diff --git a/.openpublishing.redirection.json b/.openpublishing.redirection.json index a74e666327..6edf0bae08 100644 --- a/.openpublishing.redirection.json +++ b/.openpublishing.redirection.json @@ -56,31 +56,6 @@ "redirect_document_id": true }, { -"source_path": "devices/surface-hub/i-am-done-finishing-your-surface-hub-meeting.md", -"redirect_url": "/itpro/surface-hub/finishing-your-surface-hub-meeting", -"redirect_document_id": true -}, -{ -"source_path": "devices/surface-hub/provisioning-packages-for-certificates-surface-hub.md", -"redirect_url": "/itpro/surface-hub/provisioning-packages-for-surface-hub", -"redirect_document_id": true -}, -{ -"source_path": "devices/surface-hub/manage-settings-with-local-admin-account-surface-hub.md", -"redirect_url": "/itpro/surface-hub/admin-group-management-for-surface-hub", -"redirect_document_id": true -}, -{ -"source_path": "devices/surface-hub/surface-hub-administrators-guide.md", -"redirect_url": "/itpro/surface-hub/index", -"redirect_document_id": true -}, -{ -"source_path": "devices/surface-hub/intro-to-surface-hub.md", -"redirect_url": "/itpro/surface-hub/index", -"redirect_document_id": false -}, -{ "source_path": "windows/manage/waas-quick-start.md", "redirect_url": "/itpro/windows/update/waas-quick-start", "redirect_document_id": true @@ -646,6 +621,11 @@ "redirect_document_id": true }, { +"source_path": "windows/manage/cortana-at-work-overview.md", +"redirect_url": "/itpro/windows/configure/cortana-at-work-overview", +"redirect_document_id": false +}, +{ "source_path": "windows/manage/manage-inventory-windows-store-for-business.md", "redirect_url": "/itpro/windows/manage/app-inventory-managemement-windows-store-for-business", "redirect_document_id": true diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index fb6c3024d1..e360930f75 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -20,7 +20,7 @@ We've tried to make editing an existing, public file as simple as possible. 1. Go to the page on TechNet that you want to update, and then click **Contribute**. - ![GitHub Web, showing the Contribute link](images/contribute-link.png) + ![GitHub Web, showing the Contribute link](images/contribute-link.png) 2. Log into (or sign up for) a GitHub account. @@ -28,7 +28,7 @@ We've tried to make editing an existing, public file as simple as possible. 3. Click the **Pencil** icon (in the red box) to edit the content. - ![GitHub Web, showing the Pencil icon in the red box](images/pencil-icon.png) + ![GitHub Web, showing the Pencil icon in the red box](images/pencil-icon.png) 4. Using Markdown language, make your changes to the topic. For info about how to edit content using Markdown, see: - **If you're linked to the Microsoft organization in GitHub:** [Windows Open Publishing Guide Home](http://aka.ms/windows-op-guide) @@ -37,7 +37,7 @@ We've tried to make editing an existing, public file as simple as possible. 5. Make your suggested change, and then click **Preview Changes** to make sure it looks correct. - ![GitHub Web, showing the Preview Changes tab](images/preview-changes.png) + ![GitHub Web, showing the Preview Changes tab](images/preview-changes.png) 6. When you’re done editing the topic, scroll to the bottom of the page, and then click **Propose file change** to create a fork in your personal GitHub account. @@ -48,7 +48,7 @@ We've tried to make editing an existing, public file as simple as possible. 7. On the **Comparing changes** screen, you’ll see if there are any problems with the file you’re checking in. If there are no problems, you’ll see the message, **Able to merge**. - + ![GitHub Web, showing the Comparing changes screen](images/compare-changes.png) 8. Click **Create pull request**. diff --git a/browsers/edge/available-policies.md b/browsers/edge/available-policies.md index ed9df5e159..54d68cc10d 100644 --- a/browsers/edge/available-policies.md +++ b/browsers/edge/available-policies.md @@ -5,11 +5,11 @@ author: eross-msft ms.prod: edge ms.mktglfcycl: explore ms.sitesec: library -title: Available Group Policy and Mobile Device Management (MDM) settings for Microsoft Edge (Microsoft Edge for IT Pros) +title: Group Policy and Mobile Device Management settings for Microsoft Edge (Microsoft Edge for IT Pros) localizationpriority: high --- -# Available Group Policy and Mobile Device Management (MDM) settings for Microsoft Edge +# Group Policy and Mobile Device Management (MDM) settings for Microsoft Edge **Applies to:** diff --git a/browsers/internet-explorer/ie11-deploy-guide/add-multiple-sites-to-enterprise-mode-site-list-using-the-version-1-schema-and-enterprise-mode-tool.md b/browsers/internet-explorer/ie11-deploy-guide/add-multiple-sites-to-enterprise-mode-site-list-using-the-version-1-schema-and-enterprise-mode-tool.md index a923c7b2dd..9660d3d146 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/add-multiple-sites-to-enterprise-mode-site-list-using-the-version-1-schema-and-enterprise-mode-tool.md +++ b/browsers/internet-explorer/ie11-deploy-guide/add-multiple-sites-to-enterprise-mode-site-list-using-the-version-1-schema-and-enterprise-mode-tool.md @@ -82,7 +82,7 @@ To make sure your site list is up-to-date; wait 65 seconds after opening IE and ## Add multiple sites to the Enterprise Mode Site List Manager (schema v.1) After you create your .xml or .txt file, you can bulk add the sites to the Enterprise Mode Site List Manager (schema v.1). - ![](images/wedge.gif) **To add multiple sites** + **To add multiple sites** 1. In the Enterprise Mode Site List Manager (schema v.1), click **Bulk add from file**. diff --git a/browsers/internet-explorer/ie11-deploy-guide/add-multiple-sites-to-enterprise-mode-site-list-using-the-version-2-schema-and-enterprise-mode-tool.md b/browsers/internet-explorer/ie11-deploy-guide/add-multiple-sites-to-enterprise-mode-site-list-using-the-version-2-schema-and-enterprise-mode-tool.md index 4770a4ffb0..327a105fef 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/add-multiple-sites-to-enterprise-mode-site-list-using-the-version-2-schema-and-enterprise-mode-tool.md +++ b/browsers/internet-explorer/ie11-deploy-guide/add-multiple-sites-to-enterprise-mode-site-list-using-the-version-2-schema-and-enterprise-mode-tool.md @@ -92,7 +92,7 @@ To make sure your site list is up-to-date; wait 65 seconds after opening IE and ## Add multiple sites to the Enterprise Mode Site List Manager (schema v.2) After you create your .xml or .txt file, you can bulk add the sites to the Enterprise Mode Site List Manager (schema v.2). - ![](images/wedge.gif) **To add multiple sites** + **To add multiple sites** 1. In the Enterprise Mode Site List Manager (schema v.2), click **Bulk add from file**. diff --git a/browsers/internet-explorer/ie11-deploy-guide/add-single-sites-to-enterprise-mode-site-list-using-the-version-1-enterprise-mode-tool.md b/browsers/internet-explorer/ie11-deploy-guide/add-single-sites-to-enterprise-mode-site-list-using-the-version-1-enterprise-mode-tool.md index 7e8c3c6910..1140d08486 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/add-single-sites-to-enterprise-mode-site-list-using-the-version-1-enterprise-mode-tool.md +++ b/browsers/internet-explorer/ie11-deploy-guide/add-single-sites-to-enterprise-mode-site-list-using-the-version-1-enterprise-mode-tool.md @@ -27,7 +27,7 @@ Enterprise Mode is a compatibility mode that runs on Internet Explorer 11, lett You can add individual sites to your compatibility list by using the Enterprise Mode Site List Manager.

**Note**
If you're using the v.2 version of the Enterprise Mode schema, you'll need to use the Enterprise Mode Site List Manager (schema v.1). For more info, see [Add sites to the Enterprise Mode site list using the Enterprise Mode Site List Manager (schema v.2)](add-single-sites-to-enterprise-mode-site-list-using-the-version-2-enterprise-mode-tool.md). - ![](images/wedge.gif) **To add a site to your compatibility list using the Enterprise Mode Site List Manager (schema v.1)** + **To add a site to your compatibility list using the Enterprise Mode Site List Manager (schema v.1)** 1. In the Enterprise Mode Site List Manager (schema v.1), click **Add**. diff --git a/browsers/internet-explorer/ie11-deploy-guide/add-single-sites-to-enterprise-mode-site-list-using-the-version-2-enterprise-mode-tool.md b/browsers/internet-explorer/ie11-deploy-guide/add-single-sites-to-enterprise-mode-site-list-using-the-version-2-enterprise-mode-tool.md index b18fa646cd..3ee1358e16 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/add-single-sites-to-enterprise-mode-site-list-using-the-version-2-enterprise-mode-tool.md +++ b/browsers/internet-explorer/ie11-deploy-guide/add-single-sites-to-enterprise-mode-site-list-using-the-version-2-enterprise-mode-tool.md @@ -27,7 +27,7 @@ Enterprise Mode is a compatibility mode that runs on Internet Explorer 11, lett You can add individual sites to your compatibility list by using the Enterprise Mode Site List Manager.

**Note**
If you're using the v.1 version of the Enterprise Mode schema, you'll need to use the Enterprise Mode Site List Manager (schema v.1). For more info, see [Add sites to the Enterprise Mode site list using the WEnterprise Mode Site List Manager (schema v.1)](add-single-sites-to-enterprise-mode-site-list-using-the-version-1-enterprise-mode-tool.md). - ![](images/wedge.gif) **To add a site to your compatibility list using the Enterprise Mode Site List Manager (schema v.2)** + **To add a site to your compatibility list using the Enterprise Mode Site List Manager (schema v.2)** 1. In the Enterprise Mode Site List Manager (schema v.2), click **Add**. diff --git a/browsers/internet-explorer/ie11-deploy-guide/auto-configuration-and-auto-proxy-problems-with-ie11.md b/browsers/internet-explorer/ie11-deploy-guide/auto-configuration-and-auto-proxy-problems-with-ie11.md index a64b645896..3ab6081d7c 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/auto-configuration-and-auto-proxy-problems-with-ie11.md +++ b/browsers/internet-explorer/ie11-deploy-guide/auto-configuration-and-auto-proxy-problems-with-ie11.md @@ -26,7 +26,7 @@ If you experience issues while setting up your proxy server, you can try these t - Check that the browser is pointing to the right automatic configuration script location. - ![](images/wedge.gif) **To check your proxy server address** + **To check your proxy server address** 1. On the **Tools** menu, click **Internet Options**, and then **Connections**. @@ -34,7 +34,7 @@ If you experience issues while setting up your proxy server, you can try these t 3. If you have multiple proxy servers, click **Advanced** to look at all of the additional addresses.

**Note**
If IE11 uses a proxy server for local IP addresses, regardless whether you turned on the **Bypass Proxy Server for Local Addresses** option, see [Internet Explorer Uses Proxy Server for Local IP Address Even if the "Bypass Proxy Server for Local Addresses" Option Is Turned On](https://go.microsoft.com/fwlink/p/?LinkId=85652). - ![](images/wedge.gif) **To check that you've turned on the correct settings** + **To check that you've turned on the correct settings** 1. On the **Tools** menu, click **Internet Options**, and then click **Connections**. @@ -42,7 +42,7 @@ If you experience issues while setting up your proxy server, you can try these t 3. In the **Automatic configuration** area, check that you've clicked the **Automatically detect settings** box. If you've turned on automatic configuration, check to make sure that you've also clicked the **Use automatic configuration script** box.

**Note**
If at this point everything is set up correctly, but the proxy server still isn't behaving properly, click the **Detect my network settings** box in the **Error** dialog box to try to detect the proxy server, again. - ![](images/wedge.gif) **To check that you're pointing to the correct automatic configuration script location** + **To check that you're pointing to the correct automatic configuration script location** 1. On the **Tools** menu, click **Internet Options**, and then click **Connections**. diff --git a/browsers/internet-explorer/ie11-deploy-guide/auto-configuration-settings-for-ie11.md b/browsers/internet-explorer/ie11-deploy-guide/auto-configuration-settings-for-ie11.md index f49ab30704..5b02b0d37f 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/auto-configuration-settings-for-ie11.md +++ b/browsers/internet-explorer/ie11-deploy-guide/auto-configuration-settings-for-ie11.md @@ -17,7 +17,7 @@ Automatic configuration lets you apply custom branding and graphics to your inte ## Adding the automatic configuration registry key For custom graphics and branding, add the `FEATURE\AUTOCONFIG\BRANDING` registry key to your IE installation package.

**Important**
Follow these directions carefully because serious problems can occur if you update your registry incorrectly. For added protection, back up your registry so you can restore it if a problem occurs. - ![](images/wedge.gif) **To add the registry key** + **To add the registry key** 1. On the **Start** screen, type **regedit**, and then click **Regedit.exe**. @@ -39,7 +39,7 @@ For custom graphics and branding, add the `FEATURE\AUTOCONFIG\BRANDING` registry After adding the `FEATURE\AUTOCONFIG\BRANDING` registry key, you can change your automatic configuration settings to pick up the updated branding.

**Important**
Your branding changes won't be added or updated if you've previously chosen the **Disable external branding of IE** setting in the `User Configuration\Administrative Templates\Windows Components\Internet Explorer` Group Policy object. This setting is intended to prevent branding by a third-party, like an Internet service or content provider. For more information about Group Policy, including videos and the latest technical documentation, see the [Group Policy TechCenter](https://go.microsoft.com/fwlink/p/?LinkId=214514). - ![](images/wedge.gif) **To update your settings** + **To update your settings** 1. Open the IE Customization Wizard 11, and go to the **Automatic Configuration** page. diff --git a/browsers/internet-explorer/ie11-deploy-guide/auto-detect-settings-for-ie11.md b/browsers/internet-explorer/ie11-deploy-guide/auto-detect-settings-for-ie11.md index b93b60f816..c454b9eb42 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/auto-detect-settings-for-ie11.md +++ b/browsers/internet-explorer/ie11-deploy-guide/auto-detect-settings-for-ie11.md @@ -23,7 +23,7 @@ Automatic detection works even if the browser wasn't originally set up or instal ## Updating your automatic detection settings To use automatic detection, you have to set up your DHCP and DNS servers.

**Note**
Your DHCP servers must support the `DHCPINFORM` message, to obtain the DHCP options. - ![](images/wedge.gif) **To turn on automatic detection for DHCP servers** + **To turn on automatic detection for DHCP servers** 1. Open the Internet Explorer Customization Wizard 11, and go to the **Automatic Configuration** page. @@ -31,7 +31,7 @@ To use automatic detection, you have to set up your DHCP and DNS servers.

**No 3. Open the [DHCP Administrative Tool](https://go.microsoft.com/fwlink/p/?LinkId=302212), create a new option type, using the code number 252, and then associate it with the URL to your configuration file. For detailed instructions about how to do this, see [Create an option 252 entry in DHCP](https://go.microsoft.com/fwlink/p/?LinkId=294649). - ![](images/wedge.gif) **To turn on automatic detection for DNS servers** + **To turn on automatic detection for DNS servers** 1. Open the IE Customization Wizard 11, and go to the **Automatic Configuration** page. diff --git a/browsers/internet-explorer/ie11-deploy-guide/auto-proxy-configuration-settings-for-ie11.md b/browsers/internet-explorer/ie11-deploy-guide/auto-proxy-configuration-settings-for-ie11.md index 119052b438..a9ac089edf 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/auto-proxy-configuration-settings-for-ie11.md +++ b/browsers/internet-explorer/ie11-deploy-guide/auto-proxy-configuration-settings-for-ie11.md @@ -17,7 +17,7 @@ Configure and maintain your proxy settings, like pointing your users' browsers t ## Updating your auto-proxy settings You can use your Internet settings (.ins) files to set up your standard proxy settings. You can also specify script files (.js, .jvs, or .pac) to configure and maintain your advanced proxy settings. IE uses your auto-proxy script files to dynamically determine whether to connect to a host or use a proxy server. If a proxy server connection fails, Internet Explorer 11 automatically attempts to connect to another proxy server that you have specified. - ![](images/wedge.gif) **To update your settings** + **To update your settings** 1. Create a script file with your proxy information, copying it to a server location. diff --git a/browsers/internet-explorer/ie11-deploy-guide/choose-how-to-install-ie11.md b/browsers/internet-explorer/ie11-deploy-guide/choose-how-to-install-ie11.md index cf90d5c6b3..9c4a55c2bd 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/choose-how-to-install-ie11.md +++ b/browsers/internet-explorer/ie11-deploy-guide/choose-how-to-install-ie11.md @@ -21,7 +21,7 @@ Before you install Internet Explorer 11, you should: - **Choose how you'll deploy your installation package.** Your deployment method should be based on whether you're installing to computers already running Windows, or if you're deploying IE11 as part of a Windows installation. - - **Existing computers running Windows.** Use System Center R2 2012 System Center 2012 R2 Configuration Manager, System Center Essentials 2010, Windows Server Updates Services (WSUS), or Microsoft Intune to deploy IE11. For more information about how to use these systems, see [System Center 2012 R2 Configuration Manager](https://go.microsoft.com/fwlink/p/?LinkID=276664), [System Center Essentials 2010](https://go.microsoft.com/fwlink/p/?LinkId=395200), [Windows Server Update Services](https://go.microsoft.com/fwlink/p/?LinkID=276790), and [Microsoft Intune Overview](https://go.microsoft.com/fwlink/p/?linkid=276667). + - **Existing computers running Windows.** Use System Center R2 2012 System Center 2012 R2 Configuration Manager, System Center Essentials 2010, Windows Server Updates Services (WSUS), or Microsoft Intune to deploy IE11. For more information about how to use these systems, see [System Center 2012 R2 Configuration Manager](https://go.microsoft.com/fwlink/p/?LinkID=276664), [System Center Essentials 2010](https://go.microsoft.com/fwlink/p/?LinkId=395200), [Windows Server Update Services](https://go.microsoft.com/fwlink/p/?LinkID=276790), and [Microsoft Intune Overview](https://www.microsoft.com/en-us/cloud-platform/microsoft-intune). - **As part of a Windows deployment.** Update your Windows images to include IE11, and then add the update to your MDT deployment share or to your Windows image. For instructions about how to create and use Windows images, see [Create and Manage a Windows Image Using DISM](https://go.microsoft.com/fwlink/p/?LinkId=299408). For general information about deploying IE, see [Microsoft Deployment Toolkit (MDT)](https://go.microsoft.com/fwlink/p/?LinkId=331148), [Windows ADK Overview](https://go.microsoft.com/fwlink/p/?LinkId=276669). diff --git a/browsers/internet-explorer/ie11-deploy-guide/create-install-packages-for-multiple-operating-systems-or-languages.md b/browsers/internet-explorer/ie11-deploy-guide/create-install-packages-for-multiple-operating-systems-or-languages.md index 1d2df29b8f..51f61a1b66 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/create-install-packages-for-multiple-operating-systems-or-languages.md +++ b/browsers/internet-explorer/ie11-deploy-guide/create-install-packages-for-multiple-operating-systems-or-languages.md @@ -19,7 +19,7 @@ You'll create multiple versions of your custom browser package if: - You have custom installation packages with only minor differences. Like, having a different phone number. - ![](images/wedge.gif) **To create a new package** + **To create a new package** 1. Create an installation package using the Internet Explorer Customization Wizard 11, as described in the [Internet Explorer Administration Kit 11 (IEAK 11) Customization Wizard options](../ie11-ieak/ieak11-wizard-custom-options.md) topic. diff --git a/browsers/internet-explorer/ie11-deploy-guide/delete-sites-from-your-enterprise-mode-site-list-in-the-enterprise-mode-site-list-manager.md b/browsers/internet-explorer/ie11-deploy-guide/delete-sites-from-your-enterprise-mode-site-list-in-the-enterprise-mode-site-list-manager.md index 360620938d..267c606f8b 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/delete-sites-from-your-enterprise-mode-site-list-in-the-enterprise-mode-site-list-manager.md +++ b/browsers/internet-explorer/ie11-deploy-guide/delete-sites-from-your-enterprise-mode-site-list-in-the-enterprise-mode-site-list-manager.md @@ -22,7 +22,7 @@ ms.sitesec: library - Windows Server 2008 R2 with Service Pack 1 (SP1) - ![](images/wedge.gif) **To delete a single site from your global Enterprise Mode site list** + **To delete a single site from your global Enterprise Mode site list** - From the Enterprise Mode Site List Manager, pick the site you want to delete, and then click **Delete**.
The site is permanently removed from your list. diff --git a/browsers/internet-explorer/ie11-deploy-guide/deploy-pinned-sites-using-mdt-2013.md b/browsers/internet-explorer/ie11-deploy-guide/deploy-pinned-sites-using-mdt-2013.md index affd42d162..708fccaaa2 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/deploy-pinned-sites-using-mdt-2013.md +++ b/browsers/internet-explorer/ie11-deploy-guide/deploy-pinned-sites-using-mdt-2013.md @@ -45,7 +45,7 @@ To follow the examples in this topic, you’ll need to pin the Bing (http://www. ### Step 1: Creating .website files The first step is to create a .website file for each website that you want to pin to the Windows 8.1 taskbar during deployment. A .website file is like a shortcut, except it’s a plain text file that describes not only the website’s URL but also how the icon looks. - ![](images/wedge.gif) **To create each .website file** + **To create each .website file** 1. Open the website in IE11. @@ -56,7 +56,7 @@ The first step is to create a .website file for each website that you want to pi ### Step 2: Copying the .website files to the deployment share Next, you must enable your deployment share to copy the bing.website and msn.website files to the **Start** menu on each target computer. - ![](images/wedge.gif) **To copy .website files to the deployment share** + **To copy .website files to the deployment share** 1. Open your MDT 2013 deployment share in Windows Explorer. @@ -67,7 +67,7 @@ Next, you must enable your deployment share to copy the bing.website and msn.web ### Step 3: Copying .website files to target computers After your operating system is installed on the target computer, you need to copy the .website files over so they can be pinned to the taskbar. - ![](images/wedge.gif) **To copy .website files to target computers** + **To copy .website files to target computers** 1. In the **Deployment Workbench** of MDT 2013, open the deployment share containing the task sequence during which you want to deploy pinned websites, and then click **Task Sequences**. @@ -84,7 +84,7 @@ After your operating system is installed on the target computer, you need to cop ### Step 4: Pinning .website files to the Taskbar With the .website files ready to copy to the **Public Links** folder on target computers for all users, the last step is to edit the Unattend.xml answer files to pin those .website files to the taskbar. You will need to complete the following steps for each task sequence during which you want to pin these websites to the taskbar. - ![](images/wedge.gif) **To pin .website files to the Taskbar** + **To pin .website files to the Taskbar** 1. Open the Windows System Image Manager (Windows SIM). diff --git a/browsers/internet-explorer/ie11-deploy-guide/edit-the-enterprise-mode-site-list-using-the-enterprise-mode-site-list-manager.md b/browsers/internet-explorer/ie11-deploy-guide/edit-the-enterprise-mode-site-list-using-the-enterprise-mode-site-list-manager.md index 7ebacccb8b..004a42cb19 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/edit-the-enterprise-mode-site-list-using-the-enterprise-mode-site-list-manager.md +++ b/browsers/internet-explorer/ie11-deploy-guide/edit-the-enterprise-mode-site-list-using-the-enterprise-mode-site-list-manager.md @@ -25,7 +25,7 @@ You can use Internet Explorer 11 and the Enterprise Mode Site List Manager to c If you need to edit a lot of websites, you probably don’t want to do it one at a time. Instead, you can edit your saved XML or TXT file and add the sites back again. For information about how to do this, depending on your operating system and schema version, see [Add multiple sites to the Enterprise Mode site list using a file and Enterprise Mode Site List Manager (schema v.2)](add-multiple-sites-to-enterprise-mode-site-list-using-the-version-2-schema-and-enterprise-mode-tool.md) or [Add multiple sites to the Enterprise Mode site list using a file and the Enterprise Mode Site List Manager (schema v.1)](add-multiple-sites-to-enterprise-mode-site-list-using-the-version-1-schema-and-enterprise-mode-tool.md). - ![](images/wedge.gif) **To change how your page renders** + **To change how your page renders** 1. In the Enterprise Mode Site List Manager, double-click the site you want to change. diff --git a/browsers/internet-explorer/ie11-deploy-guide/enable-and-disable-add-ons-using-administrative-templates-and-group-policy.md b/browsers/internet-explorer/ie11-deploy-guide/enable-and-disable-add-ons-using-administrative-templates-and-group-policy.md index 4a7966faaa..68b09c2320 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/enable-and-disable-add-ons-using-administrative-templates-and-group-policy.md +++ b/browsers/internet-explorer/ie11-deploy-guide/enable-and-disable-add-ons-using-administrative-templates-and-group-policy.md @@ -27,7 +27,7 @@ There are 4 types of add-ons: ## Using the Local Group Policy Editor to manage group policy objects You can use the Local Group Policy Editor to change how add-ons work in your organization. - ![](images/wedge.gif) **To manage add-ons** + **To manage add-ons** 1. In the Local Group Policy Editor, go to `Computer Configuration\Administrative Templates\Windows Components\Internet Explorer`. @@ -58,7 +58,7 @@ You can use the Local Group Policy Editor to change how add-ons work in your org ## Using the CLSID and Administrative Templates to manage group policy objects Because every add-on has a Class ID (CLSID), you can use it to enable and disable specific add-ons, using Group Policy and Administrative Templates. - ![](images/wedge.gif) **To manage add-ons** + **To manage add-ons** 1. Get the CLSID for the add-on you want to enable or disable: diff --git a/browsers/internet-explorer/ie11-deploy-guide/enterprise-mode-schema-version-1-guidance.md b/browsers/internet-explorer/ie11-deploy-guide/enterprise-mode-schema-version-1-guidance.md index e78df6c4c1..16c87cb775 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/enterprise-mode-schema-version-1-guidance.md +++ b/browsers/internet-explorer/ie11-deploy-guide/enterprise-mode-schema-version-1-guidance.md @@ -224,75 +224,9 @@ In this example, `contoso.com/about/careers` will use the default version of Int ## How to target specific sites If you want to target specific sites in your organization. - - - - - - - - - - - - - - - - - - - - - - - - - -
Targeted siteExampleExplanation
You can specify subdomains in the domain tag -
-<docMode>
-  <domain docMode="5">contoso.com</domain>
-  <domain docMode="9">info.contoso.com</domain>
-<docMode>
 -
    -
  • contoso.com uses document mode 5.
    • -
  • info.contoso.com uses document mode 9.
    • -
  • test.contoso.com also uses document mode 5.
    • -
-
You can specify exact URLs by listing the full path -
-<emie>
-  <domain exclude="false">bing.com</domain>
-  <domain exclude="false" forceCompatView="true">contoso.com</domain>
-<emie>
 -
    -
  • bing.com uses IE8 Enterprise Mode.
    • -
  • contoso.com uses IE7 Enterprise Mode.
    • -
-
You can nest paths underneath domains -
-<emie>
-  <domain exclude="true">contoso.com
-    <path exclude="false">/about</path>
-    <path exclude="true">/about/business</path>
-  </domain>
-</emie>
 -
    -
  • contoso.com will use the default version of IE.
    • -
  • contoso.com/about and everything underneath that node will load in Enterprise Mode, except contoso.com/about/business, which will load in the default version of IE.
    • -
-
You can’t add a path underneath a path. The file will still be parsed, but the sub-path will be ignored -
-<emie>
-  <domain exclude="true">contoso.com
-    <path>/about
-    <path exclude="true">/business</path>
-    </path>
-  </domain>
-</emie>
 -
    -
  • contoso.com will use the default version of IE.
    • -
  • contoso.com/about and everything underneath that node will load in Enterprise Mode, including contoso.com/about/business because the last rule is ignored.
    • -
-
\ No newline at end of file +|Targeted site |Example |Explanation | +|--------------|--------|------------| +|You can specify subdomains in the domain tag. |<docMode>
<domain docMode="5">contoso.com</domain>
<domain docMode="9">info.contoso.com</domain>
<docMode> |

