mirror of
https://github.com/MicrosoftDocs/windows-itpro-docs.git
synced 2025-06-16 19:03:46 +00:00
Merge branch 'master' of https://cpubwin.visualstudio.com/_git/it-client into delop
This commit is contained in:
jaimeo
@ -37,6 +37,7 @@
|
||||
### [Save your BitLocker key](save-bitlocker-key-surface-hub.md)
|
||||
### [Connect other devices and display with Surface Hub](connect-and-display-with-surface-hub.md)
|
||||
### [Miracast on existing wireless network or LAN](miracast-over-infrastructure.md)
|
||||
### [Enable 802.1x wired authentication](enable-8021x-wired-authentication.md)
|
||||
### [Using a room control system](use-room-control-system-with-surface-hub.md)
|
||||
## [PowerShell for Surface Hub](appendix-a-powershell-scripts-for-surface-hub.md)
|
||||
## [How Surface Hub addresses Wi-Fi Direct security issues](surface-hub-wifi-direct.md)
|
||||
|
||||
@ -16,6 +16,13 @@ ms.localizationpriority: medium
|
||||
|
||||
This topic lists new and updated topics in the [Surface Hub Admin Guide]( surface-hub-administrators-guide.md).
|
||||
|
||||
## November 2017
|
||||
|
||||
New or changed topic | Description
|
||||
--- | ---
|
||||
[Enable 802.1x wired authentication](enable-8021x-wired-authentication.md) | New
|
||||
[Manage settings with an MDM provider (Surface Hub)](manage-settings-with-mdm-for-surface-hub.md) | Added settings for 802.1x wired authentication.
|
||||
|
||||
## October 2017
|
||||
|
||||
New or changed topic | Description |
|
||||
|
||||
61
devices/surface-hub/enable-8021x-wired-authentication.md
Normal file
61
devices/surface-hub/enable-8021x-wired-authentication.md
Normal file
@ -0,0 +1,61 @@
|
||||
---
|
||||
title: Enable 802.1x wired authentication
|
||||
description: 802.1x Wired Authentication MDM policies have been enabled on Surface Hub devices.
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: manage
|
||||
ms.sitesec: library
|
||||
ms.pagetype: surfacehub
|
||||
author: jdeckerms
|
||||
ms.author: jdecker
|
||||
ms.date: 11/14/2017
|
||||
ms.localizationpriority: medium
|
||||
---
|
||||
|
||||
# Enable 802.1x wired authentication
|
||||
|
||||
The [November 14, 2017 update to Windows 10](https://support.microsoft.com/help/4048954/windows-10-update-kb4048954) (build 15063.726) enables 802.1x wired authentication MDM policies on Surface Hub devices. The feature allows organizations to enforce standardized wired network authentication using the [IEEE 802.1x authentication protocol](http://www.ieee802.org/1/pages/802.1x-2010.html). This is already available for wireless authentication using WLAN profiles via MDM. This topic explains how to configure a Surface Hub for use with wired authentication.
|
||||
|
||||
Enforcement and enablement of 802.1x wired authentication on Surface Hub can be done through MDM [OMA-URI definition](https://docs.microsoft.com/intune-classic/deploy-use/windows-10-policy-settings-in-microsoft-intune#oma-uri-settings).
|
||||
|
||||
The primary configuration to set is the **LanProfile** policy. Depending on the authentication method selected, other policies may be required, either the **EapUserData** policy or through MDM policies for adding user or machine certificates (such as [ClientCertificateInstall](https://docs.microsoft.com/windows/client-management/mdm/clientcertificateinstall-csp) for user/device certificates or [RootCATrustedCertificates](https://docs.microsoft.com/windows/client-management/mdm/rootcacertificates-csp) for device certificates).
|
||||
|
||||
## LanProfile policy element
|
||||
|
||||
To configure Surface Hub to use one of the supported 802.1x authentication methods, utilize the following OMA-URI.
|
||||
|
||||
```
|
||||
./Vendor/MSFT/SurfaceHub/Dot3/LanProfile
|
||||
```
|
||||
|
||||
This OMA-URI node takes a text string of XML as a parameter. The XML provided as a parameter should conform to the [Wired LAN Profile Schema](https://msdn.microsoft.com/library/cc233002.aspx) including elements from the [802.1X schema](https://msdn.microsoft.com/library/cc233003.aspx).
|
||||
|
||||
In most instances, an administrator or user can export the LanProfile XML from an existing PC that is already configured on the network for 802.1X using this following NETSH command.
|
||||
|
||||
```
|
||||
netsh lan export profile folder=.
|
||||
```
|
||||
|
||||
Running this command will give the following output and place a file titled **Ethernet.xml** in the current directory.
|
||||
|
||||
```
|
||||
Interface: Ethernet
|
||||
Profile File Name: .\Ethernet.xml
|
||||
1 profile(s) were exported successfully.
|
||||
```
|
||||
|
||||
## EapUserData policy element
|
||||
|
||||
If your selected authentication method requires a username and password as opposed to a certificate, you can use the **EapUserData** element to specify credentials for the device to use to authenticate to the network.
|
||||
|
||||
```
|
||||
./Vendor/MSFT/SurfaceHub/Dot3/EapUserData
|
||||
```
|
||||
|
||||
This OMA-URI node takes a text string of XML as a parameter. The XML provided as a parameter should conform to the [PEAP MS-CHAPv2 User Properties example](https://msdn.microsoft.com/library/windows/desktop/bb891979). In the example, you will need to replace all instances of *test* and *ias-domain* with your information.
|
||||
|
||||
|
||||
|
||||
## Adding certificates
|
||||
|
||||
If your selected authentication method is certificate-based, you will will need to [create a provisioning package](provisioning-packages-for-surface-hub.md), [utilize MDM](https://docs.microsoft.com/windows/client-management/mdm/clientcertificateinstall-csp), or import a certificate from settings (**Settings** > **Update and Security** > **Certificates**) to deploy those certificates to your Surface Hub device in the appropriate Certificate Store. When adding certificates, each PFX must contain only one certificate (a PFX cannot have multiple certificates).
|
||||
|
||||
@ -87,6 +87,8 @@ For more information, see [SurfaceHub configuration service provider](https://ms
|
||||
| Disable auto-populating the sign-in dialog with invitees from scheduled meetings | Properties/DisableSignInSuggestions | Yes </br> | Yes.<br> [Use a custom setting.](#example-sccm) | Yes |
|
||||
| Disable "My meetings and files" feature in Start menu | Properties/DoNotShowMyMeetingsAndFiles | Yes </br> | Yes.<br> [Use a custom setting.](#example-sccm) | Yes |
|
||||
\*Settings supported with SyncML can also be configured in a Windows Configuration Designer provisioning package.
|
||||
| Set the LanProfile for 802.1x Wired Auth | Dot3/LanProfile | Yes <br> [Use a custom policy.](#example-intune) | Yes.<br> [Use a custom setting.](#example-sccm) | Yes |
|
||||
| Set the EapUserData for 802.1x Wired Auth | Dot3/EapUserData | Yes <br> [Use a custom policy.](#example-intune) | Yes.<br> [Use a custom setting.](#example-sccm) | Yes |
|
||||
|
||||
### Supported Windows 10 settings
|
||||
|
||||
|
||||
@ -38,6 +38,7 @@ Learn about managing and updating Surface Hub.
|
||||
| [Save your BitLocker key](https://technet.microsoft.com/itpro/surface-hub/save-bitlocker-key-surface-hub) | Every Surface Hub is automatically set up with BitLocker drive encryption software. Microsoft strongly recommends that you make sure you back up your BitLocker recovery keys.|
|
||||
| [Connect other devices and display with Surface Hub](https://technet.microsoft.com/itpro/surface-hub/connect-and-display-with-surface-hub) | You can connect other device to your Surface Hub to display content.|
|
||||
| [Miracast on existing wireless network or LAN](miracast-over-infrastructure.md) | You can use Miracast on your wireless network or LAN to connect to Surface Hub. |
|
||||
[Enable 802.1x wired authentication](enable-8021x-wired-authentication.md) | 802.1x Wired Authentication MDM policies have been enabled on Surface Hub devices.
