSj$iJ+_V0Qnn?*dE}(L=mrc@(SA= z+N}|Clf(4?)rm%iYqZx@9=Qu=a$F-eMelh0c4<$5s1mUM!kkd3I~AlbkAGQ z4zF4@xV1~;7Il@J(@9A+RZT!EYlj|e%k{HNjrk&DVy>ai2u@GO{*ykm!KlRDiFo58 zpw+;l^fA^vF(?Jqm!1ljJi^K&ey|pHsWzt?Z-`Na>uQ0htHP%RcBKK?@O?x;kXvNJ zurX*TM4D^Z2~ zw4B(}rig+zKoMy0&z_1f>^F0m^CpH4gPd3DHOGhJuMRg-8s4~Ih%kd0K>5NZmK;gm z-rn%KbzKCyK`!sN(0R>FuBAFj1m)5j2B5s%ezz>JReX%fmI z*6}Odk*8uv7#kxt@*@c(khnfvd}0c!9bk#V!v&?ROXt2V_x5A`(p2CObTEGsJ` z>yUhXEQ|=Wsmw&Nk~FbpY>G?I4ZjylLDA-DeO@m|w^4v#M|ID7w-MzmjwHX6a7Vo_0v-y zkH&@oT9k-gOmJH$0Jta#AYvSyoK&}ax7u$bL{OAav=muxSa~ldK4%{*;gd2e-(_yT znpjZ7Lzn<)5^4UTft`8_rHkN20Ohx>c4FZnxN73yee>kx;fMN?&{q2JB4jCky!j_f z-=Pj_&h1(lEZc!p{+EgIPZXPQq4k3&{3pbv#2okOQ47Gt`|w2)^D!&DgP7DlG^V@z3iL2oE z9=HT7EQ$&y7|CA)bFEn@#TO>vK(_fk!V{1bSl@riEgnYMOw6Wn0+25O|Npgl%rV$D zz5 zx0Z;C)12TS9jN|=#N0_(UfRKTka|j)chY=KQJ~H)GgqhHe&?86NoVBSJ^Di1_eZnv z*fZ7~UEc%E!uMww%*81KE^|rW1JrvO-iuKL>vi60=SgZSD}y(kF0Yy>B}LQ3ILfDXj8dh2Ph-yE z`&x=bzS_#4yJ12cEPEi4W$-Y%&6;@ zqQ`AfaDwZ@{Q@?c_8kQp7+(|x=kjDfR6Jv(o5nCPH$r7+3{QPyT!fIRY$FpB;lZNC z$S#~-#)#v8{u+r8V)Bpo$e$`aR7l!|9X40d>H@_vM5Z3AepdyOU6RvWQz{eJjxu-c zCWH_?+F#-^_SewIl7esXD1h;4<)^;B6gI#M`#fk`n4Po&E1{`%J26dfcy6V59ORq% zg12d=MY7<6ELwia&CRtWc@#1cYw`!7-x@pAipZrprdQHs7!w3x- z#A8BfVJF!h)Bqepe#n@hwY&e2e9LM9dK~0OjWm5rTr{InkH;A+Azo`?zugEAr>_?f zup-F_${XvAQY1|S0E)^gTPG&gcbn%H07@v+`f!@2xCu-&?Cd z3n46AAf^0d7!m#n=L!quR&po!QUp8-o-%)@46vJ!J*AC9@9n(UkGh@D?Hpq1@vd}s z3TbH_JmJT%BCzbNdMhuTILSy;C?A6>WR6qs8z8>NOFb?@T7H~KA`>KZOZ*go+^m#2 zVkptT32GC1GGGDABO@b;#rz|~>`(}{_mS!6${qxjySuyFJcJ}YD6e*B@xvH)0ND9rsev+0#%V(f+kO9W-ILC>1svrB* zP^U<;U<3;phxSd#Tf54=O!OUCPDjKMs4()r`-jrrq#YL5dl81Sj$~g*S@Cn|fAC?) zL_`o=JMx`NhtdEc^nchgeif?G!lU5`cb2C^@rCn=@@>59nU6hxuOM$}1MW}?-; z-$Pvcv99VoNa_L%VXZ?NHX_75y_63ZP_vCrPVR=Nvr5^+7lm>np@MI7;5*S2C1!7i zI#3vYg0YMGkl*&hl`3K*iO*n0nB$!Q0}R`=0J=ye(9yW4NPKIN1W>1kDzU#4KNuwF zq=M&x^-rWP6f*s8Qe6dT1`tjK+9%u;;kttTT?ru;v}x)6JiJ!gtrD#Oe*hWdD??gQ zWR;?(Bm5a~cWwZgs_Z#Enq=i!8^ldu5#Zht9tr6KQA7~KxFsDJtII~lkh|AGFsnTa zph|nzv0!BDWC`OeHLCC~6Hu{kT*fPPd?kc2K>MU;Vo{fE0fb|0>W2x?c_hKb#q)!N z2Qn3F#6AWHvnbRmo13}8(WwDjjpQ%T$Qh9Wp8eXSj?1`Jhy!HeG0?hwaz!$s&}A6O zKx)`hqZsHV*;PW2(S%igPX;$%i*PAXUf~8NA#EY(X_R_Z0^}WWtk8*zi-(BpXn&}R zlb8eQ3-mQBs2f^eq&=TDG&BT%XeNM5eUSaU57X_XE}NVeq6XSOLXz8k)8^v?!$7$Tp{R6qI(7+XdUWDf-E+U#p~Ti*-0uJge&XU+BLR7S@57{ zmH2RP83@Ids8(?ju>;45^lESE2=vWmB*_9Yg&e22rB#iQ&r^X2s|QDuV3iOhAp~el zF*@K|M}a*?VA+UZz1UfVXl;BlU0;$^vcOkWV_`O@91tG!j*p6(e)j9FYA0S?qC1#W zFA#9^;(wT}xOwyDRs7dwwqJnvGe-qxN&XipnpVsj#1zXziJ~|H98l#QmW)V@FDco9 z)BLVS*L`(5Lhb_FZFdEB_VWyb;-VrMBq_Mt4j+s2n~Di=)EIE#IxA?O>%&DThYwFS z0C-9N7W5|}1T;r%L6F*}Zs*;?Sua#ZLwbI8yPptw0D^B*clUAao{o-a0xnC_mrT)@ z>_Ee?7Rg}kFTcx|jc}E$ozmLuJCKZBA4hr2KlJ`_l3ocLph2FF*jW%HjhoC;-#$jd ze%HyZ`3>uLT=6K}gR^JPS^>qy|EU$)5a1>`I7M@D&gY`2%OME?ni6?L=s=nB6cii; zWEOe!@rcqig(*IRNBSG&AqyA)p$c@wI(wlF$4eE_PmDAEa@Nhw2C%prC)YvT4Rc)Q z3DR{2ju0X{o!lyfAFspBYyjzRbA2?PAxuABR;)LRqa8!fE1J+ha@0gK>nR#swCn|D|viN?1uL$9*;kt(+0f^kLs2KDG%xP=LUDmiYxGj-! z%I9x^E*9+N=<$)xTue-C7>9OKbMsAniKNn(Zu^pNxxrC;a`3Hq%}~G9DMD#OXKcNp zJPMGPC{e6`D;(xClRJZ=$Od=77U9Km2fA##N+W^6a_Goiw*yF_IRecbI@sudG9z~` z4hSRR?Pu1qv9nuK?_;;0g^6IYY*Ph}El2ouX*p-0ZDZq&EJ|T}IaY!Z^qDAwbQ_`T zfhY5iqOrRzy6tmFEQ*g3*TLm?ad|i5#t3h$x9O+(ToI zIB1C*t{?=RC zZbxnCkI?M?e)1f9wgYLa%@4)%%mXZL5PC~ImY&^Q!&KtEpd_s9k>epH^CXA8 zY}vkk_+g-A*54Mv-`|z9 z4V`vek~FO5U>JuOW`X89pu!uG?t$id6>;I&2@7PU1wd0-~ zPI4rGF7>o(rV+rdK`)ZRd#?}NzGKIWjMXUq_#migy1H%!v629_pa;lczbwbHM?B^E zg{O%*Aa+@``|nE7Z9HMUZeMsME^l3%N2UQA;tx(`_10(+q(guDiKxKnfnNpst_n*B z4{~oXNuwy85FbPUx|aiGV#5LizxCgV*rUt9v_x(dE6G{t~@iboqETThms8_eeDSytzt1 z#<02iyLap8=tQqNi@=2n_SvjG+BE&wlHM2qQ>ZnF79=`QelqJFYCx)z3B?}4ULr_J zoma!qo@{J*488*5iUfP@3r(X4P%lxQ)nLCQ=t}gCj5xP^NJS3~MQD}4i`MP~$%n2Y zAHKGcLDa!Pb72zcg<6I8!W)b<;BD5Zs2n#~#A*B7;0DKFci9g7+U|`-f$1-+y<357 z^v=~D+`E52PeV$YLv?H$Khkj1a?g%$N6(x+>xZ!2@CceP823#_BWPBKx@n3m5SFUj zH1Kt+!A6Ucv*on3vU&^!gtYuog_?&{VZZ`$D_36L^y3rM>ku7Ojw;lQoClYfG1I`o z)mcw60toIE*EIxxx;%aS_-5HU-c77`gV8ufihTtG23NfYd+1NNR`A>tMs_9WeP?ag zZH~Fm7$=E1mJUVx$&Q3J`?`Wd)prlq$TRptKU%YTwOXmc$F454OvM7hqF*B`dq}=J zeBYNn6>%+gTSv#ns&L4v3>}|GbDqo^5M31VBk9`^lB{QzU{=)Z+??<+w#y&c6XF2C zv;GjLVz7u4F9DsSez})OsHZ}3-?fkcArU_yRCPGL4KpY5#XT&q8P5Kk37o`XR)Z*5 z=WLD8as|>;u=8uAly!5Kvo1eBf2KzSZkG3}#111^w6P!8@7}!&`I_TJ6p(i1GOw6x zhK9iBOw1o9;|9njFeXyu;jAzmhJdgd;Z)1Hl5>@^M7iKuEK;qcoB3my^|)T|s|MJZ zw#qCoHV<|gqrSJ_9Dr>!NCmXCpwSK zK*W|~LclQR8U_rqu&`VL`wbF-%lPNL;hT(?BeA(r*3EY+M>2vHM-!48e zf7kr>Cg|Qr9vAOf=#J8m=!1Vcx!`D&6Fi_m9m!bi@eq!?BZh&{Jl@!SA9F1MD2*&| zC~I*&0mrr)8ZZ!YiPAHu5y5R*XBmsq0OBkw1SKXbcHGB^kGw#h_~C;EbFD%@0?A^_ z1NG>MC*R-D+<{n!rn&zPiFzi6zQtbyM#>kT3S|GCypIrupFDdepn7uoJ!Q|Jdwz^n z>gjb+u3Y)^$@`NI54&3@ZoBOhyA}6)P1IBly-Ov$8w&)rWCE))3`|O#OG0T||SNzb{^4WSE>LlSt zKlU6>C`nJXx%F%qZgxF6RMABYj6{T(M7uqpT8<0Ez;>0Wy@=;fv( zkMu7AyN6pbX*>Y!oE!NQ?glyy0?HoJ)Txv57$PGI{pr({(BiF4nwxAOeveK~Y2jW& zZbr#MdKW0NIY=D?GL%38?j`BK5T+iAQlq0sQFiX){p_YBg2U!A0iqAkGcZ(PZVM-O zn5b%`(~5`sX}1bD-$(Xg2b?^_G27NutXBaQPel}IP;sR(QPXTWigsPX+d-f(|CD!V zNT8gWdoT*3D>^JLn!J1rg!v4LvN^oUXUG}g$$DQ; zSO|u3lImDUoroR?v}|&N(POA{iU$=r0Ese@ny}&%aK-u)FKws&j`pHWd#=dJm1I`( z*Q{+f%5`asb9K;$ixK!8+Mdv$@tys#xQJX1ne+0UJNzK4Z+yN9MSYaC#pQ`ud3+~^ z+>0YPWZ^{4NmM0Uj`$z(RoFe|&dyw@@=%zmJ!Rf#nhJ@#DLmq=W>GGpPVP`5K*nT# z5#u~^M}A_NBO?{+&np8vwx3VLLO2s~80W1E(voZgiVH&XtWKIlhGF)qT-(>AbVX`` zxkTST;8-u$Y`&_reT7ZYs6Pt=NH@VAK^hy;3TKF$*>t37S}@ z9G*&jN|Mr~38#Oz&Y2}^jrUWPxK7G|P9X7I!NVP-HFA0S;LK~5zS^EWOsgq1MPG+r z#@o;76j@jAlX5Jfd(TvUGL6sImfAvlx}EKP0|qg4DPJyMxV2M{=sf6pGgRUwse^;B zUnlX;a?u7Qo%%;m-oalT(aPS#KSDXSvh}`UdwX}1R*^ELa`-(1VrkxI@>eE=Pc31@6vM?MO_Vf$&zG2W5LUrE!;Sh(VdCXFW~%v@(mmRz0${gzSk3^fL>u67)1 z!d|m*c3vuwgRHz0naI>`){(DY19A9yH8UDRkDPY-@~#rgxsGdX`Fj7b8wBT$)P$BI z6TsMQG4s?z$k_eIH($b3R1%jgmg*=Dd7-qmD^)xThv_>dt@;@45!1P+tScD-M(WLzVWb16p>cV52%pk-*v1KJstNG<+Wtc1ut|nGV;VB zOz-74M$3sGI&=u9Paxt%u;`ET7cYK77LY5|fU^x1J!!3@EM6@uyBxVB5>OH;(QJ)Q zQ~%W0cZu|tNG2P$$)BqplLG$ePtT7vh@zmU2r^b^o4xgPLbe$4WGD>PmaCs^Azy|u#ZcJq<1VHl@72L||2(+=(I+)V5^qF^F4S@T>*)17o_Nwh>3 z5P)^mi#nOiTjOr-e&N#JwAQbz9s*=7y8gRA#t)*8r;eTwnMaLwtAsEWlRTRN#IWMI zpQeGuC%nA8$fb+^-hfcvhroobW_g#)N@AYi8x$ncX~fVKVqNfM%o%;!z3mV(CBa7z zUoflNes72Z{FkU=PrXMcte7awsnen4A|(h&=+Yfh1lzp9f26C32YK^+h6^7e3I-`j zQ@ikVA1x7F&3qP)q{xTHJvxf)J|KEwzYz?bD)syZZF$}r2W7Qb0WdhVp zv^}?gc1@lfKy`JOHxw#j5bDT21dGHi&3KQPbt|2^3b|2|)uUu{nHjf1H~m^48lNbQ zFh7k;xx($#?97Y>+Ww@~is6`R=rCIiwj^V~L;-IFHCjO7tsycJ*iCeZn#77MYm4oRF@)|Q^AVH1GFo4 zy?sh1#TI^|VUBHi!y; z1Vc7SL_t(|+GLjh%VcF4#?N`~>$>jyIp@sGIcL7S@4S9lOE<1MD*+3|W>QCv1XXbUI!!Vo~&Uxl~ zKKFH9XR18y`(bY}KX;t3`*FQkuKUG*dbK!zn6HOncQ#-4{c<)e#`(^2ykM%G+%6}x zVHkF2!(ukBhQ)b(znBe+em0+u!)!J-eLv0*%onTKFdyc7!?+mctLZrJhh;Yo{V-1Z z<#ZhSzMl;JVmPmv5A)S}T<**l>*+Wjm%GvJ_LGYi>vMPa){DLK=j-$P)p|XDKRE2{ zj61vY)!w+XH!Svs<=$krn2d{lvFgTEw_Hxf#kkxV#?@?COy{fVeAy2>T|aiS`J^Aa zan`n7JL$S<-%a}Ibmnc>wv)E)+O~_P$z9iVowrSHCKY{n{nU#))xn!Sb!gFC{ql>? zeDm1h!-uYU|I8~*)4cW9XLc`tbhVSme{uV#4}JdH12=r|?i)`&^1#OqtR8yg#GQBD ze9!S)qMcoG>EihpeskaPJ5K)S-st+a9v91lFFpGcdgR70U0>L=lUHB;*&m;O;`IB! z3N~+_dF9#PKKR^|4@xdfPdxUm*WY~XwPznaa{YA^^?j`V^xDIJc=e}$mwoh-E3drj z*T1{}wLd>{-~Gqh+#NlB=Kt-6@q50CXi7NrM3}Gm>UzW)-bRh#BAi_h|%;mK4)#Z}990LcHwm2hGJM zGpM$S9C9%ST?(hmqmg@mL@-=AD_ri1pi3SISGeaa&z?i!BqhnEa7mODZXTW^w@q#v zM9xj;xnU0Grfpk!_NG2m}qc+d4v%pAu2q<2&80iZGJSR zIwdnp|94busF>4RhMZE{(|gLTxwvh!xij~i&b({b1e?sJ^_(q>?r2-&jv<~b*l!!7Ph$YoEVP=$SOEou6F5nVjM1m!<6oH8dkB$4NaE8kzZ9*XlWs@+uyE|PG zK^L||+UOyFTr#s7W-x54B&B4w>6d**l_t9L?;rF(ya#!v8?Ij+{lQn?dGjMrKb`V{ zYVX32pM37X$rp=aQbrh2!77*$auqiMFru~u074B*L~W^%N@gPKRPSGtU;rQ%;}jMo z_rHX}2=K$j-QCPUNL~zRA_yboZce(FjHG0BVX@_Z^5M!rkz_!E)mx*KPDv@%b-n3b zOrW3#HsxD$G%143XTmwxgM#PLDgfK)b{YmV128me^^qUk@xt-jPd;JhrhA?+NZ~;m;_hOgT?pqqJ_7eJc*ZGCL$;`)Z|oG zWiN|Y4y7F7NGKvKrAUbok#Jm`M9@EY?8HOkdY2bYR^Y@GIROy>5E0maNX$@J)KHj> zQAJHyl}#)JFcuXu|FII2s)!0JvxS7sFBl1e2h|#ZpN@JbeAPDw-5fMN_>rn_;tY)!$P=fPcC|X4=lWO)49JxK@a@z^y2;Bp1OSP z?sw1Ma_rdh-;Z^FK0KS0p%<3??&#-E{hUVz=k7bW{M2vOUpTqo+3#a_(LE=gUh$`2 zSP;H;4w>2wD}Xu+f3}ynkJ^{M|Ih&}+E+Ze`}!xo4nYRvVI#7+bV4ah`)ykLlJWfaA-!jp)wB?^o_ zs^ob=2Ygv6YUX?xMY<%lDB*QcjAW5oyUK@Ya3Z$h|XtYm}LDJ{c5Foi@b#3;m;)}Fcg_*sFj++BWvKlv43VBX``4;oD zamLxXoOx1zt4(H(QA9{6MWpedcoVJ};OJktkXX0nZqo3olDbkCC1HWkc~r|5L47iy z;<}K?KSey{M^#-58~&v_f9_)H2B%CWCMC|awps}Q-k^~%Ng~?n&Z?Sjo`OY0zA;1u z)adJzOr#i-IxI+4MMX?Nl}t!QSlo%nfV!>nqDZHI%3xXR;>V4GQq6On2!xuhj}oE* zGu@%w?|G9`vqA}>mD8nKH&o^+MHq-WOAqb6|NNiVo_Q8~uDk!t+0m`*KKaM}5B>8M zQw5k0a_RhIht?e5!+q1PTfb-1#lOxw_#|K1(IR-f;&h{Im((JrB4p~&8$a)881P1< z>MdS>O>P^la0G&Bb(0dX=~?;tQ^afWDuV?wNeLMQ;^0GtLtp$Hl!dJb99kdR{Z;cB zdJ!m?6vo1!LgteyL18vkvlY8Giz$#OvzX;Yn?JZAlX~9muio?4 zi>u#w&gF2zV$Q?l$;<~1jY4b8U-KWP-luBW>m7WafJSSUdV+=|ffk0qX6;pHUy=}i zLeU2#)a_#1df$61BZ_Kk`ZQrs4XC}nqjPM^kQRlqUA<%1z}$KL*N?_QQ8|vJ%z>c=p*wZusj=Mevs8XG zjla0@76M>=ZUG>vY5w0_k{S?*l<(cpIJs@E%tGmuo(HATz5)gQ!dtIhedLF;4}B3w z2NpiKZQDC<&iv_*CT&~-9aw(iSMMA9&a%@dB!IuokPxTeWa^Xc^cEtDlrT$wWl~bE z8Uy!6DK+FE@vdi&>kOLbId^~!+O7;sN>9BfYA|19Pi!h7 zh#H6Bl|owjf;1&`vs(ns#@e-PXD*|`6b=89t45=I^7LYzV#eklGPaBjgM4=L>m^o z@j|0fIC-$r)N#DxG$P)JAR>Yml0cq6FAm=&P5`y2-tSrw*i_7lqDb#m<6kf~Em|!r zf=8-0sjZW4qr%gd&OUke@-sL1VnQV5Yx1Mz&z+!?%uExo61sU;@d=oJTHyuabz#9I zsKdV5|BsSH$r+ZvZ3@ zN}`oUe~^c`0kQD~NE4atM)dP#uy*gKMqggF^_^YY-rl+8?VVdMZr}CpqYwXk$Nvep z*5@k9Gyd*-d7k%uchByB+1+z;PRIol!Y#s7I@UqKOSM!7>_`PiF4_VWL5B{Pj+720 zA><@nl8^)f9RY2NP$|_0f#OsPf-r+tifyGAKXv><$ffjO=!bXD$+9QXd`dQFH@nY1 zx8EhL!@HVCcDLN#*>-#Hj{o+wjqKh&xVtdY`Tc*rQW)uOxz*W!Hrm-T+}%Ff*EHDG zdaJYf=I*xJJ*^{qns0YE4|W#*(>vwjg0`W~?Sp&igJZ)x(f01rapD_YJZs`7maoN$ zl!;%8QY$|D%8PVtsUw6e+_$LZR-yS;q4ieBw!zMpp{_^2c(vtbM`5^o$4GbU;I6ij zuIX2nwhwm~ZgsVP4|nYx?b>m(d*{%;ouhjTgWYW-dpm}^J4SojhPv8E`r3#4b`1Bn zkMy(;^%O>WcaHQHMtkUN7L`>Q^Pb4?u`zk)!e0LJ69t$kuEZxz6cQUiqL-O)ls-?G zqJ~BnTu@HU&@m2yQr9po79^rXA(4U*5-EUCQ9%hMxss-TvRLVeDL08!L=stiE{=Pn z<=cJY;mhNaNTtM&i6n}&p%|JkkEw|cvA9JUEx*bg%urE;k7Qj0fr3ki!f8jzzO}gkkDp`?4aWDyq%qYkb4I>xl?&E7{d@C=-BA(t~2b2=+HohFj zGci8eN*7Gja{S!bi{ZpL1t=R6Xc?u95Y8=&lcvopxS*6$4T6?6xpGt%Jr!e&G2|2& z6Mz8VYQ;D)$fd&8ky(f__Wx2K{;T+GN@VxA@G{YVQ_H7PiAYSGPUb)T(6aBXv~|@l z-fk+LF9h#D&|6=9&-Uh~OP?H_T7Pd#$Ep*j`+jw#n|{q#ISD{1edG9!swtVdk37bK zpFGoX=;(SyfH8jTRN=%xpVW*~-qgC8k2j|hn5cZ9CLXnfGfVn>JTJ<3!bHTAfOgKD z8H=BPf7l`UEQM{^nD)UpV%&YkP=Yn%$tzxL^|-F>T1oNZ#jIkQin+0(J_ zB_Sif2?b&NPY*vj+Yg-eYrh-X2s}~sFY9V&Rs^+DYNPVRw`xXNVj_$?zY{adkg}zLS|ZYm`Uxv1U!oRy z$4-=ltnpGBtD}S#K`FKPm@ry0`~W~Kba_7(W-8-{Z5Pt3Yv2`1txqP8tFt*|4C7kn3Tb6$K(E$gfq^VD? zzqMuCQp%XtdSIaM{H4Q;@v{Sarqow|KKAVgwzj|6zyDQ>vIX-VTDELY z>gx_4`N@){&n#d2XgttkxP=1$fJriQXdn>(uAUjjF{kpMgGr7 zaz$axZ5C&gQvtvQD>{ofV}c7#7^9pTEqzQ35}X4!Lb&1iI0#}{48W`i5z&8t$1-6u zj&lKoQj1wUGQV&xfC;cD6#xtb=ZsPo`V$DX7^BtI4JOCN9rh%fs|qtUekLD;HK{NY zX7X-W>3E?ZWc+m23o^c+O=t3cSmF8EFwCce39gs%{J{47FsyQejGNB7LFoD!Cmp1` zj2BEuc|j_jPWu(EAK0#+^1~p1TTv0#x(SibOiKgfESFv#Xy z-*>`XE?bqGFfq(k|8&)g$yJl{x!QcLwz9G=ldH<+YW>QpFjwQ}CgigB_}OeK6MEUK zo6V1d=pU(ef80EiyuHKdbj_KFl>E!h2{j6_v<&?YEv~YEm~Yfw6^v2f1Ezn z--&i=THTC4eR1-$8^_Oo|8eixkN3@(S*MkUwyyQ;zkE4RSv~perPtp*zGvW_4vVO# z<~?!ZypTG0|#eVI0Xgi>7P!g4` zv@5k#+D0isOHfiN+t|NBNkEB+9KkYh1bEE#Q{ssjV~ptP1{5HFU=m765jg^7-#`hC zbDvssRuM2%)4vL^0~)&l=f&<>Zpk6vd}C|+*?C0Yx8iSCfAH_i4J}LT z$&04#JlNQGaC(2MWmk!+DYNz;TJXW~#@Dx$V!`4l~O1Xq~shp3Z=C`rECon1w>|lR?$*kbgRZxYR+QbREa{T7?<@=tq0{eQznAQ)PHAN`1qRHds{7K z*UVZrb4_96KmR^!TT8=p3u+!*)i?ar5C3rX#mfUsR^GpI7nicgPDK`W!6U~xEgoSp zvnYlC(Q)>Fv09dO9KWvL>vccRd4m%NQ0a);p^cYNA=8LpwoFekU8qFJ%Sa$P2?N70 zZN7|YtCeYmTCL^myNhn?vLMfUH5h0&m({E$HO@1 zxv$sX@B96HZw?^;yk_n@%FH1anjB1oNG#uG|N!M2jafmtwmC6K%B$f3?% zcYOK$Yi?kL2A;8d=d!~G{iPGG>yXJaX7n1Ej6{s^KE%e_!2e95Mz4}0kDMvMs1^$u ziW?izG>0Utp?*})Y`=(uiYf}D4O~i|ctjF^_Dqf~i=al3iAH>ig>BFi0i2Lu;!;wm z^-AZQvJj()#Z8z*IjE|Dh=J272VnL)0AhsNg+;`aWMcMNVG@qChX}J71vM}rB0jml zInlz*2w-hD02*{`LMJn8(3qIAScF9U6PZXwLdZu(`q#wuVx-%xE;g1e`bxPiz&<^H zgwsyf)3tlfo}PKv16p;zcK-Cdb)SFe{68bPo`_qUWHNLy(X=`2P}j?x0e{SRU*x(0 zBAZA=1wUYs5(6XwFeg1QC2Y_J7Qk?J61FD?CO|N~IcY#-2^RaA9)LAY4kgA9(7pzH z^hnJW9M^0F)B#fR%thb_Auq|& z9;y{wklHzqQKb}f@isWd-DA2$(>-s+kKFxH_lssyBCDUfAHv+ z{`aOEo%@C3uan~NJ-1A~any~-xBq+2E3G{I_>%n(J9fKYKjn7qy7xb49L%My4`2My zJ#OQsyU)Gq-oKQ(irY5o&K*w12A8jT@SU@gz1n2gmX1t|L&(xd9OZn3w<>XfI+}%X zlX~wd9mz4|lLTWsfEs>(X7gkQr`-l*db5g24Ep4qlQ{u4)m{VId`~)?Plj)eKHYLp69y`JUhNMx0HS`77 zi^-6FH?7x6RgG<2z4gV{JfY*|e#VNy8&^2@VK+Q}xtIg*i5VsAOPm&=EG_F7>rh$N3~q>Rkuq(iP4h{&Y2 zf&gydEp|gE*)6NWc~GPR7`9{CVHLwjGK@qh>KITesuT!y)`+*MVBoF-feuU~6;j!9 z{76s+t*O7?1;=ruLNWdtpF(N@8nZ`bGm1BjDnmSeP`D95Ha01q$ zfs#O|5%zQ+*I|lc$+V$^mho)(6fq55d(HG6_aVrx^RHkvhzqa(+|gq&=i)Ud4lH?M zE6$zVc>2WDJAc~y?-OofahTjZvF)}kZ@=O?v*zu4;4?3O9NhBOiOvV#clC3RxoUXn z{vYb1Ijc`Tt6`9tE_v*GSAYK-NI1CuhU&s)EVAtQGb@fi!@K&t_RY)wiHLtM%Yd%jad|ltT#oq44 z*!rNM^`l0loQmqvp(m!6)rr{1q}^s_OTOxuB;eqwTxvQ5uJ+SoX@3A4*pn@ z(on2&!{-b|FOAVMk6ST>#)>E|+N=qcv)Cd(>YrRfr^TXcgo&EMH4!<~P`{%it4~Jm z3rB>V35h%rshEDlIU5}dTe4QY9#AW76Nz8Wp7c2It?w7~?6ClenpSR$OzQS%DfuBT*8ySC%*&LSzkp0ureM)1rY#VkM>w23H!Kp$hgk5+X2) zosn690MLVVXifH{?|#XLS}S_c>XrKbX?viS!Y*R7vg2PTZ+Yn#sPwVl9h!Rk)%R}y_CsUc32r($LkPZln3Io%I)5m#yHiBbi=PIa1h9)i}0vUP_ z42%sgSa|2Tzfjd>7X{}eA5o4?17X>J@>$-m_58gAW$WJU3stnJ-1tI<)Xv0*MCj!x z%OpvOdbQTFV`dt@P-b3k>)#K|8HN=_%#Q9f`JEbT}ca8x}lHQIbt0#8{efpg9{k{{xv;D1;0-CrG2MniG0Twn8fX4#fOkX>~@Huq@ z)+tSN`z>V;c|k&{?tNQKCzV7GNg;ZI3NXScASFPkHz!2Pw_bWxsLR3OMR}radcnv*IkXdjy<`KRsY)3n#-n!+A~9)4Y_vYf-z=>dT!zGs%RY? zrpd!6E>O`u{0}{UKlIqZet2<>y5Z*ZP|M!oOy;Zhy~CZ&!yUC>x2J~o)qmBN9`4NK z+BSZf$_!^SqaEqtw#K3M%y2f7%Qoe*O(WT+k&c#;{h5)LmRz=Zq_g=!S7s!e8R=@u zbu{PpH;-hSa{KpQWrfC}b$_xUTg-Ew)nmTG~3Np`q0B{7sx!|b7jrIgd zq5r_hj}_E^!n0=x4U1vna`_Q1yzu@X%l=Yyp^J8v0;UFo0GNegPe*URknDDA+$))R zrYYoTXl*4A1)9Wi5fWewm=Xb@taPTh# z^=Yi0>O59AC}3^zU-SNn3gHap5r@&TETixEu_#ac;F(4K`nA4e^Oat*e_q(aJKKz>X%<+OvIha zc-f49_do1CdpWc8g?ZuX#!tBVzvRG13nczwqpL-UX_(%8nxa0wA}46h>{~h9MA4ouMI^ z#G(imz~o8gQ^t=6KqZCdv9%IJ7-2qy=n<)ZM8Ief@OptMYhq`s9hTaTr& zyw`HYYCCS4R?M9{=8iuiH!z;J%^w!p{>iy#m zlUP@-ywlvd_U+zn@e;vNUVQHWrR-N*epp>KuAzS0iIb@}wk>&n+5B%mk?cFyY35~P zT{`LzZWv}F3h#f=y`^RuApxlC zlikZn)Us$1Ta;lKrmw-}2?#`MJ0y?sSte!7poTjXk`Sur&LU;VbcMe^CtY1e#*lGRlQ*DikGJ+%bdq&e|O#TRVDb?tjY=o zRI2h@cMnEz+H(uPwS3W!6_m7p*8FDO@(tgc`OVKhxonySNSrhAsafTvTUV|X787># z^x5W%mzw)}x+5_4?D5oiHP^P|H?Q~3pSS$aCz^J=`bL5?p;R(nb+Bb?S1KJvxIcK# zwk6o=P*Xz;@PqS*XO?~Et@fJ13#Y&mAKyEQN{SM@vvE5$;ve5TefQRX)iW1%{{7n7 zQiI(7=%}q6Q1LIm>?a1^yx)sjwMJyt(4)~8ILfQq9KAUT(uazKIlSHf1xwwXjO1s4K2q7on^7m5p|n-*LM ziVUOxDJcgg72`-afD|YM2;@po&bbhv1S*M2aw#ZB#sx}DOq?X7)Xz~$9#P7U3EPR3 z#<)_Eh;qs*?T90lvLlX+L~O^AP89yn*V%>GbyabE@AbWZ&pCIJrkN%o38|?GVvy1# zLMp9jB1L>K_|jJBN1~9Vnl@BS)Fu_95U~#$B}JtKiKINzUzk0`rb-!rQ>3tW?kur1+|W>uodeHS&?GS zsTVOTeJQTPS1ra;kOQkuVkk<&qD9nLjaWleUH96K*v?Ln=FrK+d`1LSndUl{+cHP1$H3J0q&S4xAh+oOpU zI8LfwIS(a%l|zK=$z_sFHCFk)OC&u@YM{w~im@3hxjxyCf@};S!Xak&3Mz?6r&*bV zNW{;?j?@QcDMh-TlpvXpeXe(nRZx635;CQtYF5m#^VSBwTV6t;?=?*#kjkTrJ|u_4 zT*c*?Z3J*lPH6lStTkg+A>vW99GG%yPV-#*6YWYo0KtcvS-2rol}y#=CpEQB&A6C< zsj`Y{r`9=E1XQ#uYRXzzRIOtX=?b&9@nl``CuCKx(zq`J#YBz8NZeEyoDNoD(?m!d z2id#p;DrY&2J>{}v3hz*_e!lJnSe(iRC;MXr8vFhSo zKYtE(FRGOEu0uz!{$cCUPo~u$%YB!B(*7jt(~f;<^VW3JS`Z>D_rHAUuBU&w?)b^W zmtH;m@-v4oU-`(_zHf(5Z94V%qgUQYM<4&-+3$V&g%^)pyqM^={Kd1WzcX*yal`%- zdCi^aw!?>BdF@MoyXK#67$7J{xD!npu^uat4l0RYv`26ZDMI4f5cjR1-&5~@*)Rz-B#$INDb#$x^?{*Zru z%}*w#nMp-GaKKMV;bLMBm{6|$Hpq~hph%ef+9Zx$kbOH6{Q1!_K#>rz6mIV7a$1?M zmvc_gXOVLA=gutb`_O0p{u&EGf5U-4T}+GXNz;xe&VT&Hr;cC!V_NR1(<~s`5}}2Xv!j4s0r4%YVO&Txzb0raA8^p-9_F@7YilJ`j9OHGNb0H@Gp=w1HgWJv zDknAm-iuk(A}uHiwbML{X(ewt`f*9!GRXp?+O1#xVbXrs{$a=)U~%JY=RW8=GWq(o zD<`hJm2O_O_54#i&zwtXTPm}FJgBq?9M_PKMjsA}xUZo8mcspk$h8MQcJ3zt`xWMun6GW|b)nb)5j0J(5Ct+5>Vozi5^{fkQ||g~3n&6YEQZ`;Sw&s3 ze#qS_(voTPOt|B=C6Q3Iz>L8kv~<%n6*J>R58C9xOzi5P0E1K9%Ahb*w7=hwun#(e zs-6Q^ZhyEbfO%T}jfa?;mv1D0Qq$EylPG0h-3i-vI5$mVO}q##``E{O9$9zkPo3$#V<$J$T=KW@Xgm*6qc#1 z$EDDJ8C$RsQrSkBH(uL>0VBkcTnN+R2&NiuS9KAS*I$D;wT$RERq@W%66Uoq)JAF@ zSnY$K8crBvCmW1v0PspH6F_`(SeTGlrI@jL9hREIBKDgc;Sag(Uj5!UE~~!NM94BS zUPL5+(?|~YZc2-!abwsh$DT08J<=eDq#stqtIc)gz_OU4ugY!@CSRC+6^OkaFd=he z>E{eU;3wGF0wZMtU?fIhpz1fB3p2?XCr9>p5A%XBUtF7)G}D~SaZYwc5oypuF>u~> zuw-|(GORTO${FXQG+-WMp9vvP^p|eFWJ-{KgPP48+i;En6sx4)w+d)#eOA9(QOSN} zt9DMT{v@pbIO@tdwqaP)+}ftw&pzWk>Wal_yA&a{sd_%zqwQMS9J3;IFQw#2TblNk zn-9Ui{&^nyIr=joTIv}Ay+b=K8s$nsm6adBo3Da_a zmo(Sqc^W(6w`tVa;tJchC7{X`Rb)$K9b*bb-C(uXMMQ6#wV*4gow*io=L^bcai8jE z0D-YNAX@B(|LK@argg3&Y(=&)(yA`^qoI{}+9S*aqczXX(+Ep^HY=Eb>WSLpJ~~X9 zRYXT?M|{Z`y=Il0?Y^cnFiS3kLhKQLV!Hjty|?<-Arp`dhyMH$3g)WPK!$}in=)=l zoJhpo>VC{i)RX;>v2zdZ>Zs!Q?w-fq`+MX82?^vuXm|?^&p}>c2=eGal8`{sv{y$Ye8y@D5i~wRt6@mXvG$!1JRnI;s{jGR{rvD|G0a9_wL<$ zVa(sj%+0;KXU{o%zMrpVO{|$U>wr-+2E>|?5r`0gsU!-50v57TpafLR2&5z_K(KX< zH=rV-RKrynrboeZA!1gen#|X@gSiNH@g-jrQQ6yWPhh4J`Bfo47LXtDEO^@7Z*% zuY7OYrjIU--u1oJS5GNqEY0}hKYqL9$U!PJJ@(J{L|y%ct7lpd92))f3Z*3$S~uVN zU3=GS!R#q(KkTh&Tkz=3H&$MHSBx2eq!l%bP;{Q_5d#}VK>#73u77xco0>XSa9#PH zHFLVQlV+fr2YP!ToV@t_k$c{GQ*eXQs%7V%@kjQ5^4G5y7j-P{J%O4Ey13#(kEp9h zjZ04dqV<^v7r%N;)Qp*X>fnUE`^2agqmzqMzc`|#kFE5~u!nQV(l0$WLCWJyIo>oT zou!C_0EBk67zMcrMdUeu^_lWDGS*2Q!RGI+zAV|L@v=xs*o@beZN7nwi$0-buDgY6 z>t&olKq;sEi9&dG0#PUi4p3q}Q4tC?KxGL4ND2cQI282&SzUpZtwdGCMXqQU1%ZR^ z6*VFlJyFQPE6=`w8k##Ft(h{TqIt-m(PLsZLvl<&>^2l*M&c@e!@e5JejwC=jv_6^ zl$4~pi#uuVtcS%dxH*bv1>)x}c?Lq>nvijlXoE-65dZ~X=2NATGRn~Hmq z25mweB@j`+RVr!fTV?9CDA+^~5Ooc#O$AVD%G_{RAZ4*AopBvkA7m@OEX7nQC8a<} zy0>X9Y8gpuQEr8QidxAiOHC?Zr9gyJ0gI|w&4jYtgvBE1P?SedsU#{I!>T$FR?1Sd z)EXI~JdncLC;$6?BdBZ?XOs1R*GM082wGGC;w2x1rZCH6Dg8ipHj*?i{=! zTY#A@ha}@M>?mba`6?RPz*Ng2GB%^gU(?b{BEz$^U6BWW`nQrb^YJJ(q+~JsN&1o& zl^Y8%Gy;3KVh2nlr%}JkmUV{S00~^e^)8Q7@~F%~3Gxn7Jdf#`MU=Z~M<*=N#H4WH}f*uHW3@yFR)+c=tCp-Ml<;)7QRyqxXp`7iv~6 z8++hMKvac>w(g^2cB~)#;*0Cgo!|2B3zhRHg)5hLoczJam5*<{{?^Q{?^4?m^@aPk zUhms>^{si`hq+_c$A9*doqzxH`YUH9AA3O-KqGE{_~8AAF7-Tpy-$UT!?69QCq(0T zv2N|%Yd5U@)7wZWxY)S&88Pd#V)4R`A0L`|@LOWd8Z~0ZQy>0i-mhN8MGM=0bVO(d zrcryg*REJ5KKFTOoi2tnEIV;nOq(>Zt9#6@XT_4GNNgGT*`YkoK+qdqHi#G#Es!+Z z{(7>1+S1y#EPGc%(m{}MaEiQ=$Z2CjTv&Tqyf|BjQ#>ZSSyZsHketXo^V%(fx?2hN2D>FzRA4vVsMzkxPmhm?=OBAQcj6#ps%) zqo%lAk2rRu%xyc9*1!lH-Rz-a|%%&E9Tg9V_h2v9~62bv5?+ z?FhX)`c6b9hsk(8ByUgUKp=AVo>XprniWFX7C^pt9fFdkJa%WhZzuclZCSG_7;v!i zDnO-@)W%z1&bv^aXbF*cC|6$Mc zEtkCEaYfC!fvJ6&-OX8N&RhYWcO_{zeXelb_Of!21qLr3Z%7B6YuHx__&zu5Iu6 zp~8adUjsEwjAqH3i(+#rh8`)Em@M81C?)Mt&X+cGfti^mmy5T%v9O!}sr3y8o+<+CMAnYeO;Ob$bYWU+fK2XK7to)cFDVbz>9F}TiFogOw z%5Z=ROOiub)rM7LWmrqqjTBah>d{=)1Y991huOr_SUJa+@)A^ZB?}Q2(>kCbKrElP zcZ%MRbb1CdPif?eaI)xsPuFnKTQpgNvxJ$NwrrHQS&L?`OH;AN{dH-N5<<#~!V*xc z%8^(@CQ(azd@*6i1|H!$nVY6F*g<*^4O-;?_C_Z{h_7<`_;f{EzfOz`Z&xl@ z)bZ5Ls*T$O=^@X5f4zS4!p`5HCbR?tl`Ern!;Gg{&J~&4^d)O4l7fMyaW9^kaW*IL z+-e2vX797qCLj7%*#Aj1+KW*#XR`nV57Tpnx%8#lRtdDMr-HVW`aLC_=~_XwU?N z5LRHRijjy}F-k^^o#dmb6hcx&lFUswGf7ma2?-SeD9Fu4a+4d69XL2?7HY6(s zyn{1Osw#A?-!n&*N6*U_VM9JHFURaOu7Pu^FfbG=Z(t?Yg)3C zd_)u{biQ$aa#ioU#PmPD&Ml~_>x|=T?{(e#+_LjYwJCkN$reHjhT$i)Mhk_b*h&s369^bo$VT zwf8#fthEj^JTM&4bNTk#-|heV1DFL;#y6Zl^X8p@Ye@^T;nNw_Jr@XtI1t{@bB<=# zj9avNXaDty&8rZj6QcDtOnqs0Tf;xQ!Q*LTq75`-e&d(t+`I(~yHDjGc)#T1(`mVL zo@sBk!kGrT#HeWY^GTRT$Aq@fB>+!Au)m07S>%J_ zP7FM!Cokhxf0EV_Y&VsPS1yrsq@F_LQ=IYQNJ9QBQLlGI&a2C_CFDW`|9eD_ANAEqb%n)pEa)Uv^j?0fae4XW^HwCY{F^`5_k4}A#@NJqvg1hB$NQ&jD}tjJ ztnB$>e^&eci96S?@4W&junCU5RQ=-ntt+ly3e2orJMhJ8JvYX^k=^mX9!`qmLs8)4 zo%meP=BR0kZK<6qyA@+XEChveoX_gKMHvhgE}p2y6Q!tLl=wW#5gKK(&|7&2V@8X% z|&%30K_1nOjP`WVyTR? zJzr+g6v4=&>(iK2DfY$p>b*U6U%^EQ|3|nw#`cvZG1q47(NALm#3-iJLY`FH_7)Aj zoptChBquUH)pwVSCyGu$(m!Llv8#6=^fcDkw3L%;CAf_Rwwzb#P0@r*O4(5_L6!qC ze^fY0Mq7E6(PLAaLTm)@#;7X(R)m3(PcXzDIZlKQ@w7kjIvQvrOvGlgxIM)fYrcq! ztNkEG*kS&O5>vK{KjEW!zN#auaAN~r+tMcz$`x-sg!S9Jp%0sYoTC_mDB+mMWm{=` z=%tEWs2kBDdQz+hmfjyyYD3*dUOpy)e~m59W{R@dhJYbPd`m52{^5rVA;T#uO z6X9e?WbrWZ10F(j@~WdHtn}`S~gr; z_HcdK@QRWLD=U9kRrW(&$-_0JL-l13>PjCrlnkvdyI)g2+)(ylP5Fb><%6rLhwG{z zt*aVdSut2wHB^f;5hnv6iCvf|qg0w~qC2jaIZBnQbJj+1%huUKiF(Awf6dMjs8D(@ zP8!)*l5P;{#A)$|v7m=4T1}?&$mbt;u6fQIx3^EZRFvPlF8Xz2$-g#i>uXOvxv2U3 zcQVe-e)&@6UO~_L*1lhMKHOd0`__|xdFA zjf6jZGhn$GZA`T8xmK-2qhejM04$*Lkh8-Gq-J}2xGa7Q7h|7|LH0+R&OCv50 zxlSbLCIy`2pqmsRe@QM)ahm~~fBApmu_Zqw_jq(7udX2# z6>?mO3k?uY9U3{aC7$OCfA+dqLZ6|x7W4tNqP!rc zjr?n}EH^F!pm~C!53uBHOn=l1UyE1>Vr6F~(ZwV=cUeO4=k2Nc0tNom0g7eEe90ML zgfWpDDm*XdB3_ZJV&Tc_Fi44opc8OK5riqRDRCSJe-R8MpoUi;aSVy5oT06EGW0u$ zJkU|vBuW;n8_39GAmuJ*EJ>8cj}eZpr>J`4SP>*ZP3EItAoM@WHr-xeT( zP{6e;zWj{zT{?p*+P37~HX#MYBxcvjEtCXdU7!Xe)`$}Xu zA6D)gf5h_Xv^Tx*0QU$A5shVWP>&w&`VCv(MmDmj^?);;C`!^`tZ7FmNt8VV%cor^ z+grv_lwJTTbDu;^_C%C!FPN6*%~_H=^P>}8qX4w;Y&`bf?tOq`(QT!;J5pCz0*|t`KJeG&CJkW zm2%DL=2tPrbKJ|0JJL&+*GzkA+{zUTEt>Y$##i0oSPB3nnA$0$oS#mAZZZJi_s3gp z06#k3h7h78kRAv{=RVuCweZx1y(dm~9y$Cr0HASG?x&yZJ9Kb^(1I(OpyK&q^x)9( zf3UhRSb@{Z`*lhwq<_-#Erx$D7R^Sm;8NCjjUzB4-dBl!DPUalrlyU#f&lR*~EKPeL7vv%jmWD072jGN+9B@~e}jWznM_e{=!> z@^hY@{PYX0oi)>bl)Cj7jT=|gO_@9+x@c1OUw6%q=AAx&Xx*BHrNuL*P0G0Vj}K3E z?|QqnGBH zwX14Jr@Dku+b1k@JdQ}rl|_OWe;!?0{_ytr7ddX zSK?BCK8hEy9%ROh%J?+&@+U6bEer5>hO68>e|YHG8FKNXN8%&@r|aCGqbkohe)hcY zdCz(8x3lMLc5}r*u^<91!%Y;Gi%zW|5@9MT3c*mWY2{KN2?T-BV7LSje+f|mvk8%q zgrI1_#4;8ySfrilW!jnA-}_JWhqDPG&|h};$Fn=T&-*^l^ZkCl$b}Gq0<6Y`!1EAD zY!+UD`0F9$0@s58BIx@*qd|ZIKLJTX2tChn90*-6K!OK_kuE|ILdK};C5e&XrI(*~ zy#zH7P=W#U6N*@(ckz&qe-ca(LO$}Ocr@ z-?C~|_0x+cpE$WUe^e#;z9UVC_UvkS_4C2^f#)ILKXl?P8W_iOrq6u(qmF&8rw?aK z@r4T~5%N6`R#r?60^jpI%(Lwm_k7UVlnnz9c`v@Ys&41%HPuT?D{XsUOVzR!i&o6+ zy?Q)_ot`VrJL*zmH zY%3cNY&g`qf1`Ho@^k&~=&&^3aok0L2Vuv>cOIWJ{Y2ZYj*G|Zcdnf>cHFqJWdMK~ zbEXAQHXo~pNYyM}(6IC6)^m+5C-)E#u6}Jk@SJ<=&3$XnkR|~+1;g0=r10(tyjX$i zmPlCszvOQ8wcH&Nodb~g4DNpHk%3jC z#4ZVB@UC8cs8WoY*p5tP8(m<+D8p@RO-|dK4s+J#l*vjP3mYm^6q=aph^yG>a;-B` zhe}66e}zhgOlqmpVVKo6R3?-rt!$)J#@INt<=n&+5v8p*5mQE)NSe@?jMA1#!*wWi zY;`$CQrl4Iw6w9-AyvwzV-v>GT4mB)TN}nIjD#pNIxS2nRazR$m9eTs*)-EeD9e-< z+Aw9fvdYA1U8bxh%1CX6Hquy1HB(ZWP#S5pe`Q(;ZPHaQ(e^TN=N(a{7;hy%n+g`@hczRB~Z%-TX}QqNbx;r%!mi@x<%5 zZe37;$#*w?lyCd;+qS>{*k3x`&XyZGWqI>xSB8 z0ppYj!d1XH6`D|EFRr#Od1e|V2oZeyA3g2ud&`9P%>1PmMpv)3PA;AhI~Bmm2nRrfP*6G1 zpS-zd8Nocjft6F9pH=nse^>oga~8I|wSnWJE0+$AQ;(L0wxT$CaD2Rc#{7U`#xvE+ z7mtaeXQwUv%k59P`x|`1r%rsL>)pfu`tegtb350)Xi@IluTIxhZ+qqS8JLst5Bz-n zFRIS>?LOGDX5d=ub5%=^Zh7PDo2`U#La7JS_3K{v!{F(s7EL5ve=K}%(Z1UCgM+7L z&920bn{x2s{l95%JsJrKoK$`N=KuWn^4H&;DT&43{`s*_8K(G?%O6ab`0%_1Ppv=w( z>9*YFzNMQwUCZf)e@@MEO`{E4ELMXWO(PVW+hk~~NGC}P)H$f8b6TSo4Ju;jC|cPZ zR8ka?VEJ1JWd=e01^saD`~G~^Ab5WHd>(k{JI|bZZpDIy=gz;da@kc!k9}ThwPN&wQcye-YNl?WvsU;7tYQ`vGnmmG z<}99#tc3)vD5zdCNUPDqOi-l>NCvL~tx6`kEimLmX_tkWyBW|6=lX{8Mt?MDd@|np z;cYG2BhNpof2PI98R0(?a}%Q#69UB*(<8R@q9gzi<~}5Yt5eK;Qb7Zq=A}-n7x$`W z^lEOR$e_X$W?n&yVD~GoT%)XXgN?OR7z0%xP`IhXj4;xT?(W5EP$3G8J}xX4A@l-8 zF)fDbnGiFUYSri^0qQP9sa3uEd^HzZsdIenRw~C6e>F!jt5v*QdEK=>u0ENvI$5%G zd8t#ZR>zZCr%>qQQl=(lYD!B%E#t|=CzE$ASjswfcXgKHHl9MM;*M%4W!UD-L%thauC%JT9py&><>H1_gwHMx_f>!9tGHb58vBe*1J4HrRb=9X1wM$5b;KGcYRkYTHAK8}$*>YRv zwiqRJe#f%#uJ=6ffVrztfJ6}|+{Gv?IiMqCc$(Utv*6}U6g@&og@Fifb`TBBTvU|= zk)fa|Ed|Yi0FeloiGl7Q=_Zk9uOyHMEy-wReld$7h<-XeCjFpqr98%zFfji&06T zWkQT!T^TCWyO_HnwWR29{?l>5lyNZ=ML>}e+CQLnP=lBAX>>7_DYX!=``W+*!D*5h}RxUXtX!b zLtrAJK1ojKb;tgImOBG)cRXu*Vn=rybxD>T6QE-s^qd)orJN(O)y#xYFq_Y!yU>d( zEo)X%2^IrQNd*-qR$|`_9OkGft%@i?R{=Wk3qZ>P*bIwClmaRt8U>F^e-NF9Dr%u` zB*{=@l~%j26PH>Q!7dmu(NWrmPGc8q)n1rMmec>SYBVq(W_H@t_GGF&gKk&Jk@E}{ z&8>=1gVLNNCuTLmJd*&jRxuT7hQe*A5NZ@6Q&f>GE3qkvfIy`n!jS}s$KU!{`TLoa+w0-6+4>wSherz z(V}baK6<>VcQmEB?F-N0(zWwE=civxa*m&fhe`%UU z%lCbH;jIti`t_TRe|arLkvtZrOX6LWl*yr{lp~` zQ>twdK`K@tAwhrk$Mxer&-1=D_RpR@&$~VMeeUaguj^db_jAkFFTDR?Ub#J`52l67 zRy^?S(>}Rx)gzDG@%mp!*YD=@&Q0$)BVD}m!T-FmfA7yf-TTVP%xA8D@Xjy4dg7+z z&!tn|nHD6|7WQpz>PIuTXl)6re%81O5n4GzLGuffa9|$}AM7xPTF*$Xq7Gq3rD})? z?TE>6lWcAE#ML%K6mgBF`3N z0Khs$JQ8NANHUH6h`JGqU_X+6=FC7b)Nf~^ zf4q)YbB7ZW_kvPOMX5qU8H$QTof4%=EG)fXB~qq9#~TkmfR#%pGCc*As0yfVATBOo zvkE8?Q;|9r}AxvG?xtCPMe(dLuhoegg_pv z(VfQ&0t#hE)e^IYD~m%KW}0Wc5jsPOe_~MU{)Q@5<&ItxV7vVyf+R>438jj8ArrDv z4?Xo$CwlXXU=oq+AJ+yyUBSNFS|714P;E;M=CUHGVtT>c`n{hd`k~A-RximM6FfWa zk=if1bkFP;KK`|TzP97|q1ugR&fC7>m(Sey=4+pN;U{nX)&o;3Hul$Cx%+P?f7jl- z6PY%Ad0GR`icNC(i7{(%7?h7- zFcu`x5G#7;G8Aj2^2cbP7SqrTu8T~=J}VXyfSA!`e|+3BAm7o{G9JmcJS|`sGtafA zZmE($%|x0;VCG_JHlp$u5jlEkAHLhp(o0@T_+41wy${nz;!SGYP9Bzf2}VbUbf@b z^-u249MA+p^|B@mM@f|zssz;_RC`~HJb{W}qcGJB89``o(EC(K1t}%4mmQL!4KzOQ z7)P?ftMG;B?u-yb4P?sXhq3l_l41@4hDHl51Deq?nK5_Vwl=63xRP4BMp&m33P)*2 zuMY_aI*S@rq-LrE{LUℜBYbOKQduZQ#$0FcIDvO|? zY6UO>2o9hX5Gl+cgq2ZZ3>`pN6*V|Vk(j}`X-;rsJI8lAh1UKcz7+t{KvMzd-L#(c z*i73uC^{^;n5TwT5>tx5!oa_nr}S{_t__8T=^<-73P)~KWd|O{f6&=tPEsJItlK4H zfdcUz+4fE?{Ivb#wy}9|id$}cDKGZuLQ&^4^r8`%{^eK!g^&H~kT?uo|G7&=76B)uTLw`}_8Xvu|T@uDT`Hcg*$j=XCX5vF|6 z%$Cj9{QlR=FW>u>e^*|*>dF1@-m+6mTbV%p2U>qN6Aik#s420d5TfzIPo}7pY<(v* zv_3f+!1zf~_%YU?wpM_}lGd!Ygf(Sj1{}+4?&yu0Kv~L70}Nn*mdmLMR(jrL$JjGa_nwTJH7GQfi- zELhuDVi?iHtU0iCm87CDjut~VOQRVSK@pmo#i<$We|xAR{WNqlnpKWL5WF6$#oS;Z zqu2jhS8nAb=_0dLtlkz5zzl$x{Xq4swvIRtT@eP*CVj#U%iC9nF_}<2_6EY}=Clh3 zWnvoHezHGy6i5sehD6ysd5f+LhgCv2t%IWq3j&d1dKE%UU?&Hhlq=+st$2{mN=RlPak1#?)*{He_q)b56^+OYJDnJi7ses`b3BIJ}esKzLSgG*psx%vdCqt`Iu&TbEO~-o5YseG%dWf7HpgS=0U&&W zp{-@#=82pAwdk3kh;|!}u{@r+8p34}t+H+-R-<)Ca07*hpakqT7G#73lX8 z#)E{Ra6=KdGcs|sfo*i5VX?M_huBi>a=SRwG7?n*-yMi3mxdLfT7)f0R%bHP$hPAk zxq13PDMkSFvJ*9Mzy`7~cHIc)f7&?*;kY2Qa;+W4nBVlERsnQ~rviAX6u?YSn2l!& z2nu5%^N%D%7Rf+JT*%JkfiY_yMyy9rdMAees86;rF>2;n#t~rvk&CwXZxU@gZq@}j zaI{+clW2c$1BpvE6P3<*(d9Nwai(#~MQOSNEm;VVoRV8gLC;MLlBU|ze^q}Fqz6O= zmW<;&1)Khb=Iobrt!pC$diZfoU96BzZK42;e@yYm37V#)1oKSix8uk2l<=!mbsGt5 z)Z$m6WyFk`)xdbI#^n-;B{Eh|i`10j>M(_A5z-EAfE3A0e}w`WaF9?OhEl)^+6gcfoE9vP;$Q$RpfXUvTChbP!YyH<+{~v}{Z2sEwV+XeOVUi;`|Y~6{T~*j3|=j@(v}aNT{Be}RXC>;M;$dgRY_A2_DPKu=%ht* zS^SHqE2o3=ltrg=e+JAS*bH5)It4dmy|PoGj3;M0t3(&z2lpK&oy-V|tj6kB06PKN zL*@LAXU+B?F=QpOIZlF3v~+8k6v)tRIkyju@pB^Bs|11w2*UKRK_^~feooya)&98) ztz(ndq1*S?BuGi2l(gVx<&!b#JgAjR4o#iHCK^^qwZWGHe~?CUwM872gr$ZQ?wXH$ zgyHdOE*-V40*R%MV}A)HLefy@o@@X@$jorLpR>w{G%2eRe@`g~+zszL1Va}kH{)+J zAZa(72`x?EsU(mHndRt_>bA<^G!-K^3v~9(+D1{n_+^hV^O%EGty}@z{7ysM4zt{h zIO)5lB|^s9f38#aR3UU1t+irQZsppNlB0l2PslLa!W0-GLNuPD8W?8%@wj#>Eiy&j z$KF>zC?YnAu0l{+3oV)szKyJbjoA)L0${ATe;^V8BSjh*Nh2^5BgSlUXlDBEuI&(U z6vd6ZcM=mYgE7ixl9)Vof3_!9i(lcvkw3SWjCw-`e{&GL*X<~$-l`B>Y@VMLn$u?z zI+CvPNIOJ{0U6fRv=ii<^_vO#@m}Hdv^1;SBPvwB`6gj_`YRZ~3?%zip7J*cVN`i` zFM-EQW$*6OpBVk#zQ@}S7C$+-*M?0(3(&Ce)?Xj_^~!OFUW*0a1jcuY(u;yQUc^d}|X*{)mSo5k;J9cdR@7;!@TYGNWHn6#6 zdB^nyS1*ow`NtU1q>Zo7zIg7%FK&!pw`l3ze=}oVZd>v9j~h;&sF*dSbnVY9pm6-rBV`jG6=kA(!{X*^hvwY8uB!XZ?f8&2YmWLnzb1Zc)cnuSmM&QR z^>uTX+`cAycW?RZLyQnLO*{IIDz0h1bGqTsUR&ud=-qhhSi|96wOdwCzxoHkf|w?} z^OhXcd;Hc$NYsq>w>)V6nStf1B=9 zEN^g+E^rny@gB>t8IBc3V~v+5HTVmM%HM2g^3K; zOM$WxA8X$vVEQW*ffIsVk0+Yayhdgn$E*qCZWwn#L`9?sNNdxXV1#OqelR_ufHndM zP4WEm%a}{smuSynuUGn+sLafLe?n)3G`<3p#s<4hA<^$0^-(2@()SbjDnpveZPBP! zQwAx7ZSQr#ezNAQ7re`WoNa)~%Myou6NLKVKbfLiW%T<@xR&pFr<4*pVu&JHT&lQO zG0Bo%ri(xq^^_oG)Pti!D(OZ=1%*}BBM$E%>@w@ZX%!D5R?&ooKoWFWf7cn)0E-ls zD6)%Oy7Gzne}3BNK4G>WMY0mPaZmmJK-0A=qWtlZyElshNxIh~P%F@5FiiGAN%MPlv|X-e>TDq0Z6CX1@PmP zaegM9mY~9tlPNMtB_V4s4*p~oN`|idDa$K^W4Agw`g8`+HqE%^J=5ix)GvLo2`*M3 zB110?{fUk6q#RdHS*TDJ29a;iB!rMbcy6>c=NcM6|F4 zRs;~mvo9ReMMXfYe~YSs;;2g{owZ&qG)=_9*#~FvoB4F!uQIT7tnD00M&{_TS&gU}866!ZR#E_=ikM4F zq-NGs`HdPwg(FSCW#e9bK@oyR=vvL%%p(D5F0OirH7h3JoY_DdJY3G)9>84%6sp*i z>`l8Q3t2hof35Yz8jwg+uB_aQ-T>wMiqfMr2YNBnY2%=X?L9 z8LTOD?4Xg)cJYNrf)AvOJ}ITjHwE{W zZcdekJaO3Zww@}&(u*S8|+ zxMFxTuW8xG*Pgp~sb>EkHM9@uXvVt-#IWH%f4P05Y{Yn4w6yi|`Nm5p9{TOuV))oG z2M?|O{BNzF{E3iyjGa92=WQ$Remd#>_V1l~KlgCW^u6uN?_B>sU*{HFRdvSkwZ6;R z`<#=QoFrT$ml;$-DhVP10#*trUID=-7Dfb&9g)H)6oFCE(bmznwo)$`t+h(qv18S8 zf3XPlQf*WU6tqY?j=+$LWooA#ee7c&)@84~);_#C<}l~%wbyt1fB)aDAHFen&nrT6 zV_b3T7nym+QUU5IUwgYgSOCck!bDK78uTv{<>RB#1lp;VkpmYY82!<`OTv85RzPqL z*ny9z)uSW{l*X?<_3rJb4y^j<%~k(6e}F8YRCm>14<<7wiDof+#)=K6|MBZ7zX3Ir|sR|f8M)R zs8I_Ky$)k$U-QAU!*AYHn$tP&gWt8U{I)F9?6-D^YO6@G@ybOb@985%$)m3Q%PzsA zK>{g;QsvqYch7tI`8hB4&w6K%D5p|k>-vqj`0Dnp+eFKlj@O>QqBX=8T9jJqmh}$XbRS+mr*rQwsZ?j)Gs?Pe z@$)DIh&l61m)F~saST>CO?E=)29SF4rDISQfLzk!vkx)c$H~NO{&XTugdkM1WG-x~^O*i)sfcLPjJ8ButoC0fEt0Faj|*w;&TRe-nXf8mYw- zoR;+31TjdZj7XMPv7$sJiC%lrVjp81N=oT#R;3C|$&HjSqFxg;>Ta`!jtB&Zw&>2-A*~*Yyg^%%Q-k-Pz z>M7@o=bDw|WS&gECQUE+AfZZ(^Ma`h_59g38;Hy(fOJ>N7Drl+l>JifQuXE_G3mya zkN9;KWPCi5HpevCH&{89=N&>tEZei-Q2cKD~K!WKBwLOx89zihdqK3ZKpq6NZ9x+SeX9ODF4w zuAe~0w9F9nQabg98;*k&54ew2N`dVnWWq$dE?P(>h|9TLn~Orqy?+__!rOSEp%4ul zzR(m!A3GLsiwG32FZnkQs~)->5MxgV}DxxSI(9 z6+?av$NbzJ+PoA7olqI+-5GJ?vJkftoS0nOim=vwkV|f`AYhq&>D=cN1cA(#Fh-%j zn2wF;;(N?-vjg)`lNE=a7;%|V6_)w1v%WZJj@V4pl?_`o3hybeV|y zwn?g7YPh%)wN%&zSFhD*q&-@=Z<|ipT;2(T{qD8*Lih@ufNxxw?FJ_x)FISJlVhwv ze{fsWI&HPE*JcNn$Rr$AnP%!+8&(QoPBr*gUK<`k=83kx)qS9MECg-m_;FniKLaBc zr;~d{GK-k6cy}L=V4@-G9vpgOuc(N0^73?ShbYe$*d;`pNTx^-M3j`u>jw94I(cOC znUix~|BaY7Uyit@+DC4jZi+M~l{(GO38B^R;9cf2tj- zQikS0%np4Pq=m=XxligEL3Xzf-5LN$;kC70iq?rxm{()mQ;y? z6fV8z-c)ICYL%p^Ht@$JG3t;+q1N^pV^XEk6qGfVv1m$3W~s?+!pVA2f20ydW>kD( z@3)B9^(g(dBmdkKgz%^VQ!6}6DP#Mgn6@4toj8;5)8v@B8{A$l1p9TYbMBClyw_&a z2vN`8)lIp>2Qt9yP+oN6ho@lrBZLs8N>aUi^+m5dc-P>m%XZ&CeaCiD7No?+lb>Gw z+aE4EyaU@WZ0YS-_UB*CfBDJ!3to7fKwzbM)&3nbp1O0?bK4f}-nsnC!$TI#tgc@6 zosVCe^uVJ_Ki#$b*n8((wrtF{Eq9+jde>)fUw`mb(caea*3O5{46gZXfLPT}`sR#* zT~GY)zuix*;e^NDzWJt|udX_AsPoayLa4DlE9M>AlTaeW@X|vMf6m?d*mu7=KJ};T z#ndr(oE(_3<;V56^mM)c5_GnhEg_}=y%;lP&jRs`y+8_cj<8xrC~UC=mrx;`G`J39 z%ZYfqGww?G5aZxvyGEi{z2?^5;`T}W6$0F)Pzhr?Vddb!>f?V}d2H`(gGVI`O46k# zj!t{#`(mW1bSzx+f6q4?mu-=yaebe>&kUH3YPxyF>=&M1e*Dmlf7rL`*#322o=z?r zQ(fFOYu_6^NB7-u`jAYU*M4>6%6)J3y#G?tHI&9)xAtEL?>PQ06JyHhl;tZ2KbW_x z|MI8rR*9mt9lOUZI5Hs4>sWH~z4qRlNHHb}s0$W+yr+KYf1UH*-q!u_lLCgUKk-h> zqO}vA*s%22eo;@7DSiO@Eev?0XGiYUx;*@rWxx&;ApLwf$c6pS%vmTDaj=Z>LLS8y zECU3EmH&N>JXPBWk67^<(DDnL9I= z{Go&4UZ1ni?7i1sdo4hQ2*8*C;EI*aKp^7)LNI}hf1~0SG0u?-5lbcjWa=s@1dk;s zfjmGI9O_p>E>;E&OmdJy2$51{8RsaZW^OC-2$UQ}DifCyy@J4xD{W{QAp6_^-zC@? zt_Dvjf8OMNZn_&`1gGpMbUwmnx0qd?pmVLAZ7adJWvE~ZJ9&24#9t=$yF4N!f&fw# zb3jHSe@K>nUS$`3Axxv1wVna8ZQOtcTVB2c!CGlu^tG z38kP+_dZ51Rf!fmm1fztAETA(gP>cj6C9N?e~~kPH?4ReH_uwhu4$CCyky@!%3!1B%69ovY-E#h|1E2i+$mRD)Za%3c!1p27|-L59|`bc{}}9*&Zv}4Y`ll z`k&(Dsq&*MvdH>nThq3Zg_0+7_hbz(f7nVi*|@lZmR-@5MQHNAuQz;E0IT^U16Qkefqm?jm*f5e|qvs#_IR)syN) zta=^;PGrog>!aGmbk4)H`a!b%UOsCfRL!SJ9jTf}W`Bvz{bE$Tj3#x2e`WVSe=bC^ zR+chi;!0prpD|d*UZ7OzJRpS(YBOp_zPqnetoeYf57_%1ihoaogCXal8Z%k72-unl z`U?PaaSN;PG(r_-=I21w*$Qzv-6@cQ8MXN&rn_-cvyJzZr=COtM_@G!A|W^-5e2Fh zp1F}I1*82<8Rb$CMk%6dn3a-$e}uVJ&vu|NKbGo}3$5_4$_~w!1}(me0;P-rwbzOs z0Hs>i<|gWSpY24#0DEaS_^J}VP>U7RTN+9Hc^>4kl;YUAj`1OyEe_s25ikfxr zycQvYq;BP_FVlNgKlF#!xBmXk#m_#m;+6b@hqrv=;&}iWFId-b?#0amKR7V`*R~JO z$+Zji{pD8-Q!#1;il97bG?iR%W+}~Qn}Vq2?JGz-j4+$V;B;YSsR6UlG*kCVWs06S zmhUC`g}hTsktCM%p3N=)dbjDlzqMWXS=&c{&TVKrc=7!R1yrs6)};@VFE_FzIq>PF z700>`jebyjsK5Q6=YS(7bN7Gx{<4ALhF|{h>8qoprsnza^Mu_;e{w{N-&>&osX+ik zBwA?`Y-vq~z*0{fZKR>%1~YL^dyOwc{h6*~>|VeyhSKFFw`*`jg`85u2R~A%l-jfF zVD_nG3hk@Q2mh5*d6fNc5v86?lJgyWQl|3-Ox^7qwD$FE5NHJ@;as8+$OTgkEoyx* zN+UpwAOfxqiHIUlf25gxg<4}2+IB?50tA9K2;h464wzQKPx&ay5=8B5QL{yCVukBv z91|RvdRLTDbW?&H%P1^mu&MLB?R@N8y7N&Je;q&F$ae=rHuup!!~Bz`jE{m`n9U!* zHMhT<9h*jxA=`-smVfECC~a!gO0|$G!3!yjL6&3jraUT)AUM_f28gLHw7O_q-i$7s zzD=49lWAC}d1++U6e@J225vGMUH0t@76g?FKqpXaErsC1rh}#W_(~u*0SyopLarD- z|G_!@90FT#)KIp2EV%SNe%$GXS|Ts+yE6T5qg0lP7iy_)%YVWQ5LHc@Ic}w1nYK5t zZLMb%m`#StP849;0D}W4qJomJqErZBl#+su5w=Fz9qN@}OxW~Fhh^+E&ko_&Pjmiz zdIXEWE4YcL7cf>o6&UDX9`avQnD=TYu{RI-a5X$`Fh*-iT2j~5bv&^o?n$IRZYsb_ZF+|x0=Z^w~E+9!HG)z5+@FP znn7?dVJehX$ucdWr+bCkj2+hkA;G`HA77n=cGZzR+7d)i+icD4ppWEA*BI z2d76)OceU2MtX~d-eTdz^hUil?zJGYS zr!@4yA2;`o5A{wI@}-gf(y8Ys3df3t-qOkZ_?hMJZ0;@%^^Bi9Ien(Tbh>}yY`%21 z|Fbj4O2bEsg%dL`=1ZsZbC;#)3NMh}&1(~R-&zCk^kCnPszfBDyn+|Wt zZx$-Soj!}v_HJ;FH=i@$mnq>b=zq{gu)__llx_m!K!u|mm^|7$Rp_1?y6e@3jUVs+ z?(Kp6?X$bC93GfD(?51<@W0>h|36<>8yr=2hVS0?B;`y5L7@J0fpe;z))yGETvp>Wlq-|2@(@(Vw3l z>75?j`1j7emHx;6w7sX?pMReodGO|j^p~ScZazKdVq5mJgPZ^MN~YSEs`Ry7f8vFy z-uxGbzVUuX%jHLt6aCqL4z2iT%i^nTtsg$Q=krqTe`6c}vL{_BWf6EyFrNQ1Tk6zhRnW~5@KN~~{P-haHiM!XiKtvs#5 zMp~2B-jYEeWQ{M}{b{OmBH1~a>Y7L;Cvsiod~zbcubky1+236*q|1fgss0roZQcEOK2sS^SBk0fK&D#Elm{}EQm$Ic zREpVZv9~gqDi5ZsgMYb7v9~;sDG%qW1F6Y;rd-NZhw{_KY_*iF4ri)^>2e`8S?aBn z(&a+FQp`>br7FX{mBDnmn5_D`>5m zwGv?~R!5@|7@;^~(U@h$!z9W`l+l<)B4HGyjt079`ww17HeS{`#5)Y%O9c~QMc$g-_I3A&i zh}Bp}6E>~4P=DOE<6+hqwi0!AW87+}V~L2BuxO&rst>ccZ8g@h`Y=mGtVE1OEjt#b zb#^T$RE&4>YoWEvUFvFr1hlKzzgio#`a*x02UPbFMQl{PzdXDyXm?z4&+?s4U`mVl z5*Mxg0aako2e<)BLS7m-f;qik#IEb64Lv-=%YT+f#0?9lPS&$C{W1zEhKxc& zF#k$Q0Ku4HObMiXEOO@;N&vx#QDQNZU_>cm)T9_&jM$bpE7u&EP2$n>-S0T4CC-upBR zLlsvzIDg8lm8%d2E$bdKFfo83B3HHl)wLqxdP6VJjzg}gqrt&86EhS6h zZ&UrqwMu67*7w%LgVbf-da#@YB98081pbhSAb-?Es4h@Td`cBgZND^Nv;(CB!1HKC z`KL%g``{huID*z(eoWwSI+P$GwbM)96#vF9S%@hyF(QPRE*u9j;)TcIgS=zpo(YH% zwO9xv=*MauS2VsbFEA3O5-h2L_YzYo9VV@0KS=eW5r+Bi7pYKb#|`z5^k$?%#-}n7 zK7TS*nCJ6@^dANBporzLHv3=~nbnSV(reXzHSY2+UuG1{%7EvUawwldurkNp!qpyuT$Ds z4r)Q93rnSw#0sa*&q1Q`ApSv1Rf-4Qm46u^3-B!s|JC5;5|^FgB3jJH{%6~Ad0xV2_gVpZ@lCVo+^)EKF|(6t%c zpF}H7Vlka4&Tt4=|19!Z*Yjwm*7>03fynpWO_;Xv=o;cNi^~#xCcH3Qx z=j`ij_tYV(?Yg$o3eSpWw0{%sL3;e{fkj`vvmrM7)P>jL5S~5p26sppJ-GKbzd!lQ zYX=a*+n!l^?c%G8?u|kSyE=c?zNY=cc%l8VR>Lrw=g+N+u@8PdW)t(J?Q5~?sVPmW z(tIQh2&!g4t6$N&B8ZQT`m)*vS-M}e9+v7k2(oLFFdlWJm)YanW`EYtxjk|8tzUHK zHxCV_&yFAV%)We&LMTM=49sS>wJm@1?dyzchj|RmpBGk)~}eJ@-1PDnf`)pDQ)Q=byZk9zCAz*tGmtH%}NL z!-VFg8)IL;zvc3cV}Hzwy!lr8*x~+NUEf6r?%1`xF!KD^(cIjxG~W2|)QXkgJbfWk zJhT@;^v=5@7(p{wGo}^($O16`WgR2~2-1>i7Z#-oC;Fi~-v~^TTif}yL|P|EsUZvM zg@Z)IhRtl=XK*pBblXXmb9}!CKnQu=h7cfNBGXO0fQTSWD1RXYQ;aB&Jwt>NM4iT# zQUVDkln_cFC4^%njbBYmfYRU0DFC=(Fy%t@3 z#j*ZUO_WsASbyzJr=DhMH%!(sr3+7ezoXSKtlwQb_UAvIh*%Z^Q0tQc0m=>k2%DJ1 zLi1+Nh}yKdX;#QI48u5mwqO{>!04vM&CTskwVpZCZ5T%1p{++=&wOvggZTqn48!Oe z`9X5ebMqF?JUc$pSQmZc^v`cxJ-&L)BH&KNh6fOPpnr>_mc^LTWeXcI!Vsg@dzRkS zGWYgb4TzzI3vL6%Ngj3pH`m6P8}Ho0JW>t65*r9r%q31bTK3LVa&vuLi6U$ZdIgyj zG)>@#|3!BU`MZQu;*~e?;tt}&MKDnMF`a4Xk>$&lFKanCyl3>a+`++~WO_5gAypS{ znkHr8b$=@##VC@PX+6HC!!qV{r?>6gwtaj&lYD;rjQE0e4?TS2gY#FepWM6iiTQIP z8`ihQV3Yv%N@~Zq?peHk&6;c1UVrbsp>yvJzWmbWO;4`>?e$~D{uhClHqX8M9Bno- z5a0q^fH9=ur7cYjjqJ$b|1);3-%T867~h?F-+!5%*_oYPNtWa*7zY}{t&|XsOMy`C zkPreG3=KZu5Sv@T!K4r{7Xv1avB4%_IHBfZb4h@hOHAAr8rtR@{)YZJ{je)pmPAi| z{K4|^2U*h0?mX}F{GPVS)iYw;oI2hRNHKW(IL#E-M^m2gAV$UlK4VRw1-7>+0Yr*B z(0~5Na(t6IQfS%FJx1mEQj6Z5A!GNj40SyH|%s(cD#Dct|d4KX{X}Qq<1)Cf-ir zu_C;(M)NtQ8>02C0AhJ_Xw@j}ByphPYiqa1t(V@icYVaAxl`Symjj5CKbWQ=A~WCVaS z2Y5($1KTE)L0CAM@C4&D9QP0&-N#T$5K#!h9VaYsGM)Jjkg>2jfo9ykn7xEiN(eEow0|udb8IdoL&uG4Cwgex*+g*oAPXh22(<|%6bK=b zG2yW6yBlThkx>9j?G;OF2}DdxJEzSJ5h6k;(7DqmXPTFhKvW^LZPVH?C}R@>goX|1 z0Crv7O0;dDtgdb~A_u}IRHYa&n-mdwi;f+}ep#3p$mGJK`mr#r9;U5w=YL5NiX$RX zkNu6~1fA!a=FgeB{P%PJa;xj!;EA@cKC~f4Ez2r`^o!B+Bcm4@KV5O?_`0ge6+Fw3T7_*wU*o~F*u9SkjGFn@UK$k5;^LP+g` zxd&S725y`3PY}zn;;qPXAH`F%zOSc8KP05zJ z#p~;qA3L<8acf>e| zxLC4$E~ShD8@S(HQ#oaLxC@anH20qNFPJ;;R7XqCmG-G`O}hJY&-Cf@Zrne+eq(+0 z@oEO>A6g|4HYG;ibRJ$ZRy z_N+Ny9Q*X8hNr!!ed_BC>bANJ3?bl z_!8NKF(iawrsT+`(V~ic-3SE6E;^a|3frc+jXV)41EQ^%g#EbTehe7O3;@WZ@Kgve zW1J!qV9XK77zMN`Q09aj-snYRh#@$fNB>R`lz#y*3J~{v;2aR7&|CyztDOCRe??Vs zMeP*Pc>%{dF*BBwe2p?sKhAfK5j(rXk7bi6$*B(?-*leIWTV5gT%qiQk03+^3faNa z_}kB{#~@QlPr^Fbys%xKWSPfP8E28tDpUo^Y*8(>=xn9%TwSQs6vdq6L7>KdrqqVw z+<(eEG3HHX@~qkAO%vw4XKvM$PF!5`hlNw-c!~?@a#uJq`WCJbQVJ=A6hb;uN#VMV zbdsuO(ahOOIZR4NNk=Imr6Yyox~`{%5>jbLNuia{8YMTnbkV!DO1Z*yl{P2^cLj5W z>uI5sqoh>Iky0v`Ng-TUikcIR2fy6BHGhpXt~}vsA(Eqi9~$_fRcWbZ z#p_=lSj6&-(O#f*;A*Xm;lfoW@I0f9=eVxp8R5mGXI$fJlTa$Ad{62Ct;s(P_n~r> ziMhsiOH^NOIi)rI4&nTmn@hw{N=;kdAZaiKh z-2}sg@O*BR_I#<0V~mg~&W!er;7KiFK`iNTAE8W`6k4S}-t5zmF!A(~g-f^XUgP^I zE|Q9+w3`+(Vf=*S1o0rrSgFU7u796Wu@qri8c%zk@{I^QFNiN&v~u^s)rn;KtqIfr z^IxXUyh*C^3gbP~_rC9Y&Uu%6``+Grx_hR3c6yqbVK!hEmSM*PMa3vpF|vpQnG|6( zfGdPTtWtIaSprA^Wtjn`96(B@2t-7Ih^0{ztCFfz@-gy9gZdp#)j4&Z=YRJ+-(3oE za{QPF*$`!o@1u;ypwd z#-&5`Za5Ls)oEwEH0h{YTkW@aP}M(a%G(>(7yM$#q;$wd?UEBB69Vm^aX~p;O46E1 zM5CqDC>_*>D~GfJrO9zYIViOtB1eHSOd@EF(qU2xt-u)6T1Y9Rl7GfSrBO*xnv_AQ zNgIJAlmaP{P)Nx%p;kbIl8}s)hNKdbH~Te`wcU%MN5SEn9c5{{8Z$@wEB=`%ikO zHk>}U^}yD*US752-o3+tK!Aa;z-GbB?XgQs9($y#rS{mqgROnhY;~@^X4d)*iz=%V zG05HgWMtPLht|FH)Yo5L>u9U`?2D82=?T}a9f?J30a(tM#eeN!pysdFkJjYszPf#8 z=r@ZW|8>{qt!v650H6e-C!6-{Tw(0Oy*n3fj-EZb?Un!j?@Di>ad6H2R5GEBiOQN2 zXI^DQ@kHD88^;4>G0j_XD*(8d*#qfBmyE(UMA9g?!du+|MN;d zlH9p>?c=i-EPtHSdGpg#VXPlMw+%Q0lBC1+^_?%j_Dp}@tS27o`Qh8Kh!OiY!&2S4efE{*i=BXbe)P!Uy|1MtAQ@CBq^Zete{gC0i#wkR2HeY6_7^G| z-r6xxtn6O@{9@Nh53X8!`RcyA-wih;!=K+h6Za~n&wuL_q=5`5Q&yh+^ww#jP-k=h zGfz%0RJ0vE^nxoTpq9#CyZ#S_aWNH2%$z!R@h>K|<$L$=aBZX|s>Y+t}fPd$2m!dp9a$)bW<2(Iw>(;gR7A@$#{@I}`pT9fvm*ah}sw&lVUtWIp!kh1p zZlByy82jWzQf9Q51m@kieo{&FBble4STukB1b>Ce3m+aVCK`9|Sbg{Ixx>dd?SFTj zAM#Y0xjMFA0>;CchS)fAJRvn0M>?jjz3cqQ?!VkTJ+ZBB^rItjR&87U^)E*2+#YuwHND5E_Dh4E!5`+SQq!d6v$^v3YoFqpQpad#F1t=K@j>M1zDnum&*&MhK z3?V2uL*fF2KmlZN!2r1c0Ahdwz~&|Ciwi>g0ho_~97LIIF^)lt*-Y4iF%UmD{QYF_ zE8*Il|6I2CQTwnS#LkrRjDGY7+3bElUw^6OwfsS?=lw_1gR_WncE6*-3I>AZKUG); zgF(v*0O+ALD}$okhRm`>zn$}N5v}|;f4{i<_+TiiJ340Ud2j8Kp=p+7+qMv(Iwwy| z)_R0BFK!;Ftt-BHa83K%LO4?Y!iJTr-*`-m)Y8GFTmJN%(c#;7uWs1;bR-L;Dt}fC zEPHj^6D3U95*Dg>|Lld&Z&~VldS?F=;aIldL1r@`CP2G&>t0>@=!!mVoSKI2l`k!6 z@2_;jRg0HBwrF6Y#PHzSfq@qmR@FwAt$cQ1&7-p(DRfQlF|L_0tJ~szMO97-RDvHw|?r$t6qi$x}{JuhKRy&d2Dg9m33(^pg6ePHURHAXl+^Ictno;@r zrn*!-7f$)w&2;tjHB87lUZ$&OdeekjWBkh6j19m5Y!D0pBydoL#@6=Uf`2iIwwCUu z)@qUpCD;OO0BK^y_O5JWR_R1jv8!fWwKS26d^NezbXATVzq-0mI4yGUOb<#lSBfD3lxA-IxU@@AAa~o()Xj0 znBzoq`Ftqkk85m>rz^<(pMR@!dy(v_!uaVrd#&&L);?8T)7{fubM5Y#zRXN|?jgb` zi9^O*)c9aPLNeZniHR5?l3-+rV`PX-CS)>bh?!s{BJm2tBq%ESqA2D?5TByHNz6bD zh<||(`<$wFpdPDgSDn4jx7OKveZMt(VD-S-+6{x5(YD2XM~)nx8Gmm7_3y48KejeM zzq>!29qn8?c=*uF%uJ*CAH8;VdN9Ab|H#tnMt^RhKb%`x-M6^1(hL_C78aNH9-Nuq zy|`y%ef`Mdp7puW;(>jK_pPqa&hMBTEzd9P-ny`JX6w$?{YT~(cBDFf{>vA4>|AL2 z!{O}wXxpynHzq~DQGfJ@)1&33wQalh%*@Pg-Lka2xPNxbXgHi-TwEWGmh*7y?!D`K zRyJm~F1-4audnP{8%%EOplE8)B#$T%21bAYf{J2HDStP4f_jb`bO?-c25vBj z$;)o>Zi|aJ)Cyv5(IxCdCiEUfp?F#@hkz zK6%hA@rj{)+)BU71?5gGlQf=PgYoLzy4)(aK^29=}9Pl?Y0Z6p<8AHqxME1j8B5K&YK8s0;^+5#|NuQI>~{GN~?O0pQqL z?j&kAlZ*i6pgEJn;O;22vH~UpS(bO}tt-=NHhlg0t+3b#uLmccIE*~7-eBZ*I z4{G1RsnPw9UwgY++ep6WhI`Mfe)=<(V#+`GzHdBh^K(`2rdytTv0mHTgFCIK;q-w= z?tgmy$46iL{s%5S*5Cf&+b(`LtsXw{$jj&d_4hkoxL9HC#G@BaUiwxd5~F59EPd#y z%X5!C*gJl-(!u42zV_Ll{;HZD9X@7#U$x6O@*YIqGB--HwEV39dYXn#)Ev3$nW{tkx#sW8P5DvgOGd8d8tm$)S; zIURDRDI9V*$yQ(B#l6%z5zq~>2`4o+tc~l+OM%yBM3uowxEI=H7q!Z!u~>Gz$BC{3 zZdP|T2a@Qpy`=(uGxE&b%M&jEH#0Cf5@|%wt%yqzeFvR1Fo8guRVBJnwF40)Eq@1@ zbB3Z#d7?42mc1ky1!Yh@hlNt8P59Lyf;n7FqGy$j07=CHsvOGU1Vcq5a+8a)D~AI{ z7D;7@Ih2FSHJL&tf~}rT0!H_ONJR}I=b9?P&*|=hRE&r2a>yZsAQp`%2||(*WePBo z0nBY|E1MU^zgkR-WjM0LvjmiR1b+h%nGLMXlKW)dy|pSilnk|d8>ii;d@{x5orQ-v ze$tuXczu)6Ax(;Iiu0gq9T9cArEUL*b=Z7PF*ZK6y>L@6ZEAp8Z!)}G*Alwd>s3?O zQO(_R`Y&&$Pu%nVmtNTa@N-LFdf?1E|ET&^#X+TyedXF;r=r<@%cG~RTz|RkkAJ9c zzxC|9Z&i75N_U)l_r3J^6V1a9I2=~HhQp1|9eVD<^zCO){_v$||MTzaiStjr{pTv5 z_~tu*s|I_Ujnk+9^!sCP{ATeBC+m<22`i`0UB+D>uV#+;uDfsj!PE6%Sn=jd@BMRd z;d`IF^8DbyL)BNm{mg&gI)C=$`NOZgQh)wTwdKTxYj2{d4cUY4Zfvb%V>M~>NwX54 zArz@5Y4EDBZ|Nk>QJZ_G2xBuNhzWQO0MOcyif75KZso?uADOa*(n_W?o4DwJ!3=J6 z5bh2!(Q8X0%R&KA4zB8CfB;!XOf)m=mR->`?C8&1{pGuHym!kFKi?)~c$)=j^@Kv)0<@z3;ui!0;g%iDQNW*(F3JFz=*XH3KOk zlt{-Rpp=*hZHzH=%s@+YMpPOcA#0qnCc>;Re)vJzWY&~ck}*w9+K+zpx0z=8vGzXi zxsZ3xoFDI;x$imW-G6KCXMH^nd{8etqnx+vjGMQvQ?E!(82-`_Mj8pUgy(PgSuh0|6{e zkEEg0kP4+qjDKDL$0aCy}-GgDU{nIkE=89JOdq?RwiQd$UI}_;-|Xfn}w3IY@~pi5!l1n>=PlP zQr@IOj8vVIu|m_;)>^G9&!MIb2wGO>_a^az)k%ZgG{r`aCNxe79L z<-8TeJbRyij+U*mOO5NYtMC}d?}W%pECdz-%8+%S7=$Z|fug5TBSk`%ANLK&DRy1r z$^}sB5EvXvGBq;QrGt-3Q)o@O@2;wA=WafQhJWW2PR!H!cv}Bbkua-3K*DkIf-^4} zjjGHb<${_#=%Rq=zJtMTS^><;H8U}wnW2JBYx6$CS*!QlSEC9^*eE6nX=KWr(ZCGL zoTCDYJnO1m4_1>&&7w)_B{mJlF-h#tT(t9nz5hK~rHWIsCIO6OQ6Nns(^?`7P>6zs zV1FEJWbQ@RM6uX2GgVQf6nWOgpV|yC_eQ3if5p-}wgjcrB&f0}OdyCH*^G*Py6FaX zEj^}uCbR)mfu?S33dzGEf*51Yw{th>01Dkl>DA1uD$80ik)R&%(&b@)2x^XzBLk7B zZNvy3(-x-Rm^J+}osBncK+sP8x;Rpx=zoaD^>V^McgJ-Ikolk`7YLXsGUxsu5h{qu z?Zk@?1B6)M9tq%8#&Q9-!KSGnZTwGQ(FuOpxeQb_L}C$96;lF}C~JzMq@u~xlvyJo zLYbAJo{4~%M*&&YML^61a!?5vBzZE6RS1X#VqwviKp_XtHW-KZVyb7sh~dRoKz~^* zg3U4mZsulTj>0TZQ53)ugaZ%Ql3Cy(iPvJqldK}a=ZR2M&s;?U?0v$%EL;7WNW{qX zmpXUg!F&p-^QWbP-P{K@otclDNE zIJ9)j$|H~Hl^0b*R~-D$n_<(9y4@xVwM)kT7MC(aE$9#xt9sW^8HE=H&6<4ZnrtTT{Q4AWpDIez}!BV zaScWrK5e@jR0_RYcTjm)QYBE>dj@}^`-L)||_z)aWSn3B}EEJigSSaf2 z5WLqsP?Q48MT8e!Tyr23>AF-769mjT z&yvqwjmpATm}mNPEj@y|cq^2RZK-#H)q z(N8~l;+VdFCNl|y(j?5k?xqtzAA9=IYHot1$W%A8&b|GsAAkM1$*V7xnJcb-{>U}Q z9;$}tj6ZQ_l)yCm`WKI{|MfE$KK_*zk34n5?~cA>>zdfSbAR@R+t$B!BrTj4MHx&w zd-2_SS3Upzl}GoTbH~mp*RJg?zii~X?f3rc&>+4)0hAFz|cpQoOQ$IdfL>{t(&W!r6udfp4mt9-!t>p zyXN1wYucvO)PI~cXUClv9N5{LeclJZbzsrKyTjS`C$ z=zc8}wKM`M3Kgwh%%P(Y=3`r5bFD|3zj%MsYC7DY!O_y zj&)*KvMGOe&gVGyxbs7#O^*N|goCag&!0 zI~#r*(d4W_CT0iZe|%lvi(OY0K70M#_uiRICNnfOK2(|-YHF~BR>VqKYAK=5c);eeI zj2-fjnYnZ4%sG3ny}oa)^?lxi6@;`!vVhcyRjl{r@Z_$J`iQZL#jx`hO*re$!T`~d zp}G8HNZHiblp-@SJQwROB3n>rWUtC)K$QQ%1%EW*GQb*`)U7EKoHg^2mEjE*NhlJj zx*MkrXUs5}4%`N6jbiR%s&AyC@C6R*#%(DHR_5453oqTRQD#fSHFfUp-JF$K*-YFz zn+~s;~MBh(np9 za(^aG72e(EDrN?>?l?D$U8Ec12i0b?g}SRdtE%G+H|ZuO0b5Yd&#_eOitboU4hNwY zUR2=_pfcLuMIBwjqPVmvQD$qxb@GS7Zth_WCaCHl&R%J#x(sWZZ_*E$Kn}* z;gWhm<`<*3sktPrEs|hX6$1`K?(JfNg5q(DQ9SUe97BtsTFW|u!QZP4Op=sVnSW^# zVlJX;UQY>WA{mJkSjE&>xCyryZ?PtXg@;ee5CVS)fe&f1PB5fj4JmKoroOWn3(<~v zXS>AZ4tjGum)UGpX2y2x!Pj1y9lqVxH->g-<$ry5ec0#gzW4Bf`yOo6x^yxlHy#e$aN>!F-?%dD z-nIW@r{DdRQ*Ai(* zj<7xQn&b9>AL{6rJ2l5-6{K^6#`LqfnL9Co_XwC;FBYb-@fNA=fjlB9Cx4#)>d@{D zCX92aE=?C{$-*~ge^hEBIYf3Xmd^jFd)-#p|I%Ea_a1jqQjyk&}b*jU=vRh0D!} z$i1toc5kLb5=QFgs@*%{mw%d~phMX05>|0dMY=a(?H;nWs?!?3bq_!R#<{zobUy0? z6XF**vO-&_NEnEcvf{(tk%CpqgYUYUXxP_~L=G}0u(edu&`ekcYE&yNy%M7(B!fal z6VAD~k^*T&q%!qcm&{yB&2{wZWElmsvi)S#S_6ARJ9vS-g@JgD+JC2y&s?m#&sS6r zKXB=VVKxja$M65sg<&}M(A5{452oH$uD|h%k01TzPu}sJZw~J~`u#Uw7*^+l-}=Z) zuWUT}#AE+@by&Y+{p?fc{(W`0{luA<|G4+--;nnnK!@KjyXgzReSWy^&Ts$Y4gbKg z`=9^Aoxl0rzR%qCu7CT!cg^QM+W6o@zkkus|KPj-y*jK88s$2+oC*usAG10n8;I_l z2_=(Y?A=AXFGgMkmWGWQzhSaryg_N(`f`RwA03(OP5oxPRKAI*~H&xcfLP%v>m@ zEcUSGB15#TK`lckVL^LzE8sQ|lT761W4F73EUbV9w3wAFsqsS2;+MfTJqbm0*(B6L z8OXx%cB|DOt9b7S)~M*=r%=|BWHH3T;T;R6yCYu9Bz>?d1*U;n2jP;*R2>PpEt+$# zktdo!4ZaFY;D27GCs_k*$xrKLn20U)Aj-T0+U)hb5DwHL;*Y@s&;hcCnd3q(!MeBRC@1m||LVqeYb6e~g`Z~|&I^V^!W-@oq)Sc3kvYtAt5)&u#2MnnR;+A%%X3k8iCKdIQFNkL&!U!=Y zREb8;GPKrMqzTp8BGsXstVf&%I2$K3@Qqq*B#!*E6ggn)RbeT55GS?|so)`OIfI*D zj95clD}O0s3PZ`8fL0JaCFgfr>Nkvnufk)^Xo9FAc!JwfM`g$eSLz|?;xoKCP*nxE zs78r!!97vX$&fx$GoA)SMTAxqG7;RfFDnv?ptqyv0;__esxq-DbvJcu2nr(82d$<| zq}$8$k`wDHOD(7B4!Ec3co*-MdS4O81F($V&3_F5QDw2ZZ)abGo}AQbC*gn=WlXofV6Ck@+FJX+9NfCGpcm@cQ{J0*X%CetSu4@x2mG?dn` zFzLaihE8`PpmG%^g4R2v0O|u(z$HVLC4c=VMjHzd*97Afut!Xp-ovSG5!5J(|HHzH zLvT_Kiw8H6R6%l7m?%jr$^Bp=p!kNMIS@7Yw$zS0VZ56RjDVsyWD1HqSd=VbYOw}vcgjtoCqi0&jev_;{kGQy1dg5a@&@}hN{eP(- zUgzHyypN72MFdBa+vqsWCJle7q)?M8F||o3DMy-dNpNJfa3ETW+U`HLqkitt z7UZrp-@EUgubutdpFe)_XN%*XIDh5!8-DcYnSWkB@$7TgJa+csH(z_-Pk(;o*Uuck z@Qa%sKiN!Gb&wC9di5{&UViE1>wkaclc#U_)|pe6Uf%t{>6@Q<`tz4A-gEJ}bAP|G z`^g`k`_JXp2eL_(q~;Ft+%_|qkWLluTHF@Ju|MUyV{|f7y9Q3N4&=r}3gw(FlA$=v z8&hMBBp+ZwbDyh3tt2_E!Xv6<#EE?}VZY*0W%#cxSm}L5#=4SfB8vA%S$}8p8$pcL z7MR-022u0k?0T7hK*M3I>$4-$JDNRvp+fPWozvj#t6};A52+c_k5#z%BC1tldaz z$51I|N_H?vEnOltMWkQqF`4>|{Ex3|`SG(V!{@x0bH3kY=uA69ZKWM-hbb_GlvXqn zZHy>t)P<1>Q9&iOB;JsqEe3*$@e)kjXf!VBg5aWIL&5?~*r-htyMHkeYC=p!@U-i zlFA)tue_9MnlHE49)0@zZ~yhyUp#*AZ!R1>dv?!5r+3cWE9iL|jy>?&3wi&k^Z&Y> z=EuJD+MgC5Iez>rUw^K5ZKUDk1F!ty;L|_)_J1yIKK4nH>|{L(%3YThWAq5gMknK5ktk#*Yg5g`vaLd8FM-UV$khcMHY;4Ttsr6|;I=?jj4kG? z-}>*zCxj!=L?8)`ar#rEUjh?M<4Wy-$fXdIcz{44*L!i1 z4U+dWRXHyv7JtClFNl;O#0u40sgfkz*xH_ikBlH=W|tZDJR}8pr&^40j)UN6S{FNZ zwd;0Igm)HE^#VD;Jc}p;Ga+MUFTe;(0TxVAAxdD0$}+)XpY{a_kZLVvyHd2KsExVGC?U>Upo*sFHMD42(^nO%o6S;+Z*>+(uVM5G6E1NIAVQe zHHRvV6f#9-vPJ`?2r`~Xb(v&?SVdLPIEVfj5=1+1!&CjHu^p>?A!24UsND4jA`;*A zttlnf?(QspbIy*qXYA$RcJ&0C3jB8zl>{>wYJVwp;9&*kw=B2s9B47zcw%|`sbN?^ zAtdIyva<8gBUk^t^WsmT^1dUtaa~oIl-Tn8xKg|!{{F!fT-1pIpK!q}gpulZjBX?X9LXeQD z-Zy%Qgou!{(iz7OZxm|~SpnCk!5^E8hS3^;;`@7Y_HoYQN20Ved8=bb(5W(LY#HcMt>72YMGi`e)2B$SX5*z{sp`y)S~gdRaj%vi;Ppn&aK79nY6Bxi`GmNdET^qD>WR0~+bSgD|$|5t*XmRMK)92P7 z{wy5%+C9%-_}*Kur`gH#|9%lmPL;|~b2*;Y?!WW*7x9aqJNu6-c=Xc`{_(=;S6@vB zDX;9u;l9VOzL6FQ_I%<8|NZ-ki+>ky{o%Ks{NLM&A(i(&{K}=RU;XURbI;-m;lNaD z8b0v#H!kBHXCD2_%TK)d=K4>bIq>8YX>sD*wYMI-b|o!qqEDUs=cSak&j0Q8w100d zJ0Jh~^V`3DZvCmJ^4cud;y@Ga4qA#2&8~r8PQN5l7G3RqIXyg zi`6-+(pyIvz*T31;7uYq_0D?(y!-%BK(4=WJ!psVW5SvGuLLDji0b1VQ8ISUvGbbR z1a%7S{%?lhV#RiVVB{MngUKxxN2Cedcu;=ziruD8Hi2UT0G%%DGCndJ&(I+`W}my+ zUkuDT|Io&c0`gt8p_`Q(jW*&YsfB-QsbGkcK;oIHM%7!7N8CPDvwqe^s%(@cCpx)2 z5|!eWh;YpO$eilxq-tsE1rrd)lST?hTXw@i^j|ZGtA%@_1i3l3jIHLc=S$~*AlmtM z41Fz&a3)n;sqg>i`_ChVC-T-wSmV0@=Ogw*+GMDEI zq8V4N%Y86xz;cZ$m*oc5J$Y8jd@sy4ur8=7l?#SS^EI69sYAi}4Y=5gwPGDW^s?ql zn!O8#)m$sh=QQl2`HY5DnypivK~YQZ&QOhm$@FygjuRs=hg!%`n2fE$mjYW9x-&wC z3`{b(^-5j|?3zHRXA>bhkja0Rv9rlCdyNry{6;P!03aoaXlh{=n8R;d=V%!nTe<=# zLa=g~9CI1@V1{_-;eZS~_Z<*K%vn>@NLd>J-7B&9m=d>@lQs83@v$V`pe9a^|-V3T(wpN$kbXVw^o0aWjtY2BI}(| zJ@-Ht)^dZ;>t+8{#w#+W2~-IsOamcg@Y@odugCJ;=(K%ABtY%{L~?C>ta^3==w#>$ zkj^W&lhKazofvT%y)7k|fNMUBP?74u%zpeCboSX9v84dismX*4< zaB1&cIZ=qD#U7e?Oh$i5)b{s855RM5sRaRrDLoAqe#;xY8oB@-cD5XDq!M{=DRo$; z?uHia_Oq!}c-gE{@1X>Zwq0n%FjKsHC+bP;Fjqo3jyBTP z+uv=J20e5RIvN52;y7^o2NiGml$xE1a2(eCTLSyI1VBN1?V^7YBS91V@3!%DYpKXm zcY^GbZ!%VN+pZR}vJ3iKWc0yysTCNpP!0pE`2TI!PR^wSW)QQ-;t0bj>Wq-vt!_&g z*erJ%;~{orDr*8Dq$#POmB_=SrKrgF#6!VGq#C6b3&b4oFTmc}s`EO02Ord_W9XEa z@3%4KAyX|-DEoizys}^{pxC^#5F=>MCYdTD#Bv(coI*XL#`6Ne#zD1VxZYib)4iyR zhOh#C#gsTr(IVRofI?Enkg>a|YM10=_y+`Q>;VnW=UNhEmd`?-Eur2_E4V83iYq*ts7=H$$?|8|)|H(p8|$#6zk=*`)DqOugkE2?7y;BqZ)ki-t$h%>d5V=?V?>`? zBk60zZeV}n8VKF2012<>)h$(p)U(|nxwDaj$xe{*Q)Zd!P=Yd8`$`@N5q7;I7J&P# zCHXmGND*DojYiWbLt_$y^~`Yq$-bj4?X)b;_{t29T6Z4X@hPBff||}-6;TomC@{)4 zI^`jhft=7oMI79zC^m1_p|anbWIS50@MVcBA;^DrZ`|=w5MGFLa^ZHP55~2EVS~(l z6AFL*DmFlrP|UvBs3LvA(h<3tvS^sjaK`|=nUcoNjYUg zN;%0r(@)77_G#?s%q=^YU)c2rkSNCXY+BVQ_ z1BhS&r4K++1VjPJ4Oq>HP$}d8`MS2?s;+-Byw-nNYwxqq$@PSggoKb78K4c90to`5 zX$>s{C}Kfq2f4H)*qQ(xTCoVEkyZw);#8+I=+um~)sB`bPNiO`c$u*(P>Dzpm1dj{ z1A{Y;Pd@svE_>~LGQQ>I;M1n_6uoC3K(Y57Ivjj5iv3dU?kSUPf|o|%Nc(G zNwCYo6e$3Z#s-Q`^MYRWz!v2))Bq?nN(FzGnQsTdP;IsCZpp5>Y`(=Xe1QZ&7g~X? zWi>A`f<1O7Z@{#p4n@Ej(1$RTKO0e#u>(j~@i^=Y3@{Wv>QbgW7p02HP;i}@*MjyW zoW@naP=?Nq%Fcqa`j>PD4BK+15cz)!K^f`Wfn3XjgbrshG_!QZNEdFv{!YturpDSE z*dVl0<^c;AfO*VSVt%!-$K6z<06~C6x6#guDiO0A=M9w{>_qkLiR(u!g5xTyS2=-W zg(1WT!hcSgofv5oK!6T62)WC!BzX8ETU|&ZfP`>~eA+f53Xqa4^p-a22{;Z z%}q?T#jYM|X@OWn)Lu1jArng3RI}(Ffn?@F)EeVOyDwiZt?J`)wV)YI_kB#Vl2~r; zTaQg`QFV92{ZDiZuHgb<;r)Ld>o$^+_EQ8}0W2IGza|zg#JHrJ7EJ&6Clo~uvzJ!) z+*_J6i;;;@##%S5`0T{Bj!$pLriFXoz1F_vVJO#uoI3k~eR@`x$#6hGVA6H-=ML?W zN$s73U)uJ^H@XLQps4OxKQR4)O^T}9R&SlZ`$^s2&h>M8jvS3=&y;`IG;jFe;)92Z zcg$>Dv}WnCQNbu8CZ&;4$mSIXPmJ97o2ajE-LSp?_%}p#&HTa9zMsD;NUa!tTwvU> zVy!6E&)vRf>G3a0m6T?Fc+HD1sLn>CssP69!aa}(o{mWiWcGfV98UoVjSC@4pUEGc zOj?qI_xz&{0XLMLuBCr#xF`8P`3c_+bTaG|ChhPmXRDmT2+{A~6O(b-oDlS?dLi^Hwc8J2(&`A zc-O`AB9@r+Z~A}rX@U3bzW&!o{yr|m`!=6BCmO4pR}8f6SW9uYUUy*iZ_Z4As1KNl z5L6_2@xIGfL{(H=zODD@Zc*N_>bu|i%++yG%b1keuy>IJnlm&$E~-d~d5^vO7eVue z-ab2g;X=*R2kQ>(mjz9lF;Wmuqh&*LfAsyiN4G&!-=}}xd`ZfNwO<+IWgqN%=$X3B z8@_Pks;sUP`i?K(m=OC9kKTHxYv`%Li|3ZSd_3x0z3bAiX!t4W?NNn@btIC8O=r%C zuI10%x-B}pAN|uQsGCYvwL&iV{LSkksprPNtyh0H|JlPGs~=wX(^G2rknCDeTJw1O z*o#ZQIii15sv0mC#>TSQhuA3yvRXKg(U7y!K*bi(Tr@_m%}#GGPFda%e5qVVU%8Mp zRm21*PH0y2R{F56I;IyVC9pllk@EMh&muoRA{r7mw=6ZcvDEIg_v=b+B#=jf*;7u2 zMUqbXT&WVw5&Y>@U}EhcHZQPIEX^+U+;8Q$LhFAL)CydXnrkOXgy0C-&o2YQ4!y<9 zQNrN`4YN@^TNm={!h8mIYvqAku=y#DvH*b~0<~`CEs>ke1=N%&ZqmgXu9+@WyC~GF zs7R$&sarwSP^nWy%|aDXF(81_7?mJy6I|wE9Y-ZH8z*XKNY#p5lBKeY+DRuAYfM^2 zVG4hdwiZ>BX;Nqss!YWq6sJQ}j*2lQjY2nYF`-h6h+BlN!D1CeEt0BCQU;oB!G$8K z7?e_R38HC26;xb8l>nm=R09(#AQeMgk6ep|5-P3Yg5(&JIvLebR6v&(51N6?po#9oWmIKWu_|b#BZ>+TkT<143yv*!^)#mgmT{RESy_+$nm$~P=R3R}>O8Jr> zC7dY36QnXE!Iluz5@Qu9O=kZC*C(+V`nsJ^+k zj|iob7}YG=`lwJsYBCu(7y*bW{iFLONv#N!DomNvu;fmu8G}3|N=?Zs_4s+AXI8dv zKay59Xp6|YdtHEqzra2}(YT7NT+)%vKFbdk3m1FAN~0oRKnBv5skQNFWVL^rCRRFh zdDut-r3gv6+uDohoUEH5#Iq|#fKYm45zVabsA3+OL_HlQUwEaQy?L0id0eLj9HZZK3xoAPUoJds~(b^tOP#^kp1u3j+wG%r?ACGKiOo zxd9<12Q04S0?qty8WM-oF* zc<~{+;lijM7^UCTmHmmsOBUimdEg^(nRMmeFt66rY zSQo15pEOfLyh}Jdq$z(5WVM`*QMR}nF14$f@z|$Ef{A)`M~t;lGpC_*Zh2C;|BYR; znT?f1@RqjFb)D8Ua}^mefEdl?XQeQ!J~FR2ScDDZqC9c|G6T{1W6OjpgsE{EUeGC$ zDvM!`GYX%a)YF8SF`-h|V0@do`WBYoQ04JIzRvtPisOpoue*O=chBs7A;IcoS0D+5 z039G?f;b{%E+H;KgfURuSQ09eSh%?4fQc$LHWdzoO@KH>C}S7KRdK2e=5PfRh$A0> zAPC3iu;K!{NXq3uAV2iX?CgxlFZw|xkal+v8x0 z`)f?x9Z!F%CuM*1aaG!4F8x)y0Sm!HiS-%{JD7rsn}57v0;bH-0J5B-h@7OW2h-kO zp7OO?;htLL0ZbcUyXSNcp_Y1)R)K?v1i+4ubZbGa`-z})T8ysR&2gW(Qx%{-$|=5*13#jv)0_Y0A3KDq0#j_TEFd{bKwob00n=e(hFK`=i|POKXi+#kuy#l zhB#m#CpvL`^S{4X(fc9sgfbf2=YO;hcxcJFE4%u-r+xh9pk;0CKivAo^>a`#wyF0Y zt>1M)-iZ3k=bJt~JLSZ7jsztWo}jO0NlRbP;?LfPV5T;vrKS56)q!!fQYX!>szL*^ z*)+{tPOX1{rG!yp;tMSzoT3n0_6<9d$1dSBo;DM1&KOne4vYmriVkayjZK;vwb9I# z5yn2GwEj-(R4a3b)h|#lAyuf`(itQ3H>GPFIdd>#FeOM$>%$qnRciN1sxxC{{*F$n z(UnAQKB?$0vQ)^-I`>a(NiBQr$RAGNDj z+>LWbpA~Ii-SNWVz;F+S9T3TWQp+dgEDpJ?-2ucH0}N88X^e9T_5n_qB1V_mkLqdol&@ds7?%|7B_akMLOG!B~X+K~VGESo=F>pCnSJ{7f zzLBaj#6f;{+No`AOJb@^?Yukd6Qr&+eU`7+{r{^pklJFCQM0(}L9+%yYk`Ix1Zyv5 zk)e$^?M$*PFKCK!f&D~;R03j)<7ss`0C^G z_g;Z0C3HZr=I7qLLDAd-u7E^V}6k=jn9}v*q{l!j}&*bWsWVU9Fa@Zf;F38n|1oob6s7zEi--DrG<+Y67C5P z9~-HesSQc`!h`fk)SH>$zO2&L&YX^R63^wq!KG~*F(ZP~8?LM?U9(DrMz!7eym-?F ze?j)}IgOOb()tE1n$Jtd7qx$^WKzV+YKody1JjbVvkMll2$qioh?ci+&#SLtrh}ey z?#&ugy>k}?LjJ;;8y|e_n>3etJQNXyuI`D4I%736TkiB0{<1w|%Fh^$RQ&42 z;&m&9+6yC)AeZ66laC*cRg_h>b!_SDdHU@`Aob#9&rLkI2V}5x)%t(Z_RTqsvvnV&S+xSGXV|)plMn76*1R;3EPML+F)S`(noyxf5^wnn+m~Iwl+iT3?D-d;+P61% z(cDPI_=R8m72>)1<0fl~LQgDv;H0X|G1KP%Rr z=zbcpYL|dH5^~t^?WTWFyDQRhPRz7|xCi9MBwiISE|b1PO=Dz&obe~yrYxFos+x8> z!mZpbrMd)4s4X2JhS-nxW36D!6y~7=g<d#yPF95A+yZbqK%GdW^Uv=r~xc7gLjDKe@^$>;uDl;oSoyxw!iHvFR5tF8S=s#_QLopZ#da(Y-_W?g>;Z z9{WmryuLZHa{B1C+vD@90VryMBL^*O;i=Qwyarl1YxLp$J0JH&_8ysfbboXAH4p>0 zJiI%ob#rh=!`zc+*s$E9<-ZNjssf(u`0g(LrgO`KYo&i%JA;i=m>#44tksvULQDfF z-t_&q5Ut*N?`q|SZQ;5~nNc!e{4=x9p7d?q0mG-fbnhmF0yLbZW!L(5z1sfcZ4iK5 zXhMg`=x45+fk5@zo96+F+wT4oq|Oxam{Uy;RquNftIG&UwA}j|_~7=3H!BYxP5l0V z_odws9l(DWMpTQUb^i1SUfAYo-as@jgNCSpxW4ELI4O- zmfl-&gV*gCV8_$%_`bUjl7a^lV&91598xGTWI8U#4Tx~}m2I<|G>5L6#c7|ugP{dA z{3s-Sd`?^>db1U6f;dbyIk9Q;dAiotX#_K;zmC$zu7-#7%^OCJX8X6!E-WzwEe<(? z+i-u_uXrDrWST-ZXdWIa0#BU#Bgl0TjDa4)&=3;HB|=l^2P&AZuSLL41R$7NUBP`U2nyif|6`=Mz1X_%n&WfCchY zy~7ZhCaFIM{7I@unLkWCBfNn_kCU0ec#{j_j#Vf z;dsswQ4|E$m|>R0q)`+QleN*yU{JZW%2K2nF>21GPMXc;nk__=T8kR4{2`lLKa?$L z$MkXIuRN{cyis_jTWg=cls+&&zqf_xF1JyukD-)vs0K6?FBE?Za8q4B*nYZm6LbblA7qpJ3Aig@ zG(W7rb=ShFoeRHIn>XRG6zm*zy+`*DIolcPrfD>7`w?18t|M!Vo3ho4 zAER@9H>Q4;Y_IIl^|LsPdjq~)An(l>G~v?SRlwoHoX4+YG%VJta2#-5J0xZ`l;cT{ z=Fpghj(`fyDt;3R^cP=&VPwEz#5$*D0SyUI3>m6%t9jZg;JFMtFDY!5T9_DG3r!Oq zvmjy*siLIwhJ_D_IO1M_qf*u z+2J8oR)l`(#aA#zUropfM2VV}6Iw(ldi5DGD@Q;xeeua1~{gI z(2zz5=5@)wAo?wsXqOG#;)gjC#))sVoA65^8 z|ArLN+!Yk6R$b?AyS`iT+X{g?t@S%Zx394nwH9kHDg<4$mKc9;_>qispabJy$>!qNE2&1VU^KAD1btik8QprBqf#O(rpp5z;4h=&9q8 zFktskM*gK`%$u1+kHu1zpJSh!+LQc(6|*H)@rti94djdb0Js=o#7{8;X^pA6254a9 z115Tomy%EVj6`9GXoB@5B~8BY6lcMB;f!FmkknX{T6)%PD1CpMl1YuF;0hR)*$L}e z$;W{~o-lcIcx{~VQJW04-MG(~SsezC+vLy%%T#R)1H zWzu}$@?X$;V6_$%XIF40MO!3J)M9-6R82s|(@)G7#`lk5J;^e}3?x>+e5WJWwqy$W zd+Z+K=m!#VUq^on#|W^>CJH(rfY>U!Mm7pl1hLr_eF|&J!WrOrC8d-Id3>5%Gg`Sp zM{Nd_e&h91ELM;Nas7C<5z&NScoAiSzFFkU)_Ef>CYud&d7J6r;D;oHozo6KQ|WA2 z>@nh2)TXs$N+L%3*?;Mo$DB+jOtHHKA|3QQkPA~M(wBel;WdL`2fdGSuAX=$^||3H z4f#$WOu9B+NvM%YNa~^UkzQdIg&_23IpU6AulfMh8n?BZcasd=EU>AZhVZwR#~?%I zbiK`GHYQYmlB|2i#Y4k}1-)DoMDesZb4895t7$u2gjMXD#r?vSrFc3?aoj}T3}EGd ztw+sQ{>^{sY2+eivd>~4rnp8WYqVA}tG7Hg+9gFO1r|H!ymT(t{;HKYYFuUwzY`-U zzfsd=)5O8iJ~;^BCNGH-=Zd0P3`R8yQ9arq*T!6OqRWXW`Ld!fk#R1AIEb-eFkoId z6HI79^6+Y%EuCvosM_QP&@Y3nDVzXXmrxWhP27J0uV9;C1b?OLDWgEX)mL0Zji!@} zS4aj5Xv3z&93Kj#oL0jna+%y3=tBzBDX*!bET+~qKOGxT;x;@8UvX? zV3Bhi@m_yOLR7f89Wc&}3579B&V@4S*dF)`?^Kr>Z{x%|@)YE%jPK&=#v`c|HNgzDbya|WO;-hH+hYf1iQ(-%VZF0v)PRS0*C{WaVI;hCXrJDBAc@1O>Jk*OX&JQ zG%MI((&@|k{OKUp%H&qvp#=?=Po-T9Q`G*vjseye%xadV{qS6Rv38g3vm0&XI z(>B3Ai{1QnFWD5<5|dz2q10YKg%2TFR8A9FcD;*d25d4FK_{6`Xcpl-MqYsm$~S*4 z^se|z3JSSc*LgE4R&5rbqv!z^c5GNuPC6(=m`J}Epz#!~5t1k=GC*o!ZR3@PqoPuB8YF)gJlvu} zb;JcAfH8?B$bs7lyX`$avu8MgW{p4+5c8FYp==KhvA6QzTCTdrb%yHxHm-755+Kr& z3x@R_!nUO|4!XAHG;@wW9FpY*NG6Jcj;=~2cDrmv>+ufWPMKxQ|3YQ$P ze4K1i_9jL6RuHIgbs5s+m*zPu(+m^=NEG;WF{?Cc4NhrLYFM>(lQw7!80tq?T}`MJ zQc|zullkz2R|ZY9dS{3%z-W5SbwC=t*?>hbM)_MFDQ<8Knts{M@6>+=$fCBB&7ZkL zfkJCNOg^k&j5D?;L&lP^G+c3wSvsNKYBjU%*c0!5@Ghib_4aLO4N%ewwt-lje0c&e zzp(z~y_M`X0nm^&R!6m)#56P31`bYWo#Qa20&W*>!s>=WDI;9$zKYrgrsR$`@hHKB!sr33Z4x2h}Ci zLhO<#+E{a?ADWK6uZLQzus4x3^pOf&2gammM!Y)!(va!^!XO zKJ}=AwGUi4f5X#{efE`K-*EK!{r@<7?Xd&kl<6$FUeVmThadm^`Db-E*?Q#I4L>+~ z@b$B_@}>_h{APdK^FO1_?>Y9rODj(tUHiya-txU4?fLCbroXs*>05VfdgiIA_gz1` zWzU^2zjWKeGxPhmF2DP0hu=J-#_nyO_|oc=-~Qxl3u=7jgKzwO>fu8;Xy=@lr(_cR zHd>H?NurP@7y~l_1VBSdtEADJYOCZE1c1g^&D6Y&$9I2~Sf1>=9z$56>|f(|I8&?4 z3}S0mYzpJzR>Y$^htv-3^`NKjlNZwp6tub~QLR3mP3y(_Qx#ueHE|SCtftuUhE8l1 z_yQ~UM_OBBVUgK{(C)4c9@F@lHyVmp0ab^~zjF~gxCDXF9*?M*0^lFVkq8X?&p{~7 znd{{Vf%SjHO*E&%+$X)VQg*WC8^`t9Nw;F#dmleCZ2a(z_kC>N)6YKe<{#em^l9syIwurzyBRq9sKIYFP`3b;>h@>TW>tHOFL4q;_!u6 z?z{N>(%rkieD3_6uP$8sg+038y!THFpT6{*a*BV*k|m|Cxc%&3@4fWm`o|7m_t3Wv z{OiyA&OL{3|H$WFJ9GPm7u5WkT|YgJD>m(X@@`zV{lLG^?Ed`^S8v~Y>8E?PfAtI3{DqgrzxsPsWh3?M zSOq5Q(+1OO;Wdq}$*iqe14tJ1UC-|!Wmm)wz)MN&#iLh#>i#@Lu#0)*epN@ zgV9~VwbO}#xx8KObdVcmkej39;fU@8p-|OK;%|*Zo{dI|uC0#_JgMMR7spK(>FE zGy&r21|xWtR;UT6eMdiud^XS;ks8CvXpFY6J)?32AZBqHK^NHr4(8m$enZdF6ntEEgMqpptdXJKDRZZWM(B{&@e#=G=A z!-aQD=yWN&`Y!MM;+;p_kVkLccJUEcuNY#eA!_69Zy`VE6&`w}-_0L-d$@m#3wAQO z`I1X$<9$tV+c^D1t&+*sk_QIRSDiIlnObMkHj=yUmaYd!7zY3fOaJPjEg=`vP(-(q zfU*L1rNdtBmX^N}Bk#c|O>#q#pv-YKUa@oTxCkj zj9DZzD`6B-&w$LF35?V?y}W$6)=Du7GBTyTeOffw)K)7|wXbW#I<299;X=cOzTuBS zT-N1jU2E47pcV^&AgEQT`{vy{E*{q)U28X*TDe&3qe85;t<4>(t=}>C*msQx8tPiN zsl0d*GL)CCEv;IGsI`9qw{gy+X>%)hIx#-(x)VaM?$Y4?ng`Um;@3{n>`n>=SAOCi zQgXNJkZ^VHQui9og_hlbvRs|Jw_vp?jN8{K&)w^xvpG%z<45zGT)HRF!h5u4+ich# zB{R7|9`o3`HV_KyF%jq%__o6$lOQJHWiv_UTdp}sYpsBhElGb=(1mpyUOug2rFi|m zD-$YR`Q>+B+cEyD8-Mx2mR~%B1;c{CsV;5$%-Q2=>eic1J-h1plWMRR21l_tIB@${ zYFkHi@#A;C`{%J&PN>TK$NzbC-I){1zJHJi4HFioto-7m>8`I;_CGXs@|g$Tomg_> z=XacY@vgJKRpo!7{g>XXe)g8y_AP4;Jylx$iRqia-n(QwZR6uAQVLcaxH_TCq62@wFzcQNlJz4z`02T~?A!jEpRN4y57o$;NB(tL zCpG9BAZw8gMBO)j`=~5gK4rt+%Km-ZE}Y};Ww-wHNoIe85@AfLxbk!FT)gel*<{tW zkq7sxbkpXSp51r-ugcDO_`g>c?%dsX>ssm`#yH6cMa8r4yK+%gH{5;x^qx1~>^=P0 zg2PX$Xn4=HiJk9Vg2*T}yzl)BO7-kI_nPYK)w+N6{zIe3elY9k5jAUC3)#h-ra><( zKBJuCT}huygI&;kTV0A)IQPrwMP6%-tcfQ;fHK zg#I9pBx*Zm8bJ|eCXT9HTdIpQq14MsmCFNKx~P9^RP~GiCx#%4=b@w@YD-OJj!tTr zb{i&&Ep@L{T}xH58v z?155EM?I!8Usp!CYZj)dR0b%HC@$;rQdORB;tHlSbk|}P7a=a#+OVq5hEgx2L#nbs z6)S&KnhJ4*mblcfx)C~x)VZC6g-Nnz-LtllCuNvf#3 z-FXXB^Zz!*xRV6-ctl2XhVMjXdDFi83_ZFh7xDEp7uj^9@@{Dl4eb;u)CpkDF)IfH zX5D`6rQ3D_M5y6P3r-^52bY;eJcooUvkc{kO*y~TrWxKGMl^*0imRB{jWr_o?Q(xV zK6egn0XG^AGXVh$lSs4ZFZ1;R6AI5*^GSoM9`HqNZJO)^VrLdU-RSxPLduXALSsO& z1}V?oxEcgBGcZvkna4MaAZun#10h)fCc^~6hKZOp69}WQVPfH|!wE%DgoK-4$drXV zvK6+LgvE+5k)$^r*snm@VsD|Z3uAvITmM^RMqyxLE5yvUj?^?=$k@o-HjXDCOyw~I zx*@J*;btT%H2N!>dYL+%)N0i-8X?z%mm6IXhU?@eZiTyjsIw0D|Ip{2YgF?hon6S# zTfCZ^Snfa(j_Z^70K9DXPzjwo>G)5& z^G|I)`!v!2_`23$t*SD-)_N~%ec!or&Vd651wt;K7!D*xTtpabIzt1RVUrLkIjAU* z3{%z^O*1vqj53*0lMRsBPz^eoWMNp0*iZxn%E2KFBb`L)GW_dD|N4KiE_;1zt$p~x zz~N(mx4qx}zR&Z#&m&kfXb@)p!~c3~Xz!ND6Ps-+OH5l{2bC+62;If9><@AOx^G;5OVnTmTE%bYx+@i2OHA*b=7U7UYxYb?^b{ zt;|aiz%K^Y7Ps}1ZP7Y;QZCQUS=az@6ltR>Dasd=(tI&#MnKr)g@|Maeya|dRS27A!Fsj!aIVMP@CP~Sc z9`vQP@}<)Lck-d-m9!3ODZ=m(Mr#xsV@!A3lr{HWd~?%ZPEOo@&qME=6O9?$|8eq~ z9pAY3?bDks9Tk6_LIILig64hY$_ar&=?@Qo_b1!lJ@w`P{Bg#%hdNgb-@NN7F|qHi z(F^V#!nJaGAp znlhE}b6XLQSzQPDGN!-G;JI^a&mP-w=`~@5VnWR_cD?q_DOHLU zp(JEtZFGO|7Y1nMr!8n7Y)U-qte}cz34uF_YBq$c=Q@bI1YqW+mZJ#?UXXOHNvBgs zNGAky!X*_emy-fTjdW2am(Xb??8@hskBiWi-$GcsHDsXKLw=EjKxE@z{Q)J8r= z)vX%kH^W?q5}qQSfRZ!5rSN$llLQAzCZm6N4?AB)$#oX-EZOp|!LK!x6mCVLM+g!7 zLKJ-fay@R#WB~=)QPEQ-+2IIxpd1s)BO+tC-G{nY=9T%XaSpU6A8gLn#dLDmS+#u% zu|_}wLsIl~tk^i?;nhMJZtp|@LDN5X`bF8@0fvAYvb|}y<*efoFv|8Wr9d$P6OVrz z2Tdb^MQ?9IqEf6T^eYW)P&7N0%d$|c4d{-++wW^%yO{fWWW(UVB*{iMjcWE_e?N2# zijliEpM2i10$us4**~DSp|_xk3YKgBhYA6hC^-9TR!q8KY%39?B=&%;1CCQYz#b&@ zDJsOF*`0Lf#s=0hs!D_l*jv~%1(kmYqCi#CjS#}-P6?28Il)CHB3G2wiRG&ebT5Io z28j7+om`gr5R`2viXwtj9JP`es<`7*ob2*}C8s%xx~yW&&7FjbGSehIr}&Prw5b#t zk_5jP9iu6!ULbv$lOOm>2xY>W%J#@$L zH^17o=)S4jH>~^Rt4m&f;hxc7i=L4?PrW3K6rIaAUwrdZfBF@zoCL(A5pdp)(X)$w z^X$rB?BN^NEPd>Y%{jLSnz!@azb`*>aKWQnIydgT?f7d8fAp=9eb3!==;xn2`n(v2 zy1@!Hbj_ahnMc}J&KER)^ILy!3z~B4fx|<4_u=)kn#=E>w(;WvhVOg*5Q0F~Z4)L- zlw>?sT3M<)EICve*FktN)hgDkpe~dl^o7ZKxP|}gk!J7G5*?5TWSVl`8~0VJgqij~n?H5%AGRSYcT z?wQm%O$;uTy|YEL0d0TNj>$@E2?$I|w{icCV!{pB-q)CLEg&-? zcTX1si?DY{cZ}z2ZxTJ%L0cF1%@qR+WU~(#Z6Fpgz_>Z0e@Hd^RL@+|cLQ|wo9catkQ-ZM&WZZSt&y*zJ%QFqg;o5hMgRXMVocs|wf zO@XNmC_~8WN?3pDa9K+w0U@`=j=!T8Hx|t@8mwZ%D7Sa0BjfVb%GhvsjJ3?95QlY; zVrNmO#7VxRa$gqJmvAx&NrFvNq7?RujUhv*;6{b1JkhoZR^cApPeZgFY8D{Ig)nycbBh6>LM(T1 zfhtyzWC6Ws^)|-TlT$@PvDDhwgmY&^q#!o4%*BrGdX668J|JuMoydXQ&UkCf?TtBI zTCGy3S=mU?V5H*R=aCuw4WF5m!)){7 z3q;5*wbcYH;NnN5F!k8*Ll;!&s}C8rAWMb#gd&9)#r=Ub^$ND$aT=CeU-tGt3Ar=I zO)2&<%hg=TL{O&|EsCIu*MHG2%-*TO27S_d$2ZBMF@nW$lKilkV2aP_{3nU$b5UQD zXP$rOJN}8NCvfP z^R;GfV3q=z%Q_S9sbD}KZn?@y-Kehvl3Z8-@%NUpS)^{5)% zXkstUGDVm<2OV=~()@+x%}(6_RUDD>XUt1X{@^hn$pp9=!y=%F%j76~vT_+OvKN0n z#*_W59CFU-ws?$4a6|dB{spq{L1f5u+GG#1WAY8*Fo*>ovm0 z++b|7mA9kG*f2=HmGN|b_ir1Y7!Ma;B&^0(KytcF-(s#cQfxzk?ElDP|v31D*BQzqB5EW5~H zB)#}$WC4N;+v*l;yWCuE2}!h-Hu~IZL)7ig%ANR#$yatcxRUkT0iGo7rJH}swe`@@ z28QIA4TuAD`e{s$3Ux$4aUfUF4c)O(UpdCIXqHh^4|Pu#{FKI4mARBIH|UC3T|=M{ z|CR7cp{^UZ07cr@17A;TiYoLfTb7-%L z!P3{usP64?5b0*3#tkT|^R7~A?Y>b?%`7sAQtnO9KRub!_da8VA}g5cA;3vrkn}#N z6o7QFT%oa~0gf!8cDfNy>M|0F2|-vHiH@UZ6))0tUt_S4#cWRJGI|uFoIS=lU_{51 zTWPey=p9e|3rzW>b(;854j=&)&OvZYDF-fvax!g^ z3yClaj0u>^U%H_O$cR92!l_kV zDsEfY;*hhj0I)5vEyxM}ki~4EwgB7WwnYV(;}o4C$z+NP0nqky0nVk*Hf=+F?IN4r zs73c5OQ-$%WHLI9XA!rv@`Wq|HwAo2BM$%9j?jqpD1o=4BvOWIOjY!#q=)U0t`$_H zwoZ*RZFZ?!oK1i2bkl>89@=rG_pshLF^fm5GvD;fqU;@69ZQY6>a5_!s0NzuM@z6x zzeBMABq$a@1Q0qo5=74`WMU-IFz% zhB!q4*y6+@?Joj~86yG+Cx~$@DB%n-Muhw{i{^j|h6P~GFaY5MaUcMgQv?iiPBM)0fGppoKX-A7-lxJ00Tu#5TJ+wW)uNIlw%GEFb2Sc5g>>$Bsk%MGLAuhg6zO5 z2@Jr1QXqerV?-Eb6ahvABT5iZL7Hap!&jqdEsJK7#ospy1+#q4 zjSXLnQ&2hWjkJ;U8LlVl#?qjXmeM07A=5im8Ko;mYL9|LrNxB$s?&S9BU7%S1Gjo7 zuxa9EQ{6YKQ-baktKTn;qK4DmX|j-hBh6aB`v`v_wCv5bPUw~5>XFdd@zuc4xHA;G zN22oUp>rhij*OS`Q6(Riixa~yNBLq{DMnQ{@()LDDXtcxNUQU|c0BS&$zeKYX)|{~Fh7~6cyrkwOftS>Oc3c@M-E3ASf^t+VMZS~N-MHo? z&0F~d9O<}=E1kNP#z0CCk=7O)+rMQc=XxE%*w;x9m9wOPz4dHq zc8sonFw8nLjgwnp&={E@#tg#PJF&MQIDOh1mHtZpXzY8Ha!bNkBNiJP&b7NWFe3v^ z2?-UXKg%i7$o=Wf8#3N#oxF=?78VUo`uV6_y50ERUlu-daqre}|C3`|`mVk<_iW$r zH?2obE?<9fmvg7J{KCFRMxQF(@wZ$Y_{l$io+`)wl5^XC|LOLbr`$P$5wx~Gk>==_r$6<9=!YOvCSL4{NsV!WjCyQ zNz=d8n(^M!M^E)XadumI^6f3x1{ROKRQUGjoD{dK~zaRXWC!FqU=<(@mQds8~6FevKz~ zZ$D~XA*Oe7=z-}dA-Cc)s83B|YDr~;hx9K}vYQ@e&N|&AJwgS!S7h0G5y4o7Fgn+# zD-nt&Q!jHEb2lSirW_c$j58}$>2Wq>WlVaMC!xmlwL&Z2S~vH@b#u=29lSq0@4qV# zCFS+k_b&hR)p=(&J$qrxzzuhQ?wPf}8CzTYy1wG`UCTe&HjosSp56B2(KVZ{>|cCl zeK2`!=E)@oZr5ji^y1QU+Yd%%Ck)&qD98ThOZ(?s=VTg2P9AwD<%?1AOs3h0#TxffQ`v1!iRu_rAWlF zAtp8iW4tf#Vtbuk?4&Qq2)W2VU_3pV-_s;+D!OxD|eE##dk3Dtg_{opXKX&WcM}G6nng1<) z=8s?h&Ocsx_Wcvz{`>cj{NWo<|K+9E?wvn%_xzdrZ=QK@;j!C)M?ZD*`IjI3_|cnR zIs3scKKrNVPWWTMHKYr`z z7w^3I%7gPq-aYo{?Qfp`&&8+ioH%m(*!S-J;OL)U-v8?_efiF@AKkz3?jGpAeW1IuIB{cf;;p&K zo%zwtJri4h`$jkG(YN-FUfnl(ZDI7<^!T;Ku`35Au0Jxly)bfpYV7LXv8%IV*Jj5z zXC}92$2RwjZA_1D&W>E29ogJBa%Eq&F;iWcDKFO}>w7yJvz@i6a;>hG>(1)r$kKFm zx$dk@mKP_>jk)rddpjF5o%PvbrB|)>ij|3Sy<1*?nJ(6*_4;(RUXQL%kF54O8{_5L zRA;5GR>q5qW96l8xw=O$kE^9Ay;Rfcc(q)2E>0FdpD0&qwbY~anR02OTIrT+y>hkI z%TwjbOnIs9tj`onb+OznFHaTAy=rZ$TI%YR3BAzEa_IunR2X;+KvQtt(>?kwIS}?@J z-M?Xcu4e$9w)uJlI^(vfs*So5Z%LACpyBqh$wRWTo&I}7QcvW!oVNB2u4d!Vr8Y=A zHl}dHQIa2!q&T-ZImHaREayyXtylr~qxpb;02n0!Fd`A4aaUtW2+YDHdokyTphz?l z;Ra_>24N9~jcPw-NUMlUtP~I+6ELwRYTVwC4Q~}C6KIx-h5dysi;({RNT?3qoo3_ zm`X*Z;!}k6Cv9wn>o1{ygGXiDAjGWsIQJvzPL`Y~lVEnhLUcE0pz~}? zj1I>Z_w8PYaJ*s%ge3LO$G`pWYO~7=&QDw~V(dS7(P!TV2I(nnsg zVa*!g*}ZNGqG7BVvWcUXNG2>bC}mM(tx%Cv2pU1LBm~9ML!&`4mxY0fL9t-;@ndT0 zlmUhfNKA#s=Chz!5Q5^|lvKs$&4x9{g|+~>Vc&SP8bfSht-#5hnXChL<0fZJ6w135;I?i^B|JY?-2ce`^Q}Pwf+6%e zn55K&Kok;KD*UnQYf{sHk=Rn;3~$}) zdiwNP!v+JV@v*K2=o4NgA&?dF^et(bNGaoxBAFahmJ}CNY42e|!8Q@q)&)mhV^W2d zOr(|V#T+S4Yt#ywLcpd5nbKp9N-NoLVJwx-5rrM2uc7Bz=8h3PH?J5AD~Iw77{Nso zO|ZrbtWSe+Ajr-0=bAQuG6xYDGWS)8A~#WZaS~mUYv0!sMcmCeI61jlh|Qn# z)K4tQPkJ&1WVW_{4NFiQ{ZbYBBu3vd97r0%{R_4gNlC;I6sgTxJYK8ExOmLyiS_9I z>=RHT+x*6p|JH|UorVMX@t~CDm`kMyl@!(_A};^Km65~zGFr~BA1>jy?yfeuFs=UU zASGdDKHIDt+%RQ)s12Rh-1!bYaovq@Jr0vVP+A*Lf8!T_>HEL=MomDd%fc@W=>KJ} z%RoY{H3IrFqJbKR_ApEl1jHO<-bjaXlsSTtTw61zW^yDZA198(0R1aFwhjqgNZb5b zWAoQ|Mbb9l1aEjK@xkA@w#i%C@}2{OTk)`Dyd;6O%^WkiNb+%_Snx80eikVEhxk+_ z?Hz&?j`Tc#mAAs`A5)W+gxg~rJvh((jjZ>tw66%rW}i5Mb0ZQ!)b;$6hjS@})SrIo zYZ+vDo=G8N`D1)WVmHHV(32|e(*3K}C6fmfFEsW72vS1dqomoq*eAS^M>jWlAB#1; zgY6^OM0_BV1nH(2H-@-5$mx$sHTJj72FHz5s?Y#`KxS9cG#yB2#~d?cF}p%$1{p(* zHTkW^vB4jOfJuOL?KgdyZ1k4030D=aMi|+|VD3+FRs*x>cw%xRkH2OuVsq?3?k(cqx(b-A3CT z7*{tULLxvUW@s!C%nur!anoNQ5faMg;}X$-k6U()1~iLjKtv)YMk0v_F7^ofMM@$7 z5orQKR?J!vF%S@u1VAK#C;&(?NQp!_fH{q(_W>YgYlv&SV3^tM#+{54041TwGqd69 zhxi&7D6{cJ$nrdwLP|(Z)Ir*2yrA{FYd>o}E(gKGJW0n)+AJkKq5{rHyo-%pb(4mF z32h@lo3G_S`zAzY{IMe&{l*X}opTasCWfR4`q@eTO4Zr%O9Uy?s^$2$kKI3G5p&XX zHm;!q9Q>5yL6&9zXY5R$syMSSe)`?J@7DKnH|}L$To4z;B^Z}NMNwmtVWOkxltwY4 z7#&5&xI{51E+~tDBH|866aiishw?^8i6+B!V%XIdwrxTP-MH+@%12paK8y zyW0S8=WfH(ktT&G?U(ESc&Orog}JZ3?@EohF~T{iVQyl(N>{C%%=3gnb9a_3tShaf5;`uWM`!3C!k==Ezt@UCp0l0Fr zp?XKvm6l^CPgK{P+HvN>4otxe;FLO`Oz36|5V+RUP*bz>N?YCa_QM*&`?u`+WaaGg zvRUgESCp0H{pXiI)t#$<-n8{Yl>{0ajsQS@Mp1uHQ*U2=ULwO?J^TLBg)_B9bE23LY2D~V%CZPx|5r}4fTrKOhsN^_ z6e;N3-X2rV1OALfa~2H^HWkmxJaA+^0jzscqA3L*EnE5IWh(=J_u#$j000JSiV{kE z%@_A*z(#+#u0nXQuN447{_F$0w+}wPqyW7AdEndO(-a_4HZj+^69+hk+CAG=mKKgY zYd>#-sBPWW2Fd^7! z)6Z!+NIH?Vx5G|<3XY{3vdBPoU!T;YCGFIlK(`r59*!zwo96qlGDf zxb6vs!ujEFI#)${d~!TB&+iWr#+l%hi9kw<$EAm(IWA9F3xor~bj|Ja`GQA|?> zi^S5VN1}1YRl>2Y0Ksy+=&x`?VuYO#6_$f$j1eAS-rxglUC>))XnKmOek|~5Rf)F)NC^L6fJU&@yzECVbCu3$foS}K5 znHfcqaJK5w{ehUS$NYhiVUQDohr{`q=|vuISXKRzV18EGG*xv8%^Qv86UJTsaC*Eb zGoCLrx9-nQi{)slHzkl8j~A+%Zp2nOnN97+7U`IO({iQxksEsznF|W1^`D6cG(7C@9~+-cq6B(lvwbG>6$3@lh;r(FcgU}yqV z-B`CcaVuo0Pc0Xi1v?|^2RtfMFxG@B7{?eRq!2)yF+~ANFeLLCrRuC>w5p;Yf{}ta zrI;drpWCB*1tJ6tJ6r-< ziAxorC@x9`=ZrB<2q#2v6(OP$Dg-B-X#{&Ul?qNU@@Xp71W^#hNN^P)CTK%N;&7_ z`YuVt01!r#o*iSlj1q>x8znRGlAkJ=5Ja&da+`hq##qg)%O-Ad zMN*2};n>oFkyLLa-%p-fn4s zvrDRWY|8jw7)$1Q=EKM`Y(};~5+`@Ew79b(3v2^>CvTB8n7zDw(ebY~tSc{Bv%GlV z;iZCjUd3mn_j@|Jx=wet{vkUf{rs6NcW&)M9Fo5)vkSfWaHbGKA~F28^K z>XokDm?C0~fs(;vLI^?#=bSQTNXUj1$~hmySth_#I2lw%DdvO;ZDGlZ8$GqHH}(Z} zwd3Z&u&%G&F#qu3omZ~zUR5!BPI2Lhlb;O?9|eHFyuDNPWr^@4!M6k(Q9;H7PbpC_ zCP|jKWuTL|l}#N!Cdt$^OpMTfO#2|ya>tK%vIr>%>>R`K)5LbHjK3|7P;M+~`s_qC z%d}+z{*&~LWp=enEw&Z`NQy+50AgZXV34})lOuCeW?x4fJDbL&aWgE@Liv`qNcQ&4 zyn}9snVTO#i`m!lka7@Bq_#kdiP3Cvlp?an&!e*PlGN15?VBCx+1^io*M8pFbI{|7 zoov|aam6mQG%a1a>pe$6kw7kxEeFqN1PMhLyX)$Y4h*+%tywf}Qt|88{SQaJ z27tGJd)7OAGAB3kb=`^kPg|F*nvtJ7bMoX_>G61KYR(UD?)5+ZCJ@y6dOIJ#X!Hm9 zo-cL{J?-3ATe)({st5gl%{T5H0bq}Zx`v*f2L(o7e%m{6_Wb3Y#d8-7J?~tyyl`gz zygS|JpT6qwdVO`L4?TH#t+c#oYTo>Xb4xe=zI;K+$9MZK_B=YT`_dbmz8-ni9#3@% z&JvRs!3n_$X6={@h9!bHFeNxiPNiedJxiQ5f^#N>P~9a9%6lJwHQww$C0zQV+2!>u z+o>kPsrfyFXX_icEL*&`Z@9Dj&T$G#|AUT!r;Yv~=3F3CRJ-xL4JFSk=$L7e|KsaS zo1;3eFnqfEobJ2KoqgucrqRAtgeW$b!Nxd&7>GA8c7Q?<+nB|~AY+g)t0IH|L5wl0 zg(U$3gu$3VAS{A^2qlyYl1de>(mK6w%l5Bttj z4;K{ArLG9YTD#KoQ#Mh5k#lv~9h_4ASm_+3bk~lTpgg?D&gVx(rGmGzR%sqPh|)U3 z6TV+GCobJ`<}XI=6kf&NOJ$`c&td1w=}SG6CQnx7X$uyA!cAGBeW|*nR8m;h!lra% zV4{*@CKR&q0^^F17-N*%-;s=YSK|w##IkmEoOA8{q0t#yaUoD3>c1D~f{2g{uGfpC zma9r_D9@3EG^9W-iKKQCky4W8D{D_$LaBs8l4Mv0O4KAE?Srq~7`6OgDn%qw+wm(Y z4Qc2QB1uSpff7k7?E8LLf@1h@{AiMx-P}lu8K_Ib&KPB_&Et zCX&fyZ8}|JC?6t9Ly~0}rXop(Y3R2y3?-H3iYUy7Fit{CR0=S5UgEtv5l4s$5CWyt z#DPIkNF0hE(Bf%m?yEUdPbytXER`MU?A{aR^3S(_Ebvl2p{;amnSX!I7zpj$TCz!8 z)+MBL8(S}(dA6T^xqIpXEqe+FAv7Bt8PB76igL9VAu=ZZSt!a9$ev4uCKUZSfN^d_ zr5R&5p`|WcfqFl~crhH(woK%liK1de`#&-MqODF3)4J@~*z>W6n&4^Qf@iTh_q!H% zr1b-T$Au_dn~02aLJ~pZ*=> zwOS(8WaB<51C}{9`b|wXW}2u_G}WewI0|fks>-AyW;_`A``v?0^%c@kCQ@T%!jK%8 zn4GN`xzJ7qBjScsTnI+U5di4X)8PY$Ki>GoyAgjNsElMhfKrD1PBQG6hG{9It}-qq zC#1%jbjUAJDnw4ooc-%5iZOb~`x4xyOQUa^0$VkqA(}`#* z9=&q5qoq2@a!NKKhy-U16^RQY9Tu>f%7h}}hC>0$&W$W((j?D$nL_)4( z6Jj)IM{GlB<+l(V1prG%13zB-s=hK93EHk@_$|XALLp+&NHpj~!;TLH)2%eYITzW= z)b?G=(_!m}TYG~XhOYEYZAmSE`{3>M%YGXqynm-JWa7cTl|jbN{bf(18&`sSK2zjU zfin6xkFCTnX!FaeiVEKgW#@uI2&SW5J}4Bo^m1h<$pWLV^a|B9jJ%IFEA>?^1X?Mz zPol`*35B~Zr@-TcQU&(5Z=N-|?#``&=4ANB)&3u^9s*!p`!}>LUvX)F_%Z-E6n*eupsRb`oL5`N9$X;+ zt}F@J@zDVUl}%QST;AK=wSMxivN!McJKzoucannY%7jUr6X%E=IY8j?ldHRXKB>+& z_Uzj1cg)t7neQ!Hx^Mq~hMxWH$yj*Jst=E!-Z7~m@%G$>`+Gm%_ovkYIhV*u`h2lh zUwd=SrwbJt3_&1Trlp{AWT4jot8K}W>5cBB?6f8CO;?JTKn~{U{R^EPD|YW*Bfxxg z@9L@JYZaKI1`10l>id-+%9I-}+I< zwiS{t;=BoYeSADC}|)Ot5eu_~!$g&Ye3ne5T9drbI#^0PyMfH3xjvRdt8DR=XlH`0WlK zHyGz6StuCk=vY2>_q=P^M^5Z$t!Vh7eeuHwXM6w;$4>))!2O#;DVFkC5iN8EfZKPD zRtn#>i$~54cK7zI@9o)IQ&oH8#?j&Py)&my0>IIG-}%XR;Be=H*)PSNrnzs-?Eh|4 z&))Wx%N7xZ1OfoNcKt|0D185K=MV1Mw07~_`Lh;o{^R=tC%T8ue0ivMqKe6D4C1qQo{4Q8daTK0T zHI}^eb}|wHPNdm|d?#nVpNFXzmsG{wfn1|YH@8rKNTtHzgzb+;BGsnt#N8hH;j zGE6kgNGuzU)F)F-{y>Cu^`xX>h1^7QC|qkgt{ZJkry6{|kg|i(cyl6N=lCP>WRvUG zDm&m0X49Ew%eG7-SW(dsi&i*}n@s(mu50I!V=Ka*e)oCQsj5@wobI0PdF<@lYp=aF zzBX5XzCywRM8ZQPa1){{kq{A*kdPoDk@FY$HKhC)f}Win@7l>EGnyXtqo(Ss?{OW% zx>hcY*W!1|KwhgfY|FY?6nRlsc~KaH*2c1~OV#?gs;aiC3vIgP_`L5Xqj4IZ_vxf+ zt;Dl&{oH8Gi?XQ7EYHiTCSF#JDGrhBMNu|?DCu%JoHjP~!;KFoS)~?5nU`f*HyW4y z=7y+`VGGcESt%GKo=?-2GX&6`tZopy%A|g{?b3NsD~IEDb!|ZiH=EUKXTz*(IOHNe z%6osf3i~*O&ybqEQlNM!F*Dv&mStWxtMTf5_r^hoW<1}%>*c~4wjkT}jiDv^?Rva_ zOJO(9jElvhEUT04>xg@S$`&OG6yIrGPH=H=r`Ael_cXoGv_OfY1KVH3h{hoO&_kDd;Yju0` z;pY4u(faiC)$NOS23PCNO$s-syVp~?wXW-j4Y^oV`QGv`H~;$gUoTJB&$3K^($qRC z^8EMT|L*(W{!~@8-fS(buU>rn_U`QufBx0Y?z*X4#JJm@RdusiWM2~*e3AQq*aRIT zwO`Y4JzF%3nP+}19(gixWe05UAp-V+!+O6+J1F<7YG%jpb+=V9W9eTD$9zhPtp`)`YR{v;_erSc&ghWqKFbJaM*lHZy8nhO-@8oZ zc~w<;RUTvVkNE7z0BTuPiy}LOnank1uRl7hPKrD)_xUHYdT9suUOSKtG> z@>C7{A|J<@=jkVn9T(xD$f z1UPvan4?Gs936K+31g4E3cT^WG)@3L`GlO10&#E{h?8?-9V3gQNFfq;;s^BNeRL$m z!BKD$Ed}xkF*y|G82lLcgn6(O2`94<#(*e*;%Fd_#w9>@C=MfkiGT~92joCL0FiNQ z(Hmq-LY&wS@6XXI2J^4`2H5i{27jWJ?~1Ed}h>mvQZfF%DB0rZ}woVHs)pmp}aR)0-cse#_l|c(Z-k$BCDd@1~emshh$u zQa4FA{o>OvKfZh~-LC7`A&%I0lDgO}L$~A*Q$MC|)eq~`ui`LL>U}qcIJl4?bump8 zdPx(;5hPjPNf?oqAxt5T-~)!>#9Q`0^_Cezus%8;A&4fnl8hG!31eqNRGzGelMcLq z55OIUgpx>ql0kMpa7g5nWp6n-N{$msr#V_q&If}CKF*&+7DoX&5hsIOgVRI~1Ce(u z8U@fJGLi@O))BH;u$IseYKIok7;BvahXyR5v(8$8)|nQJHejr)8)YqO3(DBWT4S9t z0Du747*lJlz-Z%IWvoT5O>0c8m9e0-wHA!AN}E=H>vn!sx>ed(&=#6jH`>%nHLX%w zH%iw^wMI8eHEpA`YL$BS-NpM)Cm&yIS6ZuD)s5D5+cc_el~P(aZLO42N;SGx+P0?F zTE4ydK&ouCZb3IjH%d2cQ|q<`+vrwV(`wV`rUj^tQWmDLi^#230N83*mi zI?v{+jxzvXq;q!PecyL?&pEg1UUeja0V$F|G*jaQ6Pk$##U_S{u|f1|2qhRSFdzh2 z2nmTIA;5rv5CI0OQ4FR8Y-|(H7-uqZeo8)nT!!%<*qQyXv$N%Sp4jMN6Bhh=B5P!$ zS^LPAjYe%z8)JReL|UWOpnYJ2)??2%HcG~_XSFWewq_%eOO~WD?D=FOihcINXu@cG z1%?6-*ar-g=d&MVD&N|G{lJkPq6OAqh}mN=r|F|ZJ=Yu8t*s7BOq-bGi1Bh7w(rt^ zA;(zXcrhhn@mY8l_XOh`!Pzr zDDWZIhI3dZ<1`@fQsXKnFP%Rp+xBNa(Q&kKP%3L^#kjkV&)j~{GUl~1<7XGxAyJd^ zW2vah%QFL`Sw(LzoL67JEE361M)OX5R%aqM9LbI7{1gt*i5x?T0y{VoE*MyUUU~i2 z;fPN7;bb@{2*TNDeD(ts_%;&vF;SL1BC7LEI3CjjOM=R<7Y9fd#VTWw9Ds01d_^Fg&MQz7 zAgv{Iq;$arQW?S#N(lu5lq&=%<+!dwB^6}4u9P68RG>hrbZzP-Sns-jLI?m5!cFt8 zAR$fOx@qI9kgn^7-di%i_uk=(kvS8G4@U@w4;z;q9#~me{>O>q0}5BxTU*p}V3#x@>82j{T$%LdFh|A??QXtvqhn-QPM#gr z)7i0M(R2o6;~_FCzkcVwulia_60uLVHe79Q*tE7foSC}We(Jw}Ki|}TKh&f&IhbtT zcl73^mhGDtl;sX>-nr%3?dEh&758lfx?G(E}Xl(Im02g zS{WlC|JkGNQCWpa&Rw^1Yv;x0t}l5uN8 z{^7-iAk?p|V{f6&+EcrD{i5X;JL@iVe5|B7d8T&shBE zg5zzwZ{6*nP_*a9`E%X1{Y!IKEn0T9t8VFv>Z(Dbu7A;Z??GEk(|0ev=DH#!*3FmB9vl!K)OY{n?jtqU zj}9(*t#1E+@&J?DcC7gJ`6ZA+?cVL3T@8<(os4C2Z_n8aox9%{RTZ&0?d=Vv#d$(T z`yL)I8xlbqC~GKDdZamnquDx-~sName(p|T{cA<2=fn5dEC=IsN4a%M90jbw%L1 zZYax)Jkhq^a`N=$MiuJUcl+erS#x*nns?yn-%3)+2fb(Nx2>pI^@c0Kl|txXbm`=G zrcHbP&npxPclWjC42+U2dH(cvelcfd7oBT=YTvVQ#m_IUjH#-sKfHY9@&)6^m+jrY zbL7aF(cnmMq$_3OuPZmbJ~n6P)(zv!3xD}fcgdjSvQ4uPwFC!r?&VX>O3Dx3SzEJU z*4Nz^Zk#`|ddZ}pe!LZli~mz~u75RWdmR6@_wTpX`mVKpzkRD+yIs3z-%4JBTRJsV=@1#N(B^B~QMwsK}%$#!`ob!L22bI%#x}JYO4?dsI zdVg$9cCyw|SDG&}m11LB9U7UkFI-YNfBrn+<>=Pjd~T}0r=z~)-~Z_qtOQ_;a0=A% z#NN|`U3Uuewoi=pn{9QU-uL~Ili}@uYhQlx3fBmXG2jei%iH%)t+nR&Z~Ha`t~_@1 z$GEsSzvV$Q@47|?>rdoI-n>%W-BujxUS>RTiz=1*&wou04b?oEEYClZ9USbOkgyXpm{J8~jiPsdKA4f? zyTTr;9lw5@utU}lyQ;OsigU^pSrBwD-gIg>S4pP7K8_kyHsgbx>8Wusk*kVMopG}0 zD~m6=*;0+(T2Gy(Cwc@mPD|gvAw0PB(j_l%b4y#XkFCeW!rfoKj6NBwdi=Tyi^SE@ z-_Bsim_j&5lz~RsxocPCdVhm|-Yz{cwV@*a%il(p7;SpmuN!4YjPx_J!$z<+XqGnC zl=VHjKJdIYEGV$1qR4N_cjt<-x2}!bzdOR9vnYy9WBFB2TYXf-*0jXUE~aITcP`9+ ze%$ilx3aq28#gY6t?<<`v({kpboVH}dO)i;5kdc9_5rri)YV^K?(9B)KGd8XA2B>u z(J^o%cKd2;o&ANpBf&uyt*_B)?7CTZyZi^=P#cYh zUtmbZwE`n{B}hB_rTboEVL{Qprq;S3XP>^Fc2A>a{8@vi-qoNn5zY~(gmX-}8mJm5 za9L5b02DC>Ou>|4$_SHx36}{l%4Eu9Ol8ElM1e8}j1md}G6E(6!;E9b5irU%h_Ja+ zCv@(SQm(-m2rv;7OhE*qCKv++$`J;HK_rw?jxb1s5?~lG1_VF}1rg?n@jxl1RK${6 zL)n%xJ|$8 zFLL*`J&}EQb$~^G7O_OI8e@ss{d^)fGH7}E*~@ND%GhLugfRfe1QW_Ab8Nm_yG(EQ zVR|qq*sJ$JSyW*7Qrl%8KMVz!9laeq?D&d-+G-y+1DDLHYm*DkrZT}a{i4+%IJS3Q zc{I?NwrxXZR5T`P${1k`Bg^~Q{);&|h368dp7mM@R)73|K5%e^Lk?Es>oL}&Fg~0HpK)`tV*>!iAFu z%u5(yl*t@_7y$~5Yq!L1Yr1!O+v@K-+se=9X1;mfpq50+Dac$v)>CgE{FZlcg~g}y zepTtOIj^Sbe%uxrveKb2FU!s%|8y{^wKf0yAdh{C`~LcS|M|RKDZ5hw{g+(7deXs7 zem&bg^tkrqx$W&;|*4csX;>_f@-TU{9jaNTxDRs4VemC9y{CU&bb>0DfLC>da z&Yelqa^0Oyw&-C6Fxw5k0{e_z>=?8NBkn4!sQ&G#--rXL=uoqAjA zI8<(^WmyC|zG|KwQ<_iPERhfHZ8}42m z9;&+C@{2*Szg~KJ^hH%ruqR6tn!cV87fZ7T0=NEyMz{39u4`yi4ed95T#~I z$j|4GN5%*1s4;HWI`y1PN*ED}xJ^=W%JITPCm+3DaZlKnawtC@%fv4<{Af{!-Fpv37_2RabN6N(-$)g@VRN`%Zw_1I=j!Ia_h6F$8VjScgb^?*bNiTo^@;0mgt-lEb@?&ti83{Fkk3*|8+2g431uIT3N} zywA$Ib?aTXUVW<{YO1RrGy(zB%?JiGJ3wN=h7CW#7B+0zfCj{lPhi2fv2a%R3_?oj zO1@5Irqd3ejAKXi)5+D<)qHP%Zq#D2e)0Op@4tGzn9uHC{^0#D?)ybOJ$?G&%kQr@ z3rP$bn6&)j!%sf{`Mb02!PA#-IGNnty=3iAHcx)^#k(?JUO&G7-ut)9p})Spt&8dC z)-E{1=zGiKS8v}QZdM2D?b~F-uIG!@WU+U>y*)cSFERh?-~PDX(}pcF(8J6@NRGSu+-^nIUJu{&SrxYPO$4r%WcmBg~ma108aL zrMM!4Y@7vYk}2AefJ~SoL+Jr5%-sP-xDzU!BaL1wBeh}f?s9STX0U9|9pI6DS#;&P{vtn?@9m9`bwN+Vu1dk=Fbm zhxRGcH##@8RMf|G*SMs*>$=ZkT1c4>|NhTEHg`j*yB~h~27zIswns5;u ze)HR3B?IJ$f{;N*S}7(O05QR-##jeLYaJ-$0!m0S+E^&6h$;png&>NIk>HG=3RMi= z8i6HTaJfQ%CK%lavvU@U5<|%uZEW3Z?KEAE5ZcS#Pdw`s_`g|viO9%X+!cH0&0OXvT zyg=J7)8d!^^K#e?D>;WYgopk+$C$G&DP~6 zu;|HiGW)35YHp%~zGKK_Hm8)#b}VHwxA@I}EyKn@4i2ib9fKLn!Q|NhGf*_R0ZzIa z_AAk{1h&7F=^57I(gbUR&>ThwA%?*r<@U~+GlpBT+_1n}=kU>ZtQE3E=a%VN% z7?A)Y%nXtXhSAw)$Hs40NR34U1SlI*b_d&~lUqk0v4*YdAj2Dl&QKnuB)#3)W=CUs~- z8b)LTRDdu=*QOcJNmpdbq?BPG5!sO;S3IyAVNNidGW?gVYm2#~tfF(~`}SIE?>RqB zDHq#BZqf>k3cWzlR0@ccO9?6AK_~(yia;the`zdUKxk?VAOr+_Xkr2)0ThjYCC1i} z7;nTFQNu-p2vUvFD#Qyu=$j9FX8uDU`5*qA%sH8J=G%L(eOt>x6`*E0LtcPNSwta? z0$Blyl1xDU12b2?4!VH`RRVy!_mvSCL`roih`*S$v9%Ve9O|!*EEX`hf`fGsOZE)j`hWJ21lTv6d05+&l((k z(#LkK+HtdvKSm*|2A4WlcpGI@~ z%LWt53Af=B9Q10ew6vl^B!U0{S0yOQ-ADsL8j#MSN1g=xv^h+w{Yj;F!SKEUp9Ua; zG7_Ow6r)5ZrHptAHyY$7Qa))5K)F{DF1YBjQBI7A2s5~Qj?C3;@41r%!GxB|pw}-( zf{B{FLY6-rdX|5PRecbDHV@F8*+I$Kz0(CEs9^&0&CE5;7yfd18;KWXQVrnD6(Qq!J3|I*98{hBZR@6S!QY|Z>VYd(Er>DF)i`LECZ`kv)i zZt_JNF5dG%zT2xasbDM7a>kI99o3ME4+7Itqb<_QSr{1uw;p)pC``)^ncQ$qT zd#}Iu%I`ed_*BPjxqAQp>DtwATXXr*TW`Jen-4XHYV^SjMxCveW`xFgJENyF>SHVj z>v$iWv(v`#)+$__(Gtt}U__w+P(ZK0(vG1p1xO8Qt!3oaCrT|GmC1(SpO;ZgEUIuD zWWz>?*DJufBpG2+f1gep2K88Ek8mXM_q?*t!zn4({PN;D^JUvw0D`cdx*Ih+kz$6E z{sx@6zAbqnE2s#Dr?O%JD^Nuy66rcha`%`sI=y3fg_&d?@Bm#NHN1xBD;`tG5#D=& z&TFV-?04_xruoU-@&#Y~Di#Uiqvg>mY(iL5iTPL`pf9qzu9^)}kINhlzRJzMT znafDR$BKqQ)u@Q!P`N=BM07=7S+FwirW4`D+t0Ccsmv7rMvATzH(1;_hL zhhAW{CP-0%!I|^cW#&1iEJUwYHR@-N^cv{5E85ZystN`}u{vx@_LbVUEX=!?Hx^SC z2!> z_1k`Tpz&iadF1;%_rl}8{M{|T`bBra#;GKy z__uF=?YZ@zzwg9b=TG1JV6$}6Ym$;>FvZ?z(_nrLypxPhHY49LraXOKMies$3)Og7brq|0 zQCj%4@u-P)beC2uP-c`vdQLgfU`-N2-Zz|hn~pDY(uw#IWE;Z zjx1DZ=w*b*R0?^QRRb!hAvJJSCtNwQp-?yNe=1o;M4x<(aEt@upo{L1Drr>BC+;#2 zlLP9ZVi)P2GUbG5Bq(`+q`OHKFeDh1M+b-zbO%B2icwvcV3l+jAW@!W{t8Rk@A3D6 z+~^3efFwyE+`Z1c?!3tbH(m9kC+2_i zLbK$I+g|^ZpL_YL&uuAlhoW1#;+ne`ow2;ZhC5z8IQh&SJ70ck)m`^3-hAGKYZslh z{X;+9r%&84S#f0RY-N+lX*y^^v@7kxIYmRJ7oN(m>d#AVDzWeV7oBy+Q zJ+Hb}Rrq`NTI+e%+V6KxKeStU(?O_6-NICwG*IzJ7=@W>Bm@x{6j(%oL<14&e+MB{ zb-5R?R?fjF=rD2l*p98IE0lc2w#!L#@Kz4u<>4DLDiocBB5*?X_`tY@wLJQuFd zN1lD?Prt8+ANx104suu2Fmyg^t##fJ~^M^d9Z zT93>Ev&FC|-MB8!v@h`xOw%t5e_vqCDIH5XOdv|OvDN8D+h0BU)We^tO_uZDBQt>CM#eKnuqW2ba=wT4b>?eN4u|Mr!Cy?(gu z(skc>=J9|0;qKr4?EKDquKUdGk!QW%aN`%A@b|y9W$yT$L{bOKl$iie|~%OkDqEcU2Grt z+(UnS@xm7$y!K1qy64qj-1OYnms(imnFri@->Wa*`})uA*6Z*3;nVHh?ED)0@aOM+ z^_LgF|K#E9;@!V`;nMR@+xd0%$k*;+2x%p*!S>Z@7%uG7&k=Z0F%>^ zXZrFGJ~5=e|72Gvf5oPxoS0<**d$UvPxyimG_W}cv~}i2xyt}3#&k6QlAOf5?;PNL zN7tMDQsZQA496@#_-pn)xRiPj~6TR;vj!;HcF>{WG_Xutsf3YoOBbn9J9}TkRGZhXR z=~*rp>ZFLRS=xX#<*wMXDgdxN2P?+x9?a}OR;`0aBe=y!Y-G6#zAoQLW>S+NqBfk0 z7eVMp%#n(xlduzeh00+kl{8PV$Ue|6As$3D%Epx})9B9N=04mh-9}A>ae39k4?afJ zw0~rbC+5`%f2o~~h=9>Q-by5iK);Dz)K!XBTmSfQmC?r)g1#qNgSzHg)LE{_I$jez zqPndeofcsXCnM8(ppJ$f)xD?l%)pkcXt(N30#kUh5Inf4L@WjXa`<)lqGZEobg>sc+?p zxjDg}1h;P(-8BJ+>G5v!c>CNFf}o;fHaqvr(1B2cn9kU$kGNda`mzD%u}kK;-Q1nA zE3CGNwuP9Jzw%BrKpRop#NA~xHqw#X5`LJzg+qzXy{Y`#y;gGr#y-BzPMiMUbpVI^3Gj1A(6P)s^U`H3vgvK+TdjEsRFYcNmzXUo42HE6_ zW-io+L~bPFf6@@ye2B(f=(e16h--VF%ifTsF6Gt~04GzA){OSMbL7#V)@UQ^j@ zkmp((qS;uF$)X_`i);e{i5oPxWdKocGs9eF!wvx0ToX^!TDV4abl`nzrj1`Lcjbu` z7_9klfRC*msQsix)N4ttY8z*g=%j6rf07S@WcSr~-2Y;5Bn6tr*;5Woa#k^$J*%ts z%%qI#=ZVdpnm+;u+yKhpRn-)glF8Hw3{EOqeK8E;d>&n>VJEH67!fBuNLG?aHiYUC zk3l41YhWQpcw$DvlCGKsr|U3ky`6}Bz*!y)GRO#8STK+P(<7Gfk*g*nrkZH}e=H;? zI@Usbhnrr-D54~UapaIq4(42;To&4=fmDR>$ecR!02XUaU)O$%LCtD=EHiO7Yt0N1 zK8f2mwQAm5o$aj=ukbm$TH=3MmIKcUm5ye(aQkClUf3*jq9$PzO`7ZmZ*$`|?NKxv zo}Sp69Z?Byww}G~(gW|l^ETI)e=C>rhWA{!`Gc9eY}|Y6A9~<>PobOjeq7h;-8(JW zdmVVocmMbAkN)7RQC`(ElLZYXh`@`E?1@AsoQBRrTz}~kACJuJ)hn}itmhYQzRS+n zRTL2`D^*)TZPjUK`WUDE-5>j$bH4=tWHOnXo15H|eb!!k?X}3?C6emx>{b&E zGD0{@njj+aa0Vbbub6OFM0p=0a5`6gMPf-OkC-Hx(kU>cL(U|K2}>ffC!OhHEs^aS zm&~bnbB{_Zq~fBgf5u*8Zbrj^5hChzCeBX0u5ktAx-cVIM2kRu3U6$@cHul=RC@S` zrpMByrP-2k@yOYO?`%|5F{SMdt{DPc+;h^>s#Q-xw?SiD_Afg9=FpW(BLP2Zck z<>1hkl?qA*E?D1Z;rhx)HuM=;-?#pOF^{a#abHz_XYH;Hf6%3ndeq*!`pcmHoD?fjYPQ@#0% zOLLAK9I&|Vx`vI5KYm|XRC@TFeTQpyZB^=;o1T1m*@gF@Z&xtxy_c4Ut#KA@(j$O4 zd!cMnX?MvJe;G2yfVaX;tVMvN`2c`htnj;@kz3Qmu#`n^j_X?w7b6eCzzHDo)dvGw zmbxa#&RDC(rq=^nW{0OD(BY24MEmW$mxTAle4k}Ju|lFbB0!|DVCG62vztsaA(Jtd z*%Fx!@kWN(vMj%%M}J0Oys+8`$$#VESu2xhS(7C{enU@?@Mg24vcAt;A+`BB3-vo)ja5 za5-_f9$X2Q%Z4ZcR7G7Pb%))p<3Kc9BtuAmCYjhiZ&OqDWB_U!w@8sm% zp>(I%f6VW+`0nJkpV!DLB`s11eKf<&woOf0KIiCbs!wmW<0{&YJouN3deo?zmkwd=Xe#Kc`qe%B zfB6S0mzvx92F;jx)AmpH+IF@@}9^;u#aaT0?5r*8z))?ue ztdW-_3g(9W;|{&9R@LgVU87qWos9>)jkpJfHKke zAR>E`UWgK3BTz={#u)8qe@azJ4CuBe{GRJ zeo7iuk(q_H&|yeNt^y3k0Ss3x7`K_FP?`#l|yEZz?3y;o*G zy3Qz*OA{MP#R_h||NRe?Rl1*UA*4EuZ$xf3{3zcg}X#sq2brA1eFN?U0(h_}zC@|9MM}w9?@E z=?8Zx%0>)mZA47z5>@oW1t<4YZrbeQXP16>q3Ob@iUaLx#N?*4AE@Hq(eMXrUV2vL zZrSqfKh)CIFl%M=A3v>q=l9qDd`I!7Cnmq~nz^@G4H&of<5Q||!lGj@e`3+3rgLvm z(a4btn}=?Bq3Pl$Fr;+C=GIi*Oz7TQXQw^(`DN9=yt;L7&$}1ReDzJdZSL&Dd*ZUX zG0(39>n<)GBEI~8xKIqvzL}X=>>WV@00nj?=R|?W0tCldc=l8a@^oH`80ZYa7t+GG zTg#zWIX&`hLdSaBdZs|ce?*RZ%kOltS0xC^kACqqR5wD0Wn4EdI0Yc^FG-3gNhb#~ z$dNJ%7>Aw+l4UCdDw6SgD1rG(9goWir;H!~i6g6{Hj(l9uv8e?DH4uR%148!LE&Nbnwd7SvMUc0^Sficuh+Ddm8z}PoHF7wkAa4uDMxF;D(&7@2 z&d!-BpVdncfsRm1vvYUcN(R4nN-tEYOd4a>e0A;qx9|Jx3RKtg7W*%vavR8Gx@1gl$ zpERQ@#;#rsSEo&!?OJ(j05XtJVx#|M2yXZ>ni+pL1+)&%38(N~&%@fAQ9gqdUxyfmbbQo^fn1 zRo^)F+0FgdtSVhFpZX1}Y;CPP@TAK19k^<-E-WowGF=x8Df{Vj!?!k3$@p=5U+%Mh zh3*m4;8~+~Kbx*DD{p!FhF6{+_{1VCt}J`;g&qs*<6h<6>!;X~kp(qn5$UAFBl2mg za?S*XMHiIy?21C%j31m!*-Gk+r56xyo*>PF zq|VBhn4rPYK6HisM?kc3EU<|E{D_Q^qAA1>8VaBWfBeub2nCYrVNDceUbJ3kROAr?`*%;R-nh(b3cOE=QX zNJLU%`^HB#c>{0+DR6GM48%Q=yP?fdHb+zdWJu;!2pC(k-K^~f#2mZf zJQ>TJ1DisdGTH9L8Hz0%i^j4slqs;O?y=3OE|s_J+e8$ZIF8e4Fe!I4Fli=Er_tmf z&T=LLqE<)`81v}Us)#WCf3~i!$F8aj@AZDJf4$E+ZKt$Fffhw3v=drd9TU{Fp&|{| zR;-vUhogR zct7?&XPk>>+RmJrefHY#dfw-G-t~;7>!{ALj%3o+(TX}+MQ!D_<*uW)f_BtSq;2bX zf6OXeTd9?+)NTZ=O2=(C*0yqGtXjtttv19wA{FjB>PFm+QB|sNrzA4$S950`=pEcZ z=>e@dP;7||xa!