diff --git a/windows/deployment/upgrade/resolve-windows-10-upgrade-errors.md b/windows/deployment/upgrade/resolve-windows-10-upgrade-errors.md index 71202e04e6..7c3caa7d84 100644 --- a/windows/deployment/upgrade/resolve-windows-10-upgrade-errors.md +++ b/windows/deployment/upgrade/resolve-windows-10-upgrade-errors.md @@ -7,6 +7,7 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: deploy author: greg-lindsay +ms.date: 10/10/2017 ms.localizationpriority: high --- @@ -21,8 +22,8 @@ ms.localizationpriority: high This topic contains a brief introduction to Windows 10 installation processes, and provides resolution procedures that IT administrators can use to resolve issues with Windows 10 upgrade. The following sections and procedures are provided in this guide: -- [The Windows 10 upgrade process](#the-windows-10-upgrade-process): An explanation of phases used during the upgrade process.
-- [Quick fixes](#quick-fixes): Steps you can take to eliminate many Windows upgrade errors.
+- [The Windows 10 upgrade process](#the-windows-10-upgrade-process): An explanation of phases used during the upgrade process.
+- [Quick fixes](#quick-fixes): Steps you can take to eliminate many Windows upgrade errors.
- [Upgrade error codes](#upgrade-error-codes): The components of an error code are explained. - [Result codes](#result-codes): Information about result codes. - [Extend codes](#extend-codes): Information about extend codes. @@ -53,15 +54,15 @@ The Windows Setup application is used to upgrade a computer to Windows 10, or to ![Upgrade process](../images/upgrade-process.png) -DU = Driver/device updates.
-OOBE = Out of box experience.
+DU = Driver/device updates.
+OOBE = Out of box experience.
WIM = Windows image (Microsoft) ## Quick fixes The following steps can resolve many Windows upgrade problems. -
    +
    1. Remove nonessential external hardware, such as docks and USB devices.
    2. Check all hard drives for errors and attempt repairs. To automatically repair hard drives, open an elevated command prompt, switch to the drive you wish to repair, and type the following command. You will be required to reboot the computer if the hard drive being repaired is also the system drive.
        @@ -100,13 +101,13 @@ Note: If only a result code is returned, this can be because a tool is being use ### Result codes ->A result code of **0xC1900101** is generic and indicates that a rollback occurred. In most cases, the cause is a driver compatibility issue.
        To troubleshoot a failed upgrade that has returned a result code of 0xC1900101, analyze the extend code to determine the Windows Setup phase, and see the [Resolution procedures](#resolution-procedures) section later in this topic. +>A result code of **0xC1900101** is generic and indicates that a rollback occurred. In most cases, the cause is a driver compatibility issue.
        To troubleshoot a failed upgrade that has returned a result code of 0xC1900101, analyze the extend code to determine the Windows Setup phase, and see the [Resolution procedures](#resolution-procedures) section later in this topic. Result codes can be matched to the type of error encountered. To match a result code to an error: 1. Identify the error code type, either Win32 or NTSTATUS, using the first hexidecimal digit: -
        8 = Win32 error code (ex: 0x**8**0070070) -
        C = NTSTATUS value (ex: 0x**C**1900107) +
        8 = Win32 error code (ex: 0x**8**0070070) +
        C = NTSTATUS value (ex: 0x**C**1900107) 2. Write down the last 4 digits of the error code (ex: 0x8007**0070** = 0070). These digits correspond to the last 16 bits of the [HRESULT](https://msdn.microsoft.com/en-us/library/cc231198.aspx) or the [NTSTATUS](https://msdn.microsoft.com/en-us/library/cc231200.aspx) structure. 3. Based on the type of error code determined in the first step, match the 4 digits derived from the second step to either a [Win32 error code](https://msdn.microsoft.com/en-us/library/cc231199.aspx), or an [NTSTATUS value](https://msdn.microsoft.com/en-us/library/cc704588.aspx). @@ -128,64 +129,67 @@ Extend codes can be matched to the phase and operation when an error occurred. T The following tables provide the corresponding phase and operation for values of an extend code: - - -
        Extend code: phase
        HexPhase -
        0SP_EXECUTION_UNKNOWN -
        1SP_EXECUTION_DOWNLEVEL -
        2SP_EXECUTION_SAFE_OS -
        3SP_EXECUTION_FIRST_BOOT -
        4SP_EXECUTION_OOBE_BOOT -
        5SP_EXECUTION_UNINSTALL -
        +
        - - - - - -
        Extend code: operation
        - -
        HexOperation -
        0SP_EXECUTION_OP_UNKNOWN -
        1SP_EXECUTION_OP_COPY_PAYLOAD -
        2SP_EXECUTION_OP_DOWNLOAD_UPDATES -
        3SP_EXECUTION_OP_INSTALL_UPDATES -
        4SP_EXECUTION_OP_INSTALL_RECOVERY_ENVIRONMENT -
        5SP_EXECUTION_OP_INSTALL_RECOVERY_IMAGE -
        6SP_EXECUTION_OP_REPLICATE_OC -
        7SP_EXECUTION_OP_INSTALL_DRVIERS -
        8SP_EXECUTION_OP_PREPARE_SAFE_OS -
        9SP_EXECUTION_OP_PREPARE_ROLLBACK -
        ASP_EXECUTION_OP_PREPARE_FIRST_BOOT -
        BSP_EXECUTION_OP_PREPARE_OOBE_BOOT -
        CSP_EXECUTION_OP_APPLY_IMAGE -
        DSP_EXECUTION_OP_MIGRATE_DATA -
        ESP_EXECUTION_OP_SET_PRODUCT_KEY -
        FSP_EXECUTION_OP_ADD_UNATTEND -
        -        		 - -
        HexOperation -
        10SP_EXECUTION_OP_ADD_DRIVER -
        11SP_EXECUTION_OP_ENABLE_FEATURE -
        12SP_EXECUTION_OP_DISABLE_FEATURE -
        13SP_EXECUTION_OP_REGISTER_ASYNC_PROCESS -
        14SP_EXECUTION_OP_REGISTER_SYNC_PROCESS -
        15SP_EXECUTION_OP_CREATE_FILE -
        16SP_EXECUTION_OP_CREATE_REGISTRY -
        17SP_EXECUTION_OP_BOOT -
        18SP_EXECUTION_OP_SYSPREP -
        19SP_EXECUTION_OP_OOBE -
        1ASP_EXECUTION_OP_BEGIN_FIRST_BOOT -
        1BSP_EXECUTION_OP_END_FIRST_BOOT -
        1CSP_EXECUTION_OP_BEGIN_OOBE_BOOT -
        1DSP_EXECUTION_OP_END_OOBE_BOOT -
        1ESP_EXECUTION_OP_PRE_OOBE -
        1FSP_EXECUTION_OP_POST_OOBE -
        20SP_EXECUTION_OP_ADD_PROVISIONING_PACKAGE -
        -
        + + +
        Extend code: phase
        HexPhase +
        0SP_EXECUTION_UNKNOWN +
        1SP_EXECUTION_DOWNLEVEL +
        2SP_EXECUTION_SAFE_OS +
        3SP_EXECUTION_FIRST_BOOT +
        4SP_EXECUTION_OOBE_BOOT +
        5SP_EXECUTION_UNINSTALL +
        + + + + + + + +
        Extend code: operation
        + +
        HexOperation +
        0SP_EXECUTION_OP_UNKNOWN +
        1SP_EXECUTION_OP_COPY_PAYLOAD +
        2SP_EXECUTION_OP_DOWNLOAD_UPDATES +
        3SP_EXECUTION_OP_INSTALL_UPDATES +
        4SP_EXECUTION_OP_INSTALL_RECOVERY_ENVIRONMENT +
        5SP_EXECUTION_OP_INSTALL_RECOVERY_IMAGE +
        6SP_EXECUTION_OP_REPLICATE_OC +
        7SP_EXECUTION_OP_INSTALL_DRVIERS +
        8SP_EXECUTION_OP_PREPARE_SAFE_OS +
        9SP_EXECUTION_OP_PREPARE_ROLLBACK +
        ASP_EXECUTION_OP_PREPARE_FIRST_BOOT +
        BSP_EXECUTION_OP_PREPARE_OOBE_BOOT +
        CSP_EXECUTION_OP_APPLY_IMAGE +
        DSP_EXECUTION_OP_MIGRATE_DATA +
        ESP_EXECUTION_OP_SET_PRODUCT_KEY +
        FSP_EXECUTION_OP_ADD_UNATTEND +
        +        		 + +
        HexOperation +
        10SP_EXECUTION_OP_ADD_DRIVER +
        11SP_EXECUTION_OP_ENABLE_FEATURE +
        12SP_EXECUTION_OP_DISABLE_FEATURE +
        13SP_EXECUTION_OP_REGISTER_ASYNC_PROCESS +
        14SP_EXECUTION_OP_REGISTER_SYNC_PROCESS +
        15SP_EXECUTION_OP_CREATE_FILE +
        16SP_EXECUTION_OP_CREATE_REGISTRY +
        17SP_EXECUTION_OP_BOOT +
        18SP_EXECUTION_OP_SYSPREP +
        19SP_EXECUTION_OP_OOBE +
        1ASP_EXECUTION_OP_BEGIN_FIRST_BOOT +
        1BSP_EXECUTION_OP_END_FIRST_BOOT +
        1CSP_EXECUTION_OP_BEGIN_OOBE_BOOT +
        1DSP_EXECUTION_OP_END_OOBE_BOOT +
        1ESP_EXECUTION_OP_PRE_OOBE +
        1FSP_EXECUTION_OP_POST_OOBE +
        20SP_EXECUTION_OP_ADD_PROVISIONING_PACKAGE +
        +
        For example: An extend code of **0x4000D**, represents a problem during phase 4 (**0x4**) with data migration (**000D**). @@ -193,45 +197,38 @@ For example: An extend code of **0x4000D**, represents a problem during phase 4 Several log files are created during each phase of the upgrade process. These log files are essential for troubleshooting upgrade problems. By default, the folders that contain these log files are hidden on the upgrade target computer. To view the log files, configure Windows Explorer to view hidden items, or use a tool to automatically gather these logs. The most useful log is **setupact.log**. The log files are located in a different folder depending on the Windows Setup phase. Recall that you can determine the phase from the extend code. -