|
||||
| [Using a room control system]( https://technet.microsoft.com/itpro/surface-hub/use-room-control-system-with-surface-hub) | Room control systems can be used with your Microsoft Surface Hub.|
|
||||
|
||||
## Related topics
|
||||
|
||||
@ -29,7 +29,7 @@ Review these dependencies to make sure Surface Hub features will work in your IT
|
||||
| Skype for Business (Lync Server 2013 or later, or Skype for Business Online) | Skype for Business is used for various conferencing features, like video calls, instant messaging, and screen sharing.</br></br>If screen sharing on a Surface Hub fails and the error message **An error occurred during the screen presentation** is displayed, see [Video Based Screen Sharing not working on Surface Hub](https://support.microsoft.com/help/3179272/video-based-screen-sharing-not-working-on-surface-hub) for help. |
|
||||
| Mobile device management (MDM) solution (Microsoft Intune, System Center Configuration Manager, or supported third-party MDM provider) | If you want to apply settings and install apps remotely, and to multiple devices at a time, you must set up a MDM solution and enroll the device to that solution. See [Manage settings with an MDM provider](manage-settings-with-mdm-for-surface-hub.md) for details. |
|
||||
| Microsoft Operations Managmement Suite (OMS) | OMS is used to monitor the health of Surface Hub devices. See [Monitor your Surface Hub](monitor-surface-hub.md) for details. |
|
||||
| Network and Internet access | In order to function properly, the Surface Hub should have access to a wired or wireless network. Overall, a wired connection is preferred. 802.1X Authentication is supported for both wired and wireless connections.</br></br></br>**802.1X authentication:** In Windows 10, version 1703, 802.1X authentication for wired and wireless connections is enabled by default in Surface Hub. If your organization doesn't use 802.1X authentication, there is no configuration required and Surface Hub will continue to function as normal. If you use 802.1X authentication, you must ensure that the authentication certification is installed on Surface Hub. You can deliver the certificate to Surface Hub using the [ClientCertificateInstall CSP](https://msdn.microsoft.com/windows/hardware/commercialize/customize/mdm/clientcertificateinstall-csp) in MDM, or you can [create a provisioning package](provisioning-packages-for-surface-hub.md) and install it during first run or through the Settings app. After the certificate is applied to Surface Hub, 802.1X authentication will start working automatically.</br>**Note:** Surface Hub supports 802.1X using PEAP-MSCHAPv2. We currently do not support additional EAP methods such as 802.1X using PEAP-TLS or PEAP-EAP-TLS.</br></br>**Dynamic IP:** The Surface Hub cannot be configured to use a static IP. It must use DHCP to assign an IP address.</br></br>**Proxy servers:** If your topology requires a connection to a proxy server to reach Internet services, then you can configure it during first run, or in Settings. Proxy credentials are stored across Surface Hub sessions and only need to be set once. |
|
||||
| Network and Internet access | In order to function properly, the Surface Hub should have access to a wired or wireless network. Overall, a wired connection is preferred. 802.1X Authentication is supported for both wired and wireless connections.</br></br></br>**802.1X authentication:** In Windows 10, version 1703, 802.1X authentication for wired and wireless connections is enabled by default in Surface Hub. If your organization doesn't use 802.1X authentication, there is no configuration required and Surface Hub will continue to function as normal. If you use 802.1X authentication, you must ensure that the authentication certification is installed on Surface Hub. You can deliver the certificate to Surface Hub using the [ClientCertificateInstall CSP](https://msdn.microsoft.com/windows/hardware/commercialize/customize/mdm/clientcertificateinstall-csp) in MDM, or you can [create a provisioning package](provisioning-packages-for-surface-hub.md) and install it during first run or through the Settings app. After the certificate is applied to Surface Hub, 802.1X authentication will start working automatically.</br>**Note:** For more information on enabling 802.1X wired authentication on Surface Hub, see [Enable 802.1x wired authentication](enable-8021x-wired-authentication.md).</br></br>**Dynamic IP:** The Surface Hub cannot be configured to use a static IP. It must use DHCP to assign an IP address.</br></br>**Proxy servers:** If your topology requires a connection to a proxy server to reach Internet services, then you can configure it during first run, or in Settings. Proxy credentials are stored across Surface Hub sessions and only need to be set once. |
|
||||
|
||||
Additionally, note that Surface Hub requires the following open ports:
|
||||
- HTTPS: 443
|
||||
|
||||
@ -43,7 +43,7 @@ Refunds work a little differently for free apps, and apps that have a price. In
|
||||
|
||||
There are a few requirements for apps that have a price:
|
||||
- **Timing** - Refunds are available for the first 30 days after you place your order. For example, if your order is placed on June 1, you can self-refund through June 30.
|
||||
- **Avaialable licenses** - You need to have enough available licenses to cover the number of licenses in the order you are refunding. For example, if you purchased 10 copies of an app and you want to request a refund, you must have at least 10 licenses of the app available in your inventory -- those 10 licenses can't be assigned to people in your organization.
|
||||
- **Available licenses** - You need to have enough available licenses to cover the number of licenses in the order you are refunding. For example, if you purchased 10 copies of an app and you want to request a refund, you must have at least 10 licenses of the app available in your inventory -- those 10 licenses can't be assigned to people in your organization.
|
||||
- **Whole order refunds only** - You must refund the complete amount of apps in an order. You can't refund a part of an order. For example, if you purchased 10 copies of an app, but later found you only needed 5 copies, you'll need to request a refund for the 10 apps, and then make a separate order for 5 apps. If you have had multiple orders of the same app, you can refund one order but still keep the rest of the inventory.
|
||||
|
||||
**To refund an order**
|
||||
|
||||
@ -19,7 +19,7 @@ Consider these additional features you can use after your organization deploys W
|
||||
* [Conditional access](#conditional-access)
|
||||
* [Dynamic lock](#dynamic-lock)
|
||||
* [PIN reset](#PIN-reset)
|
||||
* [Privileged workstation](#Priveleged-workstation)
|
||||
* [Privileged credentials](#Priveleged-crednetials)
|
||||
* [Mulitfactor Unlock](#Multifactor-unlock)
|
||||
|
||||
|
||||
@ -142,14 +142,14 @@ On-premises deployments provide users with the ability to reset forgotton PINs e
|
||||
>[!NOTE]
|
||||
> Visit the [Frequently Asked Questions](https://docs.microsoft.com/en-us/windows/access-protection/hello-for-business/hello-identity-verification#frequently-asked-questions) section of the Windows Hello for Business page and watch the **What happens when the user forgets their PIN?** video.
|
||||
|
||||
## Privileged Workstation
|
||||
## Privileged Credentials
|
||||
|
||||
**Requirements**
|
||||
* Hybrid and On-premises Windows Hello for Business deployments
|
||||
* Domain Joined or Hybird Azure joined devices
|
||||
* Windows 10, version 1709
|
||||
|
||||
The privileged workstation scenario enables administrators to perform elevated, admistrative funcions by enrolling both their non-privileged and privileged credentials on their device.
|
||||
The privileged credentials scenario enables administrators to perform elevated, admistrative funcions by enrolling both their non-privileged and privileged credentials on their device.
|
||||
|
||||
By design, Windows 10 does not enumerate all Windows Hello for Business users from within a user's session. Using the computer Group Policy setting, Allow enumeration of emulated smartd card for all users, you can configure a device to all this enumeration on selected devices.
|
||||
|
||||
|
||||
@ -81,7 +81,7 @@ Organizations using older directory synchronization technology, such as DirSync
|
||||
<br>
|
||||
|
||||
## Federation with Azure ##
|
||||
You can deploy Windows Hello for Business key trust in non-federated and federated environments. For non-federated envionments, key trust deployments work in environments that have deployed [Password Syncrhonization with Azure AD Connect](https://docs.microsoft.com/en-us/azure/active-directory/connect/active-directory-aadconnectsync-implement-password-synchronization) and [Azure Active Directory Pass-through-Authentication](https://docs.microsoft.com/en-us/azure/active-directory/connect/active-directory-aadconnect-pass-through-authentication). For federated envirnonments, you can deploy Windows Hello for Business key trust using Active Directory Federation Services (AD FS) 2012 R2 or later.
|
||||
You can deploy Windows Hello for Business key trust in non-federated and federated environments. For non-federated environments, key trust deployments work in environments that have deployed [Password Synchronization with Azure AD Connect](https://docs.microsoft.com/en-us/azure/active-directory/connect/active-directory-aadconnectsync-implement-password-synchronization) and [Azure Active Directory Pass-through-Authentication](https://docs.microsoft.com/en-us/azure/active-directory/connect/active-directory-aadconnect-pass-through-authentication). For federated environments, you can deploy Windows Hello for Business key trust using Active Directory Federation Services (AD FS) 2012 R2 or later.
|
||||
|
||||
### Section Review ###
|
||||
> [!div class="checklist"]
|
||||
@ -91,7 +91,7 @@ You can deploy Windows Hello for Business key trust in non-federated and federat
|
||||
<br>
|
||||
|
||||
## Multifactor Authentication ##
|
||||
Windows Hello for Business is a strong, two-factor credential the helps organizations reduce their dependency on passwords. The provisioning process lets a user enroll in Windows Hello for Business using their username and password as one factor. but needs a second factor of authentication.
|
||||
Windows Hello for Business is a strong, two-factor credential the helps organizations reduce their dependency on passwords. The provisioning process lets a user enroll in Windows Hello for Business using their username and password as one factor, but needs a second factor of authentication.
|
||||
|
||||
Hybrid Windows Hello for Business deployments can use Azure’s Multifactor Authentication service or they can use multifactor authentication provides by Windows Server 2012 R2 or later Active Directory Federation Services, which includes an adapter model that enables third parties to integrate their multifactor authentication into AD FS.
|
||||
|
||||
|
||||
@ -43,4 +43,4 @@
|
||||
##### [Configure or Deploy Multifactor Authentication Services](hello-cert-trust-deploy-mfa.md)
|
||||
#### [Configure Windows Hello for Business Policy settings](hello-cert-trust-policy-settings.md)
|
||||
|
||||
## [Windows Hello for Businesss Feature](hello-features.md)
|
||||
## [Windows Hello for Business Features](hello-features.md)
|
||||
@ -54,7 +54,7 @@ This section describes how this is done. The following diagram shows the server-
|
||||
MSDN provides much information about the Server-Server sync protocol. In particular:
|
||||
|
||||
- It is a SOAP-based protocol, and you can get the WSDL in [Server Sync Web Service](http://go.microsoft.com/fwlink/p/?LinkId=526727). The WSDL can be used to generate calling proxies for many programming environments, which will simplify your development.