`vXsrQa_9-@|ReW+Bh`A7=ilJ5-OloC8F+QK-k!H>e9dCL?xFA5R z(IJbL3CgBA<@}froA-fAn5~oH8c3ype~^dTL`af$$t60J%x|`P3i(zL5{p$&YdwIF z!;Iq;vbrD7{+&Wuv-pHOM$9hISZXs0YkUAvRTYy+qOEYJkJxEM zn^4~C#vlnHF#{tISo53R&HMQUtcmHm2Ds2huRGBUHXwDyTIF{2PFu~rc_yE;{sN-ULC zNfB9GpQ}QqIjXQZg;YQYYfyTkf95wq5m7-wt(B@utDGE!3agTPPaS@n|I3y_gAm%S zAQ4X=a)r`^Nf-9R$zrUhJxlH=V@^1lc{h1-z2jB(%nD)_WhgLo5acJM(z~af5M?H} zJmw?hKaL2Iz+rQQB{Mcr>5S(u032$Oc_r*g=na&y#2uT2$to+O?XK3Veqn*y<|dsQMNM%=VIDqKRmI#!CX}i7{sJ;un9g97NIJ(4kfsxGEmciiB&D(fa3HcTLbPzNbH%i zZt!S+2#FonsN!Y96{5jbe*uu@eUH-!@+rP$$+N?nGECiC9!fD27ri_vdM3@H z(Q%cwN-M-GyYXsZkgDb~O7lOfu(%?HOr%Vzzzl-Ywa7MaEu@0Vr0j2;GOJKqxgzqG z9ZO%LmQjgX<#uk(rY#}}VNf(rap7s3mi?^MCYea3*xCxKj}>)_f7(w(DLp`NW-w@E z9Bc2^D5vCG5vW_;=Y8WpRk6pP6^ap7!2B6pVYL4nVQiW|%fTL%}W|P%fo3ZCACc!0(y+$d~v2`sr2MHX~m$-gHwpzW`J$lekfA znoS$_94wS$%7EJ7KEPNDg5Kpmx?y z|BzeSY-B}Ie=Ros5wJFM9Ra+{i$)zBoA|7%rLoydWw9>4<&vl*hT=gZDJkeM8zor+ zAE{`xAwpFf1W50>urSxQB0H@>RY9gUn}!e#&GmjoHeH$3hZ0z0xXH?@4OmsRrDYIi zb_&5~e<|Gzh6Z_58ml;A>hXgzL_MN+@SfP9P2$`_4h)^_rvWifQ~nVLzmbHMY)e4^ z4po?__-rxt;XdBmB2(Xf=GP4Sn&rv%fLNNw#sp`+a+o*xe^Z|Upy?)++7Ze%mn?n% zwm+O6f9i&-?^xRU)bUTebhd6?$1MwU!E2Ace|ll%x4wPPe_y%cuA{e}`^CQBpJ^7h zY(9FL_Q(G9m*$4|mAY~5v7auUKE3IleNqV}#|_Av2wNW^&Zm*N1f7A> ze?NysoIN!MdLkVw;S?GNNZ3H)o~4V_x=K;Ev6g6p^0ZF$K8OO5dYu9Q5w)A$zb1mM zFh?;_+G52RNnsp{CxqJJ6q)svV_gLbn=3b7B#p3yecE;^N1;er78gL^f+?0qByEv7 zB;r$Kwl1aDstW)O)hj0GK?L_m)?0nof2y66?iokURMYI>%+BLpTMb)>!7C!`WQ$FE ziXu_%T7PJT0l~B$a8r!fm@nGw5=6_H;+-(D(^w|`g8$W9T_(=K0*K~?vS2Y)w-ou5 zgSFej;U0_C;v!CHg<91yLpbYwSu*+A@iu-H8XOD^O>r0!B_gKa(E^t_yv$HHf9F*s z#*1@$7_m%e!VN3JaM*A8;NS8<^sFqywBttGk+j0&weYT6KKk_WhBxo|$uFDvEmwU0 zvB{o=BB&~j?0)<||9Hp44_4^61+a8rgd6-{+fl zuDR&rU-|osSDt)!^TW4G6{?x7Ck9zQR4MDvxVP~56K`+HceT?R5hKo> z8N#%~IzB>l*>!m8r~Q)s7egMRGoAj2fJlA)4F)&Rxa&tyj6Y(P$f50bOUKe8mU`z< zF|gGXx#$G5H)u&z_x}~FBok-CscXhYqsE3IDb3p0M9knJ1$`4+MPXv$TKzZ+uhBv! zy7fHCf&9tG#$37T`i`ADf1#>obS7pB02rr`06RJ^-h*37GFHe((tU&~L8WOlP1+H% z=OW*$?ADY>zhtsKHGFR9_#)&*K|uG+J3!efYDloxAnrQ}xGmxjVOu25oTmXf2|_RYAO9<1e%qE%HmjLU;JUjidbPo!?OCVKcIfNzTDUQP8fro z^SMjDB$@_9m64bLkcBCksY7geDnjvgsX#R;AhS++V>fwJA9E<|T+NbK+0F%ye+f;A?i1>M6Atui!J!l263$NKtMa+IN$f{sVn*x$1*5X68C{Nb>( zLH(G4GmfH&uw(Do?M(18EQR_9MzX@e%aC~BRCcKCj71;qlF}OK?9k;Ke0#epXRH9A8faHb5E1xL zzj8;f)uf^(MQE^TA%NK6H~Rx=u&X9N4R$l6lFmp3L=95CKAqhljsTS)QmHQ0e%bEk ze_{gu+>~d|(?DAu8CqkeHZ&SYgv=&3_H`=+Km-KHC}swup?x4`GOg4=!Y~LAx{Ih$ zBaznHfSxg+Q5T`KMrsAr8c^gbsZiCg%-C76z1-=ZK#;LXH^_7VOj5OvzJ%O{ntd_2 zRs>;V2kDSlA?iWh;9Ka6j%IEl+9v@rf5Y*J@i8ch6KJdow6!J(07^?CVkQ7bYEyDh zaMZ9*+nSD1q*&*pG!`u`nDQd`?v8^Hp~rJ3YGGv`l_~g_@js0LlQn}$3r{xkL}DiD zqLp~NS1wjNpiU?pM>M9a@=%?RX9E{ST4wjrDXs*epJvKSt&)OVB02;Hm&1e-e}4?? zW%BW#pzzQJMP8!%LjyQm)oHDb=m&@yu-U1Nqe5Wp91{@{Z@t+(4eXJtn!X%nvc^+_ zh(svSlJskClNx0n2p1IuN`E$5Ylh$^%q2G|+0I_yRSE1T>uV6;<>tp1w?a85<Z?H)g$y#o_zKNP_@NQal=q0tTs>s;6Aq{?eV%n?+)>jw`laQ$_QC6R=Rw)1G!S(gFezQhi`_C`;kKF4u0n|m%E#m~2k$!O3(dX*4Y1Z-9q zlKo*PR1k|e>@7O{sR$%}M~pFy0@UZIsC zT#uuEs~{~~Kv;imf*P6Ge~jgJIn@HDH699JN68a&U2`pALQZ}Z8lLo?I$YYBvV`2` zhdve}LtbpfEIF1(VM8x$Nh@l@`D!%ZUrUg#@zHNlU%C_VV#dEZeX*31yQeZP4lDyt z7E5{O2VeMeS>1}`=5oo-E!SS(Xi7_O*m&K+3Jc@*edG4Mn|EI$f5<2!jVsI79{==9 zzmcmBUHPNaxBcpeg?63%_lqC@`vpAwo(KQ;-|~vK{JKM1Za9P*7J@?V!xRMxLyF?J zVWyDw#fVLz6PhJokz<(|dW;YgjZ8r0dgOXn$;8A3Yn5&b&<7ld%yzc=9wVkg0BJwt z9H_2qkVx3!Ow`g!f6IhUJjtB`&IAQJ^U9QGnw#78XTs67{H>Xijp*W;pT{EyZrJU1 z9Q5rKf#EWmwY(;(m0U(-b(!JEYP10ukd}f_Y!gjouOXZ2TAXtgA}O13HY2}qDqHM^ zQm_0gf=c_e9S-L`Q~EWL=!u+~XvUY#oR%`rJ%(TG;hUM8f3)V)sIHnph^e2w%Mw@; z2dA3IwZ$%y^6406Cb5vpY9g>|*UZF9CH2RMDw*~Ij2HkUq;LrU8uKkZ3E65u?|zi7 z9gK5Kt$@XnOp}dBF|!8D39=V=LpC;UlR+k}$mO@JJ^SSs|8&EX-&(i(*1Mno-L9WL z)Q%jv^THo4fBX6uuK4Z)_x$VmyZ`gt&3|1hlY%0(UAnyI&V4_AaOK|5?fBAtpM2@L zvhy9+Km5Jh&!0c>x4*pUv4^I|j=t-eC*OYNsSO8qfT}!IyWq@@X!4a%Z0d$M227B6 zAKe@%NE>8yF2Kan5w1`n)gV!usg|FZE4ghiVF?Wzf3u^i7*@RjVc53U=ybdh2%5Z; z!3@!~xZt#ILehsd|IFw=JClVl{DJj%DBBGggHu1lbVNs9v`Z(brOb&hB0%J!png}J zHJ2+Ir=L&^bn+0u+8>>rIrm?SJGT+*5zU5ZWFVrQA^=XeSPg+h5fB!|&H`NQ>^SyC z5aAtVe@(Z2y-RzNQyB%TSXdQOO3w)*d`@QU`aN*@5;E#KK62v-6<+InH&RqAvd9bu z9dcvHrkprila|W=7W8Wc{vQD{b|oM}bfCs(qoAco6DF>;>P7Z`*2?F&x%s~20ZqnV z$c7R$*WhHcrQo4lJlUDyp$y|h#?}^AOFQ`fe{*ZFaLMw%6R-cojj-v8rM<^@eesU6 z>DYlYPu;Zk^wG2D4xIgMSy!ZuFmB$s=R>P^eDtmt{(1RlKX&!k9y$EX6J`4w@4fKs z^w{lhzUQmkzHw^*Bj4Y2@+56rQRA%49L0I8h$9J@*&IR0Ogeo7JCi-lJ2~xYw)S2l ze@&DC-LV#h>6~LZUvRHC0w1l&<0(QDFU;~sqoy3xo>sGvr`bg z{BhbrYz2?WPG9{g4brrA&XGU^v4vODWZ7#98epd|keSg?&}yyc3d@^-2$h=LbCn@q zP90DK*q-e$Y;GLEoyGpJ0|@qv=_oML63t^GYRHz&P=aHUbvj)fh#k|-Fm0{1f6$br zjnJg7d&|MczXJ=)8+PBc?E}}qIDt#|zxV9ZC;qWkuDtrKr|&=fvqulEJy2R0si*BWbARfN}CGqd*I=bYQy*UjydM`MbMB@zt{5QTt2L)A7CX+ZG_DX0O(1b_L%e;@vs$C|xQ z`FC>9Is4wb_S&;%zWKgyhMFkDgXV>mR3G|`-Ee@G`(WMSNK>o=OuNR>PK1~3?n^<=1ekTX_f?E@p*n9UD3hO!>Zy4w&s ziG!#ul@k)Qt=pmKl?2{_TnSlznf9-U8MQ9bnE<|DnSM%hQvU}VgCb|smI)SU6T3__ToDlpT^$Ayu zQJM(O;HxAcw!-=Zihw0W8HMSMY%P0t-6;9hz-*e5ffic^;2eh_Q_M~ZKoI3|6hFNp zhcS3q6;cM2B2g3}OcDzMRqld}&M6i)NySYj+74p=jLi2}8a!dwACu3X<#r7KXX9%Uk8D;Uc(RxCTo|NnJem&{*_$x?%) z6n!NL5VNqJ7{#(%;!w%fFeKSAtw5lNh8~r^pV#5Ya!ui_v20i*5)~$!U7rzO)DuR_ z>0$1pg~$%wz(`QG3%N2kM6jh3Q5_>UkSs9yf{TL%e`keeGzHquL~nyYE)#MH2m=|E z{oADv1)L$89Etni2r=t355>hU>U3UGGY26GnzYHCcS}o( zA6wf#>03?Hlreqc|C(esX0ke$X%K+IfnxrFa2k-n-AZ2&InV$Rz*oc;c|EtaV+uPQ zK@cFhf0j_!0L68AJPP9(_x3tegIw!0Gj48iw?)B!NI7F2Ll}oSOJZi42>`K97a{>s z3~=IxZ|(iefqf~5GRr25VPYgmS#++Tu0Pb9{^6^(hsilLlro@o-3U@M`NZ?SkjEzl zX56v=fasVrXrT3dbsu-jFaf=zCeyanBr!Kif0jeq>iY+SYXPDh)UMSLF?98{CQq7^ z8;h}XJ5gst=A1(aoK6qTrj|~&9n>ZDU|uF98G68h$sH-3NY`rRl#6480{wX8f4Eib zf9M%;B}2w!u$L;B!2kji(RUhKF-C?GvXmQOD`W7vW)r0-u` ze^(GoFNxg50!DVoEZmC}rj5elgX?ffhJDPb=H z0zyWyzp}cMtP21}V&wQ`j3jC^29gS|ICR=J=-f~~k|U;we2BJ;Q94`8$Bv_t^rbgc z4|1kV4I<1MIcW{_8|=-FlO{$_o~Q{Ee^S~QpXyDX2fe|hnF|8- zM~*#pY}Eyc#^b~_XaDfgFqjH(!uVMir|}s%Pl73@&p7-1D)(bPZRRI0OH`$ta&BTy zkjJO5xaG444#v4nf7a@`mtT`;+JZG}u^yYZ=KL^v#@gqe4Rd;_8qL!_x@gO7f6!FW zU-qG`cZ7bE2ogqvFg-jePZR;TS&Fi;QcCTvFsd45c#v8lxglQ*eOloIg#MOjmS`Zw ze&JGhu-fA^JhHf$Zc_mQpdzZRyi zy!p>BP1$r|z-71pUQM5W$z2O}@7(axi{a$cx4!Y$lYX#o<({wI z@}DDN@^RZrcI}V%)5-lXIA_OOFV`2Z3$*l}_ud(M_@NtLeI`_)44`TI{aZKG zj)<1<3Cc66at0}$MXzPtS&;n^F@ZzNnKA%w=uxQxQnXS$s`Abwe-}2bp6lvz+YnMa z3mBenAg<+_7Ii2_K6mI;yu))6j%sCYVU(!{8kf=D<;GJn)3*~CB^LM~(&EBsag^F` zS#!(9P?+LUBu$8zu(qZP}xaaeoR*#>4>o|M4Si3`5c`5+QX=QGlvtooUnCem5AzI!Bu zrB@y}JicS+%Ms%jx64^_qqA^@4oZ>H%Bh|-14tn7h!gqy7A7x{qdMxcaE-Kiy49H zP#?G9;m5T1XNX`m`IrBouyA!GN|)ibSo%=ajiZA%JUpuy<>SMs4XiW zl4{kN%3E@JgE)iRvI2Glnqu>dGFJAeL}qKyB!n1RB5|+j^5=uZ0)`Bow}sb|b_T3; zc(neqAEaA%eR_&RK3%2=_o2=6o=bPYQgp72M7Kaif4)RTsi29ykkey~rupXHO3TSf zz*>ZiW{wFW)f5gHmRKbqVM>=E^ zKOW2@e<>-YFc|cy&SCV_xnJLN!#gi8x##*t*KTW8E?#}_H}Kdh<&-LndCnED{QCNT zzB2y#_0!J1YWuq{Uv~IMVeae;zPAGiu^H_z-FU(c>me^(_~rX=dgI`wzuX(gmYsLt znN3HY4!y-I_wL*L_VdlESwuNfj=kxt?`@dx9aiPcX%b@iW~j*CXaly#eb zyFWCe%eLLU@{(d|aTCb#3tYdAulawvt{lmlqX<{7 zf7SiooB89{{Op8S3@l7Jl8;G1;No!#t^g;%#Q=vJa070Ik!w}AJcTr&dDE{tEA!hD z09?Rl^8)+Uf@-GPWU*oF*K^~dqX^@=hG_Na%!(Q{#BP(i<>6=%4U6x~{~RQH<_mV? zKs%;$FHI%9TBYyBb++DxQ0<goY`ZnVM zhEHO3t8R8aKW|jKxav?ziQl%qcpINhFS}0Pc>P67V%zbWq=y_+USFer$nl29e;c3A zsV`I!V-Sva;4d^Ecs}&?Lq0y!e9G&6pgnHY^PP3-am@Fh!2Al&b3R}4_G6q+dOZ2@ zBh*iP%!o%8Jm2y0S&l;iQgr?~PqH*agwmk;DZMlv`kuq!kFGh4^rgts?;1#3NQanyQ z>99^1ZRkmOj)Yn(w1AY&mWC7(UabHjK-WzL*K1fvgbak4g^_Gr3X;NSf3d`XjZU`D zpphe09=vA!a@5JY2^CegRQIGixzzf$1L2fD&M>oP`e zUiD^=S(FHv8MS8ee1#fBigj(G>kK=pls`$hL~N#iA#Vx4VeC(K^tI8|bpwXT8Oo}gy9Bengq!^a`DwH1*hB;=OuBA|qfpa0e?1&m-geH`9tW*Y z?#JDqe=uvCB)8=wR4fqY=&=&d=?vmp4)4!F$P*+}@^5=~fC;elME(rbr?X8+Y5fj) zAHLEr~1GK1<2at=j0C~Maa zlzJ`VY7+R2Y%xQ#b_jD-xSNu_62l3*WNvdmJAPj2^H|M4e-SBHSb6{AM?6xDej9iX-SUR^qE@J|j2Ile<)NioC9}}$R3N6SDKQL_F;d!zmtZI; zgOPzS&tZTmLQSLPe=qg6u>^7*7U`3V`8=_|{EL=S5-3S8uj9ULZH)mu_KI(ie<#Ih z6~EP9H-mdEe_&L#Yr!k(iO8}{oW>?s!5IhCLz3#n4)G*%&-x46xDCQUcnxQ}HuC+3 z*s@M;ojW(?!1H0dGdQUP06-xo-lir;C=9W01VsD{CH%9EWTy7*`ms*Rc;azD?wLB} zmMtPf&Ih@y>v~H&ebX`=rDdJ;#)O#qL#dh-%%WE=e-#5D6HCu;u6p=o`%E?S7`uci z#Q3-(ro;qXE0=nK$gXgcGt(+7+H^NJ3TUbCr!z_$kk$*+a>8J_MFtGQ5Ixfzei*HaJ?BB|Ss@+wjrpv(t6 zkEIHbf1mag)LS&SyHBk^Sm3vbIpgk;whYu%u%uQ2c~}>(9tYu3K5M|ZTiHdxr%%j6 z;~6DkNyDV2n7iUU(@4vn!!%Yc$s#Q=%|0(9b4OU05Yl#&ZIJCPm=a3ahte^_%Rr>qtCCca_8MPQRbCqN*=oZOn;IRf)3wh ze?ugVlySFV{3uBn&9#Cl4L%2M`>v>++X(u!uhl1cHk%q{qL=2JmfI369);~ z!X2Nafb7-vd&tOdZ>ysfO10jV1mqQd&I;mTI)NePsjx2F_4s|%K-vz;_KOAr(!vej zBKKRYL8RV4pQ2%QY(M1pC%~Y{3D_ctf5_j%g*|fk2RokBvx^dE?v^}P*GQQcsK;=$ zW+Z1qA7Wek9SG|pJk3IzQbG>PthXUCjMyL=TPbElC|UaxMI`sj5h0Z9GBb)23aK$| zDmy$;bX`e!2~D@^!UV)?lNn}$YW}kx075#R`#sa!oJCW=n!frsvUeG@cn-H&e<^Fz zrt~o@>Q=imRX1%u*`n_sz)ZBb;DvP_5U?d7F1al!Es1kAxc2q>-QLz>i3qiSE(cRQ zE<4`IAGwb-A5N1F71G>Rc5%#2er1Nx$$Y0ip}V!R+lvX=Bh)JFW@Yy(@zX^p5klm?iT@7CY~`<_R*hs3E_hmjEp(Az;4dh6f&l(G6N0W;}AG@8SO2J$x)!fvE_w36 zE8e08m{l?n&-$N~W>y{ov+FyfLB$q#<{T$dnqP+vLE=@|aKT7&W#oIDf2`m08~LAK ziZ7Z)FnVu8Qm>M>#qrcIk!#i1biM7<^0w;9M)YoJ->OgRssemLFzq~4ZXTK)soNCD zVp&&~w8sGVNfyCTQk|LrS8>%gFB=fn)(nJ)pfP|hFu{yyT{=)~c}Uj&WZ-saqcje! zQ4r9EFQh#DT%mcZ0w@)jf7ry?dEGz*L@**F{hf_F(bZJ|Ui2|$x|Bqf78t zif(L;#I%jy)qMa^iw+os1FN+$dyeq&G$rkwdeNolEmq(wrt5_)0Pu=N6X-rDkb%`vq zL^bqqz~0xHUpsPD3#IQ-tjIJtG(x`VZVUtzCQ-7+&vywkF&``-gMWoUnPrl&2!my& zMlLJ~y57k$*loEaOGXXk#!s7>2cs>7N1-`qCchU8Ae0ISe;&D?P%5*NViPEW%dSKP zxiWM;>BI9)1>*wEw8{g1yFo#s=EzQ1WJN>^t@728Y-SXpTf$3KmWr& z{{5H#{b%st^RNZrwu=j$1|kpydVKl%7gL`<{pRiM1NH+q3ci<=7U8AEXhKMm1K%c+i@r8lN0la@b;@e{_}4*SyX7MoX=nX z?oS`z{+3i_vc)*?RA&4?UuPCo)p>^DfByGA12aeTAkzT>8H6Z<2+j%?!~tN!Vhe zK5+xHa}f&wVTCIm-2qlWY2d)og?_{0FhQJ2m?41uq}P^=Il31NZ~)|tDkvdgPQ(MG z*nf=ZqJC~x>!g&|@U96@Vlz$sj zN=3b1u1ugcGZ9nm{B9GLLH^Vq;^GE0n~x%J5~Q~R>(#n`&^g$!j!TdG7F)YSd`ZvW z)o0@M|7%L90u@9CeuZNHA^P22NC$1y+Z{#AV=|r?EKwfqk0RLs43$q?qnFNX-vfeY zuleCyS5K8S zQNCgP(Opxobb#2QHGSWOw(T3Us{vDjIj6GKId*=2$1z?~WJ%7ixOEdQnhvZnO+P&W z3(Ho$yp#CWd*j+#Cja>?h<^wT+J11#r9WA6#;^aekJL5i{dQ}~sV^gT?_Be9AMgee zlVnB#ivIQEF1)xV|9ES`;nR-B`b7_}fb~?1j*F5QV z>YYQe3B&*g(og6;h?c^Us7-TCp#ee+5IJ3eCb%aUW4E1@Qq9w>wz|p~5vqd~H|JSr zm{c(*)H5p}>LwMzuMjPW+K*#T$;LFO(w=|j_6R9sAT{@l#kM99q$DDlA&}k1DX(cc zvEGnvc)MVPO<7P6)qmCeCNLiHn&^(8DG=yc-h!ett-w07{@FLVpPk4&(YE~Y*MO(h zKf41k05s$M7rhy$PYi2bfVqt@N?BrI+u76uJ4Wo?2Ew!EUphnrA^=I*`21n~p8X}4 z+hAm2=BbmF_dBDPHRZM+NN)QShx!mMVM3woi$ms&`e+59F@Mt!o&n)8u~j>~H*FcV zauIOM%{$ftKuS$tFJKS_=Y?(CQ~&SVzy=_}m?Fr$S<;*7A1nquY2~x~01cUU?h44t z8`t^{^&f;SHpmbnlyVt`#tyd4A_Xe$K3#AtbTDnp`qDt(g@-c?3bKB>-^{0XFIJk3N}1_ zRDSOYh|hSt=O%w=jiq`8mSiMziCchAQt9<`0n^`}ab(x)?O%W}JN6!kt---d8iN+( zL*~l<{7l)SzXQp!_2mOtx7t!uZ}lAos<*ED=`rw=41a({sf6gv8A$O+|3bH!-vLrx0uNoc%WMK;a1s^FqOCsBP!X*?DZg; z(jnaU!hc8tRY!&XdQWv+fN#ZdromNp60GPAwUf?$Izac{41!Ikl2XAztkH0wT8Us? zF1g>L*gZC0{jUd0UwuPT5{Dl?S=raMp!YPe51DfARP7JfKt$@YCwJ%HxfonEo)C;U zkuBlYf_JK4^c3AX4*X&Z4mER5pe3!a=j%6ae}6IV=-SXl4Rud?()QHx=$VxdyB9y} z00EFtP9=#-GWH!?{IF|!_wQ_(vnpQpOuM+B2V@o8xLWz*G8pJA>AAhK?{dzCZC=?$ zb>H6^b#xsikWfZBCEO|}=7v@L3faP(&dN6*cLco{;CBJIxU&0 zK^s1tckc=woswKu#bW)LMP?y6^SZu@YWocuId#)NpHDb{y8ij!z}OkHZ(WN1xQa=X zFhpezEs>-Da5#Q%OZd{#tWEC$2gb53Fn=>A|7v^g)dL_<@=hs?TUSkGf9tf$?8`?2 z%ckPU^hsYH3tGR-%4EeOBP3O#gA%!OF&GK04k5Q-sdow}(`abK+-mM@1o8j*QGUk$p z2t*6Gi|#`Vo;`i^o=3L+wV|sGG4eFB>k<-(5|ay7>9kE@RB?Qm{0A6g0DWB0>LXdb zxqT?$PE0wr`4F!-i0sIBFqA?8^MAu!R*cAqO3dyAk`r?;YV*OABSyK^3t1xo^M}-e z?U7I(z%3SH_XTn&q;?gYi6J4(;sYfolB~?`_#a(o7Hd~k#__ejX{~+sId|x7xg9BX zpp;8m!XVmWsW5`RJiCX#}p z#56(*Z7BrN2VZ^iVNKs&`}o@1d+#~-?7j9k{QtkdZI*M>y3rK3%fJn3V#fHz#?M;U z(rDKBS&#u0*%-=T3fM6-`1ytwkn^sc1oj*QtI;w#@4;18AzkjtSwNFlgipYyV zE@uFBsN>qhp|zBnZc`zbBP`ll=t{Bk7&TY*DtjOYawRoQYP+-`pb}X`OKg%s0+;e6 zpC&<0nUWYIu^!Yt9N)We^~VWsmUO^tzY)bTOqbCoLYS`r^v= zp}XU;zSGM19(X8|Ab%uYSVX*IAqa7*F2)o95wRfIs1OMOOF4jon8Ut97+4U|xh5=( zB%rinb_v8BPbVY-F@8zNF)KvI-ALwu=filXyL^3j>2<1+2F1E8m3 z#_8DHLfL|Vh{jrA%ygB4w(7Dw0%!${t)2vZOl)O09h+OMYmkb}RvkuNVO!HUCsra` zm`Z|l8bJvgus|eS7F_`x9hu!xGnyjSg)OsnM1vK6*?&S{02+7$0Mm%B0SAcFJMP|Z#DFWQOQ@8x+KiXXlmu0#ces*NqAf`*L<>iUQ+`EOrU?h+ zLQLKcVVB;8rFaN`AaNvw5)x{oA2jMyl-xFCP=zZ=0>=cvc^`uYgZ?d+oe80?83L+O z?Z^Gan}0kIKo$0;KQYlLgTCsqJZfU0OZ^EScQ3V4?1cLyv8nqAsJ^hOyz;JlBa{gN z5R+?}993nk4TFiW^oe22X_2XZLi*4#;+?X$t0Y@T>OF=hoIxOrmN5;HKq8~dG0M<| z*oKt800GdVlmvoG?V2SX$t10|=E5C14+3)+f`1kN;8;R4lD^y|Sj<@4R6N~!&i;7A zCo1Ef zH9L|b48#**T>3%W0as&J8nZ{J#I@CySAWaWwBJ-WIMuZh4zCDsh?p|SIF;xy=!WK2 znlZg3hAi+6){@9-M7`A1(ysvM?OJ}+t=qGhReE2Yj#PUW6sIEpy3hpaEn8lird=sU z{}(184q+dBMMO55A+Vq%s3RZmFz8Y7y_5z&%u~W^NZS8!_#!d&*KJk$Uw(r&oPXWp zqIUE%CXev*ZkRBiL|BdFt4Cn`-r;BzJhd=(vgZA9Dx1T&}h6b2P*nkyc5-$C!Y73(V zEGeTqb+V!dpo&4r|Dv;#)p-#cV@@i}SiZ#|i_8dPC|ysa2ip>46{c$m5r34Al9W%L zvt}T%EHkb-5<^sXnw$2rt|JW6l}e?iCuH$5z#2)}sjlO*%U1j5u^Zx!PCshjp(d*I z?{Iy}t7ERh*=o#qw2zljF68xa=F#@Gw&i?DnSrsOAk-^fJ>|{v=rV=jh;vF7u=3GJ z80B(-5Ced7E_XD#Aq8bCw|_+T|MA1qgHXGKflIpXm?3(vzUT-JL&zKyU7v-{p1yLN zm!lz-KOJMS#uW6Lrv4PhIOkXzbZf3S@Z`k@AHU_~;r4>d=I-3(mYgSRuetT;YZw0J z7xORMz~n3w4%ckC^Cx!g+?F5z&V2ZzpMT*|S#*wBuyyCF2aVbA)qi8JPi(q$-J|z! z|J4s+;QtC+d-64|C>4J6?Kv>%(`!z#58sczqrtC$2n}C>%Aki=g1xY-4duMRgNl zRzQ`2yQEw+iRc%SB7Z|`6PVb6K4%di)iv>}0Ue%vfbm(B@Q%5W&L3(7mzSku2!9J# zaEzhE9L~^XlxM7DUgPOBbL>XvWQAKl9-xv=m)u;!>QL64Z=ln~K4p7as6acSGJht0SLj_5Crf?OZp7D< zp>v%9IhI4S@-(IKGchU{VCHxLP>jru9lZftMVi#2JI9s*mBjM|McZ!hlU?p z&f=^Pw5MdR;#b8<3JK(jK zz4-iB{`I%v73TqN{LWi%o0Tl$K`6!*6N+;-1yCawNq=HSS7pa~n7s#KHKzDvOJI{s zNM+DzS4Fh3#wZh3L50$xjc1!5sTwB^eN;j_Mw1w2)%I8eOT@3}??O!4LpAZqrM@am zui=YvY|T1Lho;td)+YNjyr?!TeSl#}bWRH0yu|7Ay<>#_G($uP z>-|o(JJT4w@K*bi(T*Lo*I{Y3Yc<{1jgJPM^euu_;6_OfY}*lu!*&Aa&6&Y6+f2Ku z#V7&-ww-~=GmM`?heQl4wq3b(-+gx7a@$VH#D9#X0eg{VLMB(5WYUuPQ} zRdvSkbI$W}?!IO>$!^Goypli&AwWn%2#ldbga8)8L>!7B3WZQ;07D6(OdCrnFbJaZ zqP#SyKmi#`ojQdg1A(mzoZ3LJdl5qs1|?{V{tOr3N^xyw)a6ZVas>6|tq=kx(}R%AF*3V}AxoGdRJw?t@O4wrnW`u(a9Y8sJzu^w&Y1 zx+zn(3QJ^iHk3h=**V_qVmH&_5>ojlYuxfD9V)i_)Vk&sYIfBAM|KdJsm~B>HgQV27fv4*T&p`mW`#;`$2=P%?}GFhG3*#%2Y+th zC*3&)wltL6BY|fQc1uv+v^fV22TqIBrq8>451%#JMag-+cAnO{!&O4aY*hK)Ti?6w zlY4xSb00{_*DLYoB4mJ8d zXf_Gk(i8UXqJ7+r4;f;hqaxXwl(tKiC(HqmPzoWXkO;_Z4own)EHeOYi+|AWF3I&K zNhMv>g#snXk;WZ|7-)7gqSC3=ptPm!ztj%R-&iUTC9x1fpj3|AO4zyA!& zFW_x}AJ=V2Bcz)knWlJW`hQs}2?Hapy&Dh@0#RoA#|8;n8LUC}|BS8Pe=a?tl)g<$ zCey$-FP0hoB?5sUGqcvnBoz=rI9U-XPNJp3q)BLUDdZA?0+tY#kjezy8zq%7Ysi>! z5<%F>Z43+)D9S2Mp=NTE?oH~wwjfm5e(H3vGDk8I6ImKbNzPHZg?|`{Xssz|p~cD} zEwQBqWQ}fXBap}>8KvoQu)UsbT&QNn1PsWeEi0OnP$-GC$$ui$!DI0XUYng}%@OFPw+ z9Mljoks{<+Zl0ALLq=&ph+2VV*-Uk2GPB>zL}kZRqHKME9J z5fY-MF`Pa9;C7*bEUk%vmAOr2u+2mYh0VSg$mMfGMZ8a;8-F%}gUQwQu1BTGZ(g}7 zeS+|CzdeJqeqfy%n46WEYUEq$>AsSu5&KQ_T!*4!yJi$1qL4y41;vK}wGSrF&3W(L zRinHHSzlf7t!;0a^X<7Z`=*(b6E3dUyzFn@(b$r(2Zmx7BWHx&y*m*Ogjs9UVUgWD zgf!iGS$KS`|-_rKE_;+s|eZ;a3NaYEURkxuBONvx5Y1L0@*tk)!6|0_B*Sj7< zmSD+9z#wF_cFj+QE_j%%~f?X>D=j61TgWzQa= znG#j^zpx+jlbS&xNt8la6V`2W&42pk%f*k(kzCMv;^p}C=@`h(Td=sb z@307j#x7bht?vbu6PNL_mV<{{`}PS6P5#-|v0F9^)XLD6HDXrj1IJEo`TPS;mgOy3 zG4ITA!O?G@eP!f<9Rfl#pLs?It8M#MAtJL6_lnTpx^bfbUyMF96kRdoh>xsvDV?8=#nY2*K{pjaSevj;?Vj!;9f2 zuK4w1hc@D#eO%C#PpmNpe+L4u+|(hrCkQkMnLKm6%U4zg873O&uFfns2sZc42a6pv zHNjWHjIqr^vLG;K%8A!I-@j14ZB=3WhJO{;-&}a(qDYl=_y2SF$%ExxbJ?~hk6U^3 zh6of?ckakpzVf-RZ;d_q?1-Ml)w>RD{OppTc+0lF>X-IC|K&|pR9t)d_{gqVf+z3# z_wDi%&(=P_zPfWu;n5@C@4qZUxmBw+$7c*D%_giw=JMr|rPpeNo4OzvBeLsKj_itJEP3*nh zj~xqS)%d`&EsL(6lWj8!+m|LEo>|xRq@L7x;LBTbeMkG%U$4FTPGaAIpMKpRpK$+* zcg~MKx|gRm@A&FAZ(0x8(Ew>+1`5pC^J1uL&78O2h^$;T`^~q;ytqrxtbbRghoWO* z=F09*{w5x5jnvHk?xk}jd-q1?xAxwORBxcYD9fId|W} zridUSN<;~`VH8{uC5#4*0)J7!f|^EAsm3L72{uept7+64Z0ee-P^6S`i6SbgQlp>^ zYK$9dHQJ`>wB{e^58UP4dr5zUnKN@?=Dz1$p6B!I_;5+rRaCxW{nHymm#@ohX)3$f zAx0*H5Fj{0YW?%usGxM+(=I*l&B@IN5`X)No;40lDV+Uf9TpKkyMK8O^-rDIaWZ@R z?(7qd%b#?iS2EW9_o2P|m*9+K0vHc?MvPPrjM^blw*5O|vh)pco z;L4r+a?Nf_QR%90uT1=+-uYS@fMAqTp1!F2CKBfKs%@sy((((3wLXK1&4y5B)uRqX zW3u)ipL^-d)VdGA65*Wic5>wmq-8DYXvUt&)0_4#Y-u0zhkt_`|8X5@_Qb`TO%wWK zMiHYNBvL~wJK9n5U?heVw_il2n6-Di#kidGE$ib;HpZ2XLul-}e|I4gwfJ-^l1WQC zzZu!s7`6Tb_48lE?W%q6$?e!(zcJ4#TXXAc1Ti%~-a{z5`o#l;5M!JQpo}1uy5LN` z?ad{not+umwtpq=+FAMZ0U4P$e#aL3__Fwlg_X}9AXnCkn=Oc@t$y|xY093O|5|h1 z^z&_eYTl;rA0ni<#YNnsidv5#=82rOBC51->b@q(9JS$}cc|5d^t9?H_tg9ETGy;~ zj(;O%RgrSWF_oart{U5V!c#PXa7rX#?w)b#G)hXJw12l54NDrm`V&5O7?$8&g$h8d z-^$0=k@Q$nXAP@)H+n|7r*i4m7vGV0Hj4!dvE+mT1wurBGJoys*Dj%W$MDTH&Z0cT z64reG6h)3$-F@3MEoWlwChF*qwZv7=Z@Fp@jIaH8QAbz7l~z@@Xms`V;fMBX?`=hq zeHa%+0DnTZjX&IHnX^Cq@vftwD0xK*cgADQO$LmgbFP8teO-Blb2~4vnbY%se=z=c zyR=OoV|%h(vSHGN$GA0CIHei11*@`C@)Ans~mo8uVuRA68uAqJ|ul-MV!L=q!PR8>4cUOPc zIq=tO<~N+J=x*!xepSK#`q)L4V&1&iC4bA(j-M$0`(MTA^pdu72-)AdaT1C6F%3r- z{Lqdph;YsXMYcg>wk;=G-+8Cb*cPuWd3betdxIqpaP(rD5Jf$)v>6FZeQ2_Ou5wPSTjoUD)r%Lt^Qb%dSlyNv z5AmQeDaQ^a9NmfSHo`d-z=YYkv?^}@o|vuGuFMH?Vg?9K9WM=U`QxZlpF{3QWR4ql zbRV)tl7#GGO`k{AZb9bgSL*llKez+O4a9~>6aS9W%ak)HT*A)~;pW$nAAduKpnY#QIg1P7mE{3i9l3_>s>p&M53q9+)*6&m8xTjZ1PkpOI|=LO(@9BI1Z zTrvQrMKEh3QdVYjag&8voPR`*pq2!rIeccRRTWR0bK z0J6kol({81ZnMG(snVu}Qtn@F8moJ85FHJ)fONLYy@ftVAKvN7-T%enT zu7hr-TuQ~UipE?AE(s$9KBi%-u|P5DlnsFwISb0;P!VAyN}&C*m$DY*e#QsW1noNv6Aqj382D%FKkqlz`H) zvNP$%TvDI_f(pu&iGOex;~D`c5{nD9^mAS741;0h!M>EPVLrGElt2QV`Zm@(+NlK5V* zfq+*(I>697_+?ba6GljA!~gkG83GtcKvUkc>FY`JfS|l|e|S^4Z7Muqz~DdfE?fip z-9Q2c7{LM|G7x{Xi+?o}Tm(aR!{Kt6UUO0WzYniCepnm}uEor7f%_?cMtJR@VI?nU zM5SKQjd6zcWq%v%f&wR$QXpQRv2o}kRB%QJMg;kA3>g29uq#QH9JaAZOjQ1==yuqS zu)|mI!uP+O7Z?ZvP`S31U#XNhfDdngg)HXxAWEPFV)^;?SNYq2K7arB+CT7+2qCLs zGy@VKEscyIAttp`MQ|pohEHg(TA05-``7=WN)SbWNq@E=k$ivSU;cq##=SuY@gpQm zo6tGt%*s(?+@hKt)}RAnW|l1|BF`pK_i5t2pP!9PvYA)o31TIRBjxTO;=P}+afS?_^ zNQ6N?7JvVU=Kc$WONeCe-~U?AKk@m0*d~L_@fY6kBJ{sfS(DQ9B3{SB3B`=sz58h1 zDrWoM4l*=tv!&mh%>lZ8cgzM_ku)6chifgjco`DoC##1-2|F3=4kF}KM$2h(_HcoU z^4I0{F}X=lPwI>CP=kX+;{=Be?i9xTO$1;B-;Sy+XplZa+r|`TpBkrRhhFVsMlyEFqh&S& z_edSoIdk~t2q+w(2Vs$Q#VQBsUR{4Zlv`Cf>e?S1li=p_7IWB6+!GREzlg;|S;FA^xKo_9PqX2$3?%e_>mWkq!qMa6)jPeV5TjLI zB(8!ZlqII9DFWPgVe^cybc<`~MJ&XE$Ej`mDPfG{Dc5kHU#h)EbSr4_BL4MB5`(GH!?@qcHa zoU`FsDw?`N5E=5m@Esp%ohp%rTTk--xsxD zBi5i1GjomKez}1;2hU$0M2Lzxq22hXK@4l)susumBBcI9GDBy_7k*a|{L3gEeZ0$w zsV^=@PF?FFj}QP?sZqa^Bwxm`eSappHrFmSE|zX^pb%WJJ_vm>7pKmP&vGMEMfg+x zw>+6lHO!wJ<;AheS8e+9JSb0C)mYi;nUbR-s93gCtb0{yQ;eHjQ>FEO;r({AfL-&3 zZ?*2S%Fv6$IFzEZj4b?|<9Q3#B8uW4b3sfIeSwM<%=0HS(OWq)f@J+Oq< z8O5h1;oub_yw*xV*;uWN8yP9LTJr6i!y0u=9xaGS`BLVu!Qwm-dmWBr#F!^aVFI`J276I*nc#+OgpoMO#afRbWr zQJ`)B_&h(qSvH%k-s{={Q#@VCWatWOXyU~%)b0G7%aOp(;UNsqM{CY_8y+=E#3Nm+ zOq?1n>l~{~HG$BI`6%i67@*kU2vS5InVe5kFSQ^7H}XSGP4;ihtA9WU*fY_q4B3(5 z1<4I4;<5s&D4+Z!51y<;qg3>DC;DppaL?X6&kOy$G);O`SlJ}{UR}7}g>V%<_#Huf zV}*~0tk}{jsZ1Ki0~nJ_@xBkgvG+PX@xov37cVz5SGLFC z8bC(Si)q0KRGMD;`9&=x1OBD~tsqU}yTUL?b( zf1J)HeV}wLh88&SE+De z>V9`I4z%GY?AWjfQ@C!L-9>u&nr0&eKujOJyr8WsoX%oBwz(rOr9wBg0hnN-dMpB( zZrgb)Xwv?qLAFBTlPMm|d)-is;!P7kL|3}T- zaGAdUWM}!zQmq5A`I`*eV=E#KX~l+6HT9?@RDh)_kbkLe0(&pE1gIOs$RfSw1A156 zA?-3-vb}RA<6ql5-PvHBFVhy^aN+cx+U+0C)XfuW>@-$kVKxS(7LVNzkEaJro_ydZ zpkmIJar9hyb(^Kn^ZWt_pvH4!5Lddrt$uN!)1};S3(T2N6r94mdD;)aJIn=vL@YVQ zZ~x30-+vFy4Zww@0giT4k7#zp&Y&yBwF4j`55amPK3d7(O>TQWBXp+p4IGSHN8bAS z+=u~`)goO{-a`fZFzrFvg%X+e1G4cEM)r5P7c?dD7VG+ljkS_tI7p$ zj$Ad7eK%6-r2CGA2ddJm1ncIgb=HE*A_L&_{r<2>!NU-2C4SpvN=4c;lZ(^ju)gL| zt}R2qLTO0%B6;kY2cmxVRdw*zz>!?sq8qE9CF++QK zzgJjqgZ#(&GX^1ceNdTKxqW$l3SsYh7#UAEzskJ1o(JyGET-tsE|t7)l1>1a9qR9@ zzdy#(-WpfHagTWu{*6r89Kd4M+1Uc}`G5YVy=|RMHNxzk@PeCk0Kb5>Z@s`Q30pJ} zYz9G>r#fA*%NF+(XV1c8TM==(uE7~ow@0RxkU+ksOXkXl8TnZ@D<6TDfR9^y0^M7KM zv=_Qua`P`LOtY)XP^ZpP3&Shy(z*XxXtS^a1UaCuQ{&#=#d$ud1oq@pxkh`6RZZQ4 zL+L1Ln!JjYfl&@Py*1M`{=^Djqiip|u{y3G{VU2&(D9Vw57_Up6Sp(^ zSjx%q*cEGmhT|09!}GWj0rWbNrCwNeSL}kFF)|`|PeWO^$aKbVcS<@)S$__XdNrH> z9z23RvsQrU&T^ojy5M!_3zyGA!2O@ijWOc7^!0P|cns+2yH3;fTwH+2hByt5BR zORhdQ`dTx-k$fBdz>Cwl?~Q%e!@YBfe3*$I-B|C^pI*Z-r|8Q!p`qpE$BGE4VBvB=K)JHDx-+;kS%gK& zsbQR9Ts1^ki_!)t!f-c$H89u=BRzA6n6q_o?$qVoL)jBi#Gcubldjt|8~ev&muGXo1%f)1sORI+h=MsWdAP zgVxxNE>AxZj{_io{pI5b{3u(edc5iV<5H^yFgM3z12f zhRz3JL{g6hv@+jQV0dWxd#Lre#N>`!>Ax&kAJyiy>0MxmekLkAQg88ebT+q>-Y5yB zfarVk>NPnxN!f$=(Pq-yw9jiu}ar`@H>z7<4E70ZcJm7uO$m~{D&B19N6KTabqlQ9 z1$dp4mVY6n$~y4~;@*E5`-9_&{nW@~(;CZsSR5M&Z0AQ2)E5zuH1LeNxY zv9d{_39c125)l%_(kcyBg`j`~3R*w}l>k2&O_gO|GwQllg#7PtoQbE&Ue0r zN8{6q)0(g9Os;`M8R&9z8E1rK%_}Oe%+P9jy4M7wh;xFx@#fx~9Y4P*U2nSAkE`)v zj7cUGW7Ir#DnkZHpa3u@^Pxt9v~bq+gVTx_4uYiAP^Dhhk_!y7VMCLUoTC=c0Yd?R z1b@UTLR-ld1yxN{$^j~nAcDqW^Ckr$S@Cxgm-gh(eboNFph<<9rgKTZu5>i0H3N8?2;= zrgy9nixm@UA4)#{{P!ml{`lmg{eSye zNeCj8Lxw%LJv*lzl>nB(+8PuL0RcD?N+OZ1=f#i$#TmiidP2Z3&$EL#1wxFN_STH0T>!#_w3pxhjpFfC5yu zN>nw3O^u*h?>cir-q=FJcFr?^u5q18!Lmy9v9(aWK_5ib(rq zBs)BTga)7zSbNN>N4$6)p1=krMasV3C6F`VTnF^PmQYQYkmm-0n6w2d*zV0)3F_HM(v3pxD&YD>5i&!r2 znnhbazTRWqQcGCQ1_Nt@-NrfYqza4IeE4UMqvrko^%?K%U)lFw(AGKa;LCMA-3&(F zcje;9CpTeBffEraMk;Juuz%#_fv(@)&sg)We_n2X`axDbWZU@*lMg?>@%mpI7c5%+ z@jGldRd@E>clGrA4-RF&dE2sg|1$n}yMpO0s1T&2APmQR`KDK23}+2yIDXre^KH*O zJ92B!hNH)8_WX41Cr4-hFDzkhkCua{wN$+6?V zymn#9xqYg(x&684hHjk8c+0lF&uX6i_4K_v7VUnj?ui{$JvZwFtf;cko+imySLb-? ztOF1_h%dtPW6KhOV2Tos$5jWA5kaeul5FW1XE zzc&ZK14FYGF~^<6xqkyYo0{mrH(r>=gc$o1M!KIdAIre}S9hsE{ zbBw$2xhI^=RWK$aQ9w&%h%X6X70@3B&`cHSM0-hIW5t-(w(447QPt z>5;ctUDMVxr+=7YGE-z?(w2Xm;X%mc!n-eh3}KGvTXVD4HLsq{s^>p^@$A@_pD*0L z5GUU;@!%^fj=ciNbTpUd;A^{@L~aw2M6>~Ad@e{SW2KhRD35;nQc6ul(gtIR8$iNR z!I-3!4AD(VZlps^A$AZkCgZ3lFHJV#R$0Cfe)hLx;eThrX08;Vzc#^}=aTxRTzE12 zRBoO@X|-g^u1Bov!{pL!tPaTK3Yx?}cPtvQ4UJ!I5?(72#OW@~-(CT5-~v7MniZ4E zEwVgD1{!8cR`Qgh`cc@FPPYk#$T=~7q&lJuuo7>Mz!?MX={j9ujz>=ncEo6ZBOdc3 z!hl3>%73a8FS1Pg@;BdLnew_zC&cLX`#(Ro;o_UDwtV}$AKm?FFHI}~C@xV1DmV7l zwP$;m_r4_ZqZjuc-E{dFD-7LwP(Y9gki=xAM}V>`gtJE`G57+DVqLF5kBG zJ6GRt-MJJ%kR%8)#YtcL-rqmk{KXM!p0w%8g@3un4-dI>)wrksu<`1N)`!+F+`X68 zH})KPot5f3ezxbH|D0lD%XeM8{DZ!eH$1+c!Nirv4-3VMqh{XQ_qWa0Pq1O*rXP9x z&TFUgvnO}$dhFYmPPcx4C1sRGWTM9%5060_K5Vf%E3zz$)q@qrfdFlE9HBq4Sq>T* zQGbaC9i%}Svre%r-Q%bP?#^zsik)$mOjW&5rF*@583gVbbjixwZCkaoOhL5T2 zR*vQlkF`7%jhj_USZ)&5UE)$;UA{>&Yk%{Sag1*f=E`(=u~sap)z7l9rU_IQawW>u zL9vd>2GuZ;)pfE$S(eJYx{KxORiLy7hfoTuI#{WlWS$BQqPmM^%2=ocDsTxH7NKqu ztLbK8OVixVP3u;OumJfY6x&&;MJS0V1R+;}s_$f_E}km@SwN=0L$Q&EZIB;<#TqDe z@O*!}$d;f~#zHk_t1&D7#87mnVDbf5W8YF8r8pX!05>b)1N=&@wOusnoAQ|!E z;+)XP`zbbCcgG(lF~`lU6*1`JPFuX1U|WBc>pNde_K~YhcRjJJGssJD^0Kfkk#5p9 zdW&SMX?M4`3jw&v;T2A`PZ-4`g=)%)-V~aqC#IFa^R$-Q63z%NxRn!{YRWX(#OWp7 zxsM0>i5oZlpJ+~86_l$0DzRt01^pBASEeM8HGfsBuJ!;0+OU8N|Z{;AW(rKsX!8D z6p(g%C7Dqm^_NLO6h)e2B}<$nA!&bBYvk>$&DLVaHtoBu4WBU)h9-t=f`BCH?np$g zv;YzX0Y_x|xJ*(PP|MOu#)<2Rv6Db>$#~x61lI*}Uhps3C>{GRWA&eZQgZoEnb zV}dirxe$m_#Hf+Gju}-LF)o-ghB?Qa8u6N8^KHy1VpL%iQEF5iA{gQfQK~Q!cC;sq zDdEdz3{i?0L5v`SoI)vPOfeWVhMBBj=`WTlE{r)>Re=ds!g&#l#OCA@kIg7ks5_zs z6Vi?8nkXk$Co~gF&;);@NTtJ(Ev^+SvC79y=Zu*~WufXzg@V%IOL`tgR)lDxQ|b0v zDsvBiDO1BAE!kHlA45`tk7?a2^}Fiks)vV!p8dVjqh-Ug@Cu8;O^?xcggeahAJkO+ zEvSuE&mCqY^dYd4#|6rWKan*~Y7%b3YmKmUT~NVP4lFdeZU=v|x#LQzV@tBJL&uyU zVAyHHN{@##rI;~bL#8%<1s))(iX0w>2&kjRHtfd~gleaZVk|nxfmOJB}m;G3N+To|-{) zJ5MPn`SO4>V*r0@7Vy92b$fQQz4I_kM1e$%s z2tW#Vx`-!h70BRUXJ33YdBe3a}@J2)polg~LOgc6(~3D|aktI;ETt zf+@p7bq|_YQvWpx+L0~RSNt+y)GsezQAvE(2%v$igP(suC{9rsQhkXte*`L06h~lA z8F1E}8`67{H#uWk;R7pRY3c&35DAjy-J&Rg*x^5{e3NJtY$;Ldd1y|bR21u?#QG*y z&Azp!n7)OSpJMVDjbwIM_11lKcBY!x`=fhy$;2#4k%}#>Qc3HIC$b95g8?I{B|TWu z^D`;J4>W(09V;aYh252;76+01TB%yN+p$d(LRakyOCA3E6RTQJr|($dow020jfQEr zPJ-XP;Kr3fhicMRmtc-DCJNQ#^X3#ce7@-JS%?q3|KF~hx?MxI{5X5pzBQfafV;}R zJq3Q(=C)>tO?>rgV}9f3e58+1hA0J;_TImrRDXYe<@NScG&ErF!H-^T`zxfTZ~M>V zjL-J@7rppaS36+m=0{hGPW)*{=be%}wTj!9edtJD{ZSl>TU7t&fxms5jvb%6|HzV? zje+$G;)-U*&&#S9)S!*&mMj-(9w3)e z;=sH~=~YX$F*)!5(B;^+uA=2L!hmqj1WhO`&-(P^8GktgDS>&9S`+v08Mbrds;=9> z)D;~Uwa}RS`lID#o6oL)n1#mvHkKZr|W$4#}P&;MW7Cv zRC@|M>E&n6Lvr@aOUG#cEade9y1cq`B*7ojzRD@JF8ILyS;W z12Ve$+SRh=w!&ja?Ndvqo;|+w?j?W7n^07{TMR87{EL;VJMRFbt$%n?v5l*~*9N)+ zdtX>|>(VQY^|Yv9^}|*LG-iv1*eNB4cL8&GOIG-c3np&gC&mn4-hLB#lEF9by{8XC z2liy_*b*#!BXh|#5e#A7MmR%UfD&5Xei0yR*>`P|KCXr2jEZj?!3#(TRi%H#o;soC zU|#J3NC~Zc@Et(HtS`^$3+MSO%k$p(jhHlMYv*ljO9W34Q%VR@)!5RVdr?N#{QC1y zSi1ag7gF}s*k;WhxOBt7{kuJ7laU%6`m^nHSR(h2ntt*VP@JHo{Q4jFJv)BoU%QI& z9{MJc5HUGC^WS4Y;a2G_jl*tI>&QI<{Uh-QsC?A2;QrS{%s=3o^ z4ncgvypzYl1(XZSICFR)P`s)A0;qxbm0RBIyq>=IZI&=$MdyF*iH)DKVZ#zSq=0L$o+85KK>FxPJzS$Tu2R*h^+}fM#7yl*G)74@ z`dRlqi_O*0blQI#FG;JFX{?jtAXXkq_@BcEsU+=`U}HIgElFcm-dE(fih8TGOg)iR zmSIAXqft&I8^9>${#M4l)m+YMIWG0(!v<=rAgSO}%1JQ;@Iu!q<&+U&OC{c+iY-RO zBvG3Od;4K$GV;2eZhAM+$Aj01n8+#OV6^1+*qxr007!4duh2C6r^eqs8EKW zMhGC&>9qC2v{Qy6Vx2mzEsSNxmd;dd$I^~;hSuHyDfj%z<9~mwv-jEA zYoFxT$xMIFS?gQh`+m=hgg{8eMwz)y=9*Qund_#A%p{R-#?o!l)|yhY$~Hs8 zR9TpyGDTZ#61KzvLSd{ZPSLfkl&ew2iL%h8GXWGEWO0fpmY}9X6eh@gi>_&aprDy4 zo7KfGSs16Y4Z7H%f-Ev15nBU<7z9}SyfmHC*2sTClgbt_-w4)ftj*3lfJb#QAzb-8$0}5#bWw+*{);drR3 z*&>r7_Y^{6WB|j+gihi?aQ1w*hS^|ko5;6<2>=mDyFXI|l0cwVh`_{ToS_x~h*^It z%}h#3Cv^F{Z}rC+PpH%nXJl|WL*)Rvjb5XL}G4k<4i^|Q_ENxSTcl#nq22N1eqz;Qr#%c zWY}iAx`bB5r0N@T9nH)JOAW!q9)(gVW2byUprl+u=IgP&(HNFoKWghEZCjU`rrC4e zJfd>K){WMsF+8RbG68>;n(VY`xt2ymB5PDQie4_k5QIzcB8LxPFOoU;prgJrxE9CUl>~JWC}0`6r8nF+5QS#B(`PHNsRJhQIYC zzBY-LZ~|&sts|2vock`jsO(C(^+zBoB!C79R-qc^=_n&y;$DB!%9Rh>E7Tyn4Uj((bEqX zdY5+XSohF>Zry+W# zqW{yA*{OFde)so%LvPEmsDQOWg>`p6ad`U6Pt@GIATTXpY zI=E-xzZWL#9$fX_(e+o~5v5VvuU~BY)$=X=t2!Tka@!~8L=M+HeQ3_Bhd2HEPolYF z{l_O)oqQ{^Vw^VCO$<6po2-lz0y4_bvK<23%K3yug!w}K;uqO7s_&)EC9mZRjzA~LUA2f2>NqoVI?`-jW zsl?jk9|uyap2TY9hiZ?2bWcExKxrYRaA{ESCC?EBK}Vo!UsH<@@5SkpLWC1g1Cx$*0(iFy4{s>q&ny^un&0AWO&rXGTvO*tg>CW4mvj zD{dI5`|9eM5AH2&T08rfj|M$o={YcfXc$qNx|S~wwys-}pSU#WTsi-#9~2gD>e%(2 z@BaOg$W0$Odn_~mTYY~#e$UyXpaqa&gEBXH-eb=Nlj;P{*naVEB0GNY`p~SsPtJSw z$fAGaM|Bf18?r25;)6FY3(G=uZ~WlT!i-t)lV9sQ7p?olv$>95VP_6rzbcB2V$70V zXU_J#aCqhm&!~nOUC$iZ{;%_5)cE_}dPU?HtbG0D9XE!A=-ztq!sqtv*VAXLdGQE; z^Xrp$ZfW|`?)HJZgqYfYfy z^Ol$itTcU%4ZyGtx@R4FW#dPu`#<@xVeN)e-`tsd_U7-td&9M%ReyPR{Et^5DGj89 zhOx`n-nOP!1SP0nK6vZ$hAStUwyb~HcKM{BahpyZZCcac|IwLc$A69>6rwh$YI6cUROt7y|!QeJ-)N}=*r z5SAAcsuc?{{tNza?!9y8o^z+akYOk6%r5sn^PK1Tem~#Kt8V>Sh5~g18!+KO?<+rF zclZ3b7nZhvYv;QETw8qnfT|45-~T;s&>|SzIC@4IAshQD-`~6T?#GLc@6+v5H~j17 zn$eS@d1&YV?!0jSx|lLJuP9AA_=1bo= zeP+kqi^GS1@|8E=6k{suj=iH7EZKPLqh~LkXH;R zvbG##dL;|fuc`q6Br1xb7H&?ndrXVoTYM;UOLKyf6HYRbJ8^df*2iEP6Ls0+|GO;o0-Vg;JYVX0GwB~|Q}l^G&vQd&n*6k$;|^@`SB zC^V_k6wx-M8rrxtUIq=46ctLcp(G7+*Z|G_*fCueO4!^Z+J=9jsUnIqSG@n0XztL( zRxVEyEq$h`1DZNbO9fgwRj~`(9)y-&XdEZYUldIb%7#vC?bMB}ve;i)v|;4t$D99o zL(l8hL4k}WCZw7olBAtmGch9C&5qrF*%@|CfQF+u$~fPngbm+^c@jT_gwp9vpY7#@YUWl6LS{ z3(9lT>0MG^-c~qoE0k_L0YC%=jif0EB}=8PXHO$(MGAizfj~iohKD5f)nY*ywPA(I zu0<6{2^s@nqgh*L9Rd;%DJG?bBD<-zW?~JDV4@blV(TphmKezp1)2gajWq-^Y7$Dt zcQ}z|Hd<-Y8o_W_nh1?0QwRx(LIMJ%fix>kOaw-wCeXx2V?fBv2H7xZ=8(DV0WtPb zQSPHc0QP?k5CKMDeP*`!Ziy;sRcZ=N>h7|6g9s6PAEH4^LVki>9U!4Rgn+au43SJkIw<+@`7N*ApdG}1! z1Pt}UCA|9Aj8@2917*Z!HO|Ro&7`uYiOgEMdia0xF*>~;51E|o>P$*TFPe5;dqn_s zfNU9FWG*7Z6hh?C3OyhQ`sdCSD1eZ)X3Yu!Ndsb}=>mvwzGR8@09wZeVzRf2O&(#R zlU)hMBmtF#X=#>9Dvmt67%y&tNQI_x?Bsc`?S@idpR(VCjaJD*nqxG9-RT+w6qOs& z%vygV0c(!VEJiCP)|xD{I$l33%~sMv#vn7=Rk3vv#`PjSLm|yp5o2FH+5yLadl}PG zY+Eaol<}`ZM2L$xX$Wi5?OaHD8cpiu19%hvT&tLCWAlzSykl3_OXiKX$m@{3XBPKj z&3gZA_O?|1=#11rH}A>@uVFtmyUmOnGOB;My!n*!MdW$c$u4Nl6_3Q}779|3^9)8a zOT)LcH|5#HyNv!iagm?P;>!Cm-Ql8S zal`dfva=lxNrk#&91}@k9zRJag2Bh<9NG_4i#BFBIdP<016yKjYa_9`yM;9SUPodU zHk#wYm$VoZ4@xW>0hv%&pH(q(DcT3y<|Ww^b8K2AkQlM@fk+_`R%6K&){yAa*$Af+W?W*}n5%MAmYQ0R6x>qQf5dmfxnt5i6IytZ^l{c(> zc{+I>D{r(`W(S|4-lv!M(F0x3VOW5mY1-0lj~@Na$lY@=cI;#C{%-z-qhf#Y(_j1G z)bJm7^Wzi0u;b;PgFk)h!mou90DvYCqI3P7(Z1ilUS7R$DA?JT-9O zwdMalEuggh-i68gwhJz9yz;lofma^>#Wq2p4Jayi{b=v5yH|VO*eV*vZ~g3c-{F0| z-&woXzjSs|)hDA?H8x0lrCRXED&Az0#2*yWo!fJL0 zGrNGC#NnDSncPppJd(RtSL%<^P%@1g^WK?W(0N)|At7t1afhtlNR59??~~lj8AFQ8 zPjFEWUd@XaN$qwn?kpqkME1D={e&oBSj8eXe?`;Oss7MOP@e zXYtS8n*ZLR_1E7PD42hd3S$}vzP{=5@h6TQ2^TDU>C!n-ZilYfvqoNCaPr8Odsjv0 z)ENg4t-gIi_B_1n(|J^3F(>4Dg%MNQN<|{!nBERh--Q+<9M9F-ZSxUzb0 z%%$hlkmLHxv$WJV6MNT$UOHSR$~W`sd1_tv#FPOJy4SAjh4T_BGpRJ*1BeR&$e8`S z5lCrvr<6&Gg)M&s(iPz3?Y7(lsVhHAAAD-VMln5<%{UD6{!eTE1SKItrDS>;FKIY4 zQ_IVrj0y@jur?YSrw+Wjf7$5SRkuzwEL*eu>gDyHd`SJ3whcdAb?0>F=I7=fJGSh` znWZ=XAV>fZm^R(HWa*8ID{h??Lo+vDIxYf%Jb8G}!4-cu&b|2Gk3{3RHKRAaegC|y z3@to)V%4=1EngkBSVjz3=xI+JeQ)H>2^yHSWc2)|&n}9=hi3lio#*bH@7l3^^2+DG zd++MApZs1Jd}Q0s{_TqtqeLJkKp@RB4nnpKLc)AaMU+}SepG0PNofKiGFlKoe6C5R zJnH|1U0HvR9LEjr;#oawOFksa@d3jRF_Hj&vUB+*`TxHv4`fwWldO&)EToy;*}=>d zoBa44gwl0B4ltuI%_XrlM@$CUvdS@BubH^Dwyc2|+?cNRj$LW8R#PsH!+k6&Rr#4v zbe%vmPpu4MGvrYUbAp3O9*c6|H$@%jSaeUIP$aeVcQ z>I=~^2zh;=PrtW!KjBwD;HUqz_dn6QkMQC5%OzqHq9 zfa{^9W{DiaZT2H7)Onnr)gpjnOCYCT+jHP zIqXcz+2wsrkuJ?{MvHApR6#0jfmzGEsC*`ODAkRwE2Jht{BoI*-02Y3;r9#P`u!G< z5a`Ikm$O8Ov(#{>AfKi-t7#tGv(U2XcUjQ$25J_g(zyRBH|J-aRm{Nv34jHKSlJAx z(J$8m2w>@Ii0wEK37A0Ifk=!%;7d~>WN3b2hh{&{4NSPqz6TXmQAR>OI|)md#+^GN z33ur)6(vv>RZ=!>uDMLlbqPB!hOB?4fL-Hhq@N6EmY7(CS%6VRO{ll@Ak4P(8O6oQ zf$xuO88oeMnMHLSh35COZ@5N?>F79CG{pAGBm{I_K!|UKugDbAf7d1PgWA3H{&=u! z%xv0+=?3Rxz8;b34u#ql#xYc+^#RA8c+fP)_gkl68{8%Td_-F?v5`~7ryCe@ zVHQ8h!vx!xIHU|i=0_@KBCUU2l|{t+m)V=lb&^dq^Om+$kZUXCEzBrVqcLG-G0BhZ zFBnDDD$8|NM=6=;tlw)XLTSeta@6y#B)18{7djB_bChR5Ndwxy;-DGnEL~j#wG=ji zL8YvICqc|vpBa&T*aYR!oZOM+ikS^1!$`RLLPUP>;2*3mx#gZNo4J2wI$ZEZuo$^3 z64U9k1RjTorQy~ZsFH8V^2^d9FD!R1i=6XyHg06CI9y!d($)bHC!IW40pdz9Cv1c) z;tf2E{m3K*F}2ZL7}5!d?pc3Nru=^^q$_s?#%8j>5kEL*C<{4dm9|Vqqu?$vhLy!eFwrSpWAj!b zFtvl*@XlguC(yW2&X%Tkw>l{Sh%kBO8ExGeuYQ7=6P#Im|5t#&17d>7YZxShi=sWT ziO#HTROt+mG2Lw7RNC}I3M~(>c6MN!JEoGBeS33hYt0wxxO;z1-`z!F$>qtw`K`8| zuNQV)1^9q)EbnxvScAs}fiH+eFcc7h1my~arN;pWBYkgT1a=xr6A}gl6gG;7B?Mau zAh#@X|HR29<3W~hgsSQkJM&T*3^yDd2X}?BT3(CDY>wv#6W1iO{juI%=ZTzrNmk)9JAh>u-0K}G)KJPvP4AC8ZZNsN4=yJ z&f77d)qZ~+kuamAc}u$6*Az%8mjFI zm(HM{(#@#!yROrJ@n-m(Yfb5oowvoaC)zEfGrhHB^xu$_WD8+ku@?z|QjifeaQF7Ud%R z!HR#W^r_67*BpDkQ%IMmG3Py&*{}JP-(@Fe|CF5(Wa&p8)J%E24J}@|KYDO5C?H#X z)3Xb+Wb3Nn@fD@zOn6bq2eM5FSQu^Hl6_(9O${qC6EjcMBN$ZrdGZ~gWe(to)rfi2 zM=fwZh?gYuwPY4CyGgP0Jj)Q>>V-NJf4P5m_8`*L^h91GR$Nx4nMvh%G(&}H=nSW? z_1sTQN4V9x&C3TN-8~I%H60o-?F{=e$hQL;a?D_fjO5s-P?ds@e0k}6=#w9m&AU9X zyrjs}(0WPFj}t)IyiDDx{vJ4ixkT=$cR3s*h%NI~A=_dF3eO5ftuNF{%qcDMLot5} z3GF#OuJpBDEwT=MQxVDeW~B_jM4nCCO?WvwfWtr}B5fInX1p)5<0G~So=pcT`)YY! z=N;W-!#;4h&(5=LKWm#H^u4S-l$RJ05fMXkX;hzCs%B4QP0CtC=8cA`Sb4H?Gym%) zNw_h|*~MLH{gKgJvW44PfaV0`+h~6mA2#-35SFc(|99a>tkxk9#`Gn@JbYrxsbu$1 z&vQyRrJ2jSUYvr^CfHU!T+eqEaHqQsRWkGaLjo+Mc*gmnO|$r&a48d)Gi(GYjCEzc zOz0{&b>_yctbmy`fE!aKOr8ciHTmv+-#J2>Nwuo>K-MH81f0g%C50(OoUMQTIUzQ7 zc03L7i?{lCyYOCXl*uu(9>k?LvL5d#tY-#Nv~YgF9iF=LJt%)yq&ul`sStTs8C*)UyA&;;tr<^wPCgCf_wbR zvfInfzs?)IF|l9NrN5oh`(*1&SF1|)RaB&_o~N;3{3)p*Umc1iE=yNHu&>5^ zxr*{Il+S##=vO#k%W%xHFbwWiKsyfpjurCIy+7BE9b~W@UUrCJDM84#kGpu|(g-$- z44ylOA_VOCx9qeD6VQO(SEii^?`u zn01xOi$#VtfsH)Ec9Q+r->bt~Am&~6%{Ho#u$)~_?Y&D^RMCIe=@_lWgPk3^6&GO@ z>dL25S3WzckV=1@e0HPZA(OmL>PlT36RKcWeVy}pvI>tUIiIH?EU>WkajFvuv$I)- z%7WA)??iG+c4klH4kgr`kY$^nK={=q?J~3&`O3fJwr!7YRd?0|vRqYjEhr_t>z1cf z^ydmV&)8w&L4^aNI6 zBTb<71Trbiwp+a@B!tt(9T=zD#n_@W@~+en1ap2jc?%*hjf09Pi{*Yz{MF7sI?F?> zBk*f}SMrvDq$`aB&nkR&5VkW6!ty%Lx0fvA#??N&P8okc)nBKc9lOw})H|JB{zurg zHK%di@w4Z?i@!@}`p}m&cASx~v5aMb02xKL<;qq%Zj#Bgi7l~LmSq=2;*Zr%AKSWh zoZ6Nn_Uu^@LT)FoeON^CUgS3h&cd*8{^x)BU6M$l608!$8RiTzhBY;b2u!6+rIb^m za;mAUq!EA4FlW4^5k?WCSY?n?#2I2NSwl+I!W7(qTQ8vv?d8eg*nk;<* zp6P;;tNfTNmsiA1Pq;kEX^$ZxN`f~}Z1GM3?2NHQbrBIfLzL4Q79%0H;lv$}5JYj( z{-mcv8B7V`6r~0$r`1H_vqc%joF!I%r`wDWnkYX~%xRLCU`{b-tfVE`0n^mPDhzQ- zG){jsohoDh{0jn6)@q#?%WIhB++Epc8d5sj0QN;NfEHjf}wOWsW*no2YktDI^o=9FlR zo#R+dq7`K-N0gG&P&gAwz^9}EjFVC{JDY!;Ba-L%{h||iF*@Y-*Ry3yk*Z@hN0?_B zsiDaSD}pm5i_QpSx!FptqHQiN<_v+7Y?+hRVTMpC*hobxN{jMZSuwpL-KHX}O>UK% zb(PJ<(HD*RQ?qlJ5#r9qnv^+oO4(q>8Z9wSFriSz3Wb0&q(VR-AP7(jIR%sf3ITso z08s$JfC7LNfDvF=!4yyo5LE~S2m_1&K>!gzFdzsp2rvSO0Ez*@fD*tkpbEfHp=h>- zV!#k!7;pwT0Tctwp^5;ZkR@v{q!e)sC<25ilmbQ-h5^BlAwU#>As|?x3cwH`0yzSh zC=>yV07eQyfKY`~#1Nnia)vloFjjw90+?rzBY+v=Gov$z2_i%x6e0u(#e_giAmNB2 zKnSE%K?ooM34sg(1Oc8&ttf~SdUTP68>F4uW6Tbzd>nCEkvh1I1DQs&YY z7~$Mw;0%~@Zil5P8=Y$ydJ7n zd|0^|HkL(oMXZ)ZHXTf z?fS{@*57U4IeAb&*{Xj|?ypaG*4{nZIC*gA-S2CYt>(#AVan>S$|KZq+9{>ywAg=}z-_dt-9H5pOldJI#07&FTH-bf9R&a=(8(+-=33C&Fokt}Q(y_Vz-1FLYYM*&Eur@Sgtc7?Il&Z6osZp<_j^ z5qrAu^~f`Zt{%Fk3~bpm!mb{AhIDk{?H;;j4p(a}R!7oLA1JyW=P*s(;%41F`&H^QzF zcFZU+Mc~MR9R-&3t=Koi?l+;aJL(ui-wJzf9GH=Bggt#2=wZ-0>{v1|L|_ZwiCio4 z9NDu%*AyKi@*cl6Y~iC^G#U7SjCu7%IHkvn&5;IF=v`& z_1uc!7+GLQYMPj94V5h`Qq0sMQ`_v8NHK$pQje7HSMEuh+nP-sk}1^2yxEtl>77yu zN^SKb*^wdvy6ok-S>Yn&WCk6`-2as8Tk=|NZgqdQ{Xh{V;tV5%T=;Ktud)Q6+_?{g z5NuEOe)ZSN<>z;={NtYS%Rmp?dy#F9x_a#G9=3HEm~mi+onQZDSwHD@!hKtM8!sO} zIc}SwXO9DGv~P&66LlTwIWjP!V0Y*`vZse#chs{-eO+|EIN04i>6_!g6g@ra+p=$m z{kDJft)oB}-S%kUj0cwN*s|xu-+SY}9(h*WvqoJz+_$5?83vXJEIDwe&wlgg+m`gY z@xYGvZP9=9cK1&cuN@9d+0}=EA$yMOIkN8@4XkM2mOWGWtPy6m-Ym>tf)J99|J<@=tCi zma2~J_p9~w4wL1O zSa&zouE{_B=aC)vv!pk_UVS^MY?RzL@FjyKfF%IMZTB+w{_EWS7q)+fSIU+SYwpXc z5?H_aZraH)=c>OSIQ4HLbA;U9nd6*P= z3kHr`=7-Gr;Co>a;bE5W$jHdR(5;!^sP{FprfP28J{%}WHD>A<>u=tXFSEb6X4lsn z7mzSRkC*AKJ_~IWOhA8O`WTyfql1y$rVSFoKw=}vGX2q|E}ClmOkFd<$bKDYYV_*{ z6QLPzJspK->U%O(sTjQ!Mvh!BPWh}o#jbIU5F~Wv5#K3mZtbo>{D#irP3^f2lXC3M z-3$^NA+zO<^|SVT$D~L?;pC{TY67t1mlArdHpt|o#??0tB@Ta_&K$7;ji)phiJXm4 zIQs1Dj-LElzsov!u69xYe)pOiNrHAEt}WaC-Gyv#bv<-4`s7?m+XCPfQMw3Y1 z*_xI7q=J9*)sla|?#ml;WDK1lArCZ>@VctJ4%?)Xt=8}9F8usvdOl`X-AK=VbZ*nb zQesT0fn4&lsv`quYJDsPd4L2G@hROWaz~k%zwE8kq>6F6V4w>8=j&a)MYPtGHdN{G z3KSM-DDP^`IWlzq)N7$^iphOhE57>GzJZf#?;KEG|7L&f?bMyEIabwvcci3H^9RVSf}6qE?f#rQ-D$+RX@NX~g&5I#R7Y;I)u9Lt=@$Z0*!OflVCT4(yA zeplBNxX%Y_SWJET!Ia}hWm>Q#x4?I7upYu-W+GGBm1#DzF@!bP(lHC;6K2+qs@p+y zFr+baKX88@8JXZfeMi{)J>-GxuQ7W`r)>!wI;I#|pe7)gb=zpTGvchK=bI_XWxNM< zb6lrDd2gT`_t$Od%1-Dxy1Os4?lrT%{Xm^xi0`y+>^fBM6AnH;9@mq83ZLK6amYR? z{;VU_;d3s(mHLav1?wacHh7xWWEye~jdNgj&!gN=Ztfz- zq&i4%>dq({sm&j>#Xl6lUydaOGi73Ynd15h9lPhF^LRo}e&v4%6aSzvv9ExclD0m`i|fs;^>Z9*T6_PO z91>i9d41afdP?Rs**bVCUp=4qq%`8AFw4Ao5s{JMGu(UtG&`O4Z24d8voZQqCqfC9 zfnt=y2Gh=))-@P=ZA=*--Q6AxSe?ak5{!p7oq9%DifPlGQL{HoQj{@LAlPU#HFkd+ zwR1XkT;MfiTF)998X9T|4>QAAOnuD8#YCs>52gb&whPRjFJVe@PfwW;`i*iPk&P;2 zhjfFNBvsCVSpqT+=%f&5$4tX8OG4m49N~2lh->spBoZi1AykQmE@G79{7vibW+pza zi0{Y-UV+kh8uA2kQAh$iGPns~kwFTJ-2l5; z&BNd(7I^@6vq{HMukyAc0YNfCU;#Kvg*GarxX%pTue|fCPU4B^J9m z>~Ufbz%qamr%4Q!0rUW1)~!fS38HI)pMSw0N4%$plACt_OiH{I4a z-TOTgC}W8*jm9wbp6T*_OwWG`-QDpnUnf|7l&LpF_ntRxH8stwH7)(nJuSfyP}8S+ z7Hq;)vK1`8KNu)ugs6<`Uf_%{D$}P!5kn26{<~%Ky<;RSJS-r|EbuGSIZQfCYQ`>O zc;I!YifIvoF3!r-C}29@b^orArGH!#-Lh)I)nzfi|1|3Q>Zq33MSp)-{qgTsM7P8) zY>8cXZPkyOmquM*8P&3U!Ecu=y7uY(D@&s<$1G@$iN5^F!Yj+7t}b14dHI5?s~25a z8*?poar26WS5`z{UADM+#p3HL7hhTVadT|+wPn#QE25fLfAn9*&Sf`_-3Y^Kl6B#& zXL>HWT0RI2WRXRXMHYW~lpxz6n>Av8q`A z_y6{8`gS+{{AKs^ar5(b`{RE5^KE>6+s-Pbqcx5xPFoA~8ne0>{V@8XyH&FlU6zsG;@a=&@K4WDk}=`OtA zZ=Ubs>vcTs!}9~b-1?XM`1x%--Nl!iaN7IVBxIKCdk%RYR% z4Ntr9ap#_P?&;c{CU-i}`&;_7=hH5pZrpz+e>&O^M|{4qPY3sOaL-5g>F8e`?E7o? z;U=7p{^c$_UAuqhqkFz~ryKj>u_zQ3gMdUL(o{_jQcZ<-cgwa`zkFPBVbJSBfzyuRch~S*f8m04PBqPSdF6NW zuY8hPerRP(EI~@$A-#$g)@|QZV?kZ$?*cy1o3(FG)^dM{N%6fWM{0QvZ7f^+kFE~s zx+WnP8tv7?&z&+ly0{zdCQ@`f1{^(%4ADaHej0gWdF#Lf<2Bj zMZ5KO@9d6oZ|&smF5(pIag4WH+Ie@__(O1e?+?N5MtdB8!y)>^==RZWgFB8eIe!@4 z6v95zCg2$C%5f99!P*d1q_c zWz|t`Rnk`!wW?!R-ehaZMXUEI@6K|Cw5~L5W_00*wAB-@Rex*U<+Wk3EYtY>_$PFR(yv(Vy2 zst)ddh2Cd1++7vkYcTpQlWpykp_?gmo3-soP8CzS16tksrJ@Q{4t^yAcgnS;U2rjB2kSSe5)r=>n@QkQmd_ly3~U5;w$u+{Pe)6*-005h*5)58Qj}ybE*by26^S%K{XbI?M!M}hLolmZLhA(iPq+EFLzi=SE@=BUxMIT z0b#}T@6NVWqJi#U?%DxxJLXpz-?X&%7XH>X18mQy${~PC+_1Dg?NoVZQ{?r+qzbZ? z5cvY3qIxrnT&b~PUxXEoz}5nS5Rw&t$bhCwwwp`yI-||GdvxZBiQss)6E<3zWDlHZ zCWYr-$wm?yo6yw+1X)@60iiZps6}dKwWWuH0bxp8%J?;;gm=vfV@;@pHo$~T>?|^C z2F2P~khPtIh$b{l9J~Yq$r?m?EZ2auvq~_935hb0^o{8m)VYtW!BJgn;h)*ZKR$NbyO$bmdMOs)3 zH*3}3g(=4i-buqST$#=O&;R~^`=At}{p-K}am80!nZw`y;{WtuloCoziicW@iOi0tMfoj0^cM;5buMgvn%>I9-e>h#;H=&}e{-KoSyvLPhXSVk*?5 zOeR+LOo|fNY%Y0(cL#)3_oN(`s>CU|+tQvsbOrw1o3d;7ol~1Nx@x!M*rGHlcfmDe zK{aN!)^WUWrrY*A%VuzAwP>9kAX@9M#lpK9M1S7_GO9r%47$_VU2{|F`fqemuVUgQ zPu`xIb%*`BHc4xEinYss)<%;SeKa4Vv8X_6q5%zP7!b50rHxVxYHsOH)<$%#^>8%^ z$54*PBmqe_z!GOtaG9$oqs?48CEs6}Hy6~C*bgFH$yyS?QbD@UjKwobno!gE8e&E! zG1JiVS{1Z)rlJS|dq5b(dz27oz>-{+V#JKamT!>>ogL&=q+lt3k!}KKnrSRKtICER z2?{f3C^;QVn!qC5D0A+@W^qbIKV9R?Ry#~CVOn#%Ru^B<(pBTXrIvo9-Qk56(ox~d z+T{5%tEHRXuZf=5#`C%?h`Om+IAFB#YjJ%+HfTfen%QHuNw<|?)x_y5tyIT6B(L!5 zY1=xqJ>R(yLAuR3%IFfa-VMwx>ZauSv>!yeK>>2NNoOqZYy+mj zh_#qDdH{2dQZoiEZ_z2c!338BQ=}?0GIGvYW`Z=K0V60`Nf6F;6QOilFw@v(ql^S_ z;uMT>86|&8zrz%kV3{42VYIpcvZ3Tn!f-3#xJ&FlroM@PczqdNxt9(NUsg1!d2qHh zMOqW`$bz{%jgDCJ zhNP}$#;eP^q{}X9pgMrB(v!-XuX{9`OTy{{`9EXl{#<2o#_`>KF8iM3gaimsE)j$R z#Tn3!s9@EZdK+4yTuf6aLZApG1PI|Kk%EAbAW7vSmr#eXwY5zLu%aNeQc7Ek{^Hml z`UmxYhuwG2p51+4;0FfC$>HQZ=Y96Me4p8%lr(*rmTG#Ie=B!h#8`J%-}4r zs?%f}CAnE!l-I;AWF@Cxvht5TD3fVdQAbuq*z>qoU2=v8=}!^ZFm{{|a3w`^Za?FH zi1o5X>X_tGa?-v#@Mnm1gXIo&$=H$nQZhpnR7I87=PE~wCO%*4uzk1xf`)vYw_tJ@m_-h{iM6wsB+CyqzzWFy^nuV!f^?=056p1_U3749!9@p$ z2lIoDKkYWpP{}gP^AShPkom~mbdF4agkoliAPHrT4Ks-qpr;=}00d<8F|Y18N}>n? zDM|n&k5S%5jfS{tD9NakLhRsU9aKq0n>g;@jf6ZX0g}CjB06fagOk+n#sK4_5H@L~ z5Q}~N1gEIPi{GyzSz4TyMrB$UBYZ)c{{jLSSh@W|N&aGYc2cMlDWyOyIAdvlEik1c zcQJ8HY>dy7U;yNs*~JJ&zqx3(W{uUmv-WjC#Q&>d9vj1bAY!YsLt;YA8?@Gt6?6^& zbF*i6^VgcSZt!e;Z9VRfBa_zROZ_a#FQfeLGF=$Q*>K?oHM7>lxuTCrA)0}-QqnY@ zB_W#Wme#h$Ap}H8Xe=Nd=fp*S+n8Yz}PQr%Zj7o_AxK+mF`CV%TXwm3CPEJZflMhI)$;ajz4`PNA zzsRKQN|jPggK2k=D;0?^l5VX2fgj)D_FJM`H?|$A`_TZD2gysyYE?0X-jJ|M))&iH zx?_K)WF8v#R)S-|S0RdQRHN2f0f5%T<|adIsF+!=@&;hBxn@y+KRLNq3J5_&uT?jM z{+3FOTbiqE6#_6iRjwfx8#tD!ag^csF|pR>)&{Cmd{~@lE@p9~9N;=sm=E_cf3~oW zd|QvK7`HZBGG8^h3FhryGi>5K!LglSgAhQlHIxCW=TBvh8bTyQW#?k~r7#$21opUs zb_PT)fkR&f>#N9r+-dL zAoSSFSl_RyD8v? zxmJZy_q)jmXPkFc5DCc|#-nMwFfnTeL<{I5Vr?PE=7xtH;$hLwOv>ENhOh3bD#KmZ z4CHlBO&}veHlS6sYCL9S_edsYW=*vwu{K{~tvSmonXQHZrPdiUDJ06Y1chW}DMs-J z2*jGmOt&n5mIM&8EHg7PB1=RfVq}(5#9d4yH3UK_C25xVd*FK)#}MM8TO#>sj`w|H z@33$nBp)Alnt~2mY(QJyW(uNq68hzTDP;*b(+Uu!K+;w*52TdJv<3xA zp;TqkgJ6{&0F+b&ppm3B@Nza+RVl5MTC;ko5JCYVDWTwvts8!_^l2gh)PMve2$9jq zQ#2B?#?0Kgj7$th_-3+_s3jT4`&f|?i%pZyV7r@27MX?yts?(Kvc+xwyZxnENKws9 z0)?!9R0V;xMx`2=SnEors}D5u1Nh8_r zH4%-eWGxjEQkl}pG__60RiKnq3m1GJlr$Sz3QISz&yH|H8o9t zcxL_&hTiJ}CMlH=LJ1t&zhza&6Wv|Eczxqb<0mx`r=9gvYDXR^?A|9sQqa_VkUiHT%b(gC3?PKKb7%PQ>CRd6CqDn|f=eIu9XPvo z(ztOS{_eow``5{n=<7K&xa#^BhqMsSJ^k2<*B;Nfs)U#` zb81VLtyuoTlxZ!~CQdN4Xl5;h`0}gsM^A6wzjFx+cw~B86`{FhR8_N-a_s2VxwB^M z?OUcbGvarrwM}ZSDx@hB#!Md5qzNGxwj}AL!Dl!2UMmrym2BwTcOBMGUXoIOu3*qm zM9&K3nsGxUX($^nJ;#&yB5%j|)%t+P|S+du%~O&q8lS;xAZK2^Wb6tj0g4p z<@5KxSvPO!?Ao=b^Zdzun>t^Ax_5V^ci-}3{hd2Du7B&u`Y-==esrbb((s;(7q>Mw z!}!LB&z#$Z$RC`4=fjbMC*SY+&Ct=|bK4K@-8O%2+rj=d8&|KLHGA@zv->~0JbY#3 z$o7rxdw2f$_TT!25RlR-2iMo9PbBY<5>aX3t{B^DBoCQbF>S*djJf)M*AKckENc+* z-dCTrWYwmY2@8Mt;?*1PKL6;{hDt*y<+%+Bp+M8bArbmp^)UG*18an~|-XR=l};$(?_m znlWc$`_G=~?)qu#1lYWPw&UaL1ITK_Ys=s2Z+~^=!f6jpIq~+okw5e`W&(i`p@{oi z;-p`0!;#z#DN;Jb;<{KQ?kl+B{h(wMI$0w5w>-AMWe@{L_>3<~%lkaBTPB@h!c*TNf>T zZg$&4{r%g&{`xNi1KVEs(Jb_I5Xo@mH?BDw{mY)M&%Zo>#=}#F2DY6$-8)uJzWLe3 zySFbXq5u2uD_tE+j}N|n^w-_3E!==(&s^BYIO@WwlYjdC@xjwOFPu2M;HgJ$-W+ai ztlawhAFo|I)zVmh?b+AazI?^C>%+G`J$c~3nzs+H2NKR9!uyn{k_x3r(-l`hLBld_ zjgfDBB-82tQ+8#~O`TW#Th8)bE!JX5mMq%>8ymAYIFJSs%1j6}KuOrrLV(P4AS|Km z`@T8BWhogj*kDKtAtfdbU<^2M36!>EGM(vLU;EGW;a1#WGkpbbJ+4{Db)mE?n5Ree05SD?hw(=g_Pfb%e%V=Az)fuR4SfKfk*BUEjq$ zdsm-6u_cLrxxuI1LqGH&DQdArPzAuKLaC)0<8l-PBy4SK8}W>i16z z^lkOK3I&ewVaRA$N~ynP2%}W_@!dds)Ii-(%T6X)U$#Bxd-j z0DY8iR~@-pLE?BxTH~hJ8*0GW$*O%8fKds7dv!n*S*2c z^Ie}x#SeeD{piJ&mMPhN`*%GWy1snb+gsLutbgP6DZPD%!6>bf2(*q5zr20#>G^lw znYMbx%KJmT9cOnSC666HuwfyYd*Ra8mwm9J@6qS$w#=VA>8)=cUj5To zrz}H=0qYMB_Uvy?Jr&2VH1T+s`VX-`U?^-U6WD`z4CwrI$2~RpdGUd*gr8s%csAUB zTV&@Wl$1Wl`~WamE2*S(>#(3aZNf;tmkJ3;^-t?zp(24McwwdrW9WCnOeDOE^GG69 zQ)rGxlZmR@T&BT9;>mOh857BDB$6){CS|g9Y*;Jp=k^3zeklzIkg84-Q#@6O#_~1! ziRoOOF^TGYOLe9(5zEC>wZ%efBpyqDrEA93Pt9iP*%&egnWB+sRaG*X$YpX(CR&xw zkBdfAsp=XNiJMqFQJqg_nre&9u~^Ku3mIKd0`6+1q#DblB9v3)S<8=<6|E}JowFTr z|9;>Tr)z%kVtFy&Ky1rCuk0FY$5i%J9=bgzxpaC=?Tb8jbV;Mlu1Vm^IvoXrHXd!mM7#o^l(tyYckTqx| zLm4m6Ak&NVeusgK{o1qDIyTh#;l%@Z9~~ znZIOs0L3s2BFt&U0~?LuhVKcl^I)<50^yI&3fznYCiS_6tnP{#D0lE|=nzJ(q#q2j zLzOB;XN)llg1{P2sSOiMkC92@5AF)vJp~#;`bFMeN|Dqu5+SXB6)FUfN^yiKYP6Et zBBQi)k9O{F>9zkTL>bETe@ogce1N#Y)O}%m9)QGHIA17BewYEW!dH zYRa~^2u5ijW?LM8Xw%^U+%9SrFQ|$**v-DTi7L!&Q}}HG(dLaSP%$FdQ5Z->28}Vs zFd`t4Wm#GSvr7tuh*UPa2fM10gG@QHX&TWq*-01RaHmv-m_K@FTxJ8J`|;>;QE`4g zB>~E{r+jZzp6%{Pjj*S>|4HMCk5D0j#DPtsUk(>0-V02B5gvo39>^tg+hT?(?88vo zQQfO{YI;S*<0%tmQ_fMM!3w`Qz@%15sg;Ll?zaR8%aaeYcMMZq23l%{(V#15!;O?V zP3TXrZj&Vj2JZCt9}`0Sdf}oqOMh|b@JB~>tY5NpniQg#OKYK&6oK|x?pDotzA34+ z1_95WT|3o(y;ifBkZ;;?@LjES#BgIV+f-MLNGU6lO*-(Bjwu~tYq*mvdpql?|^*KC;`jYYrgJ32W0xe(&z zKfb{3BpBz82cHWzB zT)w{j!O&?C8pt8YD{_>3j+$n)AjsDE>9Q!XLaTR54;#%Sm3jW`dMTGgtxBa@U`(e{ zxn%6|gFm*Gvau+khN+DO0If;2G}dJjmUfyEKtoz70AOZYT`j?Jesq3y1PNtN190qQ z+%TknXQK>&5Hii#|K)~b1O3@ON6_!&d+lAd@#4O;mCU_E+i=o$zhEPZM0Ex3nU6t>~= zv?qbAH0J;e4fb3^|+zHPf744)B_makm7bNA}aJKig%YkIE!{?fH= z5f;NwdhR|rHh1xqSf;T)Gil?VMJpFB>+0I~{=7*Oat*!R`#U;5iA#O);{F@wKKt>1 z#f4)#H+24Co+fN zee1xl2KzT!LVR=U^5l)hIWn|cgBYJ0S^m@`4gii4 zwEXJkaBuI=1`n>^_>1TE_OE{Cxi%s;wnlT8u~)CKL~oO5S(ZnlVluq@U>_PrVR@hf zBJlZ1VM|oJMLqq<`P!4j+B?qInDI^nX@L~dl2-C~C@xW(MQs%!MaR7@fn_$#_()W* zm0HW(*ESYD_fsf(v-3qZr}OP5-3G~_19mX6#}+z z+40WMjyDhO$U0?H<0E5Njy}C=QMt_g_3k+kqOE!9lIBH|6DNMqI)6{k+UI|=ytilb zfBt=|t62Pca-^fR^O1#%zWx5J5aRg$!KYR>))p4*>Un8kaNC9rEB^Vnn;rEP47CPNF6kb zSSAeFkE|(iZhm}Z8+U$(6(|w%W?Ww%{$SRfc&B+5!(=IpV|@3Q2y=|P!y~^-qTfm; z#cND=WKN#$U%vQ%>9HF_uG4tq_W6_xzdg8Dr8t*s>D|Bm$l*g*Cx+U)YZBcGkyG&_ z&QPLkZtnVY>ddWsCxjHE7tY=O=H%vWKkj>N-zT3PIyc(?#N#V3Pkj8z_}k@WPHXF< zjdNQRWp3WOa&i3d=`($gbuXUy;?$mjwaxP$9UeJ0_2o!^O)>xWn*(?5ecaSmwef|` z6H_O)Y+csewBX+Tb7NEQa!Opee)05${blLuo?ma9nEYtRtLuLB6hwA6H zE^JeO!PLR3+x-3k$jv5m^zmcw|HxW+p~nu<=*u>{!XT zg)Bj!RC@S2%R4qcflgGNCxYX{-#5HKM1pk^>!$F3vKy=~k%mje9TNe4gd07cFPLYtr;ihxP@GHj%_>HTn>@4 zxjJPRinSfp`8q<9N$;!3rZjMHBe9z+)Yi9`yM?my>iG=|Yl}@~PF3BU?qZ=ao2|%{ z)fMZ1J2Gz0Oqhs3+xeQB_PMpK88@G;oL60FPH9)!WyNAkMXolT&Q=u`Wb^Zs?Nk?9 z3e}A|?G}n{b;ZtHex94Ht*%+%WGZwzU0F51P~DQrRJz%ky1MqV@_fp+olLGWUuQdR zRptDOss`K1y4m_-u`_MwS&=jWWnkxA$BmGkOrI~+UbdljeuGx#)F zv!)P{Qp$8{gG+68M)7e&0w5yE$r>+Sf}uvDk}AQ60?F;tM7Uw%hj^Z5DgAh)*AQuc z1jf_t;v19ja*%ky43v-b*H#1}EfYm-nK-Htk|uh!3FGGwzJRk}vBGNI$mBRK`H4q) z&0LzT6IiNPk_xs zPDJdnSHOHVR!m9(flg>(s6l$G90%kOJU)(WD53 z^?MlllK_?_!>fGH#l;;mjV~~NG%I2 zi4r5t#Y9U^Vzm-9Fa0B};1o+C7ZQP((LuFDA`-^i8H_Dq27M;#{2~gbJdss63?B4B z`Iawi^9G&XgKBhcn4m)|Wqh@Nq=cFMu3ULWT4;g!I^L<9qr$$YuqV6JJUA{#j5JV^ z=gI&Q!YB=oeJ^Je-h_dAhx{x-=~I-wyPL`58yc>nc|s(ZS*f=?GYX&GVcz`Gj4cR( zfQS(ZnN2(el80QC2t=6HT9dLhxsC&j62WE6C}PBNJ8kf5Mr>l3teO;mFg^Rs3QGuL zFaw&DN;!^3MW}*cEmTSyAT|*z#Y9RHN;WfH1Xi7$ZNw4~EhO~xItm$(RE1+R0uoCm zP-F%}WTHGYf$~m?LVXYgg`531zJ(xw(fH_maNKWyIL9$*^>&fK@|FJFZ2sT2>`%E zwyoB#S?Z9M76?#jLLtQPhp*=|jv|Goz7g=s_D!zwrW(;*jC~asE6 z_a&z)b?-g*`_B2!??V_&8BMeqI0V(<^0;U%M+t-|$!3sHj1bal)e0%c zFf}ND<;i9(k3US);dqNyE#?tIW|bl_I*LJn5hj=+gvR~d7cbPJygj95u;Qg5kZJB397k& z&%$>*$bNcCGpJ%dI`s9So%?8gZpUd0b3rJh6U@~LY*a$Gzj$OD4g1kJJDX}4 zA%X}c!5bR%MFQ11sB0KwloAy)Y&@Ioah(6>#>2_+4jzO5{^vVKZ{sy*o!3)$x@iB8 zukLlWpJ=>vgffCCVN9Hvn&cU&TV0)h0RX&QpY81~Dm6j;jSRi4lX&j?UJjTkobK)tag6ZBHJLh&jj@4+urUw~iws zN%i@fRO7Do$8!{c-+q7EcI8Y(<=z+111)Wb<^zpcS*e4*lJd$l0KgBgr<>b<@-Tsv z5lWdzqO{wKe4`gyyX->vjWA}4j$eFwz4`J{lU1?uWV)m0*qbds0RRiQHi(y(-2JYy zgE>~e|7u%<{oJ|qb7xOo=|29$)&u}xb8EV>>m&eRX>}9=aAT&azOM4y)sgc}1-b~e zf1>K)<93-0V@fF5*>y%33Aj9eL8=I$ULmlHSP)tj!r}?Dd?@u7qWKcc9X|49ZgzaC zE!{m>Q&)AO&r#mrU0z#Nyz$~@ePa>Nxb_bFqvdOn;XDqu*;0?Yec_JN(OPTP?pog* z^-VRz$Lbnuk30J+$_i5kyv?0Gg(YSC_w7&X>n~ngb4dXB?XQ()NAaM4x0)h?DS-%9 zSC?LKmalJ&i2(TZ*Tt?YrI#<4V!{Z<1k=Fm(9;#y*jQU~tPx`hA(YD$?%|fn=_dQB z1HK_gM|au#p969N2;~sL0D!gio0po7?BADiYr#9{x%kt+zd4YRP*ss#UUtN8PoBRs zFh1F2FDalzOei9h%g9WBba~G#E_!pbVs78=?d>_;*;2Ipe2RzQ?z4dyv)(^*snos) z0QzWU#4%Wto@Se$ceY+Sy1X(Zyw;dt%HiqRPVZQKS6k`*d&6DMua=&;9z1ZKDak!{ zXirgj@{_eO|Bd>x;tYlmRz#M6&RPyY_=)(N9@}hiy0@$+${#bd$%+2oa zpZjLU`_2^}1VFaBIcwad=0&o(r9O>L34{LX|8=2-<_ncd^=bL^XRm`l3FSvV4)!4! zl)j&wLD=RqZUb^dPJ6p)P>{`lAcRn8oR89e5JE;7p~2qL(At3@XLdY1B>+Pe7r7i5 z`(|?N#rISBDY?Uc-sakKCq~AH?8RTiSfZ~u&cA!R;PEtN=h`U4gi@YUc!q{V7(Raz zFl#l-&qrN@7t^xLd6~!Z@{$-)JPb_t_E)-H4TeZ2$TMZ%!zws=NK`)$b;F1`)%MV#*PPEbixDHbgww_8*w%!iQZ$N(vAV z|MKG!1&a5t7a;(caG2l-jdo>u^s2Ky=ZmDwxXj=GSP2)C`wM+tGhCPfbIm^#8@{s+06qNB2i~Ac>8Qy)|=n?b};Pv1&n{ zB1DIW9fbvHsd4d9QAS5^MT{;rOcJ)XIp_0q^mLVfWTo$&xPEzLxba%&#bJMg$J-Sb zseS$Cwo+n?-<>Wzeh8x53%*#T!qwYekP`Xw#dV$Re~eveSJYSlcS(uxXhXoH{#xV0PFpa{5o<{ZDwnJ@FF z=0mD~00(={q?I` z9N4yOd5~F7#1#SB*tloY^0Hf(+BSSu{`^&cXY0v>M;rF7Tes%qiMskj-vkx=r|&lI z*s>Tve)6nCXEqc3|M*w$xzmTvUT82vHlYXzg+$aefZG3qjr@jNFy)0s*B^u-3toSNi`}EffD$$?&tr9&G{mFGBxtdEExT= zS_X5zxX<)dGcwsHvtY>#b}a|jPeTE}m`6Rej-yGXM3F*mZAX?ZTYqD)MfIfq`R@rq z5PJG93xt|hdgq>P-B&waO#Buv@QH+f5{l?@uUfrn{QZr)4}Udu^Y-AiXRo?7T`DQ6 z85-_5+PZDa*1D0gf$o7OT}^iPof`YlArf&(&8k1fJGN}EIlTMu&{)@r)_n`+FMK)H zfB$X^mmpI*>s0$r5kx`}Il5f_A9nvOp!r?0hg0?Rg@c44aJ{wd%;@WDYt~eM%&A!T ze7vXq$`39nFfwv)bo>gUfQ&KD0SH5NXlOtX1n0Fy#*oRY*KZho*ExUTtma>jjZJhN zIk-_m_9p`m*o&XpdLU!4qT}A~uPX0RYJ>_oi@JM_I&>0A)Eu zJlBzy3-?7t_W@N~GV z_U$$wxCb7b7Kzh{Mx8XA`Ab#~zq!`gb;S0CyY4h|Q1Tn2D2lZGLbKoPd-LH@Sz#QJ zJ2A--%X<0d=Fj`rZQQhWxZE>cwYU0Cx&24on5g4T+rJ|XNPkg%BeWPW0Rdr`y+wl0{+OL){&_~`4 zE?vB6?t-~PqgUR4ydLyw?Y}h-z3#PbbKjA@qpy1o@7)z~g^_bYDRBN|qO;?2edEy| zPn~IaF?Ox~`1gDN`j_KPKaD&as9mw_c*~(V>9U5#Z(Wj4BovT;3W6~HvETBkltVh3 zZmO?yyTXDXJiB)(E2DMiqAi%SZVxy!5jygDFZk`mNsC6Xn7K5sChr{ZSDqiC{6v*Hy2 z&6Fe$0ZIV@fpd?ln~cl3#v#Tig4drkVkKU$?hPdDcm;Q9gh{{v5K;1J(PA?(%j*e6 z!v!u+PzxnI0n0G6A>C3WcQjmJ8AT}jH9c)avuYrQvSLIsrkPZfpb@P|T3N>Aob;9f zq2x_{l%_XYD3elZw~7ZuF2&6L}vs(~=2gaS`kvkR>1SU3?-?ZRxOs@aO7MeNd4vO;$G zA`zQXHu<+JiXxZX>B6d5v{06Vx*h|Z&LuHTjrcu(!B{k-1rrW-ODILgV@6pjQRH@o z(ut})p zDv`K<*KxEF#HdwNUOYEtmwEkGtxt=PR9J3uUI3jaA zv^isU9&dMmcjuf0L_$RhBu`j~xpeUA`uWNh>qjN84?|9avnaSPSIj683O?j#C(i4 z=Nu5IW6?$gL_$F%B4GZCkci@c__~%?Nv<+}`#kF2?mFjtpHtP3o0+*zWTHWb31Nm& z5H~&;5)l~}6O))A@r8>ZDvBr(#f>|E5kXvtD_w~T6L8}n;oASjMOAlKci%g^rn{@F zs!yHoobUU75AUO&1s9swG}{(~4@0YU3Z?bIyWo!6#s`so7fp5sCNU0_?jctl#I#4J zq-GCkiQD?$(1kz1;D#8Q;6t2wH*>Q+S0Kh&aA(eik#W9FqWukm9YbF!I3EXpeOx~g zQuEt8o%XZ$4f1_@?q)-2wrS$PpNg>=3|B%3p*ixH5WcMZi{mXP4FW}H2OFI3gQ^n!%!pN zGx&!-SZwCEFJD^B!8_-JKXbEx5d7WCk1^Ufk7I0_c~>uqH%**7=VvoN^Wj=skE!SE zbG%JXRc4PXETI`%z1Is>ZY#i(qU=tL{;<33cAE|hpK);-ux!Kv7 zpD69kMw^8294YDDB6*X4P~J^I_30LSN(i2QdgjiYpZSS+-7W_lBImL5srP4RTQ+9c z*>mpzDQ+9b{T@0qj&E?+`Gq_0hUWATWCvq|Q?1qAh#%?Ego$|j5UHp7ET_DOBWd1i zG4-eKAMtwj76r}4g^PZdQ(bG}^KOLf9|ArxWH#r{@&!)_Yr~38R{w+u1CR0ws z5s79mG_kEXOdpI{@a{US+BD)Hv5>FTWI93^9vLc6C)xpA(D~>1Sl?86Jrb|JmZLnR zJPVM@w8Fefsa&+2sU)^J(gG+WAqkNY8Q<_=)<={t{p{EhGa z^qcQJ`TQ&GJhOBtinQwa;}7n>daG<8BN4G0h$SWz1|mQrQ9y11Tj2#$i=0R^8Ilo> z*Pjqugci9)O3ZVD1?McBL^E4PW9d|uNQTPUFo`68?l0Q)=N^CY+i$+12>>|@gGeGu zNWhxePz#78<|NVzCuXw3R!9_-vvLw7ArWCQ5Cf}O1&ost7-!>Tl#75Eupt-X!rYNs zVoItl%7V0&+HwKp1<{z~MXtW^_{lq8dG}uTVlOMJz1FUDE9o}LR;l*6bXY4|$;EQ*q}y0`sr8b|nz|K# zcWW*ysw=8J+mdPrU4?#0{TgeRijl2W-Mz0q`TG5r9ssPsUP#s@+vIlrmp}gQqrd;* z<#pkegJA zR+d8g{tw>$_kaHM-~avX*B`vCxm8_%TiML#>8-b(e)O-uzV_N(y4Q z9avpZmw3sxCW>#dLBP<9PgbRc$ zoR~qZMLN%UL9`%B{C^g%?YYY8j^^@xd;hL`@9%Pwb53${k`Qi5AUR+FLx=%X?nVsI zibiS*3awal0BZ?&Yef`PSomsPHJ*)07iW!EsPdyre04Pu@}R=o54SoJa3C2^0ePpwkz_C*m^>8HW_T z!{E>batVjPA-FVUpRfjYL6clUh8oZ%=sY^dA>k0%2lhcis!5_rit12*9coINNXR5) z95Qx^_>_GrNeZeQyd=S;8T)|htSWhrq99J3cRmpfBu;(ed{FN|5FMi`dym5EoM=FD zEW)a!iYlmrA}qq9tUAp|!mPwfE^tUd)e>1EU@^=wGdi_Qmf0X8Gpn*VBxP~HWEqVh zAQLOH01+S|i)FNg2Eht{#e~RAEPx1vKx7du0uTX_u|Ukoj7%cJ%tXX0(>8;E%+sRL z#t|CJ*l10IF^0$x$4JH^AR`JfTLg<>34t&MW558}X~Z@L1OOl+Bt+)vF~a}H0GMu` z$7l>13kJY|H2~HkAfW}YV3E*(F%VfaaU21Fv9=+OB5S7q1P0N6AQ*z!#!=h|))E3D z0w4fbYwLDDJ8}E_Yq!7q+9?PxpQ&B+}5bR4$!E2 zf+9pk+Yn465TPYD7^22tf9lhyj*KM|v8*QcY%+;FL?q&cQ;0o9glQ{qgp;G$AuO2Gs{F)WP$ z5t^9ThyYdD%=_Tf*&lxR`sx=){`~E!TQ{d3T|4OG1}B98)i#;ae?qMiv#5ulpapMc zRIszmxkH~Ntuwop4lUj=b>Z-**AIZJ0|eAc(B3B=nYjG<$)WpaH$?T$XK859bygP7 z=}v3y(xO(_nb3m2BiYOPpXGNZrM1t+PYa_;BeJ7aiw&XSTgJ4h2>5pHWQ_73+9 zF74{Ay3D&ow3JKdg3f`JearegJ91(I2SP>(6-85a!qhUmf3^SC->zP{adh7+TXrA% z@!+Z+_My_;H@7^{UtYBGp4C0=eJ*NhDb&W-PTc*=A3r|x(&nWD>lfBq(_FNi@yzAj zE4L1f-q%?xQ699|UhW;7eP2&g@54hIRxccB)8<&WRuUJ>O+EJyZycC?->%KOc5EJRFSImabz@Fj-|aT-km&n z{>?+%9~o^=s%pwxH$Js({rKe5&zyhjjh{U9P>U@*wrb0bOCSFC-(P+4*~zIBFHi1y zs?;2kq$JSx;hB?He*fN_auYQaRz0xhpLcH@e|Y7Y(T7(}zVYn$|GIo||9GJ;Ebd(P z`rcn&{^004FYLL$e<*itjIFgD>~oO*E8^szkdGq(LF)A zDeGv;+9&rt|J9YLKYaTB(uIqHD*-pJTfgZSPd)SM-o2lledp+l`xbWgB~hi4cklbz zf1Zoy-u>P2SGKJit%S}jw7aDBf%WUZ{O0`WQ!kd%Vj;{BS4x^nzkcb^u|tQtD;=V# zq&bIx!Aq7>nqrc%FR1!$kB@ykb@WeHPJeXlr7eTQMXETij@+~I!m&5Mx_a*9vB}~7 zfnZBPD*q$uOrNScvH<>g%kAy-z4x&Qf1-v>P(Z+iJV9B)h#*36qJm0L1SN<#Mi5Mp zRYhDt9{alXB# zVxZ&6&6HRND_c>u=?kxbisA>)+e@DnWFPkmHdEWgM8xH!CKqO>^fyh3ne=-J%a0zosU?Kv*KrsLYQDCA#MZzU2$^<0NW#AH_ z9239<5aEc41SBF#YDO{Vl#7@!V|Zj-q976qlmVuop-iBFfMei@QA8P{fGA)PDHkyX z!Z@aYFcl~f7|~FwAylADz?3ph87G7xOfhAMG8Mu~0U<^)FbyFZf{jy6e+XiLfomug zC{tmiCRm_EjgbZ+0V9D>fly2tCJZ5hF)>#73D^ia7StOyY@_?yn7(K*LIh(M+lxeTSf0H*JF9?4?cQ$;wnm;YgM!K?EjW(A40FD`}lGc0SHGd9; zhFDsec~_U!)EP1`Q*dJC?dml((fHRBUJ3>F*sdEJYdiIIaIjC{+{oaoLH+22{_S#o z{N+HkLKWl@`ntP$_+|O4(W36Yyq(Tg3WZX@L_lf*Yt%$Qlw)MAe`W55r*-8e*~O2q zwzTD$$wX4v2kkvI-Pb-fTh=_1m3-$U;vz9|x|x{u^K$p#>-&c18UDd;SRse%j?E1} zf6@QAd!S%!qQYOd!`*)O?D**0IYZCTt;xlz9~yHGxH(qni^gU;S3dRC_uQyxyL9Nd zvx!EjL0E&R3KKO^f2%PU1bYv=z>!|V$ke0C*3|LYs=BfiYnAeE5i$S%I5qaBvabE+ z^lD97&PfxMf-xWr6G|BXfUTvpr>)`1)AD3dAao6Lf3@^vYCwTOD{Jj8BqWyB zWWE1;%b8ezg;J$dTAz(h`q%%K21W}D%j0KO>$2`fsuhadq}wa=L&b&HYoF$>Ew+UO z?$Rigz-0zND8Y;prX|F3m#g2S;?g_!(u(!hmls+Sq7QFj7Q-+5*M99SD2sX4oVxI# zM(46wXX7$If7MspoSm8;Juvj7wf8QS6^JMi5P{2xF(Qg;w9Ua$xA1OccA?=$PIO7_ z^*4*pbnc%8?DF~Tr#Iu%)!(L{tZm7CIay)5)vO>lYi_(V>qhLO``12x>^mEMh$v83 zQ}e`Rm0dXQ1gwFs0G3) z0OJx!f2JC2w%Nu#An17EqrBC%{!3Rv{ExcZJ33j(c0a!CXzsWZ9=ZQY%DK6BP1!f2 zkco*15@U>mBuZSAwF;Hl;X|Px*QRss#sx*}^$*`~wawPX(q(pRsJcEQEZjRe<@_%n zdcRAGj0_F>^pDAk>hDfQ`qtLo9Ugh&xyK>MfA5f?RzLHm{>*7zK!C?*j$19vws`LG zJAUG;nWg5d-=9#Z)Fui!D(dX7zfa$Pc=bg1U)q}Wt(_0-ZDfN%Z)m-5AqdW!w!EEg z$iE%4-^FohW@MnN>QQc5m!asNzq|-LvRAFpY%;gWx_3RVG|7Ia1*KG!vjCZ0yR~P;TaVKQDI|7uQXjtz@kg7c6Tl z3ZAzVxLR9i6msz4kfnv*n3zChB3M}1bamJDb`^hrEoyPTucNuBx+HJ>$Ht|_7C+CO zsh6*;F7_u~I(E=|pR1djjr|UDi)}X+Zc`rM4X0pM@(@{&cgqXRwyI)I>i;M}hakK%gx$$e0$y%nBm{ugFG6D0gmfJ5z zoc}>z)Muz%UFh%aEZpT_ou8RKe>T;AG47b(KHUKi@6G1+wl)rd%D7Zi{Sl?xTQ zid;jkQs4kWs5)}hqb&dhf1vOP0_5taEfs{I90&)6GlGCzMJ|vF&nyAB0HIMX2y!9> z;X>hD22=nka)z9tASe_-iUNd2fHMH(oB`8Yz=0r9cUzfXD@Bz!5nh(gk6`6pmB~0-OR;0E);EQE))`f8+Z{B!DtygaM&U zp??SkhCmnv0AxrNN*PlalNloburLb&03?*jj2S7DDI)+zLI?xOfdC_nQlJbNWmHxa z28;m^N(rT&tPA3)VIV|S6i>qhThJAs4748hL|LfsHWJ0)F;6ine+orkNJsySBP^f^ zMi2SrNlKTAVo*N8f98tv*$rnTikBiAJl8Vn@mqX4LOx54|0SnoLOgi1m(k$mNjsNi zqij?tSzuP>|4YVLfSWuqgR)TqW^tHe+b&&gZ?7U$66j~rBg-nv-%NCGODh<9gXj83nx0QI7Zj&&h+jAJkLNqG)}rK{w*Kq4?;j_w zTZWQP?SVt%e=k}B9E=hfxkfq4l*$Sv$P_>Z4yG)=eC|xo{RT}jnxyFLwBnCbKc^-} zRqWmQV(e-_5Slbg_|hn6pg-d>MMjY;j2Qt?bz0TP2OZZgTrM#fnMsPSD{q{B|Kr~L z^x292v6pT4ADy`W^h`@v{f3P(nW-87njKA9y9_15f5C>_qzYB%Ax;|Adj90Sp5rq0 z0z@#GH5#$fwf_BhPhMe?BpE>tK2Tcq=5?3bVYM3UH!q!eaQAHDs-^G7pT3-EYi>T& zbp6}&E&IOM=vIgkIiTPSI7Pv@k0kl;&MN%)VX&>E{?e7|+248^8VW=F9HS%MRaLu; zl9I7{f6G6opXBANYpg5(W#qQQjCLuqv#F*3@ddNlpdta}fI4!)RSTs7QIUyL(=QA2 zGiAw?5|i;^c5Hk4#tpG+=I8sjq_0q@>a;JlTcVc)#J?Es9~!=PqIS=T+I^KZS+R*O zo9awlzUgpz*^Sn^H^1Jwc(zm{O0ad+_SBrZf8&R{d(ThJ+}XK3M)8smRi<*T2`)4y zOoRsnyVt%N?>}<1z~OE32D@2=su0@Te6j0MgH3n^3irrh=h@~WNstte|?w~ zzeq^R$;w0HlkG0I$sl3<$?Df*9nmg}f5o6_VB^A9^K!3QlrS~YccP|%8<;`z$;&I6 zoE(ac3^Pci@zjyt!Rw*nzU_A}Jn6p~p}VsacK&;Qtp4Pl9qDW5=AYl~tSiplp1&=t zU`P705Ib_6f^}2;=EHdnZkTd#b# z!nP=cFAKNDI)(Gb<B?652i4Uc{}f6(6F*R(4+Imw-nuq4^Ue2yId=FQCg)~4!%*}D#B7yWhX z*HNy;_d1)q@1Mc@O3cTCh-}iOjxA5R0!ebE?6$FBge+$6{L1o-g#|0Nq zQQiX=77z#;$%q(Ah9smEl7u8siW4zHhA5;$sRK$RWrzeM&7gE4 zb%vw?F(e>mKnIe#e*nn^F(Da9j)rC-IRd8%eMCrUAP*#oq`=@UPzoSp2%rR10wtG9 zD4i1tK$1!zY9PEg(*!U9K*R|d2o3@W4YdN4&IK9+0f-A^95_c42ZqFv5D1KgQWL;{ z0F|+SLd*~x0Duhf1vL<#JDQB6T}*y8s0a>1GdiIJY77_$f5w3u1y&%q;1jh=j2T>o zi8GVnrpZ{I&uuGQ2&2Ktz#?4m&jDVOZ|RM|nF*Wpm%y1x znFKegnY>IUjceko;S=7;NgK1_VK!c3ecj0N75BmZC!~1N#l;vivMdZcp5d?ZFim>h zHSPcM0w*dJe*p8mM=Wp6?-Z*)! zy*N2(nVAQiK9T=^{QlkE>N~CFw;RsH&5l?Ux$@5+MxXX~_1viaio*ubb zX^%!4f2>aKY4QXVKmde7fWd8oG;0`yG^?|-_3ytu_|u~cuYc|8dRP##&|$HL7N0AA zJO1FwVB3=?H687_&Ok@N)Y+Gt%0|aKpA9!Z9lE$8DZ;};+qr$$^WnRH`D@?b{&8zy zs3bXgt}d+YjScTc`~LZ_{x{=|O&v#-F5FqEe*=S8{Cq9S=2z-!629+BBvKL;(Uxl2W?vkm$^GXNv{B|rhlmPa$5$NO+q3g6r?i}Oj$iyNW`3F ze;?irfBbmw=QnLnUVgtVJs!}sG;YyPuddDi{R|IH1D#OXt>&5AcBFUrw+xP78~Sji z{%V#p*lg1sl@&!V-*%3?zkYw{T=Mp4FQ$DHJOBQJ))#NDKN+q2{%S_(9EB19bs-TX zA`zET<36*e|E{m^%8Rkq$FD9ve}CC^e{2o&@+zr1S>Bips5$L{H@hk_bJlus&DUr8 zp{)H6U$i|Pt82NF;~(Of9v*wLEVutz)8OmcI}cBu% zjFNx^DhueqiA&`(ZD!PgoCB>tR`&i}Q{H@FdiYeEcW6rL)~2rWJ;Rq;?-qQwH_qy9 zjbE8iT3-+v5vX}!+M%6=)fqm4N=nDPZx)u;=HGZ+b+x}_$(osVhqa>aWbf13I|Jq2 z10@wLd;9{$hRy4Ws$BlleT62Ef8}K4mF}_onU^n5thrv?)mL@C##P?rTAdQ-ZS&i* zCFN54+4et{b=*I(Gh?xCWdLSxd%)>)Ii;5}gTw785m9lHTq;mfAdn(yMv&gR)tOgt z=>6yq?p0*8!eamZe9xXwJ^;Vvv5&y z_0j5<{IVujdj7`91#=yaf1u#tSsPL|6rIm3Z*}EXrY=m3_VEn}3W{8xvaYBsyR;^I zZ`P)O(2%L2GhD|r${X`58V^@Ax!r|ZoU{C6<6{deUFFS(E1PmkYTa9RFAEOy-f1i zkrv(VZS$AP7Ct8;t1xqIYNCITLz)#Rl4f05EXraf-6EtF(Havy?|>_<=v>y3yzTql zo7SczgoT7TgJyiYas81Kdy1>Fw(Ly`nh|KR`p3j9+_P_IVVUcA+3uC==KJ^r1O?4q zziso8v+n#0u8iZ`f1?*f+U@kG&feVf z`?nlSo)H?HN-oVHEkf!BJHkn7e~1jp5J$KqjfhL7A#ual zF=?9soH*|}aQ?+G0Z1@`icm5nhEfAyD1;=_^0mOw6_+PfJ zokxsfY?Y>*H*!E!(Z2`htO06AG9+Y%262?7GcPv8fT5R;J* zSo{NoL;wLle~92#_m0;twMweiRaa1@>Qm=@=Nu|f3&Dg?36Z!U7v_RAF;7HDJg^ra z14>02(BZr4C2Qr;il`|YEFdR4|6L2Ia zub=^*SfuKSR#{Ua5H@G0P(3v;)iN}f^Y>>!a8_r|ez%XIi08W4t)I!AC zm)(tJe*+U#5S#mQ@TFVKJ+HRAhyB%Cu_TGJy8F`F-ERMtzS~P6iMlN@U+Mh3@9q!# z>t)_^z5n)mKm6DK{_&Gf-lzFO)5IE!sAc5U@%VhVJG2&N!pulW%t!<@qGio;+w!f$ z{CvqJJ()wZds`wKYb}U{2$(idC%_4D8a1c_e;$XW-?qN@K7%rPV@tKPycWO9ew}SA z;w<8k*^fEjMq47fXjpD@z7;!WyP4Q0rnx^P~Ba z(Zka;Jr5dt_F1E=nYei@ZcF&iy_+X8lkkwMSP6werBJACTOLfeCUeG;+1OP)Nu4b; zns{Rk)-dnpi`k;q&6}EgcJo zBMWJ`H`f$4b0r~GAz@UhJRX7yqU?df*5+bH%gEJQ~)lh3{jm6cSOhHw&nKbtle-jc0 zVPs`-QD+gBL71zI=Q|3LAd{$~wq<|!qsNz@{_)kj@7|lDSwj_4QBP81GjS7h@tJLr zSlE+H$&^&XdstUZ)|8kvyF^ILVsq2amWX!q>)-$Cqu)I4uOmF%f4cabecy6t(XAz?bEapH>>5p?**b>rnW^5`n`Cl? zMK|B7@5L91wAQ@M?47OmzT5U~i)QW`&go=s*~LSmSuSQxJ=(mDzG%+cwrHKa{owI~ zAAk7r#XI*LjlGT04fED=4omkmcNSq47G)2K)Im0k*$#6w)11Ydc!;@2e~5)x6Yr!! zVw$ck$dav-hA6QqTZ)B8dd$puyn6PF-+lD>^Otw`_oh3~*&@x;JWSoqGiSA2Z#H$2 z7(4{4RhB{w%&fw~C|rmtb7ih9g{Tk}CQu<2U_udAB^44Gj0lU8Ffs#66&>@Kg}C7O zUuV`qSaKxEaeAQoZ;6e1lA$G}4s5Qvcl zm@82wth|nHkO~S{!itE*Kw|+7J^>I5K*3rGQFx$%fo3WKkrY_jj;Z2Qp&}IkBwFJv z5do`DDc$3`i22=^>D3}$;npt1de>MSL|$M z`n)^rb2Wxw&E*9Vngz3nh1o~Q&&z*LC}(gbii#G$>dX=8--31e0USU#N&7=hOX zqc#2iWL?X0+!KjR-S;=WQ$d0e0q|3f(~mMMXl^CcI=G@>$`G+kDkr8Kh?#y0V* z(sj~F(X2HRL9}xp-;x(pVcYU!yV$VCm2o4DBHG+_WF4L@$={J zbzNM25@~Hle^?t`VTMS%%Cgjr-n6n5Qwky_+FuNC8zq$0+xxmVfaX>jG#O-wm`StK z4hs}1yWB0;*i~aj$(5p|uF`%=WmQy#eUiZ;nb$@qZqT5|7@EzH1j}iSC3H{z5aW5; z*%jXial>LekOvUbNrs%RlMDe}Sq>3PBiwT~LswW~e+_|--H<%<6!K^@wta8j^ zTo37Ce|X}qMNLTJV}5;D2(G1dX}#Giy`2HR-n!me7u@Qr-fyn)rMXtuYW0E})x56k z#&uyWuH|+0dcWVFs@mxlwct`;*Zb$Xe%AW%b+OmD==yrQFW+now8LTz)AZ`KYOTJm zet&2!tUd=2RH@t5(T-*Is_WfrsT`%*jh=D3f295%@2L9d_1XO~ds{Bf*449NG=7Ww zf*!UeYtfx5$g>bzY??!rI4M+z9CXTXX ze=ilYqchSBGCkr~=W|=&=6_f$zzIQHyzdCh6hNVKUWYydQ+@D}w;QS4x@MD0Mh9g~ zzm{Feo4Z`hkU5TwBhRPM-SITb{#IUQ*RHs0glwRLJaRW>xQlaU-t8eLuX~`$G{}9r zal|)YOZ;C?p)XI#UH{{Va{@Qt>dE}lf5zi=?gAUT0l>H1=D+kr{3;}y&X1435i3!7 zG=N|P5>S$7Cgn&*W+u+aiIydfvoh?&-+#RRRe%2X`uBg~f{Ul8;8E?&f&Jxe@8xEB? zsBR{Im%G-tWwM^JK@0#eV7aAE$X<4XN>$JYI8Il{D*LvXW(?;y47y*?O7ac^?~pL{ zNLVJ}Ep|zB1Io!y+kCX-9d({&lNd~X1J*NR((P<-?)$*3CoFA^LpUP9f4vIhjvgWV zwGa?hBRXe>%k}JvbE4O|t+8hUXFH{-vZNg>CPB`AfS3YH7%rYPw@6?T4H5t`)534d zF(@QSu%M!wZmJ;B4wCk8%Xfrck`3VTQPEC`)$<^C)hf5$hNNm$?M#Grtj6l>^14)O z<}km(*6MZ@WZE9zKz~%fe@7p1#4a9&q5g=%w*y_3~PBp_4k3q+M(FDpl}KexX&XzbL4#fF5oATrW4jWYOlDB=luMKxEzKgzsaE$F@v@ zHr(^=M0^4|sG!dzRisJMjLaZdI=3H$lNL+SRU_5|8RQAPGDiF+!O2p&hcpjLA~|LC zb_z_AcTgsim`6Mue^MZa9}02WM~yN8aGvoCH6&v*JTf0qi5t6omAbq6r_cYM87Fq# zpkc9`cN@2j67G&XI~J4Md9#bZ-;I=}h0k#lLH^R3?=O{v?&4Y-HvNyS>yOpCD&yyS z&hzt}_vIpRk(MJm>R#p3n1n>Um*C z=bYDV#e7`q0bRZnp3I@^yklj(_l_oi{Mv0l9X#@vO($Mk{nm@^YkDhkm9IPmNiC67 zIS+^wTfr;Be*}OFyeA*n$0^QzcGCR8?I%WWef1|Zx38LV%YtgEpk6>>8ic8?BESHG zC`2;ZSCgEJ&HF8c9A3fGZdtu+|6^xH9yqyw@YJEt zzxb5z??IhNvA1$FDmTqn3e@&-wsZ66tlaw0+Xv(mf0sLl5ID9Xwl1owna)jju3ZHp zHdG-2u>uc_!aWWbUcK%+&;9rG#`pFP{$uwYM}EOeW>phZu*X%s&R+`97jR-sk=xU~ z?{{Igqgj=2LDG=gK3?cTzoUK!GXPpFk<&z=Ugu{!>T_Wla-wz@({zWuRdq?lmwW9& zRuKt;f1X*1K?q9Um7SWlf^Ci4xc0imi&RodmPyweBk!nkv_O__ag9H0*iVgPvXZNS zLeq+u4V4e78Zy=gvy|vy!n6v3RP1caNYO|(5fNpM#F1Em#3GcDpMfP9Rv@hN61(w$ z5SRiZ3W?@syn=qvFp%+Nc2#wp9f#8FPeX5(e{a=|dX zoRpJN5{$<7DW@n&CB|$`p@}52vZj{A7D<%YVvU+wnj%F-Gbs?(lwxX&BrAimGKq>L ziLFd8sc1AcgQ42eOComsGbh2AZ-KI!e?eJPW2DT;5-Y2@Q<$GbiYysbgK#ij&7Pa8 zEm9G&jt^@y@#oS8nb6V<;7FCC)l)K@s*q5lm_StpMQrA42GgQQqMDF}RDs14p(?0) zB94(%NyMrP5)%?5F)|}_Ao0W$qxG-^W{e6do++q!m7rql#E=cK5Jx~oQkJ~4e=>8- z%px%+Q7x$~8v#kNK@T&bGI8GT`5%iwF1rZU>J<{}z6rzuiAazHNI=v$5|0=-3rc`X zG03)+a46|bUi>Hl$(Laukh3rbM2`Tu`4;Q_Xar9gT7>qS&Zfr{2$HuRHl(kZL;5)) zl0vZah>iKH9kafUtzyF+@*K{?45110 z<%L3!*i4&nu485hm9Zx_;}Luw*mQ0gsEJFObtt!V>!UmV{ciWh4Q^_mYj->D=k7)K zAK1V6`;Ry`Y4U=bHjVtPZ_Ubh+4bv(4zC@0WA(_sO&=Wo;wwLI-F(;bf8Xrcd~Eo~ z?;Tlp;J0fI{l4#8_qeY9#g9ERFgm+s|Sysxbg>E+_brF z{@Q!@4h;9R*wmQ|8`6qo7J5 zvPPLCo#)^Y0#RTxuhsEx3ZIut3Q`Bh0KC)z&2w`Y|%a~$8sF5{E1AK_KM67%f zuVpjV^*AhCi@j`;Xwp+;@wS#&%&P-MFiMbI21O<+e@HX{*#kGITGvmRl^P#rE9FE$ zMp2H5CEAKNLIRK*(h#)kw0y;QbSz#V2F+AeMWmS#u|*Lnp-IdW%!)gROe{#uqPESL zML7zqO&qCvVKR^xwnkiw1*R0CB7gt$YMn;z6Z=q5U0nr9nnwSAg z6b0MMe+ZVkRKW*;k{fhrm0AvB-)+vewvODYz=e8}6=a+KPzCQ0JYfLHZr+dqNX8j? zW&}1>EHyiVh#_QIYvt>~&Ew~$n9u)s&1`_CGkR5gwyXbh89whk`|)PMhEYP_$0pqQ z;M`}Qx$DrrZ=QW;&bBS#nj0S&K05Eo%`RQqf4g-3*3-vl4Qz-@@BYU7?_Rm%e%C#{ zz4*qSuiOE%7P_9>W^R1`;S-}>%dY(&Th|(6)m4S}IeV|i-sfJpGsDclz%VmBW@woX zg@I7s&k`sizL1JWTQ$5CEv2QVAWWeIT3XWtQ(IG15^K?>whgAK3N}JfXhjMXIt&@X ze|8F%N{u!8!x-a_wf8=Usmc8@lbrk7_w2pC^?l!3OI17N#_7`SQ@8wdeNXR(?h6lG z>At`Buv)nImdBsj_@_VOgto+0rEaXE1q0`8+Ii*u-F;`i-u>E^zSBG2J3f5Nk2Wj(hl<%8pd!e-&SO;kTQ6kE;crne*feJ1$=Q*7=h=ue|x- z+sCrm<5YRUyzlJa)OVsZwMjeD1KN%K`1GyMcJ*D}aPCA`@0ln5b$;a9*(y_zIUOL(9p8WC@>`8tzGlC;6z9%XRh>9|#oAMEE&cH$s;(YKO)O2hRaMVue_FEn z{?ol1dQPrAb$rj?FMa;GJ*v4i`_zWzhYsC$>5Y5-{MyW?_NWna=Iq$J?;n5JaPs9< zClB6p_LXJ7_+c{n);SOD+5P^RZ0=a78G++&(W4u6CTDJD#Hoz|cKA8;6i0x@Ha>Z2 zJ0TE|B@}wl-}+FDF%o?x36^*ne}zdP1V&I;o}uz zDiyhhK+>T1e93_u{pzA37i3rOOD_a+T?n7Zz7v3e6+}$6mP0BoR6aB{{OiLx0WlMi z)aIcq2!ho5YXmX1$O+|{RWQaFW>517$0O{KDZl~|ed5CAo!Svn6dZ)|e~lnCEGjOV zMgSt2Ivp`nWG}S80Kv;5C#RBT-U|Ay~v&+OvVu1(~X^cEIOuFPcVoq;fn~bi3S7yTO*e})@*GQ*?-V&tgIi+-hSN2iI=iOh@eBYA@RwJ=iiqcb;)MKt0U z(cp(%^_z{7hFJ<9eKi0uVERqv(KNlXI-!<~$s$p8C=1vnTfa_hRE+ceur$f8BoV!uYP`DpTYvJIAGw zisrPf+_mYi-Q@+Nz&d4S*DtxR>vG?+qlaf7cxn69OW*E0tY%EC|J<5QSI@6JcXZxQ z_AY*AUuEXvq+`kLhhFXa+dH2=@cjH|_bq(!$!vT>!YP7fG@8Mc>Qk6nb;F%^_gq|c z`VY4~_x!!@f4;e~_Yf{xFnIaeZCBo2bLRI;4*v4dYZta%J;F1`D%UY~<%2sv>|6cD z%S#VD-Mn@kPyXbF^W9tD>0NTA10#gWmpjA3MDWSJ>)xkd33f}O$>0R=yb37Y{3yro=%Yk{S} zprJ~Rf7Oq@h{9)amkPy_?^QxWsL~__6Z4xK7NEF3I0QKYLLJ&2h86IFmf!|JBn}?< z=%NUN+WjjS4Z)sf3SmQdBmYDpY^>#gU{a&g5QasJl61;5C5&EaLKBdjbU>0BT%Z9= zSgyD-@_{uNp(0Y>lhH&5OQLxEiK99bQz)S~e}X69;}9soJ77w|D5GPF=BL<)T0v$e zW(6jN>kz8{^)dgI`;jgwLSjrRY%PKbpQp&gh_lKsQBVSjsOVvmuL%YFR54)787+1t zw4Mg{CaS`%mEZqzap;!?j*%Q73GFA&Ep{2$OcROQG_|A|5y>(O(IPJOyi!AOvbPg4 ze_97j$jr_ansquOFK8`hLSR_%7hAAal4cM_&^i$!#ajb;ThD0Wa>Nz{^ox&MDpq{A za7Ihu$gudznFCQI%$YohEjvq&z$Xl-k$?i39TS+^+=GP( z6fI(;4FqIH68Mp<2OL5~5gW|Y9!XRp4G;lhij)8vwuYT%HnJHJ*jZvBJJAGt2a@kd zmJ6onLBH2xLZex*A7<^&bHoBUt5Y!s4`BoUjfS9}Uj z(S-qfMHHg1AG{ZdlQ_O7T5gpY+KN+e)3fI5NfT6kt*O*OO-I^1Go3J7jh~`Mk4c)F zU_h;@Z-J(fX_XacyP-67nJG8gf5tJUt`;(DT&4%qr^9VsE%o>rCC+V+L2~31O`zAW>Xr%mCmGPx@w)F z+QzGz!D@gtRW&fET@US4Et6H_&8lH^T3bs4E4DNkt2)xbooeKbs-Y>Vf37i==442x z8ahr5zd;RYQ8hJCicWHi#D*BGgK~qeZdDEKs%erMHd@sVN-Gtr3`?qNDRZV=LPp~N zDh;NlBdNPd4Q^HSBa%VG(o(gq41=2XbjVoM)SOh+L00Cf3RfC+WlU1tt_HWN>bkUC zjg_Hk%@E}VCgl>6nBzEtf080dkFX%Up3g5{EX7J`NQ)y5C~6!rz=Ws+vb{x{kkd9= z&5PWAyrCn{FFs9=D&%kopH>;|0S5vzn=mXjrXUy(g@VB0RbBxEXbb|$Z1$X)ApRd) zXRmA7QAFYHu3A;qd+&4a+_~fV!2=F#Av*!{0uGRHg2a!Ak&uN*e+V2xfRM0=aA5HU zM8rfq0STc4cm@*0D-f*e-hIxDG=X(>ednGtXLnbv^{uK=SIO{S*3M@AX*wR}`8(&! z*Yhj$_SNAB^U!Z&y(Cd?z5cWQwCR{!O=+~N3hCxwkOD8aSpzA?+IUa$MtA2Zq!?1l ze9x(^&83t&wGc=ie^khk2vC2r*Pt?q%w!%;)AKotKB;icZh0E!%HUlL{j^@aI^?y{Wq#-2g4}i*>_GK zG4Go>VSrH|J-J)%50^N0+jish z8+S^qVn)3bnMW`KgmMr&PAGd>?=fx^G!t=a5zV{;;)d?RGeK&rV{RbhjlRTaBSEN5h=rV;-8=%n>JuiNEw`})&j0k?p!@hUlH|-(ab$975;pox2Ri<5>pry-@#7}O(aFa}% zPd@E`xMg;9XcZc6qt=0$M_BjdWZh%y(Sx=Hf4Grh25Yk|hI?KTr`0mp7uvlXU`&%@ z=ICLCn8`jVd&g||r&LQy zW980PspDiy+@?dE|3T6obMhh9k&YRXpY$Bk^0=u{WW3D$I$+@}7N_0A`=A-Bp$*oU zf2dkMgeu8I&v!{AopR1&Ab_%*s#O{vMp2HGG`3R&_s8cykE&Unti=<9$Blcd$C>M+ z2n)=E%XpD%B z@b9RW271i2m#X^sJqNBHlg}WAY<)v)Rbbw8`bZ@DlZcPG!eFju-0r5PzJTzH<9S6U z%>yU%Xc04iKKUo)5o$O8=qbxB#>a|jXT|0&<{DisG#S-d3JjljDwk6W;ZLSAf5Gfw zcm|<8Puk?o!##or2)|#3lv{_FU7>WVXC*PQy!GYWn9)2I= zBR(Y6#M1M0B8WERRWWO(;#OMKkq{gfiB8Fre`ArsqUJt&dcNnwIQ7@cDrdeGWBYN{ z#?r$8W7n8%i`GRQNuK0dW#kj1cVd#9p5k$ z1egaRRwuERl8>$nRnQ{6RZJyrZq^&*J>KNQ9p`G`No0?&?rz{`& zWMyP&@WtjvR4XImbDj57^0_aB3ULtT1?zb30;A5`!h4GNJ4&L(fHVnY`mww6s8sqV|<>Ikil; z=GM#_?G?Df0gt}T+#KW07~h{~*LaNrr2(g~)`-~$2~!x;!Xq{evwxt4N_kHsIuP(a zYR%M0@>tGme$?5tg$GDkn>9LzFC@aHFw1#sP~*b91nCUT za{Jw!zIuj%=TDvkNb(uclXXRQAXD2&QFaifw#;>%3Dc||<*MIokfB*g7FMm*?U_W5@Qg+nmr9Q0%H6E&bT>O)t|Ml2cG)*PEA5?H-u3!Q%3~?J;7PT|QXWfrRrIme zOWVKY+xPB&_<#A!FaGqK|9t)9zx=j56g|xMJF{1q>*Fyw331-gD0PT`r)4h{l+xk%?kJ#l}kNBpMggng(q{)NzY8#uX3)?h7t4 zPNLRUQ(H%gwBaljBM@~I)A?LG0q;of- zlZ5Ace!O5^iRwe*(unS)Xo7%e3A~)SVNc=pYL=c(;ySBPJorx&GAJRZa7O**o`qA0 z&$!RQi+|_zDdP8~iRsi!U`&GF9=skbltNW1OG=|EPH~TG53GULbU(NWB6^BMNO0?~ z0Dy6h@(oHkR_-xDho;J6MK{fj!V-&9xR$38LFz@w;HoOKt;%@5+zrqj7ffJu=bd%M zN=I)9?#_!K>&qlio72pN@!>mK#Tnw9mrVvd8h=Ll;?}K(1zvEKXDMCr3jc&AYk=3M=)oYng9}*ea{VtVG|UM$;l=hM$nIYnfMu@ zfUQjDh%cCP4nge<%ZbB?0e>z?sXPw?b{w3~k|^p~P6ez*(OgSdSq)zz5#qFw)$H#e zw0~quQsXf<=tM?n{|F=k$BG#iFiQT5a$FhPblV{;p%vGWL4Bp9_B6r|36_ zfG8COKmWb*3`^vjQ7;a(G~AMTOmJtbf*?jw*5PE25d+*Uj0ONl ziU?~~<${A{hK%rPgXDvI@zBpN)iy9m9@12|4SduulHvuAr;V1sO-qt3n{NGTYl?C{x|36 zKPb=Gvxvrr2^*0*?Ki9MH!k`1%KX-f9{IBf@BWj#t!rAE<~3bd@UN;>kAJWCT{ed# z_s%-->FSo+tq-p}J#Q%S+YuO&xpx1C`*-IzR1~yUZT#Uz&!XJ!i`M4fyt(V!JHKnW zG`IO^&c)rK7rIfPOd6cRumF3;O^4hu5x9`;s`|E*r6Mwy~`P%ARl`C88*S1uzd2o4R*+G($Idbb?^1r#3 zU4C>+K$2UE^K6u*-Z|cnKFVDVzw|`+{^SSKPyIv~U zCe^?+ z&WYtGwtau~rR{knUK5huDRcfiw{Ok7_IcLngGJw6%{loINgpxgZ)f)Yw{`lJBjYa} zDSq78W6mo?6RtcSJ%7}Sr92Do&m z)JTU&l%)R`rb#(x9L$yz&;qp78o{o^i$S-OP@tS23o!TG3u+3^d2K-zfRkJie@hdH z?gIUST84|vF@I)ZWo}@{wqvkU;SndQ#7xXow;oXG_ax}VG zsTUtB%Ak#_ZWUhVhFZe8JY!G=!2(wOphvY0;$(J0P=9%v3r;{#3D#6D%$S~=Gmr+# zC?j42wfZJ^pd5(@5JGV5Zm7ld+&*&`B7g)WvsVraoO=O>tReL|NMwD{OCq>=Xv1RK zWLVBQiZjL@Vvill854p7m{U}mZN?V2F`;CTo3VG{*v1$Hz!)aFMhZW-d9wI$>_^0x zA5Vr2{C_9~2oVzA%ZN=P26T*vrU#)t;fEl$JBc3! zX)|(bE)LuN770`74e-*ZWFIMA)_QH)g_G&)id45`Dv3hpzZ6V@f*2xGNof3_Z8&kXmX`(pM@*#PnpLp?^;nzPF&cuCVd)gi|G5CQTxterfYJ z7e8o9%pOdXPeSdv*Pp~r7_s$F8*ZQXUhGS|q;-7tweXPVd52^Y%IY+#VDp{Iz6-~Y z*kl?zcFZ4-=T(16(|$^lM`!=}_=1X~^w|uNIytxD=8JpRlUSy-f{@3x;2KQBr#$J0 zM1MGu_=8Epgej-a%&pi@k`h_m@KJk@O+I@eymZrBbv21gir=iN9JqT=`k_x}e|?6g zK2MUe#{J=wMPHS&)MVmiuxDOhSa)gk?o}ilN8)}yqIloF@9!_G{vx;T^zx?juYX?h z#QM!e4L7^4SwHH`xr~D!_x@n_yz8}H-+$k-rM0oRt~|GuC0TAcua3Yt3VxF7yPGi-`UAe@ImY+Y?^)zuk4 z=RD7O&iUWo-j}wwrSCv%>q@CW3$=j40GkM+CW8;KOxf5#6chvrY_KKxf}3M;Gmaq> zBpaxiCb|t}RhAGyHW?vX5F99!Fyh-bU9x0f_u)C`{Lj5L;S=e7>Fqt|{D02x?Q!o! z>oBhiqamV1X&<%#rN|L8;k6v$%p5Y`jR0K98^;p7{EQme?4>|aDAm@;RZD5;fEf!P zo77&b@>AEDqat0N{c+U}++yXDL}{vAMt{DsRw3{&9anubCE%~!&iEV)DDF@(q!a5N zYx#6!kEBJ-Sx^dH($3nYoqvM>5VUKv(BzHM+LJmEHG49oNLeKhRgD`iV=4mnx?<`* zx86mh1&r}rvlEA0*36JGh{Smuu0jUw5-407t%-nK<{33Il=1O(T>*d?p=xi`FqwoU zMOPIV1-^oy8Kgr@ZQwe@;3=}r1qT?KG|g95*yH219KcJgMbaWl>VIi}r!TX=c!x)- zDMvJCRGpx?ciYu9RWM#-&F|i!2!2ufl5xY!R+o1NIO;aeF4miFz7_(drI8fa1<}Q=p4@j5Ky}VDUwYqHFf7E+;!Wdul4VIY0AEX+dn@) zwEqE7BQ$Dhj3Lws=}en2b32x9`^l#tEq?Qj!Ixgy`RPA4Uw=NV28v1xZL~trXvu1s z9S3%3%7ecce*Wmp-LI_r@Nf5j@CTUQSAECo^`q}^z4*>8&;4}q-e<-yStgQci+;Z6 z$F7*X8?;{bu?TTSU+B{5`Mkyn1!f%P)TOkH;VT z&xP(y3q__)Hh(Nye&nsk|9N5g;e(5w|8Z_=yFh_9F(v^7uojYf0h9W_{?v-M&i?G< z(WkGUS$^bD@t!sFUw-}GQ}2{EJ+k(~`NmBTZTS12ryqE(|KOorpIu-1_V4dMcWV15 ze`#L5P!>C9ZQJ+oyYKD&;`)=3 z+8x)fj{m{dJ5G)a9eiPM@9wQvPurFEEIxMh@y{m%e}T?0x5s@A~5X z^%q}LJ%1&UncB2w+qQpS+A@0lp$jA384-(}C>af$8U< z1AnRrd$a^45#rcntfBDH6*g0{ghp%6Dk)zR&Sxzd=NsdGLMV^2d#sF_v~{D@NNaYI z2FpcsBllfF+|6%nB=<0UbX|Xjtl=EEk8DJmrnBsLnC|#C-}vWV!Uk%PyoeU3#|4|j zLo1Ar)u`C=NyMUz`)4$GlQpjnXSkpgQh!58qB@_4j;8NA2bhY)4)z`eZX zl5vusiW-xBk)uh=07P#)(`GDU-}lOV4=>^J$$uEN!^P}K z#YjKaiBh;w4lKY;+$p0;;x`#*iMh;;5gYS5at!YhKY2y%ENeYjRh?x_YBRZPzCF`4 zWacc#g-g`!cfx|Xa!RKvwLocVGJkNFoVQTS85Hd$skJ0T0;3T$DT7#TY*h>92SnEb zF}P6l4T&4NMQejK7Of>?l~qUyQG!)DQ|y!-GgaSwF*Hj|XcI|RRhK9`K{d@3J@aJ$ zOwlo3Ws6kXmTT*hrGnU9|L9hkrMYo>q6y z6&A>V8ejym?e69MRP$`Ta_S?MI=B4L|}_h+X2l3qI0g8G+Xpe6K!o+ z90$$qqPEqJ>sB?*P}?p_H;bADcOLlNhD)dAg6X2QQRZqe(@6D`pk=z4c#G({Rorls zXlhcmB`CCu#(pt=P;}iS8h^*jLIafAWuaBpw8~-&6kAk%n<&)l!Z@s-ESsl^36n%a zyDZjFzCkxkl*Kxg&0)R{Ya3*BK~-fiUq{6o#kfAv-X)58SuA3HqN?u|t$m`dLlhfT zu0Yi}Q(e&2oub$yN?#GRZK}FXmpWzLWKlm^G*1>S9imW_)p;y7>3^DT(aGHfSV<7e!|reb@UdYHQCcVEw>in;{jf4R9aDp?;}M*{ z0lme{nNbkq6m-SO7ilF3=ndqNAp^p~_8X9NwTynkI4bl*LjfT5%3#@`^RTYiSFb2- zF5*)GFb%)>dyESAiGSdFakPX_{DRgz-ogz&4LT7z5tlb~{@h&QZ!qimq>MxW!my`= zZAbw~B~g2GelP%eC0qKUr#ROTo`)YIm1K7gw@x{|$tN!uo@(y9B&RefjiITp;`$pT zkFvn0A%%#(i4I9yV_2*Sa8rU32vD9OLbiGO?||_qZoojO(SQ1EDyB9gpH!ldAB4c= zpa}zMgQP;C)Q6o${8}MG#X%(U0!KQE#sBR>RK%$a?slFw9Ll{ zm@qHaIW1yC34fbt$*{_oNisGX9~O-VqPX@gSf;{j@w6Q@gghLF$d^B{yWDxV89k<< zHU|{6a#(~onauZ!06ODUQ08e3%!&^%3SN~FHxnqsNS%R@O9i5^+yn%3h~Fr<#LSyj znHq7JkF;>0-+>#Ram!9Vwz&CSu}uF0$DHag4M(c9(trNTieh~v2XzSgFv7O+#!^ zL<%hu>_St2Kt&OXxDX0zDMBh*(^|2nNllP~APU7*H!h@DS7H}#EaJi}3Wl_m65E8N zt;HtR3Po_?-o@WG}>)! z%p8V2l8uJb2~o+98*zIT2=iKOF_K)x?bnO~?qOG!DGKx@2ri&aRB8ZVTVA)Pk<_Xt zQSY5y;A5QsI1rU9Y!7_f-NO17szu=%(|?BbJvh{yD(k*Z=*gPz%U2?T2sp*QT)Hw- zV}k!)bs9?GBF(jnX!uY9q79lYqf9t`rk=XTE=9MhzEc-6Qi34AEvP~UKFK70GGc=& zQ&nz(+@Pj=X+iht9A~riT`8^+X9~oH$%M}UkyM>W<0;T#KMFU5X_`l*D$BAMihpJe z(-ydx{e|&+Mero}D9z0_y7NdPQOo>8VQ{xBqYrDM(I<(p@6_Cqb<6cpU8o{SY#&lJ zwbJhD;%JJ@R@u7>Xqp^l46i@hj;FAv28)URlNH6;VY%C84VNzZJTaGKfBZw^7A&RF zYpkMxc&SzgGa#a|Zc@Z20bke!0e?=U`eTb7Q`pJR^{zj*v51LXq0w*ARAIdW{z@X? z$N8CAbT}JHT|>tbAGR9y+8+W&oG^`BX@*M1M1;S~N*sg}c#>6V4O(aZN7m-VM{W^v ztFhvpWI{>)`uvTV7#mT7`vpELnQ{KE{JptfskIhbXxUjT3nU;g(GU0)+LD~B|9Ytn9SkK z6ArLlk|+IO-zEls!b)!kqJOJlua2P#gAt2l2x0$0(CoP9ZLS=zT%5zKHdgE*s>}|p zlo;mN(KdG(vYmGv?*0K31oh7r1ZiRpA2T-snepQ2NZ3~`K|D;oj<_P1E4UQddb!b- zNs-Yt$b!4@wAU);pC+|6_NFSD|4bZV!ERTGsJ0rNcVHp0Vqn{VaDOAh!-D(Y$OlZU zlWbevf&~R1C9N8WO5l!kRqdLPSmTlSx|b$vH4$s3U`H6q=y=;0`oTCMnVpISwI?tZ zN4=-5Pjd*rq#`UiMa-p4(ptl+1@$1%DFQ`?*lu0&h7~LS1doyPY1D?@NlQe{i0mqI zF@o*9bY7gGX9kDS@P8p!#pmLkpCHT$G3A@hj0ZZxi%e9S5OoPpQqD#}?uE1UG-cxr z%W5$xcws83Z$rTg6`SQo84e%R=|Xid?bf=K(x_=0+WMx}ol>+F zZY(-RAC|6MN-L!i3vF1&U|C90F3POD87fk`A|-)^n}2lf%!?L1T*{s0<}ZKy`4_+V z^qF#?u10UcqCA0bt7llCd6fbF!J>( zjKV6D4u6Ds+OR%-;5>)vjWI7b*&o?3$ z^Vu}P!s;cHz3~^^#AF7D!V=^FNd*rk1i3caB$E+Fp@ss}|;j1$7aJ`vSQ zY`S9U;;QM0Yk(QNDY-rP2|GkoP4ktvd<<)$wp=AuR{^D~M0Bh7(Z+i87J3oeTd7Tw z2D1UE>#(rsxa7oh@S|Y=unaX6!Srar6@Pk9h9C1zu#?cymuP&eH~Q7rF;3MtMpvA= zl_(tU=ZKi@tLzuWi3Pt}Pvhd$5G@)8+#(}zb~9M0#b#O79Y%0k^K2GkM#A7n4X|iv z{V+ad)y#_77X3%CN%Fsw9rNK=OVw#Bb)wphWO|&e^g;W(78um-hfh{r)CzGavVX`8 zyUXtGp6)Dlxv{jPx8M7dlW)BK_SRn?zW&_TUwLZh<43C=`{=1({P6YHPQLY* zKX31SUzN{&;_;`>UVHfmZ=b*a z`tJ^Z?N}}EKlqX3$IrcR@*fw!cm2hCUwG!gT^}x7hA0hcqB4kgHbl4g!(aKvGw06y z>&mIuEU=6@0E9{dyzTYgK$P^bh1X$#=c3BKSTTwK84)QcTH=LYM8Z2L=%N$7 zOz^vHLqt>q6fvu`OtVted4D%MV-Zyx{)r?~oekPrV-`w_81oTQE=)ivZXkkGcj1k z&Z(TK4oum7!OVYqO!?D{IN8sro4ob-f!%#RFj6<4+N0k^m1V-M?n{&2LF1kKspw$b z$DP!k1@?K@=#y?$41YZ^cdcSv)JS!}co06(X?Hd`8Tj41 zTDyQ-$b2~AYy`rSb417!wOS6P^7b@hMArjPC~^F=g&DMwoz<}$?I}+?wBO;^oYnqQ z!z?1IO{L5XoymvWqN(Ai6rm8Q0T=@e;Pp71PS_lu*@hE5Vt<)$o)9}be}vsDji(BU zxwgih?9-C7OEmQ8WkECvKl|uNn0=EDPQrF5&;RJUwiqj`E4=@`*IIj@GmJQ+D2$Yg zI!H(8c!7w63V3C7h`m^?H>zULL~0P5P_0dwg z8945CHa%caPY=;!`P!qwv0V#$;ZLlBfvDw-I6;QO9#5g zrlS@#{Z}>%*WLKW&WoPi9tJ|wSrq!$T>aY@H|=>PjDIc;Llg7AxBc$J`v)xGPKisqJqu2YdzGm)iKYZwu$@#ZTgjow`uU$9i z>TAMLV<%s=^~P8C-SLmz_x@|&L!Z5M>~}7J(ed#Y|NMi)2iNWV%h@{~z(uRzlxsJ< zedxgt_J7{C_qDs;d-JFNom~3pEny&}4p29j4nXM(vGp+w;h$`;PzaWr5CGaO-1RKAs$$I5U(K`%etG>eS1( zZrHPL^FJr=KKSNS|2r^x-?gDHP^NCqSRiTiT7PSHSFV=s6(rd~e;|34zjX1+&SPAx zo^#gt3&zhIhW56AU4}|Ae=T7$LNsgSU}O=TXI+o{=t`5055z9U6B# zfIRex6M#E2&w&UR$Lygu&x1Hy=KRsfq)Q+7A$8%qr8cp-OD^9V@7D z8K(^Q$cLh}5>$_EQDgSe_kmMUwdVdp`CBL+-&@+#M_01M>z~iZ6OrR!zwo($a zL0MIzh{&8bZpAOWe`rz=$`%85#;^!n?Pro2a4BG&S=ZX$GXWryqN}LlI7_Nyr_m#t z7V@PP5F$Y%>^-8AK@bYf#mt4kfiJdkY;%@@gh^^$NH2lLEgiXAH4c+7AzTCu`+vK$ zXec3=Ej<#JTm+*;h-?(A52Zax$h*CR8LaA)B z2jyjkhim1gtMV%n+*2h{F|*cRh?q@EP2xP5A}la;IS)L=`8_vpQk98Xzivd{wpQh^ zEq>TRiXlBPL9#PPsD-G`jXasK(|@B@Y~{OZ?cypOR5t8kogP)N4tW6D%H2x{+shl2WO{{(CueTk1b^h%)&A(zD z4v(L5*Zp^X{Qk1XA3OPu2iCu{d*bCCaegF%rsNC=L`~nUrn_SB{M+w5bbsiEw_jg) z|AVLAyM4~)d&1C?k+mBi`fS(GbzcJt&^;!UbEcoM{+>ezZhrICktcs~`~H1Tem;5Z zRp)kRFI)M@^J6=nU-sOUp+UAX*_XEuNG?tdlEJ-dF_-=Fy6-0OaO&h}S#n-*^+LprySO4LU8zy%@{l$l8Zo57l z9SAVwETF8bHWmSc{+ltID~F$TUfaj_1{*Kx=WV z6fF{o4X+B6sg8wQ8kRz_1j(Nnb=sC|omq`mpp*Kiv7M`kkb%Jk%#>BHt7fdI>{MM3 zh{sWC-SdVPi<*uJ@PDlIbA((b(143X_q7IE@QM~ku6~UD#hMqPmMyZk5O-RrA0{W~ z^|(XIHG|ls#&3`OzfrqB#_A$KfLPg!TKLS=LH%G-PYivF^RMVT%0p{((ptMSg{r(-zquLbo8OyHEaGjDL3N7Y7_xrxXOmaNTl3 z9BlPqh!Wl=EqG*h4$DtKbizo)eI95qXKZ)LKH;+Q!7Bg>Wu=jfYK9QZGU^fT)PIC(P-I`deLmK9 z8|bN+5gE-twIzQ3_P4*)SXK^zTu7?;O_mPm!vAUtpu1)wRDf8{^%zaMY+O34y}q65 z$6bMbQ`sR?NwQP*!#xiAJ^uIp=~DxJeA`s}n}0Md<~}NYnRHVMeKVSY(Rk8o zxcJ-o$~AG>S8-rA9=9}{c4@rqn`!)lFg!$^PAU{L0CCq0xv!MIna$v6Sa3;Nc6qvR zO1vgt>FW@$=%q!e-uzaMr4D`dFB=Ae?Yqb96sWJ0=Y*3UgOBi@0^Fn_&7D%}pomWqlysB@69Dgc^fs~G;#-rlhN!8vUnJKDLs3IeM zAQFulq+%iqy*I=vkQo&utV2Ep8zn}hOnj{JfXkz*(L6=8NwxSYEP~0VcE{hgem|+M zRf}C}Qna~NNu3p{Fs>Q6yV}w$h1@`uMB|uFv#xDS^_^G-<1bcJfx=Or>o18+B16+_hLI5_`dV^K)Bwg#N5n2YmrN>P2)h zr}{2>Qc$z9d&W3yUm;S;osW)Dcz;M}9B87T5~V z4A4RJEHx|6QDN#XrwYM1uOLegR7xe6FeVE%-;NMlWR9fPCKhAfXq1(O=%VLCC=*r` zr_Af(cp8=jJ55u|E)NnpK&{8g5T?Qs#wrkXa<#5E!*#M&{W7h`>tS$ZcQFATVK}PJu#LD0j1Ic{EbaQ{E_|^86VjE@FRV6fnNBB~rLhEEouY z5>XU$#ZJLeQbFht2PQ*7$VgpEIYTZr(?krhuu#dFs3Qi?i4qj%wNc6tDSzcoHk}bs z#zH9rmXdRqp=gv4QKW*^Nt$bfI_t@1l68r$f~zALnpwLPTpiS$5ur;7LCMUkRa+69 zMC$F)J`d!H?!m`F<5C-RBO-2QMy-fSz?OAo7DkJwN>%%fwvyhE2uW3lG4=4(tGN)U z#}Ok|^*-^(hMk@E`Ixhi{C_~E29hy4(Yq=}W;|7=~Aar~TfUDr9En}>(T2?*K>A~2h*Evb}ISz=Qvbjm{4 zoW=Sgj~QYErb0wzIc?Symo{^=S*|Zk%nH}kngm28l#dx9M8#T*>VJ>uhwIC^&beX! z@ciKO-1q&tKc921b6xNE>m7sP0su@f?wFyB089Dfq zQ4VaFAFn*Ppkeo%lw~S}_fsbu6{T^?AA6K?X2_w*t6iIc1%I|kD%-btM;Qj6PTU1| z_k>ncXz>r6R>4OvlyeA)HwS|Xm1J1Sog{?77T-)#lW~z(!~o^XCQ)z`@yW=ZKI7jA zOj`R}Q6B0CsA`t^-kCk zN<7rW&shC2hJTN>A*FIWF=Weo#GDh7Hq7}y z$(c-)LjlY<6v_jofnjx&2TFy7oC%2!WLzI4%84V$5`Pel3XPC35n&#UFcV}A8TV>) zhk`bbz7OE2WG6SDCY5a`NYVpW4JO}$F-EZIgMuk4BgBdLq%C6lz9bwA8-iM6zdhHo z9#hSR9Q~}7fiDFlS=TA5QW6Djbd6m8yEP(54|Aqn0QUe?bf6nBS-qllOr2{0Ntzv4 zCswVt5r4s75V;x}WFx=cp8kEGgH>-4Mfo36OisEhf0o~g)2>_T<`3fNsuq86u@@~l zCk@0&*%C*2bH#*W)#YQ8Tw4>mr)It@hbjPBE2VfSHB|thC>(h{<-cnHAs0(S$aGG6C=wQv-Pn9fB#81!F=-H^anKpm zMwB^0Nx_}c;jgSxeY6d6f!4h+1Ccdy+U=Q!f{tdJ6+~8LM*0W~m%(I1$~Z7(jJ+9+ zu7A{~OKZiFXQ4GE@uE|h5JM&9lAKZmblhN96&zq9D|wIY++9d#Lqg-D|7Z|ApuT$2 z)(9BKg_;Vc4qS9Bm;_`YSEI5SwPj)pJ8INo(x;MzKI#AhKb5ZbmUf`*bNf66im}mL zIPhZC$Y2Rs8?J+0h8&{(Z+fj7{$ye}0)M*vWGB&O=MEzlsR#(Tb1B+7IgV@dAGR(a zsOyr1`K0kq20HU#LV+>^u4U+>6Ln)j>ne%9V zNSDmJY~x+W|GMGzpReBc$Iq>O{DCkvKTj>c>9M^_zx360&;9gW+c$=ZfMprX zeecar?p?n7k?Wq`v;O;!g>x63v-pFzzp(#``?rQU0j6e0oD~B=Kp-Jtg426~%d|rm ziI+=J>63&iIf{dvQ^mzj2m}Vd(tj}9Y??top{xyFZ6leTDxnJc}u;Q%UCZ25hEr86k6Y+rh5~`_ILfBBqRKk41uq0B(VNJD=TB0GH8@D z84LkvxC2xhGb*^=ef-*Nbk=z`E=70dFmp%kC-Kf_%66uZmEzHdwfAG&Ie*kMN)_Q+ zuSgdH-ZnytLXOcpM{5d&6C}vqAmfVNB!(=7p1IQrpH(_{kB>X==E_})I*bWusy4-< zk@PBcjD#dqx=Nch^$e+!(HBzk>M?c9O8f3uAw(cjA**E@UbtU66%dCFUPXscI%ENP z3Nx#qV#cKMAnR*5M>+?@41d&?fT$c#9EvbNT{MqWe0+U`aU#@t9b}nUGRyc9aL5vE z$oq=Pjm4U)Qfu=b=b-?((F|cVd0CeWl{d(GV>ghJhLan#fpWp3#Zj^F0&54ilK1pG zHNliD2t-kIQQ~!%H>|Hd48y?PU(SLa%V6?2t40N7u49)s$$#JCyMHZjvI`gNrhBLs zvtbyrti3YnwH&TyG~=Yobq-**0K_W#cEQ3prtIK6qCC zeRTh9NAuR6@d41dwSR|SI>2lwvxZ!V27+Nuq&H2y^~P%-`Nig$SGS*f?doT~yZ%Ry zp1mVbldAMt={)+ zyng!jW5+Lk_@QM_d}rIgkDqhpsxW)ywY#6W<1a@hcYNiO$4+iIdf?*kJ@t`8hi-Xw z|26xb42zdsxNhsFnVBu8|1f>}=%u^2hYMz5AmItJOK!MrwN#sTTL)T|t2qI|V`2rNzeSZ!G*M)uf`>nRM^><@kGWve36^JUisd{Rzw)vXyH{19gQxaJ#r0BvE z?5nh!v$o3J*bO%@gk zErJ7Xjen?%6>^p1*l#rr3?9E`RO|;r&7BszX~G7^*pW!M^Fc#KY9=PV2dbL1(I%>9 zN|MdkoiUoxQq8H!wQEwU#n)rpd|I`Qjp~~*gPR%3_z=M4Pk>ws_h8U%)txeijocn% z?X6zoKGU;kQgybSm&VPQOnB-B+?1W1*~|^DpnvxtL=mu2AnTIo5(54TXtTHJRY927lSEfhR9ZJa&dopvfIU*SM@aO%p1 zaYSqR+ zOMjMy$t&ir-n8oh+kAZHjo;XH^{@AT z_`plI{_VB5-McHibM4K)efjzqpIx}^i+?-MoH&1adeKdHY&~^y!S1hZI(1~_;}5>$ zTMvEi_b)E~=6w(R_vFqKzx(X5L-(A1<-Riq=dW8HCIS#Klq~Dnr7ne<^a$E`9G^go zN{mKKphe=(0|j{ zH2!A;zgmWi+2Q=67OE2!ed{7=q9#8)s2p@aNy7TGuA+@WFOojAkU&G0i z3SBQD6VX{32K=PSQib(slC+=HfkwPX*Sa-Lv7$=bs4NrzJU5O$H_r+(vQ3W20)E)k zp+`VwW&L%7)_?wO?Ta+?ENt3o(nxa`Fw1QqX=;Kf1RbLDjM1jg zjpw#8>m~)-f>)I~v6mXuYlIEEoz3{;N;-j)R@p%&&iBw@kb0UoG=Q%*jDMGE1U$=0 zFo0~WX8b?y7EsM4AkC^2f4g=pBz!ni0`S5whKraUpAjaY3}2h_R9%jbu*u@bwqdrE zQ>{kIvwBf;6RpA%feTf3OLRgdmX~2hMV9NBi4)g(`&R^%ulZuz1|~-(Hq^Ze3Yjuj z)6rv$CLiH?6)jEE@IQKNXn%Ehjj`_ke4Wj!-bWS3XU@yaJTG~2lic>UhQykerg_oc zBn>fX&`@kkAcBPmE`%6UMJra2Y)VVpMUl`&tB5P9Zi>37TMY<;3royKkdoAeZ%}ok z|9~4^oH=LC%(XRm76EVM1Kx1t9wbTQon5N5638)~~;O z_uU7dzj6BYAHMX@KY#7J`O1Z#{^aVN+aG!HwQKj@FW<#6KCtv;U3wPgLyzfBwr?-@Ees z!eCHcoBpV3C72bLxEp(c{+8d8TrAsCeuhlO*Xo$aYLHio3^i!7oJk4;1Zt}&j6RL5{lJssr z2bd>7G=J+TYTwO1P?_8ltFmQBbl*+W#7HNEhg>T3qi2aL5CNPh==xlwhL7%)t+9Yi z+Wpj`xe7&M&V{Uq2W^!$3zvXx)O#+1x&@)jpa}1I3!GFHQX+0(>O(51M9P5EHo$;B5{s2J0 zIi_XioS8G_1S!L81MfS$eDvb{=s}!Q$}3oGl>^6CXSVUd6(yunV6m&Lj`M-1`Qnuw z&wQRQo)4Q_u>0`p)RTBzPo>9H=q`Qw*N(km#s4x#uy@4g`}n& zX{HR7KI({_ojOyGXS0u3E8XNDLt-QrGnN%+z8o|hldmw$zED3J-D1peDnN*U5UEb; zcC2?ZyP3OY68qWqwNzDs*tz2Q zo@0NzUVsa3r2fKTDtGTkmPBIdIgYJBY`U?(llgS$DJR!54%fQy2A52I?=ebVRg)DH zYc^ynCF`uFG4Y;ulsHTr=2N)Pg^^u*a+a7jl_f-b9U;hhfH0f;hHD|8Qu=w=mYzBV|!%q`pi=L>*qzxEaY_GonbTCFY59QI= zklL0-8q1&qu4n<*V3b(%gjuDiPAnq`C*<}Kt1959rl$^%w%LjczUqO_E1lXiQ#EPV zh&M5ebvnU~={lDyp?{=N5p%+oscC=8khBLte7J_0kfAdP5RC?YbQB43aZ6JyAozb< zu76bm&9XL%Z8eo)PnGjo!x~fVS7LPm*1yYNw>)uV+FV|nay;~6Z26BF#UBzz=pk%F zVIlcDM!R3js~x&I0|aH5?&G=Xu3Fd#fG85x<~I@5Kf`~VYp5~`y>XV6Vx)msB~fA-MV1+3&YW_}SviuK z1Iy_ZMSt^3d!+)Wn$zKidL&e=h4A&WmvSpI`xx8g4tTxSnZU8XtdrW-{EV5Y1)f)C z8Ya+(MqSqe1;Cqgs~xrP9r&7HI6RD1C9kJfFD9tL>QW)gP;Jw3{efgwM_GSJA~|?f zV{P9-#DkV#Ts1A(xWGABHFQ_XDZi-n4GfsV`oBdC1J|!rE2yvbs)k{RclBpvcP#N{}-MdZYYVl7r^e)hmH^K*;873H{B% zDlLJ@x`T-n_(^XtaDazPU)%R#>>TdJW zy;3K!JAPJ39vOMK?Or=Hp}ccy@Kt#7SS>6RU{8}Z**5*YOJ(0EIrcLvQd);S+Lwqg z)z7|qm+07qC7pjQswcVqM5dU49=9T*p;Q$h7 z1~I5A*XZQezYAS}pP%RhfVKCedbFFsqh1+Uw~-B)rlDQk*>c5IYdZ_pVJj&Q%wjP?Joq_dKtjlwxduHX!W08S zjL3{70~25*;+P2wW!?;MV)x0fefI5NT>HasumADZp|4*GB_z%alJdaS!dVcQ5EyfY z5F!U!Cgw*%`PAor@XqW1zIXA~cRumfbLHIqSRx={;1~cAX+GmbR2VtMfH6cwiit2$ zOeKE=3IPBJtC5NTA*Cc?1|$~xvJByHpr@bu@jG9-^LBWMX_kQth7a$RYFRL z1hs?B)ZKSYgb?kNco08ioygG*0~7v_J|TdVI)@2O(ft-l-p$JdnxS5@8dbI*3~ zdr2N45FrFfC`&*Vfq(>oG=wC;$WkgG3}Gok*%TrYAhn?lL5CTZDocSP*n;8&3pmPR zheCk}0Tsn0Ws7W;0%4i9&>1@&XW9>E`=4`PoXLj_A@9Asckem>^INgxCLYbpg?WJtAm5Ifx&I;fkn zXla-cs$5-votnTf@eo!zS&ZHKVjZ2Q+R`z_9`R)Ifnwa`;fY{)lS9nUkdjoi*l2#l z@B7|xhCFGkE*ns%-HDL$sp^@N9iI?_1(tF(KT(s0PKm%durB3Lvk`w2k$1Xd znG#S^T03oM{s#59hHdOvY7For4hWFm-+mnAT4i4ao`p!r|U zm7LjR=TK3YW9JJfF~3$mdJ|S|%XFSE$5^<*`jIH(_I7Q)Pr< zCMXQCgnvD5;EIvfl0+ONMmY0@{g_3QJ=!DIVbb_LhZo(dpMSNw|N3&2-XT5br!x+I zI{c##OKyHu`nS^=Q}dCJm`|DSbKmEjc|0BAfn6r7cY9Irnk9R&cF60H zJGXrH(fueb75N<|?bMYSio7i_e^%TzzQS{mVbA`y`?0xt>eb%&7Tl-R)~H zoj)=D&-)6ttwOEawauBh_fMd&M*q zY0Z)gMy%iai|dz4ub+RNS^H7ysArImm`^y5Qs!fhJ?>-wN#y4iyz$=h#v4noo!Ri9 z_QjL$ptLp#S;f;1SHE(*zT{SI@%f`HZ_rco7QB9^q2;h=5Nh3d*sPU}7t=-$i{*`( z-*92=!%HQf@Ao>zP!L17Ppr$-myg%1cwATZ=v=|R3Y3yU5(a-3{$^)csk3SN<_#Ii`331tOsJ^rYwAInd@Gh z`$fT<(zQ9Of5;DF<|=U!16~NamSi}owq}QSAcC#v7xBWZ#6}Y$%am2mlF)+6L*il2 z=;Uo1i<1j!iA;Z0kP&09&L#~1HYG~cl66bNK@A(FA*=9)?T{mIcy(q6A&GZH@6N>F zX#Sxl&UsJ5ynya5Aa;&L}kArk^Pgir*0kq&ML(}OTJ zhD;6Xl910lJe$g&YN}MQLNYR2!2sHQ3Z%_)0~TU7B^-a&w6a#zA`z9Q=LXTR11l{V z^;DgTZUWM8zCNjo{A-0InFv9XOs|W#sM1LKZu2uydn8qit&ELVn>SLnSh2~eK0!;n zqmyGqo*NRRkNn(ZF{%W}K`@DS?g-H+7^5YbVcbcg1zP3X5|y233V?KpG?n%%ou>(* zGBFk)Rq%ff3phnMme#jAVN@`WklFOK70PV)W5~ua7_K8IEoGf!;J~RbMW$<6i2^u@ zyS8hDQcZs5hE?l~_{529s;5Q>1%-6*dEts7BOFyOi-t1=geKZdJ$*~t^boZ9z}4G& zd zxt@Qw;|s5o{Kqp>-Z5FkISAaGJKF=&5&MyiNZ zY`JPwBA)1yq(K~<8FCl4@^5_i;B)?)5i z&I!kiBWP!lIo#mPZ&lqm2rKrDiz z3DIZ}<&gjP z%WfUuePSL(gfik2;xon~m_3o&by(k$by?FYGv}j z7w-Pxo$v3yaA*_i(y{pHfra%|sEx-Wfgeqv(G(P92Tx62eDh-N#`!1-5!