        The following table describes some log files and how to use them for troubleshooting purposes: +The following table describes some log files and how to use them for troubleshooting purposes:
        - - -
        Log filePhase: LocationDescriptionWhen to use +
        -
        setupact.logDown-Level:
        $Windows.~BT\Sources\Panther        		Contains information about setup actions during the downlevel phase. -All down-level failures and starting point for rollback investigations.
        This is the most important log for diagnosing setup issues. -
        OOBE:
        $Windows.~BT\Sources\Panther\UnattendGC -        		Contains information about actions during the OOBE phase.Investigating rollbacks that failed during OOBE phase and operations – 0x4001C, 0x4001D, 0x4001E, 0x4001F. -
        Rollback:
        $Windows.~BT\Sources\Rollback        		Contains information about actions during rollback.Investigating generic rollbacks - 0xC1900101. -
        Pre-initialization (prior to downlevel):
        Windows        		Contains information about initializing setup.If setup fails to launch. -
        Post-upgrade (after OOBE):
        Windows\Panther        		Contains information about setup actions during the installation.Investigate post-upgrade related issues. - -
        setuperr.logSame as setupact.logContains information about setup errors during the installation.Review all errors encountered during the installation phase. - -
        miglog.xmlPost-upgrade (after OOBE):
        Windows\Panther        		Contains information about what was migrated during the installation.Identify post upgrade data migration issues. - -
        BlueBox.logDown-Level:
        Windows\Logs\Mosetup        		Contains information communication between setup.exe and Windows Update.Use during WSUS and WU down-level failures or for 0xC1900107. - -
        Supplemental rollback logs:
        -Setupmem.dmp
        -setupapi.dev.log
        -Event logs (*.evtx) - - -        		$Windows.~BT\Sources\RollbackAdditional logs collected during rollback. - -Setupmem.dmp: If OS bugchecks during upgrade, setup will attempt to extract a mini-dump.
        -Setupapi: Device install issues - 0x30018
        -Event logs: Generic rollbacks (0xC1900101) or unexpected reboots. - -
        + + + + + + + + + + + + + + + +
        Log filePhase: LocationDescriptionWhen to use
        setupact.logDown-Level:
        $Windows.~BT\Sources\Panther        		Contains information about setup actions during the downlevel phase. All down-level failures and starting point for rollback investigations.
        This is the most important log for diagnosing setup issues.
        OOBE:
        $Windows.~BT\Sources\Panther\UnattendGC        		Contains information about actions during the OOBE phase.Investigating rollbacks that failed during OOBE phase and operations – 0x4001C, 0x4001D, 0x4001E, 0x4001F.
        Rollback:
        $Windows.~BT\Sources\Rollback        		Contains information about actions during rollback.Investigating generic rollbacks - 0xC1900101.
        Pre-initialization (prior to downlevel):
        Windows        		Contains information about initializing setup.If setup fails to launch.
        Post-upgrade (after OOBE):
        Windows\Panther        		Contains information about setup actions during the installation.Investigate post-upgrade related issues.
        setuperr.logSame as setupact.logContains information about setup errors during the installation.Review all errors encountered during the installation phase.
        miglog.xmlPost-upgrade (after OOBE):
        Windows\Panther        		Contains information about what was migrated during the installation.Identify post upgrade data migration issues.
        BlueBox.logDown-Level:
        Windows\Logs\Mosetup        		Contains information communication between setup.exe and Windows Update.Use during WSUS and WU down-level failures or for 0xC1900107.
        Supplemental rollback logs:
        +Setupmem.dmp
        +setupapi.dev.log
        +Event logs (*.evtx)        		$Windows.~BT\Sources\RollbackAdditional logs collected during rollback. +Setupmem.dmp: If OS bugchecks during upgrade, setup will attempt to extract a mini-dump.
        +Setupapi: Device install issues - 0x30018
        +Event logs: Generic rollbacks (0xC1900101) or unexpected reboots.
        ### Log entry structure A setupact.log or setuperr.log entry includes the following elements: -

          +
          1. The date and time - 2016-09-08 09:20:05.
          2. The log level - Info, Warning, Error, Fatal Error.
          3. The logging component - CONX, MOUPG, PANTHR, SP, IBSLIB, MIG, DISM, CSI, CBS. @@ -252,9 +249,9 @@ See the following example: >The following instructions are meant for IT professionals. Also see the [Upgrade error codes](#upgrade-error-codes) section in this guide to familiarize yourself with [result codes](#result-codes) and [extend codes](#extend-codes). -

            To analyze Windows Setup log files: +
            To analyze Windows Setup log files: -

              +
              1. Determine the Windows Setup error code. This code should be returned by Windows Setup if it is not successful with the upgrade process.
              2. Based on the [extend code](#extend-codes) portion of the error code, determine the type and location of a [log files](#log-files) to investigate.
              3. Open the log file in a text editor, such as notepad. @@ -262,11 +259,11 @@ See the following example:
              4. To find the last occurrence of the result code:
                1. Scroll to the bottom of the file and click after the last character. -
                2. Click **Edit**. -
                3. Click **Find**. +
                4. Click Edit. +
                5. Click Find.
                6. Type the result code. -
                7. Under **Direction** select **Up**. -
                8. Click **Find Next**. +
                9. Under Direction select Up. +
                10. Click Find Next.
              5. When you have located the last occurrence of the result code, scroll up a few lines from this location in the file and review the processes that failed just prior to generating the result code.
              6. Search for the following important text strings: @@ -283,7 +280,7 @@ For example, assume that the error code for an error is 0x8007042B - 0x2000D. Se >Some lines in the text below are shortened to enhance readability. The date and time at the start of each line (ex: 2016-10-05 15:27:08) is shortened to minutes and seconds, and the certificate file name which is a long text string is shortened to just "CN." -

                setuperr.log content: +
                setuperr.log content: 

                 27:08, Error           SP     Error READ, 0x00000570 while gathering/applying object: File, C:\ProgramData\Microsoft\Crypto\RSA\S-1-5-18 [CN]. Will return 0[gle=0x00000570]
@@ -306,7 +303,7 @@ The first line indicates there was an error **0x00000570** with the file **C:\Pr
 
 Therefore, Windows Setup failed because it was not able to migrate the corrupt file **C:\ProgramData\Microsoft\Crypto\RSA\S-1-5-18\[CN]**.  This file is a local system certificate and can be safely deleted. Searching the setupact.log file for additional details, the phrase "Shell application requested abort" is found in a location with the same timestamp as the lines in setuperr.log. This confirms our suspicion that this file is the cause of the upgrade failure:
 
-
                setupact.log content:
+
                setupact.log content:
 
 
                 27:00, Info                   Gather started at 10/5/2016 23:27:00
@@ -329,15 +326,16 @@ Therefore, Windows Setup failed because it was not able to migrate the corrupt f
 27:08, Info                   Gather ended at 10/5/2016 23:27:08 with result 44
 27:08, Info                   Leaving MigGather method
 27:08, Error           SP     SPDoFrameworkGather: Gather operation failed. Error: 0x0000002C
-
                
+
                -

                This analysis indicates that the Windows upgrade error can be resolved by deleting the C:\ProgramData\Microsoft\Crypto\RSA\S-1-5-18\[CN] file. Note: In this example, the full, unshortened file name is C:\ProgramData\Microsoft\Crypto\RSA\S-1-5-18\be8228fb2d3cb6c6b0ccd9ad51b320b4_a43d512c-69f2-42de-aef9-7a88fabdaa3f. + +
                This analysis indicates that the Windows upgrade error can be resolved by deleting the C:\ProgramData\Microsoft\Crypto\RSA\S-1-5-18\[CN] file. Note: In this example, the full, unshortened file name is C:\ProgramData\Microsoft\Crypto\RSA\S-1-5-18\be8228fb2d3cb6c6b0ccd9ad51b320b4_a43d512c-69f2-42de-aef9-7a88fabdaa3f. ## Resolution procedures ### 0xC1900101 -A frequently observed result code is 0xC1900101. This result code can be thrown at any stage of the upgrade process, with the exception of the downlevel phase. 0xC1900101 is a generic rollback code, and usually indicates that an incompatible driver is present. The incompatible driver can cause blue screens, system hangs, and unexpected reboots. Analysis of supplemental log files is often helpful, such as:
                +A frequently observed result code is 0xC1900101. This result code can be thrown at any stage of the upgrade process, with the exception of the downlevel phase. 0xC1900101 is a generic rollback code, and usually indicates that an incompatible driver is present. The incompatible driver can cause blue screens, system hangs, and unexpected reboots. Analysis of supplemental log files is often helpful, such as:
                - The minidump file: $Windows.~bt\Sources\Rollback\setupmem.dmp, - Event logs: $Windows.~bt\Sources\Rollback\*.evtx @@ -345,346 +343,346 @@ A frequently observed result code is 0xC1900101. This result code can be thrown The device install log is particularly helpful if rollback occurs during the sysprep operation (extend code 0x30018). To resolve a rollback due to driver conflicts, try running setup using a minimal set of drivers and startup programs by performing a [clean boot](https://support.microsoft.com/en-us/kb/929135) before initiating the upgrade process. -

                See the following general troubleshooting procedures associated with a result code of 0xC1900101: +
                See the following general troubleshooting procedures associated with a result code of 0xC1900101: - +
                - +
                +
                - -
                Code -
                0xC1900101 - 0x20004 -
                + +
                Code +
                0xC1900101 - 0x20004 +
                -

                -
                Cause -
                Windows Setup encountered an error during the SAFE_OS with the INSTALL_RECOVERY_ENVIRONMENT operation -
                This is generally caused by out-of-date drivers. -
                -

                +
                Cause +
                Windows Setup encountered an error during the SAFE_OS with the INSTALL_RECOVERY_ENVIRONMENT operation +
                This is generally caused by out-of-date drivers. +
                + - + - -
                Mitigation -
                Uninstall antivirus applications. -
                Remove all unused SATA devices. -
                Remove all unused devices and drivers. -
                Update drivers and BIOS. -
                - - + +
                Mitigation +
                Uninstall antivirus applications. +
                Remove all unused SATA devices. +
                Remove all unused devices and drivers. +
                Update drivers and BIOS. +
                + + - + - -
                Code -
                0xC1900101 - 0x2000c -
                + +
                Code +
                0xC1900101 - 0x2000c +
                -

                -
                Cause -
                Windows Setup encountered an unspecified error during Wim apply in the WinPE phase. -
                This is generally caused by out-of-date drivers. -
                - +
                +
                Cause +
                Windows Setup encountered an unspecified error during Wim apply in the WinPE phase. +
                This is generally caused by out-of-date drivers. +
                + - + - -
                Mitigation -
                Disconnect all peripheral devices that are connected to the system, except for the mouse, keyboard and display. -
                Contact your hardware vendor to obtain updated device drivers. -
                Ensure that "Download and install updates (recommended)" is accepted at the start of the upgrade process. -
                - - + +
                Mitigation +
                Disconnect all peripheral devices that are connected to the system, except for the mouse, keyboard and display. +
                Contact your hardware vendor to obtain updated device drivers. +
                Ensure that "Download and install updates (recommended)" is accepted at the start of the upgrade process. +
                + + - + - -
                Code -
                0xC1900101 - 0x20017 + +
                Code +
                0xC1900101 - 0x20017 -
                +
                -