|
||||
- You can find code samples in [Protocol Examples](http://go.microsoft.com/fwlink/p/?LinkId=526720). The sample code shows raw SOAP commands, which can be used. Although it’s even simpler to make the call from a programming language like .NET (calling the WSDL-generated proxies). The stub generated by the Server Sync WSDL from the MSDN link above generates an incorrect binding URL. The binding URL should be set to https://sws.update.microsoft.com/ServerSyncWebService/serversyncwebservice.asmx.
|
||||
- You can find code samples in [Protocol Examples](http://go.microsoft.com/fwlink/p/?LinkId=526720). The sample code shows raw SOAP commands, which can be used. Although it’s even simpler to make the call from a programming language like .NET (calling the WSDL-generated proxies). The stub generated by the Server Sync WSDL from the MSDN link above generates an incorrect binding URL. The binding URL should be set to https://fe2.update.microsoft.com/v6/ServerSyncWebService/serversyncwebservice.asmx.
|
||||
|
||||
Some important highlights:
|
||||
|
||||
|
||||
@ -12,7 +12,7 @@ ms.date: 11/01/2017
|
||||
# eUICCs CSP
|
||||
|
||||
|
||||
The eUICCs configuration service provider... This CSP was added in windows 10, version 1709.
|
||||
The eUICCs configuration service provider is used to support eUICC enterprise use cases and enables the IT admin to manage (assign, re-assign, remove) subscriptions to employees. This CSP was added in windows 10, version 1709.
|
||||
|
||||
The following diagram shows the eUICCs configuration service provider in tree format.
|
||||
|
||||
|
||||
Binary file not shown.
|
Before Width: | Height: | Size: 6.6 KiB After Width: | Height: | Size: 22 KiB |
@ -296,14 +296,16 @@ The deep link used for connecting your device to work will always use the follow
|
||||
|
||||
| Parameter | Description | Supported Value for Windows 10|
|
||||
|-----------|--------------------------------------------------------------|----------------------------------------------|
|
||||
| mode | Describes which mode will be executed in the enrollment app. Added in Windows 10, version 1607| “mdm” |
|
||||
| mode | Describes which mode will be executed in the enrollment app. Added in Windows 10, version 1607| “mdm”, "awa", "aadj" |
|
||||
|username | Specifies the email address or UPN of the user who should be enrolled into MDM. Added in Windows 10, version 1703. | string |
|
||||
| servername | Specifies the MDM server URL that will be used to enroll the device. Added in Windows 10, version 1703. | string|
|
||||
| accesstoken | Custom parameter for MDM servers to use as they see fit. Typically, this can be used as a token to validate the enrollment request. Added in Windows 10, version 1703. | string |
|
||||
| deviceidentifier | Custom parameter for MDM servers to use as they see fit. Typically, this can be used to pass in a unique device identifier. Added in Windows 10, version 1703. | GUID |
|
||||
| tenantidentifier | Custom parameter for MDM servers to use as they see fit. Typically, this can be used to identify which tenant the device or user belongs to. Added in Windows 10, version 1703. | GUID or string |
|
||||
| ownership | Custom parameter for MDM servers to use as they see fit. Typically, this can be used to determine whether the device is BYOD or Corp Owned. Added in Windows 10, version 1703. | 1, 2, or 3 |
|
||||
|
||||
|
||||
> **Note** "awa" and "aadj" values for mode are only supported on Windows 10, version 1709 and later.
|
||||
|
||||
|
||||
### Connecting to MDM using a deep link
|
||||
|
||||
@ -359,8 +361,7 @@ Starting in Windows 10, version 1709, clicking the **Info** button will show a l
|
||||
|
||||
|
||||
|
||||
> [!Note]
|
||||
> Starting in Windows 10, version 1709, the **Manage** button is no longer available.
|
||||
> [Note] Starting in Windows 10, version 1709, the **Manage** button is no longer available.
|
||||
|
||||
### Disconnect
|
||||
|
||||
|
||||
@ -1029,6 +1029,10 @@ For details about Microsoft mobile device management protocols for Windows 10 s
|
||||
<li>Authentication/AllowFidoDeviceSignon</li>
|
||||
<li>Browser/LockdownFavorites</li>
|
||||
<li>Browser/ProvisionFavorites</li>
|
||||
<li>Cellular/LetAppsAccessCellularData</li>
|
||||
<li>Cellular/LetAppsAccessCellularData_ForceAllowTheseApps</li>
|
||||
<li>Cellular/LetAppsAccessCellularData_ForceDenyTheseApps</li>
|
||||
<li>Cellular/LetAppsAccessCellularData_UserInControlOfTheseApps</li>
|
||||
<li>CredentialProviders/DisableAutomaticReDeploymentCredentials</li>
|
||||
<li>DeviceGuard/EnableVirtualizationBasedSecurity</li>
|
||||
<li>DeviceGuard/RequirePlatformSecurityFeatures</li>
|
||||
@ -1081,6 +1085,7 @@ For details about Microsoft mobile device management protocols for Windows 10 s
|
||||
<li>Education/PrinterNames</li>
|
||||
<li>Search/AllowCloudSearch</li>
|
||||
<li>Security/ClearTPMIfNotReady</li>
|
||||
<li>Start/HidePeopleBar</li>
|
||||
<li>Storage/AllowDiskHealthModelUpdates</li>
|
||||
<li>System/LimitEnhancedDiagnosticDataWindowsAnalytics</li>
|
||||
<li>Update/AllowAutoWindowsUpdateDownloadOverMeteredNetwork</li>
|
||||
@ -1377,6 +1382,44 @@ The DM agent for [push-button reset](https://msdn.microsoft.com/windows/hardware
|
||||
|
||||
## Change history in MDM documentation
|
||||
|
||||
### November 2017
|
||||
|
||||
<table class="mx-tdBreakAll">
|
||||
<colgroup>
|
||||
<col width="25%" />
|
||||
<col width="75%" />
|
||||
</colgroup>
|
||||
<thead>
|
||||
<tr class="header">
|
||||
<th>New or updated topic</th>
|
||||
<th>Description</th>
|
||||
</tr>
|
||||
</thead>
|
||||
<tbody>
|
||||
<tr class="odd">
|
||||
<td style="vertical-align:top">[Policy CSP](policy-configuration-service-provider.md)</td>
|
||||
<td style="vertical-align:top"><p>Added the following policies for Windows 10, version 1709:</p>
|
||||
<ul>
|
||||
<li>Authentication/AllowFidoDeviceSignon</li>
|
||||
<li>Cellular/LetAppsAccessCellularData</li>
|
||||
<li>Cellular/LetAppsAccessCellularData_ForceAllowTheseApps</li>
|
||||
<li>Cellular/LetAppsAccessCellularData_ForceDenyTheseApps</li>
|
||||
<li>Cellular/LetAppsAccessCellularData_UserInControlOfTheseApps</li>
|
||||
<li>Start/HidePeopleBar</li>
|
||||
<li>Storage/EnhancedStorageDevices</li>
|
||||
<li>Update/ManagePreviewBuilds</li>
|
||||
<li>WirelessDisplay/AllowMdnsAdvertisement</li>
|
||||
<li>WirelessDisplay/AllowMdnsDiscovery</li>
|
||||
</ul>
|
||||
<p>Added missing policies from previous releases:</p>
|
||||
<ul>
|
||||
<li>Connectivity/DisallowNetworkConnectivityActiveTest</li>
|
||||
<li>Search/AllowWindowsIndexer</li>
|
||||
</ul>
|
||||
</td></tr>
|
||||
</tbody>
|
||||
</table>
|
||||
|
||||
### October 2017
|
||||
|
||||
<table class="mx-tdBreakAll">
|
||||
@ -1402,14 +1445,6 @@ The DM agent for [push-button reset](https://msdn.microsoft.com/windows/hardware
|
||||
<li>Defender/ControlledFolderAccessAllowedApplications - string separator is |.</li>
|
||||
<li>Defender/ControlledFolderAccessProtectedFolders - string separator is |.</li>
|
||||
</ul>
|
||||
<p>Added the following policies for Windows 10, version 1709:</p>
|
||||
<ul>
|
||||
<li>Authentication/AllowFidoDeviceSignon</li>
|
||||
<li>Storage/EnhancedStorageDevices</li>
|
||||
<li>Update/ManagePreviewBuilds</li>
|
||||
<li>WirelessDisplay/AllowMdnsAdvertisement</li>
|
||||
<li>WirelessDisplay/AllowMdnsDiscovery</li>
|
||||
</ul>
|
||||
</td></tr>
|
||||
<tr class="even">
|
||||
<td style="vertical-align:top">[eUICCs CSP](euiccs-csp.md)</td>
|
||||
|
||||
@ -532,6 +532,18 @@ The following diagram shows the Policy configuration service provider in tree fo
|
||||
### Cellular policies
|
||||
|
||||
<dl>
|
||||
<dd>
|
||||
<a href="./policy-csp-cellular.md#cellular-letappsaccesscellulardata" id="cellular-letappsaccesscellulardata">Cellular/LetAppsAccessCellularData</a>
|
||||
</dd>
|
||||
<dd>
|
||||
<a href="./policy-csp-cellular.md#cellular-letappsaccesscellulardata_forceallowtheseapps" id="cellular-letappsaccesscellulardata_forceallowtheseapps">Cellular/LetAppsAccessCellularData_ForceAllowTheseApps</a>
|
||||
</dd>
|
||||
<dd>
|
||||