%&HAN$I= z3nf>+$Xv7eg;QVr;eY?=T`>#w%b#9XS9bHWPAix8eXXqhl-Vd{Xzr$}UqAl)@O@RC zSFRnjX+!&QMJR%ZFUo(-1Ijsyv_t;D?u%EJJ!lwOwR8NRj&A<%omn+|QQpwe`w#x= z;hjNMJA16zl=u6ssYSV%bo6>mn)2zHt>51+*i(sG`pC~r%bNP*RaFbWtX+M#zG(Z3 zv@y@4)SRMSA5=cNG4%bn^EPehRkj4B^vax9QU2iejI+o3zrBAo|J_|bT09*!qd1_1 zF(k@S)iKmq_7(f?1o)U3b*k2=P!1bb8e3PLK&jIo0d5k>Hw#i$%Xh+T2n$sM>S-N1 zes!4+(VVME;E*rCIF-PaD$bB%A(Q@oCOfVyxJ8M_v~D2oeF$Ano>Nv%>@k9v^jL#z zs{zhk4zNVvF?N4dKF-@7#-GBj;4p)x=_;*9f#M8@{dM3_2>if%8!Wy}A}9_g5*D>I zC9}6OV~DHCH3JP}M3#dnA|u2+YQ{%p(yQ8M1QGw3s4UP?hb!q; zBNUX7FoS=Qgd!!K*dZMO>Pbq?4I8xb3@Mc{7Wzy4;iAc0MRbPKiQ@L{fm@7f7zV=C z4$4a~Fl>gz`;1#j84d~MP&TktCv56*yvK39~G{63_J^Q3R zecFG1f82Zs@4keOzv1t{?|*#`cW?0K*ZkHCc=`i=^BTVUvOWG4TwQQVqB-ImGzjLz zt9R($lm5{^`ipPd<7e>XBYgjTzWxB-{-l3Be%b!^s(t?F_RF{XafhxS(7oS}CttMR zKE|Kjh0B}c<`F;nwtx2T_Tq>3<*WAeckSLAe0c}&ecYdX(?9=bfA*(-|K7ZM0B?Q_ z?|p%P`L4bAs{Q66+!=5Tfw$0{@^TEhmM(WFSIWyCXDPSi_1s!7uNJSt_uc=}&?A41 zF)@o?g(P9tdE-J7jzu}os%&>L7!OT&W=O2LZade8UHN9~d%~F$q0I0hCxu!q4`3y> z#t=hs^(f^fEhD1H5~2o8cH7x@;d0t+VRg5T&tY6?;jjO)QgtazejDxM&9Vv3#F4U3 z$z_MrqYJ5})Dr<~*`9n!gOl4V*ROx2NGg*4GEMO$nq0aW$cI81xZaAHbeShHUZ>{k zuqbJaO`OFyi-VLR`3R_zzw;%^gT`W!lPBevhpAJ!Bsoh34~P;^2OfCqAUjii>cB{O zyFp3MxN6Z}Bz>*b2kFwqkUu{!!e3db7`zUdd`Bh+g&G5GiI(ASoe7fE$*+HTH*2d4 zZz*N}CU4L3Y>pAoTZf&n8y*LNC7e5fH^ZyM#1u+!xBr+e$Xx;_UK@^4nfQs!ZEpGF zrX>PBW7Q=jDwB}(GBw0T)HL8zg)-eV=01Wg&>$^&p*w?Qsg=>;;AsBM;NkWJu_Uty zu(^d?mljNs^?b;;I(THUC3Ju0TIA$FSOYprP)^G zU18xXAip2&xD1}NGvSoTZ{~qK5C`JGP5{Yd&w~kJkK0h)IwK6CF@UjC2bKt~$(KQg zsy=xPnyi3iOHAm5#K=S5J#qsf%>iT3G3n0WAztN4V*qxfhC^njvlD;702l}pVIU3* zfuocjJeZFI2Ll6+F4kq!UIB8)0W=5kq&Z=X#)<&|1ROZ-j4^mJ3(A1TARaKNQ%6Rg zFeU>J7z6`p3?4*`z~CVfvN3HoW~+<*(%2=>*y*g>N9T*WW4#y4v%PiLP=hN;wKCp) z7tKfJeu5o>NpeVC?gM}HIKebrp=$S4>3|`Ceeztc23Bz!b=9PhFMvunxj0jZy5-6^ znpa?irvcI*q90>j?9 z2zjGdIzki}-RiRlp>gVEQDfM;=3Ys2DYNO`gEi;yt0LM*^$35cG!mhZ>2Evl$P(0? z;0ZP>q)jMLWJYBcSRW|4$ZMcuKD*`mu-b+(3q>U*4s86;33-N%Ru#A@o+cxM>u60^ zz2I8ToPOoxTo+p`h1ZlK{*LILs@^Edn=`r({3Veb0~hgn@}cZBnAjE7f(EER(l!Fk`U5C=kX@yERZc8 zWs88*stTXUe|0A{MzzGp%H2XysFWdrd}cW}1~I`hhc>$aK=x7E>S%#J&@!EkFu!$L z2I~{Cyh`+PLEI8swQ(D~v3xWaniL1+ZR?(*ipzD$uA+aH0gU_#cL42bl?D^$^*k;Y z9!F&6MHqby(7H7@d0^YS=xf3sp~H09GU^i&kaDpEd!!stm@?3Pym}`==s;C}PTj%k zPJvQE0FS}W4FlHEag!P`DcF4$-aNk*g)k`aOiU(yLn6dvd^L`DN@(} zx)9VCUe`Q>nB%2~0PQ8S9-sIG{i)LJZ=XgWW@ySzR><2M$EXl5{y9RyJ$a=`F zyqGNg(kMG|A{O}CxyIW^d=r#5IAnbEl7}U#PYQ;idn{NYYivRWsKt>9{Eo!CwL-{ z0U?!R?$jskvZED;45~wx{=qx5G>wt};p%rYcTkR(gB0P>yDkm16<#OOdAy94b*z6X zEwhzoo^eDLo1|a3hmbhjed#{kdZP=%RQI5-Gc3z6_@o)r?j-xigIPIlgd6g{+NX1FP}7tIhMtI90C|Hj8n#C4RuveFqSnS|Ak@$te8BrFgxuMXP&>+Z?RZ{tdFo0u5b2gq5QMh^0bDC4GuW2#xV~% z4!Q2CuHsml%CtP2k@m%QIgMP!u*7k#ppMcv7jjEA3!JHJmdli8VljU-&fkZ=!YbL! zpAhe0Xe3#gtp<&0fx(28xZp?`BtEkt(6&FmZI@vX4rv>KSctlDMwBF=?R8F`XqAl* zd6nQJJ95>1iqX=8UUpJc5nDB5nN#0@(PyARfjagDD+e7{Ca<0QE?kYKWVujGkP=*T zEuw6IwK-t(2;}F)i1UAxHxbCuUT2=YFL&MV;}6WD2ooQmJr`herqVF!oTjyS_+4@V zc$#v4uD4y^3VR(>=1gT)v@;3zCU0*`c5ZAv6B$*MMp#(aw?#~secY}@-lN`6OBr1A z3W`iG$D!?q@`@J%2#Ps$T=r%8w?{{Ady3*Hj!MYygiNi>6?}h6E)>)(*q+hy0XUKx zOVz{ZTkoZd<0vW0V6`kpwfe~$TS9QwRKh2EQLFE!?Q!q`4K!Ah zZ_-cY@NQJzYZogl6f)VNmz1CKUM`-*GCRo==v{$(THmyG>Em)RPd-K`^!0UdOwfwI ztUoBLD+qU|WwkJA*ckYFXeWF6?pD{I8``C80UXM?AVGh#^V3(SOxbjox6UpLHFAb9 zON;|Tx!0s!r+JDyQ!gtn%7D^P=0n!2rJPGrth0IC9p9AWP z+c+-!P&W%^%bi>fn!;YoHIT7<`e{qIn-6`inLC_H-A%LDZs`a9P{T$*(SJ$M(>aKV z?CFTMVdZ;qrNzdO>WiON4^(VCF{zs!W?HRPCq{oTtD$2Ss^ppqz%DTGiUG82V}iAX4PI{pC~ zQP3&;3sic=+H38#_kK^f#m&vl&AI2C-@Dgd>sikSb-8{CVUA?exr0oj3$80ES>_6! zcYJ@7Vm~$=Vd&n?Jz6Fh7q-MmKMf3n3Jn%JqOGTXJjH}pdsd$epFIh4Hejs19aZsE z#LHJjQWYTs<4`KekndH?-EJBiyReLxVpk`{?-{96FN^YQoUr{$a_wlKM~B4B6u@u? zL@8a=s;hD(jFU>SDB#6byFTz63Q`XK+*^O_rD-Ft1#1KFGra!y;0 z{4MFSPliB^u6M3SyST=?Y1;z}_Ti})aR-?>i~_gMy!RZV#S1ILoK{c4vHT=}fYN;| zb_z(pS^M}-qiMohOI-y}TOSNJD#lnTClr2@>f1Q7i8F_@M z+@2gh;?E8WCR=v=P@*B|p<}{pht4# zawz<#)_2flQIZXrTcq^YsjA})l~-AUU@OHxIeNLSnlJ;RN~xSQ`Af@EvLmLP9nUMS zHM}08aJ34*wGkb`#Bwp4oi@=HhD+ zY*dT~RJ)_Vj4Hd8vd2vHSW&?-XA_6OFOUoxyyJLqgOD*H$r%`%93AN&t@YVO)nBDM zH#B3(U0#X*l^&Kfv>r2|b?}j+X`m(3Cq_&)Z)oDm8GwpZOnz)M2CYx1SYvUw+wWFU zUBG3^p0XA+Kp5dol*xaEp;1(ng5-0T+bm?U-IE|6-NnUq=aKDj+H$q~Ls83I4-mLv z$W}*|Tg#W)OD%Gt+Dx40ik-S3EOXVebzWX7F_QVZ?VuW#yrg9bJMn_^n9GTZXU{X+ zGp)J_EK{d~MQy1Lp_UOpIPwm?ok+WmP;}}d2~NIF5Ixf4L_&Y!#E205@p$oo8Dd5n z==#*#4MBcHVCrbo>z;REk!O)ymI$5tCQ@Vpy69;;N50CP%J=Et(y-na;Yc|^L`~eK zCGvo}wNSW>{2>{+HHTLQxu#&eemFLS9GCQw|q}^l#1Z zjnnO9TE2=7-a>y6D+d@uXS;&jN9Tvt@K9bkVNNECb1?}mr{o}-_hjOx$k{yG|#dPuVBow9s<6QUF|sT$ZV)-KG-8}_yhl-h%3N`It zwbVE(Oqa8fMPAZyT<=Z7K6I7SevWKF0^w5ezBKtXW7J&AD|l97QW3W@O}!QOxV9AB-Cs zlbut!AXsI=L8o@Hi}zYxA@vU1&qdO<=w!XJI85KNh~4{%dP(<_g%hM$U6N$mJTA3n z*BK@$XZNn%GvZH}D`z0^+LM(iS60~*Tu+%RevyCl;Lpxs~| z=LJCpOC}a!j1WE|yG2b}x`oERgNP~f>8ZkAsXULyI(D+$_cctaxcU~ybX^tQqhgHU znC?O}E*Ot1Z$=?4f%p`)=v7MG;*3z>B|pyH=A@o(AnagF=|2)PPEe)d;-LzZu+Hy2 zMznufBk(Bj4mpL`b6Ruq&9WHckYX(vBX!jRgjmv%sE|B5w_0rpb}i`03VbeNz+0i7 z!fV6yzlWdAQg-P8mQ7G~=5%%a&RyL}U8S)IHjIxVnXm(J`Zku&zGod*ed`DvlnY-j zCRb_4rOBbqEkIgw%f%RlP=$m@2!l`18}NV3oeCS!E-olil$t!5{Hzp}^rX*@hz^d( z@FYl1M!Ct{JsQh?al?^WMM!{zM4QhTV@ZMv5=R;Bx zV=*N&u^zaS{B|nw=yAJ~To1y#VDE-U@8yS2iXF~$m!pvyYQiw_Rdl3eY<7`>1jBz$ z&5MSLHCB?=)E-_RJVnO^mC1w;lV)zC>7JhK5hSLl%sS*wqxn!F-y92ZV>U!@_oZoT zzV|V+9!x!0evuhg)YnsTSP)h;7Ri-PIFvZ$1?$bxT5GLoQ?(1p6ZfBa|D$K0M^_{!W-)}v5N2I11J886oBTfP(%CJKYx}t1q(!g9h35J5aPq_&Vx|oJoayKeXzh(b7 zw=9$<3$m0_=F}JS&+zc&IgLE+dWo3(W`{JqTxF8`hQ9;5k^E$PT3h^7P0u~Yh<(n; zEeBI0#G?cw_wUMUD;E}v55s?>?U>1V4*6gZc$crV(itgCp~k6M?*238c&#m3a^qb~ zpZW|8Cn5=x-?|66xl`U^ztVtYGv)GsfI})6CQ=LCqMph;gb?z~K2+RT?kx7=J21R^ zG1Sru&%ON0Yrp#4r+@S7PyF(&C%^C+ct=wqIXswLj77!ldI#;1z3YDiuYK#=k3RH1 z06-Ek(L>CX5DCB;-pIo7NcEMJvNUF6MiM}E4>#kUMXw@&D8%lGse}j!K!~KqCf10I z5C8!LMa`OtG!f?hmqh5(Hi7S|Ohru1?gBjh(XW5=rPsd<00_X^*htJL1u){KO_li~ ztjd4{U?gmh^}$D8_~Cz>pZ(JxzW<-UJ@?g5!5uKwOS`J600V#k8M)1d6GlnQ4X2sx zDbSC7>CNB%;NO4$`0s!G!JmJvy>!o%s0oAH29q`=Q$TR69|0IWbWoK;Qq)WiMSTeP z^ylAt`*T0}E&w3h1$g24*T3_|zy5Lmm7o6N)wh2HBmiWhdTC-8!3%%_pfVlTi`fN1m<|E~AZ2T< zu^s>hZ~+iul}l@vMrr^J;10oE1U*FCaTPiU41pMk%=n_JN@iq+#%SnCY(Q6l$M)nW zzwy_`WQ+~*0Bi&#P1qg)Jp1As-}}lx|9t<|4?_ddD}oZyVaCS={>#^y zMOAg(Vf?@MKKq=@a6x7&D$b}(ViZk+!32X+5Cs(^AVCxnyo{nOvDS#F4KbpvLu_K& zI@KYqt*nNM8blOiP-GI6*(;!+*sd&B*J@w-aE80@ITwFlc!PDg_nfo${(s;1`-p%r zN33*25D-w{^gwh3W5Oe>qZnHuum|2AARnuj`ylKwSAIq+*vhHfR2qITQQTi1ndn`7#nIVP{ zWl*64x3GV`A!a90iS@3u0?CpArxpgx>W2shf-H7NXg6D`DjW;AMH%&Bu~(d}u@qCv zEK?Oz6IG0z|C`6Sm|u}`YRU#eSsfYG(q#8m(6m&-KuffCiNCH=R~4k9iSWx|Qw)-0 z$xm7*glQATjll;K_n+)km<13JQ>m89qr);3Bo}`!M_Dg{Nv3DYZp`Kl%I6~kZ?I~- z%C-S$TwkgVa0bA^d}{1%BW1fR@K`PWO;y>5jK?IP2>o(H7Kf!;SuDw1rb}g?Yw<{r zSc*5cfa78wXK9G8Qd_k1RMpGP6o!?8J{EW?7Iky;T@*r^vRhSH2O$KJ#f5Q|r4SSX zG1-4B?p1Dn@+0RvL+|@(?1di_nyO;!%DoD*V7$-!`@Y@P+kfcglg*E=Cv}wtf4?1U zZJehsi#~fTt+hU`r84kXA(>!@bU+D5slf3()e$TRz_|kr^iC>DYi&sHx%3j#+m&tYBCvE@s`pwGQ+jLXXxH{v%@NnXm+2ON$kJ zZF}E#&Oe+5)X~8!a$`lEVW=~;w=S;vhF$0a;DMt&<~YQ2nCAtZK#3c1n3s5|EN}R! z;aN>o$KOft+==li$vwR%M*5BpHEkZKSl?4>zhoiU`h*?7l>g>gvavDqZF_&n`QL)$ zv^lXk1;+l=r}sAu)D`@E?NeEFSiqg{sH z```S}xU0LI51!|?G+}E;S5jBQ`kvYi-FNJlFA!TTHn@`1~$K%jc! z;bW++`0S^1;Oqu2zFTXn!Y&^Jx2Yc&mE;dRj;=3F>aAN-UkX0H!lb~|+m%_y+UUDy z!yo<0Zgl`6!0W7~UN?~)&Z#8^Da|P2#^t3>wFWDIY9!BxRr3Z_6Oe!QmGKUSqiV;% zD*bG^hARBUc425U#@ch0cFw_$pjDP(t%@)D!mwErsXOF9+o?z%~7fp7Nu(2 zOvR9SxZ3sDqHSCyA1kCVGXfCPt8OM=%8d|g*D+BVLsTOc*&u(R-H5QB80~~il_AxF zm)M(MjQ=2l5mGbl#X*j!6eGzhE8El<1zA<-Be__X7Z*jB9RqhK&_{Zw9o+w_!{hT< zIzPtu$km8j_fzU?z8Gw9OQq+*F_cykqz11E)wo5D+C4Q-mnTTUlZKB+!Q=ug!m(8r$AGz8f4VvY(A?maRTt z9#>Zme)GU1dd|+{seSEEB_+87odJ6@!Oc!A@s$6*Iw7{7)_)Pw=xFWH$1Lh{A~%HIUA@qo)BYr z*c4lK5}bHq;|aR?iGRFmXuS=-zCeQ}MeNuy*zIme_uFxxaJYNi%203)aE;nv6B-WV z<_7KmKEL}}Mtj4a-lpP_M!S`(CT`yTs~3Gi=l;C#{G|i`>YcIEfC82mG(A4l*R-YO zPF{a!4ijsErvm0F)p5wm6*;{BdDWe`vNPZ`OE)1Zqp@w(wbL+VUhLJI z*{#>XYbHPK1IMTs;_F51JOBrJB{l0%WlhR(FVQfrjD02u~0#uOFR6J!XWYzB` zN@Xn)n@;fJaF?O)U~JMWwUJAe@T{^KDv(^0KhE4+s#xe*?ZaX{sS2i~<>i}AVi}*A zHZiDLZ?v60>^n<*FAocR^J-q>U_@?fIm+f?BZ9mP>!D z`Y4otTxvTwt}+(k)oOA8^DeWMykxzwvbIUo-)Y~UQti-7p z<*CG)Q?wO~wBB<<2v2!&x~cM?vS$pf^@Po!SRmgMu{c6fTeRSErG*WYZ4P4`vE;oq zE7@VO0v5scCYhEQ;Q&E^&6Qb3&>3rXqB^}uJD8}V{qc8ia-l0cl778&pnHGm|M@!8 z*r={E44>`$&bhOAW<0hTFW8J%Ft)J)$7Zz+UI7PFFxc2(GYOkPm=LytQ4+$UrUXhr zQBny4l@cOCD3H_y1yKY^n_qng`;XSJ|SFcZLYA2~< z=A3+g;m3!_AOb!gYJ~*Hj(*|5wtwFn^2)xPSKfH(;q9fL93s)dX_bGAhOT=pdF`*N zj~(Coq(+myX(8IL4$6daKw6M%roG(VBWJkqr2+_|35 z&t|P$oH1vS$g3~@<*xO2zb$`tPtKa1t1n-kbM_c{vSa$0GmE~ul)kaQ`oQ7-`_~5d z%_7M~(bg>!UOTq^?yY}GzuTSO-AaPdoHb&IahWe+Kth7_YDt)_EeVDmq|8vDk!aoe`?{K|ja-c36nTu+(y1cAIM zzkYqq)pMk=sqwA1H$A*L?fB8E1Ftt7eRELrI3lUg5S6}_Q$hmaDZ#=iO~3uaghQtq zJ~*@eKi>`8GMD&*Bx&4?6KDGG-D)|yzxg-YRe4QD*NRm?eA9mEZ0(W5>+W3r#Yaa- zLCL6f{ktArO>KWEWg19NGKIWI^^E@8*L$!0rSbH8>%Y6Q=h3yKj*ik754`-t{l#Bi zT=>PMsee2f=~)iZnz3&l-g@s&=fyMAPyK$%`|o(`Dw(26LsSYR3QZF-m58$HoqJ#W z@kZCD1B<`@)4u=RX+5!@MDyo=cxu&OPmo;6eG)uLMEHLLxm6uU-h1}T&-OmN(f7rN zW!smNlvDzxdCOne{on65-?<N750_`We7V+#Gj$Gm(=*nVRE-tdvVu&BZqAM4D^;J zmLN-Fn~xa-!3@-5tR_RahxnLHlZhBBfOF;!?{JGC#7(>xvqiTY5}o6q_?c(ukp1Fj zbR&OSPmQX{SZgJ>QdDt;Y(}EnG?EhiWibXd%Ba&Jr(3P{HB+n*S|r@~*yj)XI@lbQ z+)HG}7>U$36m02_Zrb3VH|oEc8Ov6PmMNmChGu_;n1>&>q$m3l_(S_rTaiZN<=Ayl-v{cWtIghs!1fsmEhhW_Z860 z$)swgXzS*aYiU{-l2R}=Un{Gok+6SILZUR;B6_Hu0dU<~=M8aRAsbvzs@q9@BNgHOZ}pl!?<1zPsc8-^U$4QStVPXKr3zd;5Z_ zD`KG{lHW{5O(i48knADE=hLrr3_wUJHGvxE-mnapvceitTtlK2B)62L4WYpdno~qG zvzgDQ^C_h-8M8*PvSu=>jg)^ilHsFiPOk7LNpDD`6hc8IOV4FqKhuDFQ+TMHL?@Dx zI#N_YBU!=|#z2%u$B>dbQcy`!bErxZh@iW$ZOE}0(+;duh@Hw|CIaHhjtqlvoSzPK z{vtDdf>u*sqLgyN-K{+roj|HJ;u!ij#+1GRoKulqyN)Z4GtV7E6Lx=FXA(*dZeoUe zkK>Ru+}T1#spB#i=htIAp;Lq#j7Dmf59#K8y@|{G$BYlKLEGkfYpNr~v~#-cLEMP_Gh5q-rS8OQ`(|p-4$9$1x1>IiFwO;9$ro$w zqRSHTAYA*yckl}0AHILpbccX~$5fWsml&~6q8=&U*u^k^Dc;$BIke~THcH;XsN#pC7%%jm-x zWi$?6W==vbtBRZa>aGZKB<~!6v&Y3}5{B|@r-~u0nj=d*)>wc4Z6s81A16$@`$z1D zn7gIZaf}e*75-pYdOciIsQH8h&`^0j%IgtIL(MCc;)qO`Q4WPtaR87K6oN!1C6kir zhAghL>hzZuxIhk4=qVwITmm3MEVhc2a{@pBC7P7$-`$4+pf(cXdj~pm}Hfp^6aMM*=Yis@A zALpFwKKD8IQ``H;`^Wn}Kknzb&pFq1eZQZtpm1n!xJG1*$uWokr539qNn)mtwG0r` z2N}gtY_u>t32b{vAsQSYX30YfnybzbV9&vCi;V18oP>D<2?>WQBjHJnAbKJ%F(pwP z2I@($Iy(^&aUO|(kS&lw2}v9x&IfW|2)jm4)?r|oP~)WWUL1>9&sJC*i%X^|5ek+l zBoZQT$qSB6ZYIy+SvQ*HpQrWP?1s%|$x<_QIu6I2cg{Dy@#GwPK~E5}QCL945+NfC zig)B)yjD!JD0Kr{|8idaSx5Fzpe9@rrXhwhz>IcbD{C72l)#gSunz@EiBc1(=K zNRHS`FjlY=V1fXNNGz;Q%1WCd-10r4q66hiuoeUwm)Z+ruk{Uu>8{tfTTCU|nM$T=4M0+BxA-2VmS_rtKW=$}%Qmnc})T5LCqth16D z7&%c|rJ72AORA$!>cH@_b(GocsdqoH02rkSxihi-Jz__4oD&t+l~Tl$v{2D$qJLA6 z7ZR5!A=gj=qlu3kYx+7Aebh&p88-FI7c){)yCsV*5g9S)Nt>~Tm?n`>AVDPGAFG%m zKWF#b*Rxze&4MlOvh2=C!O%~`e+>Lhd_u=2wL%imo>`IzqFgtAI0!-&&!# zIg22Fl5@^^&w?EHdrOW;TwMK`(#c)O5jKn{LJg=hR$a0jvu{wC2a|}02;Q;dnH2QwygcoyvzjOyo6o(EHf|`j~lh%Pyyi?LflbR2+tiDcgS2yd2ilCEx&Vp4`VbQ4Xwe$4i3W^<~_E6M+ z5|aXTpCdy?W&34nHLK>;-osG7U|H3~VQa9g155L)=2nqsZK2++8MwvyDcPr?S1gI) zyxyhwGfNs;S*?ldgs;$^De$j}_Z{o|mbjSBYZQxaAqFgWq$FWn#cV^77FWcy^JSAe z)xf6I!&uEDWw@Y3gi0GWsgpuG1Vv$g4I!MNn_`wCJ}MkeSNG7l@(`);aaE~x#QJSX zkUE?2cShOG01(Kx6oCbn&_X9fNk=)zRL8&Pk!o6DbGlZUf<(ts?MK=|R)XB5iVz7j zaBDTAEfwLyHM691JkraR@#R!At8|}e$^{$3qD`hDtLfGKPNEUc|GLs>A+`vA9ZYED z!Yi2cy&U;MHPXu+=)4ka0jdSqzAlYM^;3JrD6x+MVtvz4!{XS90|`6{Btb&Uh+&nt zWGzD2o&YSzI81iJ77Q4pk?!G^(13M|78npM3xyT~s%4x35QA@-goy#jG9#fuW33Q4 zGS&cr6($#2e-`~^#?1ck+Pfcr{o6b9cC9mFkdYin<1JlHlb76a>Xo%eA2-tsI0Ozh zNXx?LocGQR27oh-nZM!C^Y@%TX6LXa1MHXyJ%bw>oO$^TU)b~hpJr@X9;L{FGVp|G z!3wi@as<{`i2R|5ABvnMCwe4L>smyIK_8MKtdwQl#$_s1jOr_;q77RhC_1D;XhU>s0ZLt<6dJcqhz!KuHD;fMt?qNR z=hXQ)y#|L-0fb2hSQ?Uldt*3@Xu~=`tPs%EUEEPGtjF=o5e0-PuFtdy%{@zDp#{m` za&7MItZ3He(In9345T@F%0`X>Oesk_A}ESjX^c#&V%aUYa6sBn0yRzt-a=o!X{IkQ*+&P>NB-eXf@O3fJc=PH*& z3w1=taF6hID8`PqE){HH=fSQ3&9Gs|Mm%|hW{5C*ID7Smrw`xt z+OIbL=E%IS-)*K}j#Cz|I52+Q_a3|T_|fgZed(i*>@b&2H9YSVJHPYg*I)VKn=daq zxEJP3F=PV7#IbkG;HMZf>#EiFe)h;OR~>qG=lRoHUq3c~`G$qY%$UFZpfuO>6ATYqlSMVd1_V#*G=Az4`k;So7=? zX6(up)h|}zjWcr|NMFVPrhL$jZOa0+S^|I z#omdx?zwb-cER|5bH$YgKQjN$$9BDSao@z-43?hs>1%VAX1`_l5)oAp`&xp{%icA40EE z*{5}#Tdi_qexMx6TJITE@71l z4V5A>4XV2vBj{GEwN4sKL4ZupZc;v1q3W$iz`0g^R3KNUz=&k?IO@&M7Ilxa*F4{U zA=amN)C;IBrayUFq0M~K^+~0m$rS}pK~jjCSs0-AjvRY8=DcG+3*0il_$v#?f42I? zS2v$M`OUw-dBxUE?)uN|yztJ7LkG=*kImSzYw?es@~gIPIdSsgcmKHR#PM5CzWm*P zU%c_~J~Q1gg}xcFAK>5`Gq`Exqd(q%f9agN`6jbq-O9r+Y(Mv^S+e4mBS&|iKV_CJ z;p^8g{oyl{?%cWR*v}uh_y&Dyxw-l?bH8=)!S^l<@3?L5!w0_h&r8Ei8yD^V_MVA1 zWZ7JrHXo<0^K0(E@4dILeduO0oNgwq{L)LOH~*KgbBoccI>Yc@-)XJ=|1*q#Gk^m+ zq6{;j9Z*scYzrDH&<=uV4WO+eXQ=~nus|sa)e`J&tAv_1y{NX0u_kRydtpsX+NMbj zMoUvdL>q{u);3LgNSZY1MK9KIueHY}1cosGf!X_C>s#OVzVGw;PpYvcYV4s0esN~` zOV4-Leg5dhKODXA+xvg@`o0T)XTR~EKMfy0viRHI+kgHy)vcebhVHrNN3ZU9>qRvx zz|IgP9gUqU6?|gG_@OWV`SP3t6V=e-YquUbaq0ZfBb)lauyx|{??;Xuyl(G-ue|?u zy?nUpR2sDsRzm3823CNTjyc`5Tu32QsQxIQFw*73D!;lBZ6GG_3U}Rp{ zzqsQOU`1esQ(>$I%>>eaxY+q{BEOtrIr>!y*}j+`@(?H)g=Ev^MocQjB&ZfFU(r%7 zmwT1Cd=n=E`lDe}1X^TUm7K-c$w)YP$YgnDvB%aX1SuEd%&Ae56hqIZj0O%(4xfz? zhhKS>Q&_CC0IpU`MSQHXTcm5xVC?N>v`b9xG)SM<`l}1um%B87fj;9Plv)&~p~IAJ zvZ4O-G7u>4nFhHA60NS!oKGq(B4SpQBx@z>RSX$V$Tg{{6#&AL0KOc7LIGMS6#xi< zHqZ)bO0P?LV_UHl60$$%xISf@Wx64fa4<#o#v=3`BRA_OKT&cd5X7?RNm+HR(p1|7 znoL{MkiNBj;zC7#9iF#@&!o{iSrI&064Im*i|7c_fKUcOrSqc<(x;TFK)J$~pn^)N zDg$v$CZ}y(!7AuuZ44UJx@$U9kQdf-?>_X-g}Z+Ks@{2c>C3M?`S*7QH?OCqYqwqa z-NL80R8uPInT7ghxq9{LpT4&Jy|V*fJyvgfba3~cdeIGkN-7Zzj1`fRE_6mJbI0vZ zJoE6mH+whln6c%FLzgan`iIX{BV+4c{K2+gzffHR(9;K<8>@Qx!Y5B1{^!M!r=I9v z^T_?L{c`KspH*YS)zHeZQ!gI8bndagymjT4rBw%r7xa&A8$EF9@eeL8d+zv@+g4Q5 zZ(sZT%lqDcd;6+=`&WJcmGAubUw6IqEU(?L>)gBB&z+fh;^g4oP{E?XJNF*>@cmm(KRdMJ(55%uxc|(L z)!1CsbIY84-#q@;%g6ut=D>Z6s!jz0AmRkSjKQaWmpkqpfs<0EOc>IqDuxpJk)ph&K`-ME}6zkDZ%B8cz7GpJpa7H2@s0dSB;HW9dKo}>GLvu7`Wieynx!C!}Ne@!U3 z0eeP&zO`xjM``Dlm{~BWN>hxjgDN(xH(0WZz5OpNZ+T>b_bHSysqGLMpF#niH3LoK zMz%(TSPt;x#a7sIDX(e6d8ig0fJkHY1k7gh>64WIq(B9VxFX1U;3cHGg=f?@~NRpi0gG4phLeLL5GMA~X+k;lx zam|7kDKyx^$jQUWq0lV1<_@RPb9P)?y1rBNU50{kR{>MSC}jq64=9bKEft;kSn5@? z?Yt}>eMw{&pSUEJLiM1_rXr}Vqy);i6Squaf23EeXx(?z|1 zumbge30djuW?GOI1${yInoPW()f`qyQ^w9_uU^szCsWQ=*rkr{P|YC1rbB(hG`QTX z*fIU^ks15<@%p>XJ>%+{k^a#oGdGU&@Bj*9Evh>e`WC2pGJVpioH8=$ryCWbo+72{N9_^PTTwd-8jm1mwB+hY3+8cTY9%X z3MDost94mY{^8B2$uqf*(yR=3kjicm5g%2sF*m47{J@@>@?k}Ak)U9 zAF_lazE!G*7LFB^IQWRuER#cjI0}2dPc-#e_#%195kkZivj^@t+)Pqnk&ngmeiZMP3Ac zmq9h9Z^&vj0!D<2ZH9c-co|8TohjQ#V;LwQWPBx^yi7(@rek?zFNG#hxka@C7FtMh zeqMtJtwm&`peY(rY4xdpVxp-Brg*(hat}kfJ-5~?+0UxodY#&WJUs{6k^`e?2JA2q zO3O^6#zn`KOTs^Vg_LMV!eT45P#VHy=$!Bd+}JA+xjkVw zJW_cn31YiPz0o>K20E#uFq`jWC41QfO@IH0`!H*wWPOzM8%hd)M=3zbqT5RCzncwV zFVuAxwPw+z#qM*gweEDdu2D2;sD9&ngvv?#Ta8m8_oXIZq2URXwgK*0_3!%g8~z2Z+2xOMif@8(R8RbWQ2rC z6KDWUTpQGaTG)tx7}kbSBi2GjYY}6NHb!?f8dQS7jMfn?ZqpUxNQz=ucf@o$Y*=bT zovG93-FofeFZDgRp}Klz)zK(Sre>|JU?L=w3O6=05UvQ**+g7oK)J&WCyO0gHHK?i zkoEEVUCL!cd9_{TrzhZkCb4vgr3S@zi<^810YQbJ?7TUD$XbO-OVrGIQ#2c~qUo@O zix$>wWhFsR6F=l>Cq}7|CE&U6$=NZS?flnH*AmIqluB-^@Kk};=5NSAcvpTrWN&nf zM|K+qdb}kyM-oHxp3IzwYvS-`ePjk-RY6-e;J6Z z`<6m}ox9?k3c6jVkN_#Awlq^*J!0K@{ai-92iuk+$C7s#mbTI@oUWB+=4|WgU&edK zgIysJi|0|_W)CereH&iPWLkJUaK29i<+HGkQ?C16;1(Dcd4UUgxR1F5-L(;m2;Yu z?NA%B!ZN!oTE&IdBDRSwLUG=~hyuilfQ4*!32Cxnh$O_?4r|%%g+j`T#u3Q;kFRU} zvEr=5&+k6xvR#(Tax3?RautwJ3lz$hLMT{&G_}%7T2d8^P}&LvQ%J;6sr7D*CKVH_ zQ5$NDm)3@2A{J_>Sdr9XaWSnn+E{~r(Z9eC^Uj>JbI$Vl%p^PclQ^ZcHRx-bF4 z%DD(GWizTprlw-7rjcc80)UuvORBo(=b(jOS6s-1-7G>q)XXx~EF*4!YXFl8N6O)U zNa74rF_v(x)uad)$(c#7WmXGu=gcMZoR&@B5No-7EsT|OeF*?z3C}ECa*!8}V$)4b zMq#39sZdSD(nD@;Ofh#+D~&MfYN6sn3{oOj_Fx%itYsBa6=fl4vgeQzshMbqx_Y!C zTgp1(gxC^lDHS$ppLSzsjUe>!n3*p$yA*t-m2ZHbO3djaoYKt zbO*bsJ`>p0R%xGfo9>rmk+j*5T&r}APhBRMb^SQ)`sJ>1HKpjWe4t8%N})55;V`Jw zT6M;xRyMzOlTL*UNL|EkW!H3j&p-hUN!?Vf?A0su@-0$u7#7S8U(}j^qvgW1CA<(OX{E|`!xD=`ZziGt18`hZ#ES8ToGi6?JA z@%=fE+>gn14>b=c%t)A&SlqZV2AFcoq0b$9^GtJa8XRVBY7%0`3Z%7E?*%3gY~FG7 z>ZN(RH^RV~m}{78FeAYLkBEAvZUhj>qe(HLXa1(ar=QEfMo(XT&!InFn7{KwKz-4+2M%8PL;w0^$iVIj zB0!iW%tBb95Xx(rnKc)kfZW~cq80>by$+q)JLA^Ff4TIr*MBkh2L~qa{{Z@f-Sci_ z0III8?q)S7CIEyy*P#a(yXENPo4@x}C;*6&x&aVn%UqRz37}fAIf0CfK>%Rp;TDS2 zNCjrnNUsZP{=Up4Ar{5%Ui3k;v8u2bQWmGOu!J#Nag?gF)*Ki=Y2$rI|NHLBA0He2 z=!1Uutr%UWP&PLUa~D_gI?!CQYwxy;CwbBsfPpbFZ_UGh8(Q}GBhUbx#KSdnV{?G> z8tRm7YQm|1N4zCcW)?s|8AyqZy$SRT+_inr(D~Y`r9d!+T98G)iowCeF2U|Z5D1_^ zjaWHc)d>Q2a7OTmuuR#Epx_#G6u5^pvdq;TaBvN9RrjRS@zQrDt`=qzKodH7;jRM* zul{+$_Vw@#RtMFHuY)v*#i9XfHfAqf_p29{JpDC)Odn5;9_1dQx>=J$Boq+!kSss~ zYQRQ=YRs--Yzi=kWy*G0RU zEINOYyEYVdDhBcs1p!jPARQitG(60$eGj8D?WALD*BPF}!hMB1y~IwDnC6UMfY zQ~T6^pe5i<^yILSO-ocEiAXMFVM1*{$I}dj%BZx0ZfrC2i1UpM2x;;wQdw$1hK8efgP*w=aV=;Y*i&{P0K4oZ5Ew zRs_o0VDQ|H~ed&@H?HavU$p?9u)__gP2tL6Z`6PA8(``MTF z{QXZm-#)+SvE3M7^X6>$iurqveCFSOLw%cWKtN4Q%TP5o55&@#y7i$~&)xRaxA30j zn6d!96UC;XansF*zq#k_H+KBv!l(aparsyFVceu0Kl{mh_wR%@#x1$|$nQ^2+p>}- zEV%RZ?+*R*@`FRC{!iDLhBb9yVfftKHG!}r*nl9rMhPe&6+{e?$Sy+IL==L5?8vSn zf?5=pvDUE_$EA5Y^PMyR()5v?}Vwvs8tM>An%sW^*t6 znEFy89Bbd%T(0Nk37V@S?)@Bp^P(nZqW$oD`Hp{I13QQ9|9n*RVYc+GJa4jHINxJ` zEfeT~U^I-tFoM7+8cMN%=H_+oPUiR^PxRRQ%JsO z{xB_1?5+_G)pO3~0Hw)2dOT-hc%Qr}>-~WH?NeZ)516%M(l-aEd$x5bWswhHA9{?BiLot?IYb6QhVY_B*@+LZO7FQVZtm|5u9dnJoo zgo>t^@hYC^TijY3!-2v{f}&88qG1R|(P*HnYscIBLY(k18xbU+F zhYDT}1P|3@&ke+PS0n4K83r8wzbaxzI|4f&r@kI^E@;QU8vILA{l$kH^#2vfV2x56cEFzmx3ie;g>SW|iy%1EbAH&*aQa`pIfSCYw`c z`}KBt)6F@_&EmX&X-QC@D0-$dd$O5wcQAJ4hKg&pv_Id`S(oxbVw@lV`bv+J-=$3T zd3Qd^o@y)opUkE>jkeBFP*oi*Yjzh`#Y}d4J-h+ND;CrkMv*j^;8O{I}%1}Q5#!-qtJ-WbrreOeZi0a4y#N7 zW!gpv3jUB<xjL?%yPF$5xbOp;a3nRYibWaoT5GiZldhpv2{rpY>10b!yDiLRs-*xAvb_^ri7aUt(*Q zqfDxQO(nyx+6kv-&G}OQ;*wkwl|9FTyXmu%Xt~#NkqUw3-mK522dNe#E3G6-&RjY7 zE6sAMv9oFmgXP@Kk_{7$wpa#vP6NHdmGh*3}k$lyh(9fgX?~K@bE*V7R6cN^a8JoRFxHu1*UEiV5V_wR;K= z&dlm$9N|Bx$Qi6hJX~nJAh#Q(2H||fkPZ4iR+%LQFFUmPRzPQgj!$Sst+1m7B2qb5 z?wp(-(ib=)2IjCLL?`6XkqadhSMwybJdUfK9ssMIyiIYhYxd$Ias2 zYlv*^%pB@DJ2$u@%mK7@0Cie>;8@YGeL6l?KmtnQ7=|M_hLI$lWRM!VKsr%od()d5 z4@*T`o?hD`Dm4~{g0bs9QQPk4_rcm8<%Gw#w)1|vOnCa`NV_(k%mreF@vfAkzsbyh z;&@D>dKx37ZP*IEIYxzkd!ZGWhGiX|9ybUL1jNiK_gvmYH|FN)n0EZs z8-@Pv5MXh11xZvyvSEPmw0x*=v^`1El0DjTVy4F=HBpZna(Zgi@Q6ooM@fbQ;gr7U@*1!b?rDI*lO z*5U+ZjgN1-cph}^O`;AIz8x^kPI9>R=^a|x}mXP?y@Qot@d~%+Bt9NC+Vb`!OFfnUkE!`<(y(d4A7f7#zc9 zRqA_Bm)+}M|M+%)(%B=>!y6DDVgikwDrR+JY1%OE^61%iS@R>f6}Z-JR>HPy$TnqQ zt3@miQR8P>{=-@cBfF(b)`NOv;wDp&0yFk-+xObCXDkygMx|mkahb1wZcc(`ZexR` zva#ZV%$H!d-HX{p&sq7DZPCnDehbUx1(;ddQnaPPe8y0J#@G+Cndd#GxT1ym9nF}% zAZ<}}WeTn{l##|}TRuh4V7oCk)t=8ylUW`4w&a`n62G?5U%NWkN{Cq9ROZ{>G9_vS z#)KBYK)dQ;zRq)_L^18lAZ=tK+A=5YUc!7T&FWtIKmF|{jRG+u9FGV#mbVaI1W6$6 zxGekPmHhsHvs|=R>=!~QqP&XRH$A_v>#kF{GFAD(~h zr~6Cyw94YrfI6YFr?2w*Rpo|_(SJPEHvLr6SeM#!F{iIj(b-ixJSuExU3qud>z()X z$BuRV{C(7!Zuf0Fb^8uD=dYG7PU(6)YS_Df2_U6QX8q28JG8umf0}5&e*p!5 zx&W}qzv{J)e>{_A1Ov=GkU&EKG|D(d!TXhrXV*MZ~zeoGYrik%+P>H0a+B(wQJ*xhk4g8ru3d{pB@j` z+X@s;0Qf|9z0*25ilY_*LIHwk2AldBOqhR$VZ{Kt1Z>*6<>hzz{iid}9a3d~ERskt@x z9&CMbuV!ShWb{_V>25YGU75G0V(iZ5r{CmUzg#*r=)L3DKq8ocQxKh{$LMG4x>3C%`gOG8Zop{b5NAAkl7OdV2owh4hGDq4D0OcJV*xH-M_6- zU_OSG71zP?rI}T4*WYS?wSF?UTUecQmXmzDaUOFm(F{~+PVt+4gN_Ya)K**Ap09JC zjAu?evucDUo3NEoGwV5IM#7j3u+VJQo}E`2!L_rOHnW;B<^>r%Cj@T%63omxBbPREW==eF=1H9sgOLHGL)%mH@bDMcU+Z9yE>|)V%6EppJ)R2`dDEtP^OA0RXqftpez5YsHDU>pJ|pKPw6*12_)x~>ZOdD6t0 zD16mbs>5c;lb~ju zWK{vy`9Y~4TAV4$X>cfRV~RRf-5E_d`WBFDIDL_%VxzFI0>&jXk+HzlM;M$YEpFk< zo7jpqg0dBVbYKi{O{@O2uWsNnsVhOtlY!ckR`|*zve2Rk-aiHf$0Cm<#1IeEeo!6` z^(82;66O|C20f6vaBd-dOfsc%2SOKtcbG^Yf@BgbbfJ~uC@6xHish78E%I5)YV|-YMl7ZUQY6<=+B6tf z0%9|PAsYDkQBp_7ApoiqsK{KBk^_TY0TKz~#f;D$xP?z3QPrwxl~dz_#a>A^IO+Z#qpUr z=X=h~^>geb#*UrD`QbEm;v{wBG@&GJDOGSIs?d@R8-xTBWz8NWHmne^V)*_{MR3_%!U?467r5 ze|YZBzH~1x+>_^i|G=vRB384nDI+)qZS2$GciiI(cY5KDzwNGG_i;en;_V}U_Y-&a z#+|)%w{C~kHNJG>?w-3B7w&^|zxSRWuJM&axqHIbZ-=zOB8cGCuHQTJ$6xplzi`K| z-2Kno&e^T6zWMck|NYB<{{7Rx{PjnF|M=VQ{`0T(FKV(T>I3&f^j@*6f&)&GR zx9-Ug+>@97;0`t}V{=CjKcJIWVeg)%E#BDBja}S$93Fkq`Zp?ol+Uvg9!x zGH+U*uW!0DnHle=yRn-3sSoCVV$8|&A2S2PyfB8M=n5e?@*dDoY3 zQ+i)GY>i-TeWe{kp8vgV0H>Si8ml8Tf&gk>p>4Od7d)?MI#M1sG^&VyC?hzcAP6F? ziWpfVYohWC01zQSi>fWgAj*Y5Y!KxfL!|K-N;YWAA`T6GQ zJr>6iG7N~qDkMS>#H2Bruor1dHg4+vvztHuiJm?23XW=FX+%X-j*ui){}2Uh2%rEZ z6}GpKgSggxw-AJ~5Wz_#i3$|~qH5jyn?}*pO3chD1{DUA2%;c=K~j{I5Tm3B6;ft} z1 zL?j7`rx;`qv2sOHmB_F(I6+ucSi#Di1QBBOf5}F5UlsNig$1!PNulnV{E{e;_qoU< zW}sw25GJt<5(065pa7%4NRAo%kXs2h;%AX#4-esp$jmH6f}k8Yc=JxHU5NQF15|=A zfdU7I;PUA)FbE<{Y!+}RlLQv?N)t(j&~V;8i{)I*IBnkxB1;4@0ZeRx5%EM4Ra7L! zq{8r=w!_tj?!lXI@l*NwXYTda?$L91_O!S%_62s(=bgPCN_S$ZlZ;OZ6U*W&RlDFrB#?;~b|8-h&yP|NN)f6Ss_)&+OA&{5$#IJr&T--v%Sd%)O#RHQ8@hFldz# z^H5S(tg^%<1jRi`fdZxjyyFisN*FC38X@e!fpeZ7~fxwI@H6WTh1r^Ft1oH_KKd?V``gZlyqBnQ<54n)Ed#p1-F z2z4ue^qm^v@CbnwAqYbth%t()t&A<|qwxu&f;dC4g)0lDYqp+Mf@aZZQL1Jj8w#d< z;n%E!QVPPP1;SQUGM6ZC!IN0DJ0Fr-cv=OSK*i4AEmMC~D>wgH&CF1NYR0A4KeeAK z(uNNq5{f6eYTL5+wG0eqAGH|}%h+B%la*$FO*>#{SQ_K*aJ3X!?6yAq%B%7xmI-!- zwaZ#&BY7A$w7c1SO{g+eP+JLcaV5|CY7DKb6_1%-N2PdO%;COZb|=zf8ee7D8)A!m zTi%UDqol-eT=p*Q0!iY>BP;;HHpvWK#N z{8RbMIk@O2EW`;Pnf{-2OS<95%08?| zyS8lJdbrkE?`i#WVh)O37y4aixtpg#MlhXScSGOF8jaF$=?Ey*c}ZnY)6%ZnVU$JS zTemA+EL_dqH;d%^`7ymk1u|LhY{J@qu6lt0@*rQ-m^{tK&j(7nN?7~UUkt;~hdj(* zmAjm?uvitQjzs@iacFVac^z4}8^&sfaBHDxuA#6x${e7Qlf$hrt7Aq_K`HBKvyKzT zG$3ix6jd2^7mdZ$&;ppkbe_dNl(Mj{gCVx0#d+ANt&EMkOE9q)$@`U1&U^WPD+jOR z5Km^WW>iq>NXE75lZ!Fb5tnPbcN9znYViYY+&`OBrgm=z2M%miguH>M9Cr|4yw~yQ z0Pgz1g}Gkf^!6MQ7`dyqT{B8Q1Tv5s5fQ0srj`|IGB*T$S3EW2x6C z0hig{u~b&urC*r2lip?PDQIL^)jPA?E%mGKzy{q&<6Pr6&Y+c@^!zAnq`qv_E4s>Y z&23&XK1&*dbbeogdd6UZ(W}sIqeUP>H7b(J+Efyr;8IMgOIkNE+PVOLCv%9ik&afT zm_M|-GcJRop>zzonayz-p)kkx&-EXz`k>29wky*7fW8$85vW3t=Ovsx5m}A6)OXE% zQK;HEw%f){F7JPYUE7v_9IFm1u%T)u=l{R=JlGf`nb}$UAuBu6>FxqwWLX-+UI#y5 zn*C)S10WW=FJDY+k{VGWlK?DBKd>;YyB|9D9pjvslR=jp%dmb34xL-r4UE`E%G-cD~0%5-ny zLa34}rgBd@*U0=L|65_V@-yH4aX|pLqrkF*_+1~3z zbI-Ts!WPlb{%<$C_z2u48}G=<@)TTZ1Xi4lB|c`LMOT&9-!+7O#7*$LM6hn#0eR_D z`%;NjfNiY8Sh-<;j`_|vL>PNA7t9|@hT4qDe*Y}TU8{A%Pb9!Y=KH=G{mS2}B*VW2vnj0dn+)2*Cv>sxl=Y)nzT!k&CCjIFam~WzEP9|*&}zWS zLq?U^24&gZNvOTK!fYyEptC$KQBtp(c?o6kuJ^2G)sNe^eeMa#LjAY+BFT&(NJD*)5Zh_ z{fvbP4fhmx(c7V^xXJ(RN@XFpKCucls=4J~r@Q&=YGC^l*=##JkbS3S?g7&rj5Ecz z9o9B~c80?-C&M0j)vZ)gDyfUG3Q>9h-N5t1od;s>sZPNd^)6M1;$L2E++o7pCA^HC zF&X2Pz6B3-jD&)0@%o$^jUbt!?A+NylTcc3-10OGBBKN>V>hSOQbUuY6X40&yzSxf8AxN+l+Y%JXO60(JYO}lpI9U~&N+&1LXyLy3r z*#mJY8BwK-EKAz++ybqe{q9~QthHybxtohb| zX`rf2Yd0cSe$P*v{r&#UIp6P_bC}CYuH68qVuUa=d&}nmV@_rZmx}#N=jInLgHb*r zrKKd0^KashkYLQfMQH&Y2dIm1d z3)Rk>HVL3#@Qn66i`vJspXQPx{PbcN0UM+@@1c0Pr?pNkRwqd}_@cr%j4?b$NA`JZ ztv}6mFP^98D7s8-@Qd~6)ZMy>o+;lx7<_ta`W3aVd=1-IxRgxBI)aWy@8^WgKR@ASNf2!l8 zd(;}{#@lBu9mkU{;JZAcxk(!DjCyE{A^C`}d8*_@wTPLJz0`mr6SX`!1R^@$Ip2Al zR5PL*8v)X}X*a<~2_eWX8(LU@LiE*TFTCbZJ$6uKO$`Drf|@n926CUrrsSm;Ifr1_ z#4F_;SyVJrAj|pg@m#jQwJ>7`ao6r-- zPyjPZd3%0>Fj>wYBu|K7_Fv)_CFznC)e3dazL!Fu-X1L~41V4z}~ipWnjaL_i$K;=3p)z=2I|-h0$kzpPZ1uYnu0B7ENZMOOS4BI5sF=VfhxhE(4iC@r*KSod) zKCyWldKd_-_tUDG(!>uD|J9D`V%H3)Qy zt~21Z%rTf7bg56Cz-%_Dw{giMz4g8vO|&Pr8bk5XSNV#d`X-L^j)ydnuKFbXX21_} zUv6Nq(ytPGI7~oJC>1OB=FDpui)fKrme3f*u`X*otU5;N@Z|3tf3TCAG&m0^%Y_jk zN@=-?S3-=CgCHpB zfR(`h@eL%5HhAL3f9+qPvgJi(==4I#)U5|a9%7$FbSk^bklhPTQvL>*>B-Z7sQEU@ zcMPqlsYu8j%UL;8-Jpv$fmPkI`ne}$Vnh!#ep5dtzQxQ}4#C9=|5bHk)@bSDgV zA79J5Fio0_?dxmHEMeFi5Xemq0bkkPVcH7L^xp1`lrPI5xY`rip<=txEgkwiT!8kD zqkP~QtiTA>e-*>6CB=c~8qW3~z7^>yFflqyJdZ6T$|+B|I&tGJzz~5$40Il4xqs^; zSy+k18*YLS5WJ!;FQ?axrrhB7@{N`6GYF5H3QDAka)lD&T8SK#F@!O&KU`Ft&7j9t zXRdgB2fms>-JVX_zvk}c(5knYX1W45jr@a$aSyHafAEo-{;eqAd!sX7vK<#_h9SCG{Zhkb<7!^apsNscC4-Q7}51iFqse&uV!y2 z76osgD>hV}RAKnX&^FY>a*Shd$Z3W~gP_+{f7^-GZ$-sbqQNnM(afHnh{g^Y4BC%F zCAu-~YVQ{`7MX#;k_I=utddy?vv8O<-Kz8QEalh9LALY_Db*p%sZcgB{=cl4}Wy+;|M-?3{-tK5vb|2Wg1Kw>{^~QI%^Q-bpT3y_hUgVk$sa zf4YHltZf8d(v&v!aI7La7*6d=RtGH7s*No z`Q!6NVCP|oEl>yWjJuRAxdD?o(F4Jmf1?Bp_*$z$T%-@TDdYRmp?$vHnMMN)x?sVb zFBN>znVDR&^kJS|@?lHYqLM5EMCg)Wd<%c2x?)@WcINq(@(*m>a5l1Nc!uN#*DqOQ zPw7qjBYW3q>kIWHWTG~KvR7C3>vCXY$)iDtga~+iG*jN(M<~#p4TNsiTkL<0f3+6a zZAH*!T}ss4LRL3Ix>x5{cL`A*~03OiAJKB1~Jrbe`p+x!lY; zK+G~@rh17+02paUC8+52JmSLe;F)nI;+1Q?f3VR(4Xi|2N|cnLW**F!m$aAbxhB)v&%(x3i7w(>VH zROT?rhNOhlHu^FSfu*(haPjPu|oLbUjzM>WuttI^nT6d9Ix8 z=Tw0o8OAT?y<_ZESn?9v^m03tv5_%c zyi$kGIn!G2icP(>MU**Ce?#9&A$_QOL8U7c!m_|f_f5GZ#&wV%-Tj`oP}~a*)sQqjs>}tJ+D@G}D?xodd(idH$6mP2>Ua#LFU*w?9~tyKux29?;s$(;`a47CVKYr2;=rJeO0d)z?E`{TCe zkrQ|I{x@CQ76V|wFu-*!yQUJ9y@|E~4QroCo%;U#%BS!ARA*<3_*jw~;;lS*TSUQV zBf9o~!mj++uBr;Jy@q}6dykd^tx#seP^IAkg(655QUeh&e^BP3Sfx~h%n=b$f)-H3 zph47-NK`P05d@hE5;ZAm5Lzn%LO^Pupok{?1ODa@dpP^7waztZn%CF&?mhPmd$0Aa zZy?>rwC!LoTNuP=n<-jv9XNcnh7<%hQ`8zcxT(o}VrnkX);jeE#(Z~N)~#zOsa6~;%+`<_c}*f|f74aQRwebEtJpJ_Fl$LUuJqR( z^tcqXG3i{3QMry=Q%HYWrZnPSX)g5_KTGP2e6dVO@IWq|+FMDgngvOx3 zDSm@)W#9@31{D$!q;9h;aaMri%8SN8l(7*~+dH{#Z-558(z7+JJ3Ci1 zB(;{gh8(R-z;az()K`^YV>2d~BBYq%`7vW(e|20Es`}iS)@~$W9!bR$yT~GeDF~&E z8yxoZmEg@HDY2;cp)X-5#2gcbfrax`Mwt16^@_5PbicVI>N*ywdD)stnhoV5)vy)L z9xaWRXslkIdDzeQLWPTKGCj ze@tE!RAhm{G(G*MMO4e;zWFxhvx;cqO8>`r0MpfNHjbojRG6Z08cMJ7Kd}4>cW7c? zzg;M&^Z#A&*22!V0csyfwd&c39EU3~?6*`DpIQnOZei)eu91VQw5*wJW0tjJO`-C% zv^$n9q0;;m0<;;hP$+1wq(Hm*Dc}Lgf2B$FeVt*6+8698lY~GBB?kkUYkYKjFl~uE zIAAVAlk#RELlSw(P0wAWwem0^rSc%EZPdO^K z`*(Kcz@YW6*?JXgJ{c7|4VHd9k$|7T#fFfY&YrnRd*RRrr!h6wAZ=JrOfW_&UxcMA z*~>zdwrwFGq7(rb1q)6?rAipSe`)r@=T0(jgOSQF)~LS#Ay7^GljO~svRxXEOId$& zF0LdIU=gaB$LH4sHo-4x?gah|vv>{P|tDmNSrdd%Bs%1W@3S$7YV1N=#)0%<0Zn^f@T95NuV^$-RHaNz0p|oZ*gQdGk?Woj> zy#H}7Q>?MQS|X~qTUr4Ce<8E_h+T_bi{)6ItxE~0t*7W6fQw+%n)VF z!DNi#i-^Dz>1HRB32~P+u0%qBKmmo4%tAs6JK#V<2*3e_By|HAf3N}r3SzaxymEOl zr^kx0lE{~3NJOAo6&D5>rtpzmg=D#Ura>`c+T$dp^b!q~y)2xvnfCSzGl zOd=D29A6e9G6FG&VpQLF%qP=W4vZL+*epfdC6|;)g{+=Hlo(^jh!ci@fRli;7?>hc z>_|EQKt}E&iKJ9Kf9i6K4hz??8;LP?v50lDWqq3|)n_}W5+R+;rlK0m!dm=eXjbh4 z$T}34atW9tgoH0#w~Xe@@=`i2Ps21*KH9%~>rv z?P*b7i;6?%dP2B6$KZ011{+*ycWbJl2pR2bR(^&nL28@JG4itAd)k{M{cd%cvs50< zHbBZkwvwaf!a4Q(Zr^M#kP?_EX0&n4^vuVe{1ol{Kxu*s5aFJ{vpKVH*XZ3Qwlf*_Nz;;JOe&U|5!W^I=2OTBH{Q7Moo9DBe%}y*x`?uLvgfKxpWk-r+s~c&*PqRQcRehg0odc6)E{YL;p#({k7$Y%5@@`2b3o;W&i98hG<&H3iogxObN^G|QDlmo&lMWf1 zj7B%T3>g*OSS`U-{Wyi+;M(n|iH2I#pkino!etg19|5eOGJ8KY&4DHRn;Y{8W_AE!md>`>eu$&@=mb>6PNN%^3+LpN3Z zwB?1hGq&>}^}%gl>xQX0GmbviF%$!*s&I5DK{%W!sZ-Rl76wpYk#lQ&_j%D5SEeEqbOFBi|f2gkXFrprL;RT13Y9c&lN2XL1johU9_;rp@ z!s@FtrVa6M^EYfC*^t8$>kp3}@y)AX@vhV@JMs(PJ8#Q#e%01zEQ5sq0VO^w4>Kdf>Rbuc3V+6Hw$Bg)lNx;1J?0;GPG4eBHTE{pOr) zn~r^WV|VBxmYo6|a=1#tuJ4){VzxT;dzVfdf=WKaIR_-1;K-nD^ z9=YGB;fZFu+jgEy|jIhag@V@xxe zHtD9tY}*jE%)=-mO8b$J!ri?jJ#+8RQ`BFXj%lajedyP`a zX-8>TmZ7iwhg1Y(Kj83$jx>^5>{`bT?Xk;0xp#C*Ru`z#KN5wb%aE z_x=CBzt$3{&H}UteUWA3W_y;N@lvLYR_LG-)l~mN{Q5~13AzazCF`{_#L*3~D=7fn zL`Z5%)bz6lK|3f)oz4(S%w`Ef7$dD%&{;-kw1yZtk~AE2fB9I)gPUbtm42HiG39>L zqUTihj}2>4K{)o(GT$=A!l^|W#fM)=(*vi9T=nZYxpqz?e^Bl2vHN!y9yQj0S4c@zv zylFj1TQUFSpSo}U71fl2q#!Z;*ux1GO%#r~ff&cWWN%6>NLxL-XJY?9E(Yq-08RDh zG>m-l>5`X^gPba3W&gmvuZo}UPjA~h@x%8|UA?^W!%GAIym|CrcYHfL>RtvE zhLxatf6K-zm)5-XBFLRf7j^dDy0hf;b09m262jO&6NeXqw6${vkBokI(_fbdePLsE z6#RH!;j!2IA3X5x+6*d7U?hWvDnRN_e9^swk8bC6F9Y5L;ICc(+FO&4A8fq*{WOa-o|zS{pU8bdU5f>@ns)UFrli172+O*k)#DSe=*!x?_P-m?$c^urJs~~Flqxs%?O-+cg#Kt z6oP#ley_4I#dodPWufRs0LKIcKnO9^+-ULXZ7TmzI`2tSOKaw3Eg_vxSVh;w5wbW7 z5h;^PyFXYJHVJ~jvc=E8+I8zZDN6*r7^baldFS1xH%@_2rl+#G`|hVzr*;5uef#h8KDBS$bne z^Ell;K4a=+@3*(-A0GypB|km??yhgH2U?nZq%~HD_KQdi=LpqpgVxi;*`A(AovNj`!WW$)Cu@ z24KDbWLYT-w$Gb<<-p^=FZ|VLxM2m%s9N#Ln}d(;&pG{K%7McLlSh-*L?JFHi%#S{ zb2>6Uwc+}u{s$kUxj{q$f1+lYLOByR0Okxc3Ms)%3|wsau-P~jLRZQewC({h(h)cT z!YF3MZaGRqX*+X7uoIyWf-s65tv@PKMg{$rQbs9;LgpieEJC6yM~Nbgp$)DUSIDSf z>6)JveT)i0kz)3wBF5apFoD*n8`!N@O!R3`amk@hij3L3bx3Cq|MRO9dP0MBZe>A7k&Mp%j5JoQScGUu)p2FRd^WvBVv|}mh zeOChlwP}%3Wgta9sX`EE`J&ZV#@uTbDN(qM2-a9BomJYjx+wM5Z%y zQ=x)avZCTIA=T6^fADw6!ea^vBQ)d5Fj0J?YJ$Bi5i=*YnqkwlSWPDhlI9WWf|;ge zT0TLOn}X$Oj`I&!2T$7Pw}f+?UU*noFCj*n;0q_3&uJw=E(thsbh2?|c4|k{8q!$^ zJHeh2CVE}VB#zlwJ)XHWT{K`^L^zL>7qoUHH$4FZ0p!gNf8^E{Z0qz^R05VBDsRZ& zv4a#9CRML2I`YfX6DPBej$|L)mAHB#N=oz0+n6zWIDc{?XMY#^(M;??B2Wer2q}e_ zK!X6!Oi$j@NcUjD#CXnFk5MxZBqYN?8Je@1Z|V&{J(4xl#pV@3ni?#x%WZ3+vm%5N z%o+BCNvI;bfBjI-3%^J|G?pN=1Vgngr+854{Ga z5mvq`xnn$G@3?1AzrU{?*H@#+Y?|GOS9bB<1K!>pc=O(6ulhSE@(L{I|+%!P{OoL-gt8FPY%2m&a8K*EFLY*DB(AnJh2sn@0oKP{{o zf6@vsVx|eY7j)i$z?7hwZU%^;@IP8!1gxd6I+g5khMU@iGARX9>loK0k3xjNH1WZi zK(5+|#IXkxtPR6+V)zk40LBc?;*4UY6(WXEaM}|Lu_aGdSD-qma>Fxf2P;xvjZiZ* z3OYbOZbCQY5^?J029oFiTH!5(5HQAkfBr=5^BCMqIm4V_P6;=N;h~0)a1ZnPn9om) z0Og6qlR!NIYWN_d)MId;pL!Fp&ySda2u1dOf+!)Fb3!N~+@Rb~4IefM_{=2s^(YyQ(UVuf5j#uC@2MccwqmLamlsizZl0gBH^uN?SmOwl; zxS9L=-kH7EUhDh)eAC2YB^DW`F~Xz56xP^_RD5ca<(igqwbarQOjlC8@%pV_-tg2@ zy#9m1E!#%e%&qb?L7J#l@T5@Yf1p}J#>8AbB352arJ7XD;qWtOT`EwwbO(KMN-$}Fk_$Q)>+Tou8j72A(8gYHDW7-Y12Yu;D9UIOVv&tBGdES33^Va3Af7`#ezxLetrCO_$ zp7g7bTE;7?s69^owq-yIcWA=W2fKjX5|$SYjvk14s?B$y#Xq**rLOF$`+y5nR7U4IhW~r2q;jSgH5#yx}Wecs3YmEE#=gyJYDn_$^Ljq zmS~*JSX73qMW_Z{-ZCX`rBHR_ zhHMs;GqucP^yn7dqUT35caJWaJ_5juP4Y0q9HLr(f6PFHf5+So%|D)E{ZK9X-ISAQ zG?>7k(Im4^4C)3mcUMEk#kLpV1~+vJ2F|y1L#_Z!GchGUg~e#@mML&K*iSfQACm#m zTPUJDM<0onbYBbbW=*1Y# z$3Zs?i&7U-#|jGTLW*OlZST)tnlg*Syl%J0J}AL}gQJbyH0l!Y%C}bf*Gj{AH%dD5 zr8@G#e|buA$(xy{*=j=zYz#_euv961>r;|Nd)mJ8-)FGwF1yHMQunc*ZU}*7Mq;c| zLiEZsx;m#As9N>$+itpdj+DqO@O8^?oqOc+`IWnFCZ+&EbTI=&OepuiRV2?uMHF>l zWVVK?vKnC5k*?i){P^zIen_*VrYWHqJ#DoY_4q$?+xCsOfC^8QTQ8YQx%tvJr|C<`2Uh{HrMF-H()A|^5b z26Zq6Wr2YqOe9g^B7wvhL_{PZsIY*8e<+Kwf>js_bGQ*Z(aNpQ9ov8LRaz^QL={97 zh*T72qD(}p5Oc{LCpJm`dZ- ze5}O6Uk+v|)M*&4OtsVh=z3wgf0bzOQym8XWWVu97SA9ur>i9*q85SQ1_||kbxxtA`IfjKBcg3_4bGEJ9F;Aix zi@)9R>T}q*Hl!PF`}Xr+zw*xgZ@so;`+9=&(slQ~@WL(MdYBRuE&KG>4(|HNVTv(c zzj5dDFCKXN!p`3xU$b``e>n-jc}FsEO2o4(Hg4N-;>2fO`S~5c{>7$efAr|3*H`Vi zohWU7;v0|u<*l#0b79Bp$ChoonRxk@Lr;I|#EH+He)-93m$sk$0ljZ#`MMhqoq2iH z_Dw`_)g7OG=#7`An>XL`_|tpdc=PbTuHAX+_+7`I-E?Rl#p(OEe}4YqKfQVA%B2S` zpZm}^AEa3cv}(zQd%p0?(+A)C^CMS&vutkLid*kF^w+=r^xywH^4{AI{NvpID`%&3 zA6>TQe}tWBP!!h|$4~d|zTML^0|<=BzKATt4oU=N4~q&4iXeyvhD{Je7zF_%f(sgr z%QMDjMMJqkJzUF${~->0j3x#ymH&j0-W z4%yf0X9g(&utnJ7jFviyy{*D0Xw}sQznY_&&+n^-+AY!+0m4$ppoH@m^9CO#KW}!~ zTL=mxxw*^I`b$CQYZAI{tKK~H{U#q|fG|a|7&8ooF~u+xe=7l)Wf`SP?dr&y=t_Co zWLKIF7=MwG8`F4wS>xsG*S)K|uW$j@2my&Pn#x94hGsZGQs0e*t8dnVl^%fpoY;ii z2hFUz6KCt4eB*k~c<;K2M^V?0lS*5;z0<}A*Js5C0+6<0;f1}8GBW<9uqJWWZ4B4|C@ zP#JaNY~FZx)?{;N!)|0P15)25N1ZXy6+dz}{l#66e{I=dfEb#b>PUTF&jd*!>JwN~ zgH=HPRd45c{|eU?Z=cY1V$j?PkQnn&bDfLM4u}Q+GEOLb5f+C< zooIyZa2^>?8=+D()6%i!i`oSXg%sKt+q?(M8}HQp(;+PsZ7k~0ZSWm~wOAcv;@ZAX=y4l?t?3H;A;`rV6ARCnW!I&wpx)838;;gqWRExD?&K2rETPm=i4fl*OJq23)96aVTV_nAEf3w z;&rApOKYN~P~HVa@XBI0C47=XiMnPV90)1Fe@Qu3f-x&+SbZ#4BKsup%=_|k+v2My zz*#{koCr2#=8COfzaF>Qu7)on<{UbZ)qRT&3tN8X-zB31{^#q$t~YG^^;y`tEie-( znxHVI5Jh2{WK4nf4>(qz{;&=FBf&puWm8kcg%e<{4Ega~;Yb%=5<*1B1)l!FLKTaQ ze;oM^;oweVIIg84|H`I1@LQ15a!1v21?Gpql8kjvf4e*@^NkW$7EQi1ULFRNt=Hzt($~KjBqhL? znX}aUH;uottX9K9Pq1}HthZuWNl^Wb*!I@E-p=Becj!Pb*VKZ_-zQAgCV;g)SU8gk zC1DZ@Zt3wiJC-q`ne@5erawee=*Dc`&w@~Yklc0T6oi@gr-M)tD+ z1Bq!0Q#8vWRu8}?u;OsZL_ZTA1vU|e$wm321GCDDBkF1k`yLSCG2j!M@>AQ2ONU?v zP%Mcsq8WP&p z27kY_w%cK+s=-7~8hV3KsMoF|MT7V8Jab@-u)c@tR%`6lT5xqEj9fwP1W4(dz3ss7 z!&yD;iQQf0Z-)v7nyCd2zz|b2+QLC0>MvuXPl1v8jF1r(&-2ine^WV-NVt>ffZ6My z8wnARqAh355hrmYQ;l;ffA8GPJMQa1t4))~bOaq8V>P_OlJGRii+b9Iq(p~$cwtT> zk3(XtNC|LHy>f}nJ)hQt&{cl+Y~iP z28zKPC&dg+vl5D-5T{2m-e9;m{OrZV&I`nRTh7*zF!VP{ROgR$o5ThI=Qh85zq+r3 zTOGHw;i_uj5mQ!7f33-urLE<>94MNkXqv(lVi02VNzNGzg8h!yuIcOGRwXOT4(IgR7fQ!#tmqmbR!%hd|GiagE;eynF7> zVtMS+O=GV;j(sOj$}8;a+4H_r8e#|7%OXNuF#6IgEfl0I$vEoyrc_Lfg*N<$F0D?v z*SY=OQ|Y2$f73MudGE#o&m1<4j+`C8!r04$kXVCJP*mN;obE`hi4X5tsm&E9R7)2IM*S+Y}0tJG{}aSA(6_QLFQ{3kiB8JKlzt?Gb<|0%eLEY zuOdx-EW#7_eCTt{jRGkkeK~_U#7t>cXqu%EBSD-Ae}O!0GAeT?N4$SHY?PEA+t`xX z*Fl6uE;(Dj`cV_uInxUFjMkRr*S-SMltG?=TCNg7;&h~ z1&JwZ6ScCfIjy_JW<##ufurho!`7Q}xv-eL(ZQI8I;+a64rkaSUP+g+HlRXqgEx_HIR0>JP8{j_mTQIkoTOuUVb-urMIz;^m^r zA)lJ#%00(i4<3;(3;}93c8Oct)>Qr9moYa_!fX?SWt^FplWN=Y8#i`N^myzmHV6zs zoKwWf)1~hQJ&#xWY~A9XzaI1)ER#1Dz8#6bfB!$e&aF9$>x#mC&fa_NeNNAeMxzTi zO9%r6$T7FrGA0-UCLstg!L~p$0nA0nE(lN%uu}w-vR#2HS5nDCp5p(Kzmm87jXZQq zYPwHPl}e?OMl++HGdlb1z1Fw>v-cnWI`s3;yIwrWdR?y~Yv2=F@5;99F-@pw^Gx=} zf8^L_B}Z~Sc=^pkZIZ{@R*np@?X@WZeJWEl$zo|!-8T!DAyb>=(;H$VYO@p94pLS5 zb8|G4+*(@OSJg=Yt=V7S?8+pACPh5W5~tdzXjAhfU9z=Tq}FI@ zs$`PPn--xGl@Vr?o|M)2G}TwRhM#F`f5RjfN$oh^Y;`odBegoIR+&}bbWIU!bCO$A zR@FKRRZUNGY?Pd-CC?{qRN~>Y=A^Z_S`(}@?1wM{+6v|7#a~-zYeessHQB`BCsk<4 z)^hd4Rm0g;^eDm>A|M14Ff{snng++@`0}P_t9$!%-f{Pdu6;Xu~&0wxv~urh;vnDk?FIJ`LVaCPsi*PUxi z^!e}T;Cr3PJ$r60=g0PCF(a_IoNOxp`10F7{C(!tk6ZuxbYk^-{PjN9>-+w}-iM2` z&sX!)?`NIh`nzQ78UM-h=y$8ze_y>E`}V5eH|c|jimG}sZ^U7Odb2w}z0v#a0`{LA zEL`&kj!oZO>3ncncV8T={AK$4*PWFIZfVJ%IH}wB@3?U%96Fqhyft?4%*@I+e#d@4 zadc$y+0@I|qknjaFBfJ0G>!Ht|3&}(vm>8g$hM73o=bNp?KrC!A8z{df8RRy9`oXt zc7EPZ?2v6o{juxaN8gPvY*;6T>jKJm`+!MXF< zcs~ma4JyjUYQ~}rA!W9Jf9_V^dk-Jax`;Tb;Lbhc$_4jU?U*fqV* zfZ07RvV*dL)w2K^y^iwuFK2%L;@SWH`_aE&XX8=wF+VuWZ=cgI?vFfpA(yXZyJlT? zM*2tc<2UWAr*e5Yn_tLIeUgn&PaZfna{5Fz==)#<5X6fVz|n~1GsVlnzy}e+ve9Bl{bN79@T_J8BB0&kkHZ4(|iOWS2Y$@ zH8mpx4JUR9mJ5pf{q!0^0ghm2+Wv6gOL@g09n~AEi z_SgmzMp?UzKmdVAnH8k)${s>2uqZKd>`LrR~kVS-?RlUNiZ~z;VvJ>GDCFX3AESKEaK*DMPe=$f10`*`YAbE}uC3d9Kqdez4 zXEQO?7)8xO)I4aeq{4t0Lbs!#XR#|GN6bSfA{ZHbFg8O}L=_9HKrl8fEJAETfjFAw z9fS^9a0ZGf{LD}$@ea%o02)moj)_f?2gIPA+&UfYMC5@K5(5V#Q!?fNQY94+Ap@H_ zBNJxne}<{qcUNC-`qRVg(0=OlB##pF5F%oSEHVHCn@|8nbMQp-~YPpr)vD!BpSSS=udKEo15YgyJJ!`)BHDA6Y;bW!IRIwX^W^u`?gW< zl620bUn!YqRO=ZGu`RR(ur(dmB}GHna~Wb>1luNwz)fvXZKFz};+vPQSr8`!y4!|v ze{H(p+NG#D+G@YJ@wi01p{yt^KgmGNB=)0fP_Nwo8qR+$YF;4Cnxl$fX%2SR-(MT= zK`yaowd~bozc9&tN!HU%jePl|B17JnW~efr+GRC3Y*W0oK9{Ub$Eq(uEnhIXoC*zZ z(s`aNIBG@na2|2e_gDQo^B@ZbFhM=Ue+w5UOIH#vxQtMeB2l=!LGhA{hzf*>3loPI zP?M6UmxG6{aL23Mx;xOiaZidiGv?#*S6QKm|06iv>i? zF&H+lM%tB05x_{xAJW3yI;g2nxw@`=z3fi#LZrq^cr$S06f60B=#A+0sy(J_&9(vlz)AvIJ@W+JI#2va&}lV&hP zAwpDw7_WG>NO_E8rlu-i=JR~m=bS$G?0s(f3#G1eU%U5N`@h!z_ZQM}1jaZjZKx5R zzgj!1^-AD~?i+DgHIlgz&_cVKk;r!`n>23ERE~(`l1sGPnUo7z@hC5Pf6LY;b2p68 zgS&7kNRc8!kKC%acrSO*vp~DNd=Gvvxn98T8uK_PF4EDJg{9T45NvguVr+1_Ed*Oj zVeho!rL8JU)If|iBPP@ZNYR?H`hKm-N^n>t6t@vIoDm#)uudtOpweH>UXF4fL@DZK z8c66Vf~(Xzh7y`RO7Zfne+k?6;HQwXO!_2>#k~ubqHidY@m!MAbl{ z-iKL&ht`a#XZUIgHv+d!w0vkKxK~Sl8D;=-kPc$HnXJGSYm|BjtZWV04v9co=m{ZJ zQYcI&gFmWaXL|SicjbeveT^dpLf$&O5~b&v>)dP@nG4w5uYx2ze-?=COl|)Ox#B|) z06`dwCzPWE5+VvhiQ0Lq;pbeUt2LUNQSB|{-46AXklG)t+$>JkMP zoD)i=gp9|Vw;S`?e~R=LjfDWgo6>K(FTZ^1`E?7y0U?3NA?2W>$Z@T^$Qde$5(PHg zfQ4T%IB{}FF%W_&BqBj^B1N151CWHAkPxLJCOAhX7;wooCWJ|*%P++^DTQ(6XbZ96 z4&$+S3}X&ajN&n&lb;zwlBgs{fr29;34xOH7?FmyAxGfEeo;RxU!PWMQ#zF!B8ugetZ}rcYo0jAQ0gsVHk|;Q7=$ar>nt(!52*$Vo z#zA9SP)Ut%QA&}{9ZUwFa4B?w!pSAR2=^iS5At&gLnx{wQ-BZxb!?9eUYSWDHK9%T zSh|MXL|v!_e*kn+=N7qplUKp`m5K-eqk>68L5?*BK)vQvpqX4~?fWDR_iX2tnr9|;h{SPWci7@wNGcnOT)N)&L9F?YjHc2$@`oik2c9i~O zSCetwfEb9j%?r!NA3QPZ;#Y6{aw~7c97q61j_62~=x`BpK%^(K^M`-1wf(9U#fSbf z`Rr%ev&VpNhE=~cVA)JyfN8mTfy@?u(>fA$4iKkmAE&6Jb1<4^6*7?Teuxzo1O ztmRX_I5PRd{vIDJ;LQ-F#={{~LJ|UIQD)b1f84X-$?bO@U7LJyf9bWl-&R&o*O6t{ z?-bPjb@=DI%5I$Kxp5IZ#{r&e-oJS2kwY`CeOYkmPqD!rxdN#KkP-?>3XUk^4v8$8 zf7N;Dd)q2*URZGVXvfNNK*&_<{1tCk)L)%@_x!-!?>XICflTkQWaW^LJ}%g`v#kEg zsM-%@yJi4EK)%0DcKhN_wh#EjrqWY~%I=-%yka^KiHy8K@4R1r`~377Q zCAW@sT2ls%_s&hdc{r;mA0#DO^ck^p&+I$b=H372mS4VaRbB{b z8AaOu|yg%hl>34L8%$FK6PHA_ZR8w8NyALm;M2fh=h-f6G;V%>2yf?cl1tjUMjuW zz6qV7t#-v z)7Gv^3Y1(Fo6`CdRO3UVpk|ZBdYp~APneOARck2dyIMD+-USpJ-*Azm>@#tw~Kb0q`pb>%#_g2Ou=y1Ua41enk zgn!i0!hh(SjcUZ0f-X-^tPBPr`MX%s=O4NPdPgHJQVd0f6c;n2+lpg}eAfm)Ei@Kw zEr0z1So!9&XKgB%z`)V{cJ8RSQVY2)J1<>V_47}oPan=%Tc!GSU~z~ck$)sE1u8Bb zN5pek^RdvrtpB!}%DY#b!XA*53yBw0_u19A?@!vd6Z*cGwP@ASN7q{}p5OWPs(1hW zL(%DDg=bH{_VmuH^~Yq-Oh&*IDy2}x$Vmgyx^ef3Z$GN07fmed3I)QKfG@t?#p`8uI$( zytU@}PyS59#x4Bv+=|=Z4LN>n;x}J!{@>${8<+Fn^_g_`tIGPDgX(tYtgPT|y0G-# zleX8CfB!9vE`q+3CLKFD_Q)&7b63`rKs`AuAV}PiQv1s`ByernCEllLncC zXY8$8cJpf(J`M_I%>U-XOM5o+zI|W5esyTwL72XD@~JZmZyslPnW7Oyrf%NQeS{uXLroOXR|zF$pVUZSx@6h zmWvu{o&Pg-X0cISXB~uptW+OsG>AcTd7Z7)Q3LYJJ&P! zoI9%DEDL7l&dj;r^8f#T5W*`W9G&UKwKnMHsM5mS3?oA!Tz^o9X3|uxnlMvGWnEn* z7O6oJJfjZHan%M32PX?Rn3O$jbt9Xko0tkMyGFFu^nXd=)JYO`Q`?(As4!1%y;WLg z4N$R09VUH)tQ`oUl1U}B7AQ4HpUDPZ(z@-P_quQ0B)$D(zxCb0e>`Y7yr;NpTmSt# z>5j!jHqSV8=Fp#S`MsU3KX|kA-M84|%ch<>fBHY4O*prn6cQ?eKv&5)Qn!@AwA!|( zj(l;uZh!M5#0RcN6EOp;R&2cf^R^p5gw~Gv7cam3&j$^A`-*lx|IGalMl732RP(Hp zuRi^|YqY*nH?Az+c*NT=H2%_e4*u)onx5%|6J(qsQe+?~*TQidh?q6!(2M*2_F>ts zcGc2?l{3_Yj%V(E(s*Kk=$fjwEeAjS!>Gai4Sz?^?f?Aq`qwWweNPuYJ5b!c3VdV| zlF=l3`LwHpgp_wT)XZ}A(i zk@1tZUBA}z(^pA_z&&pjvn*- z2Y<>2hV+biASTvrJX`wwOQmPd?fT4* zwSAlKeYD`}>$+>>+}FOn@6(S|d)xS-<2(QKK2B{Rsrn7ydt=vcevIvlHr#sqi5pka z{d-pZ?44KseYbY|V?>n{PwQ+sePQq~_kWts>@I1YP14OBm#=mF>Mc_Dkf@%$^Ox_g zyn4}HvUK0axBK3^zVPiIO}lnUuU`cinZhwL& zVk+_iG&JLolu2M3UaU@>n6%JbC73N&er1NW3ZcnZK{N5zDx|QUK2buHb?_T2fbzct z^FmoEkJO+iT8}xagTRWFPST^q205{J*^;?#sEm_Tgb}ya99HEA5m;=uj3(JbLNQkM zgJ$KNnsr`|93%sLu-3R4gA8?8$bZi=al~d38OgS+Wd}7_;?{|sb&JO`AR&iZ($<-c z(UX(KoVhYVx;$gKlLm(bolnk8D1fC0S@N7CA`f0vfIX*)`x?`CZI*xz4gPZr+cMjO zo!!jDFAmG-tV6Is$OMQznOO3ywfHbiMln%s9(Qr9AIScPNh&cj5XF=n5r0PzsU->o zB5Mj$4iC)`FD-jmOT` zA3o^zZAw42-f0})u)L%E$$wSO$k9%^sdn9tl9h{Ss#4EgQ+ML*=yS(L9^A#o*Ao>; zFa;BwaYP}cLeM4DZ^nro=^Y0~ef4Ph;3he9a%$q-x-DC>aE=cB<;Yb9DN2>Nn`BDGfb+YDy!x=(t=+kGi$xQy;J2&`s+~krPa5EU3T{vzo|5j~Q-0)VdT3C#wUhKj;?G%e{>_0;-Y-73$J@4PxPSK-p-PP&?xG*zrvE9Ng?#go*uuA=Qj1^s)- zvQAjtMQR#V%fgZSP81EEObs6L_wQkg7C2QCDwcGqd2>jr!mn(u?c7RQ+QxM4KKb{* z&b)F-z4UV9uz&*S z00qv24_i2E$$*3cNFmGG3#@8HSG7Z61*%^Z|y>?Rh zYr0G`;pxoD@Qou=n|1vZMP(2=%y5a=zd=}g1ec)+(LOm(4+7jNV?0C>2K1S1ABq{` z$D)cMqscHs2xHLz)}|tKJ3AKhFbgai2G=6V$7G^OBY(=NwK|Mm3nEg+h(khAb2f20 zOT3ly$)q`pkKlpYz1}fwT&wl5C0Atk|TA-?{)w`fI$j0>!i|ltQUoMBsvh zkX-tpQdD_VDXukFI#$Kn6j($w5el$hZI|feXs1 z!w5$%gnvXSLAl@+fSUrPh1Oh2CXh?P1fzn15CMLfNf%U#X%D18!Fiy-1>jr)7nCvJ z$he>=xOSOzLAhKhp`}og2>}?$KP4y$Qh-wErMU7@`8=Ex2qussrx_YfrcZT=`sTjuNFrSA*n?GepU`0Dt6E00BYc9mPK{37XTRGOqJuy8`tmSETvvbXqPJif^(^ac2R5Td8jnk8nvR5qu`)8 zSBL_+mZ+6bnkx^a&x40>H7HlO1;QP{-9k_uT*{g zn}2oZUnxIz#91(#78f!hs6ehH4_!RLojymh$}^<~vd=c@!OI)`+&@?@##5 z?L(0yHJOG|*r{UyVZ@kEm|o)O zZ8D9uG0mwtIyMWJ*xfhjR81OmnfW5&6{B`fQ<8zgnvZGzYHD|^CTi=DZ1_G(9L6j= zAZuW;^=EjT0O4BG3LG|zt!PwZ-B3i??b-Lp*n4ERI%km!t*M4ddm`&X&{Tbf+JCZ) zLJk;2G-fjgHs-^M@wVbkLT23@9V0PTXzUvY8SkMPB|x)S8Ao7Pkg5 z1&@w+FozLo$QmZ8X_}^){`9jS?|=Hfz4p3nYv%meXYaGu`SxY4^{(fAF1jjJTcN4u z*HRSG=&&E1GF6K4k|1+5_f<^VIkutI#}mg-`pnfy@$^@^fLceL3L;xKV1S8=LK7Jg z7PHY>p*BC&&0t2SPeudaCrLW#GLkeD34jq9Nq>@5ECB(M z%iv|pmKad>JQTYv+5ZfIGFpfW<;fnA(WzmXG=U}%0D!GU1Yj}@$N&t+lE|t>4*~#O z=J5iN$d3^Tt=Q(GLDX&!&_txI1qNoawW10omh?jTCN_H_g_9oxp{-f6B3CZtA5qOh zK~NOf=)_tb3PMX&1t2$o$$ykvtRz1(Gg%9Wz^D+xGSv!6NH$Dh8Ee*9(g+Gsk_g=^ z60;d5V;Ks|1sC;(?dY-n264Y0ZuH|?-3?MUbg&Y_5Q)O8RP(wl7%3^LW(s%;9l!76 zq&Gg$!Wf)9O69QY8Oe7^s)p)`63eW?kY#|X+yFo{;3lv`q#2ckO_};zz#u>Yn6mj~C+P78pCp%HE%&(ItWOmX4OZifZR-sbg}NPncT#A0KvBtR8MJ_THvxN=I0ykZ~yq*-5%>K@$V6GFqwb}thY zn2H~x;iHkiWcpG#Nn2S~f^Z0eo8*w@fTd)+Gj7ZNkDm9rcRq&>CcDPT&UMmNGG<5l zb3b>c3f2=}#u$923J|QdTrg0^Re2{8S73SzJKbgOH`pW8$u*Ni^P_R zt%63s;bSM?u@bwjQc4+XkbtC?)&NEuKnZ3O4x^K7AQPjAFN`uqRcXn9MuSEIqZAP# zTZ5o2g3)LcF^S(7kU<788jY6C5-g!bFq(`JNiY&Q(;gzWmYIkNOM1?Kt1r-Dc+9*;A>kVxO4xGJoY42+r{{H*5Z~fAYX`ofiMOBMb z8*s(afL5ih{Hk5!qX{_x5wZnl!>9>?nF}jhEEiTbR}zan(Z&$5wSsDh1iJc>r`V!k zl#&8lS}@|{QvO<2V~CcK0WAWPMguH5b3}3#n>dS5*?*mJjx|h5;1F!O%gAU#VL`$s zFhV4TH*&vkDuAx^befv7e1PiE6njC6)fEsb!KX`gKoxc>5=5z-D$a^i&SUFg(P$7u z7ck;EYY<|(Xwot(X9AnEUyLVn8^^Q%tA~0UC~?Y304ybSjKQ%f zwqb3*uYc#{nr#;AK;IZ>r2U7IKC@XoMuoIuA9ZNcit@L4|9wb?H07FKZM@WyU`8^6 zILBv7TG}KHf!ZjQk`X__3`)AVCIv4+`k>$fF`X-jgJ9v7@0)hel)%F#l}8g4wbfe}Ty~Pt9Dl#GfSH?Ie3DpKoEDh`NP-y4Jx<(^@OVn(ADybEDCL)KQeE`R9+k^u^P^owEA@9N%ACW!M5RTYm)7$PEQo%(!pI_KO!D`|$mhXI@30yHFvD%f*t*noKXjPlnZA@S03m!7$Da!k%vTZOU&eK>kw_Jk$(}` zKt^UVOqxj(YC?ks37MHK8zKQw1om)tAEk&_E~aYGNIg+8VdZvJVEO$T2U#Ih_qd@* z04OwwPMgCdu!lfC#t9Ccw^6-t zT6`$L#A1gWF(tTDMvg5FlCCH5XCZ_{UxuA?SjhniF%pyObI1Ei(n9njwLks{G3zkr zfF46@$uZ+nGI?ZAF6C|hzz2}xVmg=U7^vQ=4I}427H^ONMI%XIN_vMRYJYl1x^Z#G zL1QkKy9ZOl@7tPGDl(Lizkp>dSc&(m{Cq5JCk zb?Ya7ci**#jxKxq#O4dfXx0$L%CH54NMMSF#*ud5+>O6GdC$4GrX6^8;fZ5A|8sug z&dqAZoUQMkS^V5n>a*7l*!1<;`=4%HGr4QR;^7ZIb^Wi8E_n6$H-G5tP6KHYuyN;Phzf^oAR{rR{5a&g|FgEt&I`oM=DtbX$uHG&jsU?w(DuR(oC zZNN-5>dqlw*>%^S&vvX>q=pYujY+l93-5jJ+>{?aq()CxbJpH;{N=ev4vc$b*ZmjI zcPzV6jhWlMVf&`PzJD`f-5k|1SanQY@SUHm?>lV9Uq-CRS|Uq?#wcYp5Fk6_TG5Y` z9StF-l+T;PZ!f{m-r)qGsHw9u>&^NRV~^FPMi~+MIzDQ`n5>)FMQOe zqP{vmS<7rKGn3r*5F`JIK2{`6A_Yc^ot-mtbMCaRS6H2aoPUjq@kbMjVFN}SRDwuy zxAj(B7I8$tmTewIfK$d7%NzyF1_AmjLD1{*BhZ3}szH2Nf1vpA#VN5*b`n+2*?#*u zZ9(6}WKzDGPz@Mor0w}`2~#JxzT_fylMX03-hQB;EZs(D#tOg@b~M;>?2 zt)`w>#Y88NWHZQ*Sx&NZ;xE5x8>HpNEJfo@FS|_OWq+IgQB0~!Y6*jmPY$w8);;kg zRZy718KGLNb*uWM`q-OqIraK=`}U}7=1zZN?~Z?eaOIXY1Mgh>;6E;n`rat_}BOPpKW7d_J1~F zcol^Y8a}B`HDk+GEx$5!y1JB<0l%ep$iQM6WjU z#ZaVNq5*1)>XMU&8(XETceZU0`}$W^NZGJNRG=!+Dw)66L~b(5$glt>{a!jYMYYu2 zVRO7Xg&cISg#nQlDb-|8+H?$6GJi^q8m?cWkwi8kzM4?Ma2^6NLQz2c63d-kzowBt_mnZu)}f3p13H`f2?yS#dIe1GUmFt>=4 zFTmX==f89DmN(b7zp#osZ{y|tv&WxXS$kvYrRVv?L;SV9YU5ZDAX_r585FlTvlSQb zR(C$S@XYheS6*Gde8JtbtC`$kJ##Z96dj*4d?(FK+n3N#1)GZ2YXd<6*b@{N^i{7oR!Z?7RaepT;fw_5G`h z-+y7--MpGfENDAb^x0 z)+mGqG?*!M7d-TWKGq?NxXham^UJa z0V%KuJqs8D`&O9Cp?|tZqF|?nDzv&}a3Up5cSF>&pq!3fW^{$5E+T?}(+egb$u$Ec z%y_lw;WG16$v!K)jB3J2$&JlV618otPu*JW5LJ6FeUg(tC2e)%%&saX+-9Bi%-6h+ z6`TF#s!v*udx2MK*6F2M$Go?acrlQ1Q_U~zgJCl5RY^0v=6|t18@JSIGv{q+P>sq^ zoU&Rf5tl3iFcdmo=qpXPMm3FUN?X!$lu}Fnsv%fuWMHHecPaq|fTN2%>)n{M4PG4Upo5-oD zbc&ReOt0$VlYhOSoFmzhrkr<;w#tnx8wZAg04+m1qL~F6t><>pj^>SP(T>4QuwB6M z20fZ^+ae=bW85sddFAH7v}7H*F`8NJ)@ip6+c|b43RX9=--Olx03*5??I!5vfUF|J zt|e;#3A7LPBkQo8fp!Az0=Nm;5gAL?ns#j6#Ej?3j(^awX4b}N=Xf+{MiXsDz?Mj3 zk{B0KT{K!o*P78Rw{vJm+7ONy+Zl2T;O3yU*c!CNt>bnU-5j)Iw9d5FjmOx|(0HAj zSv2ho8^^|ywQQ|*4wzB+t-j;affIl_>Jkhc5OD`l6!zE9pz-!0fpG!|n!IOGrvgao z4^601-hb=!2z@nU*jj6hK?;aSP`kuvz*woIs^Hw?Bz$P3wvb`bAF(k~SWvejiRz?S z_hcF$-(3pQp=lE;sNf=rM0#5iF($Etu@s0V1RcQ+k*3Il=>!l?56AKwL1>CpvrO&j!059&sJc^UPJg>``O9jN%%wZUpZg3*`oP;NhAf|( zI<{pj%kri&yrf*Fv$flscGRrjvx8|FKQ!PpRY_2*fkUOsTnV;iVKLXY`O z?unet-q?rUCr@KXt(F=Ar*VCKRNN`oA=-$6YILKq?uFQAnkS(aqN@$oXi$-m5JtGA zV}IaV0FxQ^nLVx|f2)=w<nz~h8t=&@0e=FeKua#SunmHYSxYJ*l9-Nqe?S5ydk^}3 zQG#|G^w>UWR4wO>gE{RA0f*(n#6$)=OWCGDw6C#tf){{kuz{dp>8h;`q z0&Md5ieV%)){4bh)b~TkD^4jU5nPEX=+5s$&@m>ZSbBvzVjBrQ6yu|F5wg%@g`ScW za|*O3(A0rOM4#MI@P^r`yP1WAxx`lh73q1GewSJ5sg7BO04OZrS`yd*##_=7(^8;% zQcTOBs%d?nTS-~#lui09({+GgTYv2qm!Dp(P6jMoOD(`PPgi~RXnjqD0Ux%i2BcJm z$KFbxJ6y>Y)II67@rlZqw!_X^$`@uj5r}RM|&{kAwnAHRN^me*^ zjmX66vz04lJ}Npih8dj>UB$*XzD3Mc5vnxOGJSVI;9YvLl(&#gr9M_uAAj34&4Li7 z2oR_uDkyK`N`of2{x^DvYB~&yX4pm+zoq+wIEDrDRZFK&9=z2@OldSL+ZtpR#-&gY z$Z#r!$excn8U{X~L1~qg2D0^fhptTZR1)!~U;i|83L*tH9==}&##)trn0xh+Obfbg_?0;(}k97&K;RAG} z2Q+n?1xXnM4LXRJd`NPUi$Y&vQC;TBqh7U?%zs^e2;F_z$5R@4p%=BwK2)V!x^ zwp+~#&Wfbmtt1K6!eTH7IwKjUyBax}?s3^<86b(5%HBR@Q%a1BeYXt4tgbVe6-~}Y z0v#D_*^J9z;J)&-q+XQ)?8AEdsvzK+1m_GQ?UYcOwQ-i6C4WaqtZ}N;&?)gSMnd;6 zs{YT|l`S`p!$6C;D0}|@d-nk(1mR#dm72;VvTVze05UcC3m{4i2yF^xn-$h)pzqbG&|SMZ$gUF6-VmUqJLkTfBJ$M_ERr7L7X(kH3znVOyLc3?12#)K~;MW7Fi<|?J{Z6SU`PZ zLc)%-mZx@HmsUt+=K6g&$Myi|* z9T>6)zDqc7yHv95eUMFAJ}}|_3G=)Fh#8139M^6v;wL(;PAXYOvzAJ0{~_hcpPFwh z%dNLPQ8w5KyUqHvm)L9#5yl1An$Ez&Y;2{zHh*@HS6PbI$j_cfTrfT`uKk2d47@Kw z5g}q=8aslHh^7c@ZGPO_9I;fr*qKCRF-UlkRX<7>-H?WQs34OX&e9Zc4TLory0P5T zH$%n_K~Z(FpecTxNZ6B3v>{VTu)#Sz#po=)kMSIr=U-+sc2mSlhhp{{eUx^4M%N9U zoPT-Po0fZQcxJqLGuz|%QtB%jBiH#Qc!b|~vCjs8199-e!#=RGf1c$Rphf~c3{6cY zN-hX-)LMCwDcm~l2azv=lgypVdTCf zqzYV)*pwlVQbyZRWxF@->x5Qud!3$P9e>Q+0#z`qyn|6khp2Z>wV?)hL-$;h4$P;p zdiJMuVEc}SJCgCd4lwJ+YWaTtFv@YMf)7Kkj17doBs-#(^PoHo3b<70b+R)}RvMR# z;Jh~I&eHOYcj4zbf5Y=$OZsg`tM9y#!r2lgl6DDXz%uvQ{;{jw2Z8xdSSB(eDSx{H z%KL2KJX>yAiH~*XYv3E|%+*Z#{AlUvIW}_zpXm(-1RZmXj=92xBD-@XH(Cvrw4^4i)hLEmG}ZycpHM z{vt$XKonu#fP^p``eN)?-z#Wmqko5hMMyn&6-wET`}#eUZna#6? zERFd;Yu}E&ajq`i3NP$E>eEpo!m(I3@L2rwTLa} zj{)`U;v~DB1X^n;2F~-c+<&R(f>l~4=W$8dC5Kf+2@T})HfZ}tllj-dBw1HHT)NP3 z5ga*i@o)~5^0Yvdu~`ox2@)d;?GToL@0I3>rNLh&Jip^G#(=#(b{)w87_f@X$06RT z1{yF*hw_YjdjQQA$L8)u7Cp1W;gCqF?aS$G%_7JE24Xe~5WmD<<$qs|>U9i+FdRQr zi6$!5L0V%VW>yY|AEpGds`e=AvJXs`R?tNdUJR8Ff*Q*je+U>&9Ya3hPgnH1f+2(GvMni&Zl%wPrd(GNvfFf9gG(~eIhnwAm zQPg@;TvBZPDCy0KQGel>`tQ;{&7K};IlnFAne|~mF;Z*q*#veOPa=dOlxN1-6l+Dv zFF$^;K;}_}5e7`6O9MV!dZqt|udf|2S=QQeOmlW{%Kj)F+doWsayiLK#htZDnUIp< zhtV)k%V|Xp9`b@}ACA*$vJM%-9X8epxcr(m$e=(7dtu|SPzm;l!AR!+*b?y?#bj4#5;m)`_aMgms*MW0Ymr1WV-^cIa4Wh zm}eo=~MeM0%AIqUE7`y1qxnmw{$unw}$7 z56ZoR@HJP0Ok@d_BcKjpwVm&bp?C4dsd+GzZ=G4@aNzcrB|rPGm$-{Pb@t@Vs7!#M zJ3J|@aeogl_*_}Tla~CF&}xLym@Zq(d4FdT>S-V02JU~E&$^P*Q7*d!C96~OhL6vj zHcAiE5DA`BBf7kZ9CH);KkutldL#y8-0sDfXIGc)m96^2Au0*)2Z>EMRWcA2dgU@Z ztb|n0tDv&y@bKhWomVb_%2DhX<1^&Cf8RNOntw5zU9hr@YW-DL-g|Xe25Q@<8_W+Z z<2$b#>|FP0x^6A28Z)(U+Ak7~i-7199M_woYwyaaCl_f^gr_dP^Y*SS>rk^1?G^TL z2MrLiZeY!K6liacJ~m-G({8vV-XEN z27e)#qQe)NLVKV1PVn({-6DZ}%aXU$=e4HC7$n+z`QPggYv)WC6Yk&86b&9y6*q~1 zMiB`OVVWXS_@2tn(T8ZhbmsZ$F~@ymRDN~6r$x$x8P36Wcne+JL4uZ>NTlkb+=Bb1 z7$RO9Um2BJZ=}56pe@Q1=TGyQNtAVtCZZpz0xjp*MGW z>fc&A`|m9aGA4vMlq?KJm-tR2BY*d_${O;Jt-Y`|#n<34yf9x{YhTF0Ey%<=C3%xc zb<{#kETVhxeAv~p=({l4unnQ)A-aZkBm*$^8-+#|)GBaU7M3aY#moahw0XI2nUmg1qGcH;;xm%G>}Yi=`=Yld=9OP9gxlT0Q-7e!7&dfV z+Dt$T_(~~)2v=O58kC%g@=7VqG0Qlf4u1}QDw+IV4$%YfTQVLFeqv=kD_uS_5zkAe zOC>_-u^sU6U`l&PB*_P}jIho$!xs&3_c|R@HH$2Kq4Hyk26<``=AOS|PeR3!#-Bhw4N(1`JOkv45rW1xvxZrVOr< zSuGE%_An4ZBHnfP)l%qxHC=C;c39_OCExce{<*AR`-xA%fqh%PdZw!39Qr+X>tjP1 zcJn4<%le&ID`5Jtyv^g~7? z!RYCy0MWu`QXD~+D~T`#lb4ywgGknZ60 z@Pf|~&85nzyt$XGjuJ~Kt6-LOgr2FS7nIO_X8U&Hk?!zjIe+e`a@{h^$8he0e|$F$ z$<#o9=7v+cn`LC?P*KC&9y`)QCgdKh4!f2pUuEN+eoXI`{GVFa!{u2P>@H6`*aYMO zR(D-@C}X~+I%aDQ!YnW3(1IMiWe;NJ_yPvQ{f|X%VnSlOM}*1CYi_6SaEH10*$w!6 zs~N1BNrlc{UVqWPr2Z?+jISHt8u`Ok|H6JQ^Y!w?6F>|8C7i6HUz6!t0-u_yF|o>M zpFCdIop?vGu~Pa7pDIXr3r^AWKE5Av2{`;iHW+|Jb4~?mXoC}hJn=9^RB$szF$T2^ zQLT-AhZe+_bKB4S-uLett?T!mSA!xlc$e@guz4PG&wu-Si%gzEx6my^2qxn#AY>4W zA|mtmrF+7Z{|LL*<+hD0yxcwavmkYAXZi|_Q`@mD-zK#ss%dP;m8HaXMN4jc%k=%9 zpg$IbAuNDuIQl^WAPA8-XTS4ZKsYj?F)OPptFSV1VV`hfVplRn6%ZyQW6AZGG$W~Mn+)j7%hbXgEy7Z*i$pz=vub4 zq=Yx*>o;`E9s0HHYZo!bMeJ;C2NRjPSk{V(QJa&&lLHOiyyeDV*-*C^Gvb|kX*f!E zt(h(Z@2nZFNgp>IEseG0VNgE?*~n81zEMr=6o0Q`#tO53zP6L8Hy*GhYHHyO);)T! zA4RsN+Ookgag@n4Lp7-F*J?%dx2qjv42#sJ)h)Wz&nefwDF9<2)EH&37Rq^_V=&sL z4_dVDoV)L4ZD=++d>Npp^?0REI~zqV`_!n8y-;WCjAkkHo88gD>*&9)CbriUu_;DZ zcYmr=GtJSaWVEyFBX(0c;RBF3^nSi|iV>nX05LK#32v1wWhzpv%sPP#K!-PM#R7y8 zv6X;sXDj_klvb#Mg`t`{xo`U|B5YfStu<<=-9_Op1&^r@^~WxDu1s%=+J%^@6%|M5 z*_5@-N&zRjG#tXV;%)~YExltaKQ0I4c7J^@AdJE+Qfyv3+Yi{zLCOlgEcZ(zLMphe z{V3cP^6i*|ghfS6#k3UQZEgOxd)EylLNaAHC~!pwJg7+V-(x~1+x8_L*np)Wa3d8_ zF}JcYtB7f->za+r!G%i$0m8rxLZFC7NhmQxIi^Y3An~@ypdvGI;(*ek}l~H}yu73woeP-e)!>0C27@Y*gDn)jRJTdwzeVdSZPyH$T ztgcjax6UbCeae1q6ncrX0dG@IboHgK!Gqc#wqJWjZAb>koPs5${A0=hrj6B2vE&pE zbS^dgHe*veMcL_d6LD)x(^tSw%@Iah>Ol`QufU%obBuDOJNZ@r39326W~TUH?`QORtb$t;YInPG2$cd{JW0Fd zy9x?LrpOeDI-N))OhO=p+JANi#014aOeOXB8LiuCOW;6MAr(*tV^BoHqzHyd5e-2B z94Rv>f&eL@0B8b*D3BDQ06KG{$q*D#k)6>9jL?u=*o{n4mEFjUvymyef(e>}2^eCx zixatkGP$7}y0V)##+k_(oyZv!lX6myLP?2S(UlrQSIU-*DVsJ~8-LejW>+%dY-ozv z&=p;%F>)nWZZbDc?eolyQWkCmGf|^pf?2syUMe@DOS6@u3%XEda^@z337ANeIXk&x zR>~%gY2%t*8t2BTQE7~_%F-ztICEo=1((K+v70rnjgtwQP!@LPESyCe<)zBfY~|$4 zS#)XSLRl#bFO{>h3xB$BR(9pAl8uaYspX1sRxl!0G^MOyl#J1sO;8z4P!)u?{|Mo1 zsN8aN+RqrKGT7r*<odjN8kilA7Tp_6vJ?kCVe@g>gW*~o=~a94*U1lcYdhrarpK6` zFg&L8Fya%yCzu{XdIInx;*WrT2RcSNMtqjw>4Hy?*GOx`HSj6Q8u1w5X`(gKKM7AU z9jAC4@gK-PBb+2SPI!vxS&B~q){st8TqB%vJi&BI@f6_%;8~(m(w_vMA{{dxGpsQl zr}Ql08h`Nw`2={4b}Dj0a2#ok{1eG@@fT{(*`JfYK>j)UOUf^)dByn^*)O2K0KZIj zMt(;6O6Ud2nfitMnfMvyU&Sw2UXxyk{ibrJexCI;>xIY#%elzEM9)nxR9>rHxSWe# zP`(g*O@5(#PWGnJ^Q;#QpF5ppI8*#p^qtEa(SJ9pZ&co>ymfu&^49rn&R2VUnc-6D z+T?@t#`vAlrOAhe-aBvHt{Z!w?K1N_(@mqBESqeXE4kc}s~vv7(yNticJ$u|zB#bX zzP{h{4+nm|?^pYN{U`tMXT3V`s{?z#W1FRKc68J1e%#L=md*8EzTR)H5AyYH{?Cs8 zzJFsMcj0tSJzxlM2 zKQEgvP4jiR{JLts?&dGc)qi(af2>wtcmBuN+5Nb2m0{d#JG)8RA|$TL6&L&mARwh6 z1f_)vLX%Jhh2~2oKm#%J)^e3u!)$XHOlbQg4H|$x7;*Y@-~Z4PjYnx-9xU7k>e% zbtLq1Xj?@&(MTDoHz(@a(h6VoArV_s4r)EYxUB`%HnLd~Mby~EX+z&OS|yic0@R6W z-KFWTi$6+Z_10K<%zxarN^yzux2+>pKhG+z={i2Y@oZky8rF;HMuB;^DTA<0h+2=N zXvBwBzR${^u_E_gf<^AH9_Z|UKY!isoI~1{E8eYTUoW>rwLMbtW49G{jf&u9VT$(? z3cH<7r`xiDRC;fVw;Yvu+~S<5O_IMvOSd=}+JB4A(O(_i_!qwl!_9KAJ{?^xN7uqI z+T|O8z5;_Q7_B4OnDTWX!!ztfDu~~}EGTsRBW`BsIpxB;` zf~3=A5acMt17vhJku$?lN2MZD&88{}f|Mc(GAh*&L{v()tA?0FrHMikm12m3P8FFZ zWE#`mWQc;y5;9Hro*`u%p`@jXFs7v%p=71vQxgRhVa%qQ&NQ1DT51xK`4i|&@lsP% z3=Ip0pxNAsBd{cBJ~gbgbbp$OGGnNDX=u>2G*M8rOjv0MstA*z<8o$2&>S^G!-8g0 zO)(Ku8$nEhCYaDt(^7M=@yw8t@R<}-LogYD7=k63kr0cSB|c`Q8hXJX5vUkyv73*A zCZ!pHqQUUe^3pI+3^ezaqmgCGKoLk-(7epeV*9s0d6vop7`q5*{=|%R)-QM5tIW@hqpH38+yaI3{sW)W%|TA}jqhY)oi-mDj+6e>i^D$=`V?SHFF7Ao|ldKzMVe%~f( zY(r1hg|79jq!G!ryi>BIY0+pWskc}f?+6Qu{G6J)HbqYDlLuuen2Hkv;JWg8v_qFJi6VM_{l{b`jYdwaxL}c zT33~}K}zn=Uw`_&mF`MsWo4hLU+;v~mwmNfnP(1n9;|`61gE7$TO2i3F1AfUU%%M; z?$IVLZj4`OT(k>%kzRMc0-NT!b#+VSH7j%5Ho3tMtk}3KmYKFTi@CIhaMI2un>`t0BAs$zeiq1_QOX!ZIJ`sD_SKc`J)b?rq!IBmS6;E35L6bJI%adPE)6eQ`9LAI!41?%s_KU$&TSZ6PSu%haq|K?v+8% zF=QNb;w|$jDGYyylshXS=cqXtj+Q!23&Wk2V5n2vSpm6(NemO|Gl^qT7~%|fX$)hD znFJ%ja-T7uQ?MK}<}7oDdn+*KkWputv(#DcQsHv~MnIbEZhd?E>{nlZo_}zi?HJ-T zMI&7v`z+eAiQh`Y){l$97ytPD&jRIWSfS>hIfe)ZCs|*DGnI}E6~zHOUPmviy~(`6MD}IpE9Rad0k>k?!|U`^W5JqfA;s!UU^>& z%$duCn+QMV&c>KApT@8y+(cr|A!ja+al&0LU_y3M0TYRq2P<4Eea0~th2h>XmnJxg zVJvaNF=c;+mXHgdCgpWG+xq;g$4}h37{518Le9}9m`X4)rovkRnZ%qronXp}RD|pF zUP@igFpGVr!*v0<3}XgXK+21B^8PO`ytDqqt4EU$Q|VLcQ|dE`6XtX7a$Vkd>F(g< zolBqk?bB!PUFFjW!(2elAroONA(t>_K4U%;m@$8E=I<_GLVYg7MEEgt8N*cgH2vtt zsoQ6JM|#~y4y+zJ*gM=`TRXJ6wz{^qwl4#JkhI*N1N!#Ux#yhwMK@3-r+#1h+8Fx1 zXbI^*JZo<>!M5EYEy_^px2p9qN*&QwZ{aR+5ijm9jd8@4l4~yPsOSOPV54mZSjBTu zCv<ItuSz(=E;yi@}V|Ct*n zKK+}oKY8o)EAOS33jXtgMKk;KpU!{gwHHqPefYIMeDC<(3)l7pb&~GoC*OYg%dee& z=FRgza+?Gb=1sJ_b!_|PFTHu@*|*NEmrQ*tX-X;@|>$tW9*ug9jASjD5n?WEpBX$H>!icj=XO|E-j#E#1*Nfb=9XnoXf|qzD zwH*YA#TXM7>nzfd1P0<{a?uMsRMCGq(qEu6-#Ple_kF+T`904XjBYdHp-dig=5S?_ zLz^&IdStk?!3`pA0^rF`o&ZD=5-G?lP$GC^0_uhA`uT$JlRm{I-NG$5c{}TGh=^%JS-^C zMPrRBXUQi{ZQ-*f&_`l|)#SCRhpJMXRYwO(q6doV1(5RFo92L|?@AJ#l|@hMA&&(W z7?87|ZW?saFwZ~&3Gp}~b+yi*DT5UWL#2PX5Pzh<1Yfe(&vxWbHfiRJNsh7ZbwKU{T_TCUr<# z!vWYrPsv36zPoA2a*v6p(j1y{uF2wKA&$u&s*Qi7O&r#i&9!4bJIa4E5Qjtj%CFEc zPh+Chz+tJ5ilYuqyhBqk)eL)SP-L=)YcikcQirr3KR!{-cbFxsS+W<8H^)BK92u^9 zWwOOkgoD z`@v1McD5Dsv5-ij0*Q$f=B7c8fCUC}k(kIJB7?XYvuHzk*5dAhc^2lZ2*;R3*6e0b zjwY76H6v9K2iLCq)w&H)QEN7=S-URswaADSuh2?5;fm#Wg(83Ws`v%Iq5vJdjgKp&& zhFs_)*B*x9_bV!R6r~=DVa4({9>^tAlzE0~&E;KeDE7Hr=No1*6{|qS=~pPdv!aG$ zl}a4mjvlDV2rPd-6iLUSZZyL9w143#Tl0(Ar~HqjSR%+vD7jEQ)XXx}lY~0#6|)8v zFRJ8kN50x&gk@oD{9%Abaxq+xV_$9(RCGHl7Bv6=4tE(o+Iug}=toT)c8W(kp2M); z8t*9EbS18JfiQaUUAGdlrgWzly0(0k5YF)s(`ymQEjziev|eViH?6)3W1cT+2KH^A^P49sQtq=Z$n= z`CN;e+|ieGQZxheJ#Sr&E9H#cKmGmCt^9rcMc4~FC=h^%n*|yY7*L=Q7Xe7LYM^r0 z?d;rXLmhvIf|Aw55tw8vo-%B`k*r@NA)bOo+UO-Wf0d9u(?ZODYVxoL@8_z=YCB(i zw)vVWVXT^5KChcOoi$dj_n?^9UNsG8jW)*(R{#2+ahm5q`+{}*mDK!cll{jp58p4@ z_aMLP=P%U#<(qD19GeC*M)jL-r|o}~3oSB`i-Laz8hSNcp)KC-oRQjhuO|V^-Gu+M z*oT_^|2<~?@!au|nm_i&v@cpa1-fXmwqm9k@iDk)Zx+xGzD{oRq87ImbX%)uJNNXd z+x%>+2Y>&DNJc= ztn+`82X5zOJZniEZisV~(u-&7I4pIzI&)ON^?KH}8|mQ7Gbct`xAh)-r}tQ*vj*|^ zV4iM}C$?Qu9T~3A95WmosQBI0geo3HL>A&1NMJyYM%*@lqcD#R6o|Yry?U_m!-wS? zFC;X3nNG25PcJTVB_0;=`oH%%L^9eS=igN@0;|>*(QIB zzY7v+glB*`5^~X~U`0h6%rh|0LL3XaXqaaafkNCgEKsn(KpX|}BqA^<$C69kMI)uJ ze-sh%o7dN_kBp3p+7PuNa((35b+4c)k?Ys3iHL}dRLHJcO&?sL>4#x#hXGEk=F|u6 zM1kIBxzQ%bBPzeUkq24@o+zs`n^1oQ_fX+#;fW4mT)tr%K}FQE8Qilo6H zkyBui7Zi{ZYB58B-4t^H<(Yr-N-+#gbrrQ0DpXH?X&B}kRwS~>i`}3RX&8U~nPP%w zP{W`|5D2dp531Bd+4>agupkXtP*b$xp9&?)4$rJpT+bl8T+mGAwM1)1%y41Spw{3e z3?8Izs^zrDoH(l8^Dx7-Om=wi?Kcusle$I^^WGJ8{HV_0qxF)xmN%N*WZC!aJ8r4+ zrkhL>qvxPDuG9QO*TFm4F^_*rD?Hd=?&ais-vGGHh(Mr{z3^%4makRyUb2&;%!@s- zk8)z1Irz&@4Fa+IdUA|;QYfy$M7EW)L_a7{kDY(S=DX{kBkx@P zxZGvHm%8@cO3a;Yz`XWO7m4sT%fi_s{rP+DXM)S;O2^@-e?*^f0pOy2>&2wFi6-?# zYyM0dfv=D@cFwjchMIaGi4=Wo-<IO=8~o-LU%?dVOfOnbv?HPa1Kj#^{MJh;ekxeij zk9}pymOUQ*o_YW8``+i}%;YKw&4>PY>gc;GWU`CFol;K*p((k#2%7+!z%hZ-RQ+Al z5g+`+iBi;h_{|F!9qxzkUw-V}XR%TH%fJ4?rLMpR*Y1Dy^nJfQq5b>i3pcQ@{{F}1 z;gzF*dG5P!uTXzcn~Pt3=(Tf?f3QvX9o#dw_Gm6JMW-#;P1$XUj;VMZ!D*W5)kofV z`dja;G088UdJjMHt8Z_4BJFkVd-Z$UA!w%8&U{#Z;I*H~pZx6j+pFLF^BFd}y8M3i z@GB3Wyirra7X+s*I87Ovz&0eOEhoE=z4^@9zmsS8$YXzhT`i8Zuf6_6X{3Dro%Lhy ztq|_c+D-n8*T3_;FVqIw*I)n9xh{)atuI|ae*f>DY=3fX`Gd*>Z=AZ&6Oe(q-Q!Rw zC~>=CDP^d9<@%FP{i9AnO>|As-BH5bQ#ZCBeCq@j>Wb4AJW~!@lHWP@)|n?hTvLWG zaD%2Y*fD>i7dQ9GZ~W=_s@=Hqub)5r;rha(g@w<~9s11S!r@OX9V#pwT3k4^GV zc-LuPSeRd2xMyL0uCOpy81rxz4nhQPQ-bF1pn>KKQ^w`Sd+qa?fbpz9;;sXBV#}CU zQ^~_xWG{TgKbW}aPhj=4o5Ft?j^Y^}r5P-Tsd{BLV>C;z$}8TC z6FDcOOrHNJk2I4VwVoiOOhxKVo!*`L?b&se=futyZ1M^@d0KO-6v(p|WmR?FVxH(V z%pUvA&NfXoG3AZ0%rM*?{0;BWVX}%a8;F=Et!C@^ykXe9?1jAM&WzB_?5P{SB4uZ) zvUz{S<7+;zTsL)=Wn7wMUpjd8#7~#Wk-FZa&hA&AzKN7wfe6I4z4E4wl2FBMX|;#f zJ&tzdiY=^miSxHA7rNCd;^Lsfny4eCb>=Cl?g{G^|_5MNkFa!2{r6gdeXhGJhFe> z;}QSLrJnTp-#q?|g>zw>w6)EBc4eO~_Zi^p0CohYCBi0f4bd|NrwN=k2b+~Xv(cxE z1HNW44V%~ePJN$398z*yf}`Iak7zi`>K?w@BQ`8zy@y~fFFK~`bSPV{Koa!;@3z6f z1g;8v1L<=`i{9!|jHd#xDZnOh3=w}e0c`Pumh9~kJ+bHrqN`&zpgaY$1p+F>KqG9W zWHBYkBaTwDH9p*}-(u@7;9yI1T4jsFps0Br-ZfF1FLkNRqkRr{0PnO|$E@|lx}}$Gq1=C`8=flq zEpcE90|P(<3=A2zWT=;WH0>Ekk0X4A?8^vL*n!5tR@IU=x{Z>}vaTk2ZEj#vj$Ybl zk%54_5@PYd-{I^g<(S(&v22T|#RF&puT$%SavyA4LK%W;k7XQ{^Ev=_$bp0mSTWE6 zG!(C;x^3DqQ48QuR)RL;=rVt7N$wTQQYseBK(+PHmoEKnZT`{u!o72cKYe8B$dRR` zrG-OF2XLLm#oHOw3yX!h#fAAo;hsA-pYb@SgDXX$a5qD0{{Jf(Qwayz`T424uBraj zJZ9HaN`1D0GQRVkItq}@)ykumWn*+^cW`DXr)*DTLU2snL8n6Wr#62_@@}G80?K&J zU_5bthUl3}bD7El$sX9$I@84P%?wlV3{&*fWs|L8IT3`l%d;!Fs&`JB9-i4UCEOB_6(zisR(WP7sNGd7+>mxUQl2)n#I?HL)u*|t|U z1uU!W#uv$W)nwv_&j5eI=5ZJE-jiqPpE#=jJx;!KTKrGD9x7O3)?*nRHHu9 z(L}(95;0WqR6|n@O*AYuYLSAaI+5sjq7kWv4OKjmnURi`pkhEqfC?olR*6)@6QdUDWZI-+g-q3IsI2?!*+FI5s-1HX zWGM29(ugHG)tG-srelFlMJkc;NF`&rk&0BpHzJM-IVKj_SYaZm5rRex$QTe2AR~#0 zL?RTaSSAw*iG*6f;faWbJQ{Ln#9=W&L$U4)h|gmoN2CCWxth!FB701bIE5$YjR4LK~9 z>Jg}fd@1%W-B3G z4wz!Vlw+|AymN3JmZ*X7)*NYU%8GGj|5C3zAc$V+6C z=a`GyGXo@;hTHD$dA+4nML+lP-1gbqylh3NK~=JOI4lQ|9yJ+{^i&2U*3QF z^!VNL6iPBI!$1D{--o~b>+kL_K4vc|LzJ0Bqvr(tn`MWG4SYnTz8Hi^j z+of`wCD-?ba-La{`~S-)D+ksxD|S|6ch(0mHTy2h(U!RpWun7{jF#D%cu78MRwLxB zG-GK!v?O)9l&Mhud?}DI`+sK_H?wu`^*i4JLhgAI)q*HTknn+cb`D#ItvjA~*y(X>vjz6R4(Nalum;vZ@6b)UI&8he2Dkyf_PB{y zlj{UG9@pM&qH6;-4y{8AY#go~)*gSIcfAjLLhsNA>>_pn9k6%9WkEMI>#&9!dbM}x zfDUM#Z-d(gv<@4f_h^IbgKvYo@xEhRpU!gaaP4v9apSQ${r4W&z_kuHz_mYiZ{x9c zSbJO$=@HU2t7++kkyU=UgA$He$FDYmY9vouG?Y6E=T@KB5h1 zBl_sN=ynl1j}B;o&iS6G6SpPw9xcVS#!k_Ou!+76XuaFOt%L6fUBCudd*3s9LL1OU z>J8*y~EDCUBK46+vs*7-cr~H?10;Vtw$GJ=UpGLXKcxJ z(RC4RaJP&-xovb??|SdH4n2Q-=Wy+D9evB#c(-x*I=T(JHDT?rap>XO7{20g!|tmP z|B$3H&JrXmd!fK?j1vpKV+ zHC!rH&z6uZ$x)nDjn1-R&s;1QxNA!_pR;0UvxD8z3_7(zXVVnQ4$OaMr7Q`e%sK#; zbn#~$T1!ckC7Ns%X@aerl9hrAmdrs=q!nN zR(ra9q^J9X1ko9V>cW3&yG*N^EdpAKHZGMiO`rDJT&wfMGH+h4lI1GpY;{GZgLo^M zM$@QDYEd}IAmPfKm9hpQPRhnnh>Qk(STZIh5)u^VdwNy14yN6#T> z3_@gs*txJt6e1fmK#5MGv7|gm&<3GsLPA)lvL@R$mYbBDtd(k=Y?Y->TpO>FU8QuTR!eFuHKu=++Uj^ZsZ=V_+H{p{l?Lfp zS((%(m8GV#rjpuHlT%~160JpRwZ?R%!;#t~X_7V-)ro79Y@AhBNoti^xe{F^&cc<- zz!EYZphBZqeqajBo++HD$S(LJcQAhOjvSXA@u=rE6bwWfq-c+9DT*|Xyi?Zq)VexL zhGphK?{$AM&vcMBh{3tjG4O*_!>j_z1#@#Ycr;s+ayhZI48hC}KxGhpbk~>JDkZab zK5kuP-j#u#CC|rFia@EUUxu{G{w(RnmWimdbuO3H{b!|LmXvKT;0304b{bDPJMv6! zwFDn7g^IK5L^Tby8o1JlsLXqB?a6t*|+ zOo@NNVmfSNH;#5~jAK*B>d+%>Pb0IBVFU+`Ef268;x7c?k-b;ak3B`tOlBieXV^wG z&qxG}6Y}2|=ARu!{aKY%$mF#45=zS1hBZ?h*J{}~4dgrt!|C)mcOF02a z=2tc)6Uio(#N(okIk6b$Dy1ru9)A)|I7xprlB}sRJArrxKA+}Hrds9yQFbjmj^swL z$b7QY>(?$|uP?I;ui-fu@X0st!GN#+|KIT;$P|mO9yf$Wk4CC0Nfa53jEtyvy6TOE zydWhqsv9rii}J;k^(hAo1Q&eKUhH*MpYeZwXuu ztw~F$Jvj6a%~tbQ>2c*bUpXa8i4w{~(WN|pQ+md92?4j7p0uDAhB0~Q(LH|{?JOD4 zrPg)Xy1X-3%f~ROen>A_$^1+fT$<=Fd$6x$NnTpYOI^vBM3V?HE3TPS7J?}ai4b!F zcUEJE-$9P5$}P4&6EPDi_K(2iXVxH`ufn_YjWdL~Ya3&J`;N0n&V-M*g}~Klm1e6Y zStUJ#g?lAIK#)LMJq!X~A;o`E^hQWM@S+w%M8d3!-8Qz}Je@9J7M4JSFLDG7nQ}3C zsTAS3xz^4RK@wE;8~R@rK|n4I~6b+p+VZU(PiLh2~7{EL$gLZ_~M4 zbx`o_c798)W%rT~#`b?pc51k`xz05x6L&9RZu;FZD7%J>r4iYz%KTJ7u>5Ea3g13s z;s4SV&61{FSoE@IZO8U4&2Rb&$lSWWOtCnmObiB$BW_65ay~O%IU!GUr#+g9hg}V2 zsR5enr_pOR)Ds8Y(oj{LyVD03l2G7lcY@U zd^@{J4T!dSoDQP^kyIMS&5GMy{B=_UQqmz0DK2-B;@N+c9DGv6aA4g6SZISLwNzK> zE3x8=>r??#g4Y#HNe@^7BDIkv1E|f+Bn+V}tY)(c07x6#TE7n6V8g?Or61li_~?68 zVs_~3;>+N-o~{^7DTe%=*@l1kw)T6rv7Ea`5+mI#_63Nc2*4^x<&db;jY@a zV2N_3CtzC2t@?I3uH$+srK zD)ajI{>R__^%wr(x0U)}C4asC^5wg)U($Ca6Dc|xC@=NZ%e<1^K5PhF#kMmeQI>1r zzdo$VvopFnRagbC6)4P$iU` zQb~WpU~Wh_1?^$R!fGAJXviaqM^PS%0@Gs$-?W)g0t*@jh^q2Ers!ldGmW|u?(gbW ztfKB>7RN8IyS#2x%^Zt5R(g|Qk^%$8O#le`%XYK7SaI-JKmbvd^Sg*jHob&_LdeZu zcPT~9*ewZXH){0Bn+Q><2nIw^duPl|l+Aw?BuBhnaYGt5wfjL}s2bvm86V=as24CL z?uqyI9pa7AqH-~%22!yBB4$xRvoVl&>qX3nL?)?<+FoHd_Yn*@eu!h8dtV21G8d*_{l0yvru)@U}7IVrn0(X`IL_+<}{H>pl&i&Op6OJV%FmEwq!#8h;=cvWynm2#U z?EN&l3qRUr(9G>Hhc=>JA5FhM{+7ssCD1$owZ{>V^AKq@=@VLIxcKF(!_pxlL`+~I zpFF`ZysvbjnwfGf!Q?4Cd1>=M2x$krKBM7byMHjCo7bm`47^Pr9@ zed2D#gKint*LGNa|I>uJ2fu+xd!jZRP^(C8Y??tf1S|l#(*8H(M18Rdr|^#d$nCs% z018s&bq6@(R(t_NlUpGyND;%)gh?2e7teizr&c7QiX5eXO#NI`vM`ED`FZhuZ%(gy z3RD-z$&^KvMa14%lU3NHl5Ky=kVBzn7^ANL34k)l9hQ{x@a-KE2Yc+Y%wf-)HG6mHZ5?{dBRPA;r?{qz{i>CcGRPkCz?A^L})IT!F4;t?t1Tyr0~c zVZ}R_svUOODQZ7;%3tEkgQI_MFFW5kcIc$qb2|^MPo2abe^Yw^b*O)5qidO)gO=xo zoNM-NJ8M*z8s2k_=`aj-5}XI&kw?+V+@rMXHQSXS^FBdy8D6n_LzXT+XA*Iim<-1m z=$6>P?4qn5&n3;}<*cG6qPh%4Td0aYlcO)~76u+=+1k*v&`YIW)G0#>Gm~#Kf5pt$ zUgw&o!t=J3fw6MpzPo=6XHv=3GU2E)F=Coxw=E30aY%{lV%g-qM1)*AAy!c^Mk<=y zqKK`0X3CUV1gj%4qsJBNdNxTWq&gBXD2JIUWGil{s$iYII^jiNf?iuAZeCp5dfe7* zGqbmFSmjctVyW>W74!hIyzU2PdZLOq=h1-xyGsC_dd7+X6pVienc`gLHXxN=^wZa6 z;w)?uWx>ZOnyjanBBe=|B&Iz(LQ}FaJ{5wHoH-Nq-TyA z%Sm&XyasdhVZKi}r<|{@H}a4QHnb+@RS?Xdu)yclkTJD(3+_ed_r4 z>DO~tJnH9%ff4z%$$95LJ6z0_B>8P(b>}|hvhMsV=P-YQzPh;_wX-h$9BDRa{+IC$ z!_a>K4&t5$44F?rqQSd@nMttZQ0radM$&NOCUaMEB34Pl7ZC|Tn*t9(W>zzm+7A^4 zrX-wD8j#wHgn|No+`W-Bl9(z7fZ{^yedSu5;$AaRyP4cTx`-;+BcLlF4>Rj11Y+gB z@C2Muk%51(Hle791Yr}^9Dm(fjF?4rXulE>cLxXn$dImO2IP&n0TzI;i8IQRrwM#x zjZFzDNv|EQ_)moZ!c5Ifp%7}Hh)R_wzjewr8c@vZfEU$KUae9~nL?n-{>RwW^jcaJ z;qLnCb1%#cqcbWH2N}l<2BHHJ3628+*_dcFCMJJ|WQ4^yVc}Qe#)K^z7sj}8<;vgS zf~9}WMRoV7x2n1?Hz#CrIp@9aN1yJe>-nfT!uxci{vD?IXk7n#$NKlw>bYN8U)e~= zH&wKL8=M{$~{2bRA6B z$KVv(PUS2KX&uK>KMDxc%~YA72@2O?o*LF};Zf$%fc0fI13&+tq-apjN-UD!WIxITBsl2|0Jy8N;N73AW z+T^iKoSprSTse>&R7z_w(JMYzt3*Yv=>dT{h_EJ4p9}od9yZ0o-j&c{BNl&gb(GC6 z0$9-G-NJpb)7>%%}bvIW?`U5K&iDXr0CYh=Y1`pe4(O zoGvdc|6;wnQ48#ZAX7nNFX13b5kbOUmXhwiwq=!roqJ$DYpdxtsD4T^Z(8TAXgC9! zAX7mA;o1c*Ox*Rb9cUr~lWL_a!5L+a=7QblH4w0c9afT(f?CLWh0K4DH%DQ(9>uPy zhZ7I3de_-)eGHjM%lj$)zhb`AVvI#Xc1erU$TUN2mCCS^tgfuZF|cH#)mRxLna2hi&*z^RBmmg z1!-=Z{ouUnqUmk86#sv^g(JeX7}2(>UZe=Me;g60>v6PJpN6eDn#qAbmr7!5S9=xq z%6hhH%jIZ|O*;q+M{Id7^#-~IMwW6d#K0GD zPC6W^5TCw!`_-Smf8(XEm0I-gLr6+aHxR1^s6(Tn69dNYfH!cSl6$9r_dDQyHyRS2ZlQF!jG2baVuw`5`y2-f{a^F2+F*+$49 zQzgK`{%{jzlsZxon(*bU&k$*?G52-462j5yJX2U~t-{qy>;gYC>+mFWYIthOMn%h# zOR1SE*M3DIQD%P@Gn5tL$v};lRlUG?Y4t^GIWzob9vKJ=q1Kt;n8zb0@nJdLr^EAp zfF)nt~5oQy06IrbTw@wXi0JfgMT)73$vS~Y6Q9n3 zrUXrVxM^F&$hW4YphTdpqZDe7rUf4d;5Ob4;JR{1WCm7#nY8lfn*LZ-ll>;H`dxd1 zCis=own2ZfiJ)UDODP4UUfjI){Qdhk@7{q+K|&&ycG+&-x_;|BtH45S&$>rP?xG4SHJ#W( z?Z-A)g$I9h){UOJd&mk-ZC%8XJ}UKKqg|akn28T2VKliOE79$*)9mA=cod$(ta48PS zY=3_o-Pt~klr&%v0-FrODJ1G@qyb!U95f9%jd3Q9ri?8-QWka7yvD^?r7;Hk)DWxB zh+Du-)^(~lai*Shj@yLD#r4&Ge`8{1y0LS0nkXuaLF|s6-hd3(O*gJ9tGRR)pa;i} zwQ&rjxeuGCuqx7|p3+q=UtHjw1|XGN9qNB8sz$FBsYg-7b;NQmR|eAfRbbtYz+x0v zcTCmOX)a%yO}Em+x-sAeu){YixtQDGr~QmlMSQA*Sp^=hCJIX(&Xb8s6!>EO2+sj@ z!1dy~h+JxfNVi2X0b}=rA)w~Bszn~b#^l-Drx=mBnhN*y*q-8zv59H(tvd851$uu{ zxI@Q|$5H7CbaFXN!)NhPm(l$#e#=(hV!Nn7eZvwG$fgEuEntn#-ixhS3lu z-KujsDN@n@vUGbepBf$G{O8iEE@FLk_suMF4E@Sj{zajK7zyoEnViX*VY(5`fHCgq zj$>Mr)@Bw94FmH`P8)V7MrH?woDF|?#N0J%f);-a_woccEUbBMv)w^IXJ(Rq&i!qt zrWWquuJ3YPl>zZ^_sqYg;-1n&dXSi!%4ikB_R&EWzBFlbKQ}c^s$UkCA!Rw|_w_aI@Q8^@-cAWSVg~)#A{5l+2?{^-Nj>jY(FUfVIuWI{tq?=3_<& z?}~g$XVO%R>4=GR4PKRMqF#9J=40?$jOg8Td3E*{Ydmo)WlCz;DR-`CsYf)L(&Gxc za#Y2wzugeVWoFV135Qs^Y@n#FFIymVsM`d>^YBntT6XvBBaSP}s!wE$?v1f*5SkOk z9*QergZn)p_0?0;F|sd?W9WZeJuIc|BEEE`CWkyCk+%Y=Ddt;+B3cyUWI8FKlLjI? zKivT#fmD75rJbZPO6x+x9@jIg%B)E#KvY3HkEoOs=Webi=^@3&9BF{Glbxp>9Zm8I z>0H~tmbI2zwNO%fNe7r^PR_MfLPXFi2oN$>Akqb=A_)-_0WooFM67=|h!KSv6Coop zqd+C9V~>k~#DdI7z)gU$OHWk9Ak2-Bp)vw1)xs*9MJAG_odf`(N0Mm8#a^k|C`2<` z{QcO}_nHlv?YPu$DH|l=W|7fpA9E7KGidM z4zg485gRVtLEh-RaQ=S?5sH8awMMN~tjIvZ)KqgL!bsE*8!~cZJ~d6`>y;j1Vq_6e z$?Qo0f#@vssonNf5kYS=Gb0NUYqkv{l>&%D#1(3#I@?rHubm(>iJV$%Bff_b8{)Cp zi>P6RggU&rRuJjLr5yQ3{i-5rC6DGq)UO*8vWRw28yi!!St)3T}bi zr$||5M5&gQ&@z=q#;*6))R0;cU3nvAmp1;=Sl@D6#*J$u=GLeEjbouG7DdvZH0?K) z$n0_0N)8+|AZ8$V+9g;?@ED$^M;VE5xdbF_H5K!09HDQetnT*4hK06{o+?u3M`9en z3Y|w?^WiFbE)jpmp*s)dDBV;izEZcu%HKwbyi&ENLo_y>NJ-3Ref1kpKmNsgKYUP1 zdEw^GPyg`oTMzEmQV_V*S>AzKi$dl&&AHTDcXwQwDA0dHLX3b=i`=^L+^2tf`oW{u zODT80a{IGCKl$Ekda4@#py`7`!hli%YJrzueBtx|{_DLTeW#RyQ~|LRB1DlB){FPw ze)yk%|Mm0#{qryX_)RGV2`iO~hAda77=K` z7E}}z7#9>7WY`o$P};DFvPf9M5|#k62niq{i=ecMTRV2oY1`A|9D6?XA2T1KW2}3t z?5~_0l2mTpdhh!@@9$|Ta&xw20CEqf*4GxPY&m}hF%;r~W+<9MJWsQqJ1fjr*FkWc z#Urx5{Dq;3MT}q{Ar7Mo7+<2mX%Q$B@g2n=PGT>>?aa8uD>x6~Txy2?T-@MqhgdVO zCNVBp*LB4(R&%52w4JZ&+_%v%bG}NMAXqzZ4qcPE$0?GCa@oG8y6!!}9=aN@C2&kfy({vbX0S*@uIi ztr;uCQVi?hXlJ^wEvwA}08S=n5TY3dC>nqPiblK)fXX-+zxKG>#a+R&=A}=uX44SI znFT$L;{YHjHhjjQ86Bz650+g#ljLqImr;Kd&&wIa1JD38%`hB7<|8%wtTa+I#UPqx z7yxMNsGK(4QmSMWfVt#h83bV7DL&Of49ie73-BqQkfuJRC$lWeFzo;H&nypWe}yw9 z))^*F@mS7Y;#x2<$3z06MVvX3{*c6odAyS^W?#U~c4Ddb5+)Vm7sq`?5?FL;CJKM9 z;^FFmggHs#8WK&1!e}bytJzN+8icnZh=L;#oKGYoS`t&fPyjII3Q-gj09z%l5Ahlj z6Op79F5;M**m#j;c`A?*Bn}A@dEF9)g#>Gn#*&J~0?CQN8pJ@*uhghx=?Sm421kd> zk7YzAMTb3pIC3&4ba14)wY!jFKmmWYgSw{S;ieOLNgGcMjduzX;zMR9JD+Ub$_6OVE^=ZyUEyatNBz|kP`xMklWXmmM=^XKG_)i`2KFfel>pp1pE09 zb>3W>zoXR^#>A-Q9I{vWI;(>E+BF0EOF#o7B=X zrw*}R5z8Z$zVUF;P&z$?I08m9G{YhQuIzI0yASvC^Y#XMI|K&oaCLQ*b7*>^dt$ae zIW>51OmIY0xJv1onwI$c9}jD*jz{@Ah6Va~c&imECr_X7sEFj%`Fnqcff_$wg^P6lQi;Bcjay#QKl`WQOhGCD$mMbh zsQ7&$qhpQ6#fGVws=eVJ08o%~;@Q@ax4X^JgR!&5o4NUkfWRyfF^n1Es{}v|n##?! zzWtHA6Jz7ry05y-&l7eSI)Eh_601gXnp)#0APpOZE~{H z%ge>j%X4y2`*eGJc>J1`HKGy6A!M(RUoAbgu+(~grMdQ69%3l~$jta|e4^2`&^TtO zPD${m01(5{W-EX>9t&ehi@ET`3<1QGsGtLkR~vX&LxLhoWW|39DEP#ZMKGu$$etCb z8${*aa;wFkwG!N0;s`M@ni2O#(BGob1*R83wVejJE^ErLd%YZej4;`6F-Ntet;5lQz&(^TXA@b+=zK8gK9L zw22G|X{fDuu-uar?epsCSZQ&ZubXFfYUb;$nYhSZ$5Ib`e7`<1skwW%@yRp&`tv)E z9#%5W&R*ux-=)zFU!xeXmaC$IBCnJdR9!l8`Eq*c<%GjoL0(F`iO%+szUr%&PEL($ zyR=oNX{~?S$@Yi(lJzHsooYKne`{CA4W*pFch8_{D%SSYt}TydABtFA>CHJFwqk64 z^=$aAL9;a1{o#*=Q~CP=03qJ2?%)VQu>p5nI>j^61he~MPz{OwU1I6uOMyvUY!Ywf#_PSZrkQ`}b>^*|7k~T485x zt+0|i`s|81TTs~1t(jZvT-<0ayqL}*S|xX|;++@fCT=$sGXRLC%|u|<>>}b=#LIYE zq3^BlAF2dkIdIQNJ^ZiV=A-th-E7oRzENw715GWb0042eDwSJT?~SJ~rbmYA$_vv1 z-Bf>8fc~DB_v_mS+dmBs7>YuJ6)tu%8872`4k4ap8H8w_x2A!+-B>+0+p3iFGH^_e zjs5-Idj9Fy*-6dMKg}AayBC*7-~D^JvLegb-fnV6*VR{Lqd@Z}-K{$ptd+EzgLKrj#-52V!$8UeHr{^vN-0{O{|M{@CwAf{u(Y<;-v++ph z?WJTWK#Ux*EX#sDs@bD~L1~OxqKTZ9Rwqmn_PQ13nt=sIZCsy8;5CJhjh}hh(<*$r~b>n7v zVxp%6a!qjeNe5Wsc2ay96P>0KCY3LB&yk}C)*k4Cd_B)*=WIWkef@ScFx11%A>dj? z-NxGF%hzKE4~8?q-nd>dKGWi=c65Jp^iwS}7LFFbuTS6h*rlM;3A$o`mc zFO~rdV}p=4PrUss?_{C?VeX<(G;q91#=6vLs)vkCN*8NemA8|_?t#9}-rnmCb?4TX zdX6MVq((+=EsXZ+D#QF;Or{>Kwlpm|V1A_MzaQ5Q#QB~+mihM0Vpn%bUS@w>L1uE^ z_i-wY^;CJL#U(8oduJA!qoO@`xG1B8qFb6YO*bnVno2acF65p+=watD*4NnHTI}xR z-0(xgpMSnK8k=ooTx>|f*x1m|zbqP;Z(7^%9xfi6TVof?v;N1}dHu$5U15CZmUGU% zGh10iQf#7Vh7_Abk!lnviK2g4Bo?vPWm$1aHN=5nV$f z{`U9Bd%4lg>EXL;6HPT4!MH@hxy2X{99OfTRF|-YKa4{V*6m;+0TX|LDzLDAi8pG% zyf8@9;JtK>qPZYIF_MVDHfBTS(ZuFIeoI{`sm0=Uw?jj?%OXvd-tbz8XGDe zK798d|9rH)a=!m$)AV$IQ*&*5Yuo(P~`AgS6|I?!r^A-Mp5X$eb6+p_fg58wI2@822dZMw5`_1ka$_~wtYf?`J- zT4u(F|MkVA#~;0ZslTbFBAHB)-zPXZgCis$cwn{3kD7Jh^{w z{oeZggL}8mbhT(%(cRVa^wamhdhy9GKYZhGU0hmFTUmGY^1#QB-~8Vee02D~|M~ReU*G>;Ztm^ZbNR*DN;{zh=iG92-yy?9 zf1qv{Sv3M>=8<{?-l^KS5tbbo2+Ij;@Oaje zS1AYmdRR|}c3?A``C^R&0UHr@M&Ja*FWW5LP3@D-IFB8iR+K)i^z4ba*F}qvN-N9a z=W^klK}#tO|I#QKW1Phbeh7nFbCo4No}NcC<>x*J#$2TB`K zLxX|TA;rC?Xbzkn`iDDyN=leUEljWyYwK+2JJViPR(ImqU~ctB|M}iTGF6#qyL9^c z*7inwcPlDcQ{8ZNYWTH|!$K)rSJv0JUmc(6Ja(eJxp#DEW_x>WJ$I#Vpi##;3)wt* zijtSAqP!3xVH}-*c2!l=#O%zGwg!e$VB&CX%gpR@Yg_lR){|GqXYx0c&DgKR!BrJY7zSc;)!`?B4AgySEmy zJ0m00$IGi7ZI{L4RgRN!>~uU{5w|Pq4j&mCz1-T;nvOSr44$6c%I3OGbb?)0S#f-F za&dEerK!0Nq;6^Jm{^=hSEr?|DPG>y(?2>n*?6S2xBJ54+)6ILw3Z+3=&eD;5R^pp zY)48L_Xu=>cSCki)*7bgVk{uID=_dgLPOvu9QcKS0Ukf!M5Z)bEAXiNft+DS?t&V< zAV{g5O#AVFp83_8&E18Kow@UudTZwD7|r%z@o4>dM-Ow7-& z=H^$nr$?_1H#9YZF7G*WVQVjU^Sj%*{NlpmNJD)Y6k~i`^OQ=J9UUH-+uB{;zB#|N zHhJ#!sY97MCsA|p+C+9YyLWrz#_ieb%Y#*Q<*9Uk&Be=CHg*cyStmewY;%4*4bI_ zIGNgi+OEr2CO3ALR=216&UQFAsPrrIq#U((KIWcUl@;a*R9xzY2ti_;*hJ z-L^++76Ewm>j_>O91{VU_xm2B2dVxBL)iNVg3|q6Mt}3eFK!LPG??qrL)48f^3=2x`uh^O5`h*rEl7nN31L!D2ii`#vMi4j5_}E4BZW`fNA9S|Ql5tV<1s>Y|cXX2+jgd$AczOnjX3iIX_m=~S z+EzND?UZ&hWXDk{K`0OfDXHRUrzOQv$4S}dJkd@@*(r%y0HRXbPCHJS?PRo_B+>vT ze@TiGd$|Ne+a@PXDy>w4v=)StG&xD_q)DZ;P9Z6Y5)eqol}c-sAf5ln|&y33EsL>FLo3Q5GIJ7byFGji|c(bxB}H z(~s)juRj=bw-&`DsiJYu*P<&th+1m{lLU||I{*UJQV2U^*2$XFX4ml3^AdFQrdVR zkpKWV7Zzg%Ol1|RA%F#cjEKdhDMgv!+-Uwi_Zq*bDy$gv|4UeKlBz-4npPV-;GUIS za7h4Ma4W{ZJxa4?TZ~&0ganj80Kf%ff^mtAbMx4&d5m)b1*(cPEEC{GXu1?A5QIWP z2~2{NfZUWzAS6gGr0Wuu5`;+^L+2~9bL zN})2i5duI&;!?7GvIwEe7eS?z$=opr5G0MHv?5R_$e_t2M-)T?Q2d4VWixEw>dNTMXO10{^Q@&|(n5SR{;6FUpcAvv-Prs?HrY@uQO=LyxsbA;Dn9 zj)X8`WiD^@<-?}qeP!#O5s;!QMUeDN&;I)S_n5^CsH z^N}3o$4U5cT=1fN=s zw)V=wnD8Y$J~ZdUbloe|CCRic$-alcefSg&$Krf{bXgdRktIB`azdJb! z0)QB!d|DQ=Ab0H&A;-FCLrCEb%eB4|A#JlM?^{R*UsmPUiL2vfAeFlXt9z z5MU910)Wa2vLDa>6tq+X06>fcj0J=cCIWC&+J4L5h}?d&CW{g={nyx zc=4OK2mpa7iVz4J6V?w6R;Fx?0)l`rTDAPE`pbnw{T1aG_N-hXi40d| zqop7-Bi3#OB87w!%mN5Tdn1G;4Hy)aZK<^i9s=AJeBqC8HR3elB08XFE*|Pa-004%> zDq3Voq#{Oy3If5HP$lXTA;JI%5E4v(C57ZhsVFj32|*ZPLKHlVCV9jFdPu?8LlrTs zya|-3(Swpn#-7n=jHn9cXJ_iMNGglIHwn4O$-ur2%B#}UJt?IEgg^j{BBuh8d1WTw z*5_3+m}Ef|rGrt9TKC#?n-J|S#PC*Rm_9MQRU2ky3_COU&JQz$KQt%Y^L-V6hOSrs zTnx<~hLj8A;dzsGOLksrvI=s#ctZ!I?s;?sTYlD3H*ckdYcDRFYC)I!b2pULo3%>t z<4*dmENf8HAeRUxhBtWa|1xWX<+<{P6*ogX9iJ&#^dTYy*e!*VdoTK0agm3%8%CQ8 z=L-vleW`{$VLk#B!^DQ!{JHOctecs()5oYLze&*I0}M;XyrmdI2==69>$%akwxW!*#OblNg(od}$CCj7 z-z9uA+2c^HjDLi(kVlvta|BULWw8|z#bWY7W3!lx%STd zn6)IzWm~$;E{Yb1HKebl<(GHEH%E%>!LlGAAjo_7?R_*e;(k~^J6k{4UleF30>B$0 zR^92TnVD&A@6Jn3jzj<~cLXLzuTF|~CPc4{-{4%a#6KcDGB@``a?++<@tdaI?TxJ` z0RV^6_I>zeB5h}Qgi{QE4wC)t4vPH;JDc1SbsOWCxK`K#Z4v@_Gs)gR!oGzDsfI9T8#vezFJ!F)=Rww~vp1PMl2Iur|oK)b4Mw z*kpeRTiP0bdiJE}#p~wNrRe~GWBd1f{xZEa#g!c6a*s6p`hGMj%1WkV9R*SV#sFq#q)k3-dHATNsVyfuItT)= zB6LY}efiW>^UsfJb55i{3@9av$%v&48QPx^)|0Q47l{{tiqDGM!XlrJ=dKSC@q}&= zFG}R9hf_ikR^BdERH^28ux9b4glgAcytq$UOQF^6M9ro#`Fo)Xm{POe{L~nWt=m_pt|x0?}qfTy*BKu=OuZD00^D5#jKQIR!A~KD(EDId?=|4thGJDx>0c5 zqiPhw_djW$P1n<^`%5hfk{?&m5`J}+uSMY(D=i^G84fV&Fx7R`>WXE&7=iaO=@Nmu ztHP`R%6CKa*f+zl#;l`UH;=;u3HgB?-9@Dvol)I?J<2cB(ziT)(swL-`)FT7T~*QC zOz-Zbbs5Q}?ESB{qyWPSPL z`A~o5fpN2;#&Qm+9c&IBL5d`EzUF~DqTXX3M2(eNRwOJi&SI2*UB)|1W&E2Wy z2eS=-SL=?11WU_8ozdYNFP3_AT%Vrm zot|kOA8)Fz%z6KIC^2?b{?WsCMjCr>Ul@K^{pg=f>tdH8Ofa?E>9Tvh?QiFYzjE4^ zgoHKL)jWMRcxR%;?QZ?^@5zcQncET~{`&H2e4@U!>&(3e*XLezua5|=swn*Zuc?-Q z{-XAg@~Ib1bxnCu;i2=-Z&zQ;P2C*%;q|Sm$}ESCblq%NczJ8)=N7lSx%~X0xAP-s ziqoG=_qfNdy?WkXd#$j4;QalGTG1k4iU^@dq<~rRm~W3#r40lj(G#O!j73T*B}{B2 ziXy=nBFN$uqD8>7N(xIDh?IE)08$En9PD`*t&Dou`H=jNu`7LU;ymN4-F=_;SRE_L z@+sdJV0?jZ8(Wye@&P_&EKB&1ZI0kLP9UThCnRZ_rpcs+Qid}f1`=j~5ExQ2P@0KJ zI1-W`-#h(Z`e7w`{qC+Bk3V>1TPy9Zp7(iw&+m{$02u)gB!MIW6$D2|NARbAU+#_U zYc0&nKX^F&aP_mYLT_X|`1jRIb+x&DU9Gq7t>l;6vop(D>vn$k=;p%VJsa{|C0ThO zIF8K6p1-(x>x++XUHkCoe|&!C;(|>QqLIkM$Jei3eedW(ux)Fm9RwL68^{s{AXp>x zNZRX+Cmx{n>DFs;j8fd_R*TSo2K|;!UkbTNyxs&TSt#R}iWrwWCER{BCr(jL@cTq5 zRT_&C9=Ece(N|#&n^_y!8*C)>lV)RfiIwid6oFs2F6ulCIZt%aEL+v+>23@;v$Ae8 zf)M{#cy9!0tav9zdlf6N-PB#)l&)^7JmQdmWLv}e%@~)x)K0siAvuVDLw&fr+L(=C zMUpT!i^d|ahiCNhnOqPXCnPlGDVw^Ctn2d4Uc4!AlI;FPi)aY$6P?2QmFp>u-EC?+ z94l)RZs27_Zsm|UWAkb?#No7Bzfw`GM@mvS&srtk7{{PCn@#BIYQBH>+?LH{BmE-} z9(?ii<&~<+%p6bgZx-Kwx_9^7ljj$=@7Qb;@X=$hUA+4Hj4V%vH#gf`{Ku6)eDvuX z3-h7JkFFhmV=UCy67Fy6XemOHO-^t;wL_aakePYHu;diww5-oyua|ncPl$~mzR`e3WB_`xcb?D>Ye3x!!?_88f(fj zJ=x%-q}Wz53?T+_96>M;7-K6?+6hSe%Rf=igty zyENEd=WnSl$@8RTx%?fKt=&}(Zy%og*FSIc^;cFDZMc2o%7wG1I;+Y~&c|N-_~ouZ z?V+jY58vNBIyW$X*wXOiuUD5(P1{7lpI+Kj69{Z+{?msiR-d2CDR2pb@WJtg|Nipe z{o{Q-ZDl(fs^%3f5QrZt2j|pRU)` z=1xyWzWw&b;fda!mZpbyubw-9qJNOOomYcR!ME8w8e|G1c z<;kA*y034YKYQksKPUV2%5NWib78o<;g#_4%V*aH25Kci0H7k4Fi9rTXt)WM6W3B( zP9#y%ek&qblr@wEv~Qc1=mbatWRpZ0$$)Vp&JQ5~NtQKsOM;B44R>S&iH1fa-r_iI zMUo{1RIoXJ+dF!mKDj+H+TKxL@zu>Uf4+2-farG>z4_|v-#os2|8FassxknB!m|B2 z1z+Aiec}AV&TYjl)f=6XXYtU&%jb7K{@}>L@xEh+!~MIOnILsF?pmCT9i0k&{@Gg( zAD#B+sy3T|DMdKW8rI&vHbzNi3nYW7*Wv{LC2MGZ64H>&?{ia8cD{MAa`x~0eeeV3K zje&hb(ZKdrw^wz!@*10h6S2w4ni7PtKc~EZr?;!DJQov+shXWvy|ZVuu)HR}pkY_% z@OWf2Jh8jJrI;#`EZZbWN~ek{V+X?C>YBFM*#lG4(a6+5Bo=HA)KHhJy1q3! zIkA6gIN00j_h&in>FK_r`r1G!6q=bG@9GX@`Tc3W!lJ_ZKwxiVDiWO;-c(&`R~+eT zQO~YDvFVYCsloQnnzZyZ!qV%v2Igmf56(@F?VlVP+238)QHhH3=K`}AMNT6*OhMj?)=tOvYa&$}6CYRf-s6L14SJjg8 z(x$%NP(fjd!;zbpQ`gqo8Qnh~n;UCxt4&MGcB`f3r7e5+3{6cAg(JP?8%pheiVF~u zkftF41W1%+8&N-2`#QNRhBr<926(+I_JQICd^;5b1wNx4`{-NP6q7|L;= zLY8GDV~jCiP3bCvEFmoxQ32*FDcv?a9Gy87o}L>EbT(&a=GvJzFTM2m{QT1w*8<&T z0ur%eCl04Cv$VOnZ#)v2ni&dzbk({%u3Z0??c4kJjfW>=Mj8;;UFj*hMw?nw8k6y(YUCkVh31(0NUeX+9LY;wbZ#TROHpFZ)(k2>z7-Nh8BLI*IA(S#o zos78&^CIezi9-YolqK}Z4!{I~j1XX8Oi`JlGR288LkI{alrlsdh`JDU$QUDn5hVyS zOdXgqNiz{8geo3j9$+d_+`wEiA;2h6?3Ah)D+m)r5F!X+V2X<=UQAs;?LZX?K*9(s z4r+H(=E8&`kO&2TOaKU`j8SF>ObNr7GODPAsfgGyr3ip23RRq#xe#>%Q8cv<000mK zahVLn9|0|lS444=W;}UW8~T8(AubY<5}Fh#!8X-$qd~@i6625L97LOyXzPCbxilhe zf?X>E5=GG_i3kH`3Rdix+S&gYyY?Tc>MMR;pL4! zDU;c@W_ovj(`+j-^@uWQCX=nx>1xxgl*ty4l9HknQETQX!4${|OVxI@^QmqnBBFle z;h>3<|J_1%Wu!)Uw3Pl%MJ}eZ=EE~s+cfBA6^u~PW`j4b*S!-*Mq)~`ls7s8iKW>N#^n>l9SLNJJR@FKI$rgpfOX_|F8W9mqcmOa{ zgCo;Ohi3+x7w48Ap}gn2MU2r|Btw z5L~+{km?^3Y7onlBdikMlqhWwbTGh3J$BXB0vdtvM$HvY27{|PBM>1fbr^(7)a`h+ z7OpTa;l-QTN;6wU%)B&S9FgZZqA4gL+2Dca6-i_jUP^(7iZ~EatV~Mkj98>fplzP! zEFy3d7>Q+*2liiCTF z58B}UaX>%IDL+K>;f}S33&5e>n0CVhHp;#3Rj9*Xs`bQBHlLSuSyBUOMt{F_n28Vz z39<|m;Q^~)zDfu$v)7>1cT*T`c9&t$iHGyrFCrUgoizvD{phghPFQ^-v5l zf=Bar(mN4XZ>W~#WCjt{*6AlT z|I&HErH8C=zGyIFt8{i&w}6;`)hu>3%oEl&SnQ8rklL^z1egf3aO)bSlkk<<)YO<& z(jcXFl5+jPz+%KBI}mrmAyk)|>0@vKBs zv1w-TG$VnSaw<-HQ|AN<7O)c98fl=j_R7qZBrU>JCD*}RMmy4gn5OvFI`6L@C(GK~ zkfnW&s=)+Cc|6u@X_`s8tCi5sQ6u39EDtrOA#hicg9q;a^rPP$dTcKd?cTln%}W=a zIP}2Z-n+bg`xFqN^3a2S_rLe{l_Liqxb@+04n4Muh@N`l@aLc2+`o1&L<}GzW`zgf zIUEs~q82FT089d;K|~+iy!`P;7gL)9)&=Ap+PaXQ}`&YN#<*6`#_POt0zwvT2 zbyc@kh?Iz#h>jkAdGyNVQ%1z3VhZzI*NB8z#Eey{<(iqgF(d&mE0a_?emmO|A{JIr z7E@vMbV!4-8j-R<)WpQhgq6sc(&i+kiEOa+?;&C}CZhGz$4{?6-?_6#L|cGndW2SE zA2&d`t74JZ4VJe{>*WGZlnQSVj~S}4s2%X-$ge7{VcCR#L@P>12@Tht>rDU4J%EaL zTNl1uLg&qDBD#Oi&fD+5_4S?WUwroZ>z97|=)U`=D(P6mEW}dX|6oLPX8qWO7mo=M z6N%(!TwCms6kz5>0dhb3;gK)yT)TDq(w(oa-uV6L)h%Y4F9NX;lOzRBl-obZHTjuL z=c}!%WwHZ*6q3K}>M3O=PB6q-J&#*jEMS`-bJ}pIFcFJzMIlsEWLQK^plmFvO8nC4 zpZxvpS9Y!j5&it+@n4;NZZ;v|jSU7hB3fJ9@uxq$vTMiIdS-GP)0TLfByBeqN}5@g z_@cS{8gmx(#H>-8+y8v`k2lWl+}@KccJCo*l3|8@j{2(xwvM31S1v#k+D2&+%g%9hL*9;>+?4;&g*yE zMxeXrvLMM)Ks%ACP5ybk)%vZ;|M)udrzWy3j-T$n_jYFi0?KX>5fH(RML>~Ja2e1U z5L6Zy26><$YgodP1PKuK#lWx%fuutg_7R>j*wrExfROfW*Mqsem=KB1lx?AUS;KK#e253aywm)Ee{ z<98)pIqC^Q$i;OL!n?SUOB-Q=0Wp+wOV%}h;q3JVa3XOdehuZNKW~l9%qWgV?$60g zd->Fub>-yh4?WclIRFsgwfFf`LwR|BT19o%lNTeMeMLEWsTND`@_K7}`cWF7^lq+= z@3vXnw7T5j5Dx(1AQPuS!ZL`ZDLOyn;u_zxV$=Qkm$h%85CFW~q?)?oCA*Hdwp3Sr z~+?)mdxu303i4EZBtcR?YcQ*UD^E$9uf)wzB+YkW}Fs0MMAjtPsK?;y5DaWQW3|dIlSo*8BWDamlTWm#;=6qCFTE zh?7yVgk>1U%gb|QtZi$1^3D5^1&e~W)+Z#%0U#;<#MHRTZf`cuRo=XR7B8ZKFf7er z8UceCOk>P)z%aghJUUcmwuO#4ld}B51u22!;bB(3H~VTV2I#E+Zlw3FhX_O%Rh8u} z7&~lMRYzO?K3_KgYLAz!MO|uNXc)Kta0Futc=|@}Kqyzx&6)YFEB;9xI*3gB!~-1zq@t5y5>aqXpxku(5D#F$`)p|P_E{F~EYByOI+MYpe(yajtJwRVon4nXgjBf5tNGKq_C{(z`C@{M9mHKxS6j%zPJbQCoQBwe%PXfWU+W+$(HL0YJO9YU62F_QlB5$dK5B@<2~7 zADLT!`-8TY+^NaBr4?OO`8O;DLGl1yU-hiHd2YVBQ*&pZCx-yyVj}d9>dd@)dZsDu z@+knIDagHXdD75-%G)&k{e{O52LM3f^(zy-m7T3cR*Tj!Tb+135CIV6zy`EKB2bPTV~{&j)i%PX%WNx?Lx9FTcNnKxG}uFV_5rtX<%`!r?~WMF-L{U<=WP& zd2_dkZ|`X@3HEVg0WiXVh3lUm)B6X-39i#{n@**5ivBuPKTGqLIVx}@_jxH4F!{b6H2qK0N_wms76aAN?kW2ln}D zz$bSTe8f>1#+CFca5WbjWIl_2a$Z8~3~Oh9got!R(Ger1JSy0y;M&z!FD8=X4`>zlpDa$vq~eF#mi|ZT8fE@} z^R2n`D<^oP?*6~7bZGAFytA7O8k=SCw-2VKwrl{vL@4%%aD?R~0Hn6Ia%EM2ICNiR z(6OoEcKtx*9*M|e9{y=_!Z_FVWNq}rzwP^BV8&bZ*CDwXiNZO5zsVE zBaDzEa79p=3}Fb(aAE+Dyqh=QymbM~CIPdIv#DA5|s+05`%zwfh<$Zy^RK z6GMxY&9UZIselVBizO4|&GR!||M+97Lz!*PqMQT{nqk${NOPcn=Q%e=Hw#lC6Vl>) z5t^a;=?UfT?(2PodA23u4m%`czk6ek)Ru&wz5t#-6U zk$utIG46I)Rh`t+#m40fUr}E;H{Le)y8Y{y8EM8f41kRM}KixVt|TfB%Y~zi*~AJv}qlf@ehF5W_JX;9vt*f-VLMxcsYu7dN(4i;GROnzr?S)&33bfH>)z35&&m9E^ZC0t7(- zfD5fHH5x@_Sz=76Z(?l3&icgT%-EWetVwlSUS?!ukXM>G`t9n=(!$uuktSJ@Xr#ZY zy&=20STy*uG%?<9dP>pNDHF$qrzb^kZS_6Q4YT3#XoAKOfs-V}5rOL_QBc|YOwnB& z9(>7v+)zL=xg^OpGZQ>(DmwVA9vXNe72o!E_p~y$#sMQOSu{J^niGH1$xy&E;B8N{E4CZeq}{mSdaym4>69vpV#WLO7=ucC$KXPDyw1ITlyT8wWqnrYwoVxrQp9sS+@KcuJDelc_#vDAM zMNaLW5hsoCAJ@-xaYR585(okUhYSN68P}B+sE3*aCS1wGw69;+HnzHiW*ldK zzRQccr~8NVtJ*G}fW`^Bt5+ebOEon!IAiW+EpV7#7%Y}a$}4iWHb-j8QY6VYb00Evn6G;ev5kv$5A%nq2$SfyEvh%JlA>Q{|fQO|C&(Akt>Fr2e zby~2Wb5m8`#%h7s_>jLYX;xh%e_uX%B$J1IVYDB*TMP=GrC z;AZ4??QiPbjIg|iv4@}3y@R<75)i zc0#G>@x%~91WAen0ECBs`hPhbE0IP;hxtvvZk>D6bUD!JQD*$%?^E*H?B>e+&!6Ud z`%4%I!vX!Qp?qs+Q1T!&G{Dt}LHS~|swXd!E zUwsJF+C6dI3!t9&`ktxooE|F|& zdz@YP2;evt24hsi(DBTSL*pa_cXS zJT@}nuy`EWn8Bcb;Zc!-&LrX*ay07pj+O#@zDcDl?|=W@of)gYU~5I=Op;_G0wIJb ziu^xcXZoDRdB^c(cb{jM`_uvG;1UP{LKa9!h(iK#iJN6%VOM|v5WPY{zZh_C^1qzCe<(u=2dt<`u^>kTZPD+b9h)Tl-~N}($i-*kCr0a)$)@kpI*GQZnx+FN&txAZHOJB2!fc5 z`Zcb2vRSx!<fx0aKYbQ|NlzjOo-1TuzIyo4rM2R`Z%jQX#7GPU7=##(0TjalL=Yrf4E_D}y~`g| zkF(il-+c1T*S`#TtQRkA{_yYn_imp&+pO%IK2=Lmx*m&Kt-JG^Uwr@K{++w$7&@Wp z)oA;NeD1NU?=@e(ynFRRaauQsA;{JV?)j@vFP&R|PR)51-7^wG>X@+o<=L&Lf7`iu zf<3=kzj$;jG#%(u3_?N-+M6aE^yw@UaJzlb?xUrz5H^!m07Rlzx(#y zoe#IObDkSl-hcGy2FHZ1@0|YUt1qu!-@1A0#J^tuap&^M=%VNGpFh9;;hAZZ-ZyH0 z_Vl-Zr_YvbCcT7I0!X453fndJJOn{_$4=G1{q9%Qlur(2IFz;*m!7G~e|-O7=hAx6 z<&{fxI4MC8gkz{b{qCcq`KX!Sua(Ll+`qhYsgVk~c5a;h&wu~=`122{;mDBKfFR`7 zcKwS7SGQYfkJ%)|rKCV`?tJUxn`h%w6Mck#6kvP=MKPSWuO#Y9&b~t}cv$)0JLAfo zi=O`v)xOh<-+8%%%*ugSS2qOS-M`bh3faH?7FUd87z8}L9U49eavyM89SBbzh!4DB z<@WalZD0k0ZYyG^M4>a~kG4Ih0Bh52-9TKo^0~XWul=<5otxMmQiA~;#ZU|a9P;IV z^1ehoIcBr-h1xOOLZQgHW~ccwiCAJdhLF%wQc27bvc_LKm6P__#?a?;9L; zgcDSSt!7iNfRWAT^mZa~xF#nEf`9}BBnkOSwR$}0&sSKcwUMEUev?rv7Rszy1 z!b1=q0Yw3SthG^J*`S+Sd8!;7Q1@v1htip(KQJQ^i*Ou8a10VshuzIqYwNAm#xh%B zii^QeuSDx|dKi{!Zn0dA3I+Xr3Y|(}^!gV|4W_ZlRoRT&X_pIsRqjboJQdNKhIVO9 zeE00RGw#bnVPB6S97-3X_J2EWjE}F{2#Ujbf z>{MvMuTc%@2kk7&HX0@Sh=ar>?cd5aFU7-96vqW(mB+VGZ!sI2R3EsE4k7tlV)5kaMzy(?kH&qf9wpc#VcX*& zij#baa%SFFU#qaog+`^wQQ2w7tXg4PjO4hr%Ia~JW->E>p6MQy1_I@%Z7N3>vUJ8U zVuSo%jm|Qk3^g_@r_QWwpKPSki+a6Dq0sr}qfCRTZ!(!uV$?Cg7imZBGo|Hn>ln9w zjLT+XPLoX`P@#}$ul9L3#=~(Gk~)i#s;3&Q(n_6fa7-c=Ga9UJx1U`pZyw{C^;|X; zH5=_mCIWPSi7sT)@nDLjsti>OxfqYdL2p102Cq!(p)Zm^~JRfdT~@apcHDR zX1s}nZ^AleHo5aV3+cx0jbW ztoieupgz`F?$B{)anLZ>apuuElK}uAB+$1HqW4rjyA?3+R4H^1i*No90et@zy|H)T zyGPc4?YH`X^rCZKB#1ZZ>$kF|7={6WLI5Bj+G&^n6?T3-a_mGDAJ_jXySry*XOrA3 z1V~5-=?V}63Bdyo^kRnnAIZM1mdJhVr(JN z#2tl2)8oTLtZHdGQ46&ivD9`mpUkSLB}I*YXr$f{6RB!7Yvz;1Bpx6}>Y`!3M16C= zsRf&&D2j_suUoyD6x0E*JtxdwX!&|A)zRHEanfEiP%^* zVyg8`^=7_^T8GvmY)%d-hJbBNf0Cj7q2KrvH@5+*237eLmc7IrW?{OCZCZOkFRhMTr>DNA8Ki_IWf1VD{-@^*{3sW$2ol)WE; zf5mFOxArOOn@D4EVr4aEO*2b3pOUCIZ&&rJ*uu)0EKTMdi^L*ci9LY`tZ(XX;a zU@1_rd*L-=F~6$KDwWB@r-;S<;c+EVe_*{JCV&wUN`E(i#ntZW4~qxef?}j5=4Oq> zSV)vv1jQsKZ}+J07H{H}MTn8v&F<6nOVq2dBMBgqbRkGS1B+Uxo7bDvTeOGTEYi&9 zT0ghxOPxQ7H4-He6j85i4K+{=h}EX4z0cDR^Zcbv5A)f*nOBQjt?%>vIbsp3f2hH} zczbWl57ypLClZHIO#@;mqR% zzgoSiU(N643#+SF@i27}ODK0{53O=$Kz)1s;^%Ka|LfoX{M}E#ji`u(D8x)=Y0oTB zfcOu;|LMQ~`TFf2fBV(vU#bMNe|j{FNvx4Ij+@5)#~*+5*T4Mz+t;su`s1HJJ$`L^ z6OP>YRKsi{jsgtOF*c`&vLk}%h_m}%Qt=1a*(1mHgPzV&%hLU8;01$KZCGe2n+t$z zz!>dZ>93uX)go9B3nHlM&XP`pld$>^cRiGi&yjno3)7`X!w~D!Tri}gf4mKdA!c*W zjM@HZQt(m=lnY`RG>h&!M1(DP8i(+EwTGo$Xgp=9HzL@;FO(CJ5gLFu_Rg$O8c)L8R$((9Y%Pf4H4NYySYIb&?nPt6Cf&zaU?UH9oS5|8t4e+dQ>{#X!fEBh|& z#uu7CA?=a^u?H8wgt>1Y__4Nl-klJx@BZ$(ad+3UGf1EQdcNaBk^+P%g2P5M2B%w% z)`32yq3ljFn}74XqkTO%tvA@Pvkc^L_9d?8KEj%9+YP`y6@3#>*W(DrUsJDolg|9= zpq6d2;1(^qw&72~e>wSI8^tbWR_hjhamu;ha)FPTIM3Y5vs~Zt4JoC6rF64*?xrtC zO6*zpt5ABicBaq2FBYmBRK$9GEr4aU;}Y{LkB-J`%Y9B0A-=$M08;l@hCm7mAu?wb z2x&*+?#d_y`{I=r&!-wPgWm{*OAkZEayjH%b#Tswm?YCYe^m0zvm@DOw@?