| +|You can specify exact URLs by listing the full path. |<emie>
<domain exclude="false">bing.com</domain>
<domain exclude="false" forceCompatView="true">contoso.com</domain>
<emie>|| +|You can nest paths underneath domains. |<emie>
<domain exclude="true">contoso.com
<path exclude="false">/about</path>
<path exclude="true">
/about/business</path>
</domain>
</emie> | | +|You can’t add a path underneath a path. The file will still be parsed, but the sub-path will be ignored. |<emie>
<domain exclude="true">contoso.com
<path>/about
<path exclude="true">/business</path>
</path>
</domain>
</emie> | | \ No newline at end of file diff --git a/browsers/internet-explorer/ie11-deploy-guide/export-your-enterprise-mode-site-list-from-the-enterprise-mode-site-list-manager.md b/browsers/internet-explorer/ie11-deploy-guide/export-your-enterprise-mode-site-list-from-the-enterprise-mode-site-list-manager.md index b45f274bcc..6cbc411a30 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/export-your-enterprise-mode-site-list-from-the-enterprise-mode-site-list-manager.md +++ b/browsers/internet-explorer/ie11-deploy-guide/export-your-enterprise-mode-site-list-from-the-enterprise-mode-site-list-manager.md @@ -26,7 +26,7 @@ After you create your Enterprise Mode site list in the Enterprise Mode Site List **Important**
  This file is not intended for distribution to your managed devices. Instead, it is only for transferring data and comments from one manager to another. For example, if one administrator leaves and passes the existing data to another administrator. Internet Explorer doesn’t read this file. - ![](images/wedge.gif) **To export your compatibility list** + **To export your compatibility list** 1. On the **File** menu of the Enterprise Mode Site List Manager, click **Export**. diff --git a/browsers/internet-explorer/ie11-deploy-guide/fix-compat-issues-with-doc-modes-and-enterprise-mode-site-list.md b/browsers/internet-explorer/ie11-deploy-guide/fix-compat-issues-with-doc-modes-and-enterprise-mode-site-list.md index 94e5e4a1da..c8d09c6157 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/fix-compat-issues-with-doc-modes-and-enterprise-mode-site-list.md +++ b/browsers/internet-explorer/ie11-deploy-guide/fix-compat-issues-with-doc-modes-and-enterprise-mode-site-list.md @@ -50,7 +50,7 @@ After you’ve figured out the document mode that fixes your compatibility probl **Note**
There are two versions of the Enterprise Mode site list schema and the Enterprise Mode Site List Manager, based on your operating system. For more info about the schemas, see [Enterprise Mode schema v.2 guidance](enterprise-mode-schema-version-2-guidance.md) or [Enterprise Mode schema v.1 guidance](enterprise-mode-schema-version-1-guidance.md). For more info about the different site list management tools, see [Use the Enterprise Mode Site List Manager](use-the-enterprise-mode-site-list-manager.md). - ![](images/wedge.gif) **To add your site to the site list** + **To add your site to the site list** 1. Open the Enterprise Mode Site List Manager, and click **Add**. diff --git a/browsers/internet-explorer/ie11-deploy-guide/group-policy-and-advanced-group-policy-mgmt-ie11.md b/browsers/internet-explorer/ie11-deploy-guide/group-policy-and-advanced-group-policy-mgmt-ie11.md index 3ae9e11aab..eed0b6ac55 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/group-policy-and-advanced-group-policy-mgmt-ie11.md +++ b/browsers/internet-explorer/ie11-deploy-guide/group-policy-and-advanced-group-policy-mgmt-ie11.md @@ -29,7 +29,7 @@ From AGPM you can: - **Manage your GPO lifecycle with change control features.** You can use the available version-control, history, and auditing features to help you manage your GPOs while moving through your archive, to your editing process, and finally to your GPO deployment. **Note**
-For more information about AGPM, and to get the license, see [Microsoft Advanced Group Policy Management 4.0 SP1 Step-by-Step Guide](https://go.microsoft.com/fwlink/p/?LinkId=294916). +For more information about AGPM, and to get the license, see [Advanced Group Policy Management 4.0 Documents](https://www.microsoft.com/en-us/download/details.aspx?id=13975).   diff --git a/browsers/internet-explorer/ie11-deploy-guide/group-policy-shortcut-extensions-ie11.md b/browsers/internet-explorer/ie11-deploy-guide/group-policy-shortcut-extensions-ie11.md index a5c8385649..f30e991051 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/group-policy-shortcut-extensions-ie11.md +++ b/browsers/internet-explorer/ie11-deploy-guide/group-policy-shortcut-extensions-ie11.md @@ -23,7 +23,7 @@ Group Policy includes the Shortcuts preference extension, which lets you configu ## How do I configure shortcuts? You can create and configure shortcuts for any domain-based Group Policy Object (GPO) in the Group Policy Management Console (GPMC). - ![](images/wedge.gif) **To create a new Shortcut preference item** + **To create a new Shortcut preference item** 1. Open GPMC, right-click the Group Policy object that needs the new shortcut extension, and click **Edit**. diff --git a/browsers/internet-explorer/ie11-deploy-guide/import-into-the-enterprise-mode-site-list-manager.md b/browsers/internet-explorer/ie11-deploy-guide/import-into-the-enterprise-mode-site-list-manager.md index a52315fec5..a896a41f84 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/import-into-the-enterprise-mode-site-list-manager.md +++ b/browsers/internet-explorer/ie11-deploy-guide/import-into-the-enterprise-mode-site-list-manager.md @@ -26,7 +26,7 @@ If you need to replace your entire site list because of errors, or simply becaus **Important**   Importing your file overwrites everything that’s currently in the tool, so make sure it’s what you really mean to do. - ![](images/wedge.gif) **To import your compatibility list** + **To import your compatibility list** 1. On the **File** menu of the Enterprise Mode Site List Manager, click **Import**. diff --git a/browsers/internet-explorer/ie11-deploy-guide/install-ie11-using-microsoft-intune.md b/browsers/internet-explorer/ie11-deploy-guide/install-ie11-using-microsoft-intune.md index 37a5a38754..94b6be9b40 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/install-ie11-using-microsoft-intune.md +++ b/browsers/internet-explorer/ie11-deploy-guide/install-ie11-using-microsoft-intune.md @@ -16,7 +16,7 @@ Internet Explorer 11 is available as an update in Microsoft Intune. Microsoft I ## Adding and deploying the IE11 package You can add and then deploy the IE11 package to any computer that's managed by Microsoft Intune. - ![](images/wedge.gif) **To add the IE11 package** + **To add the IE11 package** 1. From the Microsoft Intune administrator console, start the Microsoft Intune Software Publisher. @@ -24,7 +24,7 @@ You can add and then deploy the IE11 package to any computer that's managed by M For more info about how to decide which one to use, and how to use it, see [Deploy and configure apps](https://go.microsoft.com/fwlink/p/?LinkId=301806). - ![](images/wedge.gif) **To automatically deploy and install the IE11 package** + **To automatically deploy and install the IE11 package** 1. From the Microsoft Intune administrator console, start and run through the Deploy Software wizard. @@ -34,7 +34,7 @@ For more info about how to decide which one to use, and how to use it, see [Depl For more info about this, see [Deploy and configure apps](https://go.microsoft.com/fwlink/p/?LinkId=301806). - ![](images/wedge.gif) **To let your employees install the IE11 package** + **To let your employees install the IE11 package** 1. Install the package on your company's Microsoft Intune site, marking it as **Available** for the appropriate groups. diff --git a/browsers/internet-explorer/ie11-deploy-guide/install-ie11-using-operating-system-deployment-systems.md b/browsers/internet-explorer/ie11-deploy-guide/install-ie11-using-operating-system-deployment-systems.md index 88f8a3c2f5..63cbd88f37 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/install-ie11-using-operating-system-deployment-systems.md +++ b/browsers/internet-explorer/ie11-deploy-guide/install-ie11-using-operating-system-deployment-systems.md @@ -26,7 +26,7 @@ After you install the .msu file updates, you'll need to add them to your MDT dep MDT adds IE11 to your Windows images, regardless whether you are creating or deploying a customized or non-customized image. MDT also lets you perform offline servicing during the System Center 2012 R2 Configuration Manager task sequence, letting you add IE11 before starting Windows. For info, see [Microsoft Deployment Toolkit (MDT)](https://go.microsoft.com/fwlink/p/?linkid=331148). - ![](images/wedge.gif) **To add IE11 to a MDT deployment share** + **To add IE11 to a MDT deployment share** 1. Right-click **Packages** from each **Deployment Shares** location, and then click **Import OS Packages**. diff --git a/browsers/internet-explorer/ie11-deploy-guide/install-ie11-using-system-center-configuration-manager.md b/browsers/internet-explorer/ie11-deploy-guide/install-ie11-using-system-center-configuration-manager.md index 3e5c532158..8a65258e74 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/install-ie11-using-system-center-configuration-manager.md +++ b/browsers/internet-explorer/ie11-deploy-guide/install-ie11-using-system-center-configuration-manager.md @@ -14,7 +14,7 @@ ms.sitesec: library # Install Internet Explorer 11 (IE11) using System Center 2012 R2 Configuration Manager You can install Internet Explorer 11 (IE11) by using [System Center R2 2012 Configuration Manager](https://go.microsoft.com/fwlink/p/?linkid=276664). Complete these steps for each operating system and platform combination. - ![](images/wedge.gif) **To install IE11** + **To install IE11** 1. Download and approve the [System requirements and language support for Internet Explorer 11 (IE11)](system-requirements-and-language-support-for-ie11.md). diff --git a/browsers/internet-explorer/ie11-deploy-guide/install-ie11-using-the-network.md b/browsers/internet-explorer/ie11-deploy-guide/install-ie11-using-the-network.md index 90d10b49a1..7c9f00ad35 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/install-ie11-using-the-network.md +++ b/browsers/internet-explorer/ie11-deploy-guide/install-ie11-using-the-network.md @@ -15,11 +15,11 @@ You can install Internet Explorer 11 (IE11) over your network by putting your c **Note**
If you support multiple architectures and operating systems, create a subfolder for each combination. If you support multiple languages, create a subfolder for each localized installation file. - ![](images/wedge.gif) **To manually create the folder structure** + **To manually create the folder structure** - Copy your custom IE11 installation file into a folder on your network, making sure it's available to your employees. - ![](images/wedge.gif) **To create the folder structure using IEAK 11** + **To create the folder structure using IEAK 11** - Run the Internet Explorer Customization Wizard 11 in IEAK 11, using the **Full Installation Package** option.

The wizard automatically puts your custom installation files in your `\\Flat` folder. Where the `` is the location of your other build files. diff --git a/browsers/internet-explorer/ie11-deploy-guide/install-ie11-using-windows-server-update-services-wsus.md b/browsers/internet-explorer/ie11-deploy-guide/install-ie11-using-windows-server-update-services-wsus.md index d3d5a75fb7..a06e7ae728 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/install-ie11-using-windows-server-update-services-wsus.md +++ b/browsers/internet-explorer/ie11-deploy-guide/install-ie11-using-windows-server-update-services-wsus.md @@ -13,7 +13,7 @@ ms.sitesec: library # Install Internet Explorer 11 (IE11) using Windows Server Update Services (WSUS) Windows Server Update Services (WSUS) lets you download a single copy of the Microsoft product update and cache it on your local WSUS servers. You can then configure your computers to get the update from your local servers instead of Windows Update. For more information about WSUS, see [Windows Server Update Services](https://go.microsoft.com/fwlink/p/?LinkID=276790). - ![](images/wedge.gif) **To import from Windows Update to WSUS** + **To import from Windows Update to WSUS** 1. Open your WSUS admin site. For example, `http:///WSUSAdmin/`.

Where `` is the name of your WSUS server. @@ -28,7 +28,7 @@ Where `` is the name of your WSUS server. You can also download the updates without importing them by unchecking the **Import directly into Windows Server Update Services** box. - ![](images/wedge.gif) **To approve Internet Explorer in WSUS for installation** + **To approve Internet Explorer in WSUS for installation** 1. Open your WSUS admin site and check the **Review synchronization settings** box from the **To Do** list. diff --git a/browsers/internet-explorer/ie11-deploy-guide/install-problems-with-ie11.md b/browsers/internet-explorer/ie11-deploy-guide/install-problems-with-ie11.md index b077e4a853..0469d85cb3 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/install-problems-with-ie11.md +++ b/browsers/internet-explorer/ie11-deploy-guide/install-problems-with-ie11.md @@ -30,7 +30,7 @@ If you do, you can: ## Internet Explorer didn't finish installing If Internet Explorer doesn't finish installing, it might mean that Windows Update wasn't able to install an associated update, that you have a previous, unsupported version of IE installed, or that there's a problem with your copy of IE. We recommend you try this: - ![](images/wedge.gif) **To fix this issue** + **To fix this issue** 1. Uninstall IE: diff --git a/browsers/internet-explorer/ie11-deploy-guide/intranet-problems-and-ie11.md b/browsers/internet-explorer/ie11-deploy-guide/intranet-problems-and-ie11.md index c51449c0b6..c3ddb1943c 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/intranet-problems-and-ie11.md +++ b/browsers/internet-explorer/ie11-deploy-guide/intranet-problems-and-ie11.md @@ -22,7 +22,7 @@ IE11 works differently with search, based on whether your organization is domain To explicitly go to an intranet site, regardless of the environment, users can type either a trailing slash like ` contoso/` or the `http://` prefix. Either of these will cause IE11 to treat the entry as an intranet search. You can also change the default behavior so that IE11 treats your single word entry in the address bar as an intranet site, regardless of your environment. - ![](images/wedge.gif) **To enable single-word intranet search** + **To enable single-word intranet search** 1. Open Internet Explorer for the desktop, click the **Tools** menu, and then click **Internet Options**. diff --git a/browsers/internet-explorer/ie11-deploy-guide/missing-the-compatibility-view-button.md b/browsers/internet-explorer/ie11-deploy-guide/missing-the-compatibility-view-button.md index 7bb84e0a16..d25450aae1 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/missing-the-compatibility-view-button.md +++ b/browsers/internet-explorer/ie11-deploy-guide/missing-the-compatibility-view-button.md @@ -32,7 +32,7 @@ There might be extenuating circumstances in your company, which require you to c **Important**
This functionality is only available in Internet Explorer for the desktop. - ![](images/wedge.gif) **To change your Compatibility View settings** + **To change your Compatibility View settings** 1. Open Internet Explorer for the desktop, click **Tools**, and then click **Compatibility View settings**. diff --git a/browsers/internet-explorer/ie11-deploy-guide/net-framework-problems-with-ie11.md b/browsers/internet-explorer/ie11-deploy-guide/net-framework-problems-with-ie11.md index 93d825a26b..75d0ad1469 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/net-framework-problems-with-ie11.md +++ b/browsers/internet-explorer/ie11-deploy-guide/net-framework-problems-with-ie11.md @@ -13,7 +13,7 @@ ms.sitesec: library # .NET Framework problems with Internet Explorer 11 If you’re having problems launching your legacy apps while running Internet Explorer 11, it’s most likely because Internet Explorer no longer starts apps that use managed browser hosting controls, like in .NET Framework 1.1 and 2.0. - ![](images/wedge.gif) **To turn managed browser hosting controls back on** + **To turn managed browser hosting controls back on** 1. **For x86 systems or for 32-bit processes on x64 systems:** Go to the `HKLM\SOFTWARE\MICROSOFT\.NETFramework` registry key and change the **EnableIEHosting** value to **1**. diff --git a/browsers/internet-explorer/ie11-deploy-guide/out-of-date-activex-control-blocking.md b/browsers/internet-explorer/ie11-deploy-guide/out-of-date-activex-control-blocking.md index 8baab504ad..04b5f82c88 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/out-of-date-activex-control-blocking.md +++ b/browsers/internet-explorer/ie11-deploy-guide/out-of-date-activex-control-blocking.md @@ -67,7 +67,7 @@ Out-of-date ActiveX control blocking also gives you a security warning that tell ## How do I fix an outdated ActiveX control or app? From the notification about the outdated ActiveX control, you can go to the control’s website to download its latest version. - ![](images/wedge.gif) **To get the updated ActiveX control** + **To get the updated ActiveX control** 1. From the notification bar, tap or click **Update**.

IE opens the ActiveX control’s website. @@ -76,7 +76,7 @@ IE opens the ActiveX control’s website. **Security Note:**
If you don’t fully trust a site, you shouldn’t allow it to load an outdated ActiveX control. However, although we don’t recommend it, you can view the missing webpage content by tapping or clicking **Run this time**. This option runs the ActiveX control without updating or fixing the problem. The next time you visit a webpage running the same outdated ActiveX control, you’ll get the notification again. - ![](images/wedge.gif) **To get the updated app** + **To get the updated app** 1. From the security warning, tap or click **Update** link.

IE opens the app’s website. @@ -184,7 +184,7 @@ Before you can use WMI to inventory your ActiveX controls, you need to [download Before running the PowerShell script, you must copy both the .ps1 and .mof file to the same directory location, on the client computer. - ![](images/wedge.gif) **To configure IE to use WMI logging** + **To configure IE to use WMI logging** 1. Open your Group Policy editor and turn on the `Administrative Templates\Windows Components\Internet Explorer\Turn on ActiveX control logging in IE` setting. diff --git a/browsers/internet-explorer/ie11-deploy-guide/problems-after-installing-ie11.md b/browsers/internet-explorer/ie11-deploy-guide/problems-after-installing-ie11.md index 544daf207b..8a1618533a 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/problems-after-installing-ie11.md +++ b/browsers/internet-explorer/ie11-deploy-guide/problems-after-installing-ie11.md @@ -39,7 +39,7 @@ RIES turns off all custom toolbars, browser extensions, and customizations insta ## IE is crashing or seems slow If you notice that CPU usage is running higher than normal, or that IE is frequently crashing or slowing down, you should check your browser add-ons and video card. By default, IE11 uses graphics processing unit (GPU) rendering mode. However, some outdated video cards and video drivers don't support GPU hardware acceleration. If IE11 determines that your current video card or video driver doesn't support GPU hardware acceleration, it'll use Software Rendering mode. - ![](images/wedge.gif) **To check your browser add-ons** + **To check your browser add-ons** 1. Start IE11 in **No Add-ons mode** by running the **Run** command from the **Start** menu, and then typing `iexplore.exe -extoff` into the box. @@ -51,7 +51,7 @@ If the browser doesn't crash, open Internet Explorer for the desktop, click the 4. Restart IE11. Go back to the **Manage Add-Ons** window and turn on each item, one-by-one.

After you turn each item back on, see if IE crashes or slows down. Doing it this way will help you identify the add-on that's causing IE to crash. After you've figured out which add-on was causing the problem, turn it off until you have an update from the manufacturer. - ![](images/wedge.gif) **To check for Software Rendering mode** + **To check for Software Rendering mode** 1. Open Internet Explorer for the desktop, click the **Tools** menu, and then click **Internet Options**. diff --git a/browsers/internet-explorer/ie11-deploy-guide/remove-all-sites-from-your-enterprise-mode-site-list-in-the-enterprise-mode-site-list-manager.md b/browsers/internet-explorer/ie11-deploy-guide/remove-all-sites-from-your-enterprise-mode-site-list-in-the-enterprise-mode-site-list-manager.md index 017f71560c..72143e9cb1 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/remove-all-sites-from-your-enterprise-mode-site-list-in-the-enterprise-mode-site-list-manager.md +++ b/browsers/internet-explorer/ie11-deploy-guide/remove-all-sites-from-your-enterprise-mode-site-list-in-the-enterprise-mode-site-list-manager.md @@ -26,7 +26,7 @@ You can clear all of the sites from your global Enterprise Mode site list. **Important**   This is a permanent removal and erases everything. However, if you determine it was a mistake, and you saved an XML copy of your list, you can add the file again by following the steps in the [Add multiple sites to the Enterprise Mode site list using a file and Enterprise Mode Site List Manager (schema v.2)](add-multiple-sites-to-enterprise-mode-site-list-using-the-version-2-schema-and-enterprise-mode-tool.md) or [Add multiple sites to the Enterprise Mode site list using a file and the Enterprise Mode Site List Manager (schema v.1)](add-multiple-sites-to-enterprise-mode-site-list-using-the-version-1-schema-and-enterprise-mode-tool.md), depending on your operating system. - ![](images/wedge.gif) **To clear your compatibility list** + **To clear your compatibility list** 1. On the **File** menu of the Enterprise Mode Site List Manager, click **Clear list**. diff --git a/browsers/internet-explorer/ie11-deploy-guide/remove-sites-from-a-local-compatibililty-view-list.md b/browsers/internet-explorer/ie11-deploy-guide/remove-sites-from-a-local-compatibililty-view-list.md index 4972cd8ee7..cf988c785a 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/remove-sites-from-a-local-compatibililty-view-list.md +++ b/browsers/internet-explorer/ie11-deploy-guide/remove-sites-from-a-local-compatibililty-view-list.md @@ -23,7 +23,7 @@ ms.sitesec: library Remove websites that were added to a local compatibility view list by mistake or because they no longer have compatibility problems. - ![](images/wedge.gif) **To remove sites from a local compatibility view list** + **To remove sites from a local compatibility view list** 1. Open Internet Explorer 11, click **Tools**, and then click **Compatibility View Settings**. diff --git a/browsers/internet-explorer/ie11-deploy-guide/remove-sites-from-a-local-enterprise-mode-site-list.md b/browsers/internet-explorer/ie11-deploy-guide/remove-sites-from-a-local-enterprise-mode-site-list.md index 1e353200e8..9712b3448d 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/remove-sites-from-a-local-enterprise-mode-site-list.md +++ b/browsers/internet-explorer/ie11-deploy-guide/remove-sites-from-a-local-enterprise-mode-site-list.md @@ -25,7 +25,7 @@ Remove websites that were added to a local Enterprise Mode site list by mistake **Note**
The changes described in this topic only impact sites added to a local Enterprise Mode site list and not the list of sites deployed to all employees by an administrator. Employees can't delete sites added to the list by an administrator. -  ![](images/wedge.gif) **To remove single sites from a local Enterprise Mode site list** +  **To remove single sites from a local Enterprise Mode site list** 1. Open Internet Explorer 11 and go to the site you want to remove. @@ -34,7 +34,7 @@ The checkmark disappears from next to Enterprise Mode and the site is removed fr **Note**
If the site is removed by mistake, it can be added back by clicking **Enterprise Mode** again. - ![](images/wedge.gif) **To remove all sites from a local Enterprise Mode site list** + **To remove all sites from a local Enterprise Mode site list** 1. Open IE11, click **Tools**, and then click **Internet options**. diff --git a/browsers/internet-explorer/ie11-deploy-guide/save-your-site-list-to-xml-in-the-enterprise-mode-site-list-manager.md b/browsers/internet-explorer/ie11-deploy-guide/save-your-site-list-to-xml-in-the-enterprise-mode-site-list-manager.md index 98e002f0ea..c13d249a8a 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/save-your-site-list-to-xml-in-the-enterprise-mode-site-list-manager.md +++ b/browsers/internet-explorer/ie11-deploy-guide/save-your-site-list-to-xml-in-the-enterprise-mode-site-list-manager.md @@ -23,7 +23,7 @@ ms.sitesec: library You can save your current Enterprise Mode compatibility site list as an XML file, for distribution and use by your managed systems. - ![](images/wedge.gif) **To save your list as XML** + **To save your list as XML** 1. On the **File** menu of the Enterprise Mode Site List Manager, click **Save to XML**. diff --git a/browsers/internet-explorer/ie11-deploy-guide/search-your-enterprise-mode-site-list-in-the-enterprise-mode-site-list-manager.md b/browsers/internet-explorer/ie11-deploy-guide/search-your-enterprise-mode-site-list-in-the-enterprise-mode-site-list-manager.md index b45e7b3744..a26554c11b 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/search-your-enterprise-mode-site-list-in-the-enterprise-mode-site-list-manager.md +++ b/browsers/internet-explorer/ie11-deploy-guide/search-your-enterprise-mode-site-list-in-the-enterprise-mode-site-list-manager.md @@ -23,7 +23,7 @@ ms.sitesec: library You can search to see if a specific site already appears in your global Enterprise Mode site list so you don’t try to add it again. - ![](images/wedge.gif) **To search your compatibility list** + **To search your compatibility list** - From the Enterprise Mode Site List Manager, type part of the URL into the **Search** box.

The search query searches all of the text. For example, entering *“micro”* will return results like, www.microsoft.com, microsoft.com, and microsoft.com/images. Wildcard characters aren’t supported. diff --git a/browsers/internet-explorer/ie11-deploy-guide/set-the-default-browser-using-group-policy.md b/browsers/internet-explorer/ie11-deploy-guide/set-the-default-browser-using-group-policy.md index 7f11bf5d7f..66d13bed09 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/set-the-default-browser-using-group-policy.md +++ b/browsers/internet-explorer/ie11-deploy-guide/set-the-default-browser-using-group-policy.md @@ -14,7 +14,7 @@ ms.sitesec: library # Set the default browser using Group Policy You can use the Group Policy setting, **Set a default associations configuration file**, to set the default browser for your company devices running Windows 10. - ![](images/wedge.gif) **To set the default browser as Internet Explorer 11** + **To set the default browser as Internet Explorer 11** 1. Open your Group Policy editor and go to the **Administrative Templates\\Windows Components\\File Explorer\\Set a default associations configuration file** setting.

Turning this setting on also requires you to create and store a default associations configuration file, locally or on a network share. For more information about creating this file, see [Export or Import Default Application Associations]( https://go.microsoft.com/fwlink/p/?LinkId=618268). diff --git a/browsers/internet-explorer/ie11-deploy-guide/set-up-enterprise-mode-logging-and-data-collection.md b/browsers/internet-explorer/ie11-deploy-guide/set-up-enterprise-mode-logging-and-data-collection.md index 7a8ec67cc5..32d0ba628a 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/set-up-enterprise-mode-logging-and-data-collection.md +++ b/browsers/internet-explorer/ie11-deploy-guide/set-up-enterprise-mode-logging-and-data-collection.md @@ -34,7 +34,7 @@ Getting these reports lets you find out about sites that aren’t working right, ## Using ASP to collect your data When you turn logging on, you need a valid URL that points to a server that can be listened to for updates to a user’s registry key. This means you need to set up an endpoint server for the incoming POST messages, which are sent every time the user turns Enterprise Mode on or off from the **Tools** menu. - ![](images/wedge.gif) **To set up an endpoint server** + **To set up an endpoint server** 1. Configure an IIS server to work with your Enterprise Mode data collection process. If you’re unsure how to set up IIS, see the [IIS installation webpage](https://go.microsoft.com/fwlink/p/?LinkId=507609). @@ -80,7 +80,7 @@ This sample starts with you turning on Enterprise Mode and logging (either throu ### Setting up, collecting, and viewing reports For logging, you’re going to need a valid URL that points to a server that can be listened to for updates to a user’s registry key. This means you need to set up an endpoint server for the incoming POST messages, which are sent every time the user turns Enterprise Mode on or off from the **Tools** menu. These POST messages go into your database, aggregating the report data by URL, giving you the total number of reports where users turned on Enterprise Mode, the total number of reports where users turned off Enterprise Mode, and the date of the last report. - ![](images/wedge.gif) **To set up the sample** + **To set up the sample** 1. Set up a server to collect your Enterprise Mode information from your users. @@ -91,7 +91,7 @@ For logging, you’re going to need a valid URL that points to a server that can 4. On the **Build** menu, tap or click **Build Solution**.

The required packages are automatically downloaded and included in the solution. - ![](images/wedge.gif) **To set up your endpoint server** + **To set up your endpoint server** 1. Right-click on the name, PhoneHomeSample, and click **Publish**. @@ -106,7 +106,7 @@ The required packages are automatically downloaded and included in the solution. After you finish the publishing process, you need to test to make sure the app deployed successfully. - ![](images/wedge.gif) **To test, deploy, and use the app** + **To test, deploy, and use the app** 1. Open a registry editor on the computer where you deployed the app, go to the `HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Internet Explorer\Main\EnterpriseMode` key, and change the **Enable** string to: @@ -122,7 +122,7 @@ The required packages are automatically downloaded and included in the solution. 3. Get your users to visit websites, turning Enterprise Mode on or off locally, as necessary. - ![](images/wedge.gif) **To view the report results** + **To view the report results** - Go to `http:///List` to see the report results.

If you’re already on the webpage, you’ll need to refresh the page to see the results. @@ -133,7 +133,7 @@ If you’re already on the webpage, you’ll need to refresh the page to see the ### Troubleshooting publishing errors If you have errors while you’re publishing your project, you should try to update your packages. - ![](images/wedge.gif) **To update your packages** + **To update your packages** 1. From the **Tools** menu of Microsoft Visual Studio, click **NuGet Package Manager**, and click **Manage NuGet Packages for Solution**. diff --git a/browsers/internet-explorer/ie11-deploy-guide/turn-off-enterprise-mode.md b/browsers/internet-explorer/ie11-deploy-guide/turn-off-enterprise-mode.md index 25e253872a..cd25d1df05 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/turn-off-enterprise-mode.md +++ b/browsers/internet-explorer/ie11-deploy-guide/turn-off-enterprise-mode.md @@ -28,14 +28,14 @@ In addition, if you no longer want your users to be able to turn Enterprise Mode **Important**
Turning off both of these features turns off Enterprise Mode for your company. Turning off Enterprise Mode also causes any websites included in your employee’s manual site lists to not appear in Enterprise Mode. -  ![](images/wedge.gif) **To turn off the site list using Group Policy** +  **To turn off the site list using Group Policy** 1. Open your Group Policy editor, like Group Policy Management Console (GPMC). 2. Go to the **Use the Enterprise Mode IE website list** setting, and then click **Disabled**.

Enterprise Mode will no longer look for the site list, effectively turning off Enterprise Mode. However, if you previously turned on local control for your employees, Enterprise Mode will still be available from the **Tools** menu. You need to turn that part of the functionality off separately. - ![](images/wedge.gif) **To turn off local control using Group Policy** + **To turn off local control using Group Policy** 1. Open your Group Policy editor, like Group Policy Management Console (GPMC). @@ -43,7 +43,7 @@ Enterprise Mode will no longer look for the site list, effectively turning off E 3. Enterprise Mode no longer shows up on the **Tools** menu for your employees. However, if you are still using an Enterprise Mode site list, all of the globally listed sites will still appear in Enterprise Mode. If you want to turn off all of Enterprise Mode, you will need to also turn off the site list functionality. - ![](images/wedge.gif) **To turn off the site list using the registry** + **To turn off the site list using the registry** 1. Open a registry editor, such as regedit.exe. @@ -53,7 +53,7 @@ You can also use HKEY_LOCAL_MACHINE, depending whether you want to turn off the 3. Close all and restart all instances of Internet Explorer.