<a href="./policy-csp-cellular.md#cellular-letappsaccesscellulardata_forcedenytheseapps" id="cellular-letappsaccesscellulardata_forcedenytheseapps">Cellular/LetAppsAccessCellularData_ForceDenyTheseApps</a>
|
||||
</dd>
|
||||
<dd>
|
||||
<a href="./policy-csp-cellular.md#cellular-letappsaccesscellulardata_userincontroloftheseapps" id="cellular-letappsaccesscellulardata_userincontroloftheseapps">Cellular/LetAppsAccessCellularData_UserInControlOfTheseApps</a>
|
||||
</dd>
|
||||
<dd>
|
||||
<a href="./policy-csp-cellular.md#cellular-showappcellularaccessui" id="cellular-showappcellularaccessui">Cellular/ShowAppCellularAccessUI</a>
|
||||
</dd>
|
||||
@ -573,6 +585,9 @@ The following diagram shows the Policy configuration service provider in tree fo
|
||||
<dd>
|
||||
<a href="./policy-csp-connectivity.md#connectivity-disableinternetdownloadforwebpublishingandonlineorderingwizards" id="connectivity-disableinternetdownloadforwebpublishingandonlineorderingwizards">Connectivity/DisableInternetDownloadForWebPublishingAndOnlineOrderingWizards</a>
|
||||
</dd>
|
||||
<dd>
|
||||
<a href="./policy-csp-connectivity.md#connectivity-disallownetworkconnectivityactivetests" id="connectivity-disallownetworkconnectivityactivetests">Connectivity/DisallowNetworkConnectivityActiveTests</a>
|
||||
</dd>
|
||||
<dd>
|
||||
<a href="./policy-csp-connectivity.md#connectivity-hardeneduncpaths" id="connectivity-hardeneduncpaths">Connectivity/HardenedUNCPaths</a>
|
||||
</dd>
|
||||
@ -2581,6 +2596,9 @@ The following diagram shows the Policy configuration service provider in tree fo
|
||||
<dd>
|
||||
<a href="./policy-csp-start.md#start-hidelock" id="start-hidelock">Start/HideLock</a>
|
||||
</dd>
|
||||
<dd>
|
||||
<a href="./policy-csp-start.md#start-hidepeoplebar" id="start-hidepeoplebar">Start/HidePeopleBar</a>
|
||||
</dd>
|
||||
<dd>
|
||||
<a href="./policy-csp-start.md#start-hidepowerbutton" id="start-hidepowerbutton">Start/HidePowerButton</a>
|
||||
</dd>
|
||||
|
||||
@ -6,7 +6,7 @@ ms.topic: article
|
||||
ms.prod: w10
|
||||
ms.technology: windows
|
||||
author: nickbrower
|
||||
ms.date: 11/01/2017
|
||||
ms.date: 11/16/2017
|
||||
---
|
||||
|
||||
# Policy CSP - Authentication
|
||||
@ -204,16 +204,17 @@ ms.date: 11/01/2017
|
||||
|
||||
<!--EndSKU-->
|
||||
<!--StartDescription-->
|
||||
<p style="margin-left: 20px">Added in Windows 10, version 1709. Specifies whether Fast Identity Online (FIDO) device can be used to sign on.
|
||||
<p style="margin-left: 20px">Preview release in Windows 10, version 1709. Supported in the next release. Specifies whether Fast Identity Online (FIDO) device can be used to sign on. This policy enables the Windows logon credential provider for FIDO 2.0
|
||||
|
||||
<p style="margin-left: 20px">Value type is integer.
|
||||
|
||||
<p style="margin-left: 20px">Here is an example scenario: At Contoso, there are a lot of shared devices and kiosks that employees throughout the day using as many as 20 different devices. To minimize the loss in productivity when employees have to login with username and password everytime they pick up a device, the IT admin deploys SharePC CSP and Authentication/AllowFidoDeviceSignon policy to shared devices. The IT admin provisions and distributes FIDO 2.0 devices to employees, which allows them to authenticate to various shared devices and PCs.
|
||||
|
||||
<p style="margin-left: 20px">The following list shows the supported values:
|
||||
|
||||
- 0 - Do not allow. The FIDO device credential provider disabled.
|
||||
- 1 - Allow. The FIDO device credential provider is enabled and allows usage of FIDO devices to sign into an Windows.
|
||||
|
||||
<p style="margin-left: 20px">Value type is integer.
|
||||
|
||||
<!--EndDescription-->
|
||||
<!--EndPolicy-->
|
||||
<hr/>
|
||||
|
||||
@ -6,7 +6,7 @@ ms.topic: article
|
||||
ms.prod: w10
|
||||
ms.technology: windows
|
||||
author: nickbrower
|
||||
ms.date: 11/01/2017
|
||||
ms.date: 11/16/2017
|
||||
---
|
||||
|
||||
# Policy CSP - Cellular
|
||||
@ -19,11 +19,166 @@ ms.date: 11/01/2017
|
||||
## Cellular policies
|
||||
|
||||
<dl>
|
||||
<dd>
|
||||
<a href="#cellular-letappsaccesscellulardata">Cellular/LetAppsAccessCellularData</a>
|
||||
</dd>
|
||||
<dd>
|
||||
<a href="#cellular-letappsaccesscellulardata_forceallowtheseapps">Cellular/LetAppsAccessCellularData_ForceAllowTheseApps</a>
|
||||
</dd>
|
||||
<dd>
|
||||
<a href="#cellular-letappsaccesscellulardata_forcedenytheseapps">Cellular/LetAppsAccessCellularData_ForceDenyTheseApps</a>
|
||||
</dd>
|
||||
<dd>
|
||||
<a href="#cellular-letappsaccesscellulardata_userincontroloftheseapps">Cellular/LetAppsAccessCellularData_UserInControlOfTheseApps</a>
|
||||
</dd>
|
||||
<dd>
|
||||
<a href="#cellular-showappcellularaccessui">Cellular/ShowAppCellularAccessUI</a>
|
||||
</dd>
|
||||
</dl>
|
||||
|
||||
<hr/>
|
||||
<!--StartPolicy-->
|
||||
<a href="" id="cellular-letappsaccesscellulardata"></a>**Cellular/LetAppsAccessCellularData**
|
||||
|
||||
<!--StartSKU-->
|
||||
<table>
|
||||
<tr>
|
||||
<th>Home</th>
|
||||
<th>Pro</th>
|
||||
<th>Business</th>
|
||||
<th>Enterprise</th>
|
||||
<th>Education</th>
|
||||
<th>Mobile</th>
|
||||
<th>Mobile Enterprise</th>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /><sup>3</sup></td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /><sup>3</sup></td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /><sup>3</sup></td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /><sup>3</sup></td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /><sup>3</sup></td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
<!--EndSKU-->
|
||||
<!--StartDescription-->
|
||||
Added in Windows 10, version 1709. This policy setting specifies whether Windows apps can access cellular data.
|
||||
|
||||
You can specify either a default setting for all apps or a per-app setting by specifying a Package Family Name. You can get the Package Family Name for an app by using the Get-AppPackage Windows PowerShell cmdlet. A per-app setting overrides the default setting.
|
||||
|
||||
If you choose the "User is in control" option, employees in your organization can decide whether Windows apps can access cellular data by using Settings > Network - Internet > Cellular on the device.
|
||||
|
||||
If you choose the "Force Allow" option, Windows apps are allowed to access cellular data and employees in your organization cannot change it.
|
||||
|
||||
If you choose the "Force Deny" option, Windows apps are not allowed to access cellular data and employees in your organization cannot change it.
|
||||
|
||||
If you disable or do not configure this policy setting, employees in your organization can decide whether Windows apps can access cellular data by using Settings > Network - Internet > Cellular on the device.
|
||||
|
||||
If an app is open when this Group Policy object is applied on a device, employees must restart the app or device for the policy changes to be applied to the app.”
|
||||
|
||||
Suported values:
|
||||
|
||||
- 0 - User is in control
|
||||
- 1 - Force Allow
|
||||
- 2 - Force Deny
|
||||
|
||||
<!--EndDescription-->
|
||||
<!--EndPolicy-->
|
||||
<hr/>
|
||||
<!--StartPolicy-->
|
||||
<a href="" id="cellular-letappsaccesscellulardata_forceallowtheseapps"></a>**Cellular/LetAppsAccessCellularData_ForceAllowTheseApps**
|
||||
|
||||
<!--StartSKU-->
|
||||
<table>
|
||||
<tr>
|
||||
<th>Home</th>
|
||||
<th>Pro</th>
|
||||
<th>Business</th>
|
||||
<th>Enterprise</th>
|
||||
<th>Education</th>
|
||||
<th>Mobile</th>
|
||||
<th>Mobile Enterprise</th>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /><sup>3</sup></td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /><sup>3</sup></td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /><sup>3</sup></td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /><sup>3</sup></td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /><sup>3</sup></td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
<!--EndSKU-->
|
||||
<!--StartDescription-->
|
||||
Added in Windows 10, version 1709. List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are allowed access to cellular data. This setting overrides the default LetAppsAccessCellularData policy setting for the specified apps. Value type is string.