|MEAO|4 z0R!o|q-5S4E<7#SS3VU)su^HAavyJ(cD|kDI#9|C(wr*k&(^W7M3~|SSkg3 z*#PANrO?w=cEtSb2&+dL+mVd2BkLcpNls<6AH*zw@3!W0xm+%GVb`9m3j68)y+ra; zsLT2@4g%FRf5HcoF?uQKBpqADQ=77`8eO1@h+Q+An?Xm1(PivLBXyRDIrrmJWWw(0 z?C8teR@Clfxmz?(*~yz>D7(A#-N|W(dDup!tY_X;U)-;J*7WcZL5#!qcH9+mUxdR_ zm9H7)89KLwO%E;$(hK1QA#Xm)_$H?xXV=}^e3T8+e?z6$HAE#50=X+6@YP#i=n9oT zn&Hk@!;_kj@S9|S5j;D@^9hhr7^v5sX#yD)xyGNYsmK$`+x;;57v) z!GX0{jvwb3!}P(FJEq%gl^h3DU^&(zsXjfuJK25bW4_=nxp1dP*>#9c(S_ej89YW2 c?dppE0sD??8a?z4+5i9m07*qoM6N<$f}q2ABme*a diff --git a/devices/surface/microsoft-surface-data-eraser.md b/devices/surface/microsoft-surface-data-eraser.md index ad68711a00..73ae8d9cc0 100644 --- a/devices/surface/microsoft-surface-data-eraser.md +++ b/devices/surface/microsoft-surface-data-eraser.md @@ -16,7 +16,7 @@ author: miladCA Find out how the Microsoft Surface Data Eraser tool can help you securely wipe data from your Surface devices. -[Microsoft Surface Data Eraser](https://www.microsoft.com/download/details.aspx?id=46703) is a tool that boots from a USB stick and allows you to perform a secure wipe of all data from a compatible Surface device. A Microsoft Surface Data Eraser USB stick requires only the ability to boot from USB. The USB tool is easy to create by using the provided wizard, the Microsoft Surface Data Eraser Wrapper, and is easy to use with a simple graphic interface, no command line needed. To learn more about the data wiping capabilities and practices Microsoft uses during the service process for Surface, see [Protecting your data if you send your Surface in for service](https://www.microsoft.com/surface/support/security-sign-in-and-accounts/data-wiping-policy). +[Microsoft Surface Data Eraser](https://www.microsoft.com/download/details.aspx?id=46703) is a tool that boots from a USB stick and allows you to perform a secure wipe of all data from a compatible Surface device. A Microsoft Surface Data Eraser USB stick requires only the ability to boot from USB. The USB stick is easy to create by using the provided wizard, the Microsoft Surface Data Eraser wrapper, and is easy to use with a simple graphic interface, no command line needed. To learn more about the data wiping capabilities and practices Microsoft uses during the service process for Surface, see [Protecting your data if you send your Surface in for service](https://www.microsoft.com/surface/support/security-sign-in-and-accounts/data-wiping-policy). Compatible Surface devices include: @@ -100,17 +100,17 @@ After you create a Microsoft Surface Data Eraser USB stick, you can boot a suppo 1. Insert the bootable Microsoft Surface Data Eraser USB stick into the supported Surface device. -2. Ensure your system firmware is set to boot to USB. To enter the firmware settings: +2. Boot your Surface device from the Microsoft Surface Data Eraser USB stick. To boot your device from the USB stick follow these steps: - 1. Turn off your Surface device. + a. Turn off your Surface device. + b. Press and hold the **Volume Down** button. + c. Press and release the **Power** button. + d. Release the **Volume Down** button. - 2. Press and hold the **Volume Up** button. + >[NOTE] + >If your device does not boot to USB using these steps, you may need to turn on the **Enable Alternate Boot Sequence** option in Surface UEFI. You can read more about Surface UEFI boot configuration in [Manage Surface UEFI Settings](https://technet.microsoft.com/itpro/surface/manage-surface-uefi-settings). - 3. Press and release the **Power** button. - - 4. Release the **Volume Up** button. - -3. When the Surface device boots, a **SoftwareLicenseTerms** text file is displayed. +3. When the Surface device boots, a **SoftwareLicenseTerms** text file is displayed, as shown in Figure 4. ![Booting the Microsoft Surface Data Eraser USB stick](images/data-eraser-3.png "Booting the Microsoft Surface Data Eraser USB stick") @@ -118,25 +118,20 @@ After you create a Microsoft Surface Data Eraser USB stick, you can boot a suppo 4. Read the software license terms, and then close the notepad file. -5. Accept or Decline the Software License Terms by typing **Accept** or **Decline**. +5. Accept or Decline the Software License Terms by typing **Accept** or **Decline**. You must accept the license terms to continue. -6. Select one of the following three options: +6. The Microsoft Surface Data Eraser script detects the storage devices that are present in your Surface device and displays the details of the native storage device. To continue, press **Y** (this action runs Microsoft Surface Data Eraser and removes all data from the storage device) or press **N** (this action shuts down the device without removing data). - - **Enter S to start Data Erase** – Select this option to begin the data erase process. You will have a chance to confirm in the next step. + >[NOTE] + >The Microsoft Surface Data Eraser tool will delete all data, including Windows operating system files required to boot the device, in a secure and unrecoverable way. To boot a Surface device that has been wiped with Microsoft Surface Data Eraser, you will first need to reinstall the Windows operating system. To remove data from a Surface device without removing the Windows operating system, you can use the **Reset your PC** function. However, this does not prevent your data from being recovered with forensic or data recovery capabilities. See [Recovery options in Windows 10](https://support.microsoft.com/help/12415/windows-10-recovery-options) for more information. - - **Enter D to perform Diskpart** – Select this option to use diskpart.exe to manage partitions on your disk. + ![Partition to be erased is displayed](images/sda-fig5-erase.png "Partition to be erased is displayed") + + *Figure 5. Partition to be erased is displayed in Microsoft Surface Data Eraser* - - **Enter X to shut device down** – Select this option to perform no action and shut down the device. +7. If you pressed **Y** in step 6, due to the destructive nature of the data erasure process, an additional dialog box is displayed to confirm your choice. -7. If you typed **S** to begin the data erase process, the partition that will be erased is displayed, as shown in Figure 5. If this is correct, press **Y** to continue, or **N** to shut down the device. - - ![Partition to be erased is displayed](images/sda-fig5-erase.png "Partition to be erased is displayed") - - *Figure 5. Partition to be erased is displayed in Microsoft Surface Data Eraser* - -8. If you pressed **Y** in step 7, due to the destructive nature of the data erasure process, an additional dialog box is displayed to confirm your choice. - -9. Click the **Yes** button to continue erasing data on the Surface device. +8. Click the **Yes** button to continue erasing data on the Surface device.   From af798f4daad3a1a09caebf01adc705c030ecb679 Mon Sep 17 00:00:00 2001 From: Jan Backstrom Date: Fri, 20 Jan 2017 10:45:36 -0800 Subject: [PATCH 17/87] edits --- devices/surface/microsoft-surface-data-eraser.md | 15 +++++++++------ 1 file changed, 9 insertions(+), 6 deletions(-) diff --git a/devices/surface/microsoft-surface-data-eraser.md b/devices/surface/microsoft-surface-data-eraser.md index 73ae8d9cc0..4e18fb9ccc 100644 --- a/devices/surface/microsoft-surface-data-eraser.md +++ b/devices/surface/microsoft-surface-data-eraser.md @@ -103,11 +103,14 @@ After you create a Microsoft Surface Data Eraser USB stick, you can boot a suppo 2. Boot your Surface device from the Microsoft Surface Data Eraser USB stick. To boot your device from the USB stick follow these steps: a. Turn off your Surface device. - b. Press and hold the **Volume Down** button. - c. Press and release the **Power** button. - d. Release the **Volume Down** button. - >[NOTE] + b. Press and hold the **Volume Down** button. + + c. Press and release the **Power** button. + + d. Release the **Volume Down** button. + + >[!NOTE] >If your device does not boot to USB using these steps, you may need to turn on the **Enable Alternate Boot Sequence** option in Surface UEFI. You can read more about Surface UEFI boot configuration in [Manage Surface UEFI Settings](https://technet.microsoft.com/itpro/surface/manage-surface-uefi-settings). 3. When the Surface device boots, a **SoftwareLicenseTerms** text file is displayed, as shown in Figure 4. @@ -118,11 +121,11 @@ After you create a Microsoft Surface Data Eraser USB stick, you can boot a suppo 4. Read the software license terms, and then close the notepad file. -5. Accept or Decline the Software License Terms by typing **Accept** or **Decline**. You must accept the license terms to continue. +5. Accept or decline the software license terms by typing **Accept** or **Decline**. You must accept the license terms to continue. 6. The Microsoft Surface Data Eraser script detects the storage devices that are present in your Surface device and displays the details of the native storage device. To continue, press **Y** (this action runs Microsoft Surface Data Eraser and removes all data from the storage device) or press **N** (this action shuts down the device without removing data). - >[NOTE] + >[!NOTE] >The Microsoft Surface Data Eraser tool will delete all data, including Windows operating system files required to boot the device, in a secure and unrecoverable way. To boot a Surface device that has been wiped with Microsoft Surface Data Eraser, you will first need to reinstall the Windows operating system. To remove data from a Surface device without removing the Windows operating system, you can use the **Reset your PC** function. However, this does not prevent your data from being recovered with forensic or data recovery capabilities. See [Recovery options in Windows 10](https://support.microsoft.com/help/12415/windows-10-recovery-options) for more information. ![Partition to be erased is displayed](images/sda-fig5-erase.png "Partition to be erased is displayed") From 99c2c8a938ae988f2ab5a0673cf6bbfe4475109e Mon Sep 17 00:00:00 2001 From: Jan Backstrom Date: Fri, 20 Jan 2017 11:00:45 -0800 Subject: [PATCH 18/87] fix capitalization --- devices/surface/microsoft-surface-data-eraser.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/devices/surface/microsoft-surface-data-eraser.md b/devices/surface/microsoft-surface-data-eraser.md index 4e18fb9ccc..4a39f0775e 100644 --- a/devices/surface/microsoft-surface-data-eraser.md +++ b/devices/surface/microsoft-surface-data-eraser.md @@ -119,7 +119,7 @@ After you create a Microsoft Surface Data Eraser USB stick, you can boot a suppo *Figure 4. Booting the Microsoft Surface Data Eraser USB stick* -4. Read the software license terms, and then close the notepad file. +4. Read the software license terms, and then close the Notepad file. 5. Accept or decline the software license terms by typing **Accept** or **Decline**. You must accept the license terms to continue. From de791540a0ece9e5c4f78895c40e1b8622a9cff2 Mon Sep 17 00:00:00 2001 From: jdeckerMS Date: Mon, 23 Jan 2017 11:01:30 -0800 Subject: [PATCH 19/87] title changes --- windows/keep-secure/TOC.md | 4 +- .../keep-secure/hello-and-password-changes.md | 4 +- .../hello-biometrics-in-enterprise.md | 4 +- .../keep-secure/hello-enable-phone-signin.md | 4 +- .../hello-errors-during-pin-creation.md | 4 +- windows/keep-secure/hello-event-300.md | 4 +- windows/keep-secure/hello-how-it-works.md | 6 +- .../hello-identity-verification.md | 129 ++++++++++++++++++ .../hello-manage-identity-verification.md | 129 ------------------ ...ion.md => hello-manage-in-organization.md} | 6 +- .../hello-prepare-people-to-use.md | 4 +- .../hello-why-pin-is-better-than-password.md | 4 +- ...microsoft-passport-in-your-organization.md | 2 +- windows/keep-secure/index.md | 2 +- ...y-verification-using-microsoft-passport.md | 2 +- 15 files changed, 154 insertions(+), 154 deletions(-) create mode 100644 windows/keep-secure/hello-identity-verification.md delete mode 100644 windows/keep-secure/hello-manage-identity-verification.md rename windows/keep-secure/{hello-implement-in-organization.md => hello-manage-in-organization.md} (99%) diff --git a/windows/keep-secure/TOC.md b/windows/keep-secure/TOC.md index 422542ea7f..d86fd9fc3e 100644 --- a/windows/keep-secure/TOC.md +++ b/windows/keep-secure/TOC.md @@ -1,8 +1,8 @@ # [Keep Windows 10 secure](index.md) ## [Block untrusted fonts in an enterprise](block-untrusted-fonts-in-enterprise.md) -## [Manage identity verification using Windows Hello for Business](hello-manage-identity-verification.md) +## [Windows Hello for Business](hello-identity-verification.md) ### [How Windows Hello for Business works](hello-how-it-works.md) -### [Implement Windows Hello for Business in your organization](hello-implement-in-organization.md) +### [Manage Windows Hello for Business in your organization](hello-manage-in-organization.md) ### [Enable phone sign-in to PC or VPN](hello-enable-phone-signin.md) ### [Why a PIN is better than a password](hello-why-pin-is-better-than-password.md) ### [Prepare people to use Windows Hello](hello-prepare-people-to-use.md) diff --git a/windows/keep-secure/hello-and-password-changes.md b/windows/keep-secure/hello-and-password-changes.md index 4388fd73dc..b25aacc596 100644 --- a/windows/keep-secure/hello-and-password-changes.md +++ b/windows/keep-secure/hello-and-password-changes.md @@ -36,9 +36,9 @@ Suppose instead that you sign in on **Device B** and change your password for yo ## Related topics -- [Manage identity verification using Windows Hello for Business](hello-manage-identity-verification.md) +- [Windows Hello for Business](hello-identity-verification.md) - [How Windows Hello for Business works](hello-how-it-works.md) -- [Implement Windows Hello for Business in your organization](hello-implement-in-organization.md) +- [Manage Windows Hello for Business in your organization](hello-manage-in-organization.md) - [Enable phone sign-in to PC or VPN](hello-enable-phone-signin.md) - [Why a PIN is better than a password](hello-why-pin-is-better-than-password.md) - [Prepare people to use Windows Hello](hello-prepare-people-to-use.md) diff --git a/windows/keep-secure/hello-biometrics-in-enterprise.md b/windows/keep-secure/hello-biometrics-in-enterprise.md index 98a4f449cf..e3d1f50764 100644 --- a/windows/keep-secure/hello-biometrics-in-enterprise.md +++ b/windows/keep-secure/hello-biometrics-in-enterprise.md @@ -75,9 +75,9 @@ To allow facial recognition, you must have devices with integrated special infra - Effective, real world FRR with Anti-spoofing or liveness detection: <10% ## Related topics -- [Manage identity verification using Windows Hello for Business](hello-manage-identity-verification.md) +- [Windows Hello for Business](hello-identity-verification.md) - [How Windows Hello for Business works](hello-how-it-works.md) -- [Implement Windows Hello for Business in your organization](hello-implement-in-organization.md) +- [Manage Windows Hello for Business in your organization](hello-manage-in-organization.md) - [Enable phone sign-in to PC or VPN](hello-enable-phone-signin.md) - [Why a PIN is better than a password](hello-why-pin-is-better-than-password.md) - [Prepare people to use Windows Hello](hello-prepare-people-to-use.md) diff --git a/windows/keep-secure/hello-enable-phone-signin.md b/windows/keep-secure/hello-enable-phone-signin.md index e6cd471753..f9e44256fd 100644 --- a/windows/keep-secure/hello-enable-phone-signin.md +++ b/windows/keep-secure/hello-enable-phone-signin.md @@ -63,9 +63,9 @@ If you want to distribute the **Microsoft Authenticator** app, your organization ## Related topics -- [Manage identity verification using Windows Hello for Business](hello-manage-identity-verification.md) +- [Windows Hello for Business](hello-identity-verification.md) - [How Windows Hello for Business works](hello-how-it-works.md) -- [Implement Windows Hello for Business in your organization](hello-implement-in-organization.md) +- [Manage Windows Hello for Business in your organization](hello-manage-in-organization.md) - [Why a PIN is better than a password](hello-why-pin-is-better-than-password.md) - [Prepare people to use Windows Hello](hello-prepare-people-to-use.md) - [Windows Hello and password changes](hello-and-password-changes.md) diff --git a/windows/keep-secure/hello-errors-during-pin-creation.md b/windows/keep-secure/hello-errors-during-pin-creation.md index 6d2998ebfd..a362e1f253 100644 --- a/windows/keep-secure/hello-errors-during-pin-creation.md +++ b/windows/keep-secure/hello-errors-during-pin-creation.md @@ -222,9 +222,9 @@ For errors listed in this table, contact Microsoft Support for assistance. ## Related topics -- [Manage identity verification using Windows Hello for Business](hello-manage-identity-verification.md) +- [Windows Hello for Business](hello-identity-verification.md) - [How Windows Hello for Business works](hello-how-it-works.md) -- [Implement Windows Hello for Business in your organization](hello-implement-in-organization.md) +- [Manage Windows Hello for Business in your organization](hello-manage-in-organization.md) - [Enable phone sign-in to PC or VPN](hello-enable-phone-signin.md) - [Why a PIN is better than a password](hello-why-pin-is-better-than-password.md) - [Prepare people to use Windows Hello](hello-prepare-people-to-use.md) diff --git a/windows/keep-secure/hello-event-300.md b/windows/keep-secure/hello-event-300.md index a366e3a402..b6f75fd82b 100644 --- a/windows/keep-secure/hello-event-300.md +++ b/windows/keep-secure/hello-event-300.md @@ -35,9 +35,9 @@ This is a normal condition. No further action is required. ## Related topics -- [Manage identity verification using Windows Hello for Business](hello-manage-identity-verification.md) +- [Windows Hello for Business](hello-identity-verification.md) - [How Windows Hello for Business works](hello-how-it-works.md) -- [Implement Windows Hello for Business in your organization](hello-implement-in-organization.md) +- [Manage Windows Hello for Business in your organization](hello-manage-in-organization.md) - [Enable phone sign-in to PC or VPN](hello-enable-phone-signin.md) - [Why a PIN is better than a password](hello-why-pin-is-better-than-password.md) - [Prepare people to use Windows Hello](hello-prepare-people-to-use.md) diff --git a/windows/keep-secure/hello-how-it-works.md b/windows/keep-secure/hello-how-it-works.md index c8100862aa..2f2ef14ccb 100644 --- a/windows/keep-secure/hello-how-it-works.md +++ b/windows/keep-secure/hello-how-it-works.md @@ -26,7 +26,7 @@ A goal of Windows Hello is to allow a user to open a brand-new device, securely The registration process works like this: 1. The user configures an account on the device. This account can be a local account on the device, a domain account stored in the on-premises Active Directory domain, a Microsoft account, or an Azure AD account. For a new device, this step may be as simple as signing in with a Microsoft account. Signing in with a Microsoft account on a Windows 10 device automatically sets up Windows Hello on the device; users don’t have to do anything extra to enable it. -2. To sign in using that account, the user has to enter the existing credentials for it. The IDP that “owns” the account receives the credentials and authenticates the user. This IDP authentication may include the use of an existing second authentication factor, or proof. For example, a user who registers a new device by using an Azure AD account will have to provide an SMS-based proof that Azure AD sends. +2. To sign in using that account, the user has to enter the existing credentials for it. The identity provider (IDP) that “owns” the account receives the credentials and authenticates the user. This IDP authentication may include the use of an existing second authentication factor, or proof. For example, a user who registers a new device by using an Azure AD account will have to provide an SMS-based proof that Azure AD sends. 3. When the user has provided the proof to the IDP, the user enables PIN authentication. The PIN will be associated with this particular credential. When the user sets the PIN, it becomes usable immediately Remember that Windows Hello depends on pairing a device and a credential, so the PIN chosen is associated only with the combination of the active account and that specific device. The PIN must comply with whatever length and complexity policy the account administrator has configured; this policy is enforced on the device side. Other registration scenarios that Windows Hello supports are: @@ -112,8 +112,8 @@ Windows Hello depends on having compatible IDPs available to it. As of this writ ## Related topics -- [Manage identity verification using Windows Hello for Business](hello-manage-identity-verification.md) -- [Implement Windows Hello for Business in your organization](hello-implement-in-organization.md) +- [Windows Hello for Business](hello-identity-verification.md) +- [Manage Windows Hello for Business in your organization](hello-manage-in-organization.md) - [Enable phone sign-in to PC or VPN](hello-enable-phone-signin.md) - [Why a PIN is better than a password](hello-why-pin-is-better-than-password.md) - [Prepare people to use Windows Hello](hello-prepare-people-to-use.md) diff --git a/windows/keep-secure/hello-identity-verification.md b/windows/keep-secure/hello-identity-verification.md new file mode 100644 index 0000000000..a76b8219ff --- /dev/null +++ b/windows/keep-secure/hello-identity-verification.md @@ -0,0 +1,129 @@ +--- +title: Windows Hello for Business (Windows 10) +description: In Windows 10, Windows Hello for Business replaces passwords with strong two-factor authentication on PCs and mobile devices. This authentication consists of a new type of user credential that is tied to a device and a biometric or PIN. +ms.assetid: 5BF09642-8CF5-4FBC-AC9A-5CA51E19387E +keywords: identity, PIN, biometric, Hello, passport +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security, mobile +author: jdeckerMS +localizationpriority: high +--- +# Windows Hello for Business + +**Applies to** +- Windows 10 +- Windows 10 Mobile + +In Windows 10, Windows Hello for Business replaces passwords with strong two-factor authentication on PCs and mobile devices. This authentication consists of a new type of user credential that is tied to a device and uses a biometric or PIN. + +>[!NOTE] +> When Windows 10 first shipped, it included Microsoft Passport and Windows Hello, which worked together to provide multi-factor authentication. To simplify deployment and improve supportability, Microsoft has combined these technologies into a single solution under the Windows Hello name. Customers who have already deployed these technologies will not experience any change in functionality. Customers who have yet to evaluate Windows Hello will find it easier to deploy due to simplified policies, documentation, and semantics. + +Windows Hello addresses the following problems with passwords: +- Strong passwords can be difficult to remember, and users often reuse passwords on multiple sites. +- Server breaches can expose symmetric network credentials (passwords). +- Passwords are subject to [replay attacks](https://go.microsoft.com/fwlink/p/?LinkId=615673). +- Users can inadvertently expose their passwords due to [phishing attacks](https://go.microsoft.com/fwlink/p/?LinkId=615674). + +Windows Hello lets users authenticate to: +- a Microsoft account. +- an Active Directory account. +- a Microsoft Azure Active Directory (Azure AD) account. +- Identity Provider Services or Relying Party Services that support [Fast ID Online (FIDO) v2.0](https://go.microsoft.com/fwlink/p/?LinkId=533889) authentication (in progress) + +After an initial two-step verification of the user during enrollment, Windows Hello is set up on the user's device and Windows asks the user to set a gesture, which can be a biometric, such as a fingerprint, or a PIN. The user provides the gesture to verify their identity. Windows then uses Windows Hello to authenticate users. + +As an administrator in an enterprise or educational organization, you can create policies to manage Windows Hello for Business use on Windows 10-based devices that connect to your organization. + + ## Biometric sign-in + + Windows Hello provides reliable, fully integrated biometric authentication based on facial recognition or fingerprint matching. Windows Hello uses a combination of special infrared (IR) cameras and software to increase accuracy and guard against spoofing. Major hardware vendors are shipping devices that have integrated Windows Hello-compatible cameras. Fingerprint reader hardware can be used or added to devices that don’t currently have it. On devices that support Windows Hello, an easy biometric gesture unlocks users’ credentials. + +- **Facial recognition**. This type of biometric recognition uses special cameras that see in IR light, which allows them to reliably tell the difference between a photograph or scan and a living person. Several vendors are shipping external cameras that incorporate this technology, and major laptop manufacturers are incorporating it into their devices, as well. +- **Fingerprint recognition**. This type of biometric recognition uses a capacitive fingerprint sensor to scan your fingerprint. Fingerprint readers have been available for Windows computers for years, but the current generation of sensors is significantly more reliable and less error-prone. Most existing fingerprint readers (whether external or integrated into laptops or USB keyboards) work with Windows 10. + +Windows stores biometric data that is used to implement Windows Hello securely on the local device only. The biometric data doesn’t roam and is never sent to external devices or servers. Because Windows Hello only stores biometric identification data on the device, there’s no single collection point an attacker can compromise to steal biometric data. + + +## The difference between Windows Hello and Windows Hello for Business + +- Individuals can create a PIN or biometric gesture on their personal devices for convenient sign-in. This use of Windows Hello is unique to the device on which it is set up, however it is not backed by asymmetric (public/private key) or certificate-based authentication. + +- Windows Hello for Business, which is configured by Group Policy or mobile device management (MDM) policy, uses key-based or certificate-based authentication. + +- Currently Active Directory accounts using Windows Hello are not backed by key-based or certificate-based authentication. Support for key-based or certificate-based authentication is on the roadmap for a future release. + +## Benefits of Windows Hello + +Reports of identity theft and large-scale hacking are frequent headlines. Nobody wants to be notified that their user name and password have been exposed. + +You may wonder [how a PIN can help protect a device better than a password](why-a-pin-is-better-than-a-password.md). Passwords are shared secrets; they are entered on a device and transmitted over the network to the server. An intercepted account name and password can be used by anyone. Because they're stored on the server, a server breach can reveal those stored credentials. + +In Windows 10, Windows Hello replaces passwords. When the identity provider supports keys, the Windows Hello provisioning process creates a cryptographic key pair bound to the Trusted Platform Module (TPM), if a device has a TPM, or in software. Access to these keys and obtaining a signature to validate user possession of the private key is enabled only by the PIN or biometric gesture. The two-step verification that takes place during Windows Hello enrollment creates a trusted relationship between the identity provider and the user when the public portion of the public/private key pair is sent to an identity provider and associated with a user account. When a user enters the gesture on the device, the identity provider knows from the combination of Hello keys and gesture that this is a verified identity and provides an authentication token that allows Windows 10 to access resources and services. + +>[!NOTE] +>Windows Hello as a convenience sign-in uses regular user name and password authentication, without the user entering the password. + +![How authentication works in Windows Hello](images/authflow.png) + +Imagine that someone is looking over your shoulder as you get money from an ATM and sees the PIN that you enter. Having that PIN won't help them access your account because they don't have your ATM card. In the same way, learning your PIN for your device doesn't allow that attacker to access your account because the PIN is local to your specific device and doesn't enable any type of authentication from any other device. + +Windows Hello helps protect user identities and user credentials. Because the user doesn't enter a password (except during provisioning), it helps circumvent phishing and brute force attacks. It also helps prevent server breaches because Windows Hello credentials are an asymmetric key pair, which helps prevent replay attacks when these keys are protected by TPMs. + +For customers using a hybrid Active Directory and Azure Active Directorye environment, Windows Hello also enables Windows 10 Mobile devices to be used as [a remote credential](prepare-people-to-use-microsoft-passport.md#bmk-remote) when signing into Windows 10 PCs. During the sign-in process, the Windows 10 PC can connect using Bluetooth to access Windows Hello on the user’s Windows 10 Mobile device. Because users carry their phone with them, Windows Hello makes implementing two-factor authentication across the enterprise less costly and complex than other solutions. + +> [!NOTE] +>  Phone sign-in is currently limited to select Technology Adoption Program (TAP) participants. + +  +## How Windows Hello for Business works: key points + +- Windows Hello credentials are based on certificate or asymmetrical key pair. Windows Hello credentials can be bound to the device, and the token that is obtained using the credential is also bound to the device. +- Identity provider (such as Active Directory, Azure AD, or a Microsoft account) validates user identity and maps the Windows Hello public key to a user account during the registration step. +- Keys can be generated in hardware (TPM 1.2 or 2.0 for enterprises, and TPM 2.0 for consumers) or software, based on the policy. +- Authentication is the two-factor authentication with the combination of a key or certificate tied to a device and something that the person knows (a PIN) or something that the person is (Windows Hello). The Windows Hello gesture does not roam between devices and is not shared with the server; it is stored locally on a device. +- Private key never leaves a device when using TPM. The authenticating server has a public key that is mapped to the user account during the registration process. +- PIN entry and biometric gesture both trigger Windows 10 to use the private key to cryptographically sign data that is sent to the identity provider. The identity provider verifies the user's identity and authenticates the user. +- Personal (Microsoft account) and corporate (Active Directory or Azure AD) accounts use a single container for keys. All keys are separated by identity providers' domains to help ensure user privacy. +- Certificate private keys can be protected by the Windows Hello container and the Windows Hello gesture. + +For details, see [How Windows Hello for Business works](hello-how-it-works.md). + +## Comparing key-based and certificate-based authentication + +Windows Hello for Business can use either keys (hardware or software) or certificates in hardware or software. Enterprises that have a public key infrastructure (PKI) for issuing and managing certificates can continue to use PKI in combination with Windows Hello. Enterprises that do not use PKI or want to reduce the effort associated with managing certificates can rely on key-based credentials for Windows Hello but still use certificates on their domain controllers as a root of trust. + + + +## Learn more + +[Introduction to Windows Hello](https://go.microsoft.com/fwlink/p/?LinkId=786649), video presentation on Microsoft Virtual Academy + +[What's new in Active Directory Domain Services (AD DS) in Windows Server Technical Preview](https://go.microsoft.com/fwlink/p/?LinkId=708533) + +[Windows Hello face authentication](https://go.microsoft.com/fwlink/p/?LinkId=626024) + +[Biometrics hardware guidelines](https://go.microsoft.com/fwlink/p/?LinkId=626995) + +[Windows 10: Disrupting the Revolution of Cyber-Threats with Revolutionary Security!](https://go.microsoft.com/fwlink/p/?LinkId=533890) + +[Windows 10: The End Game for Passwords and Credential Theft?](https://go.microsoft.com/fwlink/p/?LinkId=533891) + +[Authenticating identities without passwords through Microsoft Passport](https://go.microsoft.com/fwlink/p/?LinkId=616778) + +[Microsoft Passport guide](https://go.microsoft.com/fwlink/p/?LinkId=691928) + +## Related topics + +- [How Windows Hello for Business works](hello-how-it-works.md) +- [Manage Windows Hello for Business in your organization](hello-manage-in-organization.md) +- [Enable phone sign-in to PC or VPN](hello-enable-phone-signin.md) +- [Why a PIN is better than a password](hello-why-pin-is-better-than-password.md) +- [Prepare people to use Windows Hello](hello-prepare-people-to-use.md) +- [Windows Hello and password changes](hello-and-password-changes.md) +- [Windows Hello errors during PIN creation](hello-errors-during-pin-creation.md) +- [Event ID 300 - Windows Hello successfully created](hello-event-300.md) +- [Windows Hello biometrics in the enterprise](hello-biometrics-in-enterprise.md) +  diff --git a/windows/keep-secure/hello-manage-identity-verification.md b/windows/keep-secure/hello-manage-identity-verification.md deleted file mode 100644 index ca6b032a8f..0000000000 --- a/windows/keep-secure/hello-manage-identity-verification.md +++ /dev/null @@ -1,129 +0,0 @@ ---- -title: Manage identity verification using Windows Hello for Business (Windows 10) -description: In Windows 10, Windows Hello for Business replaces passwords with strong two-factor authentication on PCs and mobile devices. This authentication consists of a new type of user credential that is tied to a device and a biometric or PIN. -ms.assetid: 5BF09642-8CF5-4FBC-AC9A-5CA51E19387E -keywords: identity, PIN, biometric, Hello, passport -ms.prod: w10 -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: security, mobile -author: jdeckerMS -localizationpriority: high ---- -# Manage identity verification using Windows Hello for Business - -**Applies to** -- Windows 10 -- Windows 10 Mobile - -In Windows 10, Windows Hello for Business replaces passwords with strong two-factor authentication on PCs and mobile devices. This authentication consists of a new type of user credential that is tied to a device and a biometric or PIN. - ->[!NOTE] -> When Windows 10 first shipped, it included Microsoft Passport and Windows Hello, which worked together to provide multi-factor authentication. To simplify deployment and improve supportability, Microsoft has combined these technologies into a single solution under the Windows Hello name. Customers who have already deployed these technologies will not experience any change in functionality. Customers who have yet to evaluate Windows Hello will find it easier to deploy due to simplified policies, documentation, and semantics. - -Hello addresses the following problems with passwords: -- Passwords can be difficult to remember, and users often reuse passwords on multiple sites. -- Server breaches can expose symmetric network credentials. -- Passwords can be subject to [replay attacks](https://go.microsoft.com/fwlink/p/?LinkId=615673). -- Users can inadvertently expose their passwords due to [phishing attacks](https://go.microsoft.com/fwlink/p/?LinkId=615674). - -Hello lets users authenticate to: -- a Microsoft account. -- an Active Directory account. -- a Microsoft Azure Active Directory (Azure AD) account. -- Identity Provider Services or Relying Party Services that support [Fast ID Online (FIDO) v2.0](https://go.microsoft.com/fwlink/p/?LinkId=533889) authentication - -After an initial two-step verification of the user during enrollment, Hello is set up on the user's device and the user is asked to set a gesture, which can be a biometric, such as a fingerprint, or a PIN. The user provides the gesture to verify their identity. Windows then uses Hello to authenticate users and help them to access protected resources and services. - -As an administrator in an enterprise or educational organization, you can create policies to manage Hello use on Windows 10-based devices that connect to your organization. - - ## Biometric sign-in - - Windows Hello provides reliable, fully integrated biometric authentication based on facial recognition or fingerprint matching. Hello uses a combination of special infrared (IR) cameras and software to increase accuracy and guard against spoofing. Major hardware vendors are shipping devices that have integrated Windows Hello-compatible cameras, and fingerprint reader hardware can be used or added to devices that don’t currently have it. On devices that support Windows Hello, an easy biometric gesture unlocks users’ credentials. - -- **Facial recognition**. This type uses special cameras that see in IR light, which allows them to reliably tell the difference between a photograph or scan and a living person. Several vendors are shipping external cameras that incorporate this technology, and major laptop manufacturers are incorporating it into their devices, as well. -- **Fingerprint recognition**. This type uses a capacitive fingerprint sensor to scan your fingerprint. Fingerprint readers have been available for Windows computers for years, but the current generation of sensors is significantly more reliable and less error-prone. Most existing fingerprint readers (whether external or integrated into laptops or USB keyboards) work with Windows 10. - -Biometric data used to implement Windows Hello is stored securely on the local device only. It doesn’t roam and is never sent to external devices or servers. Because Windows Hello only stores biometric identification data on the device, there’s no single collection point an attacker can compromise to steal biometric data. - - -## The difference between Windows Hello and Windows Hello for Business - -- Individuals can create a PIN or biometric gesture on their personal devices for convenient sign-in. This use of Hello provides a layer of protection by being unique to the device on which it is set up, however it is not backed by certificate-based authentication. - -- Windows Hello for Business, which is configured by Group Policy or MDM policy, uses key-based or certificate-based authentication. - -- Currently Active Directory accounts using Windows Hello are not backed by key-based or certificate-based authentication. Support for key-based or certificate-based authentication is on the roadmap for a future release. - -## Benefits of Windows Hello - -Reports of identity theft and large-scale hacking are frequent headlines. Nobody wants to be notified that their user name and password have been exposed. - -You may wonder [how a PIN can help protect a device better than a password](why-a-pin-is-better-than-a-password.md). Passwords are shared secrets; they are entered on a device and transmitted over the network to the server. An intercepted account name and password can be used by anyone. Because they're stored on the server, a server breach can reveal those stored credentials. - -In Windows 10, Hello replaces passwords. The Hello provisioning process creates a cryptographic key pair bound to the Trusted Platform Module (TPM), if a device has a TPM, or in software. Access to these keys and obtaining a signature to validate user possession of the private key is enabled only by the PIN or biometric gesture. The two-step verification that takes place during Hello enrollment creates a trusted relationship between the identity provider and the user when the public portion of the public/private key pair is sent to an identity provider and associated with a user account. When a user enters the gesture on the device, the identify provider knows from the combination of Hello keys and gesture that this is a verified identity and provides an authentication token that allows Windows 10 to access resources and services. In addition, during the registration process, the attestation claim is produced for every identity provider to cryptographically prove that the Hello keys are tied to TPM. During registration, when the attestation claim is not presented to the identity provider, the identity provider must assume that the Hello key is created in software. - -![how authentication works in windows hello](images/authflow.png) - -Imagine that someone is looking over your shoulder as you get money from an ATM and sees the PIN that you enter. Having that PIN won't help them access your account because they don't have your ATM card. In the same way, learning your PIN for your device doesn't allow that attacker to access your account because the PIN is local to your specific device and doesn't enable any type of authentication from any other device. - -Hello helps protect user identities and user credentials. Because no passwords are used, it helps circumvent phishing and brute force attacks. It also helps prevent server breaches because Hello credentials are an asymmetric key pair, which helps prevent replay attacks when these keys are protected by TPMs. - -Hello also enables Windows 10 Mobile devices to be used as [a remote credential](prepare-people-to-use-microsoft-passport.md#bmk-remote) when signing into Windows 10 PCs. During the sign-in process, the Windows 10 PC can connect using Bluetooth to access Hello on the user’s Windows 10 Mobile device. Because users carry their phone with them, Hello makes implementing two-factor authentication across the enterprise less costly and complex than other solutions. - -> [!NOTE] ->  Phone sign-in is currently limited to select Technology Adoption Program (TAP) participants. - -  -## How Windows Hello for Business works: key points - -- Hello credentials are based on certificate or asymmetrical key pair. Hello credentials are bound to the device, and the token that is obtained using the credential is also bound to the device. -- Identify provider (such as Active Directory, Azure AD, or a Microsoft account) validates user identity and maps Hello's public key to a user account during the registration step. -- Keys can be generated in hardware (TPM 1.2 or 2.0 for enterprises, and TPM 2.0 for consumers) or software, based on the policy. -- Authentication is the two-factor authentication with the combination of a key or certificate tied to a device and something that the person knows (a PIN) or something that the person is (Windows Hello). The Hello gesture does not roam between devices and is not shared with the server; it is stored locally on a device. -- Private key never leaves a device. The authenticating server has a public key that is mapped to the user account during the registration process. -- PIN entry and biometric gesture both trigger Windows 10 to verify the user's identity and authenticate using Hello keys or certificates. -- Personal (Microsoft account) and corporate (Active Directory or Azure AD) accounts use a single container for keys. All keys are separated by identity providers' domains to help ensure user privacy. -- Certificate private keys can be protected by the Hello container and the Hello gesture. - -For details, see [How Windows Hello for Business works](hello-how-it-works.md). - -## Comparing key-based and certificate-based authentication - -Windows Hello for Business can use either keys (hardware or software) or certificates with keys in hardware or software to confirm identity. Enterprises that have a public key infrastructure (PKI) for issuing and managing certificates can continue to use PKI in combination with Hello. Enterprises that do not use PKI or want to reduce the effort associated with managing certificates can rely on key-based credentials for Hello. - -Hardware-based keys, which are generated by TPM, provide the highest level of assurance. When the TPM is manufactured, an Endorsement Key (EK) certificate is resident in the TPM. This EK certificate creates a root trust for all other keys that are generated on this TPM. -EK certification is used to generate an attestation identity key (AIK) certificate issued by a Microsoft certificate authority. This AIK certificate can be used as an attestation claim to prove to identity providers that the Hello keys are generated on the same TPM. The Microsoft certificate authority (CA) generates the AIK certificate per device, per user, and per IDP to help ensure that user privacy is protected. - -When identity providers such as Active Directory or Azure AD enroll a certificate in Hello, Windows 10 will support the same set of scenarios as a smart card. When the credential type is a key, only key-based trust and operations will be supported. - -## Learn more - -[Introduction to Windows Hello](https://go.microsoft.com/fwlink/p/?LinkId=786649), video presentation on Microsoft Virtual Academy - -[What's new in Active Directory Domain Services (AD DS) in Windows Server Technical Preview](https://go.microsoft.com/fwlink/p/?LinkId=708533) - -[Windows Hello face authentication](https://go.microsoft.com/fwlink/p/?LinkId=626024) - -[Biometrics hardware guidelines](https://go.microsoft.com/fwlink/p/?LinkId=626995) - -[Windows 10: Disrupting the Revolution of Cyber-Threats with Revolutionary Security!](https://go.microsoft.com/fwlink/p/?LinkId=533890) - -[Windows 10: The End Game for Passwords and Credential Theft?](https://go.microsoft.com/fwlink/p/?LinkId=533891) - -[Authenticating identities without passwords through Microsoft Passport](https://go.microsoft.com/fwlink/p/?LinkId=616778) - -[Microsoft Passport guide](https://go.microsoft.com/fwlink/p/?LinkId=691928) - -## Related topics - -- [How Windows Hello for Business works](hello-how-it-works.md) -- [Implement Windows Hello for Business in your organization](hello-implement-in-organization.md) -- [Enable phone sign-in to PC or VPN](hello-enable-phone-signin.md) -- [Why a PIN is better than a password](hello-why-pin-is-better-than-password.md) -- [Prepare people to use Windows Hello](hello-prepare-people-to-use.md) -- [Windows Hello and password changes](hello-and-password-changes.md) -- [Windows Hello errors during PIN creation](hello-errors-during-pin-creation.md) -- [Event ID 300 - Windows Hello successfully created](hello-event-300.md) -- [Windows Hello biometrics in the enterprise](hello-biometrics-in-enterprise.md) -  diff --git a/windows/keep-secure/hello-implement-in-organization.md b/windows/keep-secure/hello-manage-in-organization.md similarity index 99% rename from windows/keep-secure/hello-implement-in-organization.md rename to windows/keep-secure/hello-manage-in-organization.md index 7afc1c03e9..26a10d5073 100644 --- a/windows/keep-secure/hello-implement-in-organization.md +++ b/windows/keep-secure/hello-manage-in-organization.md @@ -1,5 +1,5 @@ --- -title: Implement Windows Hello in your organization (Windows 10) +title: Manage Windows Hello in your organization (Windows 10) description: You can create a Group Policy or mobile device management (MDM) policy that will implement Windows Hello for Business on devices running Windows 10. ms.assetid: 47B55221-24BE-482D-BD31-C78B22AC06D8 keywords: identity, PIN, biometric, Hello @@ -11,7 +11,7 @@ author: jdeckerMS localizationpriority: high --- -# Implement Windows Hello for Business in your organization +# Manage Windows Hello for Business in your organization **Applies to** - Windows 10 @@ -420,7 +420,7 @@ If you want to use Windows Hello for Business with certificates, you’ll need a ## Related topics -- [Manage identity verification using Windows Hello for Business](hello-manage-identity-verification.md) +- [Windows Hello for Business](hello-identity-verification.md) - [How Windows Hello for Business works](hello-how-it-works.md) - [Enable phone sign-in to PC or VPN](hello-enable-phone-signin.md) - [Why a PIN is better than a password](hello-why-pin-is-better-than-password.md) diff --git a/windows/keep-secure/hello-prepare-people-to-use.md b/windows/keep-secure/hello-prepare-people-to-use.md index 2991666df4..e1c079e7ab 100644 --- a/windows/keep-secure/hello-prepare-people-to-use.md +++ b/windows/keep-secure/hello-prepare-people-to-use.md @@ -97,9 +97,9 @@ You simply connect to VPN as you normally would. If the phone's certificates are ## Related topics -- [Manage identity verification using Windows Hello for Business](hello-manage-identity-verification.md) +- [Windows Hello for Business](hello-identity-verification.md) - [How Windows Hello for Business works](hello-how-it-works.md) -- [Implement Windows Hello for Business in your organization](hello-implement-in-organization.md) +- [Manage Windows Hello for Business in your organization](hello-manage-in-organization.md) - [Enable phone sign-in to PC or VPN](hello-enable-phone-signin.md) - [Why a PIN is better than a password](hello-why-pin-is-better-than-password.md) - [Windows Hello and password changes](hello-and-password-changes.md) diff --git a/windows/keep-secure/hello-why-pin-is-better-than-password.md b/windows/keep-secure/hello-why-pin-is-better-than-password.md index ad4f77ab13..f228aa93c2 100644 --- a/windows/keep-secure/hello-why-pin-is-better-than-password.md +++ b/windows/keep-secure/hello-why-pin-is-better-than-password.md @@ -70,9 +70,9 @@ If you only had a biometric sign-in configured and, for any reason, were unable ## Related topics -- [Manage identity verification using Windows Hello for Business](hello-manage-identity-verification.md) +- [Windows Hello for Business](hello-identity-verification.md) - [How Windows Hello for Business works](hello-how-it-works.md) -- [Implement Windows Hello for Business in your organization](hello-implement-in-organization.md) +- [Manage Windows Hello for Business in your organization](hello-manage-in-organization.md) - [Enable phone sign-in to PC or VPN](hello-enable-phone-signin.md) - [Prepare people to use Windows Hello](hello-prepare-people-to-use.md) - [Windows Hello and password changes](hello-and-password-changes.md) diff --git a/windows/keep-secure/implement-microsoft-passport-in-your-organization.md b/windows/keep-secure/implement-microsoft-passport-in-your-organization.md index 0f8ca633e1..67bda0eb2f 100644 --- a/windows/keep-secure/implement-microsoft-passport-in-your-organization.md +++ b/windows/keep-secure/implement-microsoft-passport-in-your-organization.md @@ -8,7 +8,7 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security author: jdeckerMS -redirect_url: https://technet.microsoft.com/en-us/itpro/windows/keep-secure/hello-implement-in-organization +redirect_url: https://technet.microsoft.com/en-us/itpro/windows/keep-secure/hello-manage-in-organization --- # Implement Windows Hello for Business in your organization diff --git a/windows/keep-secure/index.md b/windows/keep-secure/index.md index b09b1a64e8..f258d43aa8 100644 --- a/windows/keep-secure/index.md +++ b/windows/keep-secure/index.md @@ -18,7 +18,7 @@ Learn about keeping Windows 10 and Windows 10 Mobile secure. | - | - | | [Block untrusted fonts in an enterprise](block-untrusted-fonts-in-enterprise.md) | To help protect your company from attacks which may originate from untrusted or attacker controlled font files, we’ve created the Blocking Untrusted Fonts feature. Using this feature, you can turn on a global setting that stops your employees from loading untrusted fonts processed using the Graphics Device Interface (GDI) onto your network. Untrusted fonts are any font installed outside of the %windir%/Fonts directory. Blocking untrusted fonts helps prevent both remote (web-based or email-based) and local EOP attacks that can happen during the font file-parsing process. | | [Device Guard certification and compliance](device-guard-certification-and-compliance.md) | Device Guard is a combination of hardware and software security features that, when configured together, will lock a device down so that it can only run trusted applications. If the app isn’t trusted it can’t run, period. It also means that even if an attacker manages to get control of the Windows kernel, he or she will be much less likely to be able to run malicious executable code after the computer restarts because of how decisions are made about what can run and when. | -| [Manage identity verification using Windows Hello for Business](hello-manage-identity-verification.md) | In Windows 10, Windows Hello replaces passwords with strong two-factor authentication on PCs and mobile devices. This authentication consists of a new type of user credential that is tied to a device and a biometric or PIN. | +| [Windows Hello for Business](hello-identity-verification.md) | In Windows 10, Windows Hello replaces passwords with strong two-factor authentication on PCs and mobile devices. This authentication consists of a new type of user credential that is tied to a device and a biometric or PIN. | | [Configure S/MIME for Windows 10 and Windows 10 Mobile](configure-s-mime.md) | In Windows 10, S/MIME lets users encrypt outgoing messages and attachments so that only intended recipients who have a digital identification (ID), also known as a certificate, can read them. Users can digitally sign a message, which provides the recipients with a way to verify the identity of the sender and that the message hasn't been tampered with. | | [Install digital certificates on Windows 10 Mobile](installing-digital-certificates-on-windows-10-mobile.md) | Digital certificates bind the identity of a user or computer to a pair of keys that can be used to encrypt and sign digital information. Certificates are issued by a certification authority (CA) that vouches for the identity of the certificate holder, and they enable secure client communications with websites and services. | | [Device Guard deployment guide](device-guard-deployment-guide.md) | Device Guard is a combination of hardware and software security features that, when configured together, will lock a device down so that it can only run trusted applications. If the app isn’t trusted it can’t run, period. It also means that even if an attacker manages to get control of the Windows kernel, he or she will be much less likely to be able to run malicious executable code after the computer restarts because of how decisions are made about what can run and when. | diff --git a/windows/keep-secure/manage-identity-verification-using-microsoft-passport.md b/windows/keep-secure/manage-identity-verification-using-microsoft-passport.md index 55173ae2dd..c3ef3e00eb 100644 --- a/windows/keep-secure/manage-identity-verification-using-microsoft-passport.md +++ b/windows/keep-secure/manage-identity-verification-using-microsoft-passport.md @@ -8,7 +8,7 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security, mobile author: jdeckerMS -redirect_url: https://technet.microsoft.com/en-us/itpro/windows/keep-secure/hello-manage-identity-verification +redirect_url: https://technet.microsoft.com/en-us/itpro/windows/keep-secure/hello-identity-verification --- # Manage identity verification using Windows Hello for Business From f5cb7bb147994549b3a0ad8f67175f0474f7c835 Mon Sep 17 00:00:00 2001 From: jdeckerMS Date: Mon, 23 Jan 2017 11:08:29 -0800 Subject: [PATCH 20/87] fix bad links --- ...ange-history-for-keep-windows-10-secure.md | 2 +- windows/keep-secure/hello-how-it-works.md | 2 +- .../hello-manage-in-organization.md | 45 +------ ...y-verification-using-microsoft-passport.md | 112 ------------------ 4 files changed, 4 insertions(+), 157 deletions(-) diff --git a/windows/keep-secure/change-history-for-keep-windows-10-secure.md b/windows/keep-secure/change-history-for-keep-windows-10-secure.md index 3dd6114a0a..30de1e7cdb 100644 --- a/windows/keep-secure/change-history-for-keep-windows-10-secure.md +++ b/windows/keep-secure/change-history-for-keep-windows-10-secure.md @@ -19,7 +19,7 @@ This topic lists new and updated topics in the [Keep Windows 10 secure](index.md |[Limitations while using Windows Information Protection (WIP)](limitations-with-wip.md) |Updated to include info about USB drives and Azure RMS (Windows Insider Program only) and to add more info about Work Folders and Offline files. | |[Recommended Enterprise Cloud Resources and Neutral Resources network settings with Windows Information Protection (WIP)](recommended-network-definitions-for-wip.md) |New | |[Using Outlook Web Access with Windows Information Protection (WIP)](using-owa-with-wip.md) |New | -| Microsoft Passport guide | Content merged into [Manage identity verification using Windows Hello for Business](hello-manage-identity-verification.md) topics | +| Microsoft Passport guide | Content merged into [MWindows Hello for Business](hello-identity-verification.md) topics | ## December 2016 |New or changed topic |Description | diff --git a/windows/keep-secure/hello-how-it-works.md b/windows/keep-secure/hello-how-it-works.md index 2f2ef14ccb..fa123026c4 100644 --- a/windows/keep-secure/hello-how-it-works.md +++ b/windows/keep-secure/hello-how-it-works.md @@ -21,7 +21,7 @@ To use Windows Hello to sign in with an identity provider (IDP), a user needs a A goal of Windows Hello is to allow a user to open a brand-new device, securely join an organizational network to download and manage organizational data, and create a new Hello gesture to secure the device. Microsoft refers to the process of setting up a device for use with Windows Hello as registration. > [!NOTE] ->This is separate from the organizational configuration required to use Windows Hello with Active Directory or Azure Active Directory (Azure AD); that configuration information is in [Implement Windows Hello for Business in your organization](hello-implement-in-organization.md). Organizational configuration must be completed before users can begin to register. +>This is separate from the organizational configuration required to use Windows Hello with Active Directory or Azure Active Directory (Azure AD); that configuration information is in [Manage Windows Hello for Business in your organization](hello-manage-in-organization.md). Organizational configuration must be completed before users can begin to register. The registration process works like this: diff --git a/windows/keep-secure/hello-manage-in-organization.md b/windows/keep-secure/hello-manage-in-organization.md index 26a10d5073..87c3225316 100644 --- a/windows/keep-secure/hello-manage-in-organization.md +++ b/windows/keep-secure/hello-manage-in-organization.md @@ -28,7 +28,7 @@ You can create a Group Policy or mobile device management (MDM) policy that will   ## Group Policy settings for Windows Hello for Business -The following table lists the Group Policy settings that you can configure for Hello use in your workplace. These policy settings are available in both **User configuration** and **Computer Configuration** under **Policies** > **Administrative Templates** > **Windows Components** > **Windows Hello for Business**. +The following table lists the Group Policy settings that you can configure for Windows Hello use in your workplace. These policy settings are available in both **User configuration** and **Computer Configuration** under **Policies** > **Administrative Templates** > **Windows Components** > **Windows Hello for Business**. @@ -363,48 +363,7 @@ Configuration Manager and MDM provide the ability to manage Windows Hello for Bu Azure AD provides the ability to register devices with your enterprise and to provision Windows Hello for Business for organization accounts. -## Approaches for a Windows Hello for Business deployment -Different organizations will necessarily take different approaches to the deployment of Windows Hello depending on their capabilities and needs, but there is only one strategy: deploy Windows Hello for Business throughout the organization to get maximum protection for the maximum number of devices and resources. Organizations can take one of three basic routes to accomplish that strategy: - -- Deploy Windows Hello for Business everywhere according to whatever device or user deployment strategy works best for the organization. -- Deploy Windows Hello for Business first to high-value or high-risk targets, by using conditional access policies to restrict access to key resources only to users who hold strong authentication credentials. -- Blend Windows Hello for Business into an existing multi-factor environment, using it as an additional form of strong authentication alongside physical or virtual smart cards. - -### Deploy Windows Hello for Business everywhere - -In this approach, you deploy Windows Hello throughout the organization in a coordinated rollout. In some ways, this method is similar to any other desktop deployment project; the only real difference is that you must already have the Windows Hello infrastructure in place to support device registration before you can start using Windows Hello on Windows 10 devices. - -You can still upgrade to Windows 10 or add new Windows 10 devices without changing your infrastructure. You just can’t use Windows Hello for Business on a device until the device joins Azure AD and receives the appropriate policy. The major benefit of this approach is that it provides uniform protection for all parts of the organization. Sophisticated attackers have shown a great deal of skill in breaching large organizations by identifying weak points in their security, including users and systems that don’t have high-value information but that can be exploited to get it. Applying consistent protection across every device that an attacker could use to access enterprise data is excellent protection against these types of attacks. - -The downside to this approach is its complexity. Smaller organizations may find that managing the rollout of a new operating system across all devices is beyond the scope of their experience and capability. For these organizations, users can self-upgrade, and new users may end up with Windows 10 because they get new devices when they join. Larger organizations, especially those that are highly decentralized or have operations across many physical sites, may have more deployment knowledge and resources but face the challenge of coordinating rollout efforts across a larger user base and footprint. - -For more information about desktop deployment of Windows 10, visit the [Windows 10 TechCenter](https://technet.microsoft.com/windows/mt240567). - -One key aspect of this deployment strategy is how to get Windows 10 in users’ hands. Because different organizations have wildly differing strategies to refresh hardware and software, there’s no one-size-fits-all strategy. For example, some organizations pursue a coordinated strategy that puts new desktop operating systems in users’ hands every 2–3 years on existing hardware, supplementing with new hardware only where and when required. Others tend to replace hardware and deploy whatever version of the Windows client operating system ships on the purchased devices. In both cases, there are typically separate deployment cycles for servers and server operating systems, and the desktop and server cycles may or may not be coordinated. - -In addition to the issue of Windows 10 deployment to users, you must consider how and when (or if!) you’ll deploy biometric devices to users. Because Windows Hello can take advantage of multiple biometric identifiers, you have a flexible range of device options, which includes the purchase of new devices that incorporate your selected biometric, seeding select users with appropriate devices, rollout of biometric devices as part of a scheduled hardware refresh and using PIN gestures until users get devices, or relying on remote unlock as a second authentication factor. - -### Deploy to high-value or high-risk targets - -This strategy takes into account the fact that in most networks, not every asset is equally protected or equally valuable. There are two ways to think about this. One is that you can focus on protecting the users and services that are most at risk of compromise because of their value. Examples include sensitive internal databases or the user accounts of your key executives. The other option is that you can focus on areas of your network that are the most vulnerable, such as users who travel frequently (and thus run a higher risk of lost or stolen devices or drive-by credential theft). Either way, the strategy is the same: selectively and quickly deploy Windows Hello to protect specific people and resources. For example, you might issue new Windows 10 devices with biometric sensors to all users who need access to a sensitive internal database, and then deploy the minimum required infrastructure to support Windows Hello–secured access to that database for those users. -One of the key design capabilities of Windows Hello for Business is that it supports Bring Your Own Device (BYOD) environments by allowing users to register their own devices with the organizational IDP (whether on premises, hybrid, or Azure AD). You may be able to take advantage of this capability to quickly deploy Windows Hello to protect your most vulnerable users or assets, ideally by using biometrics as an additional safety measure for the most valuable potential targets. - -### Blend Windows Hello with your infrastructure - -Organizations that have already invested in smart cards, virtual smart cards, or token-based systems can still benefit from Windows Hello. Of those organizations, many use physical tokens and smart cards to protect only critical assets because of the expense and complexity of their deployment. Windows Hello offers a valuable complement to these systems because it protects users who currently rely on reusable credentials; protection of all users’ credentials is an important step toward blunting attacks that seek to leverage compromise of any credential into a widespread breach. This approach also gives you a great deal of flexibility in scheduling and deployment. Some enterprises have deployed multi-use smart cards that provide building-access control, access to copiers or other office equipment, stored value for lunchroom purchases, remote network access, and other services. Deployment of Windows Hello in such environments doesn’t prevent you from continuing to use smart cards for these services. You can leave the existing smart card infrastructure in place for its existing use cases, and then register desktop and mobile devices in Windows Hello and use Windows Hello to secure access to network and Internet resources. This approach requires a more complicated infrastructure and a greater degree of organizational maturity because it requires you to link your existing PKI with an enrollment service and Windows Hello itself. - -Smart cards can act as a useful complement to Windows Hello in another important way: to bootstrap the initial logon for Windows Hello registration. When a user registers with Windows Hello on a device, part of that registration process requires a conventional logon. Rather than using a traditional password, organizations that have previously deployed the necessary infrastructure for smart cards or virtual smart cards can allow their users to register new devices by logging on with a smart card or virtual smart card. After the user has proved his or her identity to the organizational IDP with the smart card, the user can set up a PIN and proceed to use Windows Hello for future logons. - -### Choose a rollout method - -Which rollout method you choose depends on several factors: - -- **How many devices you need to deploy**. This number has a huge influence on your overall deployment. A global rollout for 75,000 users has different requirements than a phased rollout for groups of 200–300 users in different cities. -- **How quickly you want to deploy Windows Hello for Business protection**. This is a classic cost–benefit tradeoff. You have to balance the security benefits of Windows Hello for Business against the cost and time required to deploy it broadly, and different organizations may make entirely different decisions depending on how they rate the costs and benefits involved. Getting the broadest possible Windows Hello coverage in the shortest time possible maximizes security benefits. -- **The type of devices you want to deploy**. Windows device manufacturers are aggressively introducing new devices optimized for Windows 10, leading to the possibility that you might deploy Windows Hello first on newly purchased tablets and portable devices, and then deploy it on the desktop as part of your normal refresh cycle. --** What your current infrastructure looks like**. The individual version of Windows Hello doesn’t require changes to your Active Directory environment, but to support Windows Hello for Business, you may need a compatible MDM system. Depending on the size and composition of your network, mobile enrollment and management services deployment may be a major project in its own right. -- **Your plans for the cloud**. If you’re already planning a move to the cloud, Azure AD eases the process of Windows Hello for Business deployment, because you can use Azure AD as an IDP alongside your existing on-premises AD DS setup without making significant changes to your on-premises environment. Future versions of Windows Hello for Business will support the ability to simultaneously register devices that are already members of an on-premises AD DS domain in an Azure AD partition so that they use Windows Hello for Business from the cloud. Hybrid deployments that combine AD DS with Azure AD give you the ability to keep machine authentication and policy management against your local AD DS domain while providing the full set of Windows Hello for Business services (and Microsoft Office 365 integration) for your users. If you plan to use on-premises AD DS only, then the design and configuration of your on-premises environment will dictate what kind of changes you may need to make. ## How to use Windows Hello for Business with Azure Active Directory @@ -414,7 +373,7 @@ There are three scenarios for using Windows Hello for Business in Azure AD–onl - **Organizations that use the free tier of Azure AD**. For these organizations, Microsoft has not enabled automatic domain join to Azure AD. Organizations that have signed up for the free tier have the option to enable or disable this feature, so automatic domain join won’t be enabled unless and until the organization’s administrators decide to enable it. When that feature is enabled, devices that join the Azure AD domain by using the Connect to work or school dialog box will be automatically registered with Windows Hello for Business support, but previously joined devices will not be registered. - **Organizations that have subscribed to Azure AD Premium** have access to the full set of Azure AD MDM features. These features include controls to manage Windows Hello for Business. You can set policies to disable or force the use of Windows Hello for Business, require the use of a TPM, and control the length and strength of PINs set on the device. -If you want to use Windows Hello for Business with certificates, you’ll need a device registration system. That means that you set up Configuration Manager Technical Preview, Intune, or a compatible non-Microsoft MDM system and enable it to enroll devices. This is a prerequisite step to use Windows Hello for Business with certificates, no matter the IDP, because the enrollment system is responsible for provisioning the devices with the necessary certificates. Set Microsoft Passport policies +If you want to use Windows Hello for Business with certificates, you’ll need a device registration system. That means that you set up Configuration Manager Technical Preview, Intune, or a compatible non-Microsoft MDM system and enable it to enroll devices. This is a prerequisite step to use Windows Hello for Business with certificates, no matter the IDP, because the enrollment system is responsible for provisioning the devices with the necessary certificates. diff --git a/windows/keep-secure/manage-identity-verification-using-microsoft-passport.md b/windows/keep-secure/manage-identity-verification-using-microsoft-passport.md index c3ef3e00eb..81cef9cc41 100644 --- a/windows/keep-secure/manage-identity-verification-using-microsoft-passport.md +++ b/windows/keep-secure/manage-identity-verification-using-microsoft-passport.md @@ -16,115 +16,3 @@ redirect_url: https://technet.microsoft.com/en-us/itpro/windows/keep-secure/hell - Windows 10 - Windows 10 Mobile -In Windows 10, Windows Hello for Business replaces passwords with strong two-factor authentication on PCs and mobile devices. This authentication consists of a new type of user credential that is tied to a device and a biometric or PIN. - ->[!NOTE] -> When Windows 10 first shipped, it included Microsoft Passport and Windows Hello, which worked together to provide multi-factor authentication. To simplify deployment and improve supportability, Microsoft has combined these technologies into a single solution under the Windows Hello name. Customers who have already deployed Microsoft Passport for Work will not experience any change in functionality. Customers who have yet to evaluate Windows Hello will find it easier to deploy due to simplified policies, documentation, and semantics. - -Hello addresses the following problems with passwords: -- Passwords can be difficult to remember, and users often reuse passwords on multiple sites. -- Server breaches can expose symmetric network credentials. -- Passwords can be subject to [replay attacks](https://go.microsoft.com/fwlink/p/?LinkId=615673). -- Users can inadvertently