                -
                Cause -
                A driver has caused an illegal operation. -
                Windows was not able to migrate the driver, resulting in a rollback of the operating system. -

                This is a safeOS boot failure, typically caused by drivers or non-Microsoft disk encryption software. -

                - +
                +
                Cause +
                A driver has caused an illegal operation. +
                Windows was not able to migrate the driver, resulting in a rollback of the operating system. +
                This is a safeOS boot failure, typically caused by drivers or non-Microsoft disk encryption software. +
                + - + - - - +
                For more information, see [Understanding Failures and Log Files](https://technet.microsoft.com/en-us/library/ee851579.aspx). +
                Update or uninstall the problem drivers. +
                Mitigation -
                -Ensure that all that drivers are updated.
                + +
                Mitigation +
                +Ensure that all that drivers are updated.
                Open the Setuperr.log and Setupact.log files in the %windir%\Panther directory, and then locate the problem drivers. -
                For more information, see [Understanding Failures and Log Files](https://technet.microsoft.com/en-us/library/ee851579.aspx). -
                Update or uninstall the problem drivers. -
                -
                + + - + - -
                Code -
                0xC1900101 - 0x30018 -
                + +
                Code +
                0xC1900101 - 0x30018 +
                -

                -
                Cause -
                A device driver has stopped responding to setup.exe during the upgrade process. -
                - +
                +
                Cause +
                A device driver has stopped responding to setup.exe during the upgrade process. +
                + - + - - - +
                Contact your hardware vendor to obtain updated device drivers. +
                Ensure that "Download and install updates (recommended)" is accepted at the start of the upgrade process. +
                Mitigation -
                + +
                Mitigation +
                Disconnect all peripheral devices that are connected to the system, except for the mouse, keyboard and display. -
                Contact your hardware vendor to obtain updated device drivers. -
                Ensure that "Download and install updates (recommended)" is accepted at the start of the upgrade process. -
                -
                + + - + - -
                Code -
                0xC1900101 - 0x3000D -
                + +
                Code +
                0xC1900101 - 0x3000D +
                -

                - +
                Cause -
                Installation failed during the FIRST_BOOT phase while attempting the MIGRATE_DATA operation. -
                This can occur due to a problem with a display driver. +
                +
                Cause +
                Installation failed during the FIRST_BOOT phase while attempting the MIGRATE_DATA operation. +
                This can occur due to a problem with a display driver. -
                -
                + - + - - - +
                Update or uninstall the display driver. +
                Mitigation -
                + +
                Mitigation +
                Disconnect all peripheral devices that are connected to the system, except for the mouse, keyboard and display. -
                Update or uninstall the display driver. -
                -
                + + - + - -
                Code -
                0xC1900101 - 0x4000D -
                + +
                Code +
                0xC1900101 - 0x4000D +
                -

                - +
                Cause -
                A rollback occurred due to a driver configuration issue. -

                Installation failed during the second boot phase while attempting the MIGRATE_DATA operation. +
                +
                Cause +
                A rollback occurred due to a driver configuration issue. +
                Installation failed during the second boot phase while attempting the MIGRATE_DATA operation. -

                This can occur due to incompatible drivers. +
                This can occur due to incompatible drivers. -

                -

                + - + - - - +
                Mitigation -
                -

                Check supplemental rollback logs for a setupmem.dmp file, or event logs for any unexpected reboots or errors. -

                Review the rollback log and determine the stop code. -
                The rollback log is located in the **C:\$Windows.~BT\Sources\Panther** folder. An example analysis is shown below. This example is not representative of all cases: -

                Info SP Crash 0x0000007E detected -
                Info SP Module name : -
                Info SP Bugcheck parameter 1 : 0xFFFFFFFFC0000005 -
                Info SP Bugcheck parameter 2 : 0xFFFFF8015BC0036A -
                Info SP Bugcheck parameter 3 : 0xFFFFD000E5D23728 -
                Info SP Bugcheck parameter 4 : 0xFFFFD000E5D22F40 -
                Info SP Cannot recover the system. -
                Info SP Rollback: Showing splash window with restoring text: Restoring your previous version of Windows. + +
                Mitigation +
                +
                Check supplemental rollback logs for a setupmem.dmp file, or event logs for any unexpected reboots or errors. +
                Review the rollback log and determine the stop code. +
                The rollback log is located in the **C:\$Windows.~BT\Sources\Panther** folder. An example analysis is shown below. This example is not representative of all cases: +
                Info SP Crash 0x0000007E detected +
                Info SP Module name : +
                Info SP Bugcheck parameter 1 : 0xFFFFFFFFC0000005 +
                Info SP Bugcheck parameter 2 : 0xFFFFF8015BC0036A +
                Info SP Bugcheck parameter 3 : 0xFFFFD000E5D23728 +
                Info SP Bugcheck parameter 4 : 0xFFFFD000E5D22F40 +
                Info SP Cannot recover the system. +
                Info SP Rollback: Showing splash window with restoring text: Restoring your previous version of Windows. -

                Typically there is a a dump file for the crash to analyze. If you are not equipped to debug the dump, then attempt the following basic troubleshooting procedures:
                +
                Typically there is a a dump file for the crash to analyze. If you are not equipped to debug the dump, then attempt the following basic troubleshooting procedures:
                -1. Make sure you have enough disk space.
                -2. If a driver is identified in the bug check message, disable the driver or check with the manufacturer for driver updates.
                -3. Try changing video adapters.
                -4. Check with your hardware vendor for any BIOS updates.
                +1. Make sure you have enough disk space.
                +2. If a driver is identified in the bug check message, disable the driver or check with the manufacturer for driver updates.
                +3. Try changing video adapters.
                +4. Check with your hardware vendor for any BIOS updates.
                5. Disable BIOS memory options such as caching or shadowing.

                -
                -

                + + - + - -
                Code -
                0xC1900101 - 0x40017 -
                + +
                Code +
                0xC1900101 - 0x40017 +
                -

                -
                Cause -
                Windows 10 upgrade failed after the second reboot. -
                This is usually caused by a faulty driver. For example: antivirus filter drivers or encryption drivers. -
                - +
                +
                Cause +
                Windows 10 upgrade failed after the second reboot. +
                This is usually caused by a faulty driver. For example: antivirus filter drivers or encryption drivers. +
                + - + - - - +

                Ensure you select the option to "Download and install updates (recommended)." +
                Mitigation -
                Clean boot into Windows, and then attempt the upgrade to Windows 10.
                + +
                Mitigation +
                Clean boot into Windows, and then attempt the upgrade to Windows 10.
                For more information, see [How to perform a clean boot in Windows](https://support.microsoft.com/en-us/kb/929135). -

                Ensure you select the option to "Download and install updates (recommended)." -
                -
                + + - +

                0x800xxxxx

                -

                Result codes starting with the digits 0x800 are also important to understand. These error codes indicate general operating system errors, and are not unique to the Windows upgrade process. Examples include timeouts, devices not functioning, and a process stopping unexpectedly. +
                Result codes starting with the digits 0x800 are also important to understand. These error codes indicate general operating system errors, and are not unique to the Windows upgrade process. Examples include timeouts, devices not functioning, and a process stopping unexpectedly. -

                See the following general troubleshooting procedures associated with a result code of 0x800xxxxx: +
                See the following general troubleshooting procedures associated with a result code of 0x800xxxxx: -

                +
                - - + - - + - - + - - + - - + - - + -
                +
                - -
                Code -
                + +
                Code +
                800040005 - 0x20007 -
                +
                -

                - +
                Cause -
                +
                +
                Cause +
                An unspecified error occurred with a driver during the SafeOS phase. -
                -
                +

                		 + - - - +
                Mitigation -
                + +
                Mitigation +
                This error has more than one possible cause. Attempt [quick fixes](#quick-fixes), and if not successful, [analyze log files](#analyze-log-files) in order to determine the problem and solution. -
                -
                +
                +
                - -
                Code -
                + +
                Code +
                800704B8 - 0x3001A -
                +
                -

                - +
                Cause -
                +
                +
                Cause +
                An extended error has occurred during the first boot phase. -
                -
                +

                		 + - - - +
                Mitigation -
                + +
                Mitigation +
                Disable or uninstall non-Microsoft antivirus applications, disconnect all unnecessary devices, and perform a [clean boot](https://support.microsoft.com/en-us/kb/929135). -
                -
                +
                +
                - -
                Code -
                + +
                Code +
                8007042B - 0x4000D -
                +
                -

                - +
                Cause -
                +
                +
                Cause +
                The installation failed during the second boot phase while attempting the MIGRATE_DATA operation. -
                This issue can occur due to file system, application, or driver issues. +
                This issue can occur due to file system, application, or driver issues. -
                -
                +

                		 + - - - +
                Mitigation -
                + +
                Mitigation +
                [Analyze log files](#analyze-log-files) in order to determine the file, application, or driver that is not able to be migrated. Disconnect, update, remove, or replace the device or object. -
                -
                +
                +
                - -
                Code -
                + +
                Code +
                8007001F - 0x3000D -
                +
                -

                - +
                Cause -
                +
                +
                Cause +
                The installation failed in the FIRST_BOOT phase with an error during MIGRATE_DATA operation. -
                -
                +

                		 + - - - +
                Mitigation -
                + +
                Mitigation +
                [Analyze log files](#analyze-log-files) in order to determine the files or registry entires that are blocking data migration. @@ -694,73 +692,73 @@ Note: If a previous upgrade did not complete, invalid profiles might exist in th To repair this error, ensure that deleted accounts are not still present in the Windows registry and that files under the \\Users directory are valid. Delete the invalid files or user profiles that are causing this error. The specific files and profiles that are causing the error will be recorded in the Windows setup log files. -
                -
                +
                +
                - -
                Code -
                + +
                Code +
                8007001F - 0x4000D -
                +
                -

                - +
                Cause -
                +
                +
                Cause +
                General failure, a device attached to the system is not functioning. -
                -
                +

                		 + - - - +
                Mitigation -
                + +
                Mitigation +
                [Analyze log files](#analyze-log-files) in order to determine the device that is not functioning properly. Disconnect, update, or replace the device. -
                -
                +
                +
                - -
                Code -
                + +
                Code +
                8007042B - 0x4001E -
                +
                -

                - +
                Cause -
                +
                +
                Cause +
                The installation failed during the second boot phase while attempting the PRE_OOBE operation. -
                -
                +

                		 + - - - +
                Mitigation -
                + +
                Mitigation +
                This error has more than one possible cause. Attempt [quick fixes](#quick-fixes), and if not successful, [analyze log files](#analyze-log-files) in order to determine the problem and solution. -
                -
                +
                + ### Other result codes @@ -782,7 +780,7 @@ This error has more than one possible cause. Attempt [quick fixes](#quick-fixes) 0xC1900200 Setup.exe has detected that the machine does not meet the minimum system requirements. -Ensure the system you are trying to upgrade meets the minimum system requirements.