|
||||
<!--EndDescription-->
|
||||
<!--EndPolicy-->
|
||||
<hr/>
|
||||
<!--StartPolicy-->
|
||||
<a href="" id="cellular-letappsaccesscellulardata_forcedenytheseapps"></a>**Cellular/LetAppsAccessCellularData_ForceDenyTheseApps**
|
||||
|
||||
<!--StartSKU-->
|
||||
<table>
|
||||
<tr>
|
||||
<th>Home</th>
|
||||
<th>Pro</th>
|
||||
<th>Business</th>
|
||||
<th>Enterprise</th>
|
||||
<th>Education</th>
|
||||
<th>Mobile</th>
|
||||
<th>Mobile Enterprise</th>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /><sup>3</sup></td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /><sup>3</sup></td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /><sup>3</sup></td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /><sup>3</sup></td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /><sup>3</sup></td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
<!--EndSKU-->
|
||||
<!--StartDescription-->
|
||||
Added in Windows 10, version 1709. List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are denied access to cellular data. This setting overrides the default LetAppsAccessCellularData policy setting for the specified apps. Value type is string.
|
||||
<!--EndDescription-->
|
||||
<!--EndPolicy-->
|
||||
<hr/>
|
||||
<!--StartPolicy-->
|
||||
<a href="" id="cellular-letappsaccesscellulardata_userincontroloftheseapps"></a>**Cellular/LetAppsAccessCellularData_UserInControlOfTheseApps**
|
||||
|
||||
<!--StartSKU-->
|
||||
<table>
|
||||
<tr>
|
||||
<th>Home</th>
|
||||
<th>Pro</th>
|
||||
<th>Business</th>
|
||||
<th>Enterprise</th>
|
||||
<th>Education</th>
|
||||
<th>Mobile</th>
|
||||
<th>Mobile Enterprise</th>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /><sup>3</sup></td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /><sup>3</sup></td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /><sup>3</sup></td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /><sup>3</sup></td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /><sup>3</sup></td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
<!--EndSKU-->
|
||||
<!--StartDescription-->
|
||||
Added in Windows 10, version 1709. List of semi-colon delimited Package Family Names of Windows Store Apps. The user is able to control the cellular data access setting for the listed apps. This setting overrides the default LetAppsAccessCellularData policy setting for the specified apps. Value type is string.
|
||||
<!--EndDescription-->
|
||||
<!--EndPolicy-->
|
||||
<hr/>
|
||||
<!--StartPolicy-->
|
||||
<a href="" id="cellular-showappcellularaccessui"></a>**Cellular/ShowAppCellularAccessUI**
|
||||
@ -61,6 +216,16 @@ ms.date: 11/01/2017
|
||||
|
||||
<!--EndScope-->
|
||||
<!--StartDescription-->
|
||||
This policy setting configures the visibility of the link to the per-application cellular access control page in the cellular setting UX.
|
||||
|
||||
If this policy setting is enabled, a drop-down list box presenting possible values will be active. Select "Hide" or "Show" to hide or show the link to the per-application cellular access control page.
|
||||
|
||||
If this policy setting is disabled or is not configured, the link to the per-application cellular access control page is showed by default.”
|
||||
|
||||
Supported values:
|
||||
|
||||
- 0 - Hide
|
||||
- 1 - Show
|
||||
<!--EndDescription-->
|
||||
> [!TIP]
|
||||
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
|
||||
|
||||
@ -52,6 +52,9 @@ ms.date: 11/01/2017
|
||||
<dd>
|
||||
<a href="#connectivity-disableinternetdownloadforwebpublishingandonlineorderingwizards">Connectivity/DisableInternetDownloadForWebPublishingAndOnlineOrderingWizards</a>
|
||||
</dd>
|
||||
<dd>
|
||||
<a href="#connectivity-disallownetworkconnectivityactivetests">Connectivity/DisallowNetworkConnectivityActiveTests</a>
|
||||
</dd>
|
||||
<dd>
|
||||
<a href="#connectivity-hardeneduncpaths">Connectivity/HardenedUNCPaths</a>
|
||||
</dd>
|
||||
@ -156,7 +159,7 @@ ms.date: 11/01/2017
|
||||
|
||||
<p style="margin-left: 20px">The following list shows the supported values:
|
||||
|
||||
- 0 – Do not allow the cellular data channel. The user can turn it on. This value is not supported in Windows 10, version 1511.
|
||||
- 0 – Do not allow the cellular data channel. The user cannot turn it on. This value is not supported in Windows 10, version 1511.
|
||||
- 1 (default) – Allow the cellular data channel. The user can turn it off.
|
||||
- 2 - Allow the cellular data channel. The user cannot turn it off.
|
||||
|
||||
@ -203,7 +206,7 @@ ms.date: 11/01/2017
|
||||
|
||||
<p style="margin-left: 20px">The following list shows the supported values:
|
||||
|
||||
- 0 – Do not allow cellular data roaming. The user can turn it on. This value is not supported in Windows 10, version 1511.
|
||||
- 0 – Do not allow cellular data roaming. The user cannot turn it on. This value is not supported in Windows 10, version 1511.
|
||||
- 1 (default) – Allow cellular data roaming.
|
||||
- 2 - Allow cellular data roaming on. The user cannot turn it off.
|
||||
|
||||
@ -634,6 +637,41 @@ ADMX Info:
|
||||
<!--EndPolicy-->
|
||||
<hr/>
|
||||
<!--StartPolicy-->
|
||||
<a href="" id="connectivity-disallownetworkconnectivityactivetests"></a>**Connectivity/DisallowNetworkConnectivityActiveTests**
|
||||
|
||||
<!--StartSKU-->
|
||||
<table>
|
||||
<tr>
|
||||
<th>Home</th>
|
||||
<th>Pro</th>
|
||||
<th>Business</th>
|
||||
<th>Enterprise</th>
|
||||
<th>Education</th>
|
||||
<th>Mobile</th>
|
||||
<th>Mobile Enterprise</th>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /><sup>2</sup></td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /><sup>2</sup></td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /><sup>2</sup></td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /><sup>2</sup></td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
<!--EndSKU-->
|
||||
|
||||
<!--StartDescription-->
|
||||
Added in Windows 10, version 1703. Network Connection Status Indicator (NCSI) detects Internet connectivity and corporate network connectivity status. NCSI sends a DNS request and HTTP query to http://www.msftconnecttest.com/connecttest.txt to determine if the device can communicate with the Internet. This policy disables the NCSI active probe, preventing network connectivity to www.msftconnecttest.com.
|
||||
|
||||
Value type is integer.
|
||||
|
||||
<!--EndDescription-->
|
||||
<!--EndPolicy-->
|
||||
<hr/>
|
||||
<!--StartPolicy-->
|
||||
<a href="" id="connectivity-hardeneduncpaths"></a>**Connectivity/HardenedUNCPaths**
|
||||
|
||||
<!--StartSKU-->
|
||||
|
||||
@ -314,7 +314,7 @@ ms.date: 11/01/2017
|
||||
|
||||
<!--EndScope-->
|
||||
<!--StartDescription-->
|
||||
<p style="margin-left: 20px">Specifies whether to allow the user to delete the workplace account using the workplace control panel.
|
||||
<p style="margin-left: 20px">Specifies whether to allow the user to delete the workplace account using the workplace control panel. If the device is Azure Active Directory joined and MDM enrolled (e.g. auto-enrolled), which is majority of the case for Intune, then disabling the MDM unenrollment has no effect.
|
||||
|
||||
> [!NOTE]
|
||||
> The MDM server can always remotely delete the account.
|
||||
|
||||
@ -67,6 +67,9 @@ ms.date: 11/01/2017
|
||||
<dd>
|
||||
<a href="#start-hidelock">Start/HideLock</a>
|
||||
</dd>
|
||||
<dd>
|
||||
<a href="#start-hidepeoplebar">Start/HidePeopleBar</a>
|
||||
</dd>
|
||||
<dd>
|
||||
<a href="#start-hidepowerbutton">Start/HidePowerButton</a>
|
||||
</dd>
|
||||
@ -901,6 +904,41 @@ ms.date: 11/01/2017
|
||||
1. Enable policy.
|
||||
2. Open Start, click on the user tile, and verify "Lock" is not available.
|
||||
|
||||
<!--EndDescription-->
|
||||
<!--EndPolicy-->
|
||||
<hr/>
|
||||
<!--StartPolicy-->
|
||||
<a href="" id="start-hidepeoplebar"></a>**Start/HidePeopleBar**
|
||||
|
||||
<!--StartSKU-->
|
||||
<table>
|
||||
<tr>
|
||||
<th>Home</th>
|
||||
<th>Pro</th>
|
||||
<th>Business</th>
|
||||
<th>Enterprise</th>
|
||||
<th>Education</th>
|
||||
<th>Mobile</th>
|
||||
<th>Mobile Enterprise</th>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /><sup>3</sup></td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /><sup>3</sup></td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /><sup>3</sup></td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /><sup>3</sup></td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
<!--EndSKU-->
|
||||
|
||||
<!--StartDescription-->
|
||||
<p style="margin-left: 20px">Added in Windows 10, version 1709. Enabling this policy removes the people icon from the taskbar as well as the corresponding settings toggle. It also prevents users from pinning people to the taskbar.
|
||||
|
||||
<p style="margin-left: 20px">Value type is integer.
|
||||
|
||||
<!--EndDescription-->
|
||||
<!--EndPolicy-->
|
||||
<hr/>
|
||||
|
||||
@ -42,6 +42,9 @@ The doWipeProtected is functionally similar to doWipe. But unlike doWipe, which
|
||||
|
||||
Supported operation is Exec.
|
||||
|
||||
<a href="" id="doWipePersistUserData"></a>**doWipePersistUserData**
|
||||
Added in Windows 10, version 1709. Exec on this node will perform a remote reset on the device and persist user accounts and data. The return status code shows whether the device accepted the Exec command.