expose their passwords due to [phishing attacks](https://go.microsoft.com/fwlink/p/?LinkId=615674). - -Hello lets users authenticate to: -- a Microsoft account. -- an Active Directory account. -- a Microsoft Azure Active Directory (Azure AD) account. -- Identity Provider Services or Relying Party Services that support [Fast ID Online (FIDO) v2.0](https://go.microsoft.com/fwlink/p/?LinkId=533889) authentication - -After an initial two-step verification of the user during enrollment, Hello is set up on the user's device and the user is asked to set a gesture, which can be a biometric, such as a fingerprint, or a PIN. The user provides the gesture to verify their identity. Windows then uses Hello to authenticate users and help them to access protected resources and services. - -As an administrator in an enterprise or educational organization, you can create policies to manage Hello use on Windows 10-based devices that connect to your organization. - - ## Biometric sign-in - - Windows Hello provides reliable, fully integrated biometric authentication based on facial recognition or fingerprint matching. Hello uses a combination of special infrared (IR) cameras and software to increase accuracy and guard against spoofing. Major hardware vendors are shipping devices that have integrated Windows Hello-compatible cameras, and fingerprint reader hardware can be used or added to devices that don’t currently have it. On devices that support Windows Hello, an easy biometric gesture unlocks users’ credentials. - - - **Facial recognition**. This type uses special cameras that see in IR light, which allows them to reliably tell the difference between a photograph or scan and a living person. Several vendors are shipping external cameras that incorporate this technology, and major laptop manufacturers are incorporating it into their devices, as well. -- **Fingerprint recognition**. This type uses a capacitive fingerprint sensor to scan your fingerprint. Fingerprint readers have been available for Windows computers for years, but the current generation of sensors is significantly more reliable and less error-prone. Most existing fingerprint readers (whether external or integrated into laptops or USB keyboards) work with Windows 10. - -Biometric data used to implement Windows Hello is stored securely on the local device only. It doesn’t roam and is never sent to external devices or servers. Because Windows Hello only stores biometric identification data on the device, there’s no single collection point an attacker can compromise to steal biometric data. - - -## The difference between Windows Hello and Windows Hello for Business - -- Individuals can create a PIN or biometric gesture on their personal devices for convenient sign-in. This use of Hello provides a layer of protection by being unique to the device on which it is set up, however it is not backed by certificate-based authentication. - -- Windows Hello for Business, which is configured by Group Policy or MDM policy, uses key-based or certificate-based authentication. - -- Currently Active Directory accounts using Windows Hello are not backed by key-based or certificate-based authentication. Support for key-based or certificate-based authentication is on the roadmap for a future release. - -## Benefits of Windows Hello - -Reports of identity theft and large-scale hacking are frequent headlines. Nobody wants to be notified that their user name and password have been exposed. - -You may wonder [how a PIN can help protect a device better than a password](why-a-pin-is-better-than-a-password.md). Passwords are shared secrets; they are entered on a device and transmitted over the network to the server. An intercepted account name and password can be used by anyone. Because they're stored on the server, a server breach can reveal those stored credentials. - -In Windows 10, Hello replaces passwords. The Hello provisioning process creates a cryptographic key pair bound to the Trusted Platform Module (TPM), if a device has a TPM, or in software. Access to these keys and obtaining a signature to validate user possession of the private key is enabled only by the PIN or biometric gesture. The two-step verification that takes place during Hello enrollment creates a trusted relationship between the identity provider and the user when the public portion of the public/private key pair is sent to an identity provider and associated with a user account. When a user enters the gesture on the device, the identify provider knows from the combination of Hello keys and gesture that this is a verified identity and provides an authentication token that allows Windows 10 to access resources and services. In addition, during the registration process, the attestation claim is produced for every identity provider to cryptographically prove that the Hello keys are tied to TPM. During registration, when the attestation claim is not presented to the identity provider, the identity provider must assume that the Hello key is created in software. - -![how authentication works in windows hello](images/authflow.png) - -Imagine that someone is looking over your shoulder as you get money from an ATM and sees the PIN that you enter. Having that PIN won't help them access your account because they don't have your ATM card. In the same way, learning your PIN for your device doesn't allow that attacker to access your account because the PIN is local to your specific device and doesn't enable any type of authentication from any other device. - -Hello helps protect user identities and user credentials. Because no passwords are used, it helps circumvent phishing and brute force attacks. It also helps prevent server breaches because Hello credentials are an asymmetric key pair, which helps prevent replay attacks when these keys are protected by TPMs. - -Hello also enables Windows 10 Mobile devices to be used as [a remote credential](prepare-people-to-use-microsoft-passport.md#bmk-remote) when signing into Windows 10 PCs. During the sign-in process, the Windows 10 PC can connect using Bluetooth to access Hello on the user’s Windows 10 Mobile device. Because users carry their phone with them, Hello makes implementing two-factor authentication across the enterprise less costly and complex than other solutions. - -> [!NOTE] ->  Phone sign-in is currently limited to select Technology Adoption Program (TAP) participants. - - - -### How Windows Hello for Business works : Key points - -- Hello credentials are based on certificate or asymmetrical key pair. Hello credentials are bound to the device, and the token that is obtained using the credential is also bound to the device. -- Identify provider (such as Active Directory, Azure AD, or a Microsoft account) validates user identity and maps Hello's public key to a user account during the registration step. -- Keys can be generated in hardware (TPM 1.2 or 2.0 for enterprises, and TPM 2.0 for consumers) or software, based on the policy. -- Authentication is the two-factor authentication with the combination of a key or certificate tied to a device and something that the person knows (a PIN) or something that the person is (Windows Hello). The Hello gesture does not roam between devices and is not shared with the server; it is stored locally on a device. -- Private key never leaves a device. The authenticating server has a public key that is mapped to the user account during the registration process. -- PIN entry and biometric gesture both trigger Windows 10 to verify the user's identity and authenticate using Hello keys or certificates. -- Personal (Microsoft account) and corporate (Active Directory or Azure AD) accounts use a single container for keys. All keys are separated by identity providers' domains to help ensure user privacy. -- Certificate private keys can be protected by the Hello container and the Hello gesture. - -For a detailed explanation, see [How Windows Hello for Business works](hello-how-it-works.md). - -## Comparing key-based and certificate-based authentication - -Windows Hello for Business can use either keys (hardware or software) or certificates with keys in hardware or software to confirm identity. Enterprises that have a public key infrastructure (PKI) for issuing and managing certificates can continue to use PKI in combination with Hello. Enterprises that do not use PKI or want to reduce the effort associated with managing certificates can rely on key-based credentials for Hello. - -Hardware-based keys, which are generated by TPM, provide the highest level of assurance. When the TPM is manufactured, an Endorsement Key (EK) certificate is resident in the TPM. This EK certificate creates a root trust for all other keys that are generated on this TPM. -EK certification is used to generate an attestation identity key (AIK) certificate issued by a Microsoft certificate authority. This AIK certificate can be used as an attestation claim to prove to identity providers that the Hello keys are generated on the same TPM. The Microsoft certificate authority (CA) generates the AIK certificate per device, per user, and per IDP to help ensure that user privacy is protected. - -When identity providers such as Active Directory or Azure AD enroll a certificate in Hello, Windows 10 will support the same set of scenarios as a smart card. When the credential type is a key, only key-based trust and operations will be supported. - -## Learn more - -[Introduction to Windows Hello](https://go.microsoft.com/fwlink/p/?LinkId=786649), video presentation on Microsoft Virtual Academy - -[What's new in Active Directory Domain Services for Windows Server 2016](https://go.microsoft.com/fwlink/p/?LinkId=708533) - -[Windows Hello face authentication](https://go.microsoft.com/fwlink/p/?LinkId=626024) - -[Biometrics hardware guidelines](https://go.microsoft.com/fwlink/p/?LinkId=626995) - -[Windows 10: Disrupting the Revolution of Cyber-Threats with Revolutionary Security!](https://go.microsoft.com/fwlink/p/?LinkId=533890) - -[Windows 10: The End Game for Passwords and Credential Theft?](https://go.microsoft.com/fwlink/p/?LinkId=533891) - -[Authenticating identities without passwords through Microsoft Passport](https://go.microsoft.com/fwlink/p/?LinkId=616778) - -[Microsoft Passport guide](https://go.microsoft.com/fwlink/p/?LinkId=691928) - -## Related topics - -- [Manage identity verification using Windows Hello for Business](hello-manage-identity-verification.md) -- [How Windows Hello for Business works](hello-how-it-works.md) -- [Implement Windows Hello for Business in your organization](hello-implement-in-organization.md) -- [Enable phone sign-in to PC or VPN](hello-enable-phone-signin.md) -- [Why a PIN is better than a password](hello-why-pin-is-better-than-password.md) -- [Prepare people to use Windows Hello](hello-prepare-people-to-use.md) -- [Windows Hello and password changes](hello-and-password-changes.md) -- [Windows Hello errors during PIN creation](hello-errors-during-pin-creation.md) -- [Event ID 300 - Windows Hello successfully created](hello-event-300.md) -- [Windows Hello biometrics in the enterprise](hello-biometrics-in-enterprise.md) \ No newline at end of file From 37d12727f548379883685ef787e83a4389b32369 Mon Sep 17 00:00:00 2001 From: jdeckerMS Date: Mon, 23 Jan 2017 11:11:48 -0800 Subject: [PATCH 21/87] fix redirect link --- .../keep-secure/microsoft-passport-guide.md | 382 +----------------- 1 file changed, 1 insertion(+), 381 deletions(-) diff --git a/windows/keep-secure/microsoft-passport-guide.md b/windows/keep-secure/microsoft-passport-guide.md index 4a17fd3d20..faa85f4206 100644 --- a/windows/keep-secure/microsoft-passport-guide.md +++ b/windows/keep-secure/microsoft-passport-guide.md @@ -8,7 +8,7 @@ ms.mktglfcycl: plan ms.sitesec: library ms.pagetype: security author: challum -redirect_url: https://technet.microsoft.com/en-us/itpro/windows/keep-secure/hello-implement-in-organization +redirect_url: https://technet.microsoft.com/en-us/itpro/windows/keep-secure/hello-identity-verification --- # Microsoft Passport guide @@ -16,383 +16,3 @@ redirect_url: https://technet.microsoft.com/en-us/itpro/windows/keep-secure/hell **Applies to** - Windows 10 -This guide describes the new Windows Hello and Microsoft Passport technologies that are part of the Windows 10, version 1511 operating system. It highlights specific capabilities of these technologies that help mitigate threats from conventional credentials and provides guidance about how to design and deploy these technologies as part of your Windows 10 rollout. - ->[!NOTE] ->For information about Windows Hello for Business in Windows 10, version 1607, see [Manage identity verification using Windows Hello for Business](manage-identity-verification-using-microsoft-passport.md). - -A fundamental assumption about information security is that a system can identify who’s using it. In identifying a user, the system can decide whether the user has identified himself or herself appropriately (a process known as authentication), and then determine what that properly authenticated user should be able to do (a process known as authorization). The overwhelming majority of computer systems deployed throughout the world depend on user credentials as a means of making authentication and authorization decisions, and that means that these systems depend on reusable, user-created passwords for their security. The oft-cited maxim that authentication can involve “something you know, something you have, or something you are” neatly highlights the issue: a reusable password is an authentication factor all by itself, so anyone who knows the password can impersonate the user who owns it. - -## Problems with traditional credentials - -Ever since the mid-1960s, when Fernando Corbató and his team at the Massachusetts Institute of Technology championed the introduction of the password, users and administrators have had to deal with the use of passwords for user authentication and authorization. Over time, the state of the art for password storage and use has advanced somewhat (with password hashing and salt being the two most noticeable improvements), but we’re still faced with two serious problems: passwords are easy to clone and easy to steal. Implementation faults may render them insecure, and users have a hard time balancing convenience and security. - -**Credential theft** - -The biggest risk of passwords is simple: an attacker can steal them easily. Every place a password is entered, processed, or stored is vulnerable. For example, an attacker can steal a collection of passwords or hashes from an authentication server by eavesdropping on network traffic to an application server, by implanting malware in an application or on a device, by logging user keystrokes on a device, or by watching to see which characters a user types — and those are just the most common attack methods. One can enact more exotic attacks to steal one or many passwords. - -The risk of theft is driven by the fact that the authentication factor the password represents is the password. Without additional authentication factors, the system assumes that anyone who knows the password is the authorized user. -Another, related risk is that of credential replay, in which an attacker captures a valid credential by eavesdropping on an insecure network, and then replays it later to impersonate a valid user. Most authentication protocols (including Kerberos and OAuth) protect against replay attacks by including a time stamp in the credential exchange process, but that protects the token that the authentication system issues, not the password that the user provides to get the ticket in the first place. - -**Credential reuse** - -The common approach of using an email address as the user name makes a bad problem worse. An attacker who successfully recovers a user name–password pair from a compromised system can then try that same pair on other systems. Surprisingly often, this tactic works to allow attackers to springboard from a compromised system into other systems. The use of email addresses as user names leads to other problems, too, which we’ll explore later in this guide. - -### - -**Trading convenience for complexity** -Most security is a tradeoff between convenience and security: the more secure a system is, the less convenient it will typically be for users. Although system designers and implementers have a broad range of tools to make their systems more secure, users get a vote, too. When users perceive that a security mechanism gets in the way of what they want to do, they often look for ways to circumvent it. This behavior leads to an arms race of sorts, with users adopting strategies to minimize the effort required to comply with their organization’s password policies as those policies evolve. - -**Password complexity** - -If the major risk to passwords is that an attacker might guess them through brute-force analysis, it might seem reasonable to require users to include a broader character set in their passwords or make them longer, but as a practical matter, password length and complexity requirements have two negative side effects. First, they encourage password reuse. Estimates by [Herley, Florêncio, and van Oorschot](https://go.microsoft.com/fwlink/p/?LinkId=627392) calculate that the stronger a password is, the more likely it is to be reused. Because users put more effort into the creation and memorization of strong passwords, they are much more likely to use the same credential across multiple systems. Second, adding length or character set complexity to passwords does not necessarily make them more difficult to guess. For example, P@ssw0rd1 is nine characters long and includes uppercase and lowercase letters, numbers, and special characters, but it’s easily guessed by many of the common password-cracking tools now available on the Internet. These tools can attack passwords by using a pre-computed dictionary of common passwords, or they can start with a base word such as password, and then apply common character substitutions. A completely random eight-character password might therefore actually take longer to guess than P@ssw0rd123. - -**Password expiration** - -Because a reusable password is the only authentication factor in password-based systems, designers have attempted to reduce the risk of credential theft and reuse. One common method for doing so is the use of limited-lifetime passwords. Some systems allow for passwords that can be used only once, but by far the more common approach is to make passwords expire after a certain period. Limiting the useful lifetime of a password puts a cap on how long a stolen password will be useful to an attacker. This practice helps protect against cases where a long-lived password is stolen, held, and used for a long time, but it also harkens back to the time when password cracking was impractical for everyone except nation state-level attackers. A smart attacker would attempt to steal passwords rather than crack them because of the time penalty associated with password cracking. -The widespread availability of commodity password-cracking tools and the massive computing power available through mechanisms such as GPU-powered crackers or distributed cloud-based cracking tools has reversed this equation so that it is often more effective for an attacker to crack a password than to try to steal it. In addition, the widespread availability of self-service [password-reset mechanisms](#password-reset) means that an attacker needs only a short window of time during which the password is valid to change the password and thus reset the validity period. Relatively few enterprise networks provide self-service password-reset mechanisms, but they are common for Internet services. In addition, many users use the secure credential store on Windows and Mac OS X systems to store valuable passwords for Internet services, so an attacker who can compromise the operating system password may be able to obtain a treasure trove of other service passwords at no cost. -Finally, overly short timelines for password expiration can tempt users to make small changes in their passwords at each expiration period — for example, moving from password123 to password456 to password789. This approach reduces the work necessary to crack the password, especially if the attacker knows any of the old passwords. - -### - -**Password-reset mechanisms** - -To let users better manage their own passwords, some services provide a way for users to change their own password. Some implementations require users to log on with their current password, while others allow users to select the **Forgot my password** option, which sends an email to the user’s registered email address. The problem with these mechanisms is that many of them are implemented such that an attacker can exploit them. For example, an attacker who can successfully guess or steal a user’s email password can merrily request password resets for all of the victim’s other accounts, because the reset emails go to the compromised account. For this reason, most enterprise networks are configured so that only administrators can reset user passwords; for example, Active Directory supports the use of a **Password must be changed on next logon** flag so that after the administrator resets a password, the user can reset the password only after providing the administrator-set password. Some mobile device management (MDM) systems support similar functionality for mobile devices. - -**User password carelessness** - -An insidious problem makes these design and implementation weaknesses worse: some users just aren’t careful with their passwords. They write them down in insecure locations, choose easy-to-guess passwords, take minimal (if any) precautions against malware, or even give their passwords to other people. These users aren’t necessarily careless because they don’t care; they want to get things done, and overly stringent password length or expiration policies or too many passwords hinders them. - -**Mitigate credential risks** - -Given the issues described so far, it might seem obvious that reusable passwords are a security hazard. The argument is simple: adding authentication factors reduces the value of the passwords themselves, because even a successful password theft won’t let an attacker log on to a system unless he or she also has the associated additional factors. Unfortunately, this simple argument has many practical complications. Security and operating system vendors have tried to solve the problems that reusable credentials pose for decades — with limited success. -The most obvious mitigation to the risks reusable passwords pose is to add one or more authentication factors. At different times over the past 30 years, different vendors have attempted to solve this problem by calling for the use of biometric identifiers (including fingerprints, iris and retina scans, and hand geometry), software-based and hardware-based tokens, physical and virtual smart cards, and voice or Short Message Service (SMS) authentication through the user’s mobile phone. A detailed description of each of these authenticators and its pros and cons is outside the scope of this guide, but no matter which authentication method you choose, core challenges have limited adoption of all Multi-Factor Authentication (MFA) solutions, including: -- **Infrastructure complexity and cost.** Any system that requires the user to provide an additional authentication factor at the point of access has to have a way to collect that information. Although it’s possible to retrofit fielded hardware by adding fingerprint readers, eye scanners, smart card readers, and so on, few enterprises have been willing to take on the cost and support burden required to do so. -- **Lack of standardization.** Although Microsoft included operating system–level smart card support as part of the Windows Vista operating system, smart card and reader vendors were free to continue to ship their own drivers, as were manufacturers of other authentication devices. Lack of standardization led to both application and support fragmentation, which means that it wasn’t always possible to mix and match solutions within an enterprise, even when the manufacturers of those solutions advertised them as being compatible. -- **Backward compatibility.** Retrofitting already-deployed operating systems and applications to use MFA has proven an extremely difficult task. Nearly three years after its release, Microsoft Office 2013 is finally getting support for MFA. The vast majority of both commercial and custom line-of-business (LOB) applications will never be retrofitted to take advantage of any authentication system other than what the underlying operating system provides. -- **User inconvenience.** Solutions that require users to obtain, keep track of, and use physical tokens are often unpopular. If users have to have a particular token for remote access or other scenarios that are supposed to make things more convenient, they tend to become quickly dissatisfied with the burden of keeping up with an additional device. This pushback is multiplied for solutions that have to be attached to computers (such as smart card readers) because such solutions introduce problems of portability, driver support, and operating system and application integration. -- **Device compatibility.** Not every hardware form factor supports every authentication method. For example, despite occasional feeble efforts from vendors, no market for mobile phone-compatible smart card readers ever emerged. -So when Microsoft first implemented smart cards as an authenticator for remote network access, one key limitation was that employees could log on only from desktop or laptop computers that had smart card readers. Any authentication method that relies on additional hardware or software may run into this problem. For example, several popular “soft token” systems rely on mobile apps that run on a limited number of mobile hardware platforms. -Another pesky problem has to do with institutional knowledge and maturity. Strong authentication systems are complex. They have lots of components, and they can be expensive to design, maintain, and operate. For some enterprises, the additional cost and overhead of maintaining an in-house public key infrastructure (PKI) to issue smart cards or the burden of managing add-on devices exceeds the value they perceive in having stronger authentication. This is a special case of the common problem that financial institutions face: if the cost of fraud reduction is higher than the cost of the fraud itself, it’s hard to justify the economics of better fraud-prevention measures. - -## Solve credential problems - -Solving the problems that passwords pose is tricky. Tightening password policies alone won’t do it: users may just recycle, share, or write down passwords. Although user education is critical for authentication security, education alone doesn’t eliminate the problem, either. - -As you’ve seen, additional authenticators won’t necessarily help if the new authentication systems add complexity, cost, or fragility. In Windows 10, Microsoft addresses these problems with two new technologies: Windows Hello and Microsoft Passport. Working together, these technologies help increase both security and user convenience: -- Microsoft Passport replaces passwords with strong two-factor authentication (2FA) by verifying existing credentials and by creating a device-specific credential that a user gesture (either biometric or PIN-based) protects. This combination effectively replaces physical and virtual smart cards as well as reusable passwords for logon and access control. -- Windows Hello provides reliable, fully integrated biometric authentication based on facial recognition or fingerprint matching. Windows Hello uses a combination of special infrared (IR) cameras and software to increase accuracy and guard against spoofing. Major hardware vendors are shipping devices that have integrated Windows Hello-compatible cameras, and fingerprint reader hardware can be used or added to devices that don’t currently have it. On devices that support Windows Hello, an easy biometric gesture unlocks users’ Microsoft Passport credentials. - -## What is Windows Hello? - -Windows Hello is the name Microsoft has given to the new biometric sign-in system built into Windows 10. Because it is built directly into the operating system, Windows Hello allows face or fingerprint identification to unlock users’ devices. Authentication happens when the user supplies his or her unique biometric identifier to access the device-specific Microsoft Passport credentials, which means that an attacker who steals the device can’t log on to it unless that attacker has the PIN. The Windows secure credential store protects biometric data on the device. By using Windows Hello to unlock a device, the authorized user gains access to all of his or her Windows experience, apps, data, websites, and services. - -The Windows Hello authenticator is known as a Hello. A Hello is unique to the combination of an individual device and a specific user; it doesn’t roam among devices, isn’t shared with a server, and cannot easily be extracted from a device. If multiple users share a device, each user gets a unique Hello for that device. You can think of a Hello as a token you can use to unlock (or release) a stored credential: the Hello itself doesn’t authenticate you to an app or service, but it releases credentials that can. - -At the launch of Windows 10, the operating system supported three Hello types: -- **PIN.** Before you can use Windows Hello to enable biometrics on a device, you must choose a PIN as your initial Hello gesture. After you’ve set a PIN, you can add biometric gestures if you want to. You can always use the PIN gesture to release your credentials, so you can still unlock and use your device even if you can’t use your preferred biometric because of an injury or because the sensor is unavailable or not working properly. -- **Facial recognition.** This type uses special cameras that see in IR light, which allows them to reliably tell the difference between a photograph or scan and a living person. Several vendors are shipping external cameras that incorporate this technology, and major laptop manufacturers are incorporating it into their devices, as well. -- **Fingerprint recognition.** This type uses a capacitive fingerprint sensor to scan your fingerprint. Fingerprint readers have been available for Windows computers for years, but the current generation of sensors is significantly more reliable and less error-prone. Most existing fingerprint readers (whether external or integrated into laptops or USB keyboards) work with Windows 10. -Biometric data used to implement these Hello gestures is stored securely on the local device only. It doesn’t roam and is never sent to external devices or servers. Because Windows Hello only stores biometric identification data on the device, there’s no single collection point an attacker can compromise to steal biometric data. Breaches that expose biometrics collected and stored for other uses (such as fingerprints collected and stored for law enforcement or background check purposes) don’t pose a significant threat: an attacker who steals biometrics literally has only a template of the identifier, and that template cannot easily be converted to a form that the attacker can present to a biometric sensor. The data path for Windows Hello-compatible sensors is resistant to tampering, too, which further reduces the chance that an attacker will be able to successfully inject faked biometric data. In addition, before an attacker can even attempt to inject data into the sensor pipeline, that attacker must gain physical access to the device — and an attacker who can do that can mount several other, less difficult attacks. -Windows Hello offers several major benefits. First, when combined with Microsoft Passport, it effectively solves the problems of credential theft and sharing. Because an attacker must obtain both the device and the selected biometric, it is much more difficult to gain access without the user’s knowledge. Second, the use of biometrics means that users benefit from having a simple authenticator that’s always with them: there’s nothing to forget, lose, or leave behind. Instead of worrying about memorizing long, complex passwords, users can take advantage of a convenient, secure method for signing in to all their Windows devices. Finally, in many cases, there’s nothing additional to deploy or manage to use Windows Hello (although Microsoft Passport may require additional deployment, as described later in this guide). Windows Hello support is built directly into the operating system, and users or enterprises can add compatible biometric devices to provide biometric gesture recognition, either as part of a coordinated rollout or as individual users or groups decide to add the necessary sensors. Windows Hello is part of Windows, so no additional deployment is required to start using it. - -## What is Microsoft Passport? - -Windows Hello provides a robust way for a device to recognize an individual user; that addresses the first part of the path between a user and a requested service or data item. After the device has recognized the user, however, it still must authenticate the user before deciding whether to grant access to a requested resource. Microsoft Passport provides strong 2FA, fully integrated into Windows, that replaces reusable passwords with the combination of a specific device and a Hello or PIN. Microsoft Passport isn’t just a replacement for traditional 2FA systems, though. It’s conceptually similar to smart cards: authentication is performed by using cryptographic primitives instead of string comparisons, and the user’s key material is secure inside tamper-resistant hardware. Microsoft Passport doesn’t require the extra infrastructure components required for smart card deployment, either. In particular, you don’t need a PKI if you don’t currently have one. Microsoft Passport combines the major advantage of smart cards — deployment flexibility for virtual smart cards and robust security for physical smart cards — without any of their drawbacks. - -Microsoft Passport offers four significant advantages over the current state of Windows authentication: it’s more flexible, it’s based on industry standards, it’s an effective risk mitigator, and it’s ready for the enterprise. Let’s look at each of these advantages in more detail. - -**It’s flexible** - -Microsoft Passport offers unprecedented flexibility. Although the format and use of reusable passwords are fixed, Microsoft Passport gives both administrators and users options to manage authentication. First and foremost, Microsoft Passport works with both biometric identifiers and PINs, so users’ credentials are protected even on devices that don’t support biometrics. Users can even use their phone to release their credentials instead of a PIN or biometric gesture on the main device. Microsoft Passport seamlessly takes advantage of the hardware of the devices in use; as users upgrade to newer devices, Microsoft Passport is ready to use them, and organizations can upgrade existing devices by adding biometric sensors where appropriate. -Microsoft Passport offers flexibility in the datacenter, too. To deploy it, in some modes you must add Windows Server 2016 domain controllers to your Active Directory environment, but you don’t have to replace or remove your existing Active Directory servers — the servers required for Microsoft Passport build on and add capability to your existing infrastructure. You don’t have to change the domain or forest functional level, and you can either add on-premises servers or use Microsoft Azure Active Directory to deploy Microsoft Passport on your network. The choice of which users you should enable for Microsoft Passport use is completely up to you: you choose the policies and devices to support and which authentication factors you want users to have access to. This makes it easy to use Microsoft Passport to supplement existing smart card or token deployments by adding strong credential protection to users who don’t currently have it or to deploy Microsoft Passport in scenarios that call for extra protection for sensitive resources or systems (described in the [Design a Microsoft Passport deployment](#design) section). - -**It’s standardized** - -Both software vendors and enterprise customers have come to realize that proprietary identity and authentication systems are a dead end. The future lies with open, interoperable systems that allow secure authentication across a variety of devices, LOBs, and external applications and websites. To this end, a group of industry players formed the Fast IDentity Online Alliance (FIDO), a nonprofit organization intended to address the lack of interoperability among strong authentication devices as well as the problems users face when they have to create and remember multiple user names and passwords. The FIDO Alliance plans to change the nature of authentication by developing specifications that define an open, scalable, interoperable set of mechanisms that supplant reliance on passwords to securely authenticate users of online services. This new standard for security devices and browser plug ins will allow any website or cloud application to interface with a broad variety of existing and future FIDO-enabled devices that the user has for online security. For more information, see the [FIDO Alliance website](https://go.microsoft.com/fwlink/p/?LinkId=627393). - -In 2013, Microsoft joined the FIDO Alliance. FIDO standards enable a universal framework that a global ecosystem delivers for a consistent and greatly improved user experience of strong passwordless authentication. The FIDO 1.0 specifications, published in December 2014, provide for two types of authentications: passwordless (known as the Universal Authentication Framework \[UAF\]) and 2nd Factor (U2F). The FIDO Alliance is working on a set of 2.0 proposals to combine the best parts of the U2F and UAF FIDO 1.0 standards. Microsoft is actively contributing to the proposals, and Windows 10 is a reference implementation of these concepts. In addition to supporting those protocols, the Windows implementation covers other aspects of the end-to-end experience that the specification does not cover, including user interface to, storage of, and protection for users’ device keys and the tokens issued after authentication; supporting administrator policies; and providing deployment tools. Microsoft expects to continue working with the FIDO Alliance as the FIDO 2.0 specification moves forward. Interoperability of FIDO products is a hallmark of FIDO authentication. Microsoft believes that bringing a FIDO solution to market will help solve a critical need for enterprises and consumers alike. - -**It’s effective** - -Microsoft Passport effectively mitigates two major security risks. First, by eliminating the use of reusable passwords for logon, it reduces the risk that a user’s credential will be copied or reused. On devices that support the Trusted Platform Module (TPM) standard, user key material can be stored in the user device’s TPM, which makes it more difficult for an attacker to capture the key material and reuse it. For devices that lack TPM, Microsoft Passport can encrypt and store credential data in software, but administrators can disable this feature to force a “TPM or nothing” deployment. -Second, because Microsoft Passport doesn’t depend on a single, centralized server, the risk of compromise from a breach of that server is removed. Although an attacker could theoretically compromise a single device, there’s no single point of attack that an intruder can leverage to gain widespread access to the environment. - -**It’s enterprise-ready** - -Every edition of Windows 10 includes Microsoft Passport functionality for individual use; enterprise and personal users can take advantage of Microsoft Passport to protect their individual credentials with compatible applications and services. In addition, enterprises whose users are running Windows 10 Professional and Windows 10 Enterprise have the ability to use Microsoft Passport for Work, an enhanced version of Microsoft Passport that includes the ability to centrally manage Microsoft Passport settings for PIN strength and biometric use through Group Policy Objects (GPOs). - -## How Microsoft Passport works - -To use Microsoft Passport to sign in with an identity provider (IDP), a user needs a configured device, which means that the Microsoft Passport life cycle starts when you configure a device for Microsoft Passport use. When the device is set up, its user can use the device to authenticate to services. In this section, we explore how device registration works, what happens when a user requests authentication, how key material is stored and processed, and which servers and infrastructure components are involved in different parts of this process. - -**Register a new user or device** - -A goal of Microsoft Passport is to allow a user to open a brand-new device, securely join an organizational network to download and manage organizational data, and create a new Hello gesture to secure the device. Microsoft refers to the process of setting up a device for use with Microsoft Passport as registration. -> **Note:**  This is separate from the organizational configuration required to use Microsoft Passport with Active Directory or Azure AD; that configuration is discussed later in this guide. This configuration must be completed before users can begin to register. -  -The registration process works like this: -1. The user configures an account on the device. - This account can be a local account on the device, a domain account stored in the on-premises Active Directory domain, a Microsoft account, or an Azure AD account. For a new device, this step may be as simple as logging on with a Microsoft account. Logging on with a Microsoft account on a Windows 10 device automatically sets up Microsoft Passport on the device; users don’t have to do anything extra to enable it. -2. To log on using that account, the user has to enter the existing credentials for it. - The IDP that “owns” the account receives the credentials and authenticates the user. This IDP authentication may include the use of an existing second authentication factor, or proof. For example, a user who registers a new device by using an Azure AD account will have to provide an SMS-based proof that Azure AD sends. -3. When the user has provided the proof to the IDP, the user enables PIN authentication (Figure 1). - The PIN will be associated with this particular credential. - - ![figure 1](images/passport-fig1.png) - - Figure 1. Set up a PIN in the **Account Settings** control panel item - - When the user sets the PIN, it becomes usable immediately (Figure 2). - - ![figure 2](images/passport-fig2-pinimmeduse.png) - - Figure 2. When set, the PIN is immediately usable - -Remember that Microsoft Passport depends on pairing a device and a credential, so the PIN chosen is associated only with the combination of the active account and that specific device. The PIN must comply with whatever length and complexity policy the account administrator has configured; this policy is enforced on the device side. Other registration scenarios that Microsoft Passport supports are: - -- A user who upgrades from the Windows 8.1 operating system will log on by using his or her existing enterprise password. That triggers MFA from the IDP side; after receiving and returning a proof, such as a text message or voice code, the IDP authenticates the user to the upgraded Windows 10 device, and the user can set his or her PIN. -- A user who typically uses a smart card to log on will be prompted to set up a PIN the first time he or she logs on to a Windows 10 device the user has not previously logged on to. -- A user who typically uses a virtual smart card to log on will be prompted to set up a PIN the first time he or she logs on to a Windows 10 device the user has not previously logged on to. - -When the user has completed this process, Microsoft Passport generates a new public–private key pair on the device. The TPM generates and stores this private key; if the device doesn’t have a TPM, the private key is encrypted and stored in software. This initial key is referred to as the protector key. It’s associated only with a single gesture; in other words, if a user registers a PIN, a fingerprint, and a face on the same device, each of those gestures will have a unique protector key. The protector key securely wraps the authentication key for a specific container. Each container has only one authentication key, but there can be multiple copies of that key wrapped with different unique protector keys (each of which is associated with a unique gesture). Microsoft Passport also generates an administrative key that the user or administrator can use to reset credentials, when necessary. In addition to the protector key, TPM-enabled devices generate a block of data that contains attestations from the TPM. - -At this point, the user has a PIN gesture defined on the device and an associated protector key for that PIN gesture. That means he or she is able to securely log on to the device with the PIN and thus that he or she can establish a trusted session with the device to add support for a biometric gesture as an alternative for the PIN. When you add a biometric gesture, it follows the same basic sequence: the user authenticates to the system by using his or her PIN, and then registers the new biometric (“smile for the camera!”), after which Windows generates a unique key pair and stores it securely. Future logons can then use either the PIN or the registered biometric gestures. - -**What’s a container?** - -You’ll often hear the term *container* used in reference to MDM solutions. Microsoft Passport uses the term, too, but in a slightly different way. Container in this context is shorthand for a logical grouping of key material or data. Windows 10 supports two containers: the default container holds user key material for personal accounts, including key material associated with the user’s Microsoft account or with other consumer identity providers, and the enterprise container holds credentials associated with a workplace or school account. - -The enterprise container exists only on devices that have been registered with an organization; it contains key material for the enterprise IDP, such as on-premises Active Directory or Azure AD. The enterprise container contains only key data for Active Directory or Azure AD. If the enterprise container is present on a device, it’s unlocked separately from the default container, which maintains separation of data and access across personal and enterprise credentials and services. For example, a user who uses a biometric gesture to log on to a managed computer can separately unlock his or her personal container by entering a PIN when logging on to make a purchase from a website. -These containers are logically separate. Organizations don’t have any control over the credentials users store in the default container, and applications that authenticate against services in the default container can’t use credentials from the enterprise container. However, individual Windows applications can use the Microsoft Passport application programming interfaces (APIs) to request access to credentials as appropriate, so that both consumer and LOB applications can be enhanced to take advantage of Microsoft Passport. - -It’s important to keep in mind that there are no physical containers on disk, in the registry, or elsewhere. Containers are logical units used to group related items. The keys, certificates, and credentials Microsoft Passport stores are protected without the creation of actual containers or folders. - -Each container actually contains a set of keys, some of which are used to protect other keys. Figure 3 shows an example: the protector key is used to encrypt the authentication key, and the authentication key is used to encrypt the individual keys stored in the container. - -![figure 3](images/passport-fig3-logicalcontainer.png) - -Figure 3. Each logical container holds one or more sets of keys - -Containers can contain several types of key material: - -- An *authentication key*, which is always an asymmetric public–private key pair. This key pair is generated during registration. It must be unlocked each time it’s accessed, by using either the user’s PIN or a previously generated biometric gesture. The authentication key exists until the user resets the PIN, at which time a new key will be generated. When the new key is generated, all the key material that the old key previously protected must be decrypted and re-encrypted using the new key. -- *Virtual smart card keys* are generated when a virtual smart card is generated and stored securely in the container. They’re available whenever the user’s container is unlocked. -- *Secure/Multipurpose Internet Mail Extensions (S/MIME) keys and certificates*, which a certification authority (CA) generates. The keys associated with the user’s S/MIME certificate can be stored in a Microsoft Passport container so they’re available to the user whenever the container is unlocked. -- The *IDP key*. These keys can be either symmetric or asymmetric, depending on which IDP you use. A single container may contain zero or more IDP keys, with some restrictions (for example, the enterprise container can contain zero or one IDP keys). IDP keys are stored in the container as illustrated in Figure 3. For certificate-based Microsoft Passport for Work, when the container is unlocked, applications that require access to the IDP key or key pair can request access. IDP keys are used to sign or encrypt authentication requests or tokens sent from this machine to the IDP. IDP keys are typically long lived but could have a shorter lifetime than the authentication key. -Microsoft accounts, Active Directory accounts, and Azure AD accounts all require the use of asymmetric key pairs. The device generates public and private keys, registers the public key with the IDP (which stores it for later verification), and securely stores the private key. For enterprises, the IDP keys can be generated in two ways: -- The IDP key pair can be associated with an enterprise CA through the Windows Network Device Enrollment Service (NDES), described more fully in [Network Device Enrollment Service Guidance](https://go.microsoft.com/fwlink/p/?LinkId=733947). In this case, Microsoft Passport requests a new certificate with the same key as the certificate from the existing PKI. This option lets organizations that have an existing PKI continue to use it where appropriate. Given that many applications, such as popular virtual private network systems, require the use of certificates, when you deploy Microsoft Passport in this mode, it allows a faster transition away from user passwords while still preserving certificate-based functionality. This option also allows the enterprise to store additional certificates in the protected container. -- The IDP can generate the IDP key pair directly, which allows quick, lower-overhead deployment of Microsoft Passport in environments that don’t have or need a PKI. - -**How keys are protected** - -Any time key material is generated, it must be protected against attack. The most robust way to do this is through specialized hardware. There’s a long history of using hardware security modules (HSMs) to generate, store, and process keys for security-critical applications. Smart cards are a special type of HSM, as are devices that are compliant with the Trusted Computing Group TPM standard. Wherever possible, the Microsoft Passport for Work implementation takes advantage of onboard TPM hardware to generate, store, and process keys. However, Microsoft Passport and Microsoft Passport for Work do not require an onboard TPM. Administrators can choose to allow key operations in software, in which case any user who has (or can escalate to) administrative rights on the machine can use the IDP keys to sign requests. As an alternative, in some scenarios, devices that don’t have a TPM can be remotely authenticated by using a device that does have a TPM, in which case all the sensitive operations are performed with the TPM and no key material is exposed. - -Whenever possible, Microsoft recommends the use of TPM hardware. The TPM protects against a variety of known and potential attacks, including PIN brute-force attacks. The TPM provides an additional layer of protection after an account lockout, too. When the TPM has locked the key material, the user will have to reset the PIN (which means he or she will have to use MFA to reauthenticate to the IDP before the IDP allows him or her to re-register). Resetting the PIN means that all keys and certificates encrypted with the old key material will be removed. - -**Authentication** - -When a user wants to access protected key material — perhaps to use an Internet site that requires a logon or to access protected resources on a corporate intranet — the authentication process begins with the user entering a PIN or biometric gesture to unlock the device, a process sometimes called *releasing the key*. Think of it like using a physical key to unlock a door: before you can unlock the door, you need to remove the key from your pocket or purse. On a personal device that’s connected to an organizational network, users will use their personal PIN or biometric to release the key; on a device joined to an on-premises or Azure AD domain, they will use the organizational PIN. -This process unlocks the protector key for the primary container on the device. When that container is unlocked, applications (and thus the user) can use whatever IDP keys reside inside the container. - -These keys are used to sign requests that are sent to the IDP, requesting access to specified resources. It’s important to understand that although the keys are unlocked, applications cannot use them at will. Applications can use specific APIs to request operations that require key material for particular actions (for example, decrypt an email message or log on to a website). Access through these APIs doesn’t require explicit validation through a user gesture, and the key material isn’t exposed to the requesting application. Rather, the application asks for authentication, encryption, or decryption, and the Microsoft Passport layer handles the actual work and returns the results. Where appropriate, an application can request a forced authentication even on an unlocked device. Windows prompts the user to reenter the PIN or perform an authentication gesture, which adds an extra level of protection for sensitive data or actions. For example, you can configure the Windows Store to require reauthentication any time a user purchases an application, even though the same account and PIN or gesture were already used to unlock the device. - -The actual authentication process works like this: - -1. The client sends an empty authentication request to the IDP. (This is merely for the handshake process.) -2. The IDP returns a challenge, known as a *nonce*. -3. The device signs the nonce with the appropriate private key. -4. The device returns the original nonce, the signed nonce, and the ID of the key used to sign the nonce. -5. The IDP fetches the public key that the key ID specified, uses it to verify the signature on the nonce, and verifies that the nonce the device returned matches the original. -6. If all the checks in step 5 succeed, the IDP returns two data items: a symmetric key, which is encrypted with the device’s public key, and a security token, which is encrypted with the symmetric key. -7. The device uses its private key to decrypt the symmetric key, and then uses that symmetric key to decrypt the token. -8. The device makes a normal authentication request for the original resource, presenting the token from the IDP as its proof of authentication. - -When the IDP validates the signature, it is verifying that the request came from the specified user and device. The private key specific to the device signs the nonce, which allows the IDP to determine the identity of the requesting user and device so that it can apply policies for content access based on user, device type, or both together. For example, an IDP could allow access to one set of resources only from mobile devices and a different set from desktop devices. - -Remote unlock, which is planned for a future release of Windows 10, builds on these scenarios by enabling seamless remote authentication from a mobile device as a second factor. For example, suppose that you’re visiting another office at your company and you need to borrow a computer there temporarily, but you don’t want to potentially expose your credentials to capture. Rather than type in your credentials, you can click **other user** on the Windows 10 logon screen, type your user name, pick the tile for remote authentication, and use an app on your phone, which you already unlocked by using its built-in facial-recognition sensors. The phone and computer are paired and handshake via Bluetooth, you type your authentication PIN on the phone, and the computer gets confirmation of your identity from the IDP. All this happens without typing a password anywhere or typing your PIN on the PC. - -**The infrastructure** - -Microsoft Passport depends on having compatible IDPs available to it. As of this writing, that means you have four deployment possibilities: -- Use an existing Windows-based PKI centered around Active Directory Certificate Services. This option requires additional infrastructure, including a way to issue certificates to devices. You can use NDES to register devices directly, Microsoft System Center Configuration Manager Technical Preview or later for on-premises environments, or Microsoft Intune where it’s available to manage mobile device participation in Microsoft Passport. -- You can configure Windows Server 2016 Technical Preview domain controllers to act as IDPs for Microsoft Passport. In this mode, the Windows Server 2016 Technical Preview domain controllers act as IDPs alongside any existing Windows Server 2008 R2 or later domain controllers. There is no requirement to replace all existing domain controllers, merely to introduce at least one Windows Server 2016 Technical Preview domain controller per Active Directory site and update the forest Active Directory Domain Services (AD DS) schema to Windows Server 2016 Technical Preview. -- The normal discovery mechanism that clients use to find domain controllers and global catalogs relies on Domain Name System (DNS) SRV records, but those records don’t contain version data. Windows 10 computers will query DNS for SRV records to find all available Active Directory servers, and then query each server to identify those that can act as Microsoft Passport IDPs. The number of authentication requests your users generate, where your users are located, and the design of your network all drive the number of Windows Server 2016 Technical Preview domain controllers required. -- Azure AD can act as an IDP either by itself or alongside an on-premises AD DS forest. Organizations that use Azure AD can register devices directly without having to join them to a local domain by using the capabilities the Azure AD Device Registration service provides. -In addition to the IDP, Microsoft Passport requires an MDM system. This system can be the cloud-based Intune if you use Azure AD, or an on-premises System Center Configuration Manager deployment that meets the system requirements described in the [Deployment requirements](#deployreq) section of this document. - -## Design a Microsoft Passport for Work deployment - -Microsoft Passport for Work is designed for integration with your existing and future directory infrastructure and device deployments, but this flexibility means there are many considerations to think about when you design your deployment. Some of these decisions are technical, while others are organizational or even political. In this section, we examine the key points where you have to make decisions about how to implement Microsoft Passport for Work. Remember, individual devices can use the individual version of Microsoft Passport without any infrastructure changes on your part. Microsoft Passport for Work allows you to control and centrally manage user authentication and device registration. To use the initial version of Microsoft Passport for Work, each device must have an Azure AD identity, so automatic registration of devices provides a means both to register new devices and to apply optional policies to manage Microsoft Passport for Work. - -**One deployment strategy** - -Different organizations will necessarily take different approaches to the deployment of Microsoft Passport depending on their capabilities and needs, but there is only one strategy: deploy Microsoft Passport for Work throughout the organization to get maximum protection for the maximum number of devices and resources. Organizations can take one of three basic routes to accomplish that strategy: - -- Deploy Microsoft Passport for Work everywhere according to whatever device or user deployment strategy works best for the organization. -- Deploy Microsoft Passport for Work first to high-value or high-risk targets, by using conditional access policies to restrict access to key resources only to users who hold strong authentication credentials. -- Blend Microsoft Passport for Work into an existing multi-factor environment, using it as an additional form of strong authentication alongside physical or virtual smart cards. - -**Deploy Microsoft Passport for Work everywhere** - -In this approach, you deploy Microsoft Passport throughout the organization in a coordinated rollout. In some ways, this method is similar to any other desktop deployment project; the only real difference is that you must already have the Microsoft Passport infrastructure in place to support device registration before you can start using Microsoft Passport on Windows 10 devices. - -> **Note:**  You can still upgrade to Windows 10 or add new Windows 10 devices without changing your infrastructure. You just can’t use Microsoft Passport for Work on a device until the device joins Azure AD and receives the appropriate policy. -  -The major benefit of this approach is that it provides uniform protection for all parts of the organization. Sophisticated attackers have shown a great deal of skill in breaching large organizations by identifying weak points in their security, including users and systems that don’t have high-value information but that can be exploited to get it. Applying consistent protection across every device that an attacker could use to access enterprise data is excellent protection against these types of attacks. - -The downside to this approach is its complexity. Smaller organizations may find that managing the rollout of a new operating system across all devices is beyond the scope of their experience and capability. For these organizations, users can self-upgrade, and new users may end up with Windows 10 because they get new devices when they join. Larger organizations, especially those that are highly decentralized or have operations across many physical sites, may have more deployment knowledge and resources but face the challenge of coordinating rollout efforts across a larger user base and footprint. - -For more information about desktop deployment of Windows 10, visit the [Windows 10 TechCenter](https://go.microsoft.com/fwlink/p/?LinkId=626581). - -One key aspect of this deployment strategy is how to get Windows 10 in users’ hands. Because different organizations have wildly differing strategies to refresh hardware and software, there’s no one-size-fits-all strategy. For example, some organizations pursue a coordinated strategy that puts new desktop operating systems in users’ hands every 2–3 years on existing hardware, supplementing with new hardware only where and when required. Others tend to replace hardware and deploy whatever version of the Windows client operating system ships on the purchased devices. In both cases, there are typically separate deployment cycles for servers and server operating systems, and the desktop and server cycles may or may not be coordinated. - -In addition to the issue of Windows 10 deployment to users, you must consider how and when (or if!) you’ll deploy biometric devices to users. Because Windows Hello can take advantage of multiple biometric identifiers, you have a flexible range of device options, which includes the purchase of new devices that incorporate your selected biometric, seeding select users with appropriate devices, rollout of biometric devices as part of a scheduled hardware refresh and using PIN gestures until users get devices, or relying on remote unlock as a second authentication factor. - -**Deploy to high-value or high-risk targets** - -This strategy takes into account the fact that in most networks, not every asset is equally protected or equally valuable. There are two ways to think about this. One is that you can focus on protecting the users and services that are most at risk of compromise because of their value. Examples include sensitive internal databases or the user accounts of your key executives. The other option is that you can focus on areas of your network that are the most vulnerable, such as users who travel frequently (and thus run a higher risk of lost or stolen devices or drive-by credential theft). Either way, the strategy is the same: selectively and quickly deploy Microsoft Passport to protect specific people and resources. For example, you might issue new Windows 10 devices with biometric sensors to all users who need access to a sensitive internal database, and then deploy the minimum required infrastructure to support Microsoft Passport–secured access to that database for those users. - -One of the key design capabilities of Microsoft Passport for Work is that it supports Bring Your Own Device (BYOD) environments by allowing users to register their own devices with the organizational IDP (whether on premises, hybrid, or Azure AD). You may be able to take advantage of this capability to quickly deploy Microsoft Passport to protect your most vulnerable users or assets, ideally by using biometrics as an additional safety measure for the most valuable potential targets. - -**Blend Microsoft Passport with your infrastructure** - -Organizations that have already invested in smart cards, virtual smart cards, or token-based systems can still benefit from Microsoft Passport. Of those organizations, many use physical tokens and smart cards to protect only critical assets because of the expense and complexity of their deployment. Microsoft Passport offers a valuable complement to these systems because it protects users who currently rely on reusable credentials; protection of all users’ credentials is an important step toward blunting attacks that seek to leverage compromise of any credential into a widespread breach. This approach also gives you a great deal of flexibility in scheduling and deployment. -Some enterprises have deployed multi-use smart cards that provide building-access control, access to copiers or other office equipment, stored value for lunchroom purchases, remote network access, and other services. Deployment of Microsoft Passport in such environments doesn’t prevent you from continuing to use smart cards for these services. You can leave the existing smart card infrastructure in place for its existing use cases, and then register desktop and mobile devices in Microsoft Passport and use Microsoft Passport to secure access to network and Internet resources. This approach requires a more complicated infrastructure and a greater degree of organizational maturity because it requires you to link your existing PKI with an enrollment service and Microsoft Passport itself. - -Smart cards can act as a useful complement to Microsoft Passport in another important way: to bootstrap the initial logon for Microsoft Passport registration. When a user registers with Microsoft Passport on a device, part of that registration process requires a conventional logon. Rather than using a traditional password, organizations that have previously deployed the necessary infrastructure for smart cards or virtual smart cards can allow their users to register new devices by logging on with a smart card or virtual smart card. After the user has proved his or her identity to the organizational IDP with the smart card, the user can set up a PIN and proceed to use Microsoft Passport for future logons. - -**Choose a rollout method** - -Which rollout method you choose depends on several factors: - -- **How many devices you need to deploy.** This number has a huge influence on your overall deployment. A global rollout for 75,000 users has different requirements than a phased rollout for groups of 200–300 users in different cities. -- **How quickly you want to deploy Microsoft Passport for Work protection.** This is a classic cost–benefit tradeoff. You have to balance the security benefits of Microsoft Passport for Work against the cost and time required to deploy it broadly, and different organizations may make entirely different decisions depending on how they rate the costs and benefits involved. Getting the broadest possible Microsoft Passport coverage in the shortest time possible maximizes security benefits. -- **The type of devices you want to deploy.** Windows device manufacturers are aggressively introducing new devices optimized for Windows 10, leading to the possibility that you might deploy Microsoft Passport first on newly purchased tablets and portable devices, and then deploy it on the desktop as part of your normal refresh cycle. -- **What your current infrastructure looks like.** The individual version of Microsoft Passport doesn’t require changes to your Active Directory environment, but to support Microsoft Passport for Work, you may need a compatible MDM system. Depending on the size and composition of your network, mobile enrollment and management services deployment may be a major project in its own right. -- **Your plans for the cloud.** If you’re already planning a move to the cloud, Azure AD eases the process of Microsoft Passport for Work deployment, because you can use Azure AD as an IDP alongside your existing on-premises AD DS setup without making significant changes to your on-premises environment. Future versions of Microsoft Passport for Work will support the ability to simultaneously register devices that are already members of an on-premises AD DS domain in an Azure AD partition so that they use Microsoft Passport for Work from the cloud. Hybrid deployments that combine AD DS with Azure AD give you the ability to keep machine authentication and policy management against your local AD DS domain while providing the full set of Microsoft Passport for Work services (and Microsoft Office 365 integration) for your users. If you plan to use on-premises AD DS only, then the design and configuration of your on-premises environment will dictate what kind of changes you may need to make. - -### - -**Deployment requirements** - -Table 1 lists six scenarios for deployment of Microsoft Passport for Work in the enterprise. The initial release of Windows 10 supports Azure AD–only scenarios, with support for on-premises Microsoft Passport for Work planned for a future release (see the [Roadmap](#roadmap) section for more details). - -Depending on the scenario you choose, Microsoft Passport for Work deployment may require four elements: - -- An organizational IDP that supports Microsoft Passport. This can be Azure AD or a set of on-premises Windows Server 2016 Technical Preview domain controllers in an existing AD DS forest. Using Azure AD means that you can establish hybrid identity management, with Azure AD acting as a Microsoft Passport IDP and your on-premises AD DS environment handling older authentication requests. This approach provides all the flexibility of Azure AD with the ability to manage computer accounts and devices running older versions of Windows and on-premises applications such as Microsoft Exchange Server or Microsoft SharePoint. -- If you use certificates, an MDM system is required to allow policy management of Microsoft Passport for Work. Domain-joined devices in on-premises or hybrid deployments require Configuration Manager Technical Preview or later. Deployments with Azure AD must use either Intune or a compatible non-Microsoft MDM solution. -- On-premises deployments require the forthcoming Active Directory Federation Services (AD FS) version included in Windows Server 2016 Technical Preview to support provisioning of Microsoft Passport credentials to devices. In this scenario, AD FS takes the place of the provisioning that Azure AD performs in cloud-based deployments. -- Certificate-based Microsoft Passport deployments require a PKI, including CAs that are accessible to all devices that need to register. If you deploy certificate-based Microsoft Passport on premises, you don’t actually need Windows Server 2016 Technical Preview domain controllers. On-premises deployments do need to apply the Windows Server 2016 Technical Preview AD DS schema and have the Windows Server 2016 Technical Preview version of AD FS installed. -Table 1. Deployment requirements for Microsoft Passport - -
------ - - - - - - - - - - - - - - - - - - - -
Microsoft Passport methodAzure ADHybrid Active Directory
Key-based