                See [Windows 10 specifications](https://www.microsoft.com/en-us/windows/windows-10-specifications) for information. +Ensure the system you are trying to upgrade meets the minimum system requirements.
                See [Windows 10 specifications](https://www.microsoft.com/en-us/windows/windows-10-specifications) for information. @@ -790,13 +788,13 @@ This error has more than one possible cause. Attempt [quick fixes](#quick-fixes) 0x80090011 A device driver error occurred during user data migration. Contact your hardware vendor and get all the device drivers updated. It is recommended to have an active internet connection during upgrade process. -

                Ensure that "Download and install updates (recommended)" is accepted at the start of the upgrade process. +
                Ensure that "Download and install updates (recommended)" is accepted at the start of the upgrade process. 0xC7700112 Failure to complete writing data to the system drive, possibly due to write access failure on the hard disk. This issue is resolved in the latest version of Upgrade Assistant. -

                Ensure that "Download and install updates (recommended)" is accepted at the start of the upgrade process. +
                Ensure that "Download and install updates (recommended)" is accepted at the start of the upgrade process. @@ -808,9 +806,9 @@ This error has more than one possible cause. Attempt [quick fixes](#quick-fixes) 0x80246007 The update was not downloaded successfully. -Attempt other methods of upgrading the operating system.
                +Attempt other methods of upgrading the operating system.
                Download and run the media creation tool. See [Download windows 10](https://www.microsoft.com/en-us/software-download/windows10). -
                Attempt to upgrade using .ISO or USB.
                +
                Attempt to upgrade using .ISO or USB.
                **Note**: Windows 10 Enterprise isn’t available in the media creation tool. For more information, go to the [Volume Licensing Service Center](https://www.microsoft.com/licensing/servicecenter/default.aspx). @@ -846,7 +844,7 @@ Download and run the media creation tool. See [Download windows 10](https://www. The user has chosen to cancel because the system does not pass the compatibility scan to install the update. Setup.exe will report this error when it can upgrade the machine with user data but cannot migrate installed applications. Incompatible software is blocking the upgrade process. Uninstall the application and try the upgrade again. See [Windows 10 Pre-Upgrade Validation using SETUP.EXE](https://blogs.technet.microsoft.com/mniehaus/2015/08/23/windows-10-pre-upgrade-validation-using-setup-exe/) for more information. -

                You can also download the [Windows Assessment and Deployment Kit (ADK) for Windows 10](http://go.microsoft.com/fwlink/p/?LinkId=526740) and install Application Compatibility Tools. +
                You can also download the [Windows Assessment and Deployment Kit (ADK) for Windows 10](http://go.microsoft.com/fwlink/p/?LinkId=526740) and install Application Compatibility Tools. @@ -856,9 +854,9 @@ Download and run the media creation tool. See [Download windows 10](https://www. This error is specific to upgrades using System Center Configuration Manager 2012 R2 SP1 CU3 (5.00.8238.1403) Analyze the SMSTS.log and verify that the upgrade is failing on "Apply Operating system" Phase: Error 80072efe DownloadFileWithRanges() failed. 80072efe. ApplyOperatingSystem (0x0760) -

                The error 80072efe means that the connection with the server was terminated abnormally. +
                The error 80072efe means that the connection with the server was terminated abnormally. -

                To resolve this issue, try the OS Deployment test on a client in same VLAN as the Configuration Manager server. Check the network configuration for random client-server connection issues happening on the remote VLAN. +
                To resolve this issue, try the OS Deployment test on a client in same VLAN as the Configuration Manager server. Check the network configuration for random client-server connection issues happening on the remote VLAN. @@ -874,7 +872,7 @@ Download and run the media creation tool. See [Download windows 10](https://www.

              7. Enable the Upgrades classification.
              8. Perform a full synch.
              -

              For detailed information on how to run these steps check out How to delete upgrades in WSUS.

              +
              For detailed information on how to run these steps check out How to delete upgrades in WSUS.

              @@ -901,60 +899,60 @@ Download and run the media creation tool. See [Download windows 10](https://www. ### Other error codes - +
              - - + - + - + - - + + - + - - - - + + + + +
              Note: If your device allows it, you can use an external USB drive for the upgrade process. Windows setup will back up the previous version of Windows to a USB external drive. The external drive must be at least 8GB (16GB is recommended). The external drive should be formatted using NTFS. Drives that are formatted in FAT32 may run into errors due to FAT32 file size limitations. USB drives are preferred over SD cards because drivers for SD cards are not migrated if the device does not support Connected Standby. + -
              Error CodesCauseMitigation
              0x80070003- 0x20007 -This is a failure during SafeOS phase driver installation. +
              Error CodesCauseMitigation
              0x80070003- 0x20007 +This is a failure during SafeOS phase driver installation. -[Verify device drivers](https://msdn.microsoft.com/windows/hardware/drivers/install/troubleshooting-device-and-driver-installations) on the computer, and [analyze log files](#analyze-log-files) to determine the problem driver. -
              0x8007025D - 0x2000C -This error occurs if the ISO file's metadata is corrupt."Re-download the ISO/Media and re-attempt the upgrade. +[Verify device drivers](https://msdn.microsoft.com/windows/hardware/drivers/install/troubleshooting-device-and-driver-installations) on the computer, and [analyze log files](#analyze-log-files) to determine the problem driver. +
              0x8007025D - 0x2000C +This error occurs if the ISO file's metadata is corrupt."Re-download the ISO/Media and re-attempt the upgrade. Alternatively, re-create installation media the [Media Creation Tool](https://www.microsoft.com/en-us/software-download/windows10). -
              0x80070490 - 0x20007An incompatible device driver is present. +
              0x80070490 - 0x20007An incompatible device driver is present. -[Verify device drivers](https://msdn.microsoft.com/windows/hardware/drivers/install/troubleshooting-device-and-driver-installations) on the computer, and [analyze log files](#analyze-log-files) to determine the problem driver. +[Verify device drivers](https://msdn.microsoft.com/windows/hardware/drivers/install/troubleshooting-device-and-driver-installations) on the computer, and [analyze log files](#analyze-log-files) to determine the problem driver. -
              0xC1900101 - 0x2000c -An unspecified error occurred in the SafeOS phase during WIM apply. This can be caused by an outdated driver or disk corruption. -Run checkdisk to repair the file system. For more information, see the [quick fixes](#quick-fixes) section in this guide. -

              Update drivers on the computer, and select "Download and install updates (recommended)" during the upgrade process. Disconnect devices other than the mouse, keyboard and display.

              0xC1900200 - 0x20008 +
              0xC1900101 - 0x2000c +An unspecified error occurred in the SafeOS phase during WIM apply. This can be caused by an outdated driver or disk corruption. +Run checkdisk to repair the file system. For more information, see the [quick fixes](#quick-fixes) section in this guide. +
              Update drivers on the computer, and select "Download and install updates (recommended)" during the upgrade process. Disconnect devices other than the mouse, keyboard and display.
              0xC1900200 - 0x20008 -The computer doesn’t meet the minimum requirements to download or upgrade to Windows 10. +The computer doesn’t meet the minimum requirements to download or upgrade to Windows 10. -See [Windows 10 Specifications](https://www.microsoft.com/en-us/windows/windows-10-specifications) and verify the computer meets minimum requirements. +See [Windows 10 Specifications](https://www.microsoft.com/en-us/windows/windows-10-specifications) and verify the computer meets minimum requirements. -
              Review logs for [compatibility information](https://blogs.technet.microsoft.com/askcore/2016/01/21/using-the-windows-10-compatibility-reports-to-understand-upgrade-issues/).
              0x80070004 - 0x3000D -This is a problem with data migration during the first boot phase. There are multiple possible causes. +
              Review logs for [compatibility information](https://blogs.technet.microsoft.com/askcore/2016/01/21/using-the-windows-10-compatibility-reports-to-understand-upgrade-issues/).
              0x80070004 - 0x3000D +This is a problem with data migration during the first boot phase. There are multiple possible causes. -[Analyze log files](#analyze-log-files) to determine the issue.
              0xC1900101 - 0x4001E -Installation failed in the SECOND_BOOT phase with an error during PRE_OOBE operation. -This is a generic error that occurs during the OOBE phase of setup. See the [0xC1900101](#0xc1900101) section of this guide and review general troubleshooting procedures described in that section.
              0x80070005 - 0x4000D -The installation failed in the SECOND_BOOT phase with an error in during MIGRATE_DATA operation. This error indicates that access was denied while attempting to migrate data. -[Analyze log files](#analyze-log-files) to determine the data point that is reporting access denied.
              0x80070004 - 0x50012 -Windows Setup failed to open a file. -[Analyze log files](#analyze-log-files) to determine the data point that is reporting access problems.
              0xC190020e -
              0x80070070 - 0x50011 -
              0x80070070 - 0x50012 -
              0x80070070 - 0x60000 -              		These errors indicate the computer does not have enough free space available to install the upgrade. -To upgrade a computer to Windows 10, it requires 16 GB of free hard drive space for a 32-bit OS, and 20 GB for a 64-bit OS. If there is not enough space, attempt to [free up drive space](https://support.microsoft.com/en-us/help/17421/windows-free-up-drive-space) before proceeding with the upgrade. +[Analyze log files](#analyze-log-files) to determine the issue.
              0xC1900101 - 0x4001E +Installation failed in the SECOND_BOOT phase with an error during PRE_OOBE operation. +This is a generic error that occurs during the OOBE phase of setup. See the [0xC1900101](#0xc1900101) section of this guide and review general troubleshooting procedures described in that section.
              0x80070005 - 0x4000D +The installation failed in the SECOND_BOOT phase with an error in during MIGRATE_DATA operation. This error indicates that access was denied while attempting to migrate data. +[Analyze log files](#analyze-log-files) to determine the data point that is reporting access denied.
              0x80070004 - 0x50012 +Windows Setup failed to open a file. +[Analyze log files](#analyze-log-files) to determine the data point that is reporting access problems.
              0xC190020e +
              0x80070070 - 0x50011 +
              0x80070070 - 0x50012 +
              0x80070070 - 0x60000 +              		These errors indicate the computer does not have enough free space available to install the upgrade. +To upgrade a computer to Windows 10, it requires 16 GB of free hard drive space for a 32-bit OS, and 20 GB for a 64-bit OS. If there is not enough space, attempt to [free up drive space](https://support.microsoft.com/en-us/help/17421/windows-free-up-drive-space) before proceeding with the upgrade. -