IE11 stops looking at the site list for rendering instructions. However, Enterprise Mode is still available to your users locally (if it was turned on). - ![](images/wedge.gif) **To turn off local control using the registry** + **To turn off local control using the registry** 1. Open a registry editor, such as regedit.exe. diff --git a/browsers/internet-explorer/ie11-deploy-guide/turn-off-natural-metrics.md b/browsers/internet-explorer/ie11-deploy-guide/turn-off-natural-metrics.md index 16525df353..49f803662c 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/turn-off-natural-metrics.md +++ b/browsers/internet-explorer/ie11-deploy-guide/turn-off-natural-metrics.md @@ -15,7 +15,7 @@ By default, Internet Explorer 11 uses “natural metrics”. Natural metrics us However, you might find that many intranet sites need you to use Windows Graphics Device Interface (GDI) metrics. To avoid potential compatibility issues, you must turn off natural metrics for those sites. - ![](images/wedge.gif) **To turn off natural metrics** + **To turn off natural metrics** - Add the following HTTP header to each site: `X-UA-TextLayoutMetrics: gdi` diff --git a/browsers/internet-explorer/ie11-deploy-guide/turn-on-enterprise-mode-and-use-a-site-list.md b/browsers/internet-explorer/ie11-deploy-guide/turn-on-enterprise-mode-and-use-a-site-list.md index abdbbc4db2..ef3ed29d52 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/turn-on-enterprise-mode-and-use-a-site-list.md +++ b/browsers/internet-explorer/ie11-deploy-guide/turn-on-enterprise-mode-and-use-a-site-list.md @@ -26,7 +26,7 @@ Before you can use a site list with Enterprise Mode, you need to turn the functi **Note**
We recommend that you store and download your website list from a secure web sever (https://), to help protect against data tampering. After the list is downloaded, it's stored locally on your employee’s computers so if the centralized file location is unavailable, they can still use Enterprise Mode. - ![](images/wedge.gif) **To turn on Enterprise Mode using Group Policy** + **To turn on Enterprise Mode using Group Policy** 1. Open your Group Policy editor and go to the `Administrative Templates\Windows Components\Internet Explorer\Use the Enterprise Mode IE website list` setting.

Turning this setting on also requires you to create and store a site list. For more information about creating your site list, see the [Use the Enterprise Mode Site List Manager](use-the-enterprise-mode-site-list-manager.md) topics. @@ -35,7 +35,7 @@ Turning this setting on also requires you to create and store a site list. For m 2. Click **Enabled**, and then in the **Options** area, type the location to your site list. - ![](images/wedge.gif) **To turn on Enterprise Mode using the registry** + **To turn on Enterprise Mode using the registry** 1. **For only the local user:** Open a registry editor, like regedit.exe and go to `HKEY_CURRENT_USER\Software\Policies\Microsoft\Internet Explorer\Main\EnterpriseMode`.

-OR-

diff --git a/browsers/internet-explorer/ie11-deploy-guide/turn-on-local-control-and-logging-for-enterprise-mode.md b/browsers/internet-explorer/ie11-deploy-guide/turn-on-local-control-and-logging-for-enterprise-mode.md index e816e64698..04edbdc3b7 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/turn-on-local-control-and-logging-for-enterprise-mode.md +++ b/browsers/internet-explorer/ie11-deploy-guide/turn-on-local-control-and-logging-for-enterprise-mode.md @@ -25,7 +25,7 @@ You can turn on local control of Enterprise Mode so that your users can turn Ent Besides turning on this feature, you also have the option to provide a URL for Enterprise Mode logging. If you turn logging on, Internet Explorer initiates a simple POST back to the supplied address, including the URL and a specification that **EnterpriseMode** was turned on or off through the **Tools** menu. - ![](images/wedge.gif) **To turn on local control of Enterprise Mode using Group Policy** + **To turn on local control of Enterprise Mode using Group Policy** 1. Open your Group Policy editor and go to the **Administrative Templates\\Windows Components\\Internet Explorer\\Let users turn on and use Enterprise Mode from the Tools menu** setting. @@ -33,7 +33,7 @@ Besides turning on this feature, you also have the option to provide a URL for E 2. Click **Enabled**, and then in the **Options** area, type the location for where to receive reports about when your employees use this functionality to turn Enterprise Mode on or off from the **Tools** menu. - ![](images/wedge.gif) **To turn on local control of Enterprise Mode using the registry** + **To turn on local control of Enterprise Mode using the registry** 1. Open a registry editor, like regedit.exe and go to `HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Internet Explorer\Main\EnterpriseMode`. diff --git a/browsers/internet-explorer/ie11-deploy-guide/user-interface-problems-with-ie11.md b/browsers/internet-explorer/ie11-deploy-guide/user-interface-problems-with-ie11.md index a4a2db0dae..86929579b2 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/user-interface-problems-with-ie11.md +++ b/browsers/internet-explorer/ie11-deploy-guide/user-interface-problems-with-ie11.md @@ -26,7 +26,7 @@ You can see your security zone settings by opening Internet Explorer for the des ## Where did the Favorites, Command, and Status bars go? For IE11, the UI has been changed to provide just the controls needed to support essential functionality, hiding anything considered non-essential, such as the **Favorites Bar**, **Command Bar**, **Menu Bar**, and **Status Bar**. This is intended to help focus users on the content of the page, rather than the browser itself. However, if you want these bars to appear, you can turn them back on using Group Policy settings. - ![](images/wedge.gif) **To turn the toolbars back on** + **To turn the toolbars back on** - Right click in the IE toolbar heading and choose to turn on the **Command bar**, **Favorites bar**, and **Status bar** from the menu.

-OR-

diff --git a/browsers/internet-explorer/ie11-deploy-guide/using-inf-files-to-create-install-packages.md b/browsers/internet-explorer/ie11-deploy-guide/using-inf-files-to-create-install-packages.md index aeeb37ff4b..7e15a06d41 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/using-inf-files-to-create-install-packages.md +++ b/browsers/internet-explorer/ie11-deploy-guide/using-inf-files-to-create-install-packages.md @@ -13,7 +13,7 @@ ms.sitesec: library # Using Setup Information (.inf) files to create install packages IEAK 11 uses Setup information (.inf) files to provide uninstallation instructions. Uninstallation instructions let your employees remove components, like files, registry entries, or shortcuts, through the **Uninstall or change a program** box. For details about .inf files, see [INF File Sections and Directives](https://go.microsoft.com/fwlink/p/?LinkId=327959). - ![](images/wedge.gif) **To add uninstallation instructions to the .inf files** + **To add uninstallation instructions to the .inf files** - Open the Registry Editor (regedit.exe) and add these registry keys: ``` diff --git a/browsers/internet-explorer/ie11-deploy-guide/what-is-the-internet-explorer-11-blocker-toolkit.md b/browsers/internet-explorer/ie11-deploy-guide/what-is-the-internet-explorer-11-blocker-toolkit.md index 5fb6495a74..443fee4ab1 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/what-is-the-internet-explorer-11-blocker-toolkit.md +++ b/browsers/internet-explorer/ie11-deploy-guide/what-is-the-internet-explorer-11-blocker-toolkit.md @@ -26,7 +26,7 @@ The Internet Explorer 11 Blocker Toolkit lets you turn off the automatic delive **Important**
The IE11 Blocker Toolkit doesn't stop users from manually installing IE11 from the [Microsoft Download Center](https://go.microsoft.com/fwlink/p/?linkid=327753). Also, even if you've installed previous versions of the toolkit before, like for Internet Explorer 10, you still need to install this version to prevent the installation of IE11. - ![](images/wedge.gif) **To install the toolkit** + **To install the toolkit** 1. Download the IE11 Blocker Toolkit from [Toolkit to Disable Automatic Delivery of Internet Explorer 11](https://go.microsoft.com/fwlink/p/?LinkId=327745). diff --git a/browsers/internet-explorer/ie11-ieak/accelerators-ieak11-wizard.md b/browsers/internet-explorer/ie11-ieak/accelerators-ieak11-wizard.md index 4e54434a53..e44077d74d 100644 --- a/browsers/internet-explorer/ie11-ieak/accelerators-ieak11-wizard.md +++ b/browsers/internet-explorer/ie11-ieak/accelerators-ieak11-wizard.md @@ -16,7 +16,7 @@ The **Accelerators** page of the Internet Explorer Administration Kit (IEAK 11) **Note**
The customizations you make on this page apply only to Internet Explorer for the desktop. -![](images/wedge.gif) **To use the Accelerators page** + **To use the Accelerators page** 1. Click **Import** to automatically import your existing accelerators from your current version of IE into this list. diff --git a/browsers/internet-explorer/ie11-ieak/add-and-approve-activex-controls-ieak11.md b/browsers/internet-explorer/ie11-ieak/add-and-approve-activex-controls-ieak11.md index 133e7f4411..0a2f864dce 100644 --- a/browsers/internet-explorer/ie11-ieak/add-and-approve-activex-controls-ieak11.md +++ b/browsers/internet-explorer/ie11-ieak/add-and-approve-activex-controls-ieak11.md @@ -21,7 +21,7 @@ While you might not care about your employees using ActiveX controls while on yo For example, your employees need to access an important Internet site, such as for a business partner or service provider, but there are ActiveX controls on their page. To make sure the site is accessible and functions the way it should, you can visit the site to review the controls, adding them as new entries to your `\Windows\Downloaded Program Files` folder. Then, as part of your browser package, you can enable and approve these ActiveX controls to run on this specific site; while all additional controls are blocked. -![](images/wedge.gif) **To add and approve ActiveX controls** +**To add and approve ActiveX controls** 1. In IE, click **Tools**, and then **Internet Options**. diff --git a/browsers/internet-explorer/ie11-ieak/additional-settings-ieak11-wizard.md b/browsers/internet-explorer/ie11-ieak/additional-settings-ieak11-wizard.md index ef6c2ef932..f8749f2d50 100644 --- a/browsers/internet-explorer/ie11-ieak/additional-settings-ieak11-wizard.md +++ b/browsers/internet-explorer/ie11-ieak/additional-settings-ieak11-wizard.md @@ -19,7 +19,7 @@ You can store your user settings in a central location so your employees that lo You’ll only see this page if you are running the **Internal** version of the IE Customization Wizard 11. -![](images/wedge.gif) **To use the Additional Settings page** +**To use the Additional Settings page** 1. Double-click **Custom Settings**, **Corporate Settings**, or **Internet Settings**, and review the included policy or restriction settings. diff --git a/browsers/internet-explorer/ie11-ieak/auto-config-ieak11-wizard.md b/browsers/internet-explorer/ie11-ieak/auto-config-ieak11-wizard.md index 35814166ac..2147e5ba34 100644 --- a/browsers/internet-explorer/ie11-ieak/auto-config-ieak11-wizard.md +++ b/browsers/internet-explorer/ie11-ieak/auto-config-ieak11-wizard.md @@ -20,13 +20,13 @@ You can set your proxy settings using Internet setting (.ins) files. You can als You can use the Domain Name System (DNS) and the Dynamic Host Configuration Protocol (DHCP) naming systems to detect and change a browser’s settings automatically when the employee first starts IE on the network. For more info, see [Set up auto detection for DHCP or DNS servers using IEAK 11](auto-detection-dhcp-or-dns-servers-ieak11.md), or refer to the product documentation for your DNS and DHCP software packages. -![](images/wedge.gif) **To check the existing settings on your employee’s devices** +**To check the existing settings on your employee’s devices** 1. Open IE, click **Tools**, click **Internet Options**, and then click the **Connections** tab. 2. Click **LAN Settings** and make sure that the **Use automatic configuration script** box is selected, confirming the path and name of the file in the **Address** box. -![](images/wedge.gif) **To use the Automatic Configuration page** +**To use the Automatic Configuration page** 1. Check the **Automatically detect configuration settings** box to automatically detect browser settings. diff --git a/browsers/internet-explorer/ie11-ieak/auto-detection-dhcp-or-dns-servers-ieak11.md b/browsers/internet-explorer/ie11-ieak/auto-detection-dhcp-or-dns-servers-ieak11.md index 65baf63d4b..16ee9d90bb 100644 --- a/browsers/internet-explorer/ie11-ieak/auto-detection-dhcp-or-dns-servers-ieak11.md +++ b/browsers/internet-explorer/ie11-ieak/auto-detection-dhcp-or-dns-servers-ieak11.md @@ -15,7 +15,7 @@ Set up your network to automatically detect and customize Internet Explorer 11 Before you can set up your environment to use automatic detection, you need to turn the feature on. -![](images/wedge.gif) **To turn on the automatic detection feature** +**To turn on the automatic detection feature** - Open Internet Explorer Administration Kit 11 (IEAK 11), run the IE Customization Wizard 11 and on the **Automatic Configuration** page, check **Automatically detect configuration settings**. For more information, see [Use the Automatic Configuration page in the IEAK 11 Wizard](auto-config-ieak11-wizard.md). @@ -30,7 +30,7 @@ Your DHCP servers must support the DHCPINFORM message, to obtain the DHCP option

**Note**
DHCP has a higher priority than DNS for automatic configuration. If DHCP provides the URL to a .pac, .jvs, .js, or .ins configuration file, the process stops and the DNS lookup doesn't happen. -![](images/wedge.gif) **To set up automatic detection for DHCP servers** +**To set up automatic detection for DHCP servers** - Open the [DHCP Administrative Tool](https://go.microsoft.com/fwlink/p/?LinkId=302212), create a new option type, using the code number 252, and then associate it with the URL to your configuration file. For detailed instructions about how to do this, see [Create an option 252 entry in DHCP](https://go.microsoft.com/fwlink/p/?LinkId=294649). @@ -40,7 +40,7 @@ DHCP has a higher priority than DNS for automatic configuration. If DHCP provide `http://123.4.567.8/account.pac`

For more detailed info about how to set up your DHCP server, see your server documentation. -![](images/wedge.gif) **To set up automatic detection for DNS servers** +**To set up automatic detection for DNS servers** 1. In your DNS database file, the file that’s used to associate your host (computer) names to static IP addresses in a zone, you need to create a host record named, **WPAD**. This record contains entries for all of the hosts that require static mappings, such as workstations, name servers, and mail servers. It also has the IP address to the web server storing your automatic configuration (.js, .jvs, .pac, or .ins) file.

The syntax is:
` IN A `
diff --git a/browsers/internet-explorer/ie11-ieak/auto-version-sync-ieak11-wizard.md b/browsers/internet-explorer/ie11-ieak/auto-version-sync-ieak11-wizard.md index ee3c61b17f..a348c82fd6 100644 --- a/browsers/internet-explorer/ie11-ieak/auto-version-sync-ieak11-wizard.md +++ b/browsers/internet-explorer/ie11-ieak/auto-version-sync-ieak11-wizard.md @@ -27,7 +27,7 @@ The **Automatic Version Synchronization** page tells you: - **Disk space available**. The amount of hard drive space available on the computer that’s running the IE Customization Wizard 11. -![](images/wedge.gif) **To use the Automatic Version Synchronization page** +**To use the Automatic Version Synchronization page** 1. Click **Synchronize**.

You might receive a security warning before downloading your Setup file, asking if you want to continue. Click **Run** to continue. diff --git a/browsers/internet-explorer/ie11-ieak/browser-ui-ieak11-wizard.md b/browsers/internet-explorer/ie11-ieak/browser-ui-ieak11-wizard.md index 08004bb0a9..de3cd4ccb5 100644 --- a/browsers/internet-explorer/ie11-ieak/browser-ui-ieak11-wizard.md +++ b/browsers/internet-explorer/ie11-ieak/browser-ui-ieak11-wizard.md @@ -15,7 +15,7 @@ The **Browser User Interface** page of the Internet Explorer Customization Wizar **Note**
The customizations you make on this page apply only to Internet Explorer for the desktop. - ![](images/wedge.gif) **To use the Browser User Interface page** + **To use the Browser User Interface page** 1. Check the **Customize Title Bars** box so you can add your custom text to the **Title Bar Text** box.

The text shows up in the title bar as **IE provided by** <*your_custom_text*>. diff --git a/browsers/internet-explorer/ie11-ieak/browsing-options-ieak11-wizard.md b/browsers/internet-explorer/ie11-ieak/browsing-options-ieak11-wizard.md index f4bab58e1e..3f600fbdde 100644 --- a/browsers/internet-explorer/ie11-ieak/browsing-options-ieak11-wizard.md +++ b/browsers/internet-explorer/ie11-ieak/browsing-options-ieak11-wizard.md @@ -15,7 +15,7 @@ The **Browsing Options** page of the Internet Explorer Administration Kit (IEAK The choices that you make on this page affect only the items shown on the **Favorites, Favorites Bar, and Feeds** page. -![](images/wedge.gif) **To use the Browsing Options page** +**To use the Browsing Options page** 1. Decide how you want to manage links that are already installed on your employee’s computer: diff --git a/browsers/internet-explorer/ie11-ieak/connection-settings-ieak11-wizard.md b/browsers/internet-explorer/ie11-ieak/connection-settings-ieak11-wizard.md index 0d7cf5093e..ffc214c941 100644 --- a/browsers/internet-explorer/ie11-ieak/connection-settings-ieak11-wizard.md +++ b/browsers/internet-explorer/ie11-ieak/connection-settings-ieak11-wizard.md @@ -15,13 +15,13 @@ The **Connection Settings** page of the Internet Explorer Administration Kit (IE **Note**
Using the options on the **Additional Settings** page of the wizard, you can let your employees change their connection settings. For more information see the [Additional Settings](additional-settings-ieak11-wizard.md) page. You can also customize additional connection settings using the **Automatic Configuration** page in the wizard. For more information see the [Automatic Configuration](auto-config-ieak11-wizard.md) page. -![](images/wedge.gif) **To view your current connection settings** +**To view your current connection settings** 1. Open IE, click the **Tools** menu, click **Internet Options**, and then click the **Connections** tab. 2. Click **Settings** to view your dial-up settings and click **LAN Settings** to view your network settings. -![](images/wedge.gif) **To use the Connection Settings page** +**To use the Connection Settings page** 1. Decide if you want to customize your connection settings. You can pick: diff --git a/browsers/internet-explorer/ie11-ieak/create-multiple-browser-packages-ieak11.md b/browsers/internet-explorer/ie11-ieak/create-multiple-browser-packages-ieak11.md index 568dfaaa3d..947b9febe9 100644 --- a/browsers/internet-explorer/ie11-ieak/create-multiple-browser-packages-ieak11.md +++ b/browsers/internet-explorer/ie11-ieak/create-multiple-browser-packages-ieak11.md @@ -21,7 +21,7 @@ You'll need to create multiple versions of your custom browser package if: The Internet Explorer Customization Wizard 11 stores your original settings in the Install.ins file and will show them each time you re-open the wizard. For more info about .ins files, see [Using Internet Settings (.INS) files with IEAK 11](using-internet-settings-ins-files.md). -![](images/wedge.gif) **To create multiple versions of your browser package** +**To create multiple versions of your browser package** 1. Use the Internet Explorer Customization Wizard 11 to create a custom browser package. For more info about how to run the wizard, start with the [Use the File Locations page in the IEAK 11 Wizard](file-locations-ieak11-wizard.md) topic. diff --git a/browsers/internet-explorer/ie11-ieak/create-uninstall-inf-files-for-custom-components.md b/browsers/internet-explorer/ie11-ieak/create-uninstall-inf-files-for-custom-components.md index bcc88868ed..1715dfaa58 100644 --- a/browsers/internet-explorer/ie11-ieak/create-uninstall-inf-files-for-custom-components.md +++ b/browsers/internet-explorer/ie11-ieak/create-uninstall-inf-files-for-custom-components.md @@ -13,7 +13,7 @@ ms.sitesec: library # Use uninstallation .INF files to uninstall custom components The Internet Explorer Administration Kit 11 (IEAK 11) uses Setup information (.inf) files to provide installation instructions for your custom browser packages. You can also use this file to uninstall your custom components by removing the files, registry entries, and shortcuts, and adding your custom component to the list of programs that can be uninstalled from **Uninstall or change a program**. -![](images/wedge.gif) **To uninstall your custom components** +**To uninstall your custom components** 1. Open the Registry Editor and add a new key and value to:
`HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\app-name,"DisplayName",,"description"`

Where *description* is the string that’s shown in the **Uninstall or change a program** box. diff --git a/browsers/internet-explorer/ie11-ieak/custom-components-ieak11-wizard.md b/browsers/internet-explorer/ie11-ieak/custom-components-ieak11-wizard.md index ca0125b893..86c289b22d 100644 --- a/browsers/internet-explorer/ie11-ieak/custom-components-ieak11-wizard.md +++ b/browsers/internet-explorer/ie11-ieak/custom-components-ieak11-wizard.md @@ -15,7 +15,7 @@ The **Custom Components** page of the Internet Explorer Customization Wizard 11 **Important**
You should sign any custom code that’s being downloaded over the Internet. The default settings of Internet Explorer 11 will automatically reject any unsigned code. For more info about digitally signing custom components, see [Security features and IEAK 11](security-and-ieak11.md). -![](images/wedge.gif) **To use the Custom Component page** +**To use the Custom Component page** 1. Click **Add**.

The **Add a Custom Component** box appears. diff --git a/browsers/internet-explorer/ie11-ieak/customize-automatic-search-for-ie.md b/browsers/internet-explorer/ie11-ieak/customize-automatic-search-for-ie.md index ba2b7e4076..7f915b87aa 100644 --- a/browsers/internet-explorer/ie11-ieak/customize-automatic-search-for-ie.md +++ b/browsers/internet-explorer/ie11-ieak/customize-automatic-search-for-ie.md @@ -18,7 +18,7 @@ Using the **Administrative Templates** section of Group Policy, you can prevent ## Automatic Search Configuration You can customize Automatic Search so that your employees can type a single word into the **Address** box to search for frequently used pages. For example, you can let a commonly used webpage about invoices appear if an employee types *invoice* into the **Address** box, even if the URL doesn’t include the term. If a website can’t be associated with the term, or if there are multiple matches, a webpage appears showing the top search results. -![](images/wedge.gif) **To set up Automatic Search** +**To set up Automatic Search** 1. Create a script (.asp) file that conditionally looks for search terms, and post it to an intranet server here: http://ieautosearch/response.asp?MT=%1&srch=%2.

For info about the acceptable values for the *%1* and *%2* parameters, see the [Automatic Search parameters](#automatic-search-parameters). For an example of the script file, see the [Sample Automatic Search script](#sample-automatic-search-script).

@@ -28,11 +28,11 @@ For info about the acceptable values for the *%1* and *%2* parameters, see the [ 3. Go to the section labeled **Searching** and type *intranet* into the **Search Provider Keyword** box. -![](images/wedge.gif) **To redirect to a different site than the one provided by the search results** +**To redirect to a different site than the one provided by the search results** - In the **Advanced Settings** section, go to the section labeled **Searching** and change the **When searching from the address bar** setting to **Just go to the most likely site**. -![](images/wedge.gif) **To disable Automatic Search** +**To disable Automatic Search** - In the **Advanced Settings** section, go to the section labeled **Searching** and change the **When searching from the address bar** setting to **Do not search from the address bar**. diff --git a/browsers/internet-explorer/ie11-ieak/favorites-favoritesbar-and-feeds-ieak11-wizard.md b/browsers/internet-explorer/ie11-ieak/favorites-favoritesbar-and-feeds-ieak11-wizard.md index fc1ffdd687..44dcbe0155 100644 --- a/browsers/internet-explorer/ie11-ieak/favorites-favoritesbar-and-feeds-ieak11-wizard.md +++ b/browsers/internet-explorer/ie11-ieak/favorites-favoritesbar-and-feeds-ieak11-wizard.md @@ -21,7 +21,7 @@ The **Favorites, Favorites Bar, and Feeds** page of the Internet Explorer Admini Although we provide default items in the **Favorites, Favorites Bar, and Feeds** area, you can remove any of the items, add more items, or add new folders and links as part of your custom package. The customizations you make on this page only apply to Internet Explorer for the desktop. -![](images/wedge.gif) **To work with Favorites** +**To work with Favorites** 1. To import your existing folder of links, pick **Favorites**, and then click **Import**. @@ -52,7 +52,7 @@ The **Details** box appears. 13. Continue with the next procedures in this topic to add additional **Favorites Bar** or **RSS Feeds** links, or you can click **Next** to go to the [Browsing Options](browsing-options-ieak11-wizard.md) page or **Back** to go to the [Accelerators](accelerators-ieak11-wizard.md) page. -![](images/wedge.gif) **To work with the Favorites Bar** +**To work with the Favorites Bar** 1. To import your existing folder of links, pick **Favorites Bar**, and then click **Import**. @@ -78,7 +78,7 @@ The **Details** box appears. 11. Continue with the next procedures in this topic to add additional **Favorites** or **RSS Feeds** links, or you can click **Next** to go to the [Browsing Options](browsing-options-ieak11-wizard.md) page or **Back** to go to the [Accelerators](accelerators-ieak11-wizard.md) page. -![](images/wedge.gif) **To work with RSS Feeds** +**To work with RSS Feeds** 1. To add a new link to the **RSS Feeds**, pick **Favorites Bar**, and then click **Add URL**.

The **Details** box appears. diff --git a/browsers/internet-explorer/ie11-ieak/feature-selection-ieak11-wizard.md b/browsers/internet-explorer/ie11-ieak/feature-selection-ieak11-wizard.md index 6c37c85e24..f7861e2e5c 100644 --- a/browsers/internet-explorer/ie11-ieak/feature-selection-ieak11-wizard.md +++ b/browsers/internet-explorer/ie11-ieak/feature-selection-ieak11-wizard.md @@ -43,7 +43,7 @@ The **Feature Selection** page of the Internet Explorer Customization Wizard 11 **Note**
Your choices on this page determine what wizard pages appear. -![](images/wedge.gif) **To use the Feature Selection page** +**To use the Feature Selection page** 1. Check the box next to each feature you want to include in your custom installation package.

You can also click **Select All** to add, or **Clear All** to remove, all of the features. diff --git a/browsers/internet-explorer/ie11-ieak/file-locations-ieak11-wizard.md b/browsers/internet-explorer/ie11-ieak/file-locations-ieak11-wizard.md index 9081a2c20e..548ad0016d 100644 --- a/browsers/internet-explorer/ie11-ieak/file-locations-ieak11-wizard.md +++ b/browsers/internet-explorer/ie11-ieak/file-locations-ieak11-wizard.md @@ -20,7 +20,7 @@ The **File Locations** page of the Internet Explorer Customization Wizard 11 let **Important**
You can create a custom installation package on your hard drive and move it to an Internet or intranet server, or you can create it directly on a server. If you create the package on a web server that’s running from your hard drive, use the path to the web server as the destination folder location. Whatever location you choose, it must be protected by appropriate access control lists (ACLs). If the location is not protected, the custom package may be tampered with. -![](images/wedge.gif) **To use the File Locations page** +**To use the File Locations page** 1. Browse to the location where you’ll store your finished custom IE installation package and the related subfolders.

**Note**
Subfolders are created for each language version, based on operating system and media type. For example, if your destination folder is `C:\Inetpub\Wwwroot\Cie\Dist`, then the English-language version is created as `C:\Inetpub\Wwwroot\Cie\Dist\Flat\Win32\En` subfolders. diff --git a/browsers/internet-explorer/ie11-ieak/first-run-and-welcome-page-ieak11-wizard.md b/browsers/internet-explorer/ie11-ieak/first-run-and-welcome-page-ieak11-wizard.md index c3ae5a99f1..27fc79e06b 100644 --- a/browsers/internet-explorer/ie11-ieak/first-run-and-welcome-page-ieak11-wizard.md +++ b/browsers/internet-explorer/ie11-ieak/first-run-and-welcome-page-ieak11-wizard.md @@ -17,7 +17,7 @@ The **First Run Wizard and Welcome Page Options** page of the Internet Explorer - **Windows 7 SP1.** You can disable the first run page for Windows 7 SP1 and then pick a custom **Welcome** page to show instead. If you don’t customize the settings on this page, your employees will see the default IE **Welcome** page. -![](images/wedge.gif) **To use the First Run Wizard and Welcome Page Options page** +**To use the First Run Wizard and Welcome Page Options page** 1. Check the **Use IE11 First Run wizard (recommended)** box to use the default First Run wizard in IE.

Clearing this box lets you use the IE11 **Welcome** page or your custom **Welcome** page. diff --git a/browsers/internet-explorer/ie11-ieak/important-urls-home-page-and-support-ieak11-wizard.md b/browsers/internet-explorer/ie11-ieak/important-urls-home-page-and-support-ieak11-wizard.md index 7d15c80a0e..74acabee72 100644 --- a/browsers/internet-explorer/ie11-ieak/important-urls-home-page-and-support-ieak11-wizard.md +++ b/browsers/internet-explorer/ie11-ieak/important-urls-home-page-and-support-ieak11-wizard.md @@ -13,7 +13,7 @@ ms.sitesec: library # Use the Important URLs - Home Page and Support page in the IEAK 11 Wizard The **Important URLS – Home Page and Support** page of the Internet Explorer Customization Wizard 11 lets you choose one or more **Home** pages and an online support page for your customized version of IE. -![](images/wedge.gif) **To use the Important URLS – Home Page and Support page** +**To use the Important URLS – Home Page and Support page** 1. In the **Add a homepage URL** box, type the URL to the page your employees go to when they click the **Home** button, and then click **Add**.