Azure AD subscription

    -
  • Azure AD subscription
    • -
  • [Azure AD Connect](https://go.microsoft.com/fwlink/p/?LinkId=616792)
    • -
  • A few Windows Server 2016 Technical Preview domain controllers on-site
    • -
  • A management solution, such as Configuration Manager, Group Policy, or MDM
    • -
  • Active Directory Certificate Services (AD CS) without Network Device Enrollment Service (NDES)
    • -
Certificate-based

Azure AD subscription

-

PKI infrastructure

-

Intune

    -
  • Azure AD subscription
    • -
  • [Azure AD Connect](https://go.microsoft.com/fwlink/p/?LinkId=616792)
    • -
  • AD CS with NDES
    • -
  • Configuration Manager (current branch) or Configuration Manager 2016 Technical Preview for domain-joined certificate enrollment, or InTune for non-domain-joined devices, or a non-Microsoft MDM service that supports Passport for Work
    • -
-  -Note that the current release of Windows 10 supports the Azure AD–only (RTM) and hybrid scenarios (RTM + November Update). Microsoft provides the forward-looking guidance in Table 1 to help organizations prepare their environments for planned future releases of Microsoft Passport for Work capabilities. - -**Select policy settings** - -Another key aspect of Microsoft Passport for Work deployment involves the choice of which policy settings to apply to the enterprise. There are two parts to this choice: which policies you deploy to manage Microsoft Passport itself and which policies you deploy to control device management and registration. A complete guide to selecting effective policies is beyond the scope of this guide, but one example reference that may be useful is [Mobile device management capabilities in Microsoft Intune](https://go.microsoft.com/fwlink/p/?LinkId=733877). - -## Implement Microsoft Passport - -No configuration is necessary to use Windows Hello or Microsoft Passport on individual user devices if those users just want to protect their personal credentials. Unless the enterprise disables the feature, users have the option to use Microsoft Passport for their personal credentials, even on devices that are registered with an organizational IDP. However, when you make Microsoft Passport for Work available for users, you must add the necessary components to your infrastructure, as described earlier in the [Deployment requirements](#deployreq) section. - -**How to use Azure AD** - -There are three scenarios for using Microsoft Passport for Work in Azure AD–only organizations: -- **Organizations that use the version of Azure AD included with Office 365.** For these organizations, no additional work is necessary. When Windows 10 was released to general availability, Microsoft changed the behavior of the Office 365 Azure AD stack. When a user selects the option to join a work or school network (Figure 4), the device is automatically joined to the Office 365 tenant’s directory partition, a certificate is issued for the device, and it becomes eligible for Office 365 MDM if the tenant has subscribed to that feature. In addition, the user will be prompted to log on and, if MFA is enabled, to enter an MFA proof that Azure AD sends to his or her phone. -- **Organizations that use the free tier of Azure AD.** For these organizations, Microsoft has not enabled automatic domain join to Azure AD. Organizations that have signed up for the free tier have the option to enable or disable this feature, so automatic domain join won’t be enabled unless and until the organization’s administrators decide to enable it. When that feature is enabled, devices that join the Azure AD domain by using the **Connect to work or school** dialog box shown in Figure 4 will be automatically registered with Microsoft Passport for Work support, but previously joined devices will not be registered. -- **Organizations that have subscribed to Azure AD Premium have access to the full set of Azure AD MDM features.** These features include controls to manage Microsoft Passport for Work. You can set policies to disable or force the use of Microsoft Passport for Work, require the use of a TPM, and control the length and strength of PINs set on the device. - - ![figure 4](images/passport-fig4-join.png) - - Figure 4: Joining an Office 365 organization automatically registers the device in Azure AD - -**Enable device registration** - -If you want to use Microsoft Passport at Work with certificates, you’ll need a device registration system. That means that you set up Configuration Manager Technical Preview, Intune, or a compatible non-Microsoft MDM system and enable it to enroll devices. This is a prerequisite step to use Microsoft Passport for Work with certificates, no matter the IDP, because the enrollment system is responsible for provisioning the devices with the necessary certificates. -**Set Microsoft Passport policies** - -As of the initial release of Windows 10, you can control the following settings for the use of Microsoft Passport for Work: -- You can require that Microsoft Passport be available only on devices that have TPM security hardware, which means the device uses TPM 1.2 or TPM 2.0. -- You can enable Microsoft Passport with a hardware-preferred option, which means that keys will be generated on TPM 1.2 or TPM 2.0 when available and by software when TPM is not available. -- You can configure whether certificate-based Microsoft Passport is available to users. You do this as part of the device deployment process, not through a separately applied policy. -- You can define the complexity and length of the PIN that users generate at registration. -- You can control whether Windows Hello use is enabled in your organization. - -These settings can be implemented through GPOs or through configuration service providers (CSPs) in MDM systems, so you have a familiar and flexible set of tools you can use to apply them to exactly the users you want. (For details about the Microsoft Passport for Work CSP, see [PassportForWork CSP)](https://go.microsoft.com/fwlink/p/?LinkId=733876). - -## Roadmap - -The speed at which Universal Windows apps and services evolve means that the traditional design-build-test-release cycle for Windows is too slow to meet customers’ needs. As part of the release of Windows 10, Microsoft is changing how it engineers, tests, and distributes Windows. Rather than large, monolithic releases every 3–5 years, the Windows engineering team is committed to smaller, more frequent releases to get new features and services into the marketplace more rapidly without sacrificing security, quality, or usability. This model has worked well in Office 365 and the Xbox ecosystem. - -In the Windows 10 initial release, Microsoft supports the following Microsoft Passport and Windows Hello features: - -- Biometric authentication, with fingerprint readers that use the Windows fingerprint reader framework -- Facial-recognition capability on devices that have compatible IR-capable cameras -- Microsoft Passport for personal credentials on individually owned and corporate-managed devices -- Microsoft Passport for Work support for organizations that have cloud-only Azure AD deployments -- Group Policy settings to control Microsoft Passport PIN length and complexity - -In future releases of Windows 10, we plan to add support for additional features: -- Additional biometric identifier types, including iris recognition -- Key-based Microsoft Passport for Work credentials for on-premises Azure AD deployments and hybrid on-premises/Azure AD deployments -- Microsoft Passport for Work certificates issued by a trusted PKI, including smart card and virtual smart card certificates -- TPM attestation to protect keys so that a malicious user or program can’t create keys in software (because those keys won’t be TPM attested and can thus be identified as fake) -- Group Policy and MDM settings to control Microsoft Passport PIN length and complexity - -In the November 2015 release, Microsoft supports the following Microsoft Passport and Windows Hello features: - -- Key-based Microsoft Passport for Work credentials for on-premises Azure AD deployments and hybrid on-premises/Azure AD deployments - -- Microsoft Passport for Work certificates issued by a trusted PKI, including smart card and virtual smart card certificates - -In future releases of Windows 10, we plan to add support for additional features: - -- Key-based and certificate-based Microsoft Passport for Work credentials for on-premises AD deployments - -- TPM attestation to protect keys so that a malicious user or program can’t create keys in software (because those keys won’t be TPM attested and can thus be identified as fake) - -In the longer term, Microsoft will continue to improve on and expand the features of both Microsoft Passport and Windows Hello to cover additional customer requirements for manageability and security. We also are working with the FIDO Alliance and a variety of third parties to encourage adoption of Microsoft Passport by both web and LOB application developers. -  -  From 3302bf396ae878d5c632d4557b4190fa98d1def8 Mon Sep 17 00:00:00 2001 From: jdeckerMS Date: Mon, 23 Jan 2017 11:41:17 -0800 Subject: [PATCH 22/87] fix typo --- .../keep-secure/change-history-for-keep-windows-10-secure.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/keep-secure/change-history-for-keep-windows-10-secure.md b/windows/keep-secure/change-history-for-keep-windows-10-secure.md index 30de1e7cdb..f144437a78 100644 --- a/windows/keep-secure/change-history-for-keep-windows-10-secure.md +++ b/windows/keep-secure/change-history-for-keep-windows-10-secure.md @@ -19,7 +19,7 @@ This topic lists new and updated topics in the [Keep Windows 10 secure](index.md |[Limitations while using Windows Information Protection (WIP)](limitations-with-wip.md) |Updated to include info about USB drives and Azure RMS (Windows Insider Program only) and to add more info about Work Folders and Offline files. | |[Recommended Enterprise Cloud Resources and Neutral Resources network settings with Windows Information Protection (WIP)](recommended-network-definitions-for-wip.md) |New | |[Using Outlook Web Access with Windows Information Protection (WIP)](using-owa-with-wip.md) |New | -| Microsoft Passport guide | Content merged into [MWindows Hello for Business](hello-identity-verification.md) topics | +| Microsoft Passport guide | Content merged into [Windows Hello for Business](hello-identity-verification.md) topics | ## December 2016 |New or changed topic |Description | From 440dcd11a3f559dd3427195396f8a20674bfb74e Mon Sep 17 00:00:00 2001 From: jdeckerMS Date: Mon, 23 Jan 2017 12:03:12 -0800 Subject: [PATCH 23/87] remove head --- windows/keep-secure/index.md | 5 ----- 1 file changed, 5 deletions(-) diff --git a/windows/keep-secure/index.md b/windows/keep-secure/index.md index f258d43aa8..5a4205583a 100644 --- a/windows/keep-secure/index.md +++ b/windows/keep-secure/index.md @@ -29,13 +29,8 @@ Learn about keeping Windows 10 and Windows 10 Mobile secure. |[Override Process Mitigation Options to help enforce app-related security policies](override-mitigation-options-for-app-related-security-policies.md) |Use Group Policy to override individual **Process Mitigation Options** settings and help to enforce specific app-related security policies. | | [VPN technical guide](vpn-guide.md) | Virtual private networks (VPN) let you give your users secure remote access to your company network. Windows 10 adds useful new VPN profile options to help you manage how users connect. | | [Windows security baselines](windows-security-baselines.md) | Learn why you should use security baselines in your organization. | -<<<<<<< HEAD -| [Security technologies](security-technologies.md) | Learn more about the different security technologies that are available in Windows 10 and Windows 10 Mobile. | -| [Enterprise security guides](windows-10-enterprise-security-guides.md) | Get proven guidance to help you better secure and protect your enterprise by using technologies such as Credential Guard and Device Guard. This section offers technology overviews and step-by-step guides. | -======= | [Security technologies](security-technologies.md) | Learn more about the different security technologies that are available in Windows 10 and Windows 10 Mobile. For example, learn about AppLocker, BitLocker, and Security auditing. | | [Enterprise security guides](windows-10-enterprise-security-guides.md) | Review technology overviews that help you understand Windows 10 security technologies in the context of the enterprise. | ->>>>>>> refs/remotes/origin/master | [Change history for Keep Windows 10 secure](change-history-for-keep-windows-10-secure.md) | This topic lists new and updated topics in the Keep Windows 10 secure documentation for [Windows 10 and Windows 10 Mobile](../index.md). |   ## Related topics From 6ca3447688dd0cd14343010aa1ea837870fd1c73 Mon Sep 17 00:00:00 2001 From: jdeckerMS Date: Mon, 23 Jan 2017 12:32:14 -0800 Subject: [PATCH 24/87] format --- windows/keep-secure/index.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/keep-secure/index.md b/windows/keep-secure/index.md index 5a4205583a..c730d90f2d 100644 --- a/windows/keep-secure/index.md +++ b/windows/keep-secure/index.md @@ -15,7 +15,7 @@ Learn about keeping Windows 10 and Windows 10 Mobile secure. ## In this section | Topic | Description | -| - | - | +| --- | --- | | [Block untrusted fonts in an enterprise](block-untrusted-fonts-in-enterprise.md) | To help protect your company from attacks which may originate from untrusted or attacker controlled font files, we’ve created the Blocking Untrusted Fonts feature. Using this feature, you can turn on a global setting that stops your employees from loading untrusted fonts processed using the Graphics Device Interface (GDI) onto your network. Untrusted fonts are any font installed outside of the %windir%/Fonts directory. Blocking untrusted fonts helps prevent both remote (web-based or email-based) and local EOP attacks that can happen during the font file-parsing process. | | [Device Guard certification and compliance](device-guard-certification-and-compliance.md) | Device Guard is a combination of hardware and software security features that, when configured together, will lock a device down so that it can only run trusted applications. If the app isn’t trusted it can’t run, period. It also means that even if an attacker manages to get control of the Windows kernel, he or she will be much less likely to be able to run malicious executable code after the computer restarts because of how decisions are made about what can run and when. | | [Windows Hello for Business](hello-identity-verification.md) | In Windows 10, Windows Hello replaces passwords with strong two-factor authentication on PCs and mobile devices. This authentication consists of a new type of user credential that is tied to a device and a biometric or PIN. | From 0dbce4ce5c3c5af2e02a5dac0483bcfb17da9e17 Mon Sep 17 00:00:00 2001 From: jdeckerMS Date: Mon, 23 Jan 2017 12:37:09 -0800 Subject: [PATCH 25/87] fix description --- windows/keep-secure/hello-identity-verification.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/keep-secure/hello-identity-verification.md b/windows/keep-secure/hello-identity-verification.md index a76b8219ff..cd1b5984c1 100644 --- a/windows/keep-secure/hello-identity-verification.md +++ b/windows/keep-secure/hello-identity-verification.md @@ -1,6 +1,6 @@ --- title: Windows Hello for Business (Windows 10) -description: In Windows 10, Windows Hello for Business replaces passwords with strong two-factor authentication on PCs and mobile devices. This authentication consists of a new type of user credential that is tied to a device and a biometric or PIN. +description: IWindows Hello for Business replaces passwords with strong two-factor authentication on PCs and mobile devices. ms.assetid: 5BF09642-8CF5-4FBC-AC9A-5CA51E19387E keywords: identity, PIN, biometric, Hello, passport ms.prod: w10 From 0bc7602df81da4e333b0cf4909c26ed5bc5755a8 Mon Sep 17 00:00:00 2001 From: jdeckerMS Date: Mon, 23 Jan 2017 12:37:44 -0800 Subject: [PATCH 26/87] fix heading --- windows/keep-secure/hello-identity-verification.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/keep-secure/hello-identity-verification.md b/windows/keep-secure/hello-identity-verification.md index cd1b5984c1..73b4d394ce 100644 --- a/windows/keep-secure/hello-identity-verification.md +++ b/windows/keep-secure/hello-identity-verification.md @@ -37,7 +37,7 @@ After an initial two-step verification of the user during enrollment, Windows He As an administrator in an enterprise or educational organization, you can create policies to manage Windows Hello for Business use on Windows 10-based devices that connect to your organization. - ## Biometric sign-in +## Biometric sign-in Windows Hello provides reliable, fully integrated biometric authentication based on facial recognition or fingerprint matching. Windows Hello uses a combination of special infrared (IR) cameras and software to increase accuracy and guard against spoofing. Major hardware vendors are shipping devices that have integrated Windows Hello-compatible cameras. Fingerprint reader hardware can be used or added to devices that don’t currently have it. On devices that support Windows Hello, an easy biometric gesture unlocks users’ credentials. From 5dc8876b90b79a369b50fde194a1e652a1ee3d5f Mon Sep 17 00:00:00 2001 From: jdeckerMS Date: Mon, 23 Jan 2017 12:51:41 -0800 Subject: [PATCH 27/87] clear redirect files --- .../enable-phone-signin-to-pc-and-vpn.md | 71 ------ ...microsoft-passport-and-password-changes.md | 41 ---- ...oft-passport-errors-during-pin-creation.md | 224 ------------------ windows/keep-secure/passport-event-300.md | 39 --- ...repare-people-to-use-microsoft-passport.md | 99 -------- .../why-a-pin-is-better-than-a-password.md | 61 ----- .../windows-hello-in-enterprise.md | 77 ------ 7 files changed, 612 deletions(-) diff --git a/windows/keep-secure/enable-phone-signin-to-pc-and-vpn.md b/windows/keep-secure/enable-phone-signin-to-pc-and-vpn.md index 064dd48a63..b3077d445a 100644 --- a/windows/keep-secure/enable-phone-signin-to-pc-and-vpn.md +++ b/windows/keep-secure/enable-phone-signin-to-pc-and-vpn.md @@ -17,74 +17,3 @@ redirect_url: https://technet.microsoft.com/en-us/itpro/windows/keep-secure/hell - Windows 10 - Windows 10 Mobile -In Windows 10, version 1607, your network users can use Windows Phone with Windows Hello to sign in to a PC, connect to VPN, and sign in to Office 365 in a browser. Phone sign-in uses Bluetooth, which means no need to wait for a phone call -- just unlock the phone and tap the app. - -![Sign in to a device](images/phone-signin-menu.png) - -> [!NOTE] -> Phone sign-in is currently limited to select Technology Adoption Program (TAP) participants. - -You can create a Group Policy or mobile device management (MDM) policy that will allow users to sign in to a work PC or their company's VPN using the credentials stored on their Windows 10 phone. - - ## Prerequisites - - - Both phone and PC must be running Windows 10, version 1607. - - The PC must be running Windows 10 Pro, Enterprise, or Education - - Both phone and PC must have Bluetooth. - - The **Microsoft Authenticator** app must be installed on the phone. - - The PC must be joined to an Active Directory domain that is connected to an Azure Active Directory (Azure AD) domain, or the PC must be joined to Azure AD. - - The phone must be joined to Azure AD or have a work account added. - - The VPN configuration profile must use certificate-based authentication. - -## Set policies - -To enable phone sign-in, you must enable the following policies using Group Policy or MDM. - -- Group Policy: **Computer Configuration** or **User Configuration** > **Policies** > **Administrative Templates** > **Windows Components** > **Windows Hello for Business** - - Enable **Use Windows Hello for Business** - - Enable **Phone Sign-in** -- MDM: - - Set **UsePassportForWork** to **True** - - Set **Remote\UseRemotePassport** to **True** - -## Configure VPN - -To enable phone sign-in to VPN, you must enable the [policy](#set-policies) for phone sign-in and ensure that VPN is configured as follows: - -- For inbox VPN, set up the VPN profile with Extensible Authentication Protocol (EAP) with the **Smart card or other certificate (TLS)** EAP type, also known as EAP-Transport Level Security (EAP-TLS). To exclusively access the VPN certificates on the phone, in the EAP filtering XML, add either **EKU** or **Issuer** (or both) filtering to make sure it picks only the Remote NGC certificate. -- For a Universal Windows Platform (UWP) VPN plug-in, add filtering criteria based on the 3rd party mechanism for the Remote NGC Certificate. - -## Get the app - -If you want to distribute the **Microsoft Authenticator** app, your organization must have set up Windows Store for Business, with Microsoft added as a [Line of Business (LOB) publisher](../manage/working-with-line-of-business-apps.md). - -[Tell people how to sign in using their phone.](prepare-people-to-use-microsoft-passport.md#bmk-remote) - - -## Related topics - -[Manage identity verification using Windows Hello for Business](manage-identity-verification-using-microsoft-passport.md) - -[Implement Windows Hello for Business in your organization](implement-microsoft-passport-in-your-organization.md) - -[Why a PIN is better than a password](why-a-pin-is-better-than-a-password.md) - -[Prepare people to use Windows Hello](prepare-people-to-use-microsoft-passport.md) - -[Windows Hello and password changes](microsoft-passport-and-password-changes.md) - -[Windows Hello errors during PIN creation](microsoft-passport-errors-during-pin-creation.md) - -[Event ID 300 - Windows Hello successfully created](passport-event-300.md) - -[Windows Hello biometrics in the enterprise](windows-hello-in-enterprise.md) - - -  - -  - - - - - diff --git a/windows/keep-secure/microsoft-passport-and-password-changes.md b/windows/keep-secure/microsoft-passport-and-password-changes.md index 3fa30f4786..fffa48b90f 100644 --- a/windows/keep-secure/microsoft-passport-and-password-changes.md +++ b/windows/keep-secure/microsoft-passport-and-password-changes.md @@ -11,44 +11,3 @@ redirect_url: https://technet.microsoft.com/en-us/itpro/windows/keep-secure/hell --- # Windows Hello and password changes -**Applies to** -- Windows 10 -- Windows 10 Mobile - -When you set up Windows Hello, the PIN or biometric gesture that you use is specific to that device. You can set up Hello for the same account on multiple devices. If the PIN or biometric is configured as part of Windows Hello for Business, changing the account password will not impact sign-in or unlock with these gestures since it uses a key or certificate. However, if Windows Hello for Business is not deployed and the password for that account changes, you must provide the new password on each device to continue to use Hello. - -## Example - -Let's suppose that you have set up a PIN for your Microsoft account on **Device A**. You use your PIN to sign in on **Device A** and then change the password for your Microsoft account. -Because you were using **Device A** when you changed your password, the PIN on **Device A** will continue to work with no other action on your part. - -Suppose instead that you sign in on **Device B** and change your password for your Microsoft account. The next time that you try to sign in on **Device A** using your PIN, sign-in will fail because the account credentials that Hello on **Device A** knows will be outdated. -> **Note:**  This example also applies to an Active Directory account when [Windows Hello for Business is not implemented](implement-microsoft-passport-in-your-organization.md). -  -## How to update Hello after you change your password on another device - -1. When you try to sign in using your PIN or biometric, you will see the following message: **Your password was changed on a different device. You must sign in to this device once with your new password, and then you can sign in with your PIN.** -2. Click **OK.** -3. Click **Sign-in options**. -4. Click the **Password** button. -5. Sign in with new password. -6. The next time that you sign in, you can select **Sign-in options** and then select **PIN** to resume using your PIN. - -## Related topics - -[Manage identity verification using Windows Hello for Business](manage-identity-verification-using-microsoft-passport.md) - -[Implement Windows Hello for Business in your organization](implement-microsoft-passport-in-your-organization.md) - -[Enable phone sign-in to PC or VPN](enable-phone-signin-to-pc-and-vpn.md) - -[Why a PIN is better than a password](why-a-pin-is-better-than-a-password.md) - -[Prepare people to use Windows Hello](prepare-people-to-use-microsoft-passport.md) - -[Windows Hello errors during PIN creation](microsoft-passport-errors-during-pin-creation.md) - -[Event ID 300 - Windows Hello successfully created](passport-event-300.md) - -[Windows Hello biometrics in the enterprise](windows-hello-in-enterprise.md) -  \ No newline at end of file diff --git a/windows/keep-secure/microsoft-passport-errors-during-pin-creation.md b/windows/keep-secure/microsoft-passport-errors-during-pin-creation.md index 61f8335040..aa890d3cd9 100644 --- a/windows/keep-secure/microsoft-passport-errors-during-pin-creation.md +++ b/windows/keep-secure/microsoft-passport-errors-during-pin-creation.md @@ -13,227 +13,3 @@ redirect_url: https://technet.microsoft.com/en-us/itpro/windows/keep-secure/hell # Windows Hello errors during PIN creation -**Applies to** -- Windows 10 -- Windows 10 Mobile - -When you set up Windows Hello in Windows 10, you may get an error during the **Create a PIN** step. This topic lists some of the error codes with recommendations for mitigating the problem. If you get an error code that is not listed here, contact Microsoft Support. - -## Where is the error code? - -The following image shows an example of an error during **Create a PIN**. - -![](images/pinerror.png) - -## Error mitigations - -When a user encounters an error when creating the work PIN, advise the user to try the following steps. Many errors can be mitigated by one of these steps. -1. Try to create the PIN again. Some errors are transient and resolve themselves. -2. Sign out, sign in, and try to create the PIN again. -3. Reboot the device and then try to create the PIN again. -4. Unjoin the device from Azure Active Directory (Azure AD), rejoin, and then try to create the PIN again. To unjoin a desktop PC, go to **Settings** > **System** > **About** and select **Disconnect from organization**. To unjoin a device running Windows 10 Mobile, you must [reset the device](https://go.microsoft.com/fwlink/p/?LinkId=715697). -5. On mobile devices, if you are unable to setup a PIN after multiple attempts, reset your device and start over. For help on how to reset your phone go to [Reset my phone](https://go.microsoft.com/fwlink/p/?LinkId=715697). -If the error occurs again, check the error code against the following table to see if there is another mitigation for that error. When no mitigation is listed in the table, contact Microsoft Support for assistance. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
HexCauseMitigation
0x801C044DAuthorization token does not contain device IDUnjoin the device from Azure AD and rejoin
0x80090036User cancelled an interactive dialogUser will be asked to try again
0x80090011The container or key was not foundUnjoin the device from Azure AD and rejoin
0x8009000FThe container or key already existsUnjoin the device from Azure AD and rejoin
0x8009002ANTE_NO_MEMORYClose programs which are taking up memory and try again.
0x80090005NTE_BAD_DATAUnjoin the device from Azure AD and rejoin
0x80090029TPM is not set up.Sign on with an administrator account. Click **Start**, type "tpm.msc", and select **tpm.msc Microsoft Common Console Document**. In the **Actions** pane, select **Prepare the TPM**.
0x80090031NTE_AUTHENTICATION_IGNOREDReboot the device. If the error occurs again after rebooting, [reset the TPM]( https://go.microsoft.com/fwlink/p/?LinkId=619969) or run [Clear-TPM](https://go.microsoft.com/fwlink/p/?LinkId=629650)
0x80090035Policy requires TPM and the device does not have TPM.Change the Passport policy to not require a TPM.
0x801C0003User is not authorized to enrollCheck if the user has permission to perform the operation​.
0x801C000ERegistration quota reached

Unjoin some other device that is currently joined using the same account or [increase the maximum number of devices per user](https://go.microsoft.com/fwlink/p/?LinkId=626933).