|
||||
|
||||
## The Remote Wipe Process
|
||||
|
||||
|
||||
|
||||
@ -17,6 +17,8 @@ This topic shows the OMA DM device description framework (DDF) for the **RemoteW
|
||||
|
||||
You can download the Windows 10 version 1607 DDF files from [here](http://download.microsoft.com/download/2/3/E/23E27D6B-6E23-4833-B143-915EDA3BDD44/Windows10_1607_DDF.zip).
|
||||
|
||||
The XML below is the DDF for Windows 10, version 1709.
|
||||
|
||||
``` syntax
|
||||
<?xml version="1.0" encoding="UTF-8"?>
|
||||
<!DOCTYPE MgmtTree PUBLIC " -//OMA//DTD-DM-DDF 1.2//EN"
|
||||
@ -108,6 +110,27 @@ You can download the Windows 10 version 1607 DDF files from [here](http://downlo
|
||||
<Description>Exec on this node will perform a remote wipe on the device and fully clean the internal drive. In some device configurations, this command may leave the device unable to boot. The return status code shows whether the device accepted the Exec command.</Description>
|
||||
</DFProperties>
|
||||
</Node>
|
||||
<Node>
|
||||
<NodeName>doWipePersistUserData</NodeName>
|
||||
<DFProperties>
|
||||
<AccessType>
|
||||
<Exec />
|
||||
</AccessType>
|
||||
<DFFormat>
|
||||
<chr />
|
||||
</DFFormat>
|
||||
<Occurrence>
|
||||
<One />
|
||||
</Occurrence>
|
||||
<Scope>
|
||||
<Permanent />
|
||||
</Scope>
|
||||
<DFType>
|
||||
<MIME>text/plain</MIME>
|
||||
</DFType>
|
||||
<Description>Exec on this node will perform a remote reset on the device and persist user accounts and data. The return status code shows whether the device accepted the Exec command.</Description>
|
||||
</DFProperties>
|
||||
</Node>
|
||||
</Node>
|
||||
</MgmtTree>
|
||||
```
|
||||
|
||||
@ -47,7 +47,7 @@ Three features enable Start and taskbar layout control:
|
||||
- The [Export-StartLayout](https://go.microsoft.com/fwlink/p/?LinkID=620879) cmdlet in Windows PowerShell exports a description of the current Start layout in .xml file format.
|
||||
|
||||
>[!NOTE]
|
||||
>To import the layout of Start to a mounted Windows image, use the [Import-StartLayout](https://go.microsoft.com/fwlink/p/?LinkId=623707) cmdlet.
|
||||
>To import the layout of Start to a mounted Windows image, use the [Import-StartLayout](https://docs.microsoft.com/powershell/module/startlayout/import-startlayout) cmdlet.
|
||||
|
||||
- [You can modify the Start .xml file](configure-windows-10-taskbar.md) to include `<CustomTaskbarLayoutCollection>` or create an .xml file just for the taskbar configuration.
|
||||
|
||||
|
||||
@ -40,7 +40,7 @@ Two features enable Start layout control:
|
||||
- The **Export-StartLayout** cmdlet in Windows PowerShell exports a description of the current Start layout in .xml file format.
|
||||
|
||||
>[!NOTE]
|
||||
>To import the layout of Start to a mounted Windows image, use the [Import-StartLayout](https://go.microsoft.com/fwlink/p/?LinkId=623707) cmdlet.
|
||||
>To import the layout of Start to a mounted Windows image, use the [Import-StartLayout](https://docs.microsoft.com/powershell/module/startlayout/import-startlayout) cmdlet.
|
||||
|
||||
|
||||
|
||||
|
||||
@ -35,7 +35,7 @@ Three features enable Start and taskbar layout control:
|
||||
- The **Export-StartLayout** cmdlet in Windows PowerShell exports a description of the current Start layout in .xml file format.
|
||||
|
||||
>[!NOTE]
|
||||
>To import the layout of Start to a mounted Windows image, use the [Import-StartLayout](https://go.microsoft.com/fwlink/p/?LinkId=623707) cmdlet.
|
||||
>To import the layout of Start to a mounted Windows image, use the [Import-StartLayout](https://docs.microsoft.com/powershell/module/startlayout/import-startlayout) cmdlet.
|
||||
|
||||
- [You can modify the Start .xml file](configure-windows-10-taskbar.md) to include `<CustomTaskbarLayoutCollection>` or create an .xml file just for the taskbar configuration.
|
||||
|
||||
|
||||
@ -22,7 +22,7 @@ Steps are provided in sections that follow the recommended setup process:
|
||||
## Device Health prerequisites
|
||||
|
||||
Device Health has the following requirements:
|
||||
1. Device Health is currently only compatible with Windows 10 devices. The solution is intended to be used with desktop devices (Windows 10 workstations and laptops).
|
||||
1. Device Health is currently only compatible with Windows 10 and Windows Server 2016 devices. The solution is intended to be used with desktop devices (Windows 10 workstations and laptops).
|
||||
2. The solution requires that at least the [enhanced level of telemetry](https://technet.microsoft.com/itpro/windows/manage/configure-windows-telemetry-in-your-organization#basic-level) is enabled on all devices that are intended to be displayed in the solution. To learn more about Windows telemetry, see [Configure Windows telemetry in your organization](/windows/configuration/configure-windows-telemetry-in-your-organization).
|
||||
3. The telemetry of your organization’s Windows devices must be successfully transmitted to Microsoft. Microsoft has specified [endpoints for each of the telemetry services](https://technet.microsoft.com/itpro/windows/manage/configure-windows-telemetry-in-your-organization#endpoints), which must be whitelisted by your organization so the data can be transmitted. The following table is taken from the article on telemetry endpoints and summarizes the use of each endpoint:
|
||||
|
||||
|
||||
@ -44,6 +44,7 @@ Use of Windows Analytics Device Health requires one of the following licenses:
|
||||
- Windows 10 Enterprise E3 or E5 per-device or per-user subscription (including Microsoft 365 F1, E3, or E5)
|
||||
- Windows 10 Education A3 or A5 (including Microsoft 365 Education A3 or A5)
|
||||
- Windows VDA E3 or E5 per-device or per-user subscription
|
||||
- Windows Server 2016 and on
|
||||
|
||||
|
||||
You don't have to install Windows 10 Enterprise on a per-device basis--you just need enough of the above licenses for the number of devices using Device Health.
|
||||
|
||||
@ -47,6 +47,6 @@ Windows as a service provides a new way to think about building, deploying, and
|
||||
|
||||
>[!TIP]
|
||||
>Windows servicing is changing, but for disaster recovery scenarios and bare-metal deployments of Windows 10, you still can use traditional imaging software such as System Center Configuration Manager or the Microsoft Deployment Toolkit. Using these tools to deploy Windows 10 images is similar to deploying previous versions of Windows.
|
||||
>With each release of a new feature update for CB, Microsoft makes available new .iso files for use in updating your custom images. Each Windows 10 build has a finite servicing lifetime, so it’s important that images stay up to date with the latest build. For detailed information about how to deploy Windows 10 to bare-metal machines or to upgrade to Windows 10 from previous builds of Windows, see [Deploy Windows 10 with System Center 2012 R2 Configuration Manager](../deploy-windows-sccm/deploy-windows-10-with-system-center-2012-r2-configuration-manager.md).
|
||||
>With each release of a new feature update for CB, Microsoft makes available new .iso files for use in updating your custom images. Each Windows 10 build has a finite servicing lifetime, so it’s important that images stay up to date with the latest build. For detailed information about how to deploy Windows 10 to bare-metal machines or to upgrade to Windows 10 from previous builds of Windows, see [Deploy Windows 10 with System Center 2012 R2 Configuration Manager](../deploy-windows-sccm/deploy-windows-10-with-system-center-2012-r2-configuration-manager.md). Additionally, Windows 10 clients can move from any supported version of Windows 10 (i.e. Version 1511) to the latest version directly (i.e 1709).
|
||||
|
||||
Not finding content you need? Windows 10 users, tell us what you want on [Feedback Hub](feedback-hub://?referrer=techDocsUcPage&tabid=2&contextid=897&newFeedback=true&topic=index.md).
|
||||
@ -29,7 +29,7 @@ With Windows Easy Transfer, files and settings can be transferred using a netwo
|
||||
### Migrate with the User State Migration Tool
|
||||
You can use USMT to automate migration during large deployments of the Windows operating system. USMT uses configurable migration rule (.xml) files to control exactly which user accounts, user files, operating system settings, and application settings are migrated and how they are migrated. You can use USMT for both *side-by-side* migrations, where one piece of hardware is being replaced, or *wipe-and-load* (or *refresh*) migrations, when only the operating system is being upgraded.
|
||||
|
||||
## Upgrade and migration monsiderations
|
||||
## Upgrade and migration considerations
|
||||
Whether you are upgrading or migrating to a new version of Windows, you must be aware of the following issues and considerations:
|
||||
|
||||
### Application compatibility
|
||||
|
||||
@ -7,7 +7,7 @@ ms.mktglfcycl: deploy
|
||||
localizationpriority: high
|
||||
ms.sitesec: library
|
||||
ms.pagetype: mdt
|
||||
ms.date: 09/05/2017
|
||||
ms.date: 11/14/2017
|
||||
author: greg-lindsay
|
||||
---
|
||||
|
||||
@ -25,7 +25,15 @@ Deployment instructions are provided for the following scenarios:
|
||||
- VMs must be running Windows 10 Pro, version 1703 (also known as the Creator's Update) or later.