If you add multiple **Home** pages, each page appears on a separate tab in the browser. If you don’t add a custom **Home** page, IE uses http://www.msn.com by default. If you want to delete an existing page, click the URL and then click **Remove**. diff --git a/browsers/internet-explorer/ie11-ieak/internal-install-ieak11-wizard.md b/browsers/internet-explorer/ie11-ieak/internal-install-ieak11-wizard.md index f96568d6ab..22e16c2e81 100644 --- a/browsers/internet-explorer/ie11-ieak/internal-install-ieak11-wizard.md +++ b/browsers/internet-explorer/ie11-ieak/internal-install-ieak11-wizard.md @@ -15,7 +15,7 @@ The **Internal Install** page of the Internet Explorer Customization Wizard 11 l **Note**
The customizations made on this page only apply to Internet Explorer for the desktop on Windows 7. -![](images/wedge.gif) **To use the Internal Install page** +**To use the Internal Install page** 1. Pick either: diff --git a/browsers/internet-explorer/ie11-ieak/language-selection-ieak11-wizard.md b/browsers/internet-explorer/ie11-ieak/language-selection-ieak11-wizard.md index cbd3082236..625df35a75 100644 --- a/browsers/internet-explorer/ie11-ieak/language-selection-ieak11-wizard.md +++ b/browsers/internet-explorer/ie11-ieak/language-selection-ieak11-wizard.md @@ -15,7 +15,7 @@ The **Language Selection** page of the Internet Explorer Customization Wizard 11 **Important**
Make sure that the language of your IEAK 11 installation matches the language of your custom IE11 package. If the languages don’t match, IEAK 11 won’t work properly. -![](images/wedge.gif) **To use the Language Selection page** +**To use the Language Selection page** 1. Pick the language you want your custom IE11 installation package to use.

You can support as many languages as you want, but each localized version must be in its own install package.

diff --git a/browsers/internet-explorer/ie11-ieak/pkg-type-selection-ieak11-wizard.md b/browsers/internet-explorer/ie11-ieak/pkg-type-selection-ieak11-wizard.md index 02429b575c..83b0d79dd5 100644 --- a/browsers/internet-explorer/ie11-ieak/pkg-type-selection-ieak11-wizard.md +++ b/browsers/internet-explorer/ie11-ieak/pkg-type-selection-ieak11-wizard.md @@ -15,7 +15,7 @@ The **Package Type Selection** page of the Internet Explorer Customization Wizar **Important**
You can't create a full installation package for deployment to Windows 10 computers. That option only works for computers running Windows 7 or Windows 8.1. -![](images/wedge.gif) **To use the File Locations page** +**To use the File Locations page** 1. Check the **Full Installation Package** box if you’re going to build your package on, or move your package to, a local area network (LAN). This media package includes the Internet Explorer 11 installation files, and is named **IE11-Setup-Full.exe**, in the `\\FLAT\\` folder.

-OR-

  diff --git a/browsers/internet-explorer/ie11-ieak/platform-selection-ieak11-wizard.md b/browsers/internet-explorer/ie11-ieak/platform-selection-ieak11-wizard.md index f6b5085ea3..0edf5578ef 100644 --- a/browsers/internet-explorer/ie11-ieak/platform-selection-ieak11-wizard.md +++ b/browsers/internet-explorer/ie11-ieak/platform-selection-ieak11-wizard.md @@ -13,7 +13,7 @@ ms.sitesec: library # Use the Platform Selection page in the IEAK 11 Wizard The **Platform Selection** page of the Internet Explorer Customization Wizard 11 lets you pick the operating system and architecture (32-bit or 64-bit) for the devices on which you’re going to install the custom installation package. -![](images/wedge.gif) **To use the Platform Selection page** +**To use the Platform Selection page** 1. Pick the operating system and architecture for the devices on which you’re going to install the custom package.

You must create individual packages for each supported operating system.

diff --git a/browsers/internet-explorer/ie11-ieak/prep-network-install-with-ieak11.md b/browsers/internet-explorer/ie11-ieak/prep-network-install-with-ieak11.md index cf4de55861..5b0a24fd55 100644 --- a/browsers/internet-explorer/ie11-ieak/prep-network-install-with-ieak11.md +++ b/browsers/internet-explorer/ie11-ieak/prep-network-install-with-ieak11.md @@ -13,7 +13,7 @@ ms.sitesec: library # Before you install your package over your network using IEAK 11 Employees can install the custom browser package using a network server. However, you must either lower the intranet security level or make the server a trusted site. -![](images/wedge.gif) **To lower your intranet security** +**To lower your intranet security** 1. In Internet Explorer 11, click **Tools**, **Internet Options**, and then the **Security** tab. @@ -21,7 +21,7 @@ Employees can install the custom browser package using a network server. However 3. Uncheck **Automatically detect intranet network**, uncheck **Include all network paths (UNC)**, and then click **OK**. -![](images/wedge.gif) **To make your server a trusted site** +**To make your server a trusted site** 1. From the **Security** tab, click **Trusted sites**, and then **Sites**. diff --git a/browsers/internet-explorer/ie11-ieak/programs-ieak11-wizard.md b/browsers/internet-explorer/ie11-ieak/programs-ieak11-wizard.md index 947b670ab7..5cc0312c67 100644 --- a/browsers/internet-explorer/ie11-ieak/programs-ieak11-wizard.md +++ b/browsers/internet-explorer/ie11-ieak/programs-ieak11-wizard.md @@ -15,7 +15,7 @@ The **Programs** page of the Internet Explorer Customization Wizard 11 lets you **Important**
The customizations you make on this page only apply to Internet Explorer for the desktop. -![](images/wedge.gif) **To use the Programs page** +**To use the Programs page** 1. Determine whether you want to customize your connection settings. You can pick: diff --git a/browsers/internet-explorer/ie11-ieak/proxy-settings-ieak11-wizard.md b/browsers/internet-explorer/ie11-ieak/proxy-settings-ieak11-wizard.md index c758d7acbf..3a1e0162be 100644 --- a/browsers/internet-explorer/ie11-ieak/proxy-settings-ieak11-wizard.md +++ b/browsers/internet-explorer/ie11-ieak/proxy-settings-ieak11-wizard.md @@ -15,7 +15,7 @@ The **Proxy Settings** page of the Internet Explorer Customization Wizard 11 let Using a proxy server lets you limit access to the Internet. You can also use the **Additional Settings** page of the wizard to further restrict your employees from changing the proxy settings. -![](images/wedge.gif) **To use the Proxy Settings page** +**To use the Proxy Settings page** 1. Check the **Enable proxy settings** box if you want to use proxy servers for any of your services. diff --git a/browsers/internet-explorer/ie11-ieak/rsop-snapin-for-policy-settings-ieak11.md b/browsers/internet-explorer/ie11-ieak/rsop-snapin-for-policy-settings-ieak11.md index 0760b36184..c8c82c121b 100644 --- a/browsers/internet-explorer/ie11-ieak/rsop-snapin-for-policy-settings-ieak11.md +++ b/browsers/internet-explorer/ie11-ieak/rsop-snapin-for-policy-settings-ieak11.md @@ -13,7 +13,7 @@ ms.sitesec: library # Using the Resultant Set of Policy (RSoP) snap-in to review policy settings After you’ve deployed your custom Internet Explorer package to your employees, you can use the Resultant Set of Policy (RSoP) snap-in to view your created policy settings. The RSoP snap-in is a two-step process. First, you run the RSoP wizard to determine what information should be viewed. Second, you open the specific items in the console window to view the settings. For complete instructions about how to use RSoP, see [Resultant Set of Policy](https://go.microsoft.com/fwlink/p/?LinkId=259479). -![](images/wedge.gif) **To add the RSoP snap-in** +**To add the RSoP snap-in** 1. On the **Start** screen, type *MMC*.

The Microsoft Management Console opens. @@ -23,7 +23,7 @@ The Microsoft Management Console opens. 3. In the **Available snap-ins** window, go down to the **Resultant Set of Policy** snap-in option, click **Add**, and then click **OK**.

You’re now ready to use the RSoP snap-in from the console. -![](images/wedge.gif) **To use the RSoP snap-in** +**To use the RSoP snap-in** 1. Right-click **Resultant Set of Policy** and then click **Generate RSoP Data**.

You’ll only need to go through the resulting RSoP Wizard first time you run the snap-in. diff --git a/browsers/internet-explorer/ie11-ieak/search-providers-ieak11-wizard.md b/browsers/internet-explorer/ie11-ieak/search-providers-ieak11-wizard.md index d58f446135..f8816f6d9a 100644 --- a/browsers/internet-explorer/ie11-ieak/search-providers-ieak11-wizard.md +++ b/browsers/internet-explorer/ie11-ieak/search-providers-ieak11-wizard.md @@ -15,7 +15,7 @@ The **Search Providers** page of the Internet Explorer Customization Wizard 11 l **Note**
The Internet Explorer Customization Wizard 11 offers improved and extended search settings. However, you can still optionally include support for Search Suggestions and Favicons, as well as Accelerator previews by using an .ins file from a previous version of IEAK. -![](images/wedge.gif) **To use the Search Providers page** +**To use the Search Providers page** 1. Click **Import** to automatically import your existing search providers from your current version of IE into this list. diff --git a/browsers/internet-explorer/ie11-ieak/security-and-privacy-settings-ieak11-wizard.md b/browsers/internet-explorer/ie11-ieak/security-and-privacy-settings-ieak11-wizard.md index a59c87f2d8..d88993dbe2 100644 --- a/browsers/internet-explorer/ie11-ieak/security-and-privacy-settings-ieak11-wizard.md +++ b/browsers/internet-explorer/ie11-ieak/security-and-privacy-settings-ieak11-wizard.md @@ -13,7 +13,7 @@ ms.sitesec: library # Use the Security and Privacy Settings page in the IEAK 11 Wizard The **Security and Privacy Settings** page of the Internet Explorer Customization Wizard 11 lets you manage your security zones, privacy settings, and content ratings. These settings help restrict the types of content your employees can access from the Internet, including any content that might be considered offensive or otherwise inappropriate in a corporate setting. -![](images/wedge.gif) **To use the Security and Privacy Settings page** +**To use the Security and Privacy Settings page** 1. Decide if you want to customize your security zones and privacy settings. You can pick: diff --git a/browsers/internet-explorer/ie11-ieak/user-experience-ieak11-wizard.md b/browsers/internet-explorer/ie11-ieak/user-experience-ieak11-wizard.md index 11278110c1..2417baf652 100644 --- a/browsers/internet-explorer/ie11-ieak/user-experience-ieak11-wizard.md +++ b/browsers/internet-explorer/ie11-ieak/user-experience-ieak11-wizard.md @@ -15,7 +15,7 @@ The **User Experience** page of the Internet Explorer Customization Wizard 11 le **Note**
You’ll only see this page if you are running the **Internal** version of the Internet Explorer Customization Wizard 11.

The customizations you make on this page only apply to Internet Explorer for the desktop on Windows 7. -![](images/wedge.gif) **To use the User Experience page** +**To use the User Experience page** 1. Choose how your employee should interact with Setup, including: diff --git a/devices/hololens/hololens-install-apps.md b/devices/hololens/hololens-install-apps.md index ddd3a6d6b5..7bdd9bd3f8 100644 --- a/devices/hololens/hololens-install-apps.md +++ b/devices/hololens/hololens-install-apps.md @@ -62,15 +62,14 @@ Using Intune, you can also [monitor your app deployment](https://docs.microsoft. ## Use the Windows Device Portal to install apps on HoloLens. +1. [Set up the HoloLens to use the Windows Device Portal](https://developer.microsoft.com/windows/mixed-reality/using_the_windows_device_portal#setting_up_hololens_to_use_windows_device_portal). The Device Portal is a web server on your HoloLens that you can connect to from a web browser on your PC. -1. [Set up the HoloLens to use the Windows Device Portal](https://developer.microsoft.com/windows/holographic/using_the_windows_device_portal#setting_up_hololens_to_use_windows_device_portal). The Device Portal is a web server on your HoloLens that you can connect to from a web browser on your PC. +2. On a PC, connect to the HoloLens using [Wi-Fi](https://developer.microsoft.com/windows/mixed-reality/Using_the_Windows_Device_Portal.html#connecting_over_wi-fi) or [USB](https://developer.microsoft.com/windows/mixed-reality/Using_the_Windows_Device_Portal.html#connecting_over_usb). -2. On a PC, connect to the HoloLens using [Wi-Fi](https://developer.microsoft.com/windows/holographic/Using_the_Windows_Device_Portal.html#connecting_over_wi-fi) or [USB](https://developer.microsoft.com/windows/holographic/Using_the_Windows_Device_Portal.html#connecting_over_usb). - -3. [Create a user name and password](https://developer.microsoft.com/windows/holographic/Using_the_Windows_Device_Portal.html#creating_a_username_and_password) if this is the first time you connect to the Windows Device Portal, or enter the user name and password that you previously set up. +3. [Create a user name and password](https://developer.microsoft.com/windows/mixed-reality/Using_the_Windows_Device_Portal.html#creating_a_username_and_password) if this is the first time you connect to the Windows Device Portal, or enter the user name and password that you previously set up. >[!TIP] - >If you see a certificate error in the browser, follow [these troubleshooting steps](https://developer.microsoft.com/windows/holographic/Using_the_Windows_Device_Portal.html#security_certificate). + >If you see a certificate error in the browser, follow [these troubleshooting steps](https://developer.microsoft.com/windows/mixed-reality/Using_the_Windows_Device_Portal.html#security_certificate). 4. In the Windows Device Portal, click **Apps**. diff --git a/devices/hololens/hololens-kiosk.md b/devices/hololens/hololens-kiosk.md index 54d65e5489..4674584a48 100644 --- a/devices/hololens/hololens-kiosk.md +++ b/devices/hololens/hololens-kiosk.md @@ -15,17 +15,17 @@ localizationpriority: medium Kiosk mode limits the user's ability to launch new apps or change the running app. When kiosk mode is enabled for HoloLens, the bloom gesture and Cortana are disabled, and placed apps aren't shown in the user's surroundings. -1. [Set up the HoloLens to use the Windows Device Portal](https://developer.microsoft.com/windows/holographic/using_the_windows_device_portal#setting_up_hololens_to_use_windows_device_portal). The Device Portal is a web server on your HoloLens that you can connect to from a web browser on your PC. +1. [Set up the HoloLens to use the Windows Device Portal](https://developer.microsoft.com/windows/mixed-reality/using_the_windows_device_portal#setting_up_hololens_to_use_windows_device_portal). The Device Portal is a web server on your HoloLens that you can connect to from a web browser on your PC. >[!IMPORTANT] >When you set up HoloLens to use the Device Portal, you must enable **Developer Mode** on the device. **Developer Mode** on a device that has been upgraded to Windows Holographic for Business enables side-loading of apps, which risks the installation of apps that have not been certified by the Microsoft Store. Administrators can block the ability to enable **Developer Mode** using the **ApplicationManagement/AllowDeveloper Unlock** setting in the [Policy CSP](https://msdn.microsoft.com/library/windows/hardware/dn904962.aspx). [Learn more about Developer Mode.](https://msdn.microsoft.com/windows/uwp/get-started/enable-your-device-for-development#developer-mode) -2. On a PC, connect to the HoloLens using [Wi-Fi](https://developer.microsoft.com/windows/holographic/Using_the_Windows_Device_Portal.html#connecting_over_wi-fi) or [USB](https://developer.microsoft.com/windows/holographic/Using_the_Windows_Device_Portal.html#connecting_over_usb). +2. On a PC, connect to the HoloLens using [Wi-Fi](https://developer.microsoft.com/windows/mixed-reality/Using_the_Windows_Device_Portal.html#connecting_over_wi-fi) or [USB](https://developer.microsoft.com/windows/mixed-reality/Using_the_Windows_Device_Portal.html#connecting_over_usb). -3. [Create a user name and password](https://developer.microsoft.com/windows/holographic/Using_the_Windows_Device_Portal.html#creating_a_username_and_password) if this is the first time you connect to the Windows Device Portal, or enter the user name and password that you previously set up. +3. [Create a user name and password](https://developer.microsoft.com/windows/mixed-reality/Using_the_Windows_Device_Portal.html#creating_a_username_and_password) if this is the first time you connect to the Windows Device Portal, or enter the user name and password that you previously set up. >[!TIP] - >If you see a certificate error in the browser, follow [these troubleshooting steps](https://developer.microsoft.com/windows/holographic/Using_the_Windows_Device_Portal.html#security_certificate). + >If you see a certificate error in the browser, follow [these troubleshooting steps](https://developer.microsoft.com/windows/mixed-reality/Using_the_Windows_Device_Portal.html#security_certificate). 4. In the Windows Device Portal, click **Kiosk Mode**. diff --git a/devices/hololens/hololens-provisioning.md b/devices/hololens/hololens-provisioning.md index c077292864..0b887cc940 100644 --- a/devices/hololens/hololens-provisioning.md +++ b/devices/hololens/hololens-provisioning.md @@ -47,7 +47,7 @@ When you run ADKsetup.exe for Windows 10, version 1607, select **Configuration D 7. Expand **Runtime settings** and customize the package with any of the settings [described below](#what-you-can-configure). >[!IMPORTANT] - >If you create a local account in the provisioning package, you must change the password using the **Settings** app every 42 days. If the password is not changed during that period, the account might be locked out and unable to sign in. If the user account is locked out, you must [perform a full device recovery](https://developer.microsoft.com/windows/holographic/reset_or_recover_your_hololens#perform_a_full_device_recovery). + >If you create a local account in the provisioning package, you must change the password using the **Settings** app every 42 days. If the password is not changed during that period, the account might be locked out and unable to sign in. If the user account is locked out, you must [perform a full device recovery](https://developer.microsoft.com/windows/mixed-reality/reset_or_recover_your_hololens#perform_a_full_device_recovery). 8. On the **File** menu, click **Save**. @@ -107,7 +107,7 @@ In Windows ICD, when you create a provisioning package for Windows Holographic, | Setting | Description | | --- | --- | -| **Accounts** | Create a local account. HoloLens currently supports a single user only. Creating multiple local accounts in a provisioning package is not supported.

**IMPORTANT**
If you create a local account in the provisioning package, you must change the password using the **Settings** app every 42 days. If the password is not changed during that period, the account might be locked out and unable to sign in. If the user account is locked out, you must [perform a full device recovery](https://developer.microsoft.com/windows/holographic/reset_or_recover_your_hololens#perform_a_full_device_recovery). | +| **Accounts** | Create a local account. HoloLens currently supports a single user only. Creating multiple local accounts in a provisioning package is not supported.