0x801C000FOperation successful but the device requires a rebootReboot the device.
0x801C0010The AIK certificate is not valid or trustedSign out and then sign in again.
0x801C0011The attestation statement of the transport key is invalidSign out and then sign in again.
0x801C0012Discovery request is not in a valid formatSign out and then sign in again.
0x801C0015The device is required to be joined to an Active Directory domain​Join the device to an Active Directory domain.
0x801C0016The federation provider configuration is emptyGo to [http://clientconfig.microsoftonline-p.net/FPURL.xml](http://clientconfig.microsoftonline-p.net/FPURL.xml) and verify that the file is not empty.
0x801C0017​The federation provider domain is emptyGo to [http://clientconfig.microsoftonline-p.net/FPURL.xml](http://clientconfig.microsoftonline-p.net/FPURL.xml) and verify that the FPDOMAINNAME element is not empty.
0x801C0018The federation provider client configuration URL is emptyGo to [http://clientconfig.microsoftonline-p.net/FPURL.xml](http://clientconfig.microsoftonline-p.net/FPURL.xml) and verify that the CLIENTCONFIG element contains a valid URL.
0x801C03E9Server response message is invalidSign out and then sign in again.
0x801C03EAServer failed to authorize user or device.Check if the token is valid and user has permission to register Passport keys.
0x801C03EBServer response http status is not validSign out and then sign in again.
0x801C03ECUnhandled exception from server.sign out and then sign in again.
0x801C03ED

Multi-factor authentication is required for a 'ProvisionKey' operation, but was not performed

-

-or-

-

Token was not found in the Authorization header

-

-or-

-

Failed to read one or more objects

-

-or-

The request sent to the server was invalid.

Sign out and then sign in again. If that doesn't resolve the issue, unjoin the device from Azure Active Directory (Azure AD) and rejoin.
0x801C03EEAttestation failedSign out and then sign in again.
0x801C03EFThe AIK certificate is no longer validSign out and then sign in again.
​0x801C044DUnable to obtain user tokenSign out and then sign in again. Check network and credentials.
0x801C044EFailed to receive user creds inputSign out and then sign in again.
-  -## Errors with unknown mitigation -For errors listed in this table, contact Microsoft Support for assistance. - -| Hex | Cause | -|-------------|-------------------------------------------------------------------------------------------------------| -| 0x80072f0c | Unknown | -| 0x80070057 | Invalid parameter or argument is passed | -| 0x80090027 | Caller provided wrong parameter. If third-party code receives this error they must change their code. | -| 0x8009002D | NTE\_INTERNAL\_ERROR | -| 0x80090020 | NTE\_FAIL | -| 0x801C0001 | ​ADRS server response is not in valid format | -| 0x801C0002 | Server failed to authenticate the user | -| 0x801C0006 | Unhandled exception from server | -| 0x801C000C | Discovery failed | -| 0x801C001B | ​The device certificate is not found | -| 0x801C000B | Redirection is needed and redirected location is not a well known server | -| 0x801C0019 | ​The federation provider client configuration is empty | -| 0x801C001A | The DRS endpoint in the federation provider client configuration is empty | -| 0x801C0013 | Tenant ID is not found in the token | -| 0x801C0014 | User SID is not found in the token | -| 0x801C03F1 | There is no UPN in the token | -| 0x801C03F0 | ​There is no key registered for the user | -| 0x801C03F1 | ​There is no UPN in the token | -| ​0x801C044C | There is no core window for the current thread | -  - -## Related topics - -[Manage identity verification using Windows Hello for Business](manage-identity-verification-using-microsoft-passport.md) - -[Implement Windows Hello for Business in your organization](implement-microsoft-passport-in-your-organization.md) - -[Enable phone sign-in to PC or VPN](enable-phone-signin-to-pc-and-vpn.md) - -[Why a PIN is better than a password](why-a-pin-is-better-than-a-password.md) - -[Prepare people to use Windows Hello](prepare-people-to-use-microsoft-passport.md) - -[Windows Hello and password changes](microsoft-passport-and-password-changes.md) - -[Event ID 300 - Windows Hello successfully created](passport-event-300.md) - -[Windows Hello biometrics in the enterprise](windows-hello-in-enterprise.md) \ No newline at end of file diff --git a/windows/keep-secure/passport-event-300.md b/windows/keep-secure/passport-event-300.md index 80298cf4fe..f516f124d0 100644 --- a/windows/keep-secure/passport-event-300.md +++ b/windows/keep-secure/passport-event-300.md @@ -13,42 +13,3 @@ redirect_url: https://technet.microsoft.com/en-us/itpro/windows/keep-secure/hell # Event ID 300 - Windows Hello successfully created -**Applies to** -- Windows 10 -- Windows 10 Mobile - -This event is created when Windows Hello for Business is successfully created and registered with Azure Active Directory (Azure AD). Applications or services can trigger actions on this event. For example, a certificate provisioning service can listen to this event and trigger a certificate request. - -## Event details -| | | -|--------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| -| **Product:** | Windows 10 operating system | -| **ID:** | 300 | -| **Source:** | Microsoft Azure Device Registration Service | -| **Version:** | 10 | -| **Message:** | The NGC key was successfully registered. Key ID: {4476694e-8e3b-4ef8-8487-be21f95e6f07}. UPN:test@contoso.com. Attestation: ATT\_SOFT. Client request ID: . Server request ID: db2da6bd-3d70-4b9b-b26b-444f669902da. -Server response: {"kid":"4476694e-8e3b-4ef8-8487-be21f95e6f07","upn":"test@contoso.com"} | -  -## Resolve - -This is a normal condition. No further action is required. - -## Related topics - -[Manage identity verification using Windows Hello for Business](manage-identity-verification-using-microsoft-passport.md) - -[Implement Windows Hello for Business in your organization](implement-microsoft-passport-in-your-organization.md) - -[Enable phone sign-in to PC or VPN](enable-phone-signin-to-pc-and-vpn.md) - -[Why a PIN is better than a password](why-a-pin-is-better-than-a-password.md) - -[Prepare people to use Windows Hello](prepare-people-to-use-microsoft-passport.md) - -[Windows Hello and password changes](microsoft-passport-and-password-changes.md) - -[Windows Hello errors during PIN creation](microsoft-passport-errors-during-pin-creation.md) - -[Event ID 300 - Windows Hello successfully created](passport-event-300.md) - -[Windows Hello biometrics in the enterprise](windows-hello-in-enterprise.md) diff --git a/windows/keep-secure/prepare-people-to-use-microsoft-passport.md b/windows/keep-secure/prepare-people-to-use-microsoft-passport.md index cde8099b99..9594deccca 100644 --- a/windows/keep-secure/prepare-people-to-use-microsoft-passport.md +++ b/windows/keep-secure/prepare-people-to-use-microsoft-passport.md @@ -13,104 +13,5 @@ redirect_url: https://technet.microsoft.com/en-us/itpro/windows/keep-secure/hell # Prepare people to use Windows Hello -**Applies to** -- Windows 10 -- Windows 10 Mobile - -When you set a policy to require Windows Hello for Business in the workplace, you will want to prepare people in your organization by explaining how to use Hello. - -After enrollment in Hello, users should use their gesture (such as a PIN or fingerprint) for access to corporate resources. Their gesture is only valid on the enrolled device. - -Although the organization may require users to change their Active Directory or Azure Active Directory (AD) account password at regular intervals, changes to their passwords have no effect on Hello. - -People who are currently using virtual or physical smart cards for authentication can use their virtual smart card to verify their identity when they set up Hello. - -## On devices owned by the organization - -When someone sets up a new device, they are prompted to choose who owns the device. For corporate devices, they select **This device belongs to my organization**. - -![who owns this pc](images/corpown.png) - -Next, they select a way to connect. Tell the people in your enterprise which option they should pick here. - -![choose how you'll connect](images/connect.png) - -They sign in, and are then asked to verify their identity. People have options to choose from, such as a text message, phone call, or authentication app. After verification, they create their PIN. The **Create a PIN** screen displays any complexity requirements that you have set, such as minimum length. - -After Hello is set up, people use their PIN to unlock the device, and that will automatically log them on. - -## On personal devices - -People who want to access work resources on their personal devices can add a work or school account in **Settings** > **Accounts** > **Work or school**, and then sign in with work credentials. The person selects the method for receiving the verification code, such as text message or email. The verification code is sent and the person then enters the verification code. After verification, the person enters and confirms new PIN. The person can access any token-based resource using this device without being asked for credentials. - -People can go to **Settings** > **Accounts** > **Work or school**, select the work account, and then select **Unjoin** to remove the account from their device. - -## Using Windows Hello and biometrics - -If your policy allows it, people can use biometrics (fingerprint, iris, and facial recognition) with Windows Hello for Business, if the hardware supports it. - -![sign in to windows, apps, and services using fingerprint or face](images/hellosettings.png) - -## Use a phone to sign in to a PC or VPN - -If your enterprise enables phone sign-in, users can pair a phone running Windows 10 Mobile to a PC running Windows 10 and then use an app on the phone to sign in to the PC using their Windows Hello credentials. - -> [!NOTE] -> Phone sign-in is currently limited to select Technology Adoption Program (TAP) participants. - -  -**Prerequisites:** - -- Both phone and PC must be running Windows 10, version 1607. -- The PC must be running Windows 10 Pro, Enterprise, or Education -- Both phone and PC must have Bluetooth. -- The **Microsoft Authenticator** app must be installed on the phone. -- The PC must be joined to an Active Directory domain that is connected to an Azure Active Directory (Azure AD) domain, or the PC must be joined to Azure AD. -- The phone must be joined to Azure AD or have a work account added. -- The VPN configuration profile must use certificate-based authentication. - -**Pair the PC and phone** - -1. On the PC, go to **Settings** > **Devices** > **Bluetooth**. Tap the name of the phone and then tap **Pair** to begin pairing. - - ![bluetooth pairing](images/btpair.png) - -2. On the phone, go to **Settings** > **Devices** > **Bluetooth**, and verify that the passcode for **Pairing accessory** on the phone matches the passcode displayed on the PC, and then tap **ok**. - - ![bluetooth pairing passcode](images/bt-passcode.png) - -3. On the PC, tap **Yes**. - -**Sign in to PC using the phone** - - -1. Open the **Microsoft Authenticator** app, choose your account, and tap the name of the PC to sign in to. - > **Note: **  The first time that you run the **Microsoft Authenticator** app, you must add an account. - - ![select a device](images/phone-signin-device-select.png) -   -2. Enter the work PIN that you set up when you joined the phone to the cloud domain or added a work account. - -**Connect to VPN** - -You simply connect to VPN as you normally would. If the phone's certificates are being used, a notification will be pushed to the phone asking if you approve. If you click **allow** in the notification, you will be prompted for your PIN. After you enter your PIN, the VPN session will connect. - -## Related topics - -[Manage identity verification using Windows Hello for Business](manage-identity-verification-using-microsoft-passport.md) - -[Implement Windows Hello for Business in your organization](implement-microsoft-passport-in-your-organization.md) - -[Enable phone sign-in to PC or VPN](enable-phone-signin-to-pc-and-vpn.md) - -[Why a PIN is better than a password](why-a-pin-is-better-than-a-password.md) - -[Windows Hello and password changes](microsoft-passport-and-password-changes.md) - -[Windows Hello errors during PIN creation](microsoft-passport-errors-during-pin-creation.md) - -[Event ID 300 - Windows Hello successfully created](passport-event-300.md) - -[Windows Hello biometrics in the enterprise](windows-hello-in-enterprise.md) diff --git a/windows/keep-secure/why-a-pin-is-better-than-a-password.md b/windows/keep-secure/why-a-pin-is-better-than-a-password.md index 5fccb990f7..1640262ffd 100644 --- a/windows/keep-secure/why-a-pin-is-better-than-a-password.md +++ b/windows/keep-secure/why-a-pin-is-better-than-a-password.md @@ -13,64 +13,3 @@ redirect_url: https://technet.microsoft.com/en-us/itpro/windows/keep-secure/hell # Why a PIN is better than a password -**Applies to** -- Windows 10 -- Windows 10 Mobile - -Windows Hello in Windows 10 enables users to sign in to their device using a PIN. How is a PIN different from (and better than) a password? -On the surface, a PIN looks much like a password. A PIN can be a set of numbers, but enterprise policy might allow complex PINs that include special characters and letters, both upper-case and lower-case. Something like **t758A!** could be an account password or a complex Hello PIN. It isn't the structure of a PIN (length, complexity) that makes it better than a password, it's how it works. - - -## PIN is tied to the device -One important difference between a password and a Hello PIN is that the PIN is tied to the specific device on which it was set up. That PIN is useless to anyone without that specific hardware. Someone who steals your password can sign in to your account from anywhere, but if they steal your PIN, they'd have to steal your physical device too! - -Even you can't use that PIN anywhere except on that specific device. If you want to sign in on multiple devices, you have to set up Hello on each device. - -## PIN is local to the device - -A password is transmitted to the server -- it can be intercepted in transmission or stolen from a server. A PIN is local to the device -- it isn't transmitted anywhere and it isn't stored on the server. -When the PIN is created, it establishes a trusted relationship with the identity provider and creates an asymmetric key pair that is used for authentication. When you enter your PIN, it unlocks the authentication key and uses the key to sign the request that is sent to the authenticating server. -> **Note:**  For details on how Hello uses asymetric key pairs for authentication, see [Microsoft Passport guide](https://go.microsoft.com/fwlink/p/?LinkId=691928). -  -## PIN is backed by hardware - -The Hello PIN is backed by a Trusted Platform Module (TPM) chip, which is a secure crypto-processor that is designed to carry out cryptographic operations. The chip includes multiple physical security mechanisms to make it tamper resistant, and malicious software is unable to tamper with the security functions of the TPM. All Windows 10 Mobile phones and many modern laptops have TPM. - -User key material is generated and available within the Trusted Platform Module (TPM) of the user device, which protects it from attackers who want to capture the key material and reuse it. Because Hello uses asymmetrical key pairs, users credentials can’t be stolen in cases where the identity provider or websites the user accesses have been compromised. - -The TPM protects against a variety of known and potential attacks, including PIN brute-force attacks. After too many incorrect guesses, the device is locked. - -## PIN can be complex - -The Windows Hello for Business PIN is subject to the same set of IT management policies as a password, such as complexity, length, expiration, and history. Although we generally think of a PIN as a simple four-digit code, administrators can set [policies](implement-microsoft-passport-in-your-organization.md) for managed devices to require a PIN complexity similar to a password. You can require or block: special characters, uppercase characters, lowercase characters, and digits. - -## What if someone steals the laptop or phone? - -To compromise a Windows Hello credential that TPM protects, an attacker must have access to the physical device, and then must find a way to spoof the user’s biometrics or guess his or her PIN—and all of this must be done before TPM anti-hammer capabilities lock the device. -You can provide additional protection for laptops that don't have TPM by enablng BitLocker and setting a policy to limit failed sign-ins. - -**Configure BitLocker without TPM** -1. Use the Local Group Policy Editor (gpedit.msc) to enable the following policy: - - **Computer Configuration** > **Administrative Templates** > **Windows Components** > **BitLocker Drive Encryption** > **Operating System Drives** > **Require additional authentication at startup** - -2. In the policy option, select **Allow BitLocker without a compatible TPM**, and then click **OK.** -3. Go to Control Panel > **System and Security** > **BitLocker Drive Encryption** and select the operating system drive to protect. -**Set account lockout threshold** -1. Use the Local Group Policy Editor (gpedit.msc) to enable the following policy: - - **Computer Configuration** >**Windows Settings** ?**Security Settings** >**Account Policies** > **Account Lockout Policy** > **Account lockout threshold** - -2. Set the number of invalid logon attempts to allow, and then click OK. - -## Why do you need a PIN to use biometrics? -Windows Hello enables biometric sign-in for Windows 10: fingerprint, iris, or facial recognition. When you set up Windows Hello, you're asked to create a PIN first. This PIN enables you to sign in using the PIN when you can’t use your preferred biometric because of an injury or because the sensor is unavailable or not working properly. - -If you only had a biometric sign-in configured and, for any reason, were unable to use that method to sign in, you would have to sign in using your account and password, which doesn't provide you the same level of protection as Hello. - -## Related topics - -[Manage identity verification using Windows Hello for Business](manage-identity-verification-using-microsoft-passport.md) - -[Implement Windows Hello for Business in your organization](implement-microsoft-passport-in-your-organization.md) -  \ No newline at end of file diff --git a/windows/keep-secure/windows-hello-in-enterprise.md b/windows/keep-secure/windows-hello-in-enterprise.md index 09380ebe1f..379a453284 100644 --- a/windows/keep-secure/windows-hello-in-enterprise.md +++ b/windows/keep-secure/windows-hello-in-enterprise.md @@ -12,80 +12,3 @@ redirect_url: https://technet.microsoft.com/en-us/itpro/windows/keep-secure/hell --- # Windows Hello biometrics in the enterprise -**Applies to:** - -- Windows 10 - -Windows Hello is the biometric authentication feature that helps strengthen authentication and helps to guard against potential spoofing through fingerprint matching and facial recognition. - -> **Note:** When Windows 10 first shipped, it included Microsoft Passport and Windows Hello, which worked together to provide multi-factor authentication. To simplify deployment and improve supportability, Microsoft has combined these technologies into a single solution under the Windows Hello name. Customers who have already deployed these technologies will not experience any change in functionality. Customers who have yet to evaluate Windows Hello will find it easier to deploy due to simplified policies, documentation, and semantics. - -Because we realize your employees are going to want to use this new technology in your enterprise, we’ve been actively working with the device manufacturers to create strict design and performance recommendations that help to ensure that you can more confidently introduce Windows Hello biometrics into your organization. - -##How does Windows Hello work? -Windows Hello lets your employees use fingerprint or facial recognition as an alternative method to unlocking a device. With Windows Hello, authentication happens when the employee provides his or her unique biometric identifier while accessing the device-specific Windows Hello credentials. - -The Windows Hello authenticator works to authenticate and allow employees onto your enterprise network. Authentication doesn’t roam among devices, isn’t shared with a server, and can’t easily be extracted from a device. If multiple employees share a device, each employee will use his or her own biometric data on the device. - -## Why should I let my employees use Windows Hello? -Windows Hello provides many benefits, including: - -- It helps to strengthen your protections against credential theft. Because an attacker must have both the device and the biometric info or PIN, it’s much more difficult to gain access without the employee’s knowledge. - -- Employees get a simple authentication method (backed up with a PIN) that’s always with them, so there’s nothing to lose. No more forgetting passwords! - -- Support for Windows Hello is built into the operating system so you can add additional biometric devices and polices as part of a coordinated rollout or to individual employees or groups using Group Policy or Mobile Device Management (MDM) configurations service provider (CSP) policies.
For more info about the available Group Policies and MDM CSPs, see the [Implement Windows Hello for Business in your organization](implement-microsoft-passport-in-your-organization.md) topic. - -## Where is Microsoft Hello data stored? -The biometric data used to support Windows Hello is stored on the local device only. It doesn’t roam and is never sent to external devices or servers. This separation helps to stop potential attackers by providing no single collection point that an attacker could potentially compromise to steal biometric data. Additionally, even if an attacker was actually able to get the biometric data, it still can’t be easily converted to a form that could be recognized by the biometric sensor. - -## Has Microsoft set any device requirements for Windows Hello? -We’ve been working with the device manufacturers to help ensure a high-level of performance and protection is met by each sensor and device, based on these requirements: - -- **False Accept Rate (FAR).** Represents the instance a biometric identification solution verifies an unauthorized person. This is normally represented as a ratio of number of instances in a given population size, for example 1 in 100 000. This can also be represented as a percentage of occurrence, for example, 0.001%. This measurement is heavily considered the most important with regards to the security of the biometric algorithm. - -- **False Reject Rate (FRR).** Represents the instances a biometric identification solution fails to verify an authorized person correctly. Usually represented as a percentage, the sum of the True Accept Rate and False Reject Rate is 1. Can be with or without anti-spoofing or liveness detection. - -### Fingerprint sensor requirements -To allow fingerprint matching, you must have devices with fingerprint sensors and software. Fingerprint sensors, or sensors that use an employee’s unique fingerprint as an alternative log on option, can be touch sensors (large area or small area) or swipe sensors. Each type of sensor has its own set of detailed requirements that must be implemented by the manufacturer, but all of the sensors must include anti-spoofing measures (required) and a way to configure them (optional). - -**Acceptable performance range for small to large size touch sensors** - -- False Accept Rate (FAR): <0.001 – 0.002% - -- False Reject Rate (FRR) without Anti-spoofing or liveness detection: <5% - -- Effective, real world FRR with Anti-spoofing or liveness detection: <10% - -**Acceptable performance range for swipe sensors** - -- False Accept Rate (FAR): <0.002% - -- False Reject Rate (FRR) without Anti-spoofing or liveness detection: <5% - -- Effective, real world FRR with Anti-spoofing or liveness detection: <10% - -### Facial recognition sensors -To allow facial recognition, you must have devices with integrated special infrared (IR) sensors and software. Facial recognition sensors use special cameras that see in IR light, letting them tell the difference between a photo and a living person while scanning an employee’s facial features. These sensors, like the fingerprint sensors, must also include anti-spoofing measures (required) and a way to configure them (optional). - -- False Accept Rate (FAR): <0.001 - -- False Reject Rate (FRR) without Anti-spoofing or liveness detection: <5% - -- Effective, real world FRR with Anti-spoofing or liveness detection: <10% - -## Related topics -- [Manage identity verification using Windows Hello for Business](manage-identity-verification-using-microsoft-passport.md) -- [Implement Windows Hello for Business in your organization](implement-microsoft-passport-in-your-organization.md) -- [Microsoft Passport guide](microsoft-passport-guide.md) -- [Prepare people to use Windows Hello for Work](prepare-people-to-use-microsoft-passport.md) -- [PassportforWork CSP](https://go.microsoft.com/fwlink/p/?LinkId=708219) - -  - -  - - - - - From fe36d0ca49f78254672d2ef243d653ae7747888f Mon Sep 17 00:00:00 2001 From: jdeckerMS Date: Mon, 23 Jan 2017 13:00:00 -0800 Subject: [PATCH 28/87] fix links --- .../keep-secure/hello-enable-phone-signin.md | 2 +- .../hello-identity-verification.md | 2 +- .../hello-manage-in-organization.md | 6 +- ...microsoft-passport-in-your-organization.md | 362 ------------------ 4 files changed, 5 insertions(+), 367 deletions(-) diff --git a/windows/keep-secure/hello-enable-phone-signin.md b/windows/keep-secure/hello-enable-phone-signin.md index f9e44256fd..c77dfeeaf1 100644 --- a/windows/keep-secure/hello-enable-phone-signin.md +++ b/windows/keep-secure/hello-enable-phone-signin.md @@ -58,7 +58,7 @@ To enable phone sign-in to VPN, you must enable the [policy](#set-policies) for If you want to distribute the **Microsoft Authenticator** app, your organization must have set up Windows Store for Business, with Microsoft added as a [Line of Business (LOB) publisher](../manage/working-with-line-of-business-apps.md). -[Tell people how to sign in using their phone.](prepare-people-to-use-microsoft-passport.md#bmk-remote) +[Tell people how to sign in using their phone.](hello-prepare-people-to-use.md#bmk-remote) ## Related topics diff --git a/windows/keep-secure/hello-identity-verification.md b/windows/keep-secure/hello-identity-verification.md index 73b4d394ce..06c9fc138d 100644 --- a/windows/keep-secure/hello-identity-verification.md +++ b/windows/keep-secure/hello-identity-verification.md @@ -59,7 +59,7 @@ Windows stores biometric data that is used to implement Windows Hello securely o Reports of identity theft and large-scale hacking are frequent headlines. Nobody wants to be notified that their user name and password have been exposed. -You may wonder [how a PIN can help protect a device better than a password](why-a-pin-is-better-than-a-password.md). Passwords are shared secrets; they are entered on a device and transmitted over the network to the server. An intercepted account name and password can be used by anyone. Because they're stored on the server, a server breach can reveal those stored credentials. +You may wonder [how a PIN can help protect a device better than a password](hello-why-pin-is-better-than-a-password.md). Passwords are shared secrets; they are entered on a device and transmitted over the network to the server. An intercepted account name and password can be used by anyone. Because they're stored on the server, a server breach can reveal those stored credentials. In Windows 10, Windows Hello replaces passwords. When the identity provider supports keys, the Windows Hello provisioning process creates a cryptographic key pair bound to the Trusted Platform Module (TPM), if a device has a TPM, or in software. Access to these keys and obtaining a signature to validate user possession of the private key is enabled only by the PIN or biometric gesture. The two-step verification that takes place during Windows Hello enrollment creates a trusted relationship between the identity provider and the user when the public portion of the public/private key pair is sent to an identity provider and associated with a user account. When a user enters the gesture on the device, the identity provider knows from the combination of Hello keys and gesture that this is a verified identity and provides an authentication token that allows Windows 10 to access resources and services. diff --git a/windows/keep-secure/hello-manage-in-organization.md b/windows/keep-secure/hello-manage-in-organization.md index 87c3225316..f2a43b7df1 100644 --- a/windows/keep-secure/hello-manage-in-organization.md +++ b/windows/keep-secure/hello-manage-in-organization.md @@ -131,7 +131,7 @@ The following table lists the Group Policy settings that you can configure for W -Phone Sign-in +Phone Sign-in

Use Phone Sign-in

Note  Applies to desktop only. Phone sign-in is currently limited to select Technology Adoption Program (TAP) participants.
@@ -289,8 +289,8 @@ The following table lists the MDM policy settings that you can configure for Win Device or user False -

True: Phone sign-in is enabled.

-

False: Phone sign-in is disabled.

+

True: Phone sign-in is enabled.

+

False: Phone sign-in is disabled.

diff --git a/windows/keep-secure/implement-microsoft-passport-in-your-organization.md b/windows/keep-secure/implement-microsoft-passport-in-your-organization.md index 67bda0eb2f..20c4be5a7e 100644 --- a/windows/keep-secure/implement-microsoft-passport-in-your-organization.md +++ b/windows/keep-secure/implement-microsoft-passport-in-your-organization.md @@ -17,365 +17,3 @@ redirect_url: https://technet.microsoft.com/en-us/itpro/windows/keep-secure/hell - Windows 10 - Windows 10 Mobile -You can create a Group Policy or mobile device management (MDM) policy that will implement Windows Hello on devices running Windows 10. - ->[!IMPORTANT] ->The Group Policy setting **Turn on PIN sign-in** does not apply to Windows Hello for Business. Use the **Turn on PIN sign-in** setting to allow or deny the use of a convenience PIN for Windows 10, version 1607. -> ->Beginning in version 1607, Windows Hello as a convenience PIN is disabled by default on all domain-joined computers. To enable a convenience PIN for Windows 10, version 1607, enable the Group Policy setting **Turn on convenience PIN sign-in**. Learn more in the blog post [Changes to Convenience PIN/Windows Hello Behavior in Windows 10, version 1607](https://blogs.technet.microsoft.com/ash/2016/08/13/changes-to-convenience-pin-and-thus-windows-hello-behaviour-in-windows-10-version-1607/). -> ->Use **Windows Hello for Business** policy settings to manage PINs for Windows Hello for Business. -  -## Group Policy settings for Windows Hello for Business - -The following table lists the Group Policy settings that you can configure for Hello use in your workplace. These policy settings are available in both **User configuration** and **Computer Configuration** under **Policies** > **Administrative Templates** > **Windows Components** > **Windows Hello for Business**. Be aware that not all settings are in both places. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
PolicyOptions
Use Windows Hello for Business -

Not configured: Users can provision Windows Hello for Business, which encrypts their domain password.

-

Enabled: Device provisions Windows Hello for Business using keys or certificates for all users.

-

Disabled: Device does not provision Windows Hello for Business for any user.

-
Use a hardware security device -

Not configured: Windows Hello for Business will be provisioned using TPM if available, and will be provisioned using software if TPM is not available.

-

Enabled: Windows Hello for Business will only be provisioned using TPM.

-

Disabled: Windows Hello for Business will be provisioned using TPM if available, and will be provisioned using software if TPM is not available.

-
Use biometrics -

Not configured: Biometrics can be used as a gesture in place of a PIN.

-

Enabled: Biometrics can be used as a gesture in place of a PIN.

-

Disabled: Only a PIN can be used as a gesture.

-
PIN ComplexityRequire digits -

Not configured: Users must include a digit in their PIN.

-

Enabled: Users must include a digit in their PIN.

-

Disabled: Users cannot use digits in their PIN.

-
Require lowercase letters -

Not configured: Users cannot use lowercase letters in their PIN.

-

Enabled: Users must include at least one lowercase letter in their PIN.

-

Disabled: Users cannot use lowercase letters in their PIN.

-
Maximum PIN length -

Not configured: PIN length must be less than or equal to 127.

-

Enabled: PIN length must be less than or equal to the number you specify.

-

Disabled: PIN length must be less than or equal to 127.

-
Minimum PIN length -

Not configured: PIN length must be greater than or equal to 4.

-

Enabled: PIN length must be greater than or equal to the number you specify.

-

Disabled: PIN length must be greater than or equal to 4.

-
Expiration -

Not configured: PIN does not expire.

-

Enabled: PIN can be set to expire after any number of days between 1 and 730, or PIN can be set to never expire by setting policy to 0.

-

Disabled: PIN does not expire.

-
History -

Not configured: Previous PINs are not stored.

-

Enabled: Specify the number of previous PINs that can be associated to a user account that can't be reused.

-

Disabled: Previous PINs are not stored.

-
Note  Current PIN is included in PIN history.
-
 
-
Require special characters -

Not configured: Users cannot include a special character in their PIN.

-

Enabled: Users must include at least one special character in their PIN.

-

Disabled: Users cannot include a special character in their PIN.

-
Require uppercase letters -

Not configured: Users cannot include an uppercase letter in their PIN.

-

Enabled: Users must include at least one uppercase letter in their PIN.

-

Disabled: Users cannot include an uppercase letter in their PIN.

-
Phone Sign-in -

Use Phone Sign-in

-
Note  Applies to desktop only. Phone sign-in is currently limited to select Technology Adoption Program (TAP) participants.
-
 
-		 -

Not configured: Phone sign-in is disabled.

-

Enabled: Users can use a portable, registered device as a companion device for desktop authentication.

-

Disabled: Phone sign-in is disabled.

-
- -## MDM policy settings for Windows Hello for Business - -The following table lists the MDM policy settings that you can configure for Windows Hello for Business use in your workplace. These MDM policy settings use the [PassportForWork configuration service provider (CSP)](https://go.microsoft.com/fwlink/p/?LinkId=692070). - ->[!IMPORTANT] ->Starting in Windows 10, version 1607, all devices only have one PIN associated with Windows Hello for Business. This means that any PIN on a device will be subject to the policies specified in the PassportForWork CSP. The values specified take precedence over any complexity rules set via Exchange ActiveSync (EAS) or the DeviceLock CSP. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
PolicyScopeDefaultOptions
UsePassportForWorkDeviceTrue -

True: Windows Hello for Business will be provisioned for all users on the device.

-

False: Users will not be able to provision Windows Hello for Business.

-
Note  If Windows Hello for Business is enabled, and then the policy is changed to False, users who previously set up Windows Hello for Business can continue to use it, but will not be able to set up Windows Hello for Business on other devices.
-
 
-
RequireSecurityDeviceDeviceFalse -

True: Windows Hello for Business will only be provisioned using TPM.

-

False: Windows Hello for Business will be provisioned using TPM if available, and will be provisioned using software if TPM is not available.

-
Biometrics -

UseBiometrics

-		Device False -

True: Biometrics can be used as a gesture in place of a PIN for domain sign-in.

-

False: Only a PIN can be used as a gesture for domain sign-in.

-
-

FacialFeaturesUser

-

EnhancedAntiSpoofing

-		DeviceNot configured -

Not configured: users can choose whether to turn on enhanced anti-spoofing.

-

True: Enhanced anti-spoofing is required on devices which support it.

-

False: Users cannot turn on enhanced anti-spoofing.

-
PINComplexity
Digits Device or user2 -

1: Numbers are not allowed.

-

2: At least one number is required.

-
Lowercase letters Device or user1 -

1: Lowercase letters are not allowed.

-

2: At least one lowercase letter is required.

-
Maximum PIN length Device or user127 -

Maximum length that can be set is 127. Maximum length cannot be less than minimum setting.

-
Minimum PIN lengthDevice or user4 -

Minimum length that can be set is 4. Minimum length cannot be greater than maximum setting.

-
Expiration Device or user0 -

Integer value specifies the period of time (in days) that a PIN can be used before the system requires the user to change it. The largest number you can configure for this policy setting is 730. The lowest number you can configure for this policy setting is 0. If this policy is set to 0, then the user’s PIN will never expire. -

-
HistoryDevice or user0 -

Integer value that specifies the number of past PINs that can be associated to a user account that can’t be reused. The largest number you can configure for this policy setting is 50. The lowest number you can configure for this policy setting is 0. If this policy is set to 0, then storage of previous PINs is not required. -

-
Special charactersDevice or user1 -

1: Special characters are not allowed.

-

2: At least one special character is required.

-
Uppercase lettersDevice or user1 -

1: Uppercase letters are not allowed.

-

2: At least one uppercase letter is required

-
Remote -

UseRemotePassport

-
Note  Applies to desktop only. Phone sign-in is currently limited to select Technology Adoption Program (TAP) participants.
-
 
-		Device or userFalse -

True: Phone sign-in is enabled.

-

False: Phone sign-in is disabled.

-
- ->[!NOTE]   -> If policy is not configured to explicitly require letters or special characters, users will be restricted to creating a numeric PIN. -  -## Prerequisites - -To deploy Windows Hello for Business, in some modes you must add Windows Server 2016 domain controllers to your Active Directory environment, but you don’t have to replace or remove your existing Active Directory servers — the servers required for Windows Hello for Business build on and add capability to your existing infrastructure. You don’t have to change the domain or forest functional level, and you can either add on-premises servers or use Azure Active Directory to deploy Windows Hello for Business in your network. - -You’ll need this software to set Windows Hello for Business policies in your enterprise. - ------ - - - - - - - - - - - - - - - - - - - -
Windows Hello for Business modeAzure ADAzure AD/AD hybrid (available with production release of Windows Server 2016)
Key-based authentication[Azure AD subscription](https://docs.microsoft.com/azure/active-directory/active-directory-howto-tenant)
    -
  • [Azure AD subscription](https://docs.microsoft.com/azure/active-directory/active-directory-howto-tenant)
    • -
  • [Azure AD Connect](https://docs.microsoft.com/azure/active-directory/active-directory-aadconnect)
    • -
  • A few Windows Server 2016 domain controllers on-site
    • -
  • A management solution, such as [Configuration Manager](https://docs.microsoft.com/sccm/index), Group Policy, or MDM
    • -
  • [Active Directory Certificate Services](https://technet.microsoft.com/windowsserver/dd448615.aspx) (AD CS) without Network Device Enrollment Service (NDES)
    • -
Certificate-based authentication
    -
  • [Azure AD subscription](https://docs.microsoft.com/azure/active-directory/active-directory-howto-tenant)
    • -
  • Intune or non-Microsoft mobile device management (MDM) solution
    • -
  • [PKI infrastructure](https://msdn.microsoft.com/library/windows/desktop/bb427432(v=vs.85).aspx)
    • -
    -
  • [Azure AD subscription](https://docs.microsoft.com/azure/active-directory/active-directory-howto-tenant)
    • -
  • [Azure AD Connect](https://docs.microsoft.com/azure/active-directory/active-directory-aadconnect)
    • -
  • [AD CS](https://technet.microsoft.com/windowsserver/dd448615.aspx) with NDES
    • -
  • [Configuration Manager](https://docs.microsoft.com/sccm/index) for domain-joined certificate enrollment, or [InTune](https://docs.microsoft.com/intune/deploy-use/control-microsoft-passport-settings-on-devices-with-microsoft-intune) for non-domain-joined devices, or a non-Microsoft MDM service that supports Hello for Business
    • -
-  -Configuration Manager and MDM provide the ability to manage Windows Hello for Business policy and to deploy and manage certificates protected by Windows Hello for Business. - -[Azure AD](https://docs.microsoft.com/azure/active-directory/active-directory-azureadjoin-passport) provides the ability to register devices with your enterprise and to provision Windows Hello for Business for organization accounts. - -[Learn more about enabling Windows Hello for Business in an Azure AD/AD hybrid environment.](https://docs.microsoft.com/azure/active-directory/active-directory-azureadjoin-passport-deployment) - - -## Windows Hello for BYOD - -Windows Hello can be managed on personal devices that your employees use for work purposes using MDM. On personal devices, users can create a personal Windows Hello PIN for unlocking the device and used this PIN for access to work resources. - -The PIN is managed using the same Windows Hello for Business policies that you can use to manage Windows Hello for Business on organization-owned devices. The PIN can also be managed using DeviceLock policy. DeviceLock policy can be used to control length, complexity, history, and expiration requirements and can be configured using the [Policy configuration service provider](https://go.microsoft.com/fwlink/p/?LinkID=623244). - -## Related topics - -[Windows Hello biometrics in the enterprise](windows-hello-in-enterprise.md) - -[Why a PIN is better than a password](why-a-pin-is-better-than-a-password.md) - -[Manage identity verification using Windows Hello for Business](manage-identity-verification-using-microsoft-passport.md) - -[Enable phone sign-in to PC or VPN](enable-phone-signin-to-pc-and-vpn.md) - -[Prepare people to use Windows Hello](prepare-people-to-use-microsoft-passport.md) - -[Windows Hello and password changes](microsoft-passport-and-password-changes.md) - -[Windows Hello errors during PIN creation](microsoft-passport-errors-during-pin-creation.md) - -[Event ID 300 - Windows Hello successfully created](passport-event-300.md) - -[Windows Hello biometrics in the enterprise](windows-hello-in-enterprise.md) -  From fcb360b4c6f7d846edc62a30c8ae34efea4be0ae Mon Sep 17 00:00:00 2001 From: jdeckerMS Date: Mon, 23 Jan 2017 13:06:03 -0800 Subject: [PATCH 29/87] sync --- windows/keep-secure/index.md | 1 - 1 file changed, 1 deletion(-) diff --git a/windows/keep-secure/index.md b/windows/keep-secure/index.md index c730d90f2d..08a7f02fe1 100644 --- a/windows/keep-secure/index.md +++ b/windows/keep-secure/index.md @@ -17,7 +17,6 @@ Learn about keeping Windows 10 and Windows 10 Mobile secure. | Topic | Description | | --- | --- | | [Block untrusted fonts in an enterprise](block-untrusted-fonts-in-enterprise.md) | To help protect your company from attacks which may originate from untrusted or attacker controlled font files, we’ve created the Blocking Untrusted Fonts feature. Using this feature, you can turn on a global setting that stops your employees from loading untrusted fonts processed using the Graphics Device Interface (GDI) onto your network. Untrusted fonts are any font installed outside of the %windir%/Fonts directory. Blocking untrusted fonts helps prevent both remote (web-based or email-based) and local EOP attacks that can happen during the font file-parsing process. | -| [Device Guard certification and compliance](device-guard-certification-and-compliance.md) | Device Guard is a combination of hardware and software security features that, when configured together, will lock a device down so that it can only run trusted applications. If the app isn’t trusted it can’t run, period. It also means that even if an attacker manages to get control of the Windows kernel, he or she will be much less likely to be able to run malicious executable code after the computer restarts because of how decisions are made about what can run and when. | | [Windows Hello for Business](hello-identity-verification.md) | In Windows 10, Windows Hello replaces passwords with strong two-factor authentication on PCs and mobile devices. This authentication consists of a new type of user credential that is tied to a device and a biometric or PIN. | | [Configure S/MIME for Windows 10 and Windows 10 Mobile](configure-s-mime.md) | In Windows 10, S/MIME lets users encrypt outgoing messages and attachments so that only intended recipients who have a digital identification (ID), also known as a certificate, can read them. Users can digitally sign a message, which provides the recipients with a way to verify the identity of the sender and that the message hasn't been tampered with. | | [Install digital certificates on Windows 10 Mobile](installing-digital-certificates-on-windows-10-mobile.md) | Digital certificates bind the identity of a user or computer to a pair of keys that can be used to encrypt and sign digital information. Certificates are issued by a certification authority (CA) that vouches for the identity of the certificate holder, and they enable secure client communications with websites and services. | From 143d5fea0060ee62d89f76523a496c9b2d98e3a5 Mon Sep 17 00:00:00 2001 From: jdeckerMS Date: Mon, 23 Jan 2017 13:12:54 -0800 Subject: [PATCH 30/87] fix links --- windows/keep-secure/hello-identity-verification.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/keep-secure/hello-identity-verification.md b/windows/keep-secure/hello-identity-verification.md index 06c9fc138d..0f73b11805 100644 --- a/windows/keep-secure/hello-identity-verification.md +++ b/windows/keep-secure/hello-identity-verification.md @@ -59,7 +59,7 @@ Windows stores biometric data that is used to implement Windows Hello securely o Reports of identity theft and large-scale hacking are frequent headlines. Nobody wants to be notified that their user name and password have been exposed. -You may wonder [how a PIN can help protect a device better than a password](hello-why-pin-is-better-than-a-password.md). Passwords are shared secrets; they are entered on a device and transmitted over the network to the server. An intercepted account name and password can be used by anyone. Because they're stored on the server, a server breach can reveal those stored credentials. +You may wonder [how a PIN can help protect a device better than a password](hello-why-pin-is-better-than-password.md). Passwords are shared secrets; they are entered on a device and transmitted over the network to the server. An intercepted account name and password can be used by anyone. Because they're stored on the server, a server breach can reveal those stored credentials. In Windows 10, Windows Hello replaces passwords. When the identity provider supports keys, the Windows Hello provisioning process creates a cryptographic key pair bound to the Trusted Platform Module (TPM), if a device has a TPM, or in software. Access to these keys and obtaining a signature to validate user possession of the private key is enabled only by the PIN or biometric gesture. The two-step verification that takes place during Windows Hello enrollment creates a trusted relationship between the identity provider and the user when the public portion of the public/private key pair is sent to an identity provider and associated with a user account. When a user enters the gesture on the device, the identity provider knows from the combination of Hello keys and gesture that this is a verified identity and provides an authentication token that allows Windows 10 to access resources and services. @@ -72,7 +72,7 @@ Imagine that someone is looking over your shoulder as you get money from an ATM Windows Hello helps protect user identities and user credentials. Because the user doesn't enter a password (except during provisioning), it helps circumvent phishing and brute force attacks. It also helps prevent server breaches because Windows Hello credentials are an asymmetric key pair, which helps prevent replay attacks when these keys are protected by TPMs. -For customers using a hybrid Active Directory and Azure Active Directorye environment, Windows Hello also enables Windows 10 Mobile devices to be used as [a remote credential](prepare-people-to-use-microsoft-passport.md#bmk-remote) when signing into Windows 10 PCs. During the sign-in process, the Windows 10 PC can connect using Bluetooth to access Windows Hello on the user’s Windows 10 Mobile device. Because users carry their phone with them, Windows Hello makes implementing two-factor authentication across the enterprise less costly and complex than other solutions. +For customers using a hybrid Active Directory and Azure Active Directorye environment, Windows Hello also enables Windows 10 Mobile devices to be used as [a remote credential](hello-prepare-people-to-use.md#bmk-remote) when signing into Windows 10 PCs. During the sign-in process, the Windows 10 PC can connect using Bluetooth to access Windows Hello on the user’s Windows 10 Mobile device. Because users carry their phone with them, Windows Hello makes implementing two-factor authentication across the enterprise less costly and complex than other solutions. > [!NOTE] >  Phone sign-in is currently limited to select Technology Adoption Program (TAP) participants. From 28c6e773841219bf2b5bc30789ccddbc9cd61468 Mon Sep 17 00:00:00 2001 From: GITMichiko Date: Mon, 23 Jan 2017 16:43:49 -0800 Subject: [PATCH 31/87] Update credential-guard.md Update in Michiko to convert existing to Security considerations. --- windows/keep-secure/credential-guard.md | 25 +++++++++++-------------- 1 file changed, 11 insertions(+), 14 deletions(-) diff --git a/windows/keep-secure/credential-guard.md b/windows/keep-secure/credential-guard.md index 96afd50094..024e1817ce 100644 --- a/windows/keep-secure/credential-guard.md +++ b/windows/keep-secure/credential-guard.md @@ -48,17 +48,18 @@ To deploy Credential Guard, the computers you are protecting must meet certain b You can deploy Credential Guard in phases, and plan these phases in relation to the computer purchases you plan for your next hardware refresh. -The following tables provide more information about the hardware, firmware, and software required for deployment of Credential Guard. The tables describe baseline protections, plus protections for improved security that are associated with hardware and firmware options available in 2015, available in 2016, and announced as options for 2017. +## Security considerations + +The following tables provide more information about the impact hardware, firmware, and software on protections used by Credential Guard. The tables describe baseline protections, plus protections for improved security that are associated with hardware and firmware options available in 2015, available in 2016, and announced as options for 2017. > [!NOTE] > For new computers running Windows 10, Trusted Platform Module (TPM 2.0) must be enabled by default. This requirement is not restated in the tables that follow.
> If you are an OEM, see the requirements information at [PC OEM requirements for Device Guard and Credential Guard](https://msdn.microsoft.com/library/windows/hardware/mt767514(v=vs.85).aspx).
> Starting in Widows 10, 1607, TPM 2.0 is required. +### Baseline protection recommendations -## Credential Guard requirements for baseline protections - -|Baseline Protections - requirement | Description | +|Baseline Protections | Description | |---------------------------------------------|----------------------------------------------------| | Hardware: **64-bit CPU** | A 64-bit computer is required for the Windows hypervisor to provide VBS. | | Hardware: **CPU virtualization extensions**,
plus **extended page tables** | **Requirements**: These hardware features are required for VBS:
One of the following virtualization extensions:
- VT-x (Intel) or
- AMD-V
And:
- Extended page tables, also called Second Level Address Translation (SLAT).

**Security benefits**: VBS provides isolation of secure kernel from normal operating system. Vulnerabilities and Day 0s in normal operating system cannot be exploited because of this isolation. | @@ -70,13 +71,9 @@ The following tables provide more information about the hardware, firmware, and > [!IMPORTANT] > The preceding table lists requirements for baseline protections. The following tables list requirements for improved security. You can use Credential Guard with hardware, firmware, and software that support baseline protections, even if they do not support protections for improved security. However, we strongly recommend meeting the requirements for improved security, to significantly strengthen the level of security that Credential Guard can provide. -## Credential Guard requirements for improved security +### 2015 Additional Security Recommendations (starting with Windows 10, version 1507, and Windows Server 2016, Technical Preview 4) -The following tables describes additional hardware and firmware requirements, and the improved security that is available when those requirements are met. - -### 2015 Additional Qualification Requirements for Credential Guard (starting with Windows 10, version 1507, and Windows Server 2016, Technical Preview 4) - -| Protections for Improved Security - requirement | Description | +| Protections for Improved Security | Description | |---------------------------------------------|----------------------------------------------------| | Hardware: **IOMMU** (input/output memory management unit) | **Requirement**: VT-D or AMD Vi IOMMU

**Security benefits**: An IOMMU can enhance system resiliency against memory attacks. For more information, see [ACPI description tables](https://msdn.microsoft.com/windows/hardware/drivers/bringup/acpi-system-description-tables). | | Firmware: **Securing Boot Configuration and Management** | **Requirements**:
- BIOS password or stronger authentication must be supported.
- In the BIOS configuration, BIOS authentication must be set.
- There must be support for protected BIOS option to configure list of permitted boot devices (for example, “Boot only from internal hard drive”) and boot device order, overriding BOOTORDER modification made by operating system.
- In the BIOS configuration, BIOS options related to security and boot options (list of permitted boot devices, boot order) must be secured to prevent other operating systems from starting and to prevent changes to the BIOS settings.

**Security benefits**:
- BIOS password or stronger authentication helps ensure that only authenticated Platform BIOS administrators can change BIOS settings. This helps protect against a physically present user with BIOS access.
- Boot order when locked provides protection against the computer being booted into WinRE or another operating system on bootable media. | @@ -84,12 +81,12 @@ The following tables describes additional hardware and firmware requirements, an
-### 2016 Additional Qualification Requirements for Credential Guard (starting with Windows 10, version 1607, and Windows Server 2016) +### 2016 Additional Security Recommendations (starting with Windows 10, version 1607, and Windows Server 2016) > [!IMPORTANT] > The following tables list requirements for improved security, beyond the level of protection described in the preceding tables. You can use Credential Guard with hardware, firmware, and software that do not support the following protections for improved security. As your systems meet more requirements, more protections become available to them. -| Protections for Improved Security - requirement | Description | +| Protections for Improved Security | Description | |---------------------------------------------|----------------------------------------------------| | Firmware: **Hardware Rooted Trust Platform Secure Boot** | **Requirements**:
Boot Integrity (Platform Secure Boot) must be supported. See the Windows Hardware Compatibility Program requirements under [System.Fundamentals.Firmware.CS.UEFISecureBoot.ConnectedStandby](https://msdn.microsoft.com/library/windows/hardware/dn932807(v=vs.85).aspx#system_fundamentals_firmware_cs_uefisecureboot_connectedstandby)
- The Hardware Security Test Interface (HSTI) must be implemented. See [Hardware Security Testability Specification](https://msdn.microsoft.com/en-us/library/windows/hardware/mt712332(v=vs.85).aspx).

**Security benefits**:
- Boot Integrity (Platform Secure Boot) from Power-On provides protections against physically present attackers, and defense-in-depth against malware.
- HSTI provides additional security assurance for correctly secured silicon and platform. | | Firmware: **Firmware Update through Windows Update** | **Requirements**: Firmware must support field updates through Windows Update and UEFI encapsulation update.

**Security benefits**: Helps ensure that firmware updates are fast, secure, and reliable. | @@ -97,9 +94,9 @@ The following tables describes additional hardware and firmware requirements, an
-### 2017 Additional Qualification Requirements for Credential Guard (starting with the next major release of Windows 10) +### 2017 Additional Security Recommendations (starting with the next major release of Windows 10) -| Protection for Improved Security - requirement | Description | +| Protection for Improved Security | Description | |---------------------------------------------|----------------------------------------------------| | Firmware: **Firmware support for SMM protection** | **Requirements**: The [Windows SMM Security Mitigations Table (WSMT) specification](http://download.microsoft.com/download/1/8/A/18A21244-EB67-4538-BAA2-1A54E0E490B6/WSMT.docx) contains details of an Advanced Configuration and Power Interface (ACPI) table that was created for use with Windows operating systems that support Windows virtualization-based security (VBS) features.

**Security benefits**:
- Protects against potential vulnerabilities in UEFI runtime in functions such as Update Capsule, Set Variables, and so on, so they can't compromise VBS.
- Reduces attack surface to VBS from system firmware.
- Blocks additional security attacks against SMM. | From 3caad49c682bf76f47d95035cb1ad56980983452 Mon Sep 17 00:00:00 2001 From: GITMichiko Date: Mon, 23 Jan 2017 17:00:11 -0800 Subject: [PATCH 32/87] Update credential-guard.md Intro update --- windows/keep-secure/credential-guard.md | 17 ++++++++--------- 1 file changed, 8 insertions(+), 9 deletions(-) diff --git a/windows/keep-secure/credential-guard.md b/windows/keep-secure/credential-guard.md index 96afd50094..9490387f08 100644 --- a/windows/keep-secure/credential-guard.md +++ b/windows/keep-secure/credential-guard.md @@ -15,24 +15,23 @@ author: brianlic-msft - Windows 10 - Windows Server 2016 -Introduced in Windows 10 Enterprise and Windows Server 2016, Credential Guard uses virtualization-based security to isolate secrets so that only privileged system software can access them. Unauthorized access to these secrets can lead to credential theft attacks, such as Pass-the-Hash or Pass-The-Ticket. Credential Guard prevents these attacks by protecting NTLM password hashes and Kerberos Ticket Granting Tickets. +Introduced in Windows 10 Enterprise and Windows Server 2016, Credential Guard uses virtualization-based security to isolate secrets so that only privileged system software can access them. Unauthorized access to these secrets can lead to credential theft attacks, such as Pass-the-Hash or Pass-The-Ticket. Credential Guard prevents these attacks by protecting NTLM password hashes, Kerberos Ticket Granting Tickets & credentials stored by applications as domain credentials. -Credential Guard offers the following features and solutions: +By enabling Credential Guard the following features and solutions are provided: -- **Hardware security** Credential Guard increases the security of derived domain credentials by taking advantage of platform security features including, Secure Boot and virtualization. -- **Virtualization-based security** Windows services that manage derived domain credentials and other secrets run in a protected environment that is isolated from the running operating system. -- **Better protection against advanced persistent threats** Securing derived domain credentials using the virtualization-based security blocks the credential theft attack techniques and tools used in many targeted attacks. Malware running in the operating system with administrative privileges cannot extract secrets that are protected by virtualization-based security. While Credential Guard is a powerful mitigation, persistent threat attacks will likely shift to new attack techniques and you should also incorporate Device Guard and other security strategies and architectures. -- **Manageability** You can manage Credential Guard by using Group Policy, WMI, from a command prompt, and Windows PowerShell. +- **Hardware security** NTLM, Kerberos and Credential Manager take advantage of platform security features including, Secure Boot and virtualization to protect credentials. +- **Virtualization-based security** Windows NTLM and Kerberos derived credentials and other secrets run in a protected environment that is isolated from the running operating system. +- **Better protection against advanced persistent threats** When Credential Manager domain credentials, NTLM and Kerberos derived credentials are protected using virtualization-based security, the credential theft attack techniques and tools used in many targeted attacks are blocked. Malware running in the operating system with administrative privileges cannot extract secrets that are protected by virtualization-based security. While Credential Guard is a powerful mitigation, persistent threat attacks will likely shift to new attack techniques and you should also incorporate Device Guard and other security strategies and architectures. ## How it works -Credential Guard isolates secrets that previous versions of Windows stored in the Local Security Authority (LSA) by using virtualization-based security. Prior to Windows 10, the LSA stored secrets used by the operating system in its process memory. With Credential Guard, the LSA process in the operating system talks to a new component called the isolated LSA process that stores and protects those secrets. Data stored by the isolated LSA process is protected using virtualization-based security and is not accessible to the rest of the operating system. LSA uses remote procedure calls to communicate with the isolated LSA process. +Kerberos, NTLM and Credential manager isolates secrets that previous versions of Windows stored in the Local Security Authority (LSA) by using virtualization-based security. Prior to Windows 10, the LSA stored secrets used by the operating system in its process memory. With Credential Guard enabled, the LSA process in the operating system talks to a new component called the isolated LSA process that stores and protects those secrets. Data stored by the isolated LSA process is protected using virtualization-based security and is not accessible to the rest of the operating system. LSA uses remote procedure calls to communicate with the isolated LSA process. For security reasons, the isolated LSA process doesn't host any device drivers. Instead, it only hosts a small subset of operating system binaries that are needed for security and nothing else. All of these binaries are signed with a certificate that is trusted by virtualization-based security and these signatures are validated before launching the file in the protected environment. -Credential Guard prevents NTLMv1, MS-CHAPv2, Digest, and CredSSP from using sign-on credentials. Thus, single sign-on does not work with these protocols. However, Credential guard allows these protocols to be used with prompted credentials or those saved in Credential Manager. It is strongly recommended that valuable credentials, such as the sign-on credentials, not be used with any of these protocols. If these protocols must be used by domain users, secondary credentials should be provisioned for these use cases. +When Credential Guard is enabled, NTLMv1, MS-CHAPv2, Digest, and CredSSP cannot use the signed in credentials. Thus, single sign-on does not work with these protocols. However, applications can prompt for credentials or use credentials stored in the Windows Vault which are not protected by Credential Guard with any of these protocol. It is strongly recommended that valuable credentials, such as the sign-in credentials, not be used with any of these protocols. If these protocols must be used by domain or AAD users, secondary credentials should be provisioned for these use cases. -Credential Guard does not allow unconstrained Kerberos delegation or Kerberos DES encryption at all. Neither sign-on nor prompted/saved credentials may be used. +When Credential Guard is enabled, Kerberos does not allow unconstrained Kerberos delegation or DES encryption not only for signed-in credentials, but also prompted or saved credentials either. Here's a high-level overview on how the LSA is isolated by using virtualization-based security: From 517d60ea67121c67a2eccf80685f5832a5386688 Mon Sep 17 00:00:00 2001 From: GITMichiko Date: Mon, 23 Jan 2017 17:37:28 -0800 Subject: [PATCH 33/87] Update credential-guard.md application draft --- windows/keep-secure/credential-guard.md | 18 ++++++++++++++++++ 1 file changed, 18 insertions(+) diff --git a/windows/keep-secure/credential-guard.md b/windows/keep-secure/credential-guard.md index 96afd50094..289fe1ab10 100644 --- a/windows/keep-secure/credential-guard.md +++ b/windows/keep-secure/credential-guard.md @@ -48,6 +48,24 @@ To deploy Credential Guard, the computers you are protecting must meet certain b You can deploy Credential Guard in phases, and plan these phases in relation to the computer purchases you plan for your next hardware refresh. +### Application requirements + +When Credential Guard is enabled, specific authentication capabilities are blocked, so applications which require blocked capabilities will break. Applications should be tested prior to deployment to ensure compatiblity with the reduced functionality. + +>[!WARNING] Enabling Credential Guard on Domain Controllers is not supported +> The domain controller hosts authentication services which integrate with processes isolated when Credential Guard is enabled. Credential Guard does not provide protections for the Active Directory database or the Security Accounts Manager (SAM). The credentials protected by Kerberos and NTLM when Credential Guard is enabled are also in the Active Directory database. + +Applications will break if they require: +- Kerberos DES encryption support +- Kerberos unconstrained delegation +- Extracting the Kerberos TGT +- NTLMv1 + +Applications will prompt & expose credentials to risk if they require: +- Digest authentication +- Credential delegation +- MS-CHAPv2 + The following tables provide more information about the hardware, firmware, and software required for deployment of Credential Guard. The tables describe baseline protections, plus protections for improved security that are associated with hardware and firmware options available in 2015, available in 2016, and announced as options for 2017. > [!NOTE] From 251607fb328c8ffda1250322ea82c6f2fd0314f7 Mon Sep 17 00:00:00 2001 From: jdeckerMS Date: Tue, 24 Jan 2017 07:11:42 -0800 Subject: [PATCH 34/87] sync --- windows/keep-secure/hello-how-it-works.md | 16 +++++++--------- 1 file changed, 7 insertions(+), 9 deletions(-) diff --git a/windows/keep-secure/hello-how-it-works.md b/windows/keep-secure/hello-how-it-works.md index fa123026c4..970453d06a 100644 --- a/windows/keep-secure/hello-how-it-works.md +++ b/windows/keep-secure/hello-how-it-works.md @@ -29,13 +29,13 @@ A goal of Windows Hello is to allow a user to open a brand-new device, securely 2. To sign in using that account, the user has to enter the existing credentials for it. The identity provider (IDP) that “owns” the account receives the credentials and authenticates the user. This IDP authentication may include the use of an existing second authentication factor, or proof. For example, a user who registers a new device by using an Azure AD account will have to provide an SMS-based proof that Azure AD sends. 3. When the user has provided the proof to the IDP, the user enables PIN authentication. The PIN will be associated with this particular credential. When the user sets the PIN, it becomes usable immediately -Remember that Windows Hello depends on pairing a device and a credential, so the PIN chosen is associated only with the combination of the active account and that specific device. The PIN must comply with whatever length and complexity policy the account administrator has configured; this policy is enforced on the device side. Other registration scenarios that Windows Hello supports are: +The PIN chosen is associated with the combination of the active account and that specific device. The PIN must comply with whatever length and complexity policy the account administrator has configured; this policy is enforced on the device side. Other registration scenarios that Windows Hello supports are: -- A user who upgrades from the Windows 8.1 operating system will sign in by using the existing enterprise password. That triggers MFA from the IDP side; after receiving and returning a proof, such as a text message or voice code, the IDP authenticates the user to the upgraded Windows 10 device, and the user can set his or her PIN. +- A user who upgrades from the Windows 8.1 operating system will sign in by using the existing enterprise password. That triggers a second authentication factor from the IDP side (if required); after receiving and returning a proof, such as a text message or voice code, the IDP authenticates the user to the upgraded Windows 10 device, and the user can set his or her PIN. - A user who typically uses a smart card to sign in will be prompted to set up a PIN the first time he or she signs in to a Windows 10 device the user has not previously signed in to. - A user who typically uses a virtual smart card to sign in will be prompted to set up a PIN the first time he or she signs in to a Windows 10 device the user has not previously signed in to. -When the user has completed this process, Windows Hello generates a new public–private key pair on the device. The TPM generates and stores this private key; if the device doesn’t have a TPM, the private key is encrypted and stored in software. This initial key is referred to as the protector key. It’s associated only with a single gesture; in other words, if a user registers a PIN, a fingerprint, and a face on the same device, each of those gestures will have a unique protector key. The protector key securely wraps the authentication key for a specific container. Each container has only one authentication key, but there can be multiple copies of that key wrapped with different unique protector keys (each of which is associated with a unique gesture). Windows Hello also generates an administrative key that the user or administrator can use to reset credentials, when necessary. In addition to the protector key, TPM-enabled devices generate a block of data that contains attestations from the TPM. +When the user has completed this process, Windows Hello generates a new public–private key pair on the device. The TPM generates and protects this private key; if the device doesn’t have a TPM, the private key is encrypted and stored in software. This initial key is referred to as the protector key. It’s associated only with a single gesture; in other words, if a user registers a PIN, a fingerprint, and a face on the same device, each of those gestures will have a unique protector key. The protector key securely wraps the authentication key for a specific container. Each container has only one authentication key, but there can be multiple copies of that key wrapped with different unique protector keys (each of which is associated with a unique gesture). Windows Hello also generates an administrative key that the user or administrator can use to reset credentials, when necessary. In addition to the protector key, TPM-enabled devices generate a block of data that contains attestations from the TPM. At this point, the user has a PIN gesture defined on the device and an associated protector key for that PIN gesture. That means he or she is able to securely sign in to the device with the PIN and thus that he or she can establish a trusted session with the device to add support for a biometric gesture as an alternative for the PIN. When you add a biometric gesture, it follows the same basic sequence: the user authenticates to the system by using his or her PIN, and then registers the new biometric (“smile for the camera!”), after which Windows generates a unique key pair and stores it securely. Future sign-ins can then use either the PIN or the registered biometric gestures. @@ -55,25 +55,24 @@ Containers can contain several types of key material: - An authentication key, which is always an asymmetric public–private key pair. This key pair is generated during registration. It must be unlocked each time it’s accessed, by using either the user’s PIN or a previously generated biometric gesture. The authentication key exists until the user resets the PIN, at which time a new key will be generated. When the new key is generated, all the key material that the old key previously protected must be decrypted and re-encrypted using the new key. - Virtual smart card keys are generated when a virtual smart card is generated and stored securely in the container. They’re available whenever the user’s container is unlocked. -- Secure/Multipurpose Internet Mail Extensions (S/MIME) keys and certificates, which a certification authority (CA) generates. The keys associated with the user’s S/MIME certificate can be stored in a Windows Hello container so they’re available to the user whenever the container is unlocked. - The IDP key. These keys can be either symmetric or asymmetric, depending on which IDP you use. A single container may contain zero or more IDP keys, with some restrictions (for example, the enterprise container can contain zero or one IDP keys). IDP keys are stored in the container. For certificate-based Windows Hello for Work, when the container is unlocked, applications that require access to the IDP key or key pair can request access. IDP keys are used to sign or encrypt authentication requests or tokens sent from this device to the IDP. IDP keys are typically long-lived but could have a shorter lifetime than the authentication key. Microsoft accounts, Active Directory accounts, and Azure AD accounts all require the use of asymmetric key pairs. The device generates public and private keys, registers the public key with the IDP (which stores it for later verification), and securely stores the private key. For enterprises, the IDP keys can be generated in two ways: - The IDP key pair can be associated with an enterprise Certificate Authority (CA) through the Windows Network Device Enrollment Service (NDES), described more fully in [Network Device Enrollment Service Guidance](https://technet.microsoft.com/library/hh831498.aspx). In this case, Windows Hello requests a new certificate with the same key as the certificate from the existing PKI. This option lets organizations that have an existing PKI continue to use it where appropriate. Given that many applications, such as popular virtual private network systems, require the use of certificates, when you deploy Windows Hello in this mode, it allows a faster transition away from user passwords while still preserving certificate-based functionality. This option also allows the enterprise to store additional certificates in the protected container. - The IDP can generate the IDP key pair directly, which allows quick, lower-overhead deployment of Windows Hello in environments that don’t have or need a PKI. ## How keys are protected -Any time key material is generated, it must be protected against attack. The most robust way to do this is through specialized hardware. There’s a long history of using hardware security modules (HSMs) to generate, store, and process keys for security-critical applications. Smart cards are a special type of HSM, as are devices that are compliant with the Trusted Computing Group TPM standard. Wherever possible, the Windows Hello for Work implementation takes advantage of onboard TPM hardware to generate, store, and process keys. However, Windows Hello and Windows Hello for Work do not require an onboard TPM. Administrators can choose to allow key operations in software, in which case any user who has (or can escalate to) administrative rights on the device can use the IDP keys to sign requests. As an alternative, in some scenarios, devices that don’t have a TPM can be remotely authenticated by using a device that does have a TPM, in which case all the sensitive operations are performed with the TPM and no key material is exposed. +Any time key material is generated, it must be protected against attack. The most robust way to do this is through specialized hardware. There’s a long history of using hardware security modules (HSMs) to generate, store, and process keys for security-critical applications. Smart cards are a special type of HSM, as are devices that are compliant with the Trusted Computing Group TPM standard. Wherever possible, the Windows Hello for Work implementation takes advantage of onboard TPM hardware to generate and protect keys. However, Windows Hello and Windows Hello for Work do not require an onboard TPM. Administrators can choose to allow key operations in software, in which case any user who has (or can escalate to) administrative rights on the device can use the IDP keys to sign requests. As an alternative, in some scenarios, devices that don’t have a TPM can be remotely authenticated by using a device that does have a TPM, in which case all the sensitive operations are performed with the TPM and no key material is exposed. Whenever possible, Microsoft recommends the use of TPM hardware. The TPM protects against a variety of known and potential attacks, including PIN brute-force attacks. The TPM provides an additional layer of protection after an account lockout, too. When the TPM has locked the key material, the user will have to reset the PIN (which means he or she will have to use MFA to reauthenticate to the IDP before the IDP allows him or her to re-register). Resetting the PIN means that all keys and certificates encrypted with the old key material will be removed. ## Authentication -When a user wants to access protected key material — perhaps to use an Internet site that requires a sign-in or to access protected resources on a corporate intranet — the authentication process begins with the user entering a PIN or biometric gesture to unlock the device, a process sometimes called releasing the key. Think of it like using a physical key to unlock a door: before you can unlock the door, you need to remove the key from your pocket or purse. On a personal device that’s connected to an organizational network, users will use their personal PIN or biometric to release the key; on a device joined to an on-premises or Azure AD domain, they will use the organizational PIN. This process unlocks the protector key for the container on the device. When that container is unlocked, applications (and thus the user) can use whatever IDP keys reside inside the container. +When a user wants to access protected key material, the authentication process begins with the user entering a PIN or biometric gesture to unlock the device, a process sometimes called releasing the key. Think of it like using a physical key to unlock a door: before you can unlock the door, you need to remove the key from your pocket or purse. The user's PIN unlocks the protector key for the container on the device. When that container is unlocked, applications (and thus the user) can use whatever IDP keys reside inside the container. These keys are used to sign requests that are sent to the IDP, requesting access to specified resources. It’s important to understand that although the keys are unlocked, applications cannot use them at will. Applications can use specific APIs to request operations that require key material for particular actions (for example, decrypt an email message or sign in to a website). Access through these APIs doesn’t require explicit validation through a user gesture, and the key material isn’t exposed to the requesting application. Rather, the application asks for authentication, encryption, or decryption, and the Windows Hello layer handles the actual work and returns the results. Where appropriate, an application can request a forced authentication even on an unlocked device. Windows prompts the user to reenter the PIN or perform an authentication gesture, which adds an extra level of protection for sensitive data or actions. For example, you can configure the Windows Store to require reauthentication any time a user purchases an application, even though the same account and PIN or gesture were already used to unlock the device. -The actual authentication process works like this: +For example, the authentication process for Azure Active Directory works like this: 1. The client sends an empty authentication request to the IDP. (This is merely for the handshake process.) 2. The IDP returns a challenge, known as a nonce. @@ -91,8 +90,7 @@ When the IDP validates the signature, it is verifying that the request came from Windows Hello depends on having compatible IDPs available to it. As of this writing, that means you have four deployment possibilities: -- Use an existing Windows-based PKI centered around Active Directory Certificate Services. This option requires additional infrastructure, including a way to issue certificates to devices. You can use NDES to register devices directly, Microsoft System Center Configuration Manager or later for on-premises environments, or Microsoft Intune where it’s available to manage mobile device participation in Windows Hello. -- You can configure Windows Server 2016 domain controllers to act as IDPs for Windows Hello. In this mode, the Windows Server 2016 domain controllers act as IDPs alongside any existing Windows Server 2008 R2 or later domain controllers. There is no requirement to replace all existing domain controllers, merely to introduce at least one Windows Server 2016 domain controller per Active Directory site and update the forest Active Directory Domain Services (AD DS) schema to Windows Server 2016 Technical Preview. +- Use an existing Windows-based PKI centered around Active Directory Certificate Services. This option requires additional infrastructure, including a way to issue certificates to users. You can use NDES to register devices directly, or Microsoft Intune where it’s available to manage mobile device participation in Windows Hello. - The normal discovery mechanism that clients use to find domain controllers and global catalogs relies on Domain Name System (DNS) SRV records, but those records don’t contain version data. Windows 10 computers will query DNS for SRV records to find all available Active Directory servers, and then query each server to identify those that can act as Windows Hello IDPs. The number of authentication requests your users generate, where your users are located, and the design of your network all drive the number of Windows Server 2016 domain controllers required. - Azure AD can act as an IDP either by itself or alongside an on-premises AD DS forest. Organizations that use Azure AD can register devices directly without having to join them to a local domain by using the capabilities the Azure AD Device Registration service provides. In addition to the IDP, Windows Hello requires an MDM system. This system can be the cloud-based Intune if you use Azure AD, or an on-premises System Center Configuration Manager deployment that meets the system requirements described in the Deployment requirements section of this document. From 32e5530ecf8f5687a033374eea110df0b7a6bc2a Mon Sep 17 00:00:00 2001 From: jdeckerMS Date: Tue, 24 Jan 2017 10:03:25 -0800 Subject: [PATCH 35/87] fix notes --- windows/keep-secure/hello-and-password-changes.md | 4 +++- windows/keep-secure/hello-biometrics-in-enterprise.md | 3 ++- windows/keep-secure/hello-event-300.md | 3 +-- windows/keep-secure/hello-how-it-works.md | 4 ++-- windows/keep-secure/hello-why-pin-is-better-than-password.md | 4 +++- 5 files changed, 11 insertions(+), 7 deletions(-) diff --git a/windows/keep-secure/hello-and-password-changes.md b/windows/keep-secure/hello-and-password-changes.md index b25aacc596..b9937eeaa8 100644 --- a/windows/keep-secure/hello-and-password-changes.md +++ b/windows/keep-secure/hello-and-password-changes.md @@ -23,7 +23,9 @@ Let's suppose that you have set up a PIN for your Microsoft account on **Device Because you were using **Device A** when you changed your password, the PIN on **Device A** will continue to work with no other action on your part. Suppose instead that you sign in on **Device B** and change your password for your Microsoft account. The next time that you try to sign in on **Device A** using your PIN, sign-in will fail because the account credentials that Hello on **Device A** knows will be outdated. -> **Note:**  This example also applies to an Active Directory account when [Windows Hello for Business is not implemented](implement-microsoft-passport-in-your-organization.md). + +>[!NOTE] +>This example also applies to an Active Directory account when [Windows Hello for Business is not implemented](implement-microsoft-passport-in-your-organization.md).   ## How to update Hello after you change your password on another device diff --git a/windows/keep-secure/hello-biometrics-in-enterprise.md b/windows/keep-secure/hello-biometrics-in-enterprise.md index e3d1f50764..162ff7d762 100644 --- a/windows/keep-secure/hello-biometrics-in-enterprise.md +++ b/windows/keep-secure/hello-biometrics-in-enterprise.md @@ -18,7 +18,8 @@ localizationpriority: high Windows Hello is the biometric authentication feature that helps strengthen authentication and helps to guard against potential spoofing through fingerprint matching and facial recognition. -> **Note:** When Windows 10 first shipped, it included Microsoft Passport and Windows Hello, which worked together to provide multi-factor authentication. To simplify deployment and improve supportability, Microsoft has combined these technologies into a single solution under the Windows Hello name. Customers who have already deployed these technologies will not experience any change in functionality. Customers who have yet to evaluate Windows Hello will find it easier to deploy due to simplified policies, documentation, and semantics. +>[!NOTE] +>When Windows 10 first shipped, it included Microsoft Passport and Windows Hello, which worked together to provide multi-factor authentication. To simplify deployment and improve supportability, Microsoft has combined these technologies into a single solution under the Windows Hello name. Customers who have already deployed these technologies will not experience any change in functionality. Customers who have yet to evaluate Windows Hello will find it easier to deploy due to simplified policies, documentation, and semantics. Because we realize your employees are going to want to use this new technology in your enterprise, we’ve been actively working with the device manufacturers to create strict design and performance recommendations that help to ensure that you can more confidently introduce Windows Hello biometrics into your organization. diff --git a/windows/keep-secure/hello-event-300.md b/windows/keep-secure/hello-event-300.md index b6f75fd82b..ea19c3f794 100644 --- a/windows/keep-secure/hello-event-300.md +++ b/windows/keep-secure/hello-event-300.md @@ -26,8 +26,7 @@ This event is created when Windows Hello for Business is successfully created an | **ID:** | 300 | | **Source:** | Microsoft Azure Device Registration Service | | **Version:** | 10 | -| **Message:** | The NGC key was successfully registered. Key ID: {4476694e-8e3b-4ef8-8487-be21f95e6f07}. UPN:test@contoso.com. Attestation: ATT\_SOFT. Client request ID: . Server request ID: db2da6bd-3d70-4b9b-b26b-444f669902da. -Server response: {"kid":"4476694e-8e3b-4ef8-8487-be21f95e6f07","upn":"test@contoso.com"} | +| **Message:** | The NGC key was successfully registered. Key ID: {4476694e-8e3b-4ef8-8487-be21f95e6f07}. UPN:test@contoso.com. Attestation: ATT\_SOFT. Client request ID: . Server request ID: db2da6bd-3d70-4b9b-b26b-444f669902da.
Server response: {"kid":"4476694e-8e3b-4ef8-8487-be21f95e6f07","upn":"test@contoso.com"} |   ## Resolve diff --git a/windows/keep-secure/hello-how-it-works.md b/windows/keep-secure/hello-how-it-works.md index 970453d06a..c9bce0ea90 100644 --- a/windows/keep-secure/hello-how-it-works.md +++ b/windows/keep-secure/hello-how-it-works.md @@ -14,11 +14,11 @@ localizationpriority: high - Windows 10 - Windows 10 Mobile -To use Windows Hello to sign in with an identity provider (IDP), a user needs a configured device, which means that the Windows Hello life cycle starts when you register a new user or device. When the device is set up, its user can use the device to authenticate to services. This topic explains how device registration works, what happens when a user requests authentication, how key material is stored and processed, and which servers and infrastructure components are involved in different parts of this process. +TWindows Hello for Business requires a registered device. When the device is set up, its user can use the device to authenticate to services. This topic explains how device registration works, what happens when a user requests authentication, how key material is stored and processed, and which servers and infrastructure components are involved in different parts of this process. ## Register a new user or device -A goal of Windows Hello is to allow a user to open a brand-new device, securely join an organizational network to download and manage organizational data, and create a new Hello gesture to secure the device. Microsoft refers to the process of setting up a device for use with Windows Hello as registration. +A goal of device registration is to allow a user to open a brand-new device, securely join an organizational network to download and manage organizational data, and create a new Windows Hello gesture to secure the device. Microsoft refers to the process of setting up a device for use with Windows Hello as registration. > [!NOTE] >This is separate from the organizational configuration required to use Windows Hello with Active Directory or Azure Active Directory (Azure AD); that configuration information is in [Manage Windows Hello for Business in your organization](hello-manage-in-organization.md). Organizational configuration must be completed before users can begin to register. diff --git a/windows/keep-secure/hello-why-pin-is-better-than-password.md b/windows/keep-secure/hello-why-pin-is-better-than-password.md index f228aa93c2..a7606f0264 100644 --- a/windows/keep-secure/hello-why-pin-is-better-than-password.md +++ b/windows/keep-secure/hello-why-pin-is-better-than-password.md @@ -30,7 +30,9 @@ Even you can't use that PIN anywhere except on that specific device. If you want A password is transmitted to the server -- it can be intercepted in transmission or stolen from a server. A PIN is local to the device -- it isn't transmitted anywhere and it isn't stored on the server. When the PIN is created, it establishes a trusted relationship with the identity provider and creates an asymmetric key pair that is used for authentication. When you enter your PIN, it unlocks the authentication key and uses the key to sign the request that is sent to the authenticating server. -> **Note:**  For details on how Hello uses asymetric key pairs for authentication, see [Microsoft Passport guide](https://go.microsoft.com/fwlink/p/?LinkId=691928). + +>[!NOTE] +>For details on how Hello uses asymetric key pairs for authentication, see [Microsoft Passport guide](https://go.microsoft.com/fwlink/p/?LinkId=691928).   ## PIN is backed by hardware From c1534420ed97a81bf5b2242942ea59883fda4055 Mon Sep 17 00:00:00 2001 From: jdeckerMS Date: Wed, 25 Jan 2017 08:17:23 -0800 Subject: [PATCH 36/87] add showcase link --- windows/keep-secure/hello-identity-verification.md | 2 ++ 1 file changed, 2 insertions(+) diff --git a/windows/keep-secure/hello-identity-verification.md b/windows/keep-secure/hello-identity-verification.md index 0f73b11805..a1e391508f 100644 --- a/windows/keep-secure/hello-identity-verification.md +++ b/windows/keep-secure/hello-identity-verification.md @@ -99,6 +99,8 @@ Windows Hello for Business can use either keys (hardware or software) or certifi ## Learn more +[Implementing Windows Hello for Business at Microsoft](https://www.microsoft.com/itshowcase/Article/Content/830/Implementing-Windows-Hello-for-Business-at-Microsoft) + [Introduction to Windows Hello](https://go.microsoft.com/fwlink/p/?LinkId=786649), video presentation on Microsoft Virtual Academy [What's new in Active Directory Domain Services (AD DS) in Windows Server Technical Preview](https://go.microsoft.com/fwlink/p/?LinkId=708533) From 16bb7c2d600dbdeac3595e927640bd6a7044f139 Mon Sep 17 00:00:00 2001 From: GITMichiko Date: Thu, 26 Jan 2017 00:07:48 -0800 Subject: [PATCH 37/87] Update credential-guard.md Added missing Security Considerations heading and demoted subheadings to match --- windows/keep-secure/credential-guard.md | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/windows/keep-secure/credential-guard.md b/windows/keep-secure/credential-guard.md index c40e90f58a..6465993ef4 100644 --- a/windows/keep-secure/credential-guard.md +++ b/windows/keep-secure/credential-guard.md @@ -65,6 +65,8 @@ Applications will prompt & expose credentials to risk if they require: - Credential delegation - MS-CHAPv2 +### Security considerations + The following tables provide more information about the hardware, firmware, and software required for deployment of Credential Guard. The tables describe baseline protections, plus protections for improved security that are associated with hardware and firmware options available in 2015, available in 2016, and announced as options for 2017. > [!NOTE] @@ -72,7 +74,7 @@ The following tables provide more information about the hardware, firmware, and > If you are an OEM, see the requirements information at [PC OEM requirements for Device Guard and Credential Guard](https://msdn.microsoft.com/library/windows/hardware/mt767514.aspx).
> Starting in Widows 10, 1607, TPM 2.0 is required. -### Baseline protection recommendations +#### Baseline protection recommendations |Baseline Protections | Description | |---------------------------------------------|----------------------------------------------------| @@ -86,7 +88,7 @@ The following tables provide more information about the hardware, firmware, and > [!IMPORTANT] > The preceding table lists requirements for baseline protections. The following tables list requirements for improved security. You can use Credential Guard with hardware, firmware, and software that support baseline protections, even if they do not support protections for improved security. However, we strongly recommend meeting the requirements for improved security, to significantly strengthen the level of security that Credential Guard can provide. -### 2015 Additional Security Recommendations (starting with Windows 10, version 1507, and Windows Server 2016, Technical Preview 4) +#### 2015 Additional Security Recommendations (starting with Windows 10, version 1507, and Windows Server 2016, Technical Preview 4) | Protections for Improved Security | Description | |---------------------------------------------|----------------------------------------------------| @@ -96,7 +98,7 @@ The following tables provide more information about the hardware, firmware, and
-### 2016 Additional Security Recommendations (starting with Windows 10, version 1607, and Windows Server 2016) +#### 2016 Additional Security Recommendations (starting with Windows 10, version 1607, and Windows Server 2016) > [!IMPORTANT] > The following tables list requirements for improved security, beyond the level of protection described in the preceding tables. You can use Credential Guard with hardware, firmware, and software that do not support the following protections for improved security. As your systems meet more requirements, more protections become available to them. @@ -109,7 +111,7 @@ The following tables provide more information about the hardware, firmware, and
-### 2017 Additional Security Recommendations (starting with the next major release of Windows 10) +#### 2017 Additional Security Recommendations (starting with the next major release of Windows 10) | Protection for Improved Security | Description | |---------------------------------------------|----------------------------------------------------| From 7047eec1676376ab2ca738dbb74e30229ed0678c Mon Sep 17 00:00:00 2001 From: GITMichiko Date: Thu, 26 Jan 2017 00:23:30 -0800 Subject: [PATCH 38/87] Update credential-guard.md hardware requirements --- windows/keep-secure/credential-guard.md | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) diff --git a/windows/keep-secure/credential-guard.md b/windows/keep-secure/credential-guard.md index c40e90f58a..12bd430f83 100644 --- a/windows/keep-secure/credential-guard.md +++ b/windows/keep-secure/credential-guard.md @@ -45,7 +45,15 @@ For Credential Guard to provide protections, the computers you are protecting mu To deploy Credential Guard, the computers you are protecting must meet certain baseline hardware, firmware, and software requirements. Beyond that, computers can meet additional hardware and firmware requirements, and receive additional protection—those computers will be more hardened against certain threats. -You can deploy Credential Guard in phases, and plan these phases in relation to the computer purchases you plan for your next hardware refresh. +To provide basic protection against OS level attempts to read Credential Manager domain credentials, NTLM and Kerberos derived credentials, Credential Manager uses: +- Support for Virtualization-based security (required) +- TPM 2.0 either discrete or firmware (preferred - provides binding to hardware) +- UEFI lock (preferred - prevents attacker from disabling with a simple registry key change) + +The Virtualization-based security requires: +- 64 bit CPU +- CPU virtualization extensions plu extended page tables +- Windows hypervisor ### Application requirements From ddf059038ad12ec80c785700770bc187ca02568d Mon Sep 17 00:00:00 2001 From: Dani Halfin Date: Mon, 30 Jan 2017 18:21:41 -0800 Subject: [PATCH 39/87] Waas-Delivery-optimization - added content added online requirement. Added to simple mode in order to better explain it. --- windows/manage/waas-delivery-optimization.md | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/windows/manage/waas-delivery-optimization.md b/windows/manage/waas-delivery-optimization.md index 9b3dc0a522..243665903d 100644 --- a/windows/manage/waas-delivery-optimization.md +++ b/windows/manage/waas-delivery-optimization.md @@ -19,6 +19,10 @@ localizationpriority: high Delivery Optimization is a self-organizing distributed cache solution for businesses looking to reduce bandwidth consumption for operating system updates, operating system upgrades, and applications by allowing clients to download those elements from alternate sources (such as other peers on the network) in addition to the traditional Internet-based Windows Update servers. You can use Delivery Optimization in conjunction with stand-alone Windows Update, Windows Server Update Services (WSUS), and Windows Update for Business. This functionality is similar to BranchCache in other systems, such as System Center Configuration Manager. +Delivery Optimization is a cloud managed solution. Having access to the Delivery Optimization cloud services, is a requirement for it to be enabled. This mean that in order to utilize Delivery Optimization, machines need to have access to the internet. + +For more details, see [Download mode](#download-mode). + >[!NOTE] >WSUS can also use [BranchCache](waas-branchcache.md) for content sharing and caching. If Delivery Optimization is enabled on devices that use BranchCache, Delivery Optimization will be used instead. @@ -33,17 +37,19 @@ You can use Group Policy or an MDM solution like Intune to configure Delivery Op Several Delivery Optimization features are configurable. + + ### Download mode (DODownloadMode) Download mode dictates which download sources clients are allowed to use when downloading Windows updates in addition to Windows Update servers. The following table shows the available download mode options and what they do. | Download mode option | Functionality when set | | --- | --- | -| HTTP Only (0) | This setting disables peer content sharing but still allows Delivery Optimization to download content from Windows Update servers or WSUS servers. | +| HTTP Only (0) | This setting disables peer content sharing but still allows Delivery Optimization to download content from Windows Update servers or WSUS servers. This mode uses metadata provided by the Delivery Optimization cloud services for a more consistent plain download experience. | | LAN (1 – Default) | This default operating mode for Delivery Optimization enables peer sharing on the same network. | | Group (2) | When group mode is set, the group is automatically selected based on the device’s Active Directory Domain Services (AD DS) site (Windows 10, version 1607) or the domain the device is authenticated to (Windows 10, version 1511). In group mode, peering occurs across internal subnets, between devices that belong to the same group, including devices in remote offices. You can use the GroupID option to create your own custom group independently of domains and AD DS sites. Group download mode is the recommended option for most organizations looking to achieve the best bandwidth optimization with Delivery Optimization. | | Internet (3) | Enable Internet peer sources for Delivery Optimization. | -| Simple (99) | Simple mode disables the use of Delivery Optimization cloud services completely (for offline environments). Delivery Optimization switches to this mode automatically when the Delivery Optimization cloud services are unavailable or unreachable. | +| Simple (99) | Simple mode disables the use of Delivery Optimization cloud services completely (for offline environments). Delivery Optimization switches to this mode automatically when the Delivery Optimization cloud services are unavailable or unreachable. In this mode, Delivery Optimization provides a modern download manager experience, with little optimization and no peer content sharing. | |Bypass (100) | Bypass Delivery Optimization and use BITS, instead. For example, select this mode so that clients can use BranchCache. | >[!NOTE] From 61f90939736f19d987115259048630974a5e38f1 Mon Sep 17 00:00:00 2001 From: jcaparas Date: Mon, 30 Jan 2017 21:40:34 -0800 Subject: [PATCH 40/87] update min reqs --- ...requirements-windows-defender-advanced-threat-protection.md | 3 +++ 1 file changed, 3 insertions(+) diff --git a/windows/keep-secure/minimum-requirements-windows-defender-advanced-threat-protection.md b/windows/keep-secure/minimum-requirements-windows-defender-advanced-threat-protection.md index 55a3242e78..a189690013 100644 --- a/windows/keep-secure/minimum-requirements-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/minimum-requirements-windows-defender-advanced-threat-protection.md @@ -24,6 +24,8 @@ localizationpriority: high There are some minimum requirements for onboarding your network and endpoints. ## Minimum requirements +You must be on Windows 10, version 1607 at a minimum, and must purchase Windows 10 Enterprise E5 edition to use the service. +For more information, see [Windows 10 Enterprise edition](https://www.microsoft.com/en-us/WindowsForBusiness/buy). ### Network and data storage and configuration requirements When you run the onboarding wizard for the first time, you must choose where your Windows Defender Advanced Threat Protection-related information is stored: either in a European or United States datacenter. @@ -33,6 +35,7 @@ When you run the onboarding wizard for the first time, you must choose where you - Review the [Windows Defender ATP data storage and privacy](data-storage-privacy-windows-defender-advanced-threat-protection.md) for more information on where and how Microsoft stores your data. ### Endpoint hardware and software requirements + The Windows Defender ATP agent only supports the following editions of Windows 10: - Windows 10 Enterprise From 0eeb85b9a935ef4336093ddf6db6dce6060822b2 Mon Sep 17 00:00:00 2001 From: jcaparas Date: Tue, 31 Jan 2017 07:21:04 -0800 Subject: [PATCH 41/87] Remove purchase --- ...-requirements-windows-defender-advanced-threat-protection.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/keep-secure/minimum-requirements-windows-defender-advanced-threat-protection.md b/windows/keep-secure/minimum-requirements-windows-defender-advanced-threat-protection.md index a189690013..7125de6f76 100644 --- a/windows/keep-secure/minimum-requirements-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/minimum-requirements-windows-defender-advanced-threat-protection.md @@ -24,7 +24,7 @@ localizationpriority: high There are some minimum requirements for onboarding your network and endpoints. ## Minimum requirements -You must be on Windows 10, version 1607 at a minimum, and must purchase Windows 10 Enterprise E5 edition to use the service. +You must be on Windows 10, version 1607 at a minimum. For more information, see [Windows 10 Enterprise edition](https://www.microsoft.com/en-us/WindowsForBusiness/buy). ### Network and data storage and configuration requirements From f43e9544db11203f905872e8a68d96da7365f46b Mon Sep 17 00:00:00 2001 From: jdeckerMS Date: Tue, 31 Jan 2017 09:58:34 -0800 Subject: [PATCH 42/87] fix typo # Conflicts: # devices/surface-hub/online-deployment-surface-hub-device-accounts.md --- windows/deploy/provisioning-apply-package.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/deploy/provisioning-apply-package.md b/windows/deploy/provisioning-apply-package.md index 417c9e9e75..1125dd6985 100644 --- a/windows/deploy/provisioning-apply-package.md +++ b/windows/deploy/provisioning-apply-package.md @@ -94,7 +94,7 @@ On a desktop computer, navigate to **Settings** > **Accounts** > **Access work o ![Is this package from a source you trust](images/package-trust.png) -# + ## Learn more From d6c7b32d1f24ca86cb98c7485aff4dc1e8af15f0 Mon Sep 17 00:00:00 2001 From: jdeckerMS Date: Tue, 31 Jan 2017 10:50:38 -0800 Subject: [PATCH 43/87] final correction --- windows/keep-secure/hello-how-it-works.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/keep-secure/hello-how-it-works.md b/windows/keep-secure/hello-how-it-works.md index c9bce0ea90..089387f204 100644 --- a/windows/keep-secure/hello-how-it-works.md +++ b/windows/keep-secure/hello-how-it-works.md @@ -35,7 +35,7 @@ The PIN chosen is associated with the combination of the active account and that - A user who typically uses a smart card to sign in will be prompted to set up a PIN the first time he or she signs in to a Windows 10 device the user has not previously signed in to. - A user who typically uses a virtual smart card to sign in will be prompted to set up a PIN the first time he or she signs in to a Windows 10 device the user has not previously signed in to. -When the user has completed this process, Windows Hello generates a new public–private key pair on the device. The TPM generates and protects this private key; if the device doesn’t have a TPM, the private key is encrypted and stored in software. This initial key is referred to as the protector key. It’s associated only with a single gesture; in other words, if a user registers a PIN, a fingerprint, and a face on the same device, each of those gestures will have a unique protector key. The protector key securely wraps the authentication key for a specific container. Each container has only one authentication key, but there can be multiple copies of that key wrapped with different unique protector keys (each of which is associated with a unique gesture). Windows Hello also generates an administrative key that the user or administrator can use to reset credentials, when necessary. In addition to the protector key, TPM-enabled devices generate a block of data that contains attestations from the TPM. +When the user has completed this process, Windows Hello generates a new public–private key pair on the device. The TPM generates and protects this private key; if the device doesn’t have a TPM, the private key is encrypted and stored in software. This initial key is referred to as the protector key. It’s associated only with a single gesture; in other words, if a user registers a PIN, a fingerprint, and a face on the same device, each of those gestures will have a unique protector key. Each unique gesture generates a unique protector key. The protector key securely wraps the authentication key. The container has only one authentication key, but there can be multiple copies of that key wrapped with different unique protector keys. Windows Hello also generates an administrative key that the user or administrator can use to reset credentials, when necessary. In addition to the protector key, TPM-enabled devices generate a block of data that contains attestations from the TPM. At this point, the user has a PIN gesture defined on the device and an associated protector key for that PIN gesture. That means he or she is able to securely sign in to the device with the PIN and thus that he or she can establish a trusted session with the device to add support for a biometric gesture as an alternative for the PIN. When you add a biometric gesture, it follows the same basic sequence: the user authenticates to the system by using his or her PIN, and then registers the new biometric (“smile for the camera!”), after which Windows generates a unique key pair and stores it securely. Future sign-ins can then use either the PIN or the registered biometric gestures. From 1580634b6347327a58204841d6c45c2b71df747a Mon Sep 17 00:00:00 2001 From: LizRoss Date: Tue, 31 Jan 2017 12:31:00 -0800 Subject: [PATCH 44/87] Fixing typo --- windows/keep-secure/app-behavior-with-wip.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/windows/keep-secure/app-behavior-with-wip.md b/windows/keep-secure/app-behavior-with-wip.md index bf932d459d..7b8a41df15 100644 --- a/windows/keep-secure/app-behavior-with-wip.md +++ b/windows/keep-secure/app-behavior-with-wip.md @@ -38,8 +38,8 @@ This table includes info about how unenlightened apps might behave, based on you   - Name-based policies, without the /*AppCompat*/ string - Name-based policies, using the /*AppCompat*/ string or proxy-based policies + Name-based policies, without the /*AppCompat*/ string + Name-based policies, using the /*AppCompat*/ string or proxy-based policies Not required. App connects to enterprise cloud resources directly, using an IP address. @@ -96,7 +96,7 @@ This table includes info about how enlightened apps might behave, based on your - + From 2a60d977cf6ce6260a730650e32428930f889fc2 Mon Sep 17 00:00:00 2001 From: LizRoss Date: Tue, 31 Jan 2017 12:40:33 -0800 Subject: [PATCH 45/87] Fixing typo --- windows/keep-secure/app-behavior-with-wip.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/windows/keep-secure/app-behavior-with-wip.md b/windows/keep-secure/app-behavior-with-wip.md index 7b8a41df15..c1d428463b 100644 --- a/windows/keep-secure/app-behavior-with-wip.md +++ b/windows/keep-secure/app-behavior-with-wip.md @@ -38,8 +38,8 @@ This table includes info about how unenlightened apps might behave, based on you - - + + @@ -96,7 +96,7 @@ This table includes info about how enlightened apps might behave, based on your
App rule settingNetworking policy configuration for name-based policies, possibly using the /*AppCompat*/ string, or proxy-based policiesNetworking policy configuration for name-based policies, possibly using the /*AppCompat*/ string, or proxy-based policies
Not required. App connects to enterprise cloud resources, using an IP address or a hostname.
 Name-based policies, without the /*AppCompat*/ stringName-based policies, using the /*AppCompat*/ string or proxy-based policiesName-based policies, without the /*AppCompat*/ stringName-based policies, using the /*AppCompat*/ string or proxy-based policies
Not required. App connects to enterprise cloud resources directly, using an IP address.
- + From 3eea7022c8e538642f280f8200f6ef132bbf13c9 Mon Sep 17 00:00:00 2001 From: LizRoss Date: Tue, 31 Jan 2017 12:48:08 -0800 Subject: [PATCH 46/87] Fixing typo --- windows/keep-secure/app-behavior-with-wip.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/windows/keep-secure/app-behavior-with-wip.md b/windows/keep-secure/app-behavior-with-wip.md index c1d428463b..4a47cfcb9c 100644 --- a/windows/keep-secure/app-behavior-with-wip.md +++ b/windows/keep-secure/app-behavior-with-wip.md @@ -38,8 +38,8 @@ This table includes info about how unenlightened apps might behave, based on you - - + + @@ -96,7 +96,7 @@ This table includes info about how enlightened apps might behave, based on your
App rule settingNetworking policy configuration for name-based policies, possibly using the /*AppCompat*/ string, or proxy-based policiesNetworking policy configuration for name-based policies, possibly using the /*AppCompat*/ string, or proxy-based policies
Not required. App connects to enterprise cloud resources, using an IP address or a hostname.
 Name-based policies, without the /*AppCompat*/ stringName-based policies, using the /*AppCompat*/ string or proxy-based policiesName-based policies, without the /*AppCompat**/ stringName-based policies, using the /*AppCompat**/ string or proxy-based policies
Not required. App connects to enterprise cloud resources directly, using an IP address.
- + From 146fdd14e0e59700961a96a4fb533663cec8576a Mon Sep 17 00:00:00 2001 From: LizRoss Date: Tue, 31 Jan 2017 12:56:48 -0800 Subject: [PATCH 47/87] Fixing typo --- windows/keep-secure/app-behavior-with-wip.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/keep-secure/app-behavior-with-wip.md b/windows/keep-secure/app-behavior-with-wip.md index 4a47cfcb9c..1f83aad42f 100644 --- a/windows/keep-secure/app-behavior-with-wip.md +++ b/windows/keep-secure/app-behavior-with-wip.md @@ -38,8 +38,8 @@ This table includes info about how unenlightened apps might behave, based on you - - + + From 4d4784d6ae4da38cd83d5c8db7a70d5c96740720 Mon Sep 17 00:00:00 2001 From: GITMichiko Date: Tue, 31 Jan 2017 13:20:13 -0800 Subject: [PATCH 48/87] Update credential-guard.md refined app stuff. typo in HW --- windows/keep-secure/credential-guard.md | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-) diff --git a/windows/keep-secure/credential-guard.md b/windows/keep-secure/credential-guard.md index a0911b6720..9ce9b9cbaa 100644 --- a/windows/keep-secure/credential-guard.md +++ b/windows/keep-secure/credential-guard.md @@ -52,15 +52,19 @@ To provide basic protection against OS level attempts to read Credential Manager The Virtualization-based security requires: - 64 bit CPU -- CPU virtualization extensions plu extended page tables +- CPU virtualization extensions plus extended page tables - Windows hypervisor ### Application requirements When Credential Guard is enabled, specific authentication capabilities are blocked, so applications which require blocked capabilities will break. Applications should be tested prior to deployment to ensure compatiblity with the reduced functionality. ->[!WARNING] Enabling Credential Guard on Domain Controllers is not supported -> The domain controller hosts authentication services which integrate with processes isolated when Credential Guard is enabled. Credential Guard does not provide protections for the Active Directory database or the Security Accounts Manager (SAM). The credentials protected by Kerberos and NTLM when Credential Guard is enabled are also in the Active Directory database. +>[!WARNING] +> Enabling Credential Guard on Domain Controllers is not supported
+> The domain controller hosts authentication services which integrate with processes isolated when Credential Guard is enabled causing crashes. + +>[!NOTE] +> Credential Guard does not provide protections for the Active Directory database or the Security Accounts Manager (SAM). The credentials protected by Kerberos and NTLM when Credential Guard is enabled are also in the Active Directory database (on domain controllers) and the SAM (for local accounts). Applications will break if they require: - Kerberos DES encryption support @@ -73,6 +77,8 @@ Applications will prompt & expose credentials to risk if they require: - Credential delegation - MS-CHAPv2 +Applications may cause performance issues when they attempt to hook the isolated Credential Guard process. + ### Security considerations The following tables provide more information about the hardware, firmware, and software required for deployment of Credential Guard. The tables describe baseline protections, plus protections for improved security that are associated with hardware and firmware options available in 2015, available in 2016, and announced as options for 2017. From 9bac3c789f7fc330a912d246c4418854cd5d0831 Mon Sep 17 00:00:00 2001 From: ErikMoreau Date: Wed, 1 Feb 2017 12:17:50 +0100 Subject: [PATCH 49/87] Update configure-proxy-internet-windows-defender-advanced-threat-protection.md MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Typo fix on line 25 added s to 'Window Defender ATP sensor' => 'Windows Defender ATP sensor' --- ...xy-internet-windows-defender-advanced-threat-protection.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/keep-secure/configure-proxy-internet-windows-defender-advanced-threat-protection.md b/windows/keep-secure/configure-proxy-internet-windows-defender-advanced-threat-protection.md index 38a3f1edc2..aa809c74c7 100644 --- a/windows/keep-secure/configure-proxy-internet-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/configure-proxy-internet-windows-defender-advanced-threat-protection.md @@ -1,4 +1,4 @@ ---- +s--- title: Configure Windows Defender ATP endpoint proxy and Internet connection settings description: Configure the Windows Defender ATP proxy and internet settings to enable communication with the cloud service. keywords: configure, proxy, internet, internet connectivity, settings, proxy settings, netsh, winhttp, proxy server @@ -22,7 +22,7 @@ localizationpriority: high - Windows 10 Pro Education - Windows Defender Advanced Threat Protection (Windows Defender ATP) -The Window Defender ATP sensor requires Microsoft Windows HTTP (WinHTTP) to report sensor data and communicate with the Windows Defender ATP service. +The Windows Defender ATP sensor requires Microsoft Windows HTTP (WinHTTP) to report sensor data and communicate with the Windows Defender ATP service. The embedded Windows Defender ATP sensor runs in system context using the LocalSystem account. The sensor uses Microsoft Windows HTTP Services (WinHTTP) to enable communication with the Windows Defender ATP cloud service. From 4da7d3f2d32df4322af557158507212298943d15 Mon Sep 17 00:00:00 2001 From: LizRoss Date: Wed, 1 Feb 2017 07:32:38 -0800 Subject: [PATCH 50/87] Fixing YAML --- ...proxy-internet-windows-defender-advanced-threat-protection.md | 1 - 1 file changed, 1 deletion(-) diff --git a/windows/keep-secure/configure-proxy-internet-windows-defender-advanced-threat-protection.md b/windows/keep-secure/configure-proxy-internet-windows-defender-advanced-threat-protection.md index aa809c74c7..53d19c2f9f 100644 --- a/windows/keep-secure/configure-proxy-internet-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/configure-proxy-internet-windows-defender-advanced-threat-protection.md @@ -1,4 +1,3 @@ -s--- title: Configure Windows Defender ATP endpoint proxy and Internet connection settings description: Configure the Windows Defender ATP proxy and internet settings to enable communication with the cloud service. keywords: configure, proxy, internet, internet connectivity, settings, proxy settings, netsh, winhttp, proxy server From fab8e945a2cbb0cd5404d3eab31cccb97dc3dc03 Mon Sep 17 00:00:00 2001 From: LizRoss Date: Wed, 1 Feb 2017 07:41:06 -0800 Subject: [PATCH 51/87] Fixing YAML --- ...proxy-internet-windows-defender-advanced-threat-protection.md | 1 + 1 file changed, 1 insertion(+) diff --git a/windows/keep-secure/configure-proxy-internet-windows-defender-advanced-threat-protection.md b/windows/keep-secure/configure-proxy-internet-windows-defender-advanced-threat-protection.md index 53d19c2f9f..dd145bf769 100644 --- a/windows/keep-secure/configure-proxy-internet-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/configure-proxy-internet-windows-defender-advanced-threat-protection.md @@ -1,3 +1,4 @@ +--- title: Configure Windows Defender ATP endpoint proxy and Internet connection settings description: Configure the Windows Defender ATP proxy and internet settings to enable communication with the cloud service. keywords: configure, proxy, internet, internet connectivity, settings, proxy settings, netsh, winhttp, proxy server From ed9fd4a4f298f92bbceed3e322475bb675c18918 Mon Sep 17 00:00:00 2001 From: jdeckerMS Date: Wed, 1 Feb 2017 07:44:16 -0800 Subject: [PATCH 52/87] mobile to start layout --- ...art-screens-by-using-mobile-device-management.md | 7 ++++--- ...creens-by-using-provisioning-packages-and-icd.md | 13 ++++++------- 2 files changed, 10 insertions(+), 10 deletions(-) diff --git a/windows/manage/customize-windows-10-start-screens-by-using-mobile-device-management.md b/windows/manage/customize-windows-10-start-screens-by-using-mobile-device-management.md index cf6a6dab79..2ccace55f5 100644 --- a/windows/manage/customize-windows-10-start-screens-by-using-mobile-device-management.md +++ b/windows/manage/customize-windows-10-start-screens-by-using-mobile-device-management.md @@ -15,17 +15,18 @@ localizationpriority: medium **Applies to** -- Windows 10 +- Windows 10 +- Windows 10 Mobile **Looking for consumer information?** - [Customize the Start menu](https://go.microsoft.com/fwlink/p/?LinkId=623630) -In Windows 10 Enterprise and Windows 10 Education, you can use a mobile device management (MDM) policy to deploy a customized Start layout to users. No reimaging is required, and the Start layout can be updated simply by overwriting the .xml file that contains the layout. This enables you to customize Start layouts for different departments or organizations, with minimal management overhead. +In Windows 10 Mobile, Windows 10 Enterprise, and Windows 10 Education, you can use a mobile device management (MDM) policy to deploy a customized Start layout to users. No reimaging is required, and the Start layout can be updated simply by overwriting the .xml file that contains the layout. This enables you to customize Start layouts for different departments or organizations, with minimal management overhead. > **Note:** Customized taskbar configuration cannot be applied using MDM at this time. -**Before you begin**: [Customize and export Start layout](customize-and-export-start-layout.md) +**Before you begin**: [Customize and export Start layout](customize-and-export-start-layout.md) for desktop editions or [create a Start layout XML](start-layout-xml-mobile.md) for mobile. **Warning**   When a full Start layout is applied with this method, the users cannot pin, unpin, or uninstall apps from Start. Users can view and open all apps in the **All Apps** view, but they cannot pin any apps to Start. When a partial Start layout is applied, the contents of the specified tile groups cannot be changed, but users can move those groups, and can also create and customize their own groups. diff --git a/windows/manage/customize-windows-10-start-screens-by-using-provisioning-packages-and-icd.md b/windows/manage/customize-windows-10-start-screens-by-using-provisioning-packages-and-icd.md index 8ec42b3218..7cc8395f8b 100644 --- a/windows/manage/customize-windows-10-start-screens-by-using-provisioning-packages-and-icd.md +++ b/windows/manage/customize-windows-10-start-screens-by-using-provisioning-packages-and-icd.md @@ -15,18 +15,19 @@ localizationpriority: medium **Applies to** -- Windows 10 +- Windows 10 +- Windows 10 Mobile **Looking for consumer information?** - [Customize the Start menu](https://go.microsoft.com/fwlink/p/?LinkId=623630) -In Windows 10 Enterprise and Windows 10 Education, version 1607, you can use a provisioning package that you create with Windows Imaging and Configuration Designer (ICD) tool to deploy a customized Start and taskbar layout to users. No reimaging is required, and the Start and taskbar layout can be updated simply by overwriting the .xml file that contains the layout. The provisioning package can be applied to a running device. This enables you to customize Start and taskbar layouts for different departments or organizations, with minimal management overhead. +In Windows 10 Mobile, Windows 10 Enterprise, and Windows 10 Education, version 1607, you can use a provisioning package that you create with Windows Imaging and Configuration Designer (ICD) tool to deploy a customized Start and taskbar layout to users. No reimaging is required, and the Start and taskbar layout can be updated simply by overwriting the .xml file that contains the layout. The provisioning package can be applied to a running device. This enables you to customize Start and taskbar layouts for different departments or organizations, with minimal management overhead. >[!IMPORTANT] >If you use a provisioning package to configure the taskbar, your configuration will be reapplied each time the explorer.exe process restarts. If your configuration pins an app and the user unpins that app, the user's change will be overwritten the next time the configuration is applied. To apply a taskbar configuration and allow users to make changes that will persist, apply your configuration by using Group Policy. -**Before you begin**: [Customize and export Start layout](customize-and-export-start-layout.md) +**Before you begin**: [Customize and export Start layout](customize-and-export-start-layout.md) for desktop editions or [create a Start layout XML](start-layout-xml-mobile.md) for mobile. ## How Start layout control works @@ -48,14 +49,12 @@ Three features enable Start and taskbar layout control: Use the [Imaging and Configuration Designer (ICD) tool](https://go.microsoft.com/fwlink/p/?LinkID=525483) included in the Windows Assessment and Deployment Kit (ADK) for Windows 10 to create a provisioning package that applies a customized Start and taskbar layout. [Install the ADK.](https://developer.microsoft.com/windows/hardware/windows-assessment-deployment-kit) -> **Important** -When you build a provisioning package, you may include sensitive information in the project files and in the provisioning package (.ppkg) file. Although you have the option to encrypt the .ppkg file, project files are not encrypted. You should store the project files in a secure location and delete the project files when they are no longer needed. +>[!IMPORTANT] +>When you build a provisioning package, you may include sensitive information in the project files and in the provisioning package (.ppkg) file. Although you have the option to encrypt the .ppkg file, project files are not encrypted. You should store the project files in a secure location and delete the project files when they are no longer needed. 1. Open ICD (by default, %systemdrive%\\Program Files (x86)\\Windows Kits\\10\\Assessment and Deployment Kit\\Imaging and Configuration Designer\\x86\\ICD.exe). 2. Choose **Advanced provisioning**. - - 3. Name your project, and click **Next**. 4. Choose **All Windows desktop editions** and click **Next**. From 8533fa6bac53f91df75629c12787009f6c9ea471 Mon Sep 17 00:00:00 2001 From: rikot Date: Wed, 1 Feb 2017 11:17:57 -0500 Subject: [PATCH 53/87] Update manage-windows-updates-for-surface-hub.md --- .../manage-windows-updates-for-surface-hub.md | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) diff --git a/devices/surface-hub/manage-windows-updates-for-surface-hub.md b/devices/surface-hub/manage-windows-updates-for-surface-hub.md index 40fdda11b1..35787fbff1 100644 --- a/devices/surface-hub/manage-windows-updates-for-surface-hub.md +++ b/devices/surface-hub/manage-windows-updates-for-surface-hub.md @@ -57,6 +57,7 @@ Surface Hubs, like all Windows 10 devices, include **Windows Update for Business 2. [Configure when Surface Hub receives updates](#configure-when-surface-hub-receives-updates). > [!NOTE] + > You can use Microsoft Intune, System Center Configuration Manager, or a supported third-party MDM provider to set up WUfB. [Walkthrough: use Microsoft Intune to configure Windows Update for Business.](https://technet.microsoft.com/en-us/itpro/windows/manage/waas-wufb-intune) @@ -75,7 +76,7 @@ This table gives examples of deployment rings. ### Configure Surface Hub to use Current Branch or Current Branch for Business By default, Surface Hubs are configured to receive updates from Current Branch (CB). CB receives feature updates as soon as they are released by Microsoft. Current Branch for Business (CBB), on the other hand, receives feature updates at least four months after they have been initially offered to CB devices, and includes all of the quality updates that have been released in the interim. For more information on the differences between CB and CBB, see [Servicing branches](https://technet.microsoft.com/en-us/itpro/windows/manage/waas-overview#servicing-branches). - +* **To manually configure Surface Hub to use CB or CBB:** 1. Open **Settings** > **Update & Security** > **Windows Update**, and then select **Advanced Options**. 2. Select **Defer feature updates**. @@ -104,6 +105,13 @@ You can connect Surface Hub to your Windows Server Update Services (WSUS) server To connect Surface Hub to a WSUS server using MDM, set an appropriate [Update/UpdateServiceUrl](https://msdn.microsoft.com/en-us/library/windows/hardware/dn904962.aspx#Update_UpdateServiceUrl) policy. +**If you use a proxy server or other method to block URLs** +If you use a method other than WSUS to block specific URLs and prevent updates, you will need to add the following Windows update trusted site URLs to the “allow list”: +- http(s)://*.update.microsoft.com +- http://download.windowsupdate.com +- http://windowsupdate.microsoft.com + +Once the Windows 10 Team Anniversary Update is installed, you can remove these addresses to return your Surface Hub to its previous state. ## Maintenance window From c5f1b8f1349357f9951031d59a90a5271121ad1a Mon Sep 17 00:00:00 2001 From: Jan Backstrom Date: Wed, 1 Feb 2017 11:23:04 -0800 Subject: [PATCH 54/87] Add reset package note at end of article --- ...-configuration-manager-to-manage-devices-with-semm.md | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/devices/surface/use-system-center-configuration-manager-to-manage-devices-with-semm.md b/devices/surface/use-system-center-configuration-manager-to-manage-devices-with-semm.md index f44e7cf414..5e81cad6ce 100644 --- a/devices/surface/use-system-center-configuration-manager-to-manage-devices-with-semm.md +++ b/devices/surface/use-system-center-configuration-manager-to-manage-devices-with-semm.md @@ -413,3 +413,12 @@ When you deploy SEMM using this script application and with a configuration that Alternatively, you can configure the application installation to reboot automatically and to install invisibly to the user – in this scenario, a technician will be required to enter the thumbprint on each device as it reboots. Any technician with access to the certificate file can read the thumbprint by viewing the certificate with CertMgr. Instructions for viewing the thumbprint with CertMgr are in the [Create or modify the SEMM Configuration Manager scripts](#create-or-modify-the-semm-configuration-manager-scripts) section of this article. Removal of SEMM from a device deployed with Configuration Manager using these scripts is as easy as uninstalling the application with Configuration Manager. This action starts the ResetSEMM.ps1 script and properly unenrolls the device with the same certificate file that was used during the deployment of SEMM. + +>[!NOTE] +>Microsoft Surface recommends that you create reset packages only when you need to unenroll a device. These reset packages are typically valid for only one device, identified by its serial number. You can, however, create a universal reset package that would work for any device enrolled in SEMM with this certificate. + +>We strongly recommend that you protect your universal reset package as carefully as the certificate you used to enroll devices in SEMM. Please remember that – just like the certificate itself – this universal reset package can be used to unenroll any of your organization’s Surface devices from SEMM. + +>When you install a reset package, the Lowest Supported Value (LSV) is reset to a value of 1. You can reenroll a device by using an existing configuration package – the device will prompt for the certificate thumbprint before ownership is taken. + +>For this reason, the reenrollment of a device in SEMM would require a new package to be created and installed on that device. Because this action is a new enrollment and not a change in configuration on a device already enrolled in SEMM, the device will prompt for the certificate thumbprint before ownership is taken. \ No newline at end of file From 7d334d6e75858fa06a0bf3d51c1920a7e91f0ce8 Mon Sep 17 00:00:00 2001 From: jdeckerMS Date: Wed, 1 Feb 2017 12:57:04 -0800 Subject: [PATCH 55/87] set up 1703 what's new --- windows/whats-new/TOC.md | 1 + windows/whats-new/index.md | 3 ++- ...ts-new-windows-10-version-1507-and-1511.md | 4 +++- .../whats-new-windows-10-version-1607.md | 4 +++- .../whats-new-windows-10-version-1703.md | 23 +++++++++++++++++++ 5 files changed, 32 insertions(+), 3 deletions(-) create mode 100644 windows/whats-new/whats-new-windows-10-version-1703.md diff --git a/windows/whats-new/TOC.md b/windows/whats-new/TOC.md index c672a255a8..4944339989 100644 --- a/windows/whats-new/TOC.md +++ b/windows/whats-new/TOC.md @@ -1,4 +1,5 @@ # [What's new in Windows 10](index.md) +## [What's new in Windows 10, version 1703](whats-new-windows-10-version-1703.md) ## [What's new in Windows 10, version 1607](whats-new-windows-10-version-1607.md) ## [What's new in Windows 10, versions 1507 and 1511](whats-new-windows-10-version-1507-and-1511.md) diff --git a/windows/whats-new/index.md b/windows/whats-new/index.md index ff170bce3b..b64a85a590 100644 --- a/windows/whats-new/index.md +++ b/windows/whats-new/index.md @@ -1,6 +1,6 @@ --- title: What's new in Windows 10 (Windows 10) -description: Learn about new features in Windows 10 for IT professionals, such as Enterprise Data Protection, Microsoft Passport, Device Guard, and more. +description: Learn about new features in Windows 10 for IT professionals, such as Enterprise Data Protection, Windows Hello, Device Guard, and more. ms.assetid: F1867017-76A1-4761-A200-7450B96AEF44 keywords: ["What's new in Windows 10", "Windows 10", "anniversary update", "contribute", "edit topic"] ms.prod: w10 @@ -15,6 +15,7 @@ Windows 10 provides IT professionals with advanced protection against modern sec ## In this section +- [What's new in Windows 10, version 1703](whats-new-windows-10-version-1703.md) - [What's new in Windows 10, version 1607](whats-new-windows-10-version-1607.md) - [What's new in Windows 10, versions 1507 and 1511](whats-new-windows-10-version-1507-and-1511.md) diff --git a/windows/whats-new/whats-new-windows-10-version-1507-and-1511.md b/windows/whats-new/whats-new-windows-10-version-1507-and-1511.md index 92c077d28e..6121188e6d 100644 --- a/windows/whats-new/whats-new-windows-10-version-1507-and-1511.md +++ b/windows/whats-new/whats-new-windows-10-version-1507-and-1511.md @@ -13,7 +13,9 @@ localizationpriority: high Below is a list of some of the new and updated features included in the initial release of Windows 10 (version 1507) and the Windows 10 update to version 1511. -> **Note:** For release dates and servicing options for each version, see [Windows 10 release information](https://technet.microsoft.com/en-us/windows/release-info). +>[!NOTE] +>For release dates and servicing options for each version, see [Windows 10 release information](https://technet.microsoft.com/en-us/windows/release-info). +  ## Deployment diff --git a/windows/whats-new/whats-new-windows-10-version-1607.md b/windows/whats-new/whats-new-windows-10-version-1607.md index 2a85e07f4d..1c6c94f739 100644 --- a/windows/whats-new/whats-new-windows-10-version-1607.md +++ b/windows/whats-new/whats-new-windows-10-version-1607.md @@ -14,7 +14,9 @@ localizationpriority: high Below is a list of some of the new and updated features in Windows 10, version 1607 (also known as the Anniversary Update). -> **Note:** For release dates and servicing options for each version, see [Windows 10 release information](https://technet.microsoft.com/en-us/windows/release-info). +>[!NOTE] +>For release dates and servicing options for each version, see [Windows 10 release information](https://technet.microsoft.com/en-us/windows/release-info). +    ## Deployment diff --git a/windows/whats-new/whats-new-windows-10-version-1703.md b/windows/whats-new/whats-new-windows-10-version-1703.md new file mode 100644 index 0000000000..3d06a1b80a --- /dev/null +++ b/windows/whats-new/whats-new-windows-10-version-1703.md @@ -0,0 +1,23 @@ +--- +title: What's new in Windows 10, version 1607 (Windows 10) +description: This topic lists new and updated topics in the What's new in Windows 10 documentation for Windows 10 and Windows 10 Mobile. +keywords: ["What's new in Windows 10", "Windows 10", "creators update"] +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +author: TrudyHa +localizationpriority: high +--- + +# What's new in Windows 10, version 1703 + +Below is a list of some of the new and updated features in Windows 10, version 1703 (also known as the Creators Update). + +>[!NOTE] +>For release dates and servicing options for each version, see [Windows 10 release information](https://technet.microsoft.com/en-us/windows/release-info). +  + + +## Learn more + +- [Windows 10 release information](https://technet.microsoft.com/en-us/windows/release-info) From c14355694243578c6aa74a7cc1f5b748c42df2e9 Mon Sep 17 00:00:00 2001 From: Justin Hall Date: Wed, 1 Feb 2017 14:12:08 -0800 Subject: [PATCH 56/87] Update credential-guard.md --- windows/keep-secure/credential-guard.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/keep-secure/credential-guard.md b/windows/keep-secure/credential-guard.md index 9ce9b9cbaa..8e9f872d0d 100644 --- a/windows/keep-secure/credential-guard.md +++ b/windows/keep-secure/credential-guard.md @@ -15,7 +15,7 @@ author: brianlic-msft - Windows 10 - Windows Server 2016 -Introduced in Windows 10 Enterprise and Windows Server 2016, Credential Guard uses virtualization-based security to isolate secrets so that only privileged system software can access them. Unauthorized access to these secrets can lead to credential theft attacks, such as Pass-the-Hash or Pass-The-Ticket. Credential Guard prevents these attacks by protecting NTLM password hashes, Kerberos Ticket Granting Tickets & credentials stored by applications as domain credentials. +Introduced in Windows 10 Enterprise and Windows Server 2016, Credential Guard uses virtualization-based security to isolate secrets so that only privileged system software can access them. Unauthorized access to these secrets can lead to credential theft attacks, such as Pass-the-Hash or Pass-The-Ticket. Credential Guard prevents these attacks by protecting NTLM password hashes, Kerberos Ticket Granting Tickets, and credentials stored by applications as domain credentials. By enabling Credential Guard the following features and solutions are provided: From a434950159b77a227e381776dce8332c73f26678 Mon Sep 17 00:00:00 2001 From: Justin Hall Date: Wed, 1 Feb 2017 14:12:58 -0800 Subject: [PATCH 57/87] Update credential-guard.md --- windows/keep-secure/credential-guard.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/keep-secure/credential-guard.md b/windows/keep-secure/credential-guard.md index 8e9f872d0d..6b213c523b 100644 --- a/windows/keep-secure/credential-guard.md +++ b/windows/keep-secure/credential-guard.md @@ -1,4 +1,4 @@ ---- +,--- title: Protect derived domain credentials with Credential Guard (Windows 10) description: Introduced in Windows 10 Enterprise, Credential Guard uses virtualization-based security to isolate secrets so that only privileged system software can access them. ms.assetid: 4F1FE390-A166-4A24-8530-EA3369FEB4B1 @@ -17,7 +17,7 @@ author: brianlic-msft Introduced in Windows 10 Enterprise and Windows Server 2016, Credential Guard uses virtualization-based security to isolate secrets so that only privileged system software can access them. Unauthorized access to these secrets can lead to credential theft attacks, such as Pass-the-Hash or Pass-The-Ticket. Credential Guard prevents these attacks by protecting NTLM password hashes, Kerberos Ticket Granting Tickets, and credentials stored by applications as domain credentials. -By enabling Credential Guard the following features and solutions are provided: +By enabling Credential Guard, the following features and solutions are provided: - **Hardware security** NTLM, Kerberos and Credential Manager take advantage of platform security features including, Secure Boot and virtualization to protect credentials. - **Virtualization-based security** Windows NTLM and Kerberos derived credentials and other secrets run in a protected environment that is isolated from the running operating system. From 187186da696b467c09899dcabd0c2ac442bc3cca Mon Sep 17 00:00:00 2001 From: Justin Hall Date: Wed, 1 Feb 2017 14:16:01 -0800 Subject: [PATCH 58/87] Update credential-guard.md --- windows/keep-secure/credential-guard.md | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/windows/keep-secure/credential-guard.md b/windows/keep-secure/credential-guard.md index 6b213c523b..62de1f7545 100644 --- a/windows/keep-secure/credential-guard.md +++ b/windows/keep-secure/credential-guard.md @@ -1,4 +1,4 @@ -,--- +,,--- title: Protect derived domain credentials with Credential Guard (Windows 10) description: Introduced in Windows 10 Enterprise, Credential Guard uses virtualization-based security to isolate secrets so that only privileged system software can access them. ms.assetid: 4F1FE390-A166-4A24-8530-EA3369FEB4B1 @@ -19,13 +19,13 @@ Introduced in Windows 10 Enterprise and Windows Server 2016, Credential Guard u By enabling Credential Guard, the following features and solutions are provided: -- **Hardware security** NTLM, Kerberos and Credential Manager take advantage of platform security features including, Secure Boot and virtualization to protect credentials. +- **Hardware security** NTLM, Kerberos, and Credential Manager take advantage of platform security features, including Secure Boot and virtualization, to protect credentials. - **Virtualization-based security** Windows NTLM and Kerberos derived credentials and other secrets run in a protected environment that is isolated from the running operating system. -- **Better protection against advanced persistent threats** When Credential Manager domain credentials, NTLM and Kerberos derived credentials are protected using virtualization-based security, the credential theft attack techniques and tools used in many targeted attacks are blocked. Malware running in the operating system with administrative privileges cannot extract secrets that are protected by virtualization-based security. While Credential Guard is a powerful mitigation, persistent threat attacks will likely shift to new attack techniques and you should also incorporate Device Guard and other security strategies and architectures. +- **Better protection against advanced persistent threats** When Credential Manager domain credentials, NTLM, and Kerberos derived credentials are protected using virtualization-based security, the credential theft attack techniques and tools used in many targeted attacks are blocked. Malware running in the operating system with administrative privileges cannot extract secrets that are protected by virtualization-based security. While Credential Guard is a powerful mitigation, persistent threat attacks will likely shift to new attack techniques and you should also incorporate Device Guard and other security strategies and architectures. ## How it works -Kerberos, NTLM and Credential manager isolates secrets that previous versions of Windows stored in the Local Security Authority (LSA) by using virtualization-based security. Prior to Windows 10, the LSA stored secrets used by the operating system in its process memory. With Credential Guard enabled, the LSA process in the operating system talks to a new component called the isolated LSA process that stores and protects those secrets. Data stored by the isolated LSA process is protected using virtualization-based security and is not accessible to the rest of the operating system. LSA uses remote procedure calls to communicate with the isolated LSA process. +Kerberos, NTLM, and Credential manager isolate secrets that previous versions of Windows stored in the Local Security Authority (LSA) by using virtualization-based security. Prior to Windows 10, the LSA stored secrets used by the operating system in its process memory. With Credential Guard enabled, the LSA process in the operating system talks to a new component called the isolated LSA process that stores and protects those secrets. Data stored by the isolated LSA process is protected using virtualization-based security and is not accessible to the rest of the operating system. LSA uses remote procedure calls to communicate with the isolated LSA process. For security reasons, the isolated LSA process doesn't host any device drivers. Instead, it only hosts a small subset of operating system binaries that are needed for security and nothing else. All of these binaries are signed with a certificate that is trusted by virtualization-based security and these signatures are validated before launching the file in the protected environment. From 5bea22adff182a0bd2eb03023e07ca3ebb21e72c Mon Sep 17 00:00:00 2001 From: Justin Hall Date: Wed, 1 Feb 2017 14:20:06 -0800 Subject: [PATCH 59/87] Update credential-guard.md --- windows/keep-secure/credential-guard.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/windows/keep-secure/credential-guard.md b/windows/keep-secure/credential-guard.md index 62de1f7545..46faf54f4b 100644 --- a/windows/keep-secure/credential-guard.md +++ b/windows/keep-secure/credential-guard.md @@ -1,4 +1,4 @@ -,,--- +s,,--- title: Protect derived domain credentials with Credential Guard (Windows 10) description: Introduced in Windows 10 Enterprise, Credential Guard uses virtualization-based security to isolate secrets so that only privileged system software can access them. ms.assetid: 4F1FE390-A166-4A24-8530-EA3369FEB4B1 @@ -29,9 +29,9 @@ Kerberos, NTLM, and Credential manager isolate secrets that previous versions of For security reasons, the isolated LSA process doesn't host any device drivers. Instead, it only hosts a small subset of operating system binaries that are needed for security and nothing else. All of these binaries are signed with a certificate that is trusted by virtualization-based security and these signatures are validated before launching the file in the protected environment. -When Credential Guard is enabled, NTLMv1, MS-CHAPv2, Digest, and CredSSP cannot use the signed in credentials. Thus, single sign-on does not work with these protocols. However, applications can prompt for credentials or use credentials stored in the Windows Vault which are not protected by Credential Guard with any of these protocol. It is strongly recommended that valuable credentials, such as the sign-in credentials, not be used with any of these protocols. If these protocols must be used by domain or AAD users, secondary credentials should be provisioned for these use cases. +When Credential Guard is enabled, NTLMv1, MS-CHAPv2, Digest, and CredSSP cannot use the signed-in credentials. Thus, single sign-on does not work with these protocols. However, applications can prompt for credentials or use credentials stored in the Windows Vault which are not protected by Credential Guard with any of these protocol. It is strongly recommended that valuable credentials, such as the sign-in credentials, not be used with any of these protocols. If these protocols must be used by domain or Azure AD users, secondary credentials should be provisioned for these use cases. -When Credential Guard is enabled, Kerberos does not allow unconstrained Kerberos delegation or DES encryption not only for signed-in credentials, but also prompted or saved credentials either. +When Credential Guard is enabled, Kerberos does not allow unconstrained Kerberos delegation or DES encryption, not only for signed-in credentials, but also prompted or saved credentials. Here's a high-level overview on how the LSA is isolated by using virtualization-based security: From 617ac9f95c57f4b3cb2a5876a10e6edfa3ad9331 Mon Sep 17 00:00:00 2001 From: Justin Hall Date: Wed, 1 Feb 2017 14:28:34 -0800 Subject: [PATCH 60/87] Update credential-guard.md --- windows/keep-secure/credential-guard.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/keep-secure/credential-guard.md b/windows/keep-secure/credential-guard.md index 46faf54f4b..05e8cf4958 100644 --- a/windows/keep-secure/credential-guard.md +++ b/windows/keep-secure/credential-guard.md @@ -1,4 +1,4 @@ -s,,--- +[s,,--- title: Protect derived domain credentials with Credential Guard (Windows 10) description: Introduced in Windows 10 Enterprise, Credential Guard uses virtualization-based security to isolate secrets so that only privileged system software can access them. ms.assetid: 4F1FE390-A166-4A24-8530-EA3369FEB4B1 @@ -39,7 +39,7 @@ Here's a high-level overview on how the LSA is isolated by using virtualization- ## Requirements -For Credential Guard to provide protections, the computers you are protecting must meet certain baseline hardware, firmware, and software requirements which we will refer to as "Hardware and software requirements". Additionally Credential Guard blocks specific authentication capabilities, so applications which require blocked capabilities will break. We will refer to this as "Application requirements". Beyond that, computers can meet additional hardware and firmware requirements, and receive additional protection—those computers will be more hardened against certain threats. To keep this section brief, those will be in Security Considerations. +For Credential Guard to provide protections, the computers you are protecting must meet certain baseline hardware, firmware, and software requirements which we will refer to as [Hardware and software requirements](#hardware-and-software-requirements). Additionally Credential Guard blocks specific authentication capabilities, so applications which require blocked capabilities will break. We will refer to this as [Application requirements](#application-requirements). Beyond that, computers can meet additional hardware and firmware requirements, and receive additional protection—those computers will be more hardened against certain threats. To keep this section brief, those will be in [Security Considerations](#security-considerations). ### Hardware and software requirements From 39e194229e9baa926617b1c703163eee87664f5c Mon Sep 17 00:00:00 2001 From: Dani Halfin Date: Wed, 1 Feb 2017 14:49:46 -0800 Subject: [PATCH 61/87] Waas-configure-wufb - fixed reg values DeferQualityUpdatesPeriod \ DeferFeatureUpdatesPeriod + inDays to both notified of issue by B Dolan --- windows/manage/waas-configure-wufb.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/manage/waas-configure-wufb.md b/windows/manage/waas-configure-wufb.md index 9626d2e24f..fcb36d20f6 100644 --- a/windows/manage/waas-configure-wufb.md +++ b/windows/manage/waas-configure-wufb.md @@ -182,9 +182,9 @@ Below are quick-reference tables of the supported Windows Update for Business po | MDM Key | Key type | Value | | --- | --- | --- | | BranchReadinessLevel | REG_DWORD | 16: systems take Feature Updates for the Current Branch (CB)
32: systems take Feature Updates for the Current Branch for Business (CBB)
Note: Other value or absent: receive all applicable updates (CB) | -| DeferQualityUpdatesPeriod | REG_DWORD | 0-30: defer quality updates by given days | +| DeferQualityUpdatesPeriodinDays | REG_DWORD | 0-30: defer quality updates by given days | | PauseQualityUpdates | REG_DWORD | 1: pause quality updates
Other value or absent: don’t pause quality updates | -| DeferFeatureUpdatesPeriod | REG_DWORD | 0-180: defer feature updates by given days | +| DeferFeatureUpdatesPeriodinDays | REG_DWORD | 0-180: defer feature updates by given days | | PauseFeatureUpdates | REG_DWORD | 1: pause feature updates
Other value or absent: don’t pause feature updates | | ExcludeWUDriversinQualityUpdate | REG_DWORD | 1: exclude Windows Update drivers
Other value or absent: offer Windows Update drivers | From c44f69aa8eaf3601e79c361e6467ec8a126fd33e Mon Sep 17 00:00:00 2001 From: Justin Hall Date: Wed, 1 Feb 2017 14:57:15 -0800 Subject: [PATCH 62/87] Update credential-guard.md --- windows/keep-secure/credential-guard.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/windows/keep-secure/credential-guard.md b/windows/keep-secure/credential-guard.md index 05e8cf4958..83458e51f1 100644 --- a/windows/keep-secure/credential-guard.md +++ b/windows/keep-secure/credential-guard.md @@ -19,7 +19,7 @@ Introduced in Windows 10 Enterprise and Windows Server 2016, Credential Guard u By enabling Credential Guard, the following features and solutions are provided: -- **Hardware security** NTLM, Kerberos, and Credential Manager take advantage of platform security features, including Secure Boot and virtualization, to protect credentials. + **Hardware security** NTLM, Kerberos, and Credential Manager take advantage of platform security features, including Secure Boot and virtualization, to protect credentials. - **Virtualization-based security** Windows NTLM and Kerberos derived credentials and other secrets run in a protected environment that is isolated from the running operating system. - **Better protection against advanced persistent threats** When Credential Manager domain credentials, NTLM, and Kerberos derived credentials are protected using virtualization-based security, the credential theft attack techniques and tools used in many targeted attacks are blocked. Malware running in the operating system with administrative privileges cannot extract secrets that are protected by virtualization-based security. While Credential Guard is a powerful mitigation, persistent threat attacks will likely shift to new attack techniques and you should also incorporate Device Guard and other security strategies and architectures. @@ -60,7 +60,7 @@ The Virtualization-based security requires: When Credential Guard is enabled, specific authentication capabilities are blocked, so applications which require blocked capabilities will break. Applications should be tested prior to deployment to ensure compatiblity with the reduced functionality. >[!WARNING] -> Enabling Credential Guard on Domain Controllers is not supported
+> Enabling Credential Guard on domain controllers is not supported
> The domain controller hosts authentication services which integrate with processes isolated when Credential Guard is enabled causing crashes. >[!NOTE] @@ -100,7 +100,7 @@ The following tables provide more information about the hardware, firmware, and | Software: Qualified **Windows operating system** | **Requirement**: Windows 10 Enterprise, Windows 10 Education, Windows 2016 Server, or Windows Enterprise IoT