              Note: If your device allows it, you can use an external USB drive for the upgrade process. Windows setup will back up the previous version of Windows to a USB external drive. The external drive must be at least 8GB (16GB is recommended). The external drive should be formatted using NTFS. Drives that are formatted in FAT32 may run into errors due to FAT32 file size limitations. USB drives are preferred over SD cards because drivers for SD cards are not migrated if the device does not support Connected Standby. -

              + @@ -962,9 +960,9 @@ Alternatively, re-create installation media the [Media Creation Tool](https://ww ## Related topics [Windows 10 FAQ for IT professionals](https://technet.microsoft.com/en-us/windows/dn798755.aspx) -
              [Windows 10 Enterprise system requirements](https://technet.microsoft.com/en-us/windows/dn798752.aspx) -
              [Windows 10 Specifications](https://www.microsoft.com/en-us/windows/Windows-10-specifications) -
              [Windows 10 IT pro forums](https://social.technet.microsoft.com/Forums/en-US/home?category=Windows10ITPro) -
              [Fix Windows Update errors by using the DISM or System Update Readiness tool](https://support.microsoft.com/kb/947821) +
              [Windows 10 Enterprise system requirements](https://technet.microsoft.com/en-us/windows/dn798752.aspx) +
              [Windows 10 Specifications](https://www.microsoft.com/en-us/windows/Windows-10-specifications) +
              [Windows 10 IT pro forums](https://social.technet.microsoft.com/Forums/en-US/home?category=Windows10ITPro) +
              [Fix Windows Update errors by using the DISM or System Update Readiness tool](https://support.microsoft.com/kb/947821) Not finding content you need? Windows 10 users, tell us what you want on [Feedback Hub](feedback-hub:?tabid=2&contextid=897). \ No newline at end of file diff --git a/windows/deployment/upgrade/upgrade-readiness-deployment-script.md b/windows/deployment/upgrade/upgrade-readiness-deployment-script.md index c3ef73e060..17224c6c74 100644 --- a/windows/deployment/upgrade/upgrade-readiness-deployment-script.md +++ b/windows/deployment/upgrade/upgrade-readiness-deployment-script.md @@ -73,7 +73,7 @@ The deployment script displays the following exit codes to let you know if it wa
              - + diff --git a/windows/deployment/windows-10-poc-mdt.md b/windows/deployment/windows-10-poc-mdt.md index f7f79e2f18..8c3ca200ef 100644 --- a/windows/deployment/windows-10-poc-mdt.md +++ b/windows/deployment/windows-10-poc-mdt.md @@ -7,7 +7,7 @@ ms.sitesec: library ms.pagetype: deploy keywords: deployment, automate, tools, configure, mdt ms.localizationpriority: high -ms.date: 08/23/2017 +ms.date: 10/10/2017 author: greg-lindsay --- @@ -37,18 +37,20 @@ This guide provides instructions to install and configure the Microsoft Deployme Topics and procedures in this guide are summarized in the following table. An estimate of the time required to complete each procedure is also provided. Time required to complete procedures will vary depending on the resources available to the Hyper-V host and assigned to VMs, such as processor speed, memory allocation, disk speed, and network speed. +
              +
              -
              Exit code and meaningExit code and meaning Suggested fix
              0 - Success
              -
              TopicDescriptionTime + +
              TopicDescriptionTime -
              [About MDT](#about-mdt)A high-level overview of the Microsoft Deployment Toolkit (MDT).Informational -
              [Install MDT](#install-mdt)Download and install MDT.40 minutes -
              [Create a deployment share and reference image](#create-a-deployment-share-and-reference-image)A reference image is created to serve as the template for deploying new images.90 minutes -
              [Deploy a Windows 10 image using MDT](#deploy-a-windows-10-image-using-mdt)The reference image is deployed in the PoC environment.60 minutes -
              [Refresh a computer with Windows 10](#refresh-a-computer-with-windows-10)Export user data from an existing client computer, wipe the computer, install a new operating system, and then restore user data and settings.60 minutes -
              [Replace a computer with Windows 10](#replace-a-computer-with-windows-10)Back up an existing client computer, then restore this backup to a new computer.60 minutes -
              [Troubleshooting logs, events, and utilities](#troubleshooting-logs-events-and-utilities)Log locations and troubleshooting hints.Informational +
              [About MDT](#about-mdt)A high-level overview of the Microsoft Deployment Toolkit (MDT).Informational +
              [Install MDT](#install-mdt)Download and install MDT.40 minutes +
              [Create a deployment share and reference image](#create-a-deployment-share-and-reference-image)A reference image is created to serve as the template for deploying new images.90 minutes +
              [Deploy a Windows 10 image using MDT](#deploy-a-windows-10-image-using-mdt)The reference image is deployed in the PoC environment.60 minutes +
              [Refresh a computer with Windows 10](#refresh-a-computer-with-windows-10)Export user data from an existing client computer, wipe the computer, install a new operating system, and then restore user data and settings.60 minutes +
              [Replace a computer with Windows 10](#replace-a-computer-with-windows-10)Back up an existing client computer, then restore this backup to a new computer.60 minutes +
              [Troubleshooting logs, events, and utilities](#troubleshooting-logs-events-and-utilities)Log locations and troubleshooting hints.Informational
              diff --git a/windows/deployment/windows-10-poc-sc-config-mgr.md b/windows/deployment/windows-10-poc-sc-config-mgr.md index dc842b3f38..0d51134732 100644 --- a/windows/deployment/windows-10-poc-sc-config-mgr.md +++ b/windows/deployment/windows-10-poc-sc-config-mgr.md @@ -7,7 +7,7 @@ ms.sitesec: library ms.pagetype: deploy keywords: deployment, automate, tools, configure, sccm ms.localizationpriority: high -ms.date: 08/23/2017 +ms.date: 10/10/2017 author: greg-lindsay --- @@ -37,23 +37,25 @@ This guide provides end-to-end instructions to install and configure System Cent Topics and procedures in this guide are summarized in the following table. An estimate of the time required to complete each procedure is also provided. Time required to complete procedures will vary depending on the resources available to the Hyper-V host and assigned to VMs, such as processor speed, memory allocation, disk speed, and network speed. +
              +
              - -
              TopicDescriptionTime + +
              TopicDescriptionTime -
              [Install prerequisites](#install-prerequisites)Install prerequisite Windows Server roles and features, download, install and configure SQL Server, configure firewall rules, and install the Windows ADK.60 minutes -
              [Install System Center Configuration Manager](#install-system-center-configuration-manager)Download System Center Configuration Manager, configure prerequisites, and install the package.45 minutes -
              [Download MDOP and install DaRT](#download-mdop-and-install-dart)Download the Microsoft Desktop Optimization Pack 2015 and install DaRT 10.15 minutes -
              [Prepare for Zero Touch installation](#prepare-for-zero-touch-installation)Prerequisite procedures to support Zero Touch installation.60 minutes -
              [Create a boot image for Configuration Manager](#create-a-boot-image-for-configuration-manager)Use the MDT wizard to create the boot image in Configuration Manager.20 minutes -
              [Create a Windows 10 reference image](#create-a-windows-10-reference-image)This procedure can be skipped if it was done previously, otherwise instructions are provided to create a reference image.0-60 minutes -
              [Add a Windows 10 operating system image](#add-a-windows-10-operating-system-image)Add a Windows 10 operating system image and distribute it.10 minutes
              [Create a task sequence](#create-a-task-sequence)Create a Configuration Manager task sequence with MDT integration using the MDT wizard15 minutes -
              [Finalize the operating system configuration](#finalize-the-operating-system-configuration)Enable monitoring, configure rules, and distribute content.30 minutes -
              [Deploy Windows 10 using PXE and Configuration Manager](#deploy-windows-10-using-pxe-and-configuration-manager)Deploy Windows 10 using Configuration Manager deployment packages and task sequences.60 minutes -
              [Replace a client with Windows 10 using Configuration Manager](#replace-a-client-with-windows-10-using-configuration-manager)Replace a client computer with Windows 10 using Configuration Manager.90 minutes -
              [Refresh a client with Windows 10 using Configuration Manager](#refresh-a-client-with-windows-10-using-configuration-manager)Use a task sequence to refresh a client with Windows 10 using Configuration Manager and MDT90 minutes +
              [Install prerequisites](#install-prerequisites)Install prerequisite Windows Server roles and features, download, install and configure SQL Server, configure firewall rules, and install the Windows ADK.60 minutes +
              [Install System Center Configuration Manager](#install-system-center-configuration-manager)Download System Center Configuration Manager, configure prerequisites, and install the package.45 minutes +
              [Download MDOP and install DaRT](#download-mdop-and-install-dart)Download the Microsoft Desktop Optimization Pack 2015 and install DaRT 10.15 minutes +
              [Prepare for Zero Touch installation](#prepare-for-zero-touch-installation)Prerequisite procedures to support Zero Touch installation.60 minutes +
              [Create a boot image for Configuration Manager](#create-a-boot-image-for-configuration-manager)Use the MDT wizard to create the boot image in Configuration Manager.20 minutes +
              [Create a Windows 10 reference image](#create-a-windows-10-reference-image)This procedure can be skipped if it was done previously, otherwise instructions are provided to create a reference image.0-60 minutes +
              [Add a Windows 10 operating system image](#add-a-windows-10-operating-system-image)Add a Windows 10 operating system image and distribute it.10 minutes
              [Create a task sequence](#create-a-task-sequence)Create a Configuration Manager task sequence with MDT integration using the MDT wizard15 minutes +
              [Finalize the operating system configuration](#finalize-the-operating-system-configuration)Enable monitoring, configure rules, and distribute content.30 minutes +
              [Deploy Windows 10 using PXE and Configuration Manager](#deploy-windows-10-using-pxe-and-configuration-manager)Deploy Windows 10 using Configuration Manager deployment packages and task sequences.60 minutes +
              [Replace a client with Windows 10 using Configuration Manager](#replace-a-client-with-windows-10-using-configuration-manager)Replace a client computer with Windows 10 using Configuration Manager.90 minutes +
              [Refresh a client with Windows 10 using Configuration Manager](#refresh-a-client-with-windows-10-using-configuration-manager)Use a task sequence to refresh a client with Windows 10 using Configuration Manager and MDT90 minutes -
              +
              @@ -417,12 +419,12 @@ If you have already completed steps in [Deploy Windows 10 in a test lab using Mi 4. In the Deployment Workbench console, right-click **Deployment Shares** and select **New Deployment Share**. 5. Use the following settings for the New Deployment Share Wizard: - - Deployment share path: **C:\MDTBuildLab**
              - - Share name: **MDTBuildLab$**
              - - Deployment share description: **MDT build lab**
              - - Options: click **Next** to accept the default
              - - Summary: click **Next**
              - - Progress: settings will be applied
              + - Deployment share path: **C:\MDTBuildLab**
              + - Share name: **MDTBuildLab$**
              + - Deployment share description: **MDT build lab**
              + - Options: click **Next** to accept the default
              + - Summary: click **Next**
              + - Progress: settings will be applied