**IMPORTANT**
If you create a local account in the provisioning package, you must change the password using the **Settings** app every 42 days. If the password is not changed during that period, the account might be locked out and unable to sign in. If the user account is locked out, you must [perform a full device recovery](https://developer.microsoft.com/windows/mixed-reality/reset_or_recover_your_hololens#perform_a_full_device_recovery). | | **Certificates** | Deploy a certificate to HoloLens. | | **ConnectivityProfiles** | Deploy a Wi-Fi profile to HoloLens. | | **EditionUpgrade** | [Upgrade to Windows Holographic for Business.](hololens-upgrade-enterprise.md) | diff --git a/devices/hololens/hololens-requirements.md b/devices/hololens/hololens-requirements.md index d8a1c1b901..11331b62f4 100644 --- a/devices/hololens/hololens-requirements.md +++ b/devices/hololens/hololens-requirements.md @@ -11,7 +11,7 @@ localizationpriority: medium # Microsoft HoloLens in the enterprise: requirements -When you develop for HoloLens, there are [system requirements and tools](https://developer.microsoft.com/windows/holographic/install_the_tools) that you need. In an enterprise environment, there are also a few requirements to use and manage HoloLens which are listed below. +When you develop for HoloLens, there are [system requirements and tools](https://developer.microsoft.com/windows/mixed-reality/install_the_tools) that you need. In an enterprise environment, there are also a few requirements to use and manage HoloLens which are listed below. ## General use - Microsoft account or Azure Active Directory (Azure AD) account diff --git a/devices/hololens/hololens-upgrade-enterprise.md b/devices/hololens/hololens-upgrade-enterprise.md index bcc472ca43..8963cea7f3 100644 --- a/devices/hololens/hololens-upgrade-enterprise.md +++ b/devices/hololens/hololens-upgrade-enterprise.md @@ -11,7 +11,7 @@ localizationpriority: medium # Unlock Windows Holographic for Business features -Microsoft HoloLens is available in the *Development Edition*, which runs Windows Holographic (an edition of Windows 10 designed for HoloLens), and in the [Commercial Suite](https://developer.microsoft.com/windows/holographic/release_notes#introducing_microsoft_hololens_commercial_suite), which provides extra features designed for business. +Microsoft HoloLens is available in the *Development Edition*, which runs Windows Holographic (an edition of Windows 10 designed for HoloLens), and in the [Commercial Suite](https://developer.microsoft.com/windows/mixed-reality/release_notes#introducing_microsoft_hololens_commercial_suite), which provides extra features designed for business. When you purchase the Commercial Suite, you receive a license that upgrades Windows Holographic to Windows Holographic for Business. This license can be applied to the device either through the organization's [mobile device management (MDM) provider](#edition-upgrade-using-mdm) or a [provisioning package](#edition-upgrade-using-a-provisioning-package). diff --git a/devices/hololens/index.md b/devices/hololens/index.md index b57a42f178..698a2db7c4 100644 --- a/devices/hololens/index.md +++ b/devices/hololens/index.md @@ -33,8 +33,8 @@ localizationpriority: medium - [Help for using HoloLens](https://support.microsoft.com/products/hololens) -- [Documentation for Holographic app development](https://developer.microsoft.com/windows/holographic/documentation) +- [Documentation for Holographic app development](https://developer.microsoft.com/windows/mixed-reality/documentation) - [HoloLens Commercial Suite](https://www.microsoft.com/microsoft-hololens/hololens-commercial) -- [HoloLens release notes](https://developer.microsoft.com/en-us/windows/holographic/release_notes) \ No newline at end of file +- [HoloLens release notes](https://developer.microsoft.com/en-us/windows/mixed-reality/release_notes) \ No newline at end of file diff --git a/devices/surface-hub/TOC.md b/devices/surface-hub/TOC.md index 5d807a4e97..a9cde81f15 100644 --- a/devices/surface-hub/TOC.md +++ b/devices/surface-hub/TOC.md @@ -1,41 +1,42 @@ # [Microsoft Surface Hub](index.md) -## [What's new in Windows 10, version 1703 for Surface Hub?](surfacehub-whats-new-1703.md) -## [Differences between Surface Hub and Windows 10 Enterprise](differences-between-surface-hub-and-windows-10-enterprise.md) -## [Prepare your environment for Microsoft Surface Hub](prepare-your-environment-for-surface-hub.md) -### [Physically install Microsoft Surface Hub](physically-install-your-surface-hub-device.md) -### [Create and test a device account](create-and-test-a-device-account-surface-hub.md) -#### [Online deployment](online-deployment-surface-hub-device-accounts.md) -#### [On-premises deployment (single forest)](on-premises-deployment-surface-hub-device-accounts.md) -#### [On-premises deployment (multiple forests)](on-premises-deployment-surface-hub-multi-forest.md) -#### [Hybrid deployment](hybrid-deployment-surface-hub-device-accounts.md) -#### [Create a device account using UI](create-a-device-account-using-office-365.md) -#### [Microsoft Exchange properties](exchange-properties-for-surface-hub-device-accounts.md) -#### [Applying ActiveSync policies to device accounts](apply-activesync-policies-for-surface-hub-device-accounts.md) -#### [Password management](password-management-for-surface-hub-device-accounts.md) -### [Create provisioning packages](provisioning-packages-for-surface-hub.md) -### [Admin group management](admin-group-management-for-surface-hub.md) -## [Set up Microsoft Surface Hub](set-up-your-surface-hub.md) -### [Setup worksheet](setup-worksheet-surface-hub.md) -### [First-run program](first-run-program-surface-hub.md) -## [Manage Microsoft Surface Hub](manage-surface-hub.md) -### [Remote Surface Hub management](remote-surface-hub-management.md) -#### [Manage settings with an MDM provider](manage-settings-with-mdm-for-surface-hub.md) -#### [Monitor your Surface Hub](monitor-surface-hub.md) -#### [Windows updates](manage-windows-updates-for-surface-hub.md) -### [Manage Surface Hub settings](manage-surface-hub-settings.md) -#### [Local management for Surface Hub settings](local-management-surface-hub-settings.md) -#### [Accessibility](accessibility-surface-hub.md) -#### [Change the Surface Hub device account](change-surface-hub-device-account.md) -#### [Device reset](device-reset-surface-hub.md) -#### [Use fully qualified domain name with Surface Hub](use-fully-qualified-domain-name-surface-hub.md) -#### [Wireless network management](wireless-network-management-for-surface-hub.md) -### [Install apps on your Surface Hub](install-apps-on-surface-hub.md) -### [End a Surface Hub meeting with End session](i-am-done-finishing-your-surface-hub-meeting.md) -### [Save your BitLocker key](save-bitlocker-key-surface-hub.md) -### [Connect other devices and display with Surface Hub](connect-and-display-with-surface-hub.md) -### [Using a room control system](use-room-control-system-with-surface-hub.md) -## [PowerShell for Surface Hub](appendix-a-powershell-scripts-for-surface-hub.md) -## [How Surface Hub addresses Wi-Fi Direct security issues](surface-hub-wifi-direct.md) -## [Troubleshoot Microsoft Surface Hub](troubleshoot-surface-hub.md) +## [Microsoft Surface Hub administrator's guide](surface-hub-administrators-guide.md) +### [Intro to Microsoft Surface Hub](intro-to-surface-hub.md) +### [Prepare your environment for Microsoft Surface Hub](prepare-your-environment-for-surface-hub.md) +#### [Physically install Microsoft Surface Hub](physically-install-your-surface-hub-device.md) +#### [Create and test a device account](create-and-test-a-device-account-surface-hub.md) +##### [Online deployment](online-deployment-surface-hub-device-accounts.md) +##### [On-premises deployment (single forest)](on-premises-deployment-surface-hub-device-accounts.md) +##### [On-premises deployment (multiple forests)](on-premises-deployment-surface-hub-multi-forest.md) +##### [Hybrid deployment](hybrid-deployment-surface-hub-device-accounts.md) +##### [Create a device account using UI](create-a-device-account-using-office-365.md) +##### [Microsoft Exchange properties](exchange-properties-for-surface-hub-device-accounts.md) +##### [Applying ActiveSync policies to device accounts](apply-activesync-policies-for-surface-hub-device-accounts.md) +##### [Password management](password-management-for-surface-hub-device-accounts.md) +#### [Create provisioning packages](provisioning-packages-for-certificates-surface-hub.md) +#### [Admin group management](admin-group-management-for-surface-hub.md) +### [Set up Microsoft Surface Hub](set-up-your-surface-hub.md) +#### [Setup worksheet](setup-worksheet-surface-hub.md) +#### [First-run program](first-run-program-surface-hub.md) +### [Manage Microsoft Surface Hub](manage-surface-hub.md) +#### [Remote Surface Hub management](remote-surface-hub-management.md) +##### [Manage settings with an MDM provider](manage-settings-with-mdm-for-surface-hub.md) +##### [Monitor your Surface Hub](monitor-surface-hub.md) +##### [Windows updates](manage-windows-updates-for-surface-hub.md) +#### [Manage Surface Hub settings](manage-surface-hub-settings.md) +##### [Local management for Surface Hub settings](local-management-surface-hub-settings.md) +##### [Accessibility](accessibility-surface-hub.md) +##### [Change the Surface Hub device account](change-surface-hub-device-account.md) +##### [Device reset](device-reset-surface-hub.md) +##### [Use fully qualified domain name with Surface Hub](use-fully-qualified-domain-name-surface-hub.md) +##### [Wireless network management](wireless-network-management-for-surface-hub.md) +#### [Install apps on your Surface Hub](install-apps-on-surface-hub.md) +#### [End a Surface Hub meeting with I'm Done](i-am-done-finishing-your-surface-hub-meeting.md) +#### [Save your BitLocker key](save-bitlocker-key-surface-hub.md) +#### [Connect other devices and display with Surface Hub](connect-and-display-with-surface-hub.md) +#### [Using a room control system](use-room-control-system-with-surface-hub.md) +### [Troubleshoot Microsoft Surface Hub](troubleshoot-surface-hub.md) +### [Appendix: PowerShell](appendix-a-powershell-scripts-for-surface-hub.md) ## [Useful downloads for Surface Hub administrators](surface-hub-downloads.md) +## [Differences between Surface Hub and Windows 10 Enterprise](differences-between-surface-hub-and-windows-10-enterprise.md) +## [How Surface Hub addresses Wi-Fi Direct security issues](surface-hub-wifi-direct.md) ## [Change history for Surface Hub](change-history-surface-hub.md) \ No newline at end of file diff --git a/devices/surface-hub/accessibility-surface-hub.md b/devices/surface-hub/accessibility-surface-hub.md index 7ea46504e4..46348c087d 100644 --- a/devices/surface-hub/accessibility-surface-hub.md +++ b/devices/surface-hub/accessibility-surface-hub.md @@ -7,7 +7,7 @@ ms.prod: w10 ms.mktglfcycl: manage ms.pagetype: surfacehub ms.sitesec: library -author: jdeckerMS +author: TrudyHa localizationpriority: medium --- @@ -30,7 +30,7 @@ The full list of accessibility settings are available to IT admins in the **Sett | Mouse | Defaults selected for **Pointer size**, **Pointer color** and **Mouse keys**. | | Other options | Defaults selected for **Visual options** and **Touch feedback**. | -Additionally, these accessibility features and apps are returned to default settings when users press [End session](finishing-your-surface-hub-meeting.md): +Additionally, these accessibility features and apps are returned to default settings when users press [I'm Done](i-am-done-finishing-your-surface-hub-meeting.md): - Narrator - Magnifier - High contrast diff --git a/devices/surface-hub/admin-group-management-for-surface-hub.md b/devices/surface-hub/admin-group-management-for-surface-hub.md index 2abc8df009..7607199209 100644 --- a/devices/surface-hub/admin-group-management-for-surface-hub.md +++ b/devices/surface-hub/admin-group-management-for-surface-hub.md @@ -7,7 +7,7 @@ ms.prod: w10 ms.mktglfcycl: manage ms.sitesec: library ms.pagetype: surfacehub, security -author: jdeckerMS +author: TrudyHa localizationpriority: medium --- diff --git a/devices/surface-hub/appendix-a-powershell-scripts-for-surface-hub.md b/devices/surface-hub/appendix-a-powershell-scripts-for-surface-hub.md index b04dd91222..76275e3ec8 100644 --- a/devices/surface-hub/appendix-a-powershell-scripts-for-surface-hub.md +++ b/devices/surface-hub/appendix-a-powershell-scripts-for-surface-hub.md @@ -1,5 +1,5 @@ --- -title: PowerShell for Surface Hub (Surface Hub) +title: Appendix PowerShell (Surface Hub) description: PowerShell scripts to help set up and manage your Microsoft Surface Hub . ms.assetid: 3EF48F63-8E4C-4D74-ACD5-461F1C653784 keywords: PowerShell, set up Surface Hub, manage Surface Hub @@ -7,14 +7,14 @@ ms.prod: w10 ms.mktglfcycl: manage ms.sitesec: library ms.pagetype: surfacehub -author: jdeckerMS +author: TrudyHa localizationpriority: medium --- -# PowerShell for Surface Hub +# Appendix: PowerShell (Surface Hub) -PowerShell scripts to help set up and manage your Microsoft Surface Hub. +PowerShell scripts to help set up and manage your Microsoft Surface Hub . - [PowerShell scripts for Surface Hub admins](#scripts-for-admins) - [Create an on-premise account](#create-on-premise-ps-scripts) @@ -43,8 +43,7 @@ What do you need in order to run the scripts? - Remote PowerShell access to your organization's domain or tenant, Exchange servers, and Skype for Business servers. - Admin credentials for your organization's domain or tenant, Exchange servers, and Skype for Business servers. ->[!NOTE] ->Whether you’re creating a new account or modifying an already-existing account, the validation script will verify that your device account is configured correctly. You should always run the validation script before adding a device account to Surface Hub. +>**Note**  Whether you’re creating a new account or modifying an already-existing account, the validation script will verify that your device account is configured correctly. You should always run the validation script before adding a device account to Surface Hub.   diff --git a/devices/surface-hub/apply-activesync-policies-for-surface-hub-device-accounts.md b/devices/surface-hub/apply-activesync-policies-for-surface-hub-device-accounts.md index e49731d001..f6cad56654 100644 --- a/devices/surface-hub/apply-activesync-policies-for-surface-hub-device-accounts.md +++ b/devices/surface-hub/apply-activesync-policies-for-surface-hub-device-accounts.md @@ -7,7 +7,7 @@ ms.prod: w10 ms.mktglfcycl: manage ms.sitesec: library ms.pagetype: surfacehub -author: jdeckerMS +author: TrudyHa localizationpriority: medium --- diff --git a/devices/surface-hub/change-history-surface-hub.md b/devices/surface-hub/change-history-surface-hub.md index d8d69bb450..74ee57c2f5 100644 --- a/devices/surface-hub/change-history-surface-hub.md +++ b/devices/surface-hub/change-history-surface-hub.md @@ -6,7 +6,7 @@ ms.prod: w10 ms.mktglfcycl: manage ms.sitesec: library ms.pagetype: surfacehub -author: jdeckerMS +author: TrudyHa localizationpriority: medium --- @@ -14,10 +14,6 @@ localizationpriority: medium This topic lists new and updated topics in the [Surface Hub Admin Guide]( surface-hub-administrators-guide.md). -## RELEASE: Windows 10, version 1703 - -The topics in this library have been updated for Windows 10, version 1703 (also known as the Creators Update). - ## February 2017 | New or changed topic | Description | diff --git a/devices/surface-hub/change-surface-hub-device-account.md b/devices/surface-hub/change-surface-hub-device-account.md index 2ad7a30571..6dc6bf7016 100644 --- a/devices/surface-hub/change-surface-hub-device-account.md +++ b/devices/surface-hub/change-surface-hub-device-account.md @@ -7,7 +7,7 @@ ms.prod: w10 ms.mktglfcycl: manage ms.sitesec: library ms.pagetype: surfacehub -author: jdeckerMS +author: TrudyHa localizationpriority: medium --- diff --git a/devices/surface-hub/create-a-device-account-using-office-365.md b/devices/surface-hub/create-a-device-account-using-office-365.md index b6719175f5..914b6136e6 100644 --- a/devices/surface-hub/create-a-device-account-using-office-365.md +++ b/devices/surface-hub/create-a-device-account-using-office-365.md @@ -7,7 +7,7 @@ ms.prod: w10 ms.mktglfcycl: manage ms.sitesec: library ms.pagetype: surfacehub -author: jdeckerMS +author: TrudyHa localizationpriority: medium --- diff --git a/devices/surface-hub/create-and-test-a-device-account-surface-hub.md b/devices/surface-hub/create-and-test-a-device-account-surface-hub.md index 5c6ab373e5..9930a748e3 100644 --- a/devices/surface-hub/create-and-test-a-device-account-surface-hub.md +++ b/devices/surface-hub/create-and-test-a-device-account-surface-hub.md @@ -7,7 +7,7 @@ ms.prod: w10 ms.mktglfcycl: manage ms.sitesec: library ms.pagetype: surfacehub -author: jdeckerMS +author: TrudyHa localizationpriority: medium --- diff --git a/devices/surface-hub/device-reset-surface-hub.md b/devices/surface-hub/device-reset-surface-hub.md index 0d070c1ae5..f2cb38c5f2 100644 --- a/devices/surface-hub/device-reset-surface-hub.md +++ b/devices/surface-hub/device-reset-surface-hub.md @@ -7,7 +7,7 @@ ms.prod: w10 ms.mktglfcycl: manage ms.sitesec: library ms.pagetype: surfacehub -author: jdeckerMS +author: TrudyHa localizationpriority: medium --- @@ -49,49 +49,21 @@ If you see a blank screen for long periods of time during the **Reset device** p ![Image showing Update & Security group in Settings app for Surface Hub.](images/sh-settings-update-security.png) -3. Click **Recovery**, and then, under **Reset device**, click **Get started**. +3. Click **Recovery**, and then click **Get started**. ![Image showing Reset device option in Settings app for Surface Hub.](images/sh-settings-reset-device.png) - -## Recover a Surface Hub from the cloud +## Reset a Surface Hub from Windows Recovery Environment -In the Windows Recovery Environment (Windows RE), you can recover your device by downloading a factory build from the cloud and installing it on the Surface Hub. This allows devices in an unusable state to recover without requiring assistance from Microsoft Support. +On rare occasions, a Surface Hub may encounter an error while cleaning up user and app data at the end of a session. When this happens, the device will automatically reboot and try again. But if this operation fails repeatedly, the device will be automatically locked to protect user data. To unlock it, you must reset the device from [Windows Recovery Environment](https://technet.microsoft.com/library/cc765966.aspx) (Windows RE). -### Recover a Surface Hub in a bad state - -If the device account gets into an unstable state or the Admin account is running into issues, you can use cloud recovery in **Settings**. You should only use cloud recovery when [reset](#reset-a-surface-hub-from-settings) doesn't fix the problem. - -1. On your Surface Hub, go to **Settings** > **Update & security** > **Recovery**. - -2. Under **Recover from the cloud**, click **Restart now**. - - ![recover from the cloud](images/recover-from-the-cloud.png) - -### Recover a locked Surface Hub - -On rare occasions, a Surface Hub may encounter an error while cleaning up user and app data at the end of a session. When this happens, the device will automatically reboot and try again. But if this operation fails repeatedly, the device will be automatically locked to protect user data. To unlock it, you must reset or recover the device from [Windows RE](https://technet.microsoft.com/library/cc765966.aspx). +**To reset a Surface Hub from Windows Recovery Environment** 1. From the welcome screen, toggle the Surface Hub's power switch 3 times. Wait a few seconds between each toggle. See the [Surface Hub Site Readiness Guide](https://www.microsoft.com/surface/support/surface-hub/surface-hub-site-readiness-guide) for help with locating the power switch. -2. The device should automatically boot into Windows RE. -3. After the Surface Hub enters Windows RE, select **Recover from the cloud**. (Optionally, you can choose **Reset**, however **Recover from the cloud** is the recommended approach.) - >[!NOTE] - >When using **Recover from the cloud**, an ethernet connection is recommended. - - ![Recover from the cloud](images/recover-from-cloud.png) - -4. Enter the Bitlocker key (if prompted). -5. When prompted, select **Reinstall**. +2. The device should automatically boot into Windows RE. Select **Advanced Repair**. +3. Select **Reset**. +4. If prompted, enter your device's BitLocker key. - ![Reinstall](images/reinstall.png) - -6. Select **Yes** to repartition the disk. - - ![Repartition](images/repartition.png) - -Reset will begin after the image is downloaded from the cloud. You will see progress indicators. - -![downloading 97&](images/recover-progress.png) ## Related topics diff --git a/devices/surface-hub/differences-between-surface-hub-and-windows-10-enterprise.md b/devices/surface-hub/differences-between-surface-hub-and-windows-10-enterprise.md index e6d812ea78..73557c1f2c 100644 --- a/devices/surface-hub/differences-between-surface-hub-and-windows-10-enterprise.md +++ b/devices/surface-hub/differences-between-surface-hub-and-windows-10-enterprise.md @@ -33,7 +33,7 @@ Surface Hub doesn't have a lock screen or a screen saver, but it has a similar f Surface Hub is designed to be used in communal spaces, such as meeting rooms. Unlike Windows PCs, anyone can walk up and use a Surface Hub without logging on. The system always runs as a local, auto logged-in, low-privilege user. It doesn't support logging in any additional users - including admin users. > [!NOTE] -> Surface Hub supports signing in to Microsoft Edge and other apps. However, these credentials are deleted when users press **End session**. +> Surface Hub supports signing in to Microsoft Edge and other apps. However, these credentials are deleted when users press **I'm done**. *Organization policies that this may affect:*
Generally, Surface Hub uses lockdown features rather than user access control to enforce security. Policies related to password requirements, interactive logon, user accounts, and access control don't apply for Surface Hub. @@ -46,7 +46,7 @@ Users have access to a limited set of directories on the Surface Hub: - Pictures - Downloads -Files saved locally in these directories are deleted when users press **End session**. To save content created during a meeting, users should save files to a USB drive or to OneDrive. +Files saved locally in these directories are deleted when users press **I'm done**. To save content created during a meeting, users should save files to a USB drive or to OneDrive. *Organization policies that this may affect:*
Policies related to access permissions and ownership of files and folders don't apply for Surface Hub. Users can't browse and save files to system directories and network folders. diff --git a/devices/surface-hub/exchange-properties-for-surface-hub-device-accounts.md b/devices/surface-hub/exchange-properties-for-surface-hub-device-accounts.md index 527eaf6198..3e9df023a1 100644 --- a/devices/surface-hub/exchange-properties-for-surface-hub-device-accounts.md +++ b/devices/surface-hub/exchange-properties-for-surface-hub-device-accounts.md @@ -7,7 +7,7 @@ ms.prod: w10 ms.mktglfcycl: manage ms.sitesec: library ms.pagetype: surfacehub -author: jdeckerMS +author: TrudyHa localizationpriority: medium --- diff --git a/devices/surface-hub/finishing-your-surface-hub-meeting.md b/devices/surface-hub/finishing-your-surface-hub-meeting.md deleted file mode 100644 index 8733038060..0000000000 --- a/devices/surface-hub/finishing-your-surface-hub-meeting.md +++ /dev/null @@ -1,92 +0,0 @@ ---- -title: End session - ending a Surface Hub meeting -description: To end a Surface Hub meeting, tap End session. Surface Hub cleans up the application state, operating system state, and the user interface so that Surface Hub is ready for the next meeting. -keywords: I am Done, end Surface Hub meeting, finish Surface Hub meeting, clean up Surface Hub meeting -ms.prod: w10 -ms.mktglfcycl: manage -ms.sitesec: library -ms.pagetype: surfacehub -author: jdeckerMS -localizationpriority: medium ---- - -# End a Surface Hub meeting with End session -Surface Hub is a collaboration device designed to be used in meeting spaces by different groups of people. At the end of a meeting, users can tap **End session** to clean up any sensitive data and prepare the device for the next meeting. Surface Hub will clean up, or reset, the following states: -- Applications -- Operating system -- User interface - -This topic explains what **End session** resets for each of these states. - -## Applications -When you start apps on Surface Hub, they are stored in memory and data is stored at the application level. Data is available to all users during that session (or meeting) until date is removed or overwritten. When **End session** is selected, Surface Hub application state is cleared out by closing applications, deleting browser history, resetting applications, and removing Skype logs. - -### Close applications -Surface Hub closes all visible windows, including Win32 and Universal Windows Platform (UWP) applications. The application close stage uses the multitasking view to query the visible windows. Win32 windows that do not close within a certain timeframe are closed using **TerminateProcess**. - -### Delete browser history -Surface Hub uses Delete Browser History (DBH) in Edge to clear Edge history and cached data. This is similar to how a user can clear out their browser history manually, but **End session** also ensures that application states are cleared and data is removed before the next session, or meeting, starts. - -### Reset applications -**End session** resets the state of each application that is installed on the Surface Hub. Resetting an application clears all background tasks, application data, notifications, and user consent dialogs. Applications are returned to their first-run state for the next people that use Surface Hub. - -### Remove Skype logs -Skype does not store personally-identifiable information on Surface Hub. Information is stored in the Skype service to meet existing Skype for Business guidance. Local Skype logging information is the only data removed when **End session** is selected. This includes Unified Communications Client Platform (UCCP) logs and media logs. - -## Operating System -The operating system hosts a variety of information about the state of the sessions that needs to be cleared after each Surface Hub meeting. - -### File System -Meeting attendees have access to a limited set of directories on the Surface Hub. When **End session** is selected, Surface Hub clears these directories:
-- Music -- Videos -- Documents -- Pictures -- Downloads - -Surface Hub also clears these directories, since many applications often write to them: -- Desktop -- Favorites -- Recent -- Public Documents -- Public Music -- Public Videos -- Public Downloads - -### Credentials -User credentials that are stored in **TokenBroker**, **PasswordVault**, or **Credential Manager** are cleared when you tap **End session**. - -## User interface -User interface (UI) settings are returned to their default values when **End session** is selected. - -### UI items -- Reset Quick Actions to default state -- Clear Toast notifications -- Reset volume levels -- Reset sidebar width -- Reset tablet mode layout -- Sign user out of Office 365 meetings and files - -### Accessibility -Accessibility features and apps are returned to default settings when **End session** is selected. -- Filter keys -- High contrast -- Sticky keys -- Toggle keys -- Mouse keys -- Magnifier -- Narrator - -### Clipboard -The clipboard is cleared to remove data that was copied to the clipboard during the session. - -## Frequently asked questions -**What happens if I forget to tap End session at the end of a meeting, and someone else uses the Surface Hub later?**
-Surface Hub only cleans up meeting content when users tap **End session**. If you leave the meeting without tapping **End session**, the device will return to the welcome screen after some time. From the welcome screen, users have the option to resume the previous session or start a new one. You can also disable the ability to resume a session if **End session** is not pressed. - -**Are documents recoverable?**
-Removing files from the hard drive when **End session** is selected is just like any other file deletion from a hard disk drive. Third-party software might be able to recover data from the hard disk drive, but file recovery is not a supported feature on Surface Hub. To prevent data loss, always save the data you need before leaving a meeting. - -**Do the clean-up actions from End session comply with the US Department of Defense clearing and sanitizing standard: DoD 5220.22-M?**
-No. Currently, the clean-up actions from **End session** do not comply with this standard. - diff --git a/devices/surface-hub/first-run-program-surface-hub.md b/devices/surface-hub/first-run-program-surface-hub.md index 4e6ceac8b8..6ee36023cc 100644 --- a/devices/surface-hub/first-run-program-surface-hub.md +++ b/devices/surface-hub/first-run-program-surface-hub.md @@ -7,7 +7,7 @@ ms.prod: w10 ms.mktglfcycl: manage ms.sitesec: library ms.pagetype: surfacehub -author: jdeckerMS +author: TrudyHa localizationpriority: medium --- @@ -43,10 +43,9 @@ Each of these sections also contains information about paths you might take when This is the first screen you'll see when you power up the Surface Hub for the first time. It's where you input localization information for your device. ->[!NOTE] ->This is also where you begin the optional process of deploying a provisioning package. See [Create provisioning packages](provisioning-packages-for-certificates-surface-hub.md) if that's what you're doing. +>**Note**  This is also where you begin the optional process of deploying a provisioning package. See [Create provisioning packages](provisioning-packages-for-certificates-surface-hub.md) if that's what you're doing. - Select a language and the initial setup options are displayed. +  ![Image showing ICD options checklist.](images/setuplocale.png) @@ -327,9 +326,6 @@ This is what happens when you choose an option. - **Use Microsoft Azure Active Directory** Clicking this option allows you to join the device to Azure AD. Once you click **Next**, the device will restart to apply some settings, and then you’ll be taken to the [Use Microsoft Azure Active Directory](#use-microsoft-azure) page and asked to enter credentials that can allow you to join Azure AD. After joining, admins from the joined organization will be able to use the Settings app. The specific people that will be allowed depends on your Azure AD subscription and how you’ve configured the settings for your Azure AD organization. - - >[!IMPORTANT] - >If you join Surface Hub to Azure AD during first-run setup, single sign-on (SSO) for Office apps will not work properly. Users will have to sign in to each Office app individually. - **Use Active Directory Domain Services** @@ -386,7 +382,7 @@ Once the device has been domain joined, you must specify a security group from t The following input is required: - **Domain:** This is the fully qualified domain name (FQDN) of the domain that you want to join. A security group from this domain can be used to manage the device. -- **User name:** The user name of an account that has sufficient permission to join the specified domain. This account must be a computer object. +- **User name:** The user name of an account that has sufficient permission to join the specified domain. - **Password:** The password for the account. After the credentials are verified, you will be asked to type a security group name. This input is required. diff --git a/devices/surface-hub/i-am-done-finishing-your-surface-hub-meeting.md b/devices/surface-hub/i-am-done-finishing-your-surface-hub-meeting.md new file mode 100644 index 0000000000..ccf99db112 --- /dev/null +++ b/devices/surface-hub/i-am-done-finishing-your-surface-hub-meeting.md @@ -0,0 +1,91 @@ +--- +title: I am done - ending a Surface Hub meeting +description: To end a Surface Hub meeting, tap I am Done. Surface Hub cleans up the application state, operating system state, and the user interface so that Surface Hub is ready for the next meeting. +keywords: I am Done, end Surface Hub meeting, finish Surface Hub meeting, clean up Surface Hub meeting +ms.prod: w10 +ms.mktglfcycl: manage +ms.sitesec: library +ms.pagetype: surfacehub +author: TrudyHa +localizationpriority: medium +--- + +# End a Surface Hub meeting with I'm Done +Surface Hub is a collaboration device designed to be used in meeting spaces by different groups of people. At the end of a meeting, users can tap **I'm Done** to clean up any sensitive data and prepare the device for the next meeting. Surface Hub will clean up, or reset, the following states: +- Applications +- Operating system +- User interface + +This topic explains what **I'm Done** resets for each of these states. + +## Applications +When you start apps on Surface Hub, they are stored in memory and data is stored at the application level. Data is available to all users during that session (or meeting) until date is removed or overwritten. When **I'm done** is selected, Surface Hub application state is cleared out by closing applications, deleting browser history, resetting applications, and removing Skype logs. + +### Close applications +Surface Hub closes all visible windows, including Win32 and Universal Windows Platform (UWP) applications. The application close stage uses the multitasking view to query the visible windows. Win32 windows that do not close within a certain timeframe are closed using **TerminateProcess**. + +### Delete browser history +Surface Hub uses Delete Browser History (DBH) in Edge to clear Edge history and cached data. This is similar to how a user can clear out their browser history manually, but **I'm Done** also ensures that application states are cleared and data is removed before the next session, or meeting, starts. + +### Reset applications +**I'm Done** resets the state of each application that is installed on the Surface Hub. Resetting an application clears all background tasks, application data, notifications, and user consent dialogs. Applications are returned to their first-run state for the next people that use Surface Hub. + +### Remove Skype logs +Skype does not store personally-identifiable information on Surface Hub. Information is stored in the Skype service to meet existing Skype for Business guidance. Local Skype logging information is the only data removed when **I'm Done** is selected. This includes Unified Communications Client Platform (UCCP) logs and media logs. + +## Operating System +The operating system hosts a variety of information about the state of the sessions that needs to be cleared after each Surface Hub meeting. + +### File System +Meeting attendees have access to a limited set of directories on the Surface Hub. When **I'm Done** is selected, Surface Hub clears these directories:
+- Music +- Videos +- Documents +- Pictures +- Downloads + +Surface Hub also clears these directories, since many applications often write to them: +- Desktop +- Favorites +- Recent +- Public Documents +- Public Music +- Public Videos +- Public Downloads + +### Credentials +User credentials that are stored in **TokenBroker**, **PasswordVault**, or **Credential Manager** are cleared when you tap **I’m done**. + +## User interface +User interface (UI) settings are returned to their default values when **I'm Done** is selected. + +### UI items +- Reset Quick Actions to default state +- Clear Toast notifications +- Reset volume levels +- Reset sidebar width +- Reset tablet mode layout + +### Accessibility +Accessibility features and apps are returned to default settings when **I'm Done** is selected. +- Filter keys +- High contrast +- Sticky keys +- Toggle keys +- Mouse keys +- Magnifier +- Narrator + +### Clipboard +The clipboard is cleared to remove data that was copied to the clipboard during the session. + +## Frequently asked questions +**What happens if I forget to tap I'm Done at the end of a meeting, and someone else uses the Surface Hub later?**
+Surface Hub only cleans up meeting content when users tap **I'm Done**. If you leave the meeting without tapping **I'm Done**, the device will return to the welcome screen after some time. From the welcome screen, users have the option to resume the previous session or start a new one. + +**Are documents recoverable?**
+Removing files from the hard drive when **I'm Done** is selected is just like any other file deletion from a hard disk drive. Third-party software might be able to recover data from the hard disk drive, but file recovery is not a supported feature on Surface Hub. To prevent data loss, always save the data you need before leaving a meeting. + +**Do the clean-up actions from I'm Done comply with the US Department of Defense clearing and sanitizing standard: DoD 5220.22-M?**
+No. Currently, the clean-up actions from **I'm Done** do not comply with this standard. + diff --git a/devices/surface-hub/images/OOBE-2.jpg b/devices/surface-hub/images/OOBE-2.jpg deleted file mode 100644 index 0c615a2ec4..0000000000 Binary files a/devices/surface-hub/images/OOBE-2.jpg and /dev/null differ diff --git a/devices/surface-hub/images/account-management-details.PNG b/devices/surface-hub/images/account-management-details.PNG deleted file mode 100644 index 66712394ec..0000000000 Binary files a/devices/surface-hub/images/account-management-details.PNG and /dev/null differ diff --git a/devices/surface-hub/images/account-management.PNG b/devices/surface-hub/images/account-management.PNG deleted file mode 100644 index 34165dfcd6..0000000000 Binary files a/devices/surface-hub/images/account-management.PNG and /dev/null differ diff --git a/devices/surface-hub/images/add-applications-details.PNG b/devices/surface-hub/images/add-applications-details.PNG deleted file mode 100644 index 2efd3483ae..0000000000 Binary files a/devices/surface-hub/images/add-applications-details.PNG and /dev/null differ diff --git a/devices/surface-hub/images/add-applications.PNG b/devices/surface-hub/images/add-applications.PNG deleted file mode 100644 index 2316deb2fd..0000000000 Binary files a/devices/surface-hub/images/add-applications.PNG and /dev/null differ diff --git a/devices/surface-hub/images/add-certificates-details.PNG b/devices/surface-hub/images/add-certificates-details.PNG deleted file mode 100644 index 78cd783282..0000000000 Binary files a/devices/surface-hub/images/add-certificates-details.PNG and /dev/null differ diff --git a/devices/surface-hub/images/add-certificates.PNG b/devices/surface-hub/images/add-certificates.PNG deleted file mode 100644 index 24cb605d1c..0000000000 Binary files a/devices/surface-hub/images/add-certificates.PNG and /dev/null differ diff --git a/devices/surface-hub/images/add-config-file-details.PNG b/devices/surface-hub/images/add-config-file-details.PNG deleted file mode 100644 index c7b4db97e6..0000000000 Binary files a/devices/surface-hub/images/add-config-file-details.PNG and /dev/null differ diff --git a/devices/surface-hub/images/add-config-file.PNG b/devices/surface-hub/images/add-config-file.PNG deleted file mode 100644 index 5b779509d9..0000000000 Binary files a/devices/surface-hub/images/add-config-file.PNG and /dev/null differ diff --git a/devices/surface-hub/images/apps.png b/devices/surface-hub/images/apps.png deleted file mode 100644 index 5cb3b7ec8f..0000000000 Binary files a/devices/surface-hub/images/apps.png and /dev/null differ diff --git a/devices/surface-hub/images/developer-setup.PNG b/devices/surface-hub/images/developer-setup.PNG deleted file mode 100644 index 8c93d5ed91..0000000000 Binary files a/devices/surface-hub/images/developer-setup.PNG and /dev/null differ diff --git a/devices/surface-hub/images/end-session.png b/devices/surface-hub/images/end-session.png deleted file mode 100644 index 4b28583af4..0000000000 Binary files a/devices/surface-hub/images/end-session.png and /dev/null differ diff --git a/devices/surface-hub/images/enroll-mdm-details.PNG b/devices/surface-hub/images/enroll-mdm-details.PNG deleted file mode 100644 index f3a7fea8da..0000000000 Binary files a/devices/surface-hub/images/enroll-mdm-details.PNG and /dev/null differ diff --git a/devices/surface-hub/images/enroll-mdm.PNG b/devices/surface-hub/images/enroll-mdm.PNG deleted file mode 100644 index b7cfdbc767..0000000000 Binary files a/devices/surface-hub/images/enroll-mdm.PNG and /dev/null differ diff --git a/devices/surface-hub/images/finish-details.png b/devices/surface-hub/images/finish-details.png deleted file mode 100644 index 727efac696..0000000000 Binary files a/devices/surface-hub/images/finish-details.png and /dev/null differ diff --git a/devices/surface-hub/images/finish.PNG b/devices/surface-hub/images/finish.PNG deleted file mode 100644 index 7c65da1799..0000000000 Binary files a/devices/surface-hub/images/finish.PNG and /dev/null differ diff --git a/devices/surface-hub/images/five.png b/devices/surface-hub/images/five.png deleted file mode 100644 index 961f0e15b7..0000000000 Binary files a/devices/surface-hub/images/five.png and /dev/null differ diff --git a/devices/surface-hub/images/four.png b/devices/surface-hub/images/four.png deleted file mode 100644 index 0fef213b37..0000000000 Binary files a/devices/surface-hub/images/four.png and /dev/null differ diff --git a/devices/surface-hub/images/icd-simple-edit.png b/devices/surface-hub/images/icd-simple-edit.png deleted file mode 100644 index aea2e24c8a..0000000000 Binary files a/devices/surface-hub/images/icd-simple-edit.png and /dev/null differ diff --git a/devices/surface-hub/images/one.png b/devices/surface-hub/images/one.png deleted file mode 100644 index 42b4742c49..0000000000 Binary files a/devices/surface-hub/images/one.png and /dev/null differ diff --git a/devices/surface-hub/images/ppkg-config.png b/devices/surface-hub/images/ppkg-config.png deleted file mode 100644 index 10a2b7de58..0000000000 Binary files a/devices/surface-hub/images/ppkg-config.png and /dev/null differ diff --git a/devices/surface-hub/images/ppkg-csv.png b/devices/surface-hub/images/ppkg-csv.png deleted file mode 100644 index 0648f555e1..0000000000 Binary files a/devices/surface-hub/images/ppkg-csv.png and /dev/null differ diff --git a/devices/surface-hub/images/proxy-details.PNG b/devices/surface-hub/images/proxy-details.PNG deleted file mode 100644 index fcc7b06a41..0000000000 Binary files a/devices/surface-hub/images/proxy-details.PNG and /dev/null differ diff --git a/devices/surface-hub/images/proxy.PNG b/devices/surface-hub/images/proxy.PNG deleted file mode 100644 index cdfc02c454..0000000000 Binary files a/devices/surface-hub/images/proxy.PNG and /dev/null differ diff --git a/devices/surface-hub/images/recover-from-cloud.png b/devices/surface-hub/images/recover-from-cloud.png deleted file mode 100644 index 7d409edc5f..0000000000 Binary files a/devices/surface-hub/images/recover-from-cloud.png and /dev/null differ diff --git a/devices/surface-hub/images/recover-from-the-cloud.png b/devices/surface-hub/images/recover-from-the-cloud.png deleted file mode 100644 index 07c1e22851..0000000000 Binary files a/devices/surface-hub/images/recover-from-the-cloud.png and /dev/null differ diff --git a/devices/surface-hub/images/recover-progress.png b/devices/surface-hub/images/recover-progress.png deleted file mode 100644 index 316d830a57..0000000000 Binary files a/devices/surface-hub/images/recover-progress.png and /dev/null differ diff --git a/devices/surface-hub/images/reinstall.png b/devices/surface-hub/images/reinstall.png deleted file mode 100644 index 2f307841aa..0000000000 Binary files a/devices/surface-hub/images/reinstall.png and /dev/null differ diff --git a/devices/surface-hub/images/repartition.png b/devices/surface-hub/images/repartition.png deleted file mode 100644 index 26725a8c54..0000000000 Binary files a/devices/surface-hub/images/repartition.png and /dev/null differ diff --git a/devices/surface-hub/images/set-up-device-admins-details.PNG b/devices/surface-hub/images/set-up-device-admins-details.PNG deleted file mode 100644 index 42c04b4b3b..0000000000 Binary files a/devices/surface-hub/images/set-up-device-admins-details.PNG and /dev/null differ diff --git a/devices/surface-hub/images/set-up-device-admins.PNG b/devices/surface-hub/images/set-up-device-admins.PNG deleted file mode 100644 index e0e037903c..0000000000 Binary files a/devices/surface-hub/images/set-up-device-admins.PNG and /dev/null differ diff --git a/devices/surface-hub/images/set-up-device-details.PNG b/devices/surface-hub/images/set-up-device-details.PNG deleted file mode 100644 index be565ac8d9..0000000000 Binary files a/devices/surface-hub/images/set-up-device-details.PNG and /dev/null differ diff --git a/devices/surface-hub/images/set-up-device.PNG b/devices/surface-hub/images/set-up-device.PNG deleted file mode 100644 index 0c9eb0e3ff..0000000000 Binary files a/devices/surface-hub/images/set-up-device.PNG and /dev/null differ diff --git a/devices/surface-hub/images/set-up-network-details.PNG b/devices/surface-hub/images/set-up-network-details.PNG deleted file mode 100644 index 7e1391326c..0000000000 Binary files a/devices/surface-hub/images/set-up-network-details.PNG and /dev/null differ diff --git a/devices/surface-hub/images/set-up-network.PNG b/devices/surface-hub/images/set-up-network.PNG deleted file mode 100644 index a0e856c103..0000000000 Binary files a/devices/surface-hub/images/set-up-network.PNG and /dev/null differ diff --git a/devices/surface-hub/images/sh-quick-action.png b/devices/surface-hub/images/sh-quick-action.png index 3003e464b3..cb072a9793 100644 Binary files a/devices/surface-hub/images/sh-quick-action.png and b/devices/surface-hub/images/sh-quick-action.png differ diff --git a/devices/surface-hub/images/sh-settings-reset-device.png b/devices/surface-hub/images/sh-settings-reset-device.png index f3a9a6dc5c..b3e35bb385 100644 Binary files a/devices/surface-hub/images/sh-settings-reset-device.png and b/devices/surface-hub/images/sh-settings-reset-device.png differ diff --git a/devices/surface-hub/images/sh-settings-update-security.png b/devices/surface-hub/images/sh-settings-update-security.png index 59212d1805..a10d4ffb51 100644 Binary files a/devices/surface-hub/images/sh-settings-update-security.png and b/devices/surface-hub/images/sh-settings-update-security.png differ diff --git a/devices/surface-hub/images/sh-settings.png b/devices/surface-hub/images/sh-settings.png index 0134fda740..03125b3419 100644 Binary files a/devices/surface-hub/images/sh-settings.png and b/devices/surface-hub/images/sh-settings.png differ diff --git a/devices/surface-hub/images/six.png b/devices/surface-hub/images/six.png deleted file mode 100644 index 2816328ec3..0000000000 Binary files a/devices/surface-hub/images/six.png and /dev/null differ diff --git a/devices/surface-hub/images/surfacehub.png b/devices/surface-hub/images/surfacehub.png deleted file mode 100644 index 1b9b484ab8..0000000000 Binary files a/devices/surface-hub/images/surfacehub.png and /dev/null differ diff --git a/devices/surface-hub/images/three.png b/devices/surface-hub/images/three.png deleted file mode 100644 index 887fa270d7..0000000000 Binary files a/devices/surface-hub/images/three.png and /dev/null differ diff --git a/devices/surface-hub/images/two.png b/devices/surface-hub/images/two.png deleted file mode 100644 index b8c2d52eaf..0000000000 Binary files a/devices/surface-hub/images/two.png and /dev/null differ diff --git a/devices/surface-hub/images/wcd-wizard.PNG b/devices/surface-hub/images/wcd-wizard.PNG deleted file mode 100644 index 706771f756..0000000000 Binary files a/devices/surface-hub/images/wcd-wizard.PNG and /dev/null differ diff --git a/devices/surface-hub/index.md b/devices/surface-hub/index.md index dabf0f1f6e..22e94d2746 100644 --- a/devices/surface-hub/index.md +++ b/devices/surface-hub/index.md @@ -12,36 +12,19 @@ localizationpriority: medium # Microsoft Surface Hub ->[Looking for the user's guide for Surface Hub?](http://download.microsoft.com/download/3/6/B/36B6331E-0C63-4E71-A05D-EE88D05081F8/surface-hub-user-guide-en-us.pdf) - -