Important:
Windows Server 2016 running as a domain controller does not support Credential Guard. Only Device Guard is supported in this configuration.


**Security benefits**: Support for VBS and for management features that simplify configuration of Credential Guard. | > [!IMPORTANT] -> The preceding table lists requirements for baseline protections. The following tables list requirements for improved security. You can use Credential Guard with hardware, firmware, and software that support baseline protections, even if they do not support protections for improved security. However, we strongly recommend meeting the requirements for improved security, to significantly strengthen the level of security that Credential Guard can provide. +> The preceding table lists requirements for baseline protections. The following tables list requirements for improved security. You can use Credential Guard with hardware, firmware, and software that support baseline protections, even if they do not support protections for improved security. However, we strongly recommend meeting the requirements for improved security to significantly strengthen the level of security that Credential Guard can provide. #### 2015 Additional Security Recommendations (starting with Windows 10, version 1507, and Windows Server 2016, Technical Preview 4) From fd00479513e7d2ad9e033e346f015d7e5f57fd12 Mon Sep 17 00:00:00 2001 From: Justin Hall Date: Wed, 1 Feb 2017 15:00:29 -0800 Subject: [PATCH 63/87] Update credential-guard.md --- windows/keep-secure/credential-guard.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/keep-secure/credential-guard.md b/windows/keep-secure/credential-guard.md index 83458e51f1..37f0fd9b7f 100644 --- a/windows/keep-secure/credential-guard.md +++ b/windows/keep-secure/credential-guard.md @@ -21,7 +21,7 @@ By enabling Credential Guard, the following features and solutions are provided: **Hardware security** NTLM, Kerberos, and Credential Manager take advantage of platform security features, including Secure Boot and virtualization, to protect credentials. - **Virtualization-based security** Windows NTLM and Kerberos derived credentials and other secrets run in a protected environment that is isolated from the running operating system. -- **Better protection against advanced persistent threats** When Credential Manager domain credentials, NTLM, and Kerberos derived credentials are protected using virtualization-based security, the credential theft attack techniques and tools used in many targeted attacks are blocked. Malware running in the operating system with administrative privileges cannot extract secrets that are protected by virtualization-based security. While Credential Guard is a powerful mitigation, persistent threat attacks will likely shift to new attack techniques and you should also incorporate Device Guard and other security strategies and architectures. +,- **Better protection against advanced persistent threats** When Credential Manager domain credentials, NTLM, and Kerberos derived credentials are protected using virtualization-based security, the credential theft attack techniques and tools used in many targeted attacks are blocked. Malware running in the operating system with administrative privileges cannot extract secrets that are protected by virtualization-based security. While Credential Guard is a powerful mitigation, persistent threat attacks will likely shift to new attack techniques and you should also incorporate Device Guard and other security strategies and architectures. ## How it works @@ -61,7 +61,7 @@ When Credential Guard is enabled, specific authentication capabilities are block >[!WARNING] > Enabling Credential Guard on domain controllers is not supported
-> The domain controller hosts authentication services which integrate with processes isolated when Credential Guard is enabled causing crashes. +> The domain controller hosts authentication services which integrate with processes isolated when Credential Guard is enabled, causing crashes. >[!NOTE] > Credential Guard does not provide protections for the Active Directory database or the Security Accounts Manager (SAM). The credentials protected by Kerberos and NTLM when Credential Guard is enabled are also in the Active Directory database (on domain controllers) and the SAM (for local accounts). From 0161a423f34d67c4e9f744c81377671ae3434a17 Mon Sep 17 00:00:00 2001 From: Justinha Date: Wed, 1 Feb 2017 15:40:37 -0800 Subject: [PATCH 64/87] removed credential delegation from remote desktop table heading --- windows/keep-secure/remote-credential-guard.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/keep-secure/remote-credential-guard.md b/windows/keep-secure/remote-credential-guard.md index a8f2f46557..0ae8111073 100644 --- a/windows/keep-secure/remote-credential-guard.md +++ b/windows/keep-secure/remote-credential-guard.md @@ -34,7 +34,7 @@ Use the following table to compare different security options for Remote Desktop > [!NOTE] > This table compares different options than are shown in the previous diagram. -| Remote Desktop with Credential Delegation | Remote Credential Guard | Restricted Admin mode | +| Remote Desktop | Remote Credential Guard | Restricted Admin mode | |---|---|---| | Protection: Provides **less protection** than other modes in this table. | Protection: Provides **moderate protection**, compared to other modes in this table. | Protection: Provides **the most protection** of the modes in this table. However, it also requires you to be in the local “Administrators” group on the remote computer. | | Version support: The remote computer can be running **any operating system that supports credential delegation**, which was introduced in Windows Vista. | Version support: The remote computer must be running **at least Windows 10, version 1607, or Windows Server 2016**. | Version support: The remote computer must be running **at least patched Windows 7 or patched Windows Server 2008 R2**.

For more information about patches (software updates) related to Restricted Admin mode, see [Microsoft Security Advisory 2871997](https://technet.microsoft.com/library/security/2871997.aspx). | From 6b319d25bacc26654418b846d7d700832efe9b3d Mon Sep 17 00:00:00 2001 From: Dani Halfin Date: Wed, 1 Feb 2017 17:36:28 -0800 Subject: [PATCH 65/87] Waas-servicing-branches - add section - remove WU --- .../manage/waas-servicing-branches-windows-10-updates.md | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/windows/manage/waas-servicing-branches-windows-10-updates.md b/windows/manage/waas-servicing-branches-windows-10-updates.md index f42352f643..b514878ffe 100644 --- a/windows/manage/waas-servicing-branches-windows-10-updates.md +++ b/windows/manage/waas-servicing-branches-windows-10-updates.md @@ -190,6 +190,13 @@ or [Manage Windows 10 updates using System Center Configuration Manager](waas-ma
App rule settingNetworking policy configuration for name-based policies, possibly using the /*AppCompat*/ string, or proxy-based policiesNetworking policy configuration for name-based policies, possibly using the /*AppCompat*/ string, or proxy-based policies
Not required. App connects to enterprise cloud resources, using an IP address or a hostname.
 Name-based policies, without the /*AppCompat**/ stringName-based policies, using the /*AppCompat**/ string or proxy-based policiesName-based policies, without the /*AppCompat*/ stringName-based policies, using the /*AppCompat*/ string or proxy-based policies
Not required. App connects to enterprise cloud resources directly, using an IP address.

+## Block user access to Windows Update Settings + +In Windows 10, administrators can control user access to Windows Update. +By enabling the Group Policy setting under **Computer Configuration\Administrative Templates\Windows Components\Windows update\Remove access to use all Windows update features**, administrators can disable the "Check for updates" option for users. Any background update scans, downloads and installations will continue to work as configured. + +>[!NOTE] +> In Windows 10, any Group Policy user configuration settings for Windows Update were deprecate and are no longer supported on this platform. ## Related topics From d2f76e58eba86de11ac894434bedfbc311842d01 Mon Sep 17 00:00:00 2001 From: Dani Halfin Date: Wed, 1 Feb 2017 17:47:51 -0800 Subject: [PATCH 66/87] fixed typo --- windows/manage/waas-servicing-branches-windows-10-updates.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/manage/waas-servicing-branches-windows-10-updates.md b/windows/manage/waas-servicing-branches-windows-10-updates.md index b514878ffe..bf763d2b49 100644 --- a/windows/manage/waas-servicing-branches-windows-10-updates.md +++ b/windows/manage/waas-servicing-branches-windows-10-updates.md @@ -190,7 +190,7 @@ or [Manage Windows 10 updates using System Center Configuration Manager](waas-ma
-## Block user access to Windows Update Settings +## Block user access to Windows Update settings In Windows 10, administrators can control user access to Windows Update. By enabling the Group Policy setting under **Computer Configuration\Administrative Templates\Windows Components\Windows update\Remove access to use all Windows update features**, administrators can disable the "Check for updates" option for users. Any background update scans, downloads and installations will continue to work as configured. From 97fa0782ba1244039f2b8aebca2888d5ee747de1 Mon Sep 17 00:00:00 2001 From: jdeckerMS Date: Thu, 2 Feb 2017 07:10:58 -0800 Subject: [PATCH 67/87] fix format --- devices/surface-hub/manage-windows-updates-for-surface-hub.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/devices/surface-hub/manage-windows-updates-for-surface-hub.md b/devices/surface-hub/manage-windows-updates-for-surface-hub.md index 35787fbff1..b2e70af5d6 100644 --- a/devices/surface-hub/manage-windows-updates-for-surface-hub.md +++ b/devices/surface-hub/manage-windows-updates-for-surface-hub.md @@ -107,7 +107,7 @@ To connect Surface Hub to a WSUS server using MDM, set an appropriate [Update/Up **If you use a proxy server or other method to block URLs** If you use a method other than WSUS to block specific URLs and prevent updates, you will need to add the following Windows update trusted site URLs to the “allow list”: -- http(s)://*.update.microsoft.com +- http(s)://\*.update.microsoft.com - http://download.windowsupdate.com - http://windowsupdate.microsoft.com From b7c16542943af08bed734aa473975147ebd37c60 Mon Sep 17 00:00:00 2001 From: jdeckerMS Date: Thu, 2 Feb 2017 07:27:21 -0800 Subject: [PATCH 68/87] URLs --- .../surface-hub/manage-windows-updates-for-surface-hub.md | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/devices/surface-hub/manage-windows-updates-for-surface-hub.md b/devices/surface-hub/manage-windows-updates-for-surface-hub.md index b2e70af5d6..d4cb3d614d 100644 --- a/devices/surface-hub/manage-windows-updates-for-surface-hub.md +++ b/devices/surface-hub/manage-windows-updates-for-surface-hub.md @@ -76,7 +76,7 @@ This table gives examples of deployment rings. ### Configure Surface Hub to use Current Branch or Current Branch for Business By default, Surface Hubs are configured to receive updates from Current Branch (CB). CB receives feature updates as soon as they are released by Microsoft. Current Branch for Business (CBB), on the other hand, receives feature updates at least four months after they have been initially offered to CB devices, and includes all of the quality updates that have been released in the interim. For more information on the differences between CB and CBB, see [Servicing branches](https://technet.microsoft.com/en-us/itpro/windows/manage/waas-overview#servicing-branches). -* + **To manually configure Surface Hub to use CB or CBB:** 1. Open **Settings** > **Update & Security** > **Windows Update**, and then select **Advanced Options**. 2. Select **Defer feature updates**. @@ -107,9 +107,9 @@ To connect Surface Hub to a WSUS server using MDM, set an appropriate [Update/Up **If you use a proxy server or other method to block URLs** If you use a method other than WSUS to block specific URLs and prevent updates, you will need to add the following Windows update trusted site URLs to the “allow list”: -- http(s)://\*.update.microsoft.com -- http://download.windowsupdate.com -- http://windowsupdate.microsoft.com +- `http(s)://\*.update.microsoft.com` +- `http://download.windowsupdate.com` +- `http://windowsupdate.microsoft.com` Once the Windows 10 Team Anniversary Update is installed, you can remove these addresses to return your Surface Hub to its previous state. From fd50e41f55a45efa4c934090a680d920b6defe30 Mon Sep 17 00:00:00 2001 From: jdeckerMS Date: Thu, 2 Feb 2017 08:00:34 -0800 Subject: [PATCH 69/87] format --- devices/surface-hub/manage-windows-updates-for-surface-hub.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/devices/surface-hub/manage-windows-updates-for-surface-hub.md b/devices/surface-hub/manage-windows-updates-for-surface-hub.md index d4cb3d614d..1a5e22a17e 100644 --- a/devices/surface-hub/manage-windows-updates-for-surface-hub.md +++ b/devices/surface-hub/manage-windows-updates-for-surface-hub.md @@ -107,7 +107,7 @@ To connect Surface Hub to a WSUS server using MDM, set an appropriate [Update/Up **If you use a proxy server or other method to block URLs** If you use a method other than WSUS to block specific URLs and prevent updates, you will need to add the following Windows update trusted site URLs to the “allow list”: -- `http(s)://\*.update.microsoft.com` +- `http(s)://*.update.microsoft.com` - `http://download.windowsupdate.com` - `http://windowsupdate.microsoft.com` From 7e988cb680e3ff469bc2250899b21b22c05b6e46 Mon Sep 17 00:00:00 2001 From: Dani Halfin Date: Thu, 2 Feb 2017 10:01:20 -0800 Subject: [PATCH 70/87] waas-DO - fixed after PM review --- windows/manage/waas-delivery-optimization.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/windows/manage/waas-delivery-optimization.md b/windows/manage/waas-delivery-optimization.md index 243665903d..b1701d80d9 100644 --- a/windows/manage/waas-delivery-optimization.md +++ b/windows/manage/waas-delivery-optimization.md @@ -19,7 +19,7 @@ localizationpriority: high Delivery Optimization is a self-organizing distributed cache solution for businesses looking to reduce bandwidth consumption for operating system updates, operating system upgrades, and applications by allowing clients to download those elements from alternate sources (such as other peers on the network) in addition to the traditional Internet-based Windows Update servers. You can use Delivery Optimization in conjunction with stand-alone Windows Update, Windows Server Update Services (WSUS), and Windows Update for Business. This functionality is similar to BranchCache in other systems, such as System Center Configuration Manager. -Delivery Optimization is a cloud managed solution. Having access to the Delivery Optimization cloud services, is a requirement for it to be enabled. This mean that in order to utilize Delivery Optimization, machines need to have access to the internet. +Delivery Optimization is a cloud managed solution. Having access to the Delivery Optimization cloud services, is a requirement for it to be enabled. This mean that in order to utilize the peer-to-peer functionality of Delivery Optimization, machines need to have access to the internet. For more details, see [Download mode](#download-mode). @@ -45,11 +45,11 @@ Download mode dictates which download sources clients are allowed to use when do | Download mode option | Functionality when set | | --- | --- | -| HTTP Only (0) | This setting disables peer content sharing but still allows Delivery Optimization to download content from Windows Update servers or WSUS servers. This mode uses metadata provided by the Delivery Optimization cloud services for a more consistent plain download experience. | +| HTTP Only (0) | This setting disables peer-to-peer caching but still allows Delivery Optimization to download content from Windows Update servers or WSUS servers. This mode uses additional metadata provided by the Delivery Optimization cloud services for a peerless reliable and efficient download experience. | | LAN (1 – Default) | This default operating mode for Delivery Optimization enables peer sharing on the same network. | | Group (2) | When group mode is set, the group is automatically selected based on the device’s Active Directory Domain Services (AD DS) site (Windows 10, version 1607) or the domain the device is authenticated to (Windows 10, version 1511). In group mode, peering occurs across internal subnets, between devices that belong to the same group, including devices in remote offices. You can use the GroupID option to create your own custom group independently of domains and AD DS sites. Group download mode is the recommended option for most organizations looking to achieve the best bandwidth optimization with Delivery Optimization. | | Internet (3) | Enable Internet peer sources for Delivery Optimization. | -| Simple (99) | Simple mode disables the use of Delivery Optimization cloud services completely (for offline environments). Delivery Optimization switches to this mode automatically when the Delivery Optimization cloud services are unavailable or unreachable. In this mode, Delivery Optimization provides a modern download manager experience, with little optimization and no peer content sharing. | +| Simple (99) | Simple mode disables the use of Delivery Optimization cloud services completely (for offline environments). Delivery Optimization switches to this mode automatically when the Delivery Optimization cloud services are unavailable, unreachable or when the content file size is less than 10 MB. In this mode, Delivery Optimization provides a reliable download experience, with no peer-to-peer caching. | |Bypass (100) | Bypass Delivery Optimization and use BITS, instead. For example, select this mode so that clients can use BranchCache. | >[!NOTE] From d23d739707acef1a9756c3a78ecb1a13a48d0e92 Mon Sep 17 00:00:00 2001 From: Dani Halfin Date: Thu, 2 Feb 2017 10:15:48 -0800 Subject: [PATCH 71/87] fixed type and added change of WaaS-branches to CH --- .../change-history-for-manage-and-update-windows-10.md | 8 ++++++-- .../manage/waas-servicing-branches-windows-10-updates.md | 2 +- 2 files changed, 7 insertions(+), 3 deletions(-) diff --git a/windows/manage/change-history-for-manage-and-update-windows-10.md b/windows/manage/change-history-for-manage-and-update-windows-10.md index a794ec798f..837fac6dda 100644 --- a/windows/manage/change-history-for-manage-and-update-windows-10.md +++ b/windows/manage/change-history-for-manage-and-update-windows-10.md @@ -14,6 +14,12 @@ This topic lists new and updated topics in the [Manage and update Windows 10](in >If you're looking for **update history** for Windows 10, see [Windows 10 and Windows Server 2016 update history](https://support.microsoft.com/help/12387/windows-10-update-history). +## February 2017 + +| New or changed topic | Description | +| --- | --- | +| [Assign devices to servicing branches for Windows 10 updates](waas-servicing-branches-windows-10-updates.md) | Added Group Policy setting that blocks user access to Windows Update. | + ## January 2017 | New or changed topic | Description | @@ -24,8 +30,6 @@ This topic lists new and updated topics in the [Manage and update Windows 10](in | [Quick guide to Windows as a service](waas-quick-start.md) | Added video that explains how Windows as a service works. | | [Manage device restarts after updates](waas-restart.md) | Added Registry keys for controlling restarts. | - - ## December 2016 | New or changed topic | Description | diff --git a/windows/manage/waas-servicing-branches-windows-10-updates.md b/windows/manage/waas-servicing-branches-windows-10-updates.md index bf763d2b49..7e62bcbf3a 100644 --- a/windows/manage/waas-servicing-branches-windows-10-updates.md +++ b/windows/manage/waas-servicing-branches-windows-10-updates.md @@ -196,7 +196,7 @@ In Windows 10, administrators can control user access to Windows Update. By enabling the Group Policy setting under **Computer Configuration\Administrative Templates\Windows Components\Windows update\Remove access to use all Windows update features**, administrators can disable the "Check for updates" option for users. Any background update scans, downloads and installations will continue to work as configured. >[!NOTE] -> In Windows 10, any Group Policy user configuration settings for Windows Update were deprecate and are no longer supported on this platform. +> In Windows 10, any Group Policy user configuration settings for Windows Update were deprecated and are no longer supported on this platform. ## Related topics From 4f8eaabbd71970f37e631a964a11549face01ea6 Mon Sep 17 00:00:00 2001 From: rikot Date: Thu, 2 Feb 2017 13:48:57 -0500 Subject: [PATCH 72/87] Update manage-windows-updates-for-surface-hub.md --- devices/surface-hub/manage-windows-updates-for-surface-hub.md | 2 ++ 1 file changed, 2 insertions(+) diff --git a/devices/surface-hub/manage-windows-updates-for-surface-hub.md b/devices/surface-hub/manage-windows-updates-for-surface-hub.md index 35787fbff1..e1e0574390 100644 --- a/devices/surface-hub/manage-windows-updates-for-surface-hub.md +++ b/devices/surface-hub/manage-windows-updates-for-surface-hub.md @@ -90,6 +90,7 @@ Once you've determined deployment rings for your Surface Hubs, configure update - To defer quality updates, set an appropriate [Update/DeferQualityUpdatesPeriodInDays](https://msdn.microsoft.com/en-us/library/windows/hardware/dn904962.aspx#Update_DeferQualityUpdatesPeriodInDays) policy for each ring. > [!NOTE] + > If you encounter issues during the update rollout, you can pause updates using [Update/PauseFeatureUpdates](https://msdn.microsoft.com/en-us/library/windows/hardware/dn904962.aspx#Update_PauseFeatureUpdates) and [Update/PauseQualityUpdates](https://msdn.microsoft.com/en-us/library/windows/hardware/dn904962.aspx#Update_PauseQualityUpdates). @@ -106,6 +107,7 @@ You can connect Surface Hub to your Windows Server Update Services (WSUS) server To connect Surface Hub to a WSUS server using MDM, set an appropriate [Update/UpdateServiceUrl](https://msdn.microsoft.com/en-us/library/windows/hardware/dn904962.aspx#Update_UpdateServiceUrl) policy. **If you use a proxy server or other method to block URLs** + If you use a method other than WSUS to block specific URLs and prevent updates, you will need to add the following Windows update trusted site URLs to the “allow list”: - http(s)://*.update.microsoft.com - http://download.windowsupdate.com From 408c738d0429c64900130e1a8ae81128e7fcb9dc Mon Sep 17 00:00:00 2001 From: Justinha Date: Thu, 2 Feb 2017 13:21:14 -0800 Subject: [PATCH 73/87] fixed formatting --- windows/keep-secure/credential-guard.md | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/windows/keep-secure/credential-guard.md b/windows/keep-secure/credential-guard.md index 37f0fd9b7f..980862a955 100644 --- a/windows/keep-secure/credential-guard.md +++ b/windows/keep-secure/credential-guard.md @@ -9,6 +9,7 @@ ms.pagetype: security localizationpriority: high author: brianlic-msft --- + # Protect derived domain credentials with Credential Guard **Applies to** @@ -19,9 +20,9 @@ Introduced in Windows 10 Enterprise and Windows Server 2016, Credential Guard u By enabling Credential Guard, the following features and solutions are provided: - **Hardware security** NTLM, Kerberos, and Credential Manager take advantage of platform security features, including Secure Boot and virtualization, to protect credentials. +- **Hardware security** NTLM, Kerberos, and Credential Manager take advantage of platform security features, including Secure Boot and virtualization, to protect credentials. - **Virtualization-based security** Windows NTLM and Kerberos derived credentials and other secrets run in a protected environment that is isolated from the running operating system. -,- **Better protection against advanced persistent threats** When Credential Manager domain credentials, NTLM, and Kerberos derived credentials are protected using virtualization-based security, the credential theft attack techniques and tools used in many targeted attacks are blocked. Malware running in the operating system with administrative privileges cannot extract secrets that are protected by virtualization-based security. While Credential Guard is a powerful mitigation, persistent threat attacks will likely shift to new attack techniques and you should also incorporate Device Guard and other security strategies and architectures. +- **Better protection against advanced persistent threats** When Credential Manager domain credentials, NTLM, and Kerberos derived credentials are protected using virtualization-based security, the credential theft attack techniques and tools used in many targeted attacks are blocked. Malware running in the operating system with administrative privileges cannot extract secrets that are protected by virtualization-based security. While Credential Guard is a powerful mitigation, persistent threat attacks will likely shift to new attack techniques and you should also incorporate Device Guard and other security strategies and architectures. ## How it works @@ -60,7 +61,7 @@ The Virtualization-based security requires: When Credential Guard is enabled, specific authentication capabilities are blocked, so applications which require blocked capabilities will break. Applications should be tested prior to deployment to ensure compatiblity with the reduced functionality. >[!WARNING] -> Enabling Credential Guard on domain controllers is not supported
+> Enabling Credential Guard on domain controllers is not supported.
> The domain controller hosts authentication services which integrate with processes isolated when Credential Guard is enabled, causing crashes. >[!NOTE] From 594e403a7f6420a90b540ff54f18f1472209e05f Mon Sep 17 00:00:00 2001 From: Karthika Raman Date: Thu, 2 Feb 2017 13:54:25 -0800 Subject: [PATCH 74/87] making a minor change to reflect the KB requirement change with V5 --- windows/deploy/upgrade-analytics-get-started.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/deploy/upgrade-analytics-get-started.md b/windows/deploy/upgrade-analytics-get-started.md index 1455ee624e..cd76825250 100644 --- a/windows/deploy/upgrade-analytics-get-started.md +++ b/windows/deploy/upgrade-analytics-get-started.md @@ -127,7 +127,7 @@ The Upgrade Analytics deployment script does the following: 3. Checks whether the computer has a pending restart.   -4. Verifies that the latest version of KB package 10.0.x is installed (version 10.0.14348 or later is required, but version 10.0.14913 or later is recommended). +4. Verifies that the latest version of KB package 10.0.x is installed (version 10.0.14913 or later is required). 5. If enabled, turns on verbose mode for troubleshooting. From 09621fff218b73be9552c4ffbff860db5756f997 Mon Sep 17 00:00:00 2001 From: Justinha Date: Thu, 2 Feb 2017 14:25:52 -0800 Subject: [PATCH 75/87] fixed metadata --- windows/keep-secure/credential-guard.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/keep-secure/credential-guard.md b/windows/keep-secure/credential-guard.md index 980862a955..9d3a33d12c 100644 --- a/windows/keep-secure/credential-guard.md +++ b/windows/keep-secure/credential-guard.md @@ -1,4 +1,4 @@ -[s,,--- +--- title: Protect derived domain credentials with Credential Guard (Windows 10) description: Introduced in Windows 10 Enterprise, Credential Guard uses virtualization-based security to isolate secrets so that only privileged system software can access them. ms.assetid: 4F1FE390-A166-4A24-8530-EA3369FEB4B1 From 4fb86ef0967caf665ceb36ee7bcffcbed36e306f Mon Sep 17 00:00:00 2001 From: jdeckerMS Date: Thu, 2 Feb 2017 14:55:33 -0800 Subject: [PATCH 76/87] sync --- devices/surface-hub/manage-windows-updates-for-surface-hub.md | 1 - 1 file changed, 1 deletion(-) diff --git a/devices/surface-hub/manage-windows-updates-for-surface-hub.md b/devices/surface-hub/manage-windows-updates-for-surface-hub.md index 8cd7c3a9fa..d8661c166c 100644 --- a/devices/surface-hub/manage-windows-updates-for-surface-hub.md +++ b/devices/surface-hub/manage-windows-updates-for-surface-hub.md @@ -90,7 +90,6 @@ Once you've determined deployment rings for your Surface Hubs, configure update - To defer quality updates, set an appropriate [Update/DeferQualityUpdatesPeriodInDays](https://msdn.microsoft.com/en-us/library/windows/hardware/dn904962.aspx#Update_DeferQualityUpdatesPeriodInDays) policy for each ring. > [!NOTE] - > If you encounter issues during the update rollout, you can pause updates using [Update/PauseFeatureUpdates](https://msdn.microsoft.com/en-us/library/windows/hardware/dn904962.aspx#Update_PauseFeatureUpdates) and [Update/PauseQualityUpdates](https://msdn.microsoft.com/en-us/library/windows/hardware/dn904962.aspx#Update_PauseQualityUpdates). From a1b4cef484bd08b7b9aa34f8bad236086c911ebd Mon Sep 17 00:00:00 2001 From: Greg Lindsay Date: Thu, 2 Feb 2017 15:40:23 -0800 Subject: [PATCH 77/87] bug 118 --- windows/deploy/usmt-overview.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/deploy/usmt-overview.md b/windows/deploy/usmt-overview.md index 9f6a18384a..9dca476f1c 100644 --- a/windows/deploy/usmt-overview.md +++ b/windows/deploy/usmt-overview.md @@ -35,7 +35,7 @@ USMT provides the following benefits to businesses that are deploying Windows op - Increases employee satisfaction with the migration experience. ## Limitations -USMT is intended for administrators who are performing large-scale automated deployments. If you are only migrating the user states of a few computers, you can use [Windows Easy Transfer](https://go.microsoft.com/fwlink/p/?LinkId=140248). +USMT is intended for administrators who are performing large-scale automated deployments. If you are only migrating the user states of a few computers, you can use [PCmover Express](http://go.microsoft.com/fwlink/?linkid=620915). PCmover Express is a tool created by Microsoft's partner, Laplink. There are some scenarios in which the use of USMT is not recommended. These include: From 621a8df6f338a941e610f454e0f0d5a09606fb5d Mon Sep 17 00:00:00 2001 From: Brian Lich Date: Thu, 2 Feb 2017 16:33:26 -0800 Subject: [PATCH 78/87] moving link to baseline to the top of the article --- ...dows-operating-system-components-to-microsoft-services.md | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/windows/manage/manage-connections-from-windows-operating-system-components-to-microsoft-services.md b/windows/manage/manage-connections-from-windows-operating-system-components-to-microsoft-services.md index c7c8415926..83ba743e69 100644 --- a/windows/manage/manage-connections-from-windows-operating-system-components-to-microsoft-services.md +++ b/windows/manage/manage-connections-from-windows-operating-system-components-to-microsoft-services.md @@ -25,8 +25,9 @@ If you want to minimize connections from Windows to Microsoft services, or confi You can configure telemetry at the Security level, turn off Windows Defender telemetry and MSRT reporting, and turn off all other connections to Microsoft network endpoints as described in this article to help prevent Windows from sending any data to Microsoft. There are many reasons why these communications are enabled by default, such as updating malware definitions and maintain current certificate revocation lists, which is why we strongly recommend against this. This data helps us deliver a secure, reliable, and more delightful personalized experience. -We are always striving to improve our documentation and welcome your feedback. You can provide feedback by contacting telmhelp@microsoft.com. +To help make it easier to deploy settings to restrict connections from Windows 10 to Microsoft, you can apply the [Windows Restricted Traffic Limited Functionality Baseline](https://go.microsoft.com/fwlink/?linkid=828887). This baseline was created in the same way as the [Windows security baselines](../keep-secure/windows-security-baselines.md) that are often used to efficiently configure Windows to a known secure state. Running the Windows Restricted Traffic Limited Functionality Baseline on devices in your organization will allow you to quickly configure all of the settings covered in this document. However, some of the settings reduce the functionality and security configuration of your device and are therefore not recommended. Make sure should you've chosen the right settings configuration for your environment before applying. Applying this baseline is equivalent to applying the Windows 10 steps covered in this article. +We are always striving to improve our documentation and welcome your feedback. You can provide feedback by contacting telmhelp@microsoft.com. ## What's new in Windows 10, version 1607 and Windows Server 2016 @@ -1359,5 +1360,3 @@ You can turn off automatic updates by doing one of the following. This is not re - **5**. Turn off automatic updates. To learn more, see [Device update management](http://msdn.microsoft.com/library/windows/hardware/dn957432.aspx) and [Configure Automatic Updates by using Group Policy](http://technet.microsoft.com/library/cc720539.aspx). - -To help make it easier to deploy settings to restrict connections from Windows 10 to Microsoft, you can apply the [Windows Restricted Traffic Limited Functionality Baseline](https://go.microsoft.com/fwlink/?linkid=828887). This baseline was created in the same way as the [Windows security baselines](../keep-secure/windows-security-baselines.md) that are often used to efficiently configure Windows to a known secure state. Running the Windows Restricted Traffic Limited Functionality Baseline on devices in your organization will allow you to quickly configure all of the settings covered in this document. However, some of the settings reduce the functionality and security configuration of your device and are therefore not recommended. Make sure should you've chosen the right settings configuration for your environment before applying. From 20f539c21c638cef902061adc7f8f6e5d112a0c9 Mon Sep 17 00:00:00 2001 From: JanKeller1 Date: Thu, 2 Feb 2017 21:18:51 -0800 Subject: [PATCH 79/87] Added missing backticks --- ...deploy-catalog-files-to-support-code-integrity-policies.md | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/windows/keep-secure/deploy-catalog-files-to-support-code-integrity-policies.md b/windows/keep-secure/deploy-catalog-files-to-support-code-integrity-policies.md index ba8e5d4999..898731c8d2 100644 --- a/windows/keep-secure/deploy-catalog-files-to-support-code-integrity-policies.md +++ b/windows/keep-secure/deploy-catalog-files-to-support-code-integrity-policies.md @@ -124,8 +124,6 @@ To sign the existing catalog file, copy each of the following commands into an e After the catalog file is signed, add the signing certificate to a code integrity policy, as described in the following steps. - - 1. If you have not already verified the catalog file digital signature, right-click the catalog file, and then click **Properties**. On the **Digital Signatures** tab, verify that your signing certificate exists with the algorithm you expect. 2. If you already have an XML policy file that you want to add the signing certificate to, skip to the next step. Otherwise, use [New-CIPolicy](https://technet.microsoft.com/library/mt634473.aspx) to create a code integrity policy that you will later merge into another policy (not deploy as-is). This example creates a policy called **CatalogSignatureOnly.xml** in the location **C:\\PolicyFolder**: @@ -134,7 +132,7 @@ After the catalog file is signed, add the signing certificate to a code integrit > **Note**  Include the **-UserPEs** parameter to ensure that the policy includes user mode code integrity. -3. Use [Add-SignerRule](https://technet.microsoft.com/library/mt634479.aspx) to add the signing certificate to the code integrity policy, filling in the correct path and filenames for ** and **: +3. Use [Add-SignerRule](https://technet.microsoft.com/library/mt634479.aspx) to add the signing certificate to the code integrity policy, filling in the correct path and filenames for `` and ``: ` Add-SignerRule -FilePath -CertificatePath -User ` From 3f472177e6cfcbdc289bb0150cc6e9f0c6e023f2 Mon Sep 17 00:00:00 2001 From: Jason Gerend Date: Fri, 3 Feb 2017 15:44:53 -0800 Subject: [PATCH 80/87] Create windows-libraries.md Derived from this older topic: https://technet.microsoft.com/en-us/library/dd744693(v=ws.10).aspx --- windows/manage/windows-libraries.md | 129 ++++++++++++++++++++++++++++ 1 file changed, 129 insertions(+) create mode 100644 windows/manage/windows-libraries.md diff --git a/windows/manage/windows-libraries.md b/windows/manage/windows-libraries.md new file mode 100644 index 0000000000..d65aba09be --- /dev/null +++ b/windows/manage/windows-libraries.md @@ -0,0 +1,129 @@ +--- +ms.assetid: e68cd672-9dea-4ff8-b725-a915f33d8fd2 +title: Windows Libraries +ms.prod: windows-server-threshold +ms.author: jgerend +ms.manager: dongill +ms.technology: storage +ms.topic: article +author: jasongerend +ms.date: 2/3/2017 +description: +--- +> Applies to: Windows 10, Windows 8.1, Windows 7, Windows Server 2016, Windows Server 2012 R2, Windows Server 2012, Windows Server 2008 R2 + +# Windows Libraries + +Libraries are virtual containers for users’ content. A library can contain files and folders stored on the local computer or in a remote storage location. In Windows Explorer, users interact with libraries in ways similar to how they would interact with other folders. Libraries are built upon the legacy known folders (such as My Documents, My Pictures, and My Music) that users are familiar with, and these known folders are automatically included in the default libraries and set as the default save location. + +## Features for Users + +Windows libraries are backed by full content search and rich metadata. Libraries offer the following advantages to users: +- Aggregate content from multiple storage locations into a single, unified presentation. +- Enable users to stack and group library contents based on metadata. +- Enable fast, full-text searches across multiple storage locations, from Windows Explorer or from the Start menu. +- Support customized filter search suggestions, based on the types of files contained in the library. +- Enable users to create new libraries and specify which folders they want to include. + +## Features for Administrators + +Administrators can configure and control Windows libraries in the following ways: +- Create custom libraries by creating and deploying Library Description (*.library-ms) files. +- Hide or delete the default libraries. (The Library node itself cannot be hidden or deleted from the Windows Explorer navigation pane.) +- Specify a set of libraries available to Default User, and then deploy those libraries to users that derive from Default User. +- Specify locations to include in a library. +- Remove a default location from a library. +- Remove advanced libraries features, when the environment does not support the local caching of files, by using the [Turn off Windows Libraries features that rely on indexed file data](https://technet.microsoft.com/library/faaefdad-6e12-419a-b714-6a7bb60f6773#WS_TurnOffWindowsLibraries) Group Policy. This makes all libraries basic (see [Indexing Requirements and Basic Libraries](https://technet.microsoft.com/library/dd744693.aspx#WS_IndexingReqs_BasicLibraries)), removes libraries from the scope of the Start menu search, and removes other features to avoid confusing users and consuming resources. + +## More about Libraries + +The following is important information about libraries you may need to understand to successfully manage your enterprise. + +### Library Contents + +Including a folder in a library does not physically move or change the storage location of the files or folders; the library is a view into those folders. However, users interacting with files in a library are copying, moving, and deleting the files themselves, not copies of these files. + +### Default Libraries and Known Folders + +The default libraries include: +- Documents +- Music +- Pictures +- Videos + +Libraries are built upon the legacy known folders (such as My Documents, My Pictures, and My Music) that users are familiar with. These known folders are automatically included in the default libraries and set as the default save location. That is, when users drag, copy, or save a file to the Documents library, the file is moved, copied, or saved to the My Documents folder. Administrators and users can change the default save-to location. + +### Hiding Default Libraries + +Users or administrators can hide or delete the default libraries, though the libraries node in the Navigation pane cannot be hidden or deleted. Hiding a default library is preferable to deleting it, as applications like Windows Media Player rely on the default libraries and will re-create them if they do not exist on the computer. See [How to Hide Default Libraries](https://technet.microsoft.com/library/d44c78e0-08ef-4e91-935a-a6f43716e37d#BKMK_HideDefaultLibraries) for instructions. + +### Default Save Locations for Libraries + +Each library has a default save location. Files are saved or copied to this location if the user chooses to save or copy a file to a library, rather than a specific location within the library. Known folders are the default save locations; however, users can select a different save location. +If the user removes the default save location from a library, the next location is automatically selected as the new default save location. If the library is empty of locations or if all included locations cannot be saved to, then the save operation fails. + +### Indexing Requirements and “Basic” Libraries + +Certain library features depend on the contents of the libraries being indexed. Library locations must be available for local indexing or be indexed in a manner conforming to the Windows Indexing Protocol. If indexing is not enabled for one or more locations within a library, the entire library reverts to basic functionality: +- No support for metadata browsing via **Arrange By** views. +- Grep-only searches. +- Grep-only search suggestions. The only properties available for input suggestions are **Date Modified** and **Size**. +- No support for searching from the Start menu. Start menu searches do not return files from basic libraries. +- No previews of file snippets for search results returned in Content mode. + +To avoid this limited functionality, all locations within the library must be indexable, either locally or remotely. When users add local folders to libraries, Windows adds the location to the indexing scope and indexes the contents. Remote locations that are not indexed remotely can be added to the local index using Offline File synchronization. This gives the user the benefits of local storage even though the location is remote. Making a folder “Always available offline” creates a local copy of the folder’s files, adds those files to the index, and keeps the local and remote copies in sync. Users can manually sync locations which are not indexed remotely and are not using folder redirection to gain the benefits of being indexed locally. + +For instructions on enabling indexing, see [How to Enable Indexing of Library Locations](https://technet.microsoft.com/library/d44c78e0-08ef-4e91-935a-a6f43716e37d#BKMK_EnableIndexLocations). + +If your environment does not support caching files locally, you should enable the [Turn off Windows Libraries features that rely on indexed file](https://technet.microsoft.com/library/faaefdad-6e12-419a-b714-6a7bb60f6773#WS_TurnOffWindowsLibraries) data Group Policy. This makes all libraries basic. For further information, see [Group Policy for Windows Search, Browse, and Organize](https://technet.microsoft.com/library/dd744697.aspx). + +### Folder Redirection + +While library files themselves cannot be redirected, you can redirect known folders included in libraries by using [Folder Redirection](https://technet.microsoft.com/library/hh848267.aspx). For example, you can redirect the “My Documents” folder, which is included in the default Documents library. When redirecting known folders, you should make sure that the destination is either indexed or always available offline in order to maintain full library functionality. In both cases, the files for the destination folder are indexed and supported in libraries. These settings are configured on the server side. + +### Supported storage locations + +The following table show which locations are supported in Windows libraries. + +|Supported Locations|Unsupported Locations| +|---|---| +|Fixed local volumes (NTFS/FAT)|Removable drives| +|Shares that are indexed (departmental servers*, Windows home PCs)|Removable media (such as DVDs)| +|Network shares that are accessible through DFS Namespaces or are part of a failover cluster|Shares that are available offline (redirected folders that use Offline Files)| +|Network shares that aren't available offline or remotely indexed|NAS Drives| +||Other data sources: SharePoint, Exchange, etc.| + +\* For shares that are indexed on a departmental server, Windows Search works well in workgroups or on a domain server that has similar characteristics to a workgroup server. For example, Windows Search works well on a single share departmental server with the following characteristics: + +- Expected maximum load is four concurrent query requests. +- Expected indexing corpus is a maximum of one million documents. +- Users directly access the server. That is, the server is not made available through DFS Namespaces. +- Users are not redirected to another server in case of failure. That is, server clusters are not used. + +### Library Attributes + +The following library attributes can be modified within Windows Explorer, the Library Management dialog, or the Library Description file (*.library-ms): +- Name +- Library locations +- Order of library locations +- Default save location + +The library icon can be modified by the administrator or user by directly editing the Library Description schema file. + +See the [Library Description Schema](http://go.microsoft.com/fwlink/?LinkId=159581) topic on MSDN for information on creating Library Description files. + +## See also + +### Concepts + +- [Windows Search Features ](https://technet.microsoft.com/library/dd744686.aspx) +- [Windows Indexing Features](https://technet.microsoft.com/library/dd744700.aspx) +- [Federated Search Features](https://technet.microsoft.com/library/dd744682.aspx) +- [Administrative How-to Guides](https://technet.microsoft.com/library/ee461108.aspx) +- [Group Policy for Windows Search, Browse, and Organize](https://technet.microsoft.com/library/dd744697.aspx) +- [Additional Resources for Windows Search, Browse, and Organization](https://technet.microsoft.com/library/dd744695.aspx) + +### Other resources + +- [Folder Redirection, Offline Files, and Roaming User Profiles](https://technet.microsoft.com/library/hh848267.aspx) +- [Library Description Schema](https://msdn.microsoft.com/library/dd798389.aspx) From b1b4dbdb7c11fcb6b4cad7ae35168d11f05cc2cd Mon Sep 17 00:00:00 2001 From: Jason Gerend Date: Fri, 3 Feb 2017 15:54:13 -0800 Subject: [PATCH 81/87] Update windows-libraries.md --- windows/manage/windows-libraries.md | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/windows/manage/windows-libraries.md b/windows/manage/windows-libraries.md index d65aba09be..6d3460b637 100644 --- a/windows/manage/windows-libraries.md +++ b/windows/manage/windows-libraries.md @@ -88,9 +88,8 @@ The following table show which locations are supported in Windows libraries. |Supported Locations|Unsupported Locations| |---|---| |Fixed local volumes (NTFS/FAT)|Removable drives| -|Shares that are indexed (departmental servers*, Windows home PCs)|Removable media (such as DVDs)| -|Network shares that are accessible through DFS Namespaces or are part of a failover cluster|Shares that are available offline (redirected folders that use Offline Files)| -|Network shares that aren't available offline or remotely indexed|NAS Drives| +|Shares that are indexed (departmental servers*, Windows home PCs)|Removable media (such as DVDs)

Network shares that are accessible through DFS Namespaces or are part of a failover cluster| +|Shares that are available offline (redirected folders that use Offline Files)|Network shares that aren't available offline or remotely indexed

Network Attached Storage (NAS) devices| ||Other data sources: SharePoint, Exchange, etc.| \* For shares that are indexed on a departmental server, Windows Search works well in workgroups or on a domain server that has similar characteristics to a workgroup server. For example, Windows Search works well on a single share departmental server with the following characteristics: From c77b871da65378be88d27eb1f23f48e11ef0813e Mon Sep 17 00:00:00 2001 From: Brian Lich Date: Fri, 3 Feb 2017 16:09:06 -0800 Subject: [PATCH 82/87] Revert "Create windows-libraries.md" --- windows/manage/windows-libraries.md | 128 ---------------------------- 1 file changed, 128 deletions(-) delete mode 100644 windows/manage/windows-libraries.md diff --git a/windows/manage/windows-libraries.md b/windows/manage/windows-libraries.md deleted file mode 100644 index 6d3460b637..0000000000 --- a/windows/manage/windows-libraries.md +++ /dev/null @@ -1,128 +0,0 @@ ---- -ms.assetid: e68cd672-9dea-4ff8-b725-a915f33d8fd2 -title: Windows Libraries -ms.prod: windows-server-threshold -ms.author: jgerend -ms.manager: dongill -ms.technology: storage -ms.topic: article -author: jasongerend -ms.date: 2/3/2017 -description: ---- -> Applies to: Windows 10, Windows 8.1, Windows 7, Windows Server 2016, Windows Server 2012 R2, Windows Server 2012, Windows Server 2008 R2 - -# Windows Libraries - -Libraries are virtual containers for users’ content. A library can contain files and folders stored on the local computer or in a remote storage location. In Windows Explorer, users interact with libraries in ways similar to how they would interact with other folders. Libraries are built upon the legacy known folders (such as My Documents, My Pictures, and My Music) that users are familiar with, and these known folders are automatically included in the default libraries and set as the default save location. - -## Features for Users - -Windows libraries are backed by full content search and rich metadata. Libraries offer the following advantages to users: -- Aggregate content from multiple storage locations into a single, unified presentation. -- Enable users to stack and group library contents based on metadata. -- Enable fast, full-text searches across multiple storage locations, from Windows Explorer or from the Start menu. -- Support customized filter search suggestions, based on the types of files contained in the library. -- Enable users to create new libraries and specify which folders they want to include. - -## Features for Administrators - -Administrators can configure and control Windows libraries in the following ways: -- Create custom libraries by creating and deploying Library Description (*.library-ms) files. -- Hide or delete the default libraries. (The Library node itself cannot be hidden or deleted from the Windows Explorer navigation pane.) -- Specify a set of libraries available to Default User, and then deploy those libraries to users that derive from Default User. -- Specify locations to include in a library. -- Remove a default location from a library. -- Remove advanced libraries features, when the environment does not support the local caching of files, by using the [Turn off Windows Libraries features that rely on indexed file data](https://technet.microsoft.com/library/faaefdad-6e12-419a-b714-6a7bb60f6773#WS_TurnOffWindowsLibraries) Group Policy. This makes all libraries basic (see [Indexing Requirements and Basic Libraries](https://technet.microsoft.com/library/dd744693.aspx#WS_IndexingReqs_BasicLibraries)), removes libraries from the scope of the Start menu search, and removes other features to avoid confusing users and consuming resources. - -## More about Libraries - -The following is important information about libraries you may need to understand to successfully manage your enterprise. - -### Library Contents - -Including a folder in a library does not physically move or change the storage location of the files or folders; the library is a view into those folders. However, users interacting with files in a library are copying, moving, and deleting the files themselves, not copies of these files. - -### Default Libraries and Known Folders - -The default libraries include: -- Documents -- Music -- Pictures -- Videos - -Libraries are built upon the legacy known folders (such as My Documents, My Pictures, and My Music) that users are familiar with. These known folders are automatically included in the default libraries and set as the default save location. That is, when users drag, copy, or save a file to the Documents library, the file is moved, copied, or saved to the My Documents folder. Administrators and users can change the default save-to location. - -### Hiding Default Libraries - -Users or administrators can hide or delete the default libraries, though the libraries node in the Navigation pane cannot be hidden or deleted. Hiding a default library is preferable to deleting it, as applications like Windows Media Player rely on the default libraries and will re-create them if they do not exist on the computer. See [How to Hide Default Libraries](https://technet.microsoft.com/library/d44c78e0-08ef-4e91-935a-a6f43716e37d#BKMK_HideDefaultLibraries) for instructions. - -### Default Save Locations for Libraries - -Each library has a default save location. Files are saved or copied to this location if the user chooses to save or copy a file to a library, rather than a specific location within the library. Known folders are the default save locations; however, users can select a different save location. -If the user removes the default save location from a library, the next location is automatically selected as the new default save location. If the library is empty of locations or if all included locations cannot be saved to, then the save operation fails. - -### Indexing Requirements and “Basic” Libraries - -Certain library features depend on the contents of the libraries being indexed. Library locations must be available for local indexing or be indexed in a manner conforming to the Windows Indexing Protocol. If indexing is not enabled for one or more locations within a library, the entire library reverts to basic functionality: -- No support for metadata browsing via **Arrange By** views. -- Grep-only searches. -- Grep-only search suggestions. The only properties available for input suggestions are **Date Modified** and **Size**. -- No support for searching from the Start menu. Start menu searches do not return files from basic libraries. -- No previews of file snippets for search results returned in Content mode. - -To avoid this limited functionality, all locations within the library must be indexable, either locally or remotely. When users add local folders to libraries, Windows adds the location to the indexing scope and indexes the contents. Remote locations that are not indexed remotely can be added to the local index using Offline File synchronization. This gives the user the benefits of local storage even though the location is remote. Making a folder “Always available offline” creates a local copy of the folder’s files, adds those files to the index, and keeps the local and remote copies in sync. Users can manually sync locations which are not indexed remotely and are not using folder redirection to gain the benefits of being indexed locally. - -For instructions on enabling indexing, see [How to Enable Indexing of Library Locations](https://technet.microsoft.com/library/d44c78e0-08ef-4e91-935a-a6f43716e37d#BKMK_EnableIndexLocations). - -If your environment does not support caching files locally, you should enable the [Turn off Windows Libraries features that rely on indexed file](https://technet.microsoft.com/library/faaefdad-6e12-419a-b714-6a7bb60f6773#WS_TurnOffWindowsLibraries) data Group Policy. This makes all libraries basic. For further information, see [Group Policy for Windows Search, Browse, and Organize](https://technet.microsoft.com/library/dd744697.aspx). - -### Folder Redirection - -While library files themselves cannot be redirected, you can redirect known folders included in libraries by using [Folder Redirection](https://technet.microsoft.com/library/hh848267.aspx). For example, you can redirect the “My Documents” folder, which is included in the default Documents library. When redirecting known folders, you should make sure that the destination is either indexed or always available offline in order to maintain full library functionality. In both cases, the files for the destination folder are indexed and supported in libraries. These settings are configured on the server side. - -### Supported storage locations - -The following table show which locations are supported in Windows libraries. - -|Supported Locations|Unsupported Locations| -|---|---| -|Fixed local volumes (NTFS/FAT)|Removable drives| -|Shares that are indexed (departmental servers*, Windows home PCs)|Removable media (such as DVDs)

Network shares that are accessible through DFS Namespaces or are part of a failover cluster| -|Shares that are available offline (redirected folders that use Offline Files)|Network shares that aren't available offline or remotely indexed

Network Attached Storage (NAS) devices| -||Other data sources: SharePoint, Exchange, etc.| - -\* For shares that are indexed on a departmental server, Windows Search works well in workgroups or on a domain server that has similar characteristics to a workgroup server. For example, Windows Search works well on a single share departmental server with the following characteristics: - -- Expected maximum load is four concurrent query requests. -- Expected indexing corpus is a maximum of one million documents. -- Users directly access the server. That is, the server is not made available through DFS Namespaces. -- Users are not redirected to another server in case of failure. That is, server clusters are not used. - -### Library Attributes - -The following library attributes can be modified within Windows Explorer, the Library Management dialog, or the Library Description file (*.library-ms): -- Name -- Library locations -- Order of library locations -- Default save location - -The library icon can be modified by the administrator or user by directly editing the Library Description schema file. - -See the [Library Description Schema](http://go.microsoft.com/fwlink/?LinkId=159581) topic on MSDN for information on creating Library Description files. - -## See also - -### Concepts - -- [Windows Search Features ](https://technet.microsoft.com/library/dd744686.aspx) -- [Windows Indexing Features](https://technet.microsoft.com/library/dd744700.aspx) -- [Federated Search Features](https://technet.microsoft.com/library/dd744682.aspx) -- [Administrative How-to Guides](https://technet.microsoft.com/library/ee461108.aspx) -- [Group Policy for Windows Search, Browse, and Organize](https://technet.microsoft.com/library/dd744697.aspx) -- [Additional Resources for Windows Search, Browse, and Organization](https://technet.microsoft.com/library/dd744695.aspx) - -### Other resources - -- [Folder Redirection, Offline Files, and Roaming User Profiles](https://technet.microsoft.com/library/hh848267.aspx) -- [Library Description Schema](https://msdn.microsoft.com/library/dd798389.aspx) From 4d84b705cc9c89faf39df2f3497f1b297e2d7722 Mon Sep 17 00:00:00 2001 From: JanKeller1 Date: Fri, 3 Feb 2017 18:19:49 -0800 Subject: [PATCH 83/87] Responded to a customer comment re what's new --- windows/keep-secure/bitlocker-overview.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/keep-secure/bitlocker-overview.md b/windows/keep-secure/bitlocker-overview.md index 2ffb869b8f..e3d23d3102 100644 --- a/windows/keep-secure/bitlocker-overview.md +++ b/windows/keep-secure/bitlocker-overview.md @@ -42,7 +42,7 @@ BitLocker control panel, and they are appropriate to use for automated deploymen ## New and changed functionality -To find out what's new in BitLocker for Windows 10, see the [BitLocker](https://technet.microsoft.com/itpro/windows/whats-new/whats-new-windows-10-version-1507-and-1511#bitlocker) section in "What's new in Windows 10, versions 1507 and 1511." +To find out what's new in BitLocker for Windows 10, such as support for the XTS-AES encryption algorithm, see the [BitLocker](https://technet.microsoft.com/itpro/windows/whats-new/whats-new-windows-10-version-1507-and-1511#bitlocker) section in "What's new in Windows 10, versions 1507 and 1511."   ## System requirements From 088a59b5b47b266f1209ce1349c5baad3d9eb565 Mon Sep 17 00:00:00 2001 From: JanKeller1 Date: Mon, 6 Feb 2017 12:55:21 -0800 Subject: [PATCH 84/87] Delete outdated text re TPM cmdlets --- windows/keep-secure/change-the-tpm-owner-password.md | 5 +---- .../initialize-and-configure-ownership-of-the-tpm.md | 8 ++------ windows/keep-secure/manage-tpm-commands.md | 6 +----- windows/keep-secure/manage-tpm-lockout.md | 6 +----- windows/keep-secure/tpm-fundamentals.md | 6 +----- 5 files changed, 6 insertions(+), 25 deletions(-) diff --git a/windows/keep-secure/change-the-tpm-owner-password.md b/windows/keep-secure/change-the-tpm-owner-password.md index a8b0e386d3..16b63a490e 100644 --- a/windows/keep-secure/change-the-tpm-owner-password.md +++ b/windows/keep-secure/change-the-tpm-owner-password.md @@ -44,10 +44,7 @@ To change to a new TPM owner password, in TPM.msc, click **Change Owner Password ## Use the TPM cmdlets -If you are using Windows PowerShell to manage your computers, you can also manage the TPM by using Windows PowerShell. To install the TPM cmdlets, type the following command: -**dism /online /enable-feature /FeatureName:tpm-psh-cmdlets** - -For details about the individual cmdlets, see [TPM Cmdlets in Windows PowerShell](http://technet.microsoft.com/library/jj603116.aspx). +You can manage the TPM using Windows PowerShell. For details, see [TPM Cmdlets in Windows PowerShell](http://technet.microsoft.com/library/jj603116.aspx). ## Related topics diff --git a/windows/keep-secure/initialize-and-configure-ownership-of-the-tpm.md b/windows/keep-secure/initialize-and-configure-ownership-of-the-tpm.md index 013355ffa6..813dde388c 100644 --- a/windows/keep-secure/initialize-and-configure-ownership-of-the-tpm.md +++ b/windows/keep-secure/initialize-and-configure-ownership-of-the-tpm.md @@ -27,7 +27,7 @@ With TPM 1.2 and Windows 10, version 1507 or 1511, you can also take the followi - [Turn on or turn off the TPM](#turn-on-or-turn-off) -This topic also provides information about [using the TPM cmdlets](#use-the-tpm-cmdlets). +For information about the TPM cmdlets, see [TPM Cmdlets in Windows PowerShell](http://technet.microsoft.com/library/jj603116.aspx). ## About TPM initialization and ownership @@ -150,11 +150,7 @@ If you want to stop using the services that are provided by the TPM, you can use ## Use the TPM cmdlets -If you are using Windows PowerShell to manage your computers, you can also manage the TPM by using Windows PowerShell. To install the TPM cmdlets, type the following command: - -`dism /online /enable-feature /FeatureName:tpm-psh-cmdlets` - -For details about the individual cmdlets, see [TPM Cmdlets in Windows PowerShell](http://technet.microsoft.com/library/jj603116.aspx). +You can manage the TPM using Windows PowerShell. For details, see [TPM Cmdlets in Windows PowerShell](http://technet.microsoft.com/library/jj603116.aspx). ## Related topics diff --git a/windows/keep-secure/manage-tpm-commands.md b/windows/keep-secure/manage-tpm-commands.md index 71f3c2229e..c95d30f931 100644 --- a/windows/keep-secure/manage-tpm-commands.md +++ b/windows/keep-secure/manage-tpm-commands.md @@ -77,11 +77,7 @@ The following procedures describe how to manage the TPM command lists. You must ## Use the TPM cmdlets -If you are using Windows PowerShell to manage your computers, you can also manage the TPM by using Windows PowerShell. To install the TPM cmdlets, type the following command: - -`dism /online /enable-feature /FeatureName:tpm-psh-cmdlets` - -For details about the individual cmdlets, see [TPM Cmdlets in Windows PowerShell](http://technet.microsoft.com/library/jj603116.aspx). +You can manage the TPM using Windows PowerShell. For details, see [TPM Cmdlets in Windows PowerShell](http://technet.microsoft.com/library/jj603116.aspx). ## Related topics diff --git a/windows/keep-secure/manage-tpm-lockout.md b/windows/keep-secure/manage-tpm-lockout.md index 3f5e966157..76b1ee2bae 100644 --- a/windows/keep-secure/manage-tpm-lockout.md +++ b/windows/keep-secure/manage-tpm-lockout.md @@ -78,11 +78,7 @@ For information about mitigating dictionary attacks that use the lockout setting ## Use the TPM cmdlets -If you are using Windows PowerShell to manage your computers, you can also manage the TPM by using Windows PowerShell. To install the TPM cmdlets, type the following command: - -**dism /online /enable-feature /FeatureName:tpm-psh-cmdlets** - -For details about the individual cmdlets, see [TPM Cmdlets in Windows PowerShell](http://technet.microsoft.com/library/jj603116.aspx). +You can manage the TPM using Windows PowerShell. For details, see [TPM Cmdlets in Windows PowerShell](http://technet.microsoft.com/library/jj603116.aspx). ## Related topics diff --git a/windows/keep-secure/tpm-fundamentals.md b/windows/keep-secure/tpm-fundamentals.md index efb080c89c..044bb0c1be 100644 --- a/windows/keep-secure/tpm-fundamentals.md +++ b/windows/keep-secure/tpm-fundamentals.md @@ -67,11 +67,7 @@ The TPM can be used to protect certificates and RSA keys. The TPM key storage pr ## TPM Cmdlets -If you are using PowerShell to script and manage your computers, you can now manage the TPM using Windows PowerShell as well. To install the TPM cmdlets use the following command: - -`dism /online /enable-feature /FeatureName:tpm-psh-cmdlets` - -For details about the individual cmdlets, see [TPM Cmdlets in Windows PowerShell](http://technet.microsoft.com/library/jj603116.aspx). +You can manage the TPM using Windows PowerShell. For details, see [TPM Cmdlets in Windows PowerShell](http://technet.microsoft.com/library/jj603116.aspx). ## Physical presence interface From 6adbbad69d88543020b5daa8e6edf19703900ce4 Mon Sep 17 00:00:00 2001 From: Jason Gerend Date: Mon, 6 Feb 2017 15:21:17 -0800 Subject: [PATCH 85/87] Updated Windows Libraries file --- windows/manage/windows-libraries.md | 128 ++++++++++++++++++++++++++++ 1 file changed, 128 insertions(+) create mode 100644 windows/manage/windows-libraries.md diff --git a/windows/manage/windows-libraries.md b/windows/manage/windows-libraries.md new file mode 100644 index 0000000000..1608798dce --- /dev/null +++ b/windows/manage/windows-libraries.md @@ -0,0 +1,128 @@ +--- +ms.assetid: e68cd672-9dea-4ff8-b725-a915f33d8fd2 +title: Windows Libraries +ms.prod: windows-server-threshold +ms.author: jgerend +ms.manager: dongill +ms.technology: storage +ms.topic: article +author: jasongerend +ms.date: 2/6/2017 +description: All about Windows Libraries, which are containers for users' content, such as Documents and Pictures. +--- +> Applies to: Windows 10, Windows 8.1, Windows 7, Windows Server 2016, Windows Server 2012 R2, Windows Server 2012, Windows Server 2008 R2 + +# Windows Libraries + +Libraries are virtual containers for users’ content. A library can contain files and folders stored on the local computer or in a remote storage location. In Windows Explorer, users interact with libraries in ways similar to how they would interact with other folders. Libraries are built upon the legacy known folders (such as My Documents, My Pictures, and My Music) that users are familiar with, and these known folders are automatically included in the default libraries and set as the default save location. + +## Features for Users + +Windows libraries are backed by full content search and rich metadata. Libraries offer the following advantages to users: +- Aggregate content from multiple storage locations into a single, unified presentation. +- Enable users to stack and group library contents based on metadata. +- Enable fast, full-text searches across multiple storage locations, from Windows Explorer or from the Start menu. +- Support customized filter search suggestions, based on the types of files contained in the library. +- Enable users to create new libraries and specify which folders they want to include. + +## Features for Administrators + +Administrators can configure and control Windows libraries in the following ways: +- Create custom libraries by creating and deploying Library Description (*.library-ms) files. +- Hide or delete the default libraries. (The Library node itself cannot be hidden or deleted from the Windows Explorer navigation pane.) +- Specify a set of libraries available to Default User, and then deploy those libraries to users that derive from Default User. +- Specify locations to include in a library. +- Remove a default location from a library. +- Remove advanced libraries features, when the environment does not support the local caching of files, by using the [Turn off Windows Libraries features that rely on indexed file data](https://technet.microsoft.com/library/faaefdad-6e12-419a-b714-6a7bb60f6773#WS_TurnOffWindowsLibraries) Group Policy. This makes all libraries basic (see [Indexing Requirements and Basic Libraries](https://technet.microsoft.com/library/dd744693.aspx#WS_IndexingReqs_BasicLibraries)), removes libraries from the scope of the Start menu search, and removes other features to avoid confusing users and consuming resources. + +## More about Libraries + +The following is important information about libraries you may need to understand to successfully manage your enterprise. + +### Library Contents + +Including a folder in a library does not physically move or change the storage location of the files or folders; the library is a view into those folders. However, users interacting with files in a library are copying, moving, and deleting the files themselves, not copies of these files. + +### Default Libraries and Known Folders + +The default libraries include: +- Documents +- Music +- Pictures +- Videos + +Libraries are built upon the legacy known folders (such as My Documents, My Pictures, and My Music) that users are familiar with. These known folders are automatically included in the default libraries and set as the default save location. That is, when users drag, copy, or save a file to the Documents library, the file is moved, copied, or saved to the My Documents folder. Administrators and users can change the default save-to location. + +### Hiding Default Libraries + +Users or administrators can hide or delete the default libraries, though the libraries node in the Navigation pane cannot be hidden or deleted. Hiding a default library is preferable to deleting it, as applications like Windows Media Player rely on the default libraries and will re-create them if they do not exist on the computer. See [How to Hide Default Libraries](https://technet.microsoft.com/library/d44c78e0-08ef-4e91-935a-a6f43716e37d#BKMK_HideDefaultLibraries) for instructions. + +### Default Save Locations for Libraries + +Each library has a default save location. Files are saved or copied to this location if the user chooses to save or copy a file to a library, rather than a specific location within the library. Known folders are the default save locations; however, users can select a different save location. +If the user removes the default save location from a library, the next location is automatically selected as the new default save location. If the library is empty of locations or if all included locations cannot be saved to, then the save operation fails. + +### Indexing Requirements and “Basic” Libraries + +Certain library features depend on the contents of the libraries being indexed. Library locations must be available for local indexing or be indexed in a manner conforming to the Windows Indexing Protocol. If indexing is not enabled for one or more locations within a library, the entire library reverts to basic functionality: +- No support for metadata browsing via **Arrange By** views. +- Grep-only searches. +- Grep-only search suggestions. The only properties available for input suggestions are **Date Modified** and **Size**. +- No support for searching from the Start menu. Start menu searches do not return files from basic libraries. +- No previews of file snippets for search results returned in Content mode. + +To avoid this limited functionality, all locations within the library must be indexable, either locally or remotely. When users add local folders to libraries, Windows adds the location to the indexing scope and indexes the contents. Remote locations that are not indexed remotely can be added to the local index using Offline File synchronization. This gives the user the benefits of local storage even though the location is remote. Making a folder “Always available offline” creates a local copy of the folder’s files, adds those files to the index, and keeps the local and remote copies in sync. Users can manually sync locations which are not indexed remotely and are not using folder redirection to gain the benefits of being indexed locally. + +For instructions on enabling indexing, see [How to Enable Indexing of Library Locations](https://technet.microsoft.com/library/d44c78e0-08ef-4e91-935a-a6f43716e37d#BKMK_EnableIndexLocations). + +If your environment does not support caching files locally, you should enable the [Turn off Windows Libraries features that rely on indexed file](https://technet.microsoft.com/library/faaefdad-6e12-419a-b714-6a7bb60f6773#WS_TurnOffWindowsLibraries) data Group Policy. This makes all libraries basic. For further information, see [Group Policy for Windows Search, Browse, and Organize](https://technet.microsoft.com/library/dd744697.aspx). + +### Folder Redirection + +While library files themselves cannot be redirected, you can redirect known folders included in libraries by using [Folder Redirection](https://technet.microsoft.com/library/hh848267.aspx). For example, you can redirect the “My Documents” folder, which is included in the default Documents library. When redirecting known folders, you should make sure that the destination is either indexed or always available offline in order to maintain full library functionality. In both cases, the files for the destination folder are indexed and supported in libraries. These settings are configured on the server side. + +### Supported storage locations + +The following table show which locations are supported in Windows libraries. + +|Supported Locations|Unsupported Locations| +|---|---| +|Fixed local volumes (NTFS/FAT)|Removable drives| +|Shares that are indexed (departmental servers*, Windows home PCs)|Removable media (such as DVDs)

Network shares that are accessible through DFS Namespaces or are part of a failover cluster| +|Shares that are available offline (redirected folders that use Offline Files)|Network shares that aren't available offline or remotely indexed

Network Attached Storage (NAS) devices| +||Other data sources: SharePoint, Exchange, etc.| + +\* For shares that are indexed on a departmental server, Windows Search works well in workgroups or on a domain server that has similar characteristics to a workgroup server. For example, Windows Search works well on a single share departmental server with the following characteristics: + +- Expected maximum load is four concurrent query requests. +- Expected indexing corpus is a maximum of one million documents. +- Users directly access the server. That is, the server is not made available through DFS Namespaces. +- Users are not redirected to another server in case of failure. That is, server clusters are not used. + +### Library Attributes + +The following library attributes can be modified within Windows Explorer, the Library Management dialog, or the Library Description file (*.library-ms): +- Name +- Library locations +- Order of library locations +- Default save location + +The library icon can be modified by the administrator or user by directly editing the Library Description schema file. + +See the [Library Description Schema](http://go.microsoft.com/fwlink/?LinkId=159581) topic on MSDN for information on creating Library Description files. + +## See also + +### Concepts + +- [Windows Search Features ](https://technet.microsoft.com/library/dd744686.aspx) +- [Windows Indexing Features](https://technet.microsoft.com/library/dd744700.aspx) +- [Federated Search Features](https://technet.microsoft.com/library/dd744682.aspx) +- [Administrative How-to Guides](https://technet.microsoft.com/library/ee461108.aspx) +- [Group Policy for Windows Search, Browse, and Organize](https://technet.microsoft.com/library/dd744697.aspx) +- [Additional Resources for Windows Search, Browse, and Organization](https://technet.microsoft.com/library/dd744695.aspx) + +### Other resources + +- [Folder Redirection, Offline Files, and Roaming User Profiles](https://technet.microsoft.com/library/hh848267.aspx) +- [Library Description Schema](https://msdn.microsoft.com/library/dd798389.aspx) From 0b178ca1ef17ca8b186183e413008969f04dc7fc Mon Sep 17 00:00:00 2001 From: mamtakumar Date: Mon, 6 Feb 2017 15:33:07 -0800 Subject: [PATCH 86/87] Update mbam-25-supported-configurations.md Updated SQL Server database requirements table to include 1 new row at the top for support for SQL 2014 SP2 --- mdop/mbam-v25/mbam-25-supported-configurations.md | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/mdop/mbam-v25/mbam-25-supported-configurations.md b/mdop/mbam-v25/mbam-25-supported-configurations.md index 38cf7a85aa..7f215f9a1a 100644 --- a/mdop/mbam-v25/mbam-25-supported-configurations.md +++ b/mdop/mbam-v25/mbam-25-supported-configurations.md @@ -338,6 +338,12 @@ You must install SQL Server with the **SQL\_Latin1\_General\_CP1\_CI\_AS** coll + +

Microsoft SQL Server 2014

+

Standard, Enterprise, or Datacenter

+

SP2

+

64-bit

+

Microsoft SQL Server 2014

Standard, Enterprise, or Datacenter

From 2be8f358e3dd889df6ee4280ad49d5708aef3bb2 Mon Sep 17 00:00:00 2001 From: JanKeller1 Date: Tue, 7 Feb 2017 14:38:21 -0800 Subject: [PATCH 87/87] Added an intro to provide more context --- ...options-for-app-related-security-policies.md | 17 ++++++++++++++++- 1 file changed, 16 insertions(+), 1 deletion(-) diff --git a/windows/keep-secure/override-mitigation-options-for-app-related-security-policies.md b/windows/keep-secure/override-mitigation-options-for-app-related-security-policies.md index 0f98929851..b686486083 100644 --- a/windows/keep-secure/override-mitigation-options-for-app-related-security-policies.md +++ b/windows/keep-secure/override-mitigation-options-for-app-related-security-policies.md @@ -17,7 +17,22 @@ ms.sitesec: library - Windows 10, version 1607 - Windows Server 2016 -Use Group Policy to override individual **Process Mitigation Options** settings and help to enforce specific app-related security policies. +Windows 10 includes Group Policy-configurable “Process Mitigation Options” that add advanced protections against memory-based attacks, that is, attacks where malware manipulates memory to gain control of a system. For example, malware might attempt to use buffer overruns to inject malicious executable code into memory, but Process Mitigation Options can prevent the running of the malicious code. + +> [!IMPORTANT] +> We recommend trying these mitigations in a test lab before deploying to your organization, to determine if they interfere with your organization’s required apps. + +The Group Policy settings in this topic are related to three types of process mitigations. In Windows 10, all three types are on by default for 64-bit applications, but by using the Group Policy settings described in this topic, you can configure additional protections. The types of process mitigations are: + +- **Data Execution Prevention (DEP)** is a system-level memory protection feature that enables the operating system to mark one or more pages of memory as non-executable, preventing code from being run from that region of memory, to help prevent exploitation of buffer overruns. DEP helps prevent code from being run from data pages such as the default heap, stacks, and memory pools. For more information, see [Data Execution Prevention](windows-10-security-guide.md#data-execution-prevention). + +- **Structured Exception Handling Overwrite Protection (SEHOP)** is designed to block exploits that use the Structured Exception Handler (SEH) overwrite technique. Because this protection mechanism is provided at run-time, it helps to protect apps regardless of whether they have been compiled with the latest improvements. + +- **Address Space Layout Randomization (ASLR)** loads DLLs into random memory addresses at boot time to mitigate against malware that’s designed to attack specific memory locations, where specific DLLs are expected to be loaded. For more information, see [Address Space Layout Randomization](windows-10-security-guide.md#address-space-layout-randomization). + + To find additional ASLR protections in the table below, look for `IMAGES` or `ASLR`. + +The following procedure describes how to use Group Policy to override individual **Process Mitigation Options** settings. **To modify Process Mitigation Options**