              - Confirmation: click **Finish** 6. Expand the **Deployment Shares** node, and then expand **MDT build lab**. @@ -432,18 +434,18 @@ If you have already completed steps in [Deploy Windows 10 in a test lab using Mi 7. Right-click the **Windows 10** folder created in the previous step, and then click **Import Operating System**. 8. Use the following settings for the Import Operating System Wizard: - - OS Type: **Full set of source files**
              - - Source: **D:\\**
              - - Destination: **W10Ent_x64**
              + - OS Type: **Full set of source files**
              + - Source: **D:\\**
              + - Destination: **W10Ent_x64**
              - Summary: click **Next** - Confirmation: click **Finish** 9. For purposes of this test lab, we will not add applications, such as Microsoft Office, to the deployment share. For information about adding applications, see the [Add applications](deploy-windows-mdt/create-a-windows-10-reference-image.md#sec03) section of the [Create a Windows 10 reference image](deploy-windows-mdt/create-a-windows-10-reference-image.md) topic in the TechNet library. 10. The next step is to create a task sequence to reference the operating system that was imported. To create a task sequence, right-click the **Task Sequences** node under **MDT Build Lab** and then click **New Task Sequence**. Use the following settings for the New Task Sequence Wizard: - - Task sequence ID: **REFW10X64-001**
              - - Task sequence name: **Windows 10 Enterprise x64 Default Image**
              - - Task sequence comments: **Reference Build**
              + - Task sequence ID: **REFW10X64-001**
              + - Task sequence name: **Windows 10 Enterprise x64 Default Image**
              + - Task sequence comments: **Reference Build**
              - Template: **Standard Client Task Sequence** - Select OS: click **Windows 10 Enterprise Evaluation in W10Ent_x64 install.wim** - Specify Product Key: **Do not specify a product key at this time** @@ -638,27 +640,27 @@ If you have already completed steps in [Deploy Windows 10 in a test lab using Mi 4. In the **State Restore** group, click the **Set Status 5** action, click **Add** in the upper left corner, point to **User State**, and click **Request State Store**. This adds a new action immediately after **Set Status 5**. -5. Configure the **Request State Store** action that was just added with the following settings:
              - - Request state storage location to: **Restore state from another computer**
              - - Select the **If computer account fails to connect to state store, use the Network Access account** checkbox.
              - - Options tab: Select the **Continue on error** checkbox.
              - - Add Condition: **Task Sequence Variable**:
              - - Variable: **USMTLOCAL**
              - - Condition: **not equals**
              - - Value: **True**
              - - Click **OK**.
              - - Click **Apply**
              . +5. Configure the **Request State Store** action that was just added with the following settings:
              + - Request state storage location to: **Restore state from another computer**
              + - Select the **If computer account fails to connect to state store, use the Network Access account** checkbox.
              + - Options tab: Select the **Continue on error** checkbox.
              + - Add Condition: **Task Sequence Variable**:
              + - Variable: **USMTLOCAL**
              + - Condition: **not equals**
              + - Value: **True**
              + - Click **OK**.
              + - Click **Apply**
              . 6. In the **State Restore** group, click **Restore User State**, click **Add**, point to **User State**, and click **Release State Store**. -7. Configure the **Release State Store** action that was just added with the following settings:
              - - Options tab: Select the **Continue on error** checkbox.
              - - Add Condition: **Task Sequence Variable**:
              - - Variable: **USMTLOCAL**
              - - Condition: **not equals**
              - - Value: **True**
              - - Click **OK**.
              - - Click **OK**
              . +7. Configure the **Release State Store** action that was just added with the following settings:
              + - Options tab: Select the **Continue on error** checkbox.
              + - Add Condition: **Task Sequence Variable**:
              + - Variable: **USMTLOCAL**
              + - Condition: **not equals**
              + - Value: **True**
              + - Click **OK**.
              + - Click **OK**
              . ### Finalize the operating system configuration @@ -668,12 +670,12 @@ If you have already completed steps in [Deploy Windows 10 in a test lab using Mi 1. In the MDT deployment workbench on SRV1, right-click **Deployment Shares** and then click **New Deployment Share**. 2. Use the following settings for the New Deployment Share Wizard: - - Deployment share path: **C:\MDTProduction**
              - - Share name: **MDTProduction$**
              - - Deployment share description: **MDT Production**
              - - Options: click **Next** to accept the default
              - - Summary: click **Next**
              - - Progress: settings will be applied
              + - Deployment share path: **C:\MDTProduction**
              + - Share name: **MDTProduction$**
              + - Deployment share description: **MDT Production**
              + - Options: click **Next** to accept the default
              + - Summary: click **Next**
              + - Progress: settings will be applied
              - Confirmation: click **Finish** 3. Right-click the **MDT Production** deployment share, and click **Properties**. @@ -724,10 +726,10 @@ If you have already completed steps in [Deploy Windows 10 in a test lab using Mi 2. On the General page, next to **Collection**, click **Browse**, select the **All Unknown Computers** collection, click **OK**, and then click **Next**. -3. On the Deployment Settings page, use the following settings:
              - - Purpose: **Available**
              - - Make available to the following: **Only media and PXE**
              - - Click **Next**.
              +3. On the Deployment Settings page, use the following settings:
              + - Purpose: **Available**
              + - Make available to the following: **Only media and PXE**
              + - Click **Next**.
              4. Click **Next** five times to accept defaults on the Scheduling, User Experience, Alerts, and Distribution Points pages. 5. Click **Close**. @@ -910,14 +912,14 @@ Set-VMNetworkAdapter -VMName PC4 -StaticMacAddress 00-15-5D-83-26-FF 1. On SRV1, in the Configuration Manager console, in the Asset and Compliance workspace, right-click **Device Collections** and then click **Create Device Collection**. 2. Use the following settings in the **Create Device Collection Wizard**: - - General > Name: **Install Windows 10 Enterprise x64**
              - - General > Limiting collection: **All Systems**
              - - Membership Rules > Add Rule: **Direct Rule**
              - - The **Create Direct Membership Rule Wizard** opens, click **Next**
              - - Search for Resources > Resource class: **System Resource**
              - - Search for Resources > Attribute name: **Name**
              - - Search for Resources > Value: **%**
              - - Select Resources > Value: Select the computername associated with the PC1 VM
              + - General > Name: **Install Windows 10 Enterprise x64**
              + - General > Limiting collection: **All Systems**
              + - Membership Rules > Add Rule: **Direct Rule**
              + - The **Create Direct Membership Rule Wizard** opens, click **Next**
              + - Search for Resources > Resource class: **System Resource**
              + - Search for Resources > Attribute name: **Name**
              + - Search for Resources > Value: **%**
              + - Select Resources > Value: Select the computername associated with the PC1 VM
              - Click **Next** twice and then click **Close** in both windows (Next, Next, Close, then Next, Next, Close) 3. Double-click the Install Windows 10 Enterprise x64 device collection and verify that the PC1 computer account is displayed. @@ -925,14 +927,14 @@ Set-VMNetworkAdapter -VMName PC4 -StaticMacAddress 00-15-5D-83-26-FF 4. In the Software Library workspace, expand **Operating Systems**, click **Task Sequences**, right-click **Windows 10 Enterprise x64** and then click **Deploy**. 5. Use the following settings in the Deploy Sofware wizard: - - General > Collection: Click Browse and select **Install Windows 10 Enterprise x64**
              - - Deployment Settings > Purpose: **Available**
              - - Deployment Settings > Make available to the following: **Configuration Manager clients, media and PXE**
              - - Scheduling > Click **Next**
              - - User Experience > Click **Next**
              - - Alerts > Click **Next**
              - - Distribution Points > Click **Next**
              - - Summary > Click **Next**
              + - General > Collection: Click Browse and select **Install Windows 10 Enterprise x64**
              + - Deployment Settings > Purpose: **Available**
              + - Deployment Settings > Make available to the following: **Configuration Manager clients, media and PXE**
              + - Scheduling > Click **Next**
              + - User Experience > Click **Next**
              + - Alerts > Click **Next**
              + - Distribution Points > Click **Next**
              + - Summary > Click **Next**
              - Verify that the wizard completed successfully and then click **Close** @@ -970,14 +972,14 @@ Set-VMNetworkAdapter -VMName PC4 -StaticMacAddress 00-15-5D-83-26-FF 1. On SRV1, in the Configuration Manager console, in the Assets and Compliance workspace, right-click **Device Collections** and then click **Create Device Collection**. 2. Use the following settings in the **Create Device Collection Wizard**: - - General > Name: **USMT Backup (Replace)**
              - - General > Limiting collection: **All Systems**
              - - Membership Rules > Add Rule: **Direct Rule**
              - - The **Create Direct Membership Rule Wizard** opens, click **Next**
              - - Search for Resources > Resource class: **System Resource**
              - - Search for Resources > Attribute name: **Name**
              - - Search for Resources > Value: **%**
              - - Select Resources > Value: Select the computername associated with the PC1 VM (GREGLIN-PC1 in this example).
              + - General > Name: **USMT Backup (Replace)**
              + - General > Limiting collection: **All Systems**
              + - Membership Rules > Add Rule: **Direct Rule**
              + - The **Create Direct Membership Rule Wizard** opens, click **Next**
              + - Search for Resources > Resource class: **System Resource**
              + - Search for Resources > Attribute name: **Name**
              + - Search for Resources > Value: **%**
              + - Select Resources > Value: Select the computername associated with the PC1 VM (GREGLIN-PC1 in this example).
              - Click **Next** twice and then click **Close** in both windows. 3. Click **Device Collections** and then double-click **USMT Backup (Replace)**. Verify that the computer name/hostname associated with PC1 is displayed in the collection. Do not proceed until this name is displayed. @@ -985,13 +987,13 @@ Set-VMNetworkAdapter -VMName PC4 -StaticMacAddress 00-15-5D-83-26-FF ### Create a new deployment In the Configuration Manager console, in the Software Library workspace under Operating Systems, click **Task Sequences**, right-click **Replace Task Sequence**, click **Deploy**, and use the following settings: -- General > Collection: **USMT Backup (Replace)**
              -- Deployment Settings > Purpose: **Available**
              -- Deployment Settings > Make available to the following: **Only Configuration Manager Clients**
              -- Scheduling: Click **Next**
              -- User Experience: Click **Next**
              -- Alerts: Click **Next**
              -- Distribution Points: Click **Next**
              +- General > Collection: **USMT Backup (Replace)**
              +- Deployment Settings > Purpose: **Available**
              +- Deployment Settings > Make available to the following: **Only Configuration Manager Clients**
              +- Scheduling: Click **Next**
              +- User Experience: Click **Next**
              +- Alerts: Click **Next**
              +- Distribution Points: Click **Next**