Microsoft Surface Hub is an all-in-one productivity device that is intended for brainstorming, collaboration, and presentations. In order to get the maximum benefit from Surface Hub, your organization’s infrastructure and the Surface Hub itself must be properly set up and integrated. The documentation in this library describes what needs to be done both before and during setup in order to help you optimize your use of the device.![image of a Surface Hub](images/surfacehub.png)
-  - -## Surface Hub setup process - -In some ways, adding your new Surface Hub is just like adding any other Microsoft Windows-based device to your network. However, in order to get your Surface Hub up and running at its full capacity, there are some very specific requirements. Here are the next topics you'll need: - -1. [Prepare your environment for Surface Hub](prepare-your-environment-for-surface-hub.md) -2. [Gather the information listed in the Setup worksheet](setup-worksheet-surface-hub.md) -2. [Physically install your Surface Hub device](physically-install-your-surface-hub-device.md) -3. [Run the Surface Hub first-run setup program (OOBE)](first-run-program-surface-hub.md) +Documents related to deploying and managing the Microsoft Surface Hub in your organization. +>[Looking for the user's guide for Surface Hub?](https://www.microsoft.com/surface/support/surface-hub) ## In this section | Topic | Description | | --- | --- | -| [What's new in Windows 10, version 1703 for Surface Hub?](surfacehub-whats-new-1703.md) | Discover the changes and improvements for Microsoft Surface Hub in the Windows 10, version 1703 release (also known as Creators Update). | +| [Microsoft Surface Hub administrator's guide](surface-hub-administrators-guide.md) | This guide covers the installation and administration of devices running Surface Hub, and is intended for use by anyone responsible for these tasks, including IT administrators and developers.| | [Differences between Surface Hub and Windows 10 Enterprise](differences-between-surface-hub-and-windows-10-enterprise.md) | This topic explains the differences between the operating system on Surface Hub and Windows 10 Enterprise. | -| [Prepare your environment for Microsoft Surface Hub](prepare-your-environment-for-surface-hub.md) | This section contains an overview of the steps required to prepare your environment so that you can use all of the features of Surface Hub. See [Intro to Surface Hub](intro-to-surface-hub.md) for a description of how the device and its features interact with your IT environment. | -| [Set up Microsoft Surface Hub](set-up-your-surface-hub.md) | Set up instructions for Surface Hub include a setup worksheet, and a walkthrough of the first-run program. | -| [Manage Microsoft Surface Hub](manage-surface-hub.md) | How to manage your Surface Hub after finishing the first-run program. | -| [PowerShell for Surface Hub](appendix-a-powershell-scripts-for-surface-hub.md) | -| [How Surface Hub addresses Wi-Fi Direct security issues](surface-hub-wifi-direct.md) | This topic provides guidance on Wi-Fi Direct security risks, how the Surface Hub has addressed those risks, and how Surface Hub administrators can configure the device for the highest level of security. | PowerShell scripts to help set up and manage your Surface Hub. | -| [Troubleshoot Microsoft Surface Hub](troubleshoot-surface-hub.md) | Troubleshoot common problems, including setup issues, Exchange ActiveSync errors. | +| [How Surface Hub addresses Wi-Fi Direct security issues](surface-hub-wifi-direct.md) | This topic provides guidance on Wi-Fi Direct security risks, how the Surface Hub has addressed those risks, and how Surface Hub administrators can configure the device for the highest level of security. | | [Useful downloads for Surface Hub administrators](surface-hub-downloads.md) | This topic provides links to useful Surface Hub documents, such as product datasheets, the site readiness guide, and user's guide. | -| [Change history for Surface Hub](change-history-surface-hub.md) | This topic lists new and updated topics in the Surface Hub documentation library. | - +| [Change history for Surface Hub](change-history-surface-hub.md) | This topic lists new and updated topics in the Surface Hub documentation. | diff --git a/devices/surface-hub/install-apps-on-surface-hub.md b/devices/surface-hub/install-apps-on-surface-hub.md index bc56fcbba5..d26712627a 100644 --- a/devices/surface-hub/install-apps-on-surface-hub.md +++ b/devices/surface-hub/install-apps-on-surface-hub.md @@ -7,7 +7,7 @@ ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: surfacehub, store -author: jdeckerMS +author: TrudyHa localizationpriority: medium --- @@ -16,7 +16,7 @@ localizationpriority: medium You can install additional apps on your Surface Hub to fit your team or organization's needs. There are different methods for installing apps depending on whether you are developing and testing an app, or deploying a released app. This topic describes methods for installing apps for either scenario. A few things to know about apps on Surface Hub: -- Surface Hub only runs [Universal Windows Platform (UWP) apps](https://msdn.microsoft.com/windows/uwp/get-started/whats-a-uwp). Apps created using the [Desktop App Converter](https://docs.microsoft.com/windows/uwp/porting/desktop-to-uwp-run-desktop-app-converter) will not run on Surface Hub. See a [list of apps that work with Surface Hub](https://www.microsoft.com/surface/support/surface-hub/surface-hub-apps). +- Surface Hub only runs [Universal Windows Platform (UWP) apps](https://msdn.microsoft.com/windows/uwp/get-started/whats-a-uwp). See a [list of apps that work with Surface Hub](https://www.microsoft.com/surface/support/surface-hub/surface-hub-apps). - Apps must be targeted for the [Universal device family](https://msdn.microsoft.com/library/windows/apps/dn894631). - By default, apps must be Store-signed to be installed. During testing and development, you can also choose to run developer-signed UWP apps by placing the device in developer mode.- When submitting an app to the Windows Store, developers need to set Device family availability and Organizational licensing options to make sure an app will be available to run on Surface Hub. - You need admin credentials to install apps on your Surface Hub. Since the device is designed to be used in communal spaces like meeting rooms, people can't access the Windows Store to download and install apps. diff --git a/devices/surface-hub/intro-to-surface-hub.md b/devices/surface-hub/intro-to-surface-hub.md new file mode 100644 index 0000000000..eb48a1fb78 --- /dev/null +++ b/devices/surface-hub/intro-to-surface-hub.md @@ -0,0 +1,28 @@ +--- +title: Intro to Microsoft Surface Hub +description: Microsoft Surface Hub is an all-in-one productivity device that is intended for brainstorming, collaboration, and presentations. +ms.assetid: 5DAD4489-81CF-47ED-9567-A798B90C7E76 +keywords: Surface Hub, productivity, collaboration, presentations, setup +ms.prod: w10 +ms.mktglfcycl: explore +ms.sitesec: library +ms.pagetype: surfacehub +author: TrudyHa +localizationpriority: medium +--- + +# Intro to Microsoft Surface Hub + + +Microsoft Surface Hub is an all-in-one productivity device that is intended for brainstorming, collaboration, and presentations. In order to get the maximum benefit from Surface Hub, your organization’s infrastructure and the Surface Hub itself must be properly set up and integrated. This guide describes what needs to be done both before and during setup in order to help you optimize your use of the device. +  +You’ll need to understand how each of these services interacts with Surface Hub. See [Prepare your environment for Surface Hub](prepare-your-environment-for-surface-hub.md) for details. + +## Surface Hub setup process + +In some ways, adding your new Surface Hub is just like adding any other Microsoft Windows-based device to your network. However, in order to get your Surface Hub up and running at its full capacity, there are some very specific requirements. Here are the next topics you'll need: + +1. [Prepare your environment for Surface Hub](prepare-your-environment-for-surface-hub.md) +2. [Physically install your Surface Hub device](physically-install-your-surface-hub-device.md) +3. [Run the Surface Hub first-run setup program (OOBE)](first-run-program-surface-hub.md) + diff --git a/devices/surface-hub/local-management-surface-hub-settings.md b/devices/surface-hub/local-management-surface-hub-settings.md index 7d17d33c38..dea2a514bd 100644 --- a/devices/surface-hub/local-management-surface-hub-settings.md +++ b/devices/surface-hub/local-management-surface-hub-settings.md @@ -6,7 +6,7 @@ ms.prod: w10 ms.mktglfcycl: manage ms.sitesec: library ms.pagetype: surfacehub -author: jdeckerMS +author: TrudyHa localizationpriority: medium --- @@ -16,38 +16,29 @@ After initial setup of Microsoft Surface Hub, the device’s settings can be loc ## Surface Hub settings -Surface Hubs have many settings that are common to other Windows devices, but also have settings which are only configurable on Surface Hubs. This table lists settings only configurable on Surface Hubs. +Surface Hubs have many settings that are common to other Windows devices, but also have settings which are only configurable on Surface Hubs. This table lists settings only cofigurable on Surface Hubs. | Setting | Location | Description | | ------- | -------- | ----------- | -| Device account | Surface Hub > Accounts | Set or change the Surface Hub's device account. | -| Device account sync status | Surface Hub > Accounts | Check the sync status of the device account’s mail and calendar on the Surface Hub. | -| Password rotation | Surface Hub > Accounts | Choose whether to let the Surface Hub automatically rotate the device account's password. | -| Change admin account password | Surface Hub > Accounts | Change the password for the local admin account. This is only available if you configured the device to use a local admin during first run. | -| Device Management | Surface Hub > Device management | Manage policies and business applications using mobile device management (MDM). | -| Provisioning packages | Surface Hub > Device management | Set or change provisioning packages installed on the Surface Hub. | -| Configure Operations Management Suite (OMS) | Surface Hub > Device management | Set up monitoring for your Surface Hub using OMS. | -| Open the Windows Store app | Surface Hub > Apps & features | The Windows Store app is only available to admins through the Settings app. | -| Skype for Business domain name | Surface Hub > Calling & Audio | Configure a domain name for your Skype for Business server. | -| Default Speaker volume | Surface Hub > Calling & Audio | Configure the default speaker volume for the Surface Hub when it starts a session. | -| Default microphone and speaker settings | Surface Hub > Calling & Audio | Configure a default microphone and speaker for calls, and a default speaker for media playback. | -| Enable Dolby Audio X2 | Surface Hub > Calling & Audio | Configure the Dolby Audio X2 speaker enhancements. | -| Open Connect App automatically | Surface Hub > Projection | Choose whether projection will automatically open the Connect app or wait for user input before opening. | -| Turn off wireless projection using Miracast | Surface Hub > Projection | Choose whether presenters can wirelessly project to the Surface Hub using Miracast. | -| Require a PIN for wireless projection | Surface Hub > Projection | Choose whether people are required to enter a PIN before they use wireless projection. | -| Wireless projection (Miracast) channel | Surface Hub > Projection | Set the channel for Miracast projection. | -| Meeting info shown on the welcome screen | Surface Hub > Welcome screen | Choose whether meeting organizer, time, and subject show up on the welcome screen. | -| Welcome screen background | Surface Hub > Welcome screen | Choose a background image for the welcome screen. | -| Idle timeout to Welcome screen | Surface Hub > Session & Power | Choose how long until the Surface Hub returns to the welcome screen after no motion is detected. | -| Resume session | Surface Hub > Session & Power | Choose to allow users to resume a session after no motion is detected or to automatically clean up a session. | -| Access to Office 365 meetings and files | Surface Hub > Session & Power | Choose whether a user can sign in to Office 365 to get access to their meetings and files. | -| Turn on screen with motion sensors | Surface Hub > Session & clean up | Choose whether the screen turns on when motion is detected. | -| Session time out | Surface Hub > Session & clean up | Choose how long the device needs to be inactive before returning to the welcome screen. | -| Sleep time out | Surface Hub > Session & clean up | Choose how long the device needs to be inactive before going to sleep mode. | -| Friendly name | Surface Hub > About | Set the Surface Hub name that people will see when connecting wirelessly. | +| Device account | This device > Accounts | Set or change the Surface Hub's device account. | +| Device account sync status | This device > Accounts | Check the sync status of the device account’s mail and calendar on the Surface Hub. | +| Password rotation | This device > Accounts | Choose whether to let the Surface Hub automatically rotate the device account's password. | +| Change admin account password | This device > Accounts | Change the password for the local admin account. This is only available if you configured the device to use a local admin during first run. | +| Configure Operations Management Suite (OMS) | This device > Device management | Set up monitoring for your Surface Hub using OMS. | +| Open the Windows Store app | This device > Apps & features | The Windows Store app is only available to admins through the Settings app. | +| Skype for Business domain name | This device > Calling | Configure a domain name for your Skype for Business server. | +| Default microphone and speaker settings | This device > Calling | Configure a default microphone and speaker for calls, and a default speaker for media playback. | +| Turn off wireless projection using Miracast | This device > Wireless projection | Choose whether presenters can wirelessly project to the Surface Hub using Miracast. | +| Require a PIN for wireless projection | This device > Wireless projection | Choose whether people are required to enter a PIN before they use wireless projection. | +| Wireless projection (Miracast) channel | This device > Wireless projection | Set the channel for Miracast projection. | +| Meeting info shown on the welcome screen | This device > Welcome screen | Choose whether meeting organizer, time, and subject show up on the welcome screen. | +| Welcome screen background | This device > Welcome screen | Choose a background image for the welcome screen. | +| Turn on screen with motion sensors | This device > Session & clean up | Choose whether the screen turns on when motion is detected. | +| Session time out | This device > Session & clean up | Choose how long the device needs to be inactive before returning to the welcome screen. | +| Sleep time out | This device > Session & clean up | Choose how long the device needs to be inactive before going to sleep mode. | +| Friendly name | This device > About | Set the Surface Hub name that people will see when connecting wirelessly. | | Maintenance hours | Update & security > Windows Update > Advanced options | Configure when updates can be installed. | | Configure Windows Server Update Services (WSUS) server | Update & security > Windows Update > Advanced options | Change whether Surface Hub receives updates from a WSUS server instead of Windows Update. | -| Recover from the cloud | Update & security > Recovery | Reinstall the operating system on Surface Hub to a manufacturer build from the cloud. | | Save BitLocker key | Update & security > Recovery | Backup your Surface Hub's BitLocker key to a USB drive. | | Collect logs | Update & security > Recovery | Save logs to a USB drive to send to Microsoft later. | diff --git a/devices/surface-hub/manage-settings-with-local-admin-account-surface-hub.md b/devices/surface-hub/manage-settings-with-local-admin-account-surface-hub.md new file mode 100644 index 0000000000..db9230f9ad --- /dev/null +++ b/devices/surface-hub/manage-settings-with-local-admin-account-surface-hub.md @@ -0,0 +1,13 @@ +--- +title: Manage settings with a local admin account (Surface Hub) +description: A local admin account will be set up on every Microsoft Surface Hub as part of the first run program. The only way to change the local admin options that you chose at that time is to reset the device. +ms.assetid: B4B3668B-985D-427E-8495-E30ABEECA679 +redirect_url: https://technet.microsoft.com/itpro/surface-hub/admin-group-management-for-surface-hub +keywords: local admin account, Surface Hub, change local admin options +ms.prod: w10 +ms.mktglfcycl: manage +ms.sitesec: library +ms.pagetype: surfacehub +author: TrudyHa +localizationpriority: medium +--- diff --git a/devices/surface-hub/manage-settings-with-mdm-for-surface-hub.md b/devices/surface-hub/manage-settings-with-mdm-for-surface-hub.md index 0dcd527405..8cadcb7309 100644 --- a/devices/surface-hub/manage-settings-with-mdm-for-surface-hub.md +++ b/devices/surface-hub/manage-settings-with-mdm-for-surface-hub.md @@ -65,23 +65,13 @@ For more information, see [SurfaceHub configuration service provider](https://ms | Automatically turn on the screen using motion sensors | InBoxApps/Welcome/AutoWakeScreen | Yes | Yes | Yes | | Require a pin for wireless projection | InBoxApps/WirelessProjection/PINRequired | Yes | Yes | Yes | | Enable wireless projection | InBoxApps/WirelessProjection/Enabled | Yes | Yes.
[Use a custom setting.](#example-sccm) | Yes | -| Miracast channel to use for wireless projection | InBoxApps/WirelessProjection/Channel | Yes | Yes.
[Use a custom setting.](#example-sccm) | Yes | +| Miracast channel to use for wireless projection | InBoxApps/WirelessProjection/Channel | Yes | Yes.
Use a custom setting. | Yes | | Connect to your Operations Management Suite workspace | MOMAgent/WorkspaceID
MOMAgent/WorkspaceKey | Yes | Yes.
[Use a custom setting.](#example-sccm) | Yes | | Welcome screen background image | InBoxApps/Welcome/CurrentBackgroundPath | Yes | Yes.
[Use a custom setting.](#example-sccm) | Yes | | Meeting information displayed on the welcome screen | InBoxApps/Welcome/MeetingInfoOption | Yes | Yes.
[Use a custom setting.](#example-sccm) | Yes | -| Friendly name for wireless projection | Properties/FriendlyName | Yes
[Use a custom policy.](#example-intune) | Yes.
[Use a custom setting.](#example-sccm) | Yes | +| Friendly name for wireless projection | Properties/FriendlyName | Yes.
[Use a custom policy.](#example-intune)) | Yes.
[Use a custom setting.](#example-sccm) | Yes | | Device account, including password rotation | DeviceAccount/*``*
See [SurfaceHub CSP](https://msdn.microsoft.com/library/windows/hardware/mt608323.aspx). | No | No | Yes | -| Specify Skype domain | InBoxApps/SkypeForBusiness/DomainName | Yes
| Yes.
[Use a custom setting.](#example-sccm) | Yes | -| Auto launch Connect App when projection is initiated | InBoxApps/Connect/AutoLaunch | Yes
| Yes.
[Use a custom setting.](#example-sccm) | Yes | -| Set default volume | Properties/DefaultVolume | Yes
| Yes.
[Use a custom setting.](#example-sccm) | Yes | -| Set screen timeout | Properties/ScreenTimeout | Yes
| Yes.
[Use a custom setting.](#example-sccm) | Yes | -| Set session timeout | Properties/SessionTimeout | Yes
| Yes.
[Use a custom setting.](#example-sccm) | Yes | -| Set sleep timeout | Properties/SleepTimeout | Yes
| Yes.
[Use a custom setting.](#example-sccm) | Yes | -| Allow session to resume after screen is idle | Properties/AllowSessionResume | Yes
| Yes.
[Use a custom setting.](#example-sccm) | Yes | -| Allow device account to be used for proxy authentication | Properties/AllowAutoProxyAuth | Yes
| Yes.
[Use a custom setting.](#example-sccm) | Yes | -| Disable auto-populating the sign-in dialog with invitees from scheduled meetings | Properties/DisableSignInSuggestions | Yes
| Yes.
[Use a custom setting.](#example-sccm) | Yes | -| Disable "My meetings and files" feature in Start menu | Properties/DoNotShowMyMeetingsAndFiles | Yes
| Yes.
[Use a custom setting.](#example-sccm) | Yes | -\*Settings supported with SyncML can also be configured in a Windows Configuration Designer provisioning package. +\*Settings supported with SyncML can also be configured in a Windows Imaging and Configuration Designer (Windows ICD) provisioning package. ### Supported Windows 10 settings @@ -92,58 +82,57 @@ The following tables include info on Windows 10 settings that have been validate #### Security settings | Setting | Details | CSP reference | Supported with
Intune? | Supported with
Configuration Manager? | Supported with
SyncML\*? | | -------- | -------- | ------------- |-------------------------- | ---------------------------------------- | ------------------------- | -| Allow Bluetooth | Keep this enabled to support Bluetooth peripherals. | [Connectivity/AllowBluetooth](https://msdn.microsoft.com/library/windows/hardware/dn904962.aspx#Connectivity_AllowBluetooth) | Yes.
| Yes.
[Use a custom setting.](#example-sccm) | Yes | -| Bluetooth policies | Use to set the Bluetooth device name, and block advertising, discovery, and automatic pairing. | Bluetooth/*``*
See [Policy CSP](https://msdn.microsoft.com/library/windows/hardware/dn904962.aspx) | Yes.
| Yes.
[Use a custom setting.](#example-sccm) | Yes | -| Allow camera | Keep this enabled for Skype for Business. | [Camera/AllowCamera](https://msdn.microsoft.com/library/windows/hardware/dn904962.aspx#Camera_AllowCamera) | Yes.
| Yes.
[Use a custom setting.](#example-sccm) | Yes | -| Allow location | Keep this enabled to support apps such as Maps. | [System/AllowLocation](https://msdn.microsoft.com/library/windows/hardware/dn904962.aspx#System_AllowLocation) | Yes.
. | Yes.
[Use a custom setting.](#example-sccm) | Yes | -| Allow telemetry | Keep this enabled to help Microsoft improve Surface Hub. | [System/AllowTelemetry](https://msdn.microsoft.com/library/windows/hardware/dn904962.aspx#System_AllowTelemetry) | Yes.
| Yes.
[Use a custom setting.](#example-sccm) | Yes | -| Allow USB Drives | Keep this enabled to support USB drives on Surface Hub | [System/AllowStorageCard](https://msdn.microsoft.com/windows/hardware/commercialize/customize/mdm/policy-configuration-service-provider#system-allowstoragecard) | Yes
[Use a custom policy.](#example-intune) | Yes.
[Use a custom setting.](#example-sccm) | Yes | -\*Settings supported with SyncML can also be configured in a Windows Configuration Designer provisioning package. +| Allow Bluetooth | Keep this enabled to support Bluetooth peripherals. | [Connectivity/AllowBluetooth](https://msdn.microsoft.com/library/windows/hardware/dn904962.aspx#Connectivity_AllowBluetooth) | Yes.
Use a custom policy. | Yes.
Use a custom setting. | Yes | +| Bluetooth policies | Use to set the Bluetooth device name, and block advertising, discovery, and automatic pairing. | Bluetooth/*``*
See [Policy CSP](https://msdn.microsoft.com/library/windows/hardware/dn904962.aspx) | Yes.
Use a custom policy. | Yes.
Use a custom setting. | Yes | +| Allow camera | Keep this enabled for Skype for Business. | [Camera/AllowCamera](https://msdn.microsoft.com/library/windows/hardware/dn904962.aspx#Camera_AllowCamera) | Yes.
Use a custom policy. | Yes.
Use a custom setting. | Yes | +| Allow location | Keep this enabled to support apps such as Maps. | [System/AllowLocation](https://msdn.microsoft.com/library/windows/hardware/dn904962.aspx#System_AllowLocation) | Yes.
Use a custom policy. | Yes.
Use a custom setting. | Yes | +| Allow telemetry | Keep this enabled to help Microsoft improve Surface Hub. | [System/AllowTelemetry](https://msdn.microsoft.com/library/windows/hardware/dn904962.aspx#System_AllowTelemetry) | Yes.
Use a custom policy. | Yes.
Use a custom setting. | Yes | +\*Settings supported with SyncML can also be configured in a Windows Imaging and Configuration Designer (Windows ICD) provisioning package. #### Browser settings | Setting | Details | CSP reference | Supported with
Intune? | Supported with
Configuration Manager? | Supported with
SyncML\*? | | -------- | ---------------- | ------------- |-------------------------- | ---------------------------------------- | ------------------------- | -| Homepages | Use to configure the default homepages in Microsoft Edge. | [Browser/Homepages](https://msdn.microsoft.com/library/windows/hardware/dn904962.aspx#Browser_Homepages) | Yes
[Use a custom policy.](#example-intune) | Yes.
[Use a custom setting.](#example-sccm) | Yes | -| Allow cookies | Surface Hub automatically deletes cookies at the end of a session. Use this to block cookies within a session. | [Browser/AllowCookies](https://msdn.microsoft.com/library/windows/hardware/dn904962.aspx#Browser_AllowCookies) | Yes
[Use a custom policy.](#example-intune) | Yes.
[Use a custom setting.](#example-sccm) | Yes | -| Allow developer tools | Use to stop users from using F12 Developer Tools. | [Browser/AllowDeveloperTools](https://msdn.microsoft.com/library/windows/hardware/dn904962.aspx#Browser_AllowDeveloperTools) | Yes
[Use a custom policy.](#example-intune) | Yes.
[Use a custom setting.](#example-sccm) | Yes | -| Allow Do Not Track | Use to enable Do Not Track headers. | [Browser/AllowDoNotTrack](https://msdn.microsoft.com/library/windows/hardware/dn904962.aspx#Browser_AllowDoNotTrack) | Yes
[Use a custom policy.](#example-intune) | Yes.
[Use a custom setting.](#example-sccm) | Yes | -| Allow pop-ups | Use to block pop-up browser windows. | [Browser/AllowPopups](https://msdn.microsoft.com/library/windows/hardware/dn904962.aspx#Browser_AllowPopups) | Yes
[Use a custom policy.](#example-intune) | Yes.
[Use a custom setting.](#example-sccm) | Yes | -| Allow search suggestions | Use to block search suggestions in the address bar. | [Browser/AllowSearchSuggestionsinAddressBar](https://msdn.microsoft.com/library/windows/hardware/dn904962.aspx#Browser_AllowSearchSuggestionsinAddressBar) | Yes
[Use a custom policy.](#example-intune) | Yes.
[Use a custom setting.](#example-sccm) | Yes | -| Allow SmartScreen | Keep this enabled to turn on SmartScreen. | [Browser/AllowSmartScreen](https://msdn.microsoft.com/library/windows/hardware/dn904962.aspx#Browser_AllowSmartScreen) | Yes
[Use a custom policy.](#example-intune) | Yes.
[Use a custom setting.](#example-sccm) | Yes | -| Prevent ignoring SmartScreen Filter warnings for websites | For extra security, use to stop users from ignoring SmartScreen Filter warnings and block them from accessing potentially malicious websites. | [Browser/PreventSmartScreenPromptOverride](https://msdn.microsoft.com/library/windows/hardware/dn904962.aspx#Browser_PreventSmartScreenPromptOverride) | Yes
[Use a custom policy.](#example-intune) | Yes.
[Use a custom setting.](#example-sccm) | Yes | -| Prevent ignoring SmartScreen Filter warnings for files | For extra security, use to stop users from ignoring SmartScreen Filter warnings and block them from downloading unverified files from Microsoft Edge. | [Browser/PreventSmartScreenPromptOverrideForFiles](https://msdn.microsoft.com/library/windows/hardware/dn904962.aspx#Browser_PreventSmartScreenPromptOverrideForFiles) | Yes
[Use a custom policy.](#example-intune) | Yes.
[Use a custom setting.](#example-sccm) | Yes | -\*Settings supported with SyncML can also be configured in a Windows Configuration Designer provisioning package. +| Homepages | Use to configure the default homepages in Microsoft Edge. | [Browser/Homepages](https://msdn.microsoft.com/library/windows/hardware/dn904962.aspx#Browser_Homepages) | Yes.
Use a custom policy. | Yes.
Use a custom setting. | Yes | +| Allow cookies | Surface Hub automatically deletes cookies at the end of a session. Use this to block cookies within a session. | [Browser/AllowCookies](https://msdn.microsoft.com/library/windows/hardware/dn904962.aspx#Browser_AllowCookies) | Yes.
Use a custom policy. | Yes.
Use a custom setting. | Yes | +| Allow developer tools | Use to stop users from using F12 Developer Tools. | [Browser/AllowDeveloperTools](https://msdn.microsoft.com/library/windows/hardware/dn904962.aspx#Browser_AllowDeveloperTools) | Yes.
Use a custom policy. | Yes.
Use a custom setting. | Yes | +| Allow Do Not Track | Use to enable Do Not Track headers. | [Browser/AllowDoNotTrack](https://msdn.microsoft.com/library/windows/hardware/dn904962.aspx#Browser_AllowDoNotTrack) | Yes.
Use a custom policy. | Yes.
Use a custom setting. | Yes | +| Allow pop-ups | Use to block pop-up browser windows. | [Browser/AllowPopups](https://msdn.microsoft.com/library/windows/hardware/dn904962.aspx#Browser_AllowPopups) | Yes.
Use a custom policy. | Yes.
Use a custom setting. | Yes | +| Allow search suggestions | Use to block search suggestions in the address bar. | [Browser/AllowSearchSuggestionsinAddressBar](https://msdn.microsoft.com/library/windows/hardware/dn904962.aspx#Browser_AllowSearchSuggestionsinAddressBar) | Yes.
Use a custom policy. | Yes.
Use a custom setting. | Yes | +| Allow SmartScreen | Keep this enabled to turn on SmartScreen. | [Browser/AllowSmartScreen](https://msdn.microsoft.com/library/windows/hardware/dn904962.aspx#Browser_AllowSmartScreen) | Yes.
Use a custom policy. | Yes.
Use a custom setting. | Yes | +| Prevent ignoring SmartScreen Filter warnings for websites | For extra security, use to stop users from ignoring SmartScreen Filter warnings and block them from accessing potentially malicious websites. | [Browser/PreventSmartScreenPromptOverride](https://msdn.microsoft.com/library/windows/hardware/dn904962.aspx#Browser_PreventSmartScreenPromptOverride) | Yes.
Use a custom policy. | Yes.
Use a custom setting. | Yes | +| Prevent ignoring SmartScreen Filter warnings for files | For extra security, use to stop users from ignoring SmartScreen Filter warnings and block them from downloading unverified files from Microsoft Edge. | [Browser/PreventSmartScreenPromptOverrideForFiles](https://msdn.microsoft.com/library/windows/hardware/dn904962.aspx#Browser_PreventSmartScreenPromptOverrideForFiles) | Yes.
Use a custom policy. | Yes.
Use a custom setting. | Yes | +\*Settings supported with SyncML can also be configured in a Windows Imaging and Configuration Designer (Windows ICD) provisioning package. #### Windows Update settings | Setting | Details | CSP reference | Supported with
Intune? | Supported with
Configuration Manager? | Supported with
SyncML*? | | ----------- | ---------------- | ------------- |-------------------------- | ---------------------------------------- | ------------------------- | -| Use Current Branch or Current Branch for Business | Use to configure Windows Update for Business – see [Windows updates](manage-windows-updates-for-surface-hub.md). | [Update/BranchReadinessLevel](https://msdn.microsoft.com/library/windows/hardware/dn904962.aspx#Update_BranchReadinessLevel) | Yes
[Use a custom policy.](#example-intune) | Yes.
[Use a custom setting.](#example-sccm) | Yes | -| Defer feature updates| See above. | [Update/ DeferFeatureUpdatesPeriodInDays](https://msdn.microsoft.com/library/windows/hardware/dn904962.aspx#Update_DeferFeatureUpdatesPeriodInDays) | Yes
[Use a custom policy.](#example-intune) | Yes.
[Use a custom setting.](#example-sccm) | Yes | -| Defer quality updates | See above. | [Update/DeferQualityUpdatesPeriodInDays](https://msdn.microsoft.com/library/windows/hardware/dn904962.aspx#Update_DeferQualityUpdatesPeriodInDays) | Yes
[Use a custom policy.](#example-intune) | Yes.
[Use a custom setting.](#example-sccm) | Yes | -| Pause feature updates | See above. | [Update/PauseFeatureUpdates](https://msdn.microsoft.com/library/windows/hardware/dn904962.aspx#Update_PauseFeatureUpdates) | Yes
[Use a custom policy.](#example-intune) | Yes.
[Use a custom setting.](#example-sccm) | Yes | -| Pause quality updates | See above. | [Update/PauseQualityUpdates](https://msdn.microsoft.com/library/windows/hardware/dn904962.aspx#Update_PauseQualityUpdates) | Yes
[Use a custom policy.](#example-intune) | Yes.
[Use a custom setting.](#example-sccm) | Yes| -| Configure device to use WSUS| Use to connect your Surface Hub to WSUS instead of Windows Update – see [Windows updates](manage-windows-updates-for-surface-hub.md). | [Update/UpdateServiceUrl](https://msdn.microsoft.com/library/windows/hardware/dn904962.aspx#Update_UpdateServiceUrl) | Yes
[Use a custom policy.](#example-intune) | Yes.
[Use a custom setting.](#example-sccm) | Yes | -| Delivery optimization | Use peer-to-peer content sharing to reduce bandwidth issues during updates. See [Configure Delivery Optimization for Windows 10](https://technet.microsoft.com/itpro/windows/manage/waas-delivery-optimization) for details. | DeliveryOptimization/*``*
See [Policy CSP](https://msdn.microsoft.com/library/windows/hardware/dn904962.aspx) | Yes
[Use a custom policy.](#example-intune) | Yes.
[Use a custom setting.](#example-sccm) | Yes | -\*Settings supported with SyncML can also be configured in a Windows Configuration Designer provisioning package. +| Use Current Branch or Current Branch for Business | Use to configure Windows Update for Business – see [Windows updates](manage-windows-updates-for-surface-hub.md). | [Update/BranchReadinessLevel](https://msdn.microsoft.com/library/windows/hardware/dn904962.aspx#Update_BranchReadinessLevel) | Yes. Use a custom policy. | Yes. Use a custom setting. | Yes | +| Defer feature updates| See above. | [Update/ DeferFeatureUpdatesPeriodInDays](https://msdn.microsoft.com/library/windows/hardware/dn904962.aspx#Update_DeferFeatureUpdatesPeriodInDays) | Yes.
Use a custom policy. | Yes.
Use a custom setting. | Yes | +| Defer quality updates | See above. | [Update/DeferQualityUpdatesPeriodInDays](https://msdn.microsoft.com/library/windows/hardware/dn904962.aspx#Update_DeferQualityUpdatesPeriodInDays) | Yes.
Use a custom policy. | Yes.
Use a custom setting. | Yes | +| Pause feature updates | See above. | [Update/PauseFeatureUpdates](https://msdn.microsoft.com/library/windows/hardware/dn904962.aspx#Update_PauseFeatureUpdates) | Yes.
Use a custom policy. | Yes.
Use a custom setting. | Yes | +| Pause quality updates | See above. | [Update/PauseQualityUpdates](https://msdn.microsoft.com/library/windows/hardware/dn904962.aspx#Update_PauseQualityUpdates) | Yes.
Use a custom policy. | Yes.
Use a custom setting. | Yes| +| Configure device to use WSUS| Use to connect your Surface Hub to WSUS instead of Windows Update – see [Windows updates](manage-windows-updates-for-surface-hub.md). | [Update/UpdateServiceUrl](https://msdn.microsoft.com/library/windows/hardware/dn904962.aspx#Update_UpdateServiceUrl) | Yes.
Use a custom policy. | Yes.
Use a custom setting. | Yes | +| Delivery optimization | Use peer-to-peer content sharing to reduce bandwidth issues during updates. See [Configure Delivery Optimization for Windows 10](https://technet.microsoft.com/itpro/windows/manage/waas-delivery-optimization) for details. | DeliveryOptimization/*``*
See [Policy CSP](https://msdn.microsoft.com/library/windows/hardware/dn904962.aspx) | Yes.
Use a custom policy. | Yes.
Use a custom setting. | Yes | +\*Settings supported with SyncML can also be configured in a Windows Imaging and Configuration Designer (Windows ICD) provisioning package. #### Windows Defender settings | Setting | Details | CSP reference | Supported with
Intune? | Supported with
Configuration Manager? | Supported with
SyncML\*? | | ----------- | ---------------- | ------------- |-------------------------- | ---------------------------------------- | ------------------------- | -| Defender policies | Use to configure various Defender settings, including a scheduled scan time. | Defender/*``*
See [Policy CSP](https://msdn.microsoft.com/library/windows/hardware/dn904962.aspx) | Yes
[Use a custom policy.](#example-intune) | Yes.
[Use a custom setting.](#example-sccm) | Yes | +| Defender policies | Use to configure various Defender settings, including a scheduled scan time. | Defender/*``*
See [Policy CSP](https://msdn.microsoft.com/library/windows/hardware/dn904962.aspx) | Yes.
Use a custom policy. | Yes.
Use a custom setting. | Yes | | Defender status | Use to initiate a Defender scan, force a signature update, query any threats detected. | [Defender CSP](https://msdn.microsoft.com/library/windows/hardware/mt187856.aspx) | No. | No. | Yes | -\*Settings supported with SyncML can also be configured in a Windows Configuration Designer provisioning package. +\*Settings supported with SyncML can also be configured in a Windows Imaging and Configuration Designer (Windows ICD) provisioning package. #### Remote reboot | Setting | Details | CSP reference | Supported with
Intune? | Supported with
Configuration Manager? | Supported with
SyncML\*? | | ----------- | ---------------- | ------------- |-------------------------- | ---------------------------------------- | ------------------------- | | Reboot the device immediately | Use in conjunction with OMS to minimize support costs – see [Monitor your Microsoft Surface Hub](monitor-surface-hub.md). | ./Vendor/MSFT/Reboot/RebootNow
See [Reboot CSP](https://msdn.microsoft.com/library/windows/hardware/mt720802.aspx) | No | No | Yes | -| Reboot the device at a scheduled date and time | See above. | ./Vendor/MSFT/Reboot/Schedule/Single
See [Reboot CSP](https://msdn.microsoft.com/library/windows/hardware/mt720802.aspx) | Yes
[Use a custom policy.](#example-intune) | Yes.
[Use a custom setting.](#example-sccm) | Yes | -| Reboot the device daily at a scheduled date and time | See above. | ./Vendor/MSFT/Reboot/Schedule/DailyRecurrent
See [Reboot CSP](https://msdn.microsoft.com/library/windows/hardware/mt720802.aspx) | Yes
[Use a custom policy.](#example-intune) | Yes.
[Use a custom setting.](#example-sccm) | Yes | -\*Settings supported with SyncML can also be configured in a Windows Configuration Designer provisioning package. +| Reboot the device at a scheduled date and time | See above. | ./Vendor/MSFT/Reboot/Schedule/Single
See [Reboot CSP](https://msdn.microsoft.com/library/windows/hardware/mt720802.aspx) | Yes.
Use a custom policy. | Yes.
Use a custom setting. | Yes | +| Reboot the device daily at a scheduled date and time | See above. | ./Vendor/MSFT/Reboot/Schedule/DailyRecurrent
See [Reboot CSP](https://msdn.microsoft.com/library/windows/hardware/mt720802.aspx) | Yes.
Use a custom policy. | Yes.
Use a custom setting. | Yes | +\*Settings supported with SyncML can also be configured in a Windows Imaging and Configuration Designer (Windows ICD) provisioning package. #### Install certificates @@ -153,7 +142,7 @@ The following tables include info on Windows 10 settings that have been validate -\*Settings supported with SyncML can also be configured in a Windows Configuration Designer provisioning package. +\*Settings supported with SyncML can also be configured in a Windows Imaging and Configuration Designer (Windows ICD) provisioning package. #### Collect logs @@ -162,7 +151,7 @@ The following tables include info on Windows 10 settings that have been validate | Collect ETW logs | Use to remotely collect ETW logs from Surface Hub. | [DiagnosticLog CSP](https://msdn.microsoft.com/library/windows/hardware/mt219118.aspx) | No | No | Yes | -\*Settings supported with SyncML can also be configured in a Windows Configuration Designer provisioning package. +\*Settings supported with SyncML can also be configured in a Windows Imaging and Configuration Designer (Windows ICD) provisioning package. ### Generate OMA URIs for settings You need to use a setting’s OMA URI to create a custom policy in Intune, or a custom setting in System Center Configuration Manager. @@ -263,7 +252,7 @@ For more information, see [Create configuration items for Windows 8.1 and Window [Manage Microsoft Surface Hub](manage-surface-hub.md) - +[Microsoft Surface Hub administrator's guide](surface-hub-administrators-guide.md)   diff --git a/devices/surface-hub/manage-surface-hub-settings.md b/devices/surface-hub/manage-surface-hub-settings.md index ecfbb7c584..5413d28a30 100644 --- a/devices/surface-hub/manage-surface-hub-settings.md +++ b/devices/surface-hub/manage-surface-hub-settings.md @@ -6,7 +6,7 @@ ms.prod: w10 ms.mktglfcycl: manage ms.sitesec: library ms.pagetype: surfacehub -author: jdeckerMS +author: TrudyHa localizationpriority: medium --- diff --git a/devices/surface-hub/manage-surface-hub.md b/devices/surface-hub/manage-surface-hub.md index 95b3b394bd..b464c430f2 100644 --- a/devices/surface-hub/manage-surface-hub.md +++ b/devices/surface-hub/manage-surface-hub.md @@ -7,7 +7,7 @@ ms.prod: w10 ms.mktglfcycl: manage ms.sitesec: library ms.pagetype: surfacehub -author: jdeckerMS +author: TrudyHa localizationpriority: medium --- @@ -30,7 +30,7 @@ Learn about managing and updating Surface Hub. | [Remote Surface Hub management](remote-surface-hub-management.md) |Topics related to managing your Surface Hub remotely. Include install apps, managing settings with MDM and monitoring with Operations Management Suite. | | [Manage Surface Hub settings](manage-surface-hub-settings.md) |Topics related to managing Surface Hub settings: accessibility, device account, device reset, fully qualified domain name, Windows Update settings, and wireless network | | [Install apps on your Surface Hub]( https://technet.microsoft.com/itpro/surface-hub/install-apps-on-surface-hub) | Admins can install apps can from either the Windows Store or the Windows Store for Business.| -| [End a meeting with End session](https://technet.microsoft.com/itpro/surface-hub/i-am-done-finishing-your-surface-hub-meeting) | At the end of a meeting, users can tap **End session** to clean up any sensitive data and prepare the device for the next meeting.| +| [End a meeting with I’m done](https://technet.microsoft.com/itpro/surface-hub/i-am-done-finishing-your-surface-hub-meeting) | At the end of a meeting, users can tap I'm Done to clean up any sensitive data and prepare the device for the next meeting.| | [Save your BitLocker key](https://technet.microsoft.com/itpro/surface-hub/save-bitlocker-key-surface-hub) | Every Surface Hub is automatically set up with BitLocker drive encryption software. Microsoft strongly recommends that you make sure you back up your BitLocker recovery keys.| | [Connect other devices and display with Surface Hub](https://technet.microsoft.com/itpro/surface-hub/connect-and-display-with-surface-hub) | You can connect other device to your Surface Hub to display content.| | [Using a room control system]( https://technet.microsoft.com/itpro/surface-hub/use-room-control-system-with-surface-hub) | Room control systems can be used with your Microsoft Surface Hub.| diff --git a/devices/surface-hub/manage-windows-updates-for-surface-hub.md b/devices/surface-hub/manage-windows-updates-for-surface-hub.md index f54bd79038..659e2a6ae5 100644 --- a/devices/surface-hub/manage-windows-updates-for-surface-hub.md +++ b/devices/surface-hub/manage-windows-updates-for-surface-hub.md @@ -7,7 +7,7 @@ ms.prod: w10 ms.mktglfcycl: manage ms.sitesec: library ms.pagetype: surfacehub -author: jdeckerMS +author: TrudyHa localizationpriority: medium --- diff --git a/devices/surface-hub/monitor-surface-hub.md b/devices/surface-hub/monitor-surface-hub.md index 27f722e175..4b96956704 100644 --- a/devices/surface-hub/monitor-surface-hub.md +++ b/devices/surface-hub/monitor-surface-hub.md @@ -7,7 +7,7 @@ ms.prod: w10 ms.mktglfcycl: manage ms.sitesec: library ms.pagetype: surfacehub -author: jdeckerMS +author: TrudyHa localizationpriority: medium --- diff --git a/devices/surface-hub/on-premises-deployment-surface-hub-device-accounts.md b/devices/surface-hub/on-premises-deployment-surface-hub-device-accounts.md index 7a4a8ed551..8914899056 100644 --- a/devices/surface-hub/on-premises-deployment-surface-hub-device-accounts.md +++ b/devices/surface-hub/on-premises-deployment-surface-hub-device-accounts.md @@ -7,7 +7,7 @@ ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: surfacehub -author: jdeckerMS +author: TrudyHa localizationpriority: medium --- diff --git a/devices/surface-hub/online-deployment-surface-hub-device-accounts.md b/devices/surface-hub/online-deployment-surface-hub-device-accounts.md index 0c25519753..6510d41971 100644 --- a/devices/surface-hub/online-deployment-surface-hub-device-accounts.md +++ b/devices/surface-hub/online-deployment-surface-hub-device-accounts.md @@ -7,7 +7,7 @@ ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: surfacehub -author: jdeckerMS +author: TrudyHa localizationpriority: medium --- diff --git a/devices/surface-hub/password-management-for-surface-hub-device-accounts.md b/devices/surface-hub/password-management-for-surface-hub-device-accounts.md index 851ae60a58..c6c3db5d36 100644 --- a/devices/surface-hub/password-management-for-surface-hub-device-accounts.md +++ b/devices/surface-hub/password-management-for-surface-hub-device-accounts.md @@ -7,7 +7,7 @@ ms.prod: w10 ms.mktglfcycl: manage ms.sitesec: library ms.pagetype: surfacehub, security -author: jdeckerMS +author: TrudyHa localizationpriority: medium --- diff --git a/devices/surface-hub/physically-install-your-surface-hub-device.md b/devices/surface-hub/physically-install-your-surface-hub-device.md index 3ea7a56b63..489e6a03a3 100644 --- a/devices/surface-hub/physically-install-your-surface-hub-device.md +++ b/devices/surface-hub/physically-install-your-surface-hub-device.md @@ -7,7 +7,7 @@ ms.prod: w10 ms.mktglfcycl: manage ms.sitesec: library ms.pagetype: surfacehub, readiness -author: jdeckerMS +author: TrudyHa localizationpriority: medium --- diff --git a/devices/surface-hub/prepare-your-environment-for-surface-hub.md b/devices/surface-hub/prepare-your-environment-for-surface-hub.md index 9ae8f829c5..f5c342d43d 100644 --- a/devices/surface-hub/prepare-your-environment-for-surface-hub.md +++ b/devices/surface-hub/prepare-your-environment-for-surface-hub.md @@ -7,7 +7,7 @@ ms.prod: w10 ms.mktglfcycl: plan ms.sitesec: library ms.pagetype: surfacehub -author: jdeckerMS +author: TrudyHa localizationpriority: medium --- @@ -27,12 +27,11 @@ Review these dependencies to make sure Surface Hub features will work in your IT | Skype for Business (Lync Server 2013 or later, or Skype for Business Online) | Skype for Business is used for various conferencing features, like video calls, instant messaging, and screen sharing.