|
||||
- VMs must be Active Directory-joined or Azure Active Directory-joined.
|
||||
- VMs must be generation 1.
|
||||
- VMs must hosted by a [Qualified Multitenant Hoster](https://www.microsoft.com/en-us/CloudandHosting/licensing_sca.aspx).
|
||||
- VMs must hosted by a [Qualified Multitenant Hoster](https://www.microsoft.com/en-us/CloudandHosting/licensing_sca.aspx) (QMTH).
|
||||
|
||||
## Activation
|
||||
|
||||
The underlying Windows 10 Pro license must be activated prior to Subscription Activation of Windows 10 Enterprise.
|
||||
|
||||
Procedures in this topic provide a Windows 10 Pro Generic Volume License Key (GVLK). Activation with this key is accomplished using a Volume License KMS activation server provided by the QMTH. Alternatively, a KMS activation server on your corporate network can be used if you have configured a private connection, such as [ExpressRoute](https://azure.microsoft.com/services/expressroute/) or [VPN Gateway](https://azure.microsoft.com/services/vpn-gateway/).
|
||||
|
||||
For examples of activation issues, see [Troubleshoot the user experience](https://docs.microsoft.com/windows/deployment/deploy-enterprise-licenses#troubleshoot-the-user-experience).
|
||||
|
||||
## Active Directory-joined VMs
|
||||
|
||||
|
||||
@ -92,7 +92,7 @@ Harware requirements are displayed below:
|
||||
</tr>
|
||||
<tr>
|
||||
<td BGCOLOR="#a0e4fa">**OS**</td>
|
||||
<td>Windows 8.1/10 or Windows Server 2012/2012 R2/2016<B>*</B></td>
|
||||
<td>Windows 8.1/10 or Windows Server 2012/2012 R2/2016<b>\*</b></td>
|
||||
<td>Windows 7 or a later</td>
|
||||
</tr>
|
||||
<tr>
|
||||
@ -129,7 +129,7 @@ Harware requirements are displayed below:
|
||||
</table>
|
||||
|
||||
|
||||
<B>*</B><I>The Hyper-V server role can also be installed on a computer running Windows Server 2008 R2. However, the Windows PowerShell module for Hyper-V is not available on Windows Server 2008 R2, therefore you cannot use many of the steps provided in this guide to configure Hyper-V. To manage Hyper-V on Windows Server 2008 R2, you can use Hyper-V WMI, or you can use the Hyper-V Manager console. Providing all steps in this guide as Hyper-V WMI or as 2008 R2 Hyper-V Manager procedures is beyond the scope of the guide.</I>
|
||||
<B>\*</B><I>The Hyper-V server role can also be installed on a computer running Windows Server 2008 R2. However, the Windows PowerShell module for Hyper-V is not available on Windows Server 2008 R2, therefore you cannot use many of the steps provided in this guide to configure Hyper-V. To manage Hyper-V on Windows Server 2008 R2, you can use Hyper-V WMI, or you can use the Hyper-V Manager console. Providing all steps in this guide as Hyper-V WMI or as 2008 R2 Hyper-V Manager procedures is beyond the scope of the guide.</I>
|
||||
<BR>
|
||||
<BR>The Hyper-V role cannot be installed on Windows 7 or earlier versions of Windows.
|
||||
|
||||
@ -229,7 +229,7 @@ When you have completed installation of Hyper-V on the host computer, begin conf
|
||||
|
||||
After completing registration you will be able to download the 7.47 GB Windows Server 2012 R2 evaluation VHD. An example of the download offering is shown below.
|
||||
|
||||
<TABLE BORDER=1>
|
||||
<TABLE BORDER="1">
|
||||
<tr><td>  </TD></TR>
|
||||
</TABLE>
|
||||
|
||||
@ -262,7 +262,7 @@ w10-enterprise.iso
|
||||
|
||||
>Important: Do not attempt to use the VM resulting from the following procedure as a reference image. Also, to avoid conflicts with existing clients, do not start the VM outside the PoC network.
|
||||
|
||||
<TABLE BORDER=2><tr><td>
|
||||
<TABLE BORDER="2"><tr><td>
|
||||
If you do not have a PC available to convert to VM, perform the following steps to download an evaluation VM:
|
||||
<BR>
|
||||
<OL>
|
||||
@ -292,7 +292,7 @@ When creating a VM in Hyper-V, you must specify either generation 1 or generatio
|
||||
|
||||
<div style='font-size:9.0pt'>
|
||||
|
||||
<table border=1 cellspacing="0" cellpadding="0">
|
||||
<table border="1" cellspacing="0" cellpadding="0">
|
||||
<tr>
|
||||
<td></td>
|
||||
<td>Architecture</td>
|
||||
@ -363,7 +363,7 @@ The following table displays the Hyper-V VM generation to choose based on the OS
|
||||
|
||||
<div style='font-size:9.0pt'>
|
||||
|
||||
<table border=1 cellspacing="0" cellpadding="0">
|
||||
<table border="1" cellspacing="0" cellpadding="0">
|
||||
<tr>
|
||||
<td>OS</td>
|
||||
<td>Partition style</td>
|
||||
@ -372,8 +372,8 @@ The following table displays the Hyper-V VM generation to choose based on the OS
|
||||
<td>Procedure</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td rowspan=4>Windows 7</td>
|
||||
<td rowspan=2>MBR</td>
|
||||
<td rowspan="4">Windows 7</td>
|
||||
<td rowspan="2">MBR</td>
|
||||
<td>32</td>
|
||||
<td>1</td>
|
||||
<td>[Prepare a generation 1 VM](#prepare-a-generation-1-vm)</td>
|
||||
@ -384,7 +384,7 @@ The following table displays the Hyper-V VM generation to choose based on the OS
|
||||
<td>[Prepare a generation 1 VM](#prepare-a-generation-1-vm)</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td rowspan=2>GPT</td>
|
||||
<td rowspan="2">GPT</td>
|
||||
<td>32</td>
|
||||
<td>N/A</td>
|
||||
<td>N/A</td>
|
||||
@ -395,8 +395,8 @@ The following table displays the Hyper-V VM generation to choose based on the OS
|
||||
<td>[Prepare a generation 1 VM from a GPT disk](#prepare-a-generation-1-vm-from-a-gpt-disk)</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td rowspan=4>Windows 8 or later</td>
|
||||
<td rowspan=2>MBR</td>
|
||||
<td rowspan="4">Windows 8 or later</td>
|
||||
<td rowspan="2">MBR</td>
|
||||
<td>32</td>
|
||||
<td>1</td>
|
||||
<td>[Prepare a generation 1 VM](#prepare-a-generation-1-vm)</td>
|
||||
@ -407,7 +407,7 @@ The following table displays the Hyper-V VM generation to choose based on the OS
|
||||
<td>[Prepare a generation 1 VM](#prepare-a-generation-1-vm)</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td rowspan=2>GPT</td>
|
||||
<td rowspan="2">GPT</td>
|
||||
<td>32</td>
|
||||
<td>1</td>
|
||||
<td>[Prepare a generation 1 VM from a GPT disk](#prepare-a-generation-1-vm-from-a-gpt-disk)</td>
|
||||
@ -513,7 +513,7 @@ Notes:<BR>
|
||||
|
||||
### Resize VHD
|
||||
|
||||
<HR size=4>
|
||||
<HR size="4">
|
||||
**<I>Enhanced session mode</I>**
|
||||
|
||||
**Important**: Before proceeding, verify that you can take advantage of [enhanced session mode](https://technet.microsoft.com/windows-server-docs/compute/hyper-v/learn-more/Use-local-resources-on-Hyper-V-virtual-machine-with-VMConnect) when completing instructions in this guide. Enhanced session mode enables you to copy and paste the commands from the Hyper-V host to VMs, between VMs, and between RDP sessions. After copying some text, you can paste into a Windows PowerShell window by simply right-clicking. Before right-clicking, do not left click other locations as this can empty the clipboard. You can also copy and paste <U>files</U> directly from one computer to another by right-clicking and selecting copy on one computer, then right-clicking and selecting paste on another computer.
|
||||
@ -524,7 +524,7 @@ To ensure that enhanced session mode is enabled on the Hyper-V host, type the fo
|
||||
|
||||
>If enhanced session mode was not previously enabled, close any existing virtual machine connections and re-open them to enable access to enhanced session mode. As mentioned previously: instructions to "type" commands provided in this guide can be typed, but the preferred method is to copy and paste these commands. Most of the commands to this point in the guide have been brief, but many commands in sections below are longer and more complex.
|
||||
|
||||
<HR size=4>
|
||||
<HR size="4">
|
||||
|
||||
The second Windows Server 2012 R2 VHD needs to be expanded in size from 40GB to 100GB to support installing imaging tools and storing OS images.