              - Click **Next** and then click **Close**. ### Verify the backup diff --git a/windows/deployment/windows-10-poc.md b/windows/deployment/windows-10-poc.md index 5a67eebb9e..b313b96ffe 100644 --- a/windows/deployment/windows-10-poc.md +++ b/windows/deployment/windows-10-poc.md @@ -7,7 +7,7 @@ ms.sitesec: library ms.pagetype: deploy keywords: deployment, automate, tools, configure, mdt, sccm ms.localizationpriority: high -ms.date: 08/23/2017 +ms.date: 10/10/2017 author: greg-lindsay --- @@ -42,25 +42,25 @@ After completing the instructions in this guide, you will have a PoC environment Topics and procedures in this guide are summarized in the following table. An estimate of the time required to complete each procedure is also provided. Time required to complete procedures will vary depending on the resources available to the Hyper-V host and assigned to VMs, such as processor speed, memory allocation, disk speed, and network speed. +
              +
              - -
              TopicDescriptionTime - -
              [Hardware and software requirements](#hardware-and-software-requirements)Prerequisites to complete this guide.Informational -
              [Lab setup](#lab-setup)A description and diagram of the PoC environment.Informational -
              [Configure the PoC environment](#configure-the-poc-environment)Parent topic for procedures.Informational -
              [Verify support and install Hyper-V](#verify-support-and-install-hyper-v)Verify that installation of Hyper-V is supported, and install the Hyper-V server role.10 minutes -
              [Download VHD and ISO files](#download-vhd-and-iso-files)Download evaluation versions of Windows Server 2012 R2 and Windows 10 and prepare these files to be used on the Hyper-V host.30 minutes -
              [Convert PC to VM](#convert-pc-to-vm)Convert a physical computer on your network to a VM hosted in Hyper-V.30 minutes -
              [Resize VHD](#resize-vhd)Increase the storage capacity for one of the Windows Server VMs.5 minutes -
              [Configure Hyper-V](#configure-hyper-v)Create virtual switches, determine available RAM for virtual machines, and add virtual machines.15 minutes -
              [Configure service and user accounts](#configure-service-and-user-accounts)Start virtual machines and configure all services and settings.60 minutes -
              [Configure VMs](#configure-vms)Start virtual machines and configure all services and settings.60 minutes -
              [Appendix A: Verify the configuration](#appendix-a-verify-the-configuration)Verify and troubleshoot network connectivity and services in the PoC environment.30 minutes -
              [Appendix B: Terminology in this guide](#appendix-b-terminology-used-in-this-guide)Terms used in this guide.Informational -
              - + + +
              TopicDescriptionTime
              [Hardware and software requirements](#hardware-and-software-requirements)Prerequisites to complete this guide.Informational +
              [Lab setup](#lab-setup)A description and diagram of the PoC environment.Informational +
              [Configure the PoC environment](#configure-the-poc-environment)Parent topic for procedures.Informational +
              [Verify support and install Hyper-V](#verify-support-and-install-hyper-v)Verify that installation of Hyper-V is supported, and install the Hyper-V server role.10 minutes +
              [Download VHD and ISO files](#download-vhd-and-iso-files)Download evaluation versions of Windows Server 2012 R2 and Windows 10 and prepare these files to be used on the Hyper-V host.30 minutes +
              [Convert PC to VM](#convert-pc-to-vm)Convert a physical computer on your network to a VM hosted in Hyper-V.30 minutes +
              [Resize VHD](#resize-vhd)Increase the storage capacity for one of the Windows Server VMs.5 minutes +
              [Configure Hyper-V](#configure-hyper-v)Create virtual switches, determine available RAM for virtual machines, and add virtual machines.15 minutes +
              [Configure service and user accounts](#configure-service-and-user-accounts)Start virtual machines and configure all services and settings.60 minutes +
              [Configure VMs](#configure-vms)Start virtual machines and configure all services and settings.60 minutes +
              [Appendix A: Verify the configuration](#appendix-a-verify-the-configuration)Verify and troubleshoot network connectivity and services in the PoC environment.30 minutes +
              [Appendix B: Terminology in this guide](#appendix-b-terminology-used-in-this-guide)Terms used in this guide.Informational +
              ## Hardware and software requirements @@ -74,9 +74,9 @@ Harware requirements are displayed below:
              - +
              - + @@ -230,7 +230,7 @@ When you have completed installation of Hyper-V on the host computer, begin conf After completing registration you will be able to download the 7.47 GB Windows Server 2012 R2 evaluation VHD. An example of the download offering is shown below.
              **Computer 1** (required) **Computer 2** (recommended)
              - +
              ![VHD](images/download_vhd.png)
              ![VHD](images/download_vhd.png)
              2. Download the file to the **C:\VHD** directory. When the download is complete, rename the VHD file that you downloaded to **2012R2-poc-1.vhd**. This is done to make the filename simple to recognize and type. @@ -262,7 +262,7 @@ w10-enterprise.iso >Important: Do not attempt to use the VM resulting from the following procedure as a reference image. Also, to avoid conflicts with existing clients, do not start the VM outside the PoC network. -
              +
              If you do not have a PC available to convert to VM, perform the following steps to download an evaluation VM:
                @@ -292,7 +292,7 @@ When creating a VM in Hyper-V, you must specify either generation 1 or generatio
                - +
                @@ -363,7 +363,7 @@ The following table displays the Hyper-V VM generation to choose based on the OS
                -
                Architecture
                +
                @@ -1073,18 +1073,18 @@ Use the following procedures to verify that the PoC environment is configured pr
                -
                OS Partition style
                -
                TermDefinition -
                GPTGUID partition table (GPT) is an updated hard-disk formatting scheme that enables the use of newer hardware. GPT is one of the partition formats that can be chosen when first initializing a hard drive, prior to creating and formatting partitions. -
                Hyper-VHyper-V is a server role introduced with Windows Server 2008 that lets you create a virtualized computing environment. Hyper-V can also be installed as a Windows feature on Windows client operating systems, starting with Windows 8. -
                Hyper-V hostThe computer where Hyper-V is installed. -
                Hyper-V ManagerThe user-interface console used to view and configure Hyper-V. -
                MBRMaster Boot Record (MBR) is a legacy hard-disk formatting scheme that limits support for newer hardware. MBR is one of the partition formats that can be chosen when first initializing a hard drive, prior to creating and formatting partitions. MBR is in the process of being replaced by the GPT partition format. -
                Proof of concept (PoC)Confirmation that a process or idea works as intended. A PoC is carried out in a test environment to learn about and verify a process. -
                Shadow copyA copy or "snapshot" of a computer at a point in time, created by the Volume Shadow Copy Service (VSS), typically for backup purposes. -
                Virtual machine (VM)A VM is a virtual computer with its own operating system, running on the Hyper-V host. -
                Virtual switchA virtual network connection used to connect VMs to each other and to physical network adapters on the Hyper-V host. -
                VM snapshotA point in time image of a VM that includes its disk, memory and device state. It can be used to return a virtual machine to a former state corresponding to the time the snapshot was taken. + +
                TermDefinition +
                GPTGUID partition table (GPT) is an updated hard-disk formatting scheme that enables the use of newer hardware. GPT is one of the partition formats that can be chosen when first initializing a hard drive, prior to creating and formatting partitions. +
                Hyper-VHyper-V is a server role introduced with Windows Server 2008 that lets you create a virtualized computing environment. Hyper-V can also be installed as a Windows feature on Windows client operating systems, starting with Windows 8. +
                Hyper-V hostThe computer where Hyper-V is installed. +
                Hyper-V ManagerThe user-interface console used to view and configure Hyper-V. +
                MBRMaster Boot Record (MBR) is a legacy hard-disk formatting scheme that limits support for newer hardware. MBR is one of the partition formats that can be chosen when first initializing a hard drive, prior to creating and formatting partitions. MBR is in the process of being replaced by the GPT partition format. +
                Proof of concept (PoC)Confirmation that a process or idea works as intended. A PoC is carried out in a test environment to learn about and verify a process. +
                Shadow copyA copy or "snapshot" of a computer at a point in time, created by the Volume Shadow Copy Service (VSS), typically for backup purposes. +
                Virtual machine (VM)A VM is a virtual computer with its own operating system, running on the Hyper-V host. +
                Virtual switchA virtual network connection used to connect VMs to each other and to physical network adapters on the Hyper-V host. +
                VM snapshotA point in time image of a VM that includes its disk, memory and device state. It can be used to return a virtual machine to a former state corresponding to the time the snapshot was taken.
                diff --git a/windows/device-security/device-guard/deploy-catalog-files-to-support-code-integrity-policies.md b/windows/device-security/device-guard/deploy-catalog-files-to-support-code-integrity-policies.md index 0e2e0995b9..198770fcb7 100644 --- a/windows/device-security/device-guard/deploy-catalog-files-to-support-code-integrity-policies.md +++ b/windows/device-security/device-guard/deploy-catalog-files-to-support-code-integrity-policies.md @@ -28,7 +28,7 @@ To create a catalog file, you use a tool called **Package Inspector**. You must 1. Be sure that a code integrity policy is currently deployed in audit mode on the computer on which you will run Package Inspector. - Package Inspector does not always detect installation files that have been removed from the computer during the installation process. To ensure that these binaries are also trusted, deploy a code integrity policy in audit mode. You can use the code integrity policy that you created and audited in [Create a code integrity policy from a golden computer](deploy-code-integrity-policies-steps.md#create-a-code-integrity-policy-from-a-golden-computer) and [Audit code integrity policies](deploy-code-integrity-policies-steps.md#audit-code-integrity-policies). + Package Inspector does not always detect installation files that have been removed from the computer during the installation process. To ensure that these binaries are also trusted, deploy a code integrity policy in audit mode. You can use the code integrity policy that you created and audited in [Create a code integrity policy from a reference computer](deploy-code-integrity-policies-steps.md#create-a-code-integrity-policy-from-a-reference-computer) and [Audit code integrity policies](deploy-code-integrity-policies-steps.md#audit-code-integrity-policies). > **Note**  This process should **not** be performed on a system with an enforced Windows Defender Device Guard policy, only with a policy in audit mode. If a policy is currently being enforced, you will not be able to install and run the application. diff --git a/windows/device-security/device-guard/deploy-code-integrity-policies-steps.md b/windows/device-security/device-guard/deploy-code-integrity-policies-steps.md index a27db98ffe..cef4895ba6 100644 --- a/windows/device-security/device-guard/deploy-code-integrity-policies-steps.md +++ b/windows/device-security/device-guard/deploy-code-integrity-policies-steps.md @@ -717,11 +717,11 @@ We recommend that every code integrity policy be run in audit mode before being When code integrity policies are run in audit mode, it allows administrators