If screen sharing on a Surface Hub fails and the error message **An error occurred during the screen presentation** is displayed, see [Video Based Screen Sharing not working on Surface Hub](https://support.microsoft.com/help/3179272/video-based-screen-sharing-not-working-on-surface-hub) for help. | | Mobile device management (MDM) solution (Microsoft Intune, System Center Configuration Manager, or supported third-party MDM provider) | If you want to apply settings and install apps remotely, and to multiple devices at a time, you must set up a MDM solution and enroll the device to that solution. See [Manage settings with an MDM provider](manage-settings-with-mdm-for-surface-hub.md) for details. | | Microsoft Operations Managmement Suite (OMS) | OMS is used to monitor the health of Surface Hub devices. See [Monitor your Surface Hub](monitor-surface-hub.md) for details. | -| Network and Internet access |

In order to function properly, the Surface Hub should have access to a wired or wireless network. Overall, a wired connection is preferred. 802.1x Authentication is supported for both wired and wireless connections.

**Dynamic IP:** The Surface Hub cannot be configured to use a static IP. It must use DHCP to assign an IP address.

**Proxy servers:** If your topology requires a connection to a proxy server to reach Internet services, then you can configure it during first run, or in Settings. Proxy credentials are stored across Surface Hub sessions and only need to be set once. | +| Network and Internet access |

In order to function properly, the Surface Hub should have access to a wired or wireless network. Overall, a wired connection is preferred.

**Dynamic IP:** The Surface Hub cannot be configured to use a static IP. It must use DHCP to assign an IP address.

**Proxy servers:** If your topology requires a connection to a proxy server to reach Internet services, then you can configure it during first run, or in Settings. | Additionally, note that Surface Hub requires the following open ports: - HTTPS: 443 - HTTP: 80 -- NTP: 123 Depending on your environment, access to additional ports may be needed: - For online environments, see [Office 365 IP URLs and IP address ranges](https://support.office.com/en-us/article/Office-365-URLs-and-IP-address-ranges-8548a211-3fe7-47cb-abb1-355ea5aa88a2?ui=en-US&rs=en-US&ad=US). @@ -42,20 +41,6 @@ Microsoft collects telemetry to help improve your Surface Hub experience. Add th - Telemetry client endpoint: `https://vortex.data.microsoft.com/` - Telemetry settings endpoint: `https://settings.data.microsoft.com/` -### Proxy configuration - -If your organization restricts computers on your network from connecting to the Internet, there is a set of URLs that need to be available for devices to use Store for Business. Some of the Store for Business features use Windows Store app and Windows Store services. Devices using Store for Business – either to acquire, install, or update apps – will need access to these URLs. If you use a proxy server to block traffic, your configuration needs to allow these URLs: - -- login.live.com -- login.windows.net -- account.live.com -- clientconfig.passport.net -- windowsphone.com -- *.wns.windows.com -- *.microsoft.com -- www.msftncsi.com (prior to Windows 10, version 1607) -- www.msftconnecttest.com/connecttest.txt (replaces www.msftncsi.com starting with Windows 10, version 1607) - ## Work with other admins @@ -64,7 +49,7 @@ Surface Hub interacts with a few different products and services. Depending on t ## Create and verify device account -A device account is an Exchange resource account that Surface Hub uses to display its meeting calendar, join Skype for Business calls, send email, and (optionally) to authenticate to Exchange. See [Create and test a device account](create-and-test-a-device-account-surface-hub.md) for details. +A device account is an Exchange resource account that Surface Hub uses to display its meeting calendar, join Skype for Business calls, and send email. See [Create and test a device account](create-and-test-a-device-account-surface-hub.md) for details. After you've created your device account, there are a couple of ways to verify that it's setup correctly. - Run Surface Hub device account validation PowerShell scripts. For more information, see [Surface Hub device account scripts](https://gallery.technet.microsoft.com/scriptcenter/Surface-Hub-device-account-6db77696) in Script Center, or [PowerShell scripts for Surface Hub](appendix-a-powershell-scripts-for-surface-hub.md) later in this guide. diff --git a/devices/surface-hub/provisioning-packages-for-certificates-surface-hub.md b/devices/surface-hub/provisioning-packages-for-certificates-surface-hub.md new file mode 100644 index 0000000000..73dd21ac2e --- /dev/null +++ b/devices/surface-hub/provisioning-packages-for-certificates-surface-hub.md @@ -0,0 +1,221 @@ +--- +title: Create provisioning packages (Surface Hub) +description: For Windows 10, settings that use the registry or a content services platform (CSP) can be configured using provisioning packages. You can also add certificates during first run using provisioning. +ms.assetid: 8AA25BD4-8A8F-4B95-9268-504A49BA5345 +keywords: add certificate, provisioning package +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: surfacehub +author: TrudyHa +localizationpriority: medium +--- + +# Create provisioning packages (Surface Hub) + +This topic explains how to create a provisioning package using the Windows Imaging and Configuration Designer (ICD), and apply it to Surface Hub devices. For Surface Hub, you can use provisioning packages to add certificates, install Universal Windows Platform (UWP) apps, and customize policies and settings. + +You can apply a provisioning package using a USB during first run, or through the **Settings** app. + + +## Advantages +- Quickly configure devices without using a MDM provider. + +- No network connectivity required. + +- Simple to apply. + +[Learn more about the benefits and uses of provisioning packages.](https://technet.microsoft.com/itpro/windows/whats-new/new-provisioning-packages) + + +## Requirements + +To create and apply a provisioning package to a Surface Hub, you'll need the following: + +- Windows Imaging and Configuration Designer (ICD), which is installed as a part of the [Windows 10 Assessment and Deployment Kit (ADK)](http://go.microsoft.com/fwlink/p/?LinkId=526740). +- A PC running Windows 10. +- A USB flash drive. +- If you apply the package using the **Settings** app, you'll need device admin credentials. + +You'll create the provisioning package on a PC running Windows 10, save the package to a USB drive, and then deploy it to your Surface Hub. + + +## Supported items for Surface Hub provisioning packages + +Currently, you can add these items to provisioning packages for Surface Hub: +- **Certificates** - You can add certificates, if needed, to authenticate to Microsoft Exchange. +- **Universal Windows Platform (UWP) apps** - You can install UWP apps. This can be an offline-licensed app from the Windows Store for Business, or an app created by an in-house dev. +- **Policies** - Surface Hub supports a subset of the policies in the [Policy configuration service provider](https://msdn.microsoft.com/library/windows/hardware/dn904962.aspx). Some of those policies can be configured with ICD. +- **Settings** - You can configure any setting in the [SurfaceHub configuration service provider](https://msdn.microsoft.com/library/windows/hardware/mt608323.aspx). + + +## Create the provisioning package + +Use the Windows Imaging and Configuration Designer (ICD) tool included in the Windows Assessment and Deployment Kit (ADK) for Windows 10 to create a provisioning package. When you install the ADK, you can choose to install only the Imaging and Configuration Designer (ICD). [Install the ADK.](http://go.microsoft.com/fwlink/p/?LinkId=526740) + +1. Open Windows ICD (by default, `%windir%\Program Files (x86)\Windows Kits\10\Assessment and Deployment Kit\Imaging and Configuration Designer\x86\ICD.exe`). + +2. Click **Advanced provisioning**. + + ![ICD start options](images/ICDstart-option.PNG) + +3. Name your project and click **Next**. + +4. Select **Common to Windows 10 Team edition**, click **Next**, and then click **Finish**. + + ![ICD new project](images/icd-new-project.png) + +5. In the project, under **Available customizations**, select **Common Team edition settings**. + + ![ICD common settings](images/icd-common-settings.png) + + +### Add a certificate to your package +You can use provisioning packages to install certificates that will allow the device to authenticate to Microsoft Exchange. + +> [!NOTE] +> Provisioning packages can only install certificates to the device (local machine) store, and not to the user store. If your organization requires that certificates must be installed to the user store, use Mobile Device Management (MDM) to deploy these certificates. See your MDM solution documentation for details. + +1. In the **Available customizations** pane, go to **Runtime settings** > **Certificates** > **ClientCertificates**. + +2. Enter a **CertificateName** and then click **Add**. + +2. Enter the **CertificatePassword**. + +3. For **CertificatePath**, browse and select the certificate. + +4. Set **ExportCertificate** to **False**. + +5. For **KeyLocation**, select **Software only**. + + +### Add a Universal Windows Platform (UWP) app to your package +Before adding a UWP app to a provisioning package, you need the app package (either an .appx, or .appxbundle) and any dependency files. If you acquired the app from the Windows Store for Business, you will also need the *unencoded* app license. See [Distribute offline apps](https://technet.microsoft.com/itpro/windows/manage/distribute-offline-apps#download-an-offline-licensed-app) to learn how to download these items from the Windows Store for Business. + +1. In the **Available customizations** pane, go to **Runtime settings** > **UniversalAppInstall** > **DeviceContextApp**. + +2. Enter a **PackageFamilyName** for the app and then click **Add**. For consistency, use the app's package family name. If you acquired the app from the Windows Store for Business, you can find the package family name in the app license. Open the license file using a text editor, and use the value between the \...\ tags. + +3. For **ApplicationFile**, click **Browse** to find and select the target app (either an \*.appx or \*.appxbundle). + +4. For **DependencyAppxFiles**, click **Browse** to find and add any dependencies for the app. For Surface Hub, you will only need the x64 versions of these dependencies. + +If you acquired the app from the Windows Store for Business, you will also need to add the app license to your provisioning package. + +1. Make a copy of the app license, and rename it to use a **.ms-windows-store-license** extension. For example, "example.xml" becomes "example.ms-windows-store-license". + +2. In ICD, in the **Available customizations** pane, go to **Runtime settings** > **UniversalAppInstall** > **DeviceContextAppLicense**. + +3. Enter a **LicenseProductId** and then click **Add**. For consistency, use the app's license ID from the app license. Open the license file using a text editor. Then, in the \ tag, use the value in the **LicenseID** attribute. + +4. Select the new **LicenseProductId** node. For **LicenseInstall**, click **Browse** to find and select the license file that you renamed in Step 1. + + +### Add a policy to your package +Surface Hub supports a subset of the policies in the [Policy configuration service provider](https://msdn.microsoft.com/library/windows/hardware/dn904962.aspx). Some of those policies can be configured with ICD. + +1. In the **Available customizations** pane, go to **Runtime settings** > **Policies**. + +2. Select one of the available policy areas. + +3. Select and set the policy you want to add to your provisioning package. + + +### Add Surface Hub settings to your package + +You can add settings from the [SurfaceHub configuration service provider](https://msdn.microsoft.com/library/windows/hardware/mt608323.aspx) to your provisioning package. + +1. In the **Available customizations** pane, go to **Runtime settings** > **WindowsTeamSettings**. + +2. Select one of the available setting areas. + +3. Select and set the setting you want to add to your provisioning package. + + +## Build your package + +1. When you are done configuring the provisioning package, on the **File** menu, click **Save**. + +2. Read the warning that project files may contain sensitive information, and click **OK**. + + > [!IMPORTANT] + > When you build a provisioning package, you may include sensitive information in the project files and in the provisioning package (.ppkg) file. Although you have the option to encrypt the .ppkg file, project files are not encrypted. You should store the project files in a secure location and delete the project files when they are no longer needed. + +3. On the **Export** menu, click **Provisioning package**. + +4. Change **Owner** to **IT Admin**, which will set the precedence of this provisioning package higher than provisioning packages applied to this device from other sources. + +5. Set a value for **Package Version**, and then select **Next.** + + > [!TIP] + > You can make changes to existing packages and change the version number to update previously applied packages. + +6. Optional: You can choose to encrypt the package and enable package signing. + + - **Enable package encryption** - If you select this option, an auto-generated password will be shown on the screen. + + - **Enable package signing** - If you select this option, you must select a valid certificate to use for signing the package. You can specify the certificate by clicking **Browse...** and choosing the certificate you want to use to sign the package. + + > [!IMPORTANT] + > We recommend that you include a trusted provisioning certificate in your provisioning package. When the package is applied to a device, the certificate is added to the system store and any package signed with that certificate thereafter can be applied silently.  + +7. Click **Next** to specify the output location where you want the provisioning package to go once it's built. By default, Windows ICD uses the project folder as the output location.

+Optionally, you can click **Browse** to change the default output location. + +8. Click **Next**. + +9. Click **Build** to start building the package. The project information is displayed in the build page and the progress bar indicates the build status.

+If you need to cancel the build, click **Cancel**. This cancels the current build process, closes the wizard, and takes you back to the **Customizations Page**. + +10. If your build fails, an error message will show up that includes a link to the project folder. You can scan the logs to determine what caused the error. Once you fix the issue, try building the package again.

+If your build is successful, the name of the provisioning package, output directory, and project directory will be shown. + + - If you choose, you can build the provisioning package again and pick a different path for the output package. To do this, click **Back** to change the output package name and path, and then click **Next** to start another build. + + - If you are done, click **Finish** to close the wizard and go back to the **Customizations Page**. + +11. Select the **output location** link to go to the location of the package. Copy the .ppkg to an empty USB flash drive. + + +## Apply a provisioning package to Surface Hub + +There are two options for deploying provisioning packages to a Surface Hub. You can apply a provisioning packing [during the first run wizard](#apply-a-provisioning-package-during-first-run), or using [Settings](#apply-a-package-using-settings). + + +### Apply a provisioning package during first run + +> [!IMPORTANT] +> Only use provisioning packages to install certificates during first run. Use the **Settings** app to install apps and apply other settings. + +1. When you turn on the Surface Hub for the first time, the first-run program will display the [**Hi there page**](first-run-program-surface-hub.md#first-page). Make sure that the settings are properly configured before proceeding. + +2. Insert the USB flash drive containing the .ppkg file into the Surface Hub. If the package is in the root directory of the drive, the first-run program will recognize it and ask if you want to set up the device. Select **Set up**. + + ![Set up device?](images/provisioningpackageoobe-01.png) + +3. The next screen asks you to select a provisioning source. Select **Removable Media** and tap **Next**. + + ![Provision this device](images/provisioningpackageoobe-02.png) + +4. Select the provisioning package (\*.ppkg) that you want to apply, and tap **Next**. Note that you can only install one package during first run. + + ![Choose a package](images/provisioningpackageoobe-03.png) + +5. The first-run program will show you a summary of the changes that the provisioning package will apply. Select **Yes, add it**. The package will be applied, and you'll be taken to the next page in the first-run program. + + ![Do you trust this package?](images/provisioningpackageoobe-04.png) + + +### Apply a package using Settings + +1. Insert the USB flash drive containing the .ppkg file into the Surface Hub. + +2. From the Surface Hub, start **Settings** and enter the admin credentials when prompted. + +3. Navigate to **This device** > **Device management**. Under **Provisioning packages**, select **Add or remove a provisioning package**. + +4. Select **Add a package**. + +5. Choose your provisioning package and select **Add**. You may have to re-enter the admin credentials if prompted. + +6. You'll see a summary of the changes that the provisioning package will apply. Select **Yes, add it**. diff --git a/devices/surface-hub/provisioning-packages-for-surface-hub.md b/devices/surface-hub/provisioning-packages-for-surface-hub.md deleted file mode 100644 index 0d3604f6ad..0000000000 --- a/devices/surface-hub/provisioning-packages-for-surface-hub.md +++ /dev/null @@ -1,319 +0,0 @@ ---- -title: Create provisioning packages (Surface Hub) -description: For Windows 10, settings that use the registry or a configuration service provider (CSP) can be configured using provisioning packages. -ms.assetid: 8AA25BD4-8A8F-4B95-9268-504A49BA5345 -keywords: add certificate, provisioning package -ms.prod: w10 -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: surfacehub -author: jdeckerMS -localizationpriority: medium ---- - -# Create provisioning packages (Surface Hub) - -This topic explains how to create a provisioning package using the Windows Configuration Designer, and apply it to Surface Hub devices. For Surface Hub, you can use provisioning packages to add certificates, install Universal Windows Platform (UWP) apps, and customize policies and settings. - -You can apply a provisioning package using a USB stick during first-run setup, or through the **Settings** app. - - -## Advantages -- Quickly configure devices without using a mobile device management (MDM) provider. - -- No network connectivity required. - -- Simple to apply. - -[Learn more about the benefits and uses of provisioning packages.](https://technet.microsoft.com/itpro/windows/configure/provisioning-packages) - - -## Requirements - -To create and apply a provisioning package to a Surface Hub, you'll need the following: - -- Windows Configuration Designer, which can be installed from Windows Store or from the Windows 10 Assessment and Deployment Kit (ADK). [Learn how to install Windows Configuration Designer.](https://technet.microsoft.com/itpro/windows/configure/provisioning-install-icd) -- A USB stick. -- If you apply the package using the **Settings** app, you'll need device admin credentials. - -You create the provisioning package on a PC running Windows 10, save the package to a USB drive, and then deploy it to your Surface Hub. - - -## Supported items for Surface Hub provisioning packages - -Using the **Provision Surface Hub devices** wizard, you can: - -- Enroll in Active Directory, Azure Active Directory, or MDM -- Create an device administrator account -- Add applications and certificates -- Configure proxy settings -- Add a Surface Hub configuration file - ->[!WARNING] ->You must run Windows Configuration Designer on Windows 10 to configure Azure Active Directory enrollment using the wizard. - -Using the advanced provisioning editor, you can add these items to provisioning packages for Surface Hub: - -- **Policies** - Surface Hub supports a subset of the policies in the [Policy configuration service provider](https://msdn.microsoft.com/library/windows/hardware/dn904962.aspx#surfacehubpolicies). -- **Settings** - You can configure any setting in the [SurfaceHub configuration service provider](https://msdn.microsoft.com/library/windows/hardware/mt608323.aspx). - ->[!TIP] -> Use the wizard to create a package with the common settings, then switch to the advanced editor to add other settings. -> ->![open advanced editor](images/icd-simple-edit.png) - -## Use the Surface Hub provisioning wizard - -After you [install Windows Configuration Designer](https://technet.microsoft.com/itpro/windows/configure/provisioning-install-icd), you can create a provisioning package. - -### Create the provisioning package - -1. Open Windows Configuration Designer: - - From either the Start screen or Start menu search, type 'Windows Configuration Designer' and click on the Windows Configuration Designer shortcut, - - or - - - If you installed Windows Configuration Designer from the ADK, navigate to `C:\Program Files (x86)\Windows Kits\10\Assessment and Deployment Kit\Imaging and Configuration Designer\x86` (on an x64 computer) or `C:\Program Files\Windows Kits\10\Assessment and Deployment Kit\Imaging and Configuration Designer\x86\ICD.exe` (on an x86 computer), and then double-click **ICD.exe**. - -2. Click **Provision Surface Hub devices**. - -3. Name your project and click **Next**. - -### Configure settings - - - - - - - - - -
![step one](images/one.png) ![add certificates](images/add-certificates.png)

To provision the device with a certificate, click **Add a certificate**. Enter a name for the certificate, and then browse to and select the certificate to be used.		![add a certificate](images/add-certificates-details.png)
![step two](images/two.png) ![configure proxy settings](images/proxy.png)

Toggle **Yes** or **No** for proxy settings. The default configuration for Surface Hub is to automatically detect proxy settings, so you can select **No** if that is the setting that you want. However, if your infrastructure previously required using a proxy server and has changed to not require a proxy server, you can use a provisioning package to revert your Surface Hub devices to the default settings by selecting **Yes** and **Automatically detect settings**.

If you toggle **Yes**, you can select to automatically detect proxy settings, or you can manually configure the settings by entering a URL to a setup script, or a static proxy server address. You can also identify whether to use the proxy server for local addresses, and enter exceptions (addresses that Surface Hub should connect to directly without using the proxy server). 		![configure proxy settings](images/proxy-details.png)
![step three](images/three.png) ![device admins](images/set-up-device-admins.png)

You can enroll the device in Active Directory and specify a security group to use the Settings app, enroll in Azure Active Directory to allow global admins to use the Settings app, or create a local administrator account on the device.

To enroll the device in Active Directory, enter the credentials for a least-privileged user account to join the device to the domain, and specify the security group to have admin credentials on Surface Hub. If a provisioning package that enrolls a device in Active Directory is going to be applied to a Surface Hub that was reset, the same domain account can only be used if the account listed is a domain administrator or is the same account that set up the Surface Hub initially. Otherwise, a different domain account must be used in the provisioning package.

Before you use a Windows Configuration Designer wizard to configure bulk Azure AD enrollment, [set up Azure AD join in your organization](https://docs.microsoft.com/azure/active-directory/active-directory-azureadjoin-setup). The **maximum number of devices per user** setting in your Azure AD tenant determines how many times the bulk token that you get in the wizard can be used. To enroll the device in Azure AD, select that option and enter a friendly name for the bulk token you will get using the wizard. Set an expiration date for the token (maximum is 30 days from the date you get the token). Click **Get bulk token**. In the **Let's get you signed in** window, enter an account that has permissions to join a device to Azure AD, and then the password. Click **Accept** to give Windows Configuration Designer the necessary permissions.

To create a local administrator account, select that option and enter a user name and password.

**Important:** If you create a local account in the provisioning package, you must change the password using the **Settings** app every 42 days. If the password is not changed during that period, the account might be locked out and unable to sign in. 		![join Active Directory, Azure AD, or create a local admin account](images/set-up-device-admins-details.png)
![step four](images/four.png) ![enroll in device management](images/enroll-mdm.png)

Toggle **Yes** or **No** for enrollment in MDM.

If you toggle **Yes**, you must provide a service account and password or certificate thumbprint that is authorized to enroll the device, and also specify the authentication type. If required by your MDM provider, also enter the URLs for the discovery service, enrollment service, and policy service. [Learn more about managing Surface Hub with MDM.](manage-settings-with-mdm-for-surface-hub.md)		![enroll in mobile device management](images/enroll-mdm-details.png)
![step five](images/five.png) ![add applications](images/add-applications.png)

You can install multiple Universal Windows Platform (UWP) apps in a provisioning package. For help with the settings, see [Provision PCs with apps](https://technet.microsoft.com/itpro/windows/configure/provision-pcs-with-apps).

**Important:** Although the wizard interface allows you to select a Classic Win32 app, only include UWP apps in a provisioning package that will be applied to Surface Hub. If you include a Classic Win32 app, provisioning will fail. 		![add an application](images/add-applications-details.png)
![step six](images/six.png) ![Add configuration file](images/add-config-file.png)

You don't configure any settings in this step. It provides instructions for including a configuration file that contains a list of device accounts. The configuration file must not contain column headers. When you apply the provisioning package to Surface Hub, if a Surface Hub configuration file is included on the USB drive, you can select the account and friendly name for the device from the file. See [Sample configuration file](#sample-configuration-file) for an example.

**Important:** The configuration file can only be applied during the out-of-box setup experience (OOBE) and can only be used with provisioning packages created using the Windows Configuration Designer released with Windows 10, version 1703. 		![Add a Surface Hub configuration file](images/add-config-file-details.png)
![finish](images/finish.png)

You can set a password to protect your provisioning package. You must enter this password when you apply the provisioning package to a device.		![Protect your package](images/finish-details.png)
- -After you're done, click **Create**. It only takes a few seconds. When the package is built, the location where the package is stored is displayed as a hyperlink at the bottom of the page. - -## Sample configuration file - -A Surface Hub configuration file contains a list of device accounts that your device can use to connect to Exchange and Skype for Business. When you apply a provisioning package to Surface Hub, you can include a configuration file in the root directory of the USB flash drive, and then select the desired account to apply to that device. The configuration file can only be applied during the out-of-box setup experience (OOBE) and can only be used with provisioning packages created using the Windows Configuration Designer released with Windows 10, version 1703. - -Use Microsoft Excel or other CSV editor to create a CSV file named `SurfaceHubConfiguration.csv`. In the file, enter a list of device accounts and friendly names in this format: - -``` -,, -``` ->[!IMPORTANT] ->Because the configuration file stores the device account passwords in plaintext, we recommend that you update the passwords after you've applied the provisioning package to your devices. You can use the [DeviceAccount node](https://msdn.microsoft.com/windows/hardware/commercialize/customize/mdm/surfacehub-csp#deviceaccount) in the [Surface Hub configuration service provider (CSP)](https://msdn.microsoft.com/windows/hardware/commercialize/customize/mdm/surfacehub-csp) to update the passwords via MDM. - - -The following is an example of `SurfaceHubConfiguration.csv`. - -``` -Rainier@contoso.com,password,Rainier Surface Hub -Adams@contoso.com,password,Adams Surface Hub -Baker@contoso.com,password,Baker Surface Hub -Glacier@constoso.com,password,Glacier Surface Hub -Stuart@contoso.com,password,Stuart Surface Hub -Fernow@contoso.com,password,Fernow Surface Hub -Goode@contoso.com,password,Goode Surface Hub -Shuksan@contoso.com,password,Shuksan Surface Hub -Buckner@contoso.com,password,Buckner Surface Hub -Logan@contoso.com,password,Logan Surface Hub -Maude@consoto.com,password,Maude Surface hub -Spickard@contoso.com,password,Spickard Surface Hub -Redoubt@contoso.com,password,Redoubt Surface Hub -Dome@contoso.com,password,Dome Surface Hub -Eldorado@contoso.com,password,Eldorado Surface Hub -Dragontail@contoso.com,password,Dragontail Surface Hub -Forbidden@contoso.com,password,Forbidden Surface Hub -Oval@contoso.com,password,Oval Surface Hub -StHelens@contoso.com,password,St Helens Surface Hub -Rushmore@contoso.com,password,Rushmore Surface Hub -``` - -## Use advanced provisioning - -After you [install Windows Configuration Designer](https://technet.microsoft.com/itpro/windows/configure/provisioning-install-icd), you can create a provisioning package. - -### Create the provisioning package (advanced) - -1. Open Windows Configuration Designer: - - From either the Start screen or Start menu search, type 'Windows Configuration Designer' and click on the Windows Configuration Designer shortcut, - - or - - - If you installed Windows Configuration Designer from the ADK, navigate to `C:\Program Files (x86)\Windows Kits\10\Assessment and Deployment Kit\Imaging and Configuration Designer\x86` (on an x64 computer) or `C:\Program Files\Windows Kits\10\Assessment and Deployment Kit\Imaging and Configuration Designer\x86\ICD.exe` (on an x86 computer), and then double-click **ICD.exe**. - -2. Click **Advanced provisioning**. - -3. Name your project and click **Next**. - -4. Select **Common to Windows 10 Team edition**, click **Next**, and then click **Finish**. - - ![ICD new project](images/icd-new-project.png) - -5. In the project, under **Available customizations**, select **Common Team edition settings**. - - ![ICD common settings](images/icd-common-settings.png) - - -### Add a certificate to your package -You can use provisioning packages to install certificates that will allow the device to authenticate to Microsoft Exchange. - -> [!NOTE] -> Provisioning packages can only install certificates to the device (local machine) store, and not to the user store. If your organization requires that certificates must be installed to the user store, use Mobile Device Management (MDM) to deploy these certificates. See your MDM solution documentation for details. - -1. In the **Available customizations** pane, go to **Runtime settings** > **Certificates** > **ClientCertificates**. - -2. Enter a **CertificateName** and then click **Add**. - -2. Enter the **CertificatePassword**. - -3. For **CertificatePath**, browse and select the certificate. - -4. Set **ExportCertificate** to **False**. - -5. For **KeyLocation**, select **Software only**. - - -### Add a Universal Windows Platform (UWP) app to your package -Before adding a UWP app to a provisioning package, you need the app package (either an .appx, or .appxbundle) and any dependency files. If you acquired the app from the Windows Store for Business, you will also need the *unencoded* app license. See [Distribute offline apps](https://technet.microsoft.com/itpro/windows/manage/distribute-offline-apps#download-an-offline-licensed-app) to learn how to download these items from the Windows Store for Business. - -1. In the **Available customizations** pane, go to **Runtime settings** > **UniversalAppInstall** > **DeviceContextApp**. - -2. Enter a **PackageFamilyName** for the app and then click **Add**. For consistency, use the app's package family name. If you acquired the app from the Windows Store for Business, you can find the package family name in the app license. Open the license file using a text editor, and use the value between the \...\ tags. - -3. For **ApplicationFile**, click **Browse** to find and select the target app (either an \*.appx or \*.appxbundle). - -4. For **DependencyAppxFiles**, click **Browse** to find and add any dependencies for the app. For Surface Hub, you will only need the x64 versions of these dependencies. - -If you acquired the app from the Windows Store for Business, you will also need to add the app license to your provisioning package. - -1. Make a copy of the app license, and rename it to use a **.ms-windows-store-license** extension. For example, "example.xml" becomes "example.ms-windows-store-license". - -2. In ICD, in the **Available customizations** pane, go to **Runtime settings** > **UniversalAppInstall** > **DeviceContextAppLicense**. - -3. Enter a **LicenseProductId** and then click **Add**. For consistency, use the app's license ID from the app license. Open the license file using a text editor. Then, in the \ tag, use the value in the **LicenseID** attribute. - -4. Select the new **LicenseProductId** node. For **LicenseInstall**, click **Browse** to find and select the license file that you renamed in Step 1. - - -### Add a policy to your package -Surface Hub supports a subset of the policies in the [Policy configuration service provider](https://msdn.microsoft.com/library/windows/hardware/dn904962.aspx). Some of those policies can be configured with ICD. - -1. In the **Available customizations** pane, go to **Runtime settings** > **Policies**. - -2. Select one of the available policy areas. - -3. Select and set the policy you want to add to your provisioning package. - - -### Add Surface Hub settings to your package - -You can add settings from the [SurfaceHub configuration service provider](https://msdn.microsoft.com/library/windows/hardware/mt608323.aspx) to your provisioning package. - -1. In the **Available customizations** pane, go to **Runtime settings** > **WindowsTeamSettings**. - -2. Select one of the available setting areas. - -3. Select and set the setting you want to add to your provisioning package. - - -## Build your package - -1. When you are done configuring the provisioning package, on the **File** menu, click **Save**. - -2. Read the warning that project files may contain sensitive information, and click **OK**. - - > [!IMPORTANT] - > When you build a provisioning package, you may include sensitive information in the project files and in the provisioning package (.ppkg) file. Although you have the option to encrypt the .ppkg file, project files are not encrypted. You should store the project files in a secure location and delete the project files when they are no longer needed. - -3. On the **Export** menu, click **Provisioning package**. - -4. Change **Owner** to **IT Admin**, which will set the precedence of this provisioning package higher than provisioning packages applied to this device from other sources. - -5. Set a value for **Package Version**, and then select **Next.** - - > [!TIP] - > You can make changes to existing packages and change the version number to update previously applied packages. - -6. Optional: You can choose to encrypt the package and enable package signing. - - - **Enable package encryption** - If you select this option, an auto-generated password will be shown on the screen. - - - **Enable package signing** - If you select this option, you must select a valid certificate to use for signing the package. You can specify the certificate by clicking **Browse...** and choosing the certificate you want to use to sign the package. - - > [!IMPORTANT] - > We recommend that you include a trusted provisioning certificate in your provisioning package. When the package is applied to a device, the certificate is added to the system store and any package signed with that certificate thereafter can be applied silently.  - -7. Click **Next** to specify the output location where you want the provisioning package to go once it's built. By default, Windows ICD uses the project folder as the output location.

-Optionally, you can click **Browse** to change the default output location. - -8. Click **Next**. - -9. Click **Build** to start building the package. The project information is displayed in the build page and the progress bar indicates the build status.

-If you need to cancel the build, click **Cancel**. This cancels the current build process, closes the wizard, and takes you back to the **Customizations Page**. - -10. If your build fails, an error message will show up that includes a link to the project folder. You can scan the logs to determine what caused the error. Once you fix the issue, try building the package again.

-If your build is successful, the name of the provisioning package, output directory, and project directory will be shown. - - - If you choose, you can build the provisioning package again and pick a different path for the output package. To do this, click **Back** to change the output package name and path, and then click **Next** to start another build. - - - If you are done, click **Finish** to close the wizard and go back to the **Customizations Page**. - -11. Select the **output location** link to go to the location of the package. Copy the .ppkg to an empty USB flash drive. - - -## Apply a provisioning package to Surface Hub - -There are two options for deploying provisioning packages to a Surface Hub. You can apply a provisioning packing [during the first run wizard](#apply-a-provisioning-package-during-first-run), or using [Settings](#apply-a-package-using-settings). - - -### Apply a provisioning package during first run - -> [!IMPORTANT] -> Only use provisioning packages to install certificates during first run. Use the **Settings** app to install apps and apply other settings. - -1. When you turn on the Surface Hub for the first time, the first-run program will display the [**Hi there page**](first-run-program-surface-hub.md#first-page). Make sure that the settings are properly configured before proceeding. - -2. Insert the USB flash drive containing the .ppkg file into the Surface Hub. If the package is in the root directory of the drive, the first-run program will recognize it and ask if you want to set up the device. Select **Set up**. - - ![Set up device?](images/provisioningpackageoobe-01.png) - -3. The next screen asks you to select a provisioning source. Select **Removable Media** and tap **Next**. - - ![Provision this device](images/provisioningpackageoobe-02.png) - -4. Select the provisioning package (\*.ppkg) that you want to apply, and tap **Next**. Note that you can only install one package during first run. - - ![Choose a package](images/provisioningpackageoobe-03.png) - -5. The first-run program will show you a summary of the changes that the provisioning package will apply. Select **Yes, add it**. - - ![Do you trust this package?](images/provisioningpackageoobe-04.png) - -6. If a configuration file is included in the root directory of the USB flash drive, you will see **Select a configuration**. The first device account in the configuration file will be shown with a summary of the account information that will be applied to the Surface Hub. - - ![select a configuration](images/ppkg-config.png) - -7. In **Select a configuration**, select the device name to apply, and then click **Next**. - - ![select a friendly device name](images/ppkg-csv.png) - -The settings from the provisioning package will be applied to the device and OOBE will be complete. After the device restarts, you can remove the USB flash drive. - -### Apply a package using Settings - -1. Insert the USB flash drive containing the .ppkg file into the Surface Hub. - -2. From the Surface Hub, start **Settings** and enter the admin credentials when prompted. - -3. Navigate to **Surface Hub** > **Device management**. Under **Provisioning packages**, select **Add or remove a provisioning package**. - -4. Select **Add a package**. - -5. Choose your provisioning package and select **Add**. You may have to re-enter the admin credentials if prompted. - -6. You'll see a summary of the changes that the provisioning package will apply. Select **Yes, add it**. - - diff --git a/devices/surface-hub/remote-surface-hub-management.md b/devices/surface-hub/remote-surface-hub-management.md index 57bd619f8b..41588251fe 100644 --- a/devices/surface-hub/remote-surface-hub-management.md +++ b/devices/surface-hub/remote-surface-hub-management.md @@ -6,7 +6,7 @@ ms.prod: w10 ms.mktglfcycl: manage ms.sitesec: library ms.pagetype: surfacehub -author: jdeckerMS +author: TrudyHa localizationpriority: medium --- diff --git a/devices/surface-hub/save-bitlocker-key-surface-hub.md b/devices/surface-hub/save-bitlocker-key-surface-hub.md index 6e6b8b5317..2354de0f40 100644 --- a/devices/surface-hub/save