|
||||
|
||||
|
||||
@ -25,7 +25,7 @@
|
||||
### [Onboard endpoints and set up access](windows-defender-atp\onboard-configure-windows-defender-advanced-threat-protection.md)
|
||||
#### [Configure client endpoints](windows-defender-atp\configure-endpoints-windows-defender-advanced-threat-protection.md)
|
||||
##### [Configure endpoints using Group Policy](windows-defender-atp\configure-endpoints-gp-windows-defender-advanced-threat-protection.md)
|
||||
##### [Configure endpoints using System Security Configuration Manager](windows-defender-atp\configure-endpoints-sccm-windows-defender-advanced-threat-protection.md)
|
||||
##### [Configure endpoints using System Center Configuration Manager](windows-defender-atp\configure-endpoints-sccm-windows-defender-advanced-threat-protection.md)
|
||||
##### [Configure endpoints using Mobile Device Management tools](windows-defender-atp\configure-endpoints-mdm-windows-defender-advanced-threat-protection.md)
|
||||
###### [Configure endpoints using Microsoft Intune](windows-defender-atp\configure-endpoints-mdm-windows-defender-advanced-threat-protection.md#configure-endpoints-using-microsoft-intune)
|
||||
##### [Configure endpoints using a local script](windows-defender-atp\configure-endpoints-script-windows-defender-advanced-threat-protection.md)
|
||||
|
||||
@ -1,7 +1,7 @@
|
||||
---
|
||||
title: Windows Defender ATP data storage and privacy
|
||||
description: Learn about how Windows Defender ATP handles privacy and data that it collects.
|
||||
keywords: Windows Defender ATP data storage and privacy, storage, privacy
|
||||
keywords: Windows Defender ATP data storage and privacy, storage, privacy, licensing, geolocation, data retention, data
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
@ -17,23 +17,19 @@ ms.date: 10/17/2017
|
||||
|
||||
**Applies to:**
|
||||
|
||||
- Windows 10 Enterprise
|
||||
- Windows 10 Education
|
||||
- Windows 10 Pro
|
||||
- Windows 10 Pro Education
|
||||
- Windows Defender Advanced Threat Protection (Windows Defender ATP)
|
||||
|
||||
|
||||
|
||||
This section covers some of the most frequently asked questions regarding privacy and data handling for Windows Defender ATP.
|
||||
> [!NOTE]
|
||||
> This document explains the data storage and privacy details related to Windows Defender ATP. For more information related to Windows Defender ATP and other products and services like Windows Defender and Windows 10, see [Microsoft Privacy Statement](https://go.microsoft.com/fwlink/?linkid=827576). See also [Windows 10 privacy FAQ](https://go.microsoft.com/fwlink/?linkid=827577) for more information.
|
||||
> This document explains the data storage and privacy details related to Windows Defender ATP. For more information related to Windows Defender ATP and other products and services like Windows Defender Antivirus and Windows 10, see [Microsoft Privacy Statement](https://go.microsoft.com/fwlink/?linkid=827576). See also [Windows 10 privacy FAQ](https://go.microsoft.com/fwlink/?linkid=827577) for more information.
|
||||
|
||||
## What data does Windows Defender ATP collect?
|
||||
|
||||
Microsoft will collect and store information from your configured endpoints in a database specific to the service for administration, tracking, and reporting purposes.
|
||||
|
||||
Information collected includes code file data (such as file names, sizes, and hashes), process data (running processes, hashes), registry data, network connection data (host IPs and ports), and machine details (such as GUIDs, names, and the operating system version).
|
||||
Information collected includes file data (such as file names, sizes, and hashes), process data (running processes, hashes), registry data, network connection data (host IPs and ports), and machine details (such as machine identifiers, names, and the operating system version).
|
||||
|
||||
Microsoft stores this data securely in Microsoft Azure and maintains it in accordance with Microsoft privacy practices and [Microsoft Trust Center policies](https://go.microsoft.com/fwlink/?linkid=827578).
|
||||
|
||||
@ -42,11 +38,11 @@ Microsoft uses this data to:
|
||||
- Generate alerts if a possible attack was detected
|
||||
- Provide your security operations with a view into machines, files, and URLs related to threat signals from your network, enabling you to investigate and explore the presence of security threats on the network.
|
||||
|
||||
Microsoft does not mine your data for advertising or for any other purpose other than providing you the service.
|
||||
Microsoft does not use your data for advertising or for any other purpose other than providing you the service.
|
||||
|
||||
## Do I have the flexibility to select where to store my data?
|
||||
|
||||
When onboarding the service for the first time, you can choose to store your data in Microsoft Azure datacenters in Europe or United States. Once configured, you cannot change the location where your data is stored. This provides a convenient way to minimize compliance risk by actively selecting the geographic locations where your data will reside. Microsoft will not transfer the data from the specified geolocation.
|
||||
When onboarding the service for the first time, you can choose to store your data in Microsoft Azure datacenters in Europe or in the United States. Once configured, you cannot change the location where your data is stored. This provides a convenient way to minimize compliance risk by actively selecting the geographic locations where your data will reside. Microsoft will not under any circumstance, transfer the data from the specified geolocation into another geolocation.
|
||||
|
||||
## Is my data isolated from other customer data?
|
||||
Yes, your data is isolated through access authentication and logical segregation based on customer identifier. Each customer can only access data collected from its own organization and generic data that Microsoft provides.
|
||||
@ -69,7 +65,7 @@ No. Customer data is isolated from other customers and is not shared. However, i
|
||||
You can choose the data retention policy for your data. This determines how long Window Defender ATP will store your data. There’s a flexibility of choosing in the range of 1 month to six months to meet your company’s regulatory compliance needs.
|
||||
|
||||
**At contract termination or expiration**<br>
|
||||
Your data will be kept for a period of at least 90 days, during which it will be available to you. At the end of this period, that data will be erased from Microsoft’s systems to make it unrecoverable, no later than 180 days from contract termination or expiration.
|
||||
Your data will be kept and will be available to you while the licence is under grace period or suspended mode. At the end of this period, that data will be erased from Microsoft’s systems to make it unrecoverable, no later than 180 days from contract termination or expiration.
|
||||
|
||||
|
||||
## Can Microsoft help us maintain regulatory compliance?
|
||||
|
||||
@ -53,7 +53,7 @@ Enable security information and event management (SIEM) integration so you can p
|
||||
5. Select **Generate tokens** to get an access and refresh token.
|
||||
|
||||
> [!NOTE]
|
||||
> You'll need to generate a new Access token every 90 days.
|
||||
> You'll need to generate a new Refresh token every 90 days.
|
||||
|
||||
You can now proceed with configuring your SIEM solution or connecting to the alerts REST API through programmatic access. You'll need to use the tokens when configuring your SIEM solution to allow it to receive alerts from the Windows Defender ATP portal.
|
||||
|
||||
|
||||
@ -66,7 +66,7 @@ The hardware requirements for Windows Defender ATP on endpoints is the same as t
|
||||
> Endpoints that are running mobile versions of Windows are not supported.
|
||||
|
||||
#### Internet connectivity
|
||||
Internet connectivity on endpoints is required.
|
||||
Internet connectivity on endpoints is required either directly or through proxy.
|
||||
|
||||
The Windows Defender ATP sensor can utilize up to 5MB daily of bandwidth to communicate with the Windows Defender ATP cloud service and report cyber data.
|
||||
|
||||
|
||||
@ -31,7 +31,7 @@ ms.date: 10/17/2017
|
||||
You can take response actions on machines and files to quickly respond to detected attacks so that you can contain or reduce and prevent further damage caused by malicious attackers in your organization.
|
||||
|
||||
>[!NOTE]
|
||||
> These response actions are only available for machines on Windows 10, version 1703.
|
||||
> These response actions are only available for machines on Windows 10, version 1703 or higher.
|
||||
|
||||
## In this section
|
||||
Topic | Description
|
||||
|
||||
@ -29,6 +29,9 @@ ms.date: 10/17/2017
|
||||
|
||||
The Security Analytics dashboard expands your visibility into the overall security posture of your organization. From this dashboard, you'll be able to quickly assess the security posture of your organization, see machines that require attention, as well as recommendations for actions to further reduce the attack surface in your organization - all in one place. From there you can take action based on the recommended configuration baselines.
|
||||
|
||||
>[!IMPORTANT]
|
||||
> This feature is available for machines on Windows 10, version 1703 or later.
|
||||
|
||||
The **Security analytics dashboard** displays a snapshot of:
|
||||
- Organizational security score
|
||||
- Security coverage
|
||||
|
||||
@ -106,7 +106,7 @@ Topic | Description
|
||||
[Windows Defender ATP service health](service-status-windows-defender-advanced-threat-protection.md) | Verify that the service health is running properly or if there are current issues.
|
||||
[Troubleshoot Windows Defender Advanced Threat Protection](troubleshoot-windows-defender-advanced-threat-protection.md) | This topic contains information to help IT Pros find workarounds for the known issues and troubleshoot issues in Windows Defender ATP.
|
||||
[Review events and errors on endpoints with Event Viewer](event-error-codes-windows-defender-advanced-threat-protection.md)| Review events and errors associated with event IDs to determine if further troubleshooting steps are required.
|
||||
[Windows Defender compatibility](defender-compatibility-windows-defender-advanced-threat-protection.md) | Learn about how Windows Defender works in conjunction with Windows Defender ATP.
|
||||
[Windows Defender Antivirus compatibility with Windows Defender ATP](defender-compatibility-windows-defender-advanced-threat-protection.md) | Learn about how Windows Defender Antivirus works in conjunction with Windows Defender ATP.
|
||||
|
||||
## Related topic
|
||||
[Windows Defender ATP helps detect sophisticated threats](https://www.microsoft.com/itshowcase/Article/Content/854/Windows-Defender-ATP-helps-detect-sophisticated-threats)
|
||||
|
||||
Reference in New Issue
Block a user