to discover any applications that were missed during an initial policy scan and to identify any new applications that have been installed and run since the original policy was created. While a code integrity policy is running in audit mode, any binary that runs and would have been denied had the policy been enforced is logged in the **Applications and Services Logs\\Microsoft\\Windows\\CodeIntegrity\\Operational** event log. When these logged binaries have been validated, they can easily be added to a new code integrity policy. When the new exception policy is created, you can merge it with your existing code integrity policies. > [!Note] -> Before you begin this process, you need to create a code integrity policy binary file. If you have not already done so, see [Create a code integrity policy from a golden computer](#create-a-code-integrity-policy-from-a-golden-computer), earlier in this topic, for a step-by-step walkthrough of the process to create a code integrity policy and convert it to binary format. +> Before you begin this process, you need to create a code integrity policy binary file. If you have not already done so, see [Create a code integrity policy from a reference computer](#create-a-code-integrity-policy-from-a-reference-computer), earlier in this topic, for a step-by-step walkthrough of the process to create a code integrity policy and convert it to binary format. **To audit a code integrity policy with local policy:** -1. Find a *.bin policy file that you have created, for example, the DeviceGuardPolicy.bin file that resulted from the steps in the earlier section, [Create a code integrity policy from a golden computer](#create-a-code-integrity-policy-from-a-golden-computer). Copy the file to C:\\Windows\\System32\\CodeIntegrity. +1. Find a *.bin policy file that you have created, for example, the DeviceGuardPolicy.bin file that resulted from the steps in the earlier section, [Create a code integrity policy from a reference computer](#create-a-code-integrity-policy-from-a-reference-computer). Copy the file to C:\\Windows\\System32\\CodeIntegrity. 2. On the computer you want to run in audit mode, open the Local Group Policy Editor by running **GPEdit.msc**. @@ -735,7 +735,7 @@ When code integrity policies are run in audit mode, it allows administrators to > [!Note] - > - The illustration shows the example file name *DeviceGuardPolicy.bin* because this name was used earlier in this topic, in [Create a code integrity policy from a reference computer](#create-a-code-integrity-policy-from-a-golden-computer). Also, this policy file does not need to be copied to every system. You can instead copy the code integrity policies to a file share to which all computer accounts have access. + > - The illustration shows the example file name *DeviceGuardPolicy.bin* because this name was used earlier in this topic, in [Create a code integrity policy from a reference computer](#create-a-code-integrity-policy-from-a-reference-computer). Also, this policy file does not need to be copied to every system. You can instead copy the code integrity policies to a file share to which all computer accounts have access. > - Any policy you select here is converted to SIPolicy.p7b when it is deployed to the individual computers. @@ -793,7 +793,7 @@ Use the following procedure after you have been running a computer with a code i You can now use this file to update the existing code integrity policy that you ran in audit mode by merging the two policies. For instructions on how to merge this audit policy with the existing code integrity policy, see the next section, [Merge code integrity policies](#merge-code-integrity-policies). > [!Note] -> You may have noticed that you did not generate a binary version of this policy as you did in [Create a code integrity policy from a golden computer](#create-a-code-integrity-policy-from-a-golden-computer). This is because code integrity policies created from an audit log are not intended to run as stand-alone policies but rather to update existing code integrity policies. +> You may have noticed that you did not generate a binary version of this policy as you did in [Create a code integrity policy from a reference computer](#create-a-code-integrity-policy-from-a-reference-computer). This is because code integrity policies created from an audit log are not intended to run as stand-alone policies but rather to update existing code integrity policies. ## Use a code integrity policy to control specific plug-ins, add-ins, and modules @@ -823,7 +823,7 @@ New-CIPolicy -Rules $rule -FilePath ".\BlockAddins.xml" -UserPEs ## Merge code integrity policies -When you develop code integrity policies, you will occasionally need to merge two policies. A common example is when a code integrity policy is initially created and audited. Another example is when you create a single master policy by using multiple code integrity policies previously created from golden computers. Because each computer running Windows 10 can have only one code integrity policy, it is important to properly maintain these policies. In this example, audit events have been saved into a secondary code integrity policy that you then merge with the initial code integrity policy. +When you develop code integrity policies, you will occasionally need to merge two policies. A common example is when a code integrity policy is initially created and audited. Another example is when you create a single master policy by using multiple code integrity policies previously created from reference computers. Because each computer running Windows 10 can have only one code integrity policy, it is important to properly maintain these policies. In this example, audit events have been saved into a secondary code integrity policy that you then merge with the initial code integrity policy. > [!Note] > The following example uses several of the code integrity policy .xml files that you created in earlier sections in this topic. You can follow this process, however, with any two code integrity policies you would like to combine. @@ -873,7 +873,7 @@ Every code integrity policy is created with audit mode enabled. After you have s ` $CIPolicyBin=$CIPolicyPath+"EnforcedDeviceGuardPolicy.bin"` > [!Note] - > The initial code integrity policy that this section refers to was created in the [Create a code integrity policy from a golden computer](#create-a-code-integrity-policy-from-a-golden-computer) section. If you are using a different code integrity policy, update the **CIPolicyPath** and **InitialCIPolicy** variables. + > The initial code integrity policy that this section refers to was created in the [Create a code integrity policy from a reference computer](#create-a-code-integrity-policy-from-a-reference-computer) section. If you are using a different code integrity policy, update the **CIPolicyPath** and **InitialCIPolicy** variables. 2. Ensure that rule options 9 (“Advanced Boot Options Menu”) and 10 (“Boot Audit on Failure”) are set the way that you intend for this policy. We strongly recommend that you enable these rule options before you run any enforced policy for the first time. Enabling these options provides administrators with a pre-boot command prompt, and allows Windows to start even if the code integrity policy blocks a kernel-mode driver from running. When ready for enterprise deployment, you can remove these options. @@ -917,7 +917,7 @@ To sign a code integrity policy with SignTool.exe, you need the following compon - SignTool.exe, found in the Windows SDK (Windows 7 or later) -- The binary format of the code integrity policy that you generated in the [Create a code integrity policy from a golden computer](#create-a-code-integrity-policy-from-a-golden-computer) section or another code integrity policy that you have created +- The binary format of the code integrity policy that you generated in the [Create a code integrity policy from a reference computer](#create-a-code-integrity-policy-from-a-reference-computer) section or another code integrity policy that you have created - An internal CA code signing certificate or a purchased code signing certificate @@ -932,7 +932,7 @@ If you do not have a code signing certificate, see the [Optional: Create a code ` $CIPolicyBin=$CIPolicyPath+"DeviceGuardPolicy.bin"` > [!Note] - > This example uses the code integrity policy that you created in the [Create a code integrity policy from a golden computer](#create-a-code-integrity-policy-from-a-golden-computer) section. If you are signing another policy, be sure to update the **$CIPolicyPath** and **$CIPolicyBin** variables with the correct information. + > This example uses the code integrity policy that you created in the [Create a code integrity policy from a reference computer](#create-a-code-integrity-policy-from-a-reference-computer) section. If you are signing another policy, be sure to update the **$CIPolicyPath** and **$CIPolicyBin** variables with the correct information. 2. Import the .pfx code signing certificate. Import the code signing certificate that you will use to sign the code integrity policy into the signing user’s personal store on the computer that will be doing the signing. In this example, you use the certificate that was created in [Optional: Create a code signing certificate for code integrity policies](optional-create-a-code-signing-certificate-for-code-integrity-policies.md). @@ -1034,7 +1034,7 @@ There may be a time when signed code integrity policies cause a boot failure. Be Code integrity policies can easily be deployed and managed with Group Policy. A Windows Defender Device Guard administrative template will be available in Windows Server 2016 that allows you to simplify deployment of Windows Defender Device Guard hardware-based security features and code integrity policies. The following procedure walks you through how to deploy a code integrity policy called **DeviceGuardPolicy.bin** to a test OU called *DG Enabled PCs* by using a GPO called **Contoso GPO Test**. > [!Note] -> This walkthrough requires that you have previously created a code integrity policy and have a computer running Windows 10 on which to test a Group Policy deployment. For more information about how to create a code integrity policy, see [Create a code integrity policy from a golden computer](#create-a-code-integrity-policy-from-a-golden-computer), earlier in this topic. +> This walkthrough requires that you have previously created a code integrity policy and have a computer running Windows 10 on which to test a Group Policy deployment. For more information about how to create a code integrity policy, see [Create a code integrity policy from a reference computer](#create-a-code-integrity-policy-from-a-reference-computer), earlier in this topic. > [!Note] > Signed code integrity policies can cause boot failures when deployed. We recommend that signed code integrity policies be thoroughly tested on each hardware platform before enterprise deployment. @@ -1066,7 +1066,7 @@ To deploy and manage a code integrity policy with Group Policy: In this policy setting, you specify either the local path in which the policy will exist on the client computer or a Universal Naming Convention (UNC) path that the client computers will look to retrieve the latest version of the policy. For example, with DeviceGuardPolicy.bin on the test computer, the example file path would be C:\\Windows\\System32\\CodeIntegrity\\DeviceGuardPolicy.bin, as shown in Figure 5. > [!Note] - > The illustration shows the example file name *DeviceGuardPolicy.bin* because this name was used earlier in this topic, in [Create a code integrity policy from a golden computer](#create-a-code-integrity-policy-from-a-golden-computer). Also, this policy file does not need to be copied to every computer. You can instead copy the code integrity policies to a file share to which all computer accounts have access. Any policy selected here is converted to SIPolicy.p7b when it is deployed to the individual client computers. + > The illustration shows the example file name *DeviceGuardPolicy.bin* because this name was used earlier in this topic, in [Create a code integrity policy from a reference computer](#create-a-code-integrity-policy-from-a-reference-computer). Also, this policy file does not need to be copied to every computer. You can instead copy the code integrity policies to a file share to which all computer accounts have access. Any policy selected here is converted to SIPolicy.p7b when it is deployed to the individual client computers. ![Group Policy called Deploy Code Integrity Policy](images/dg-fig26-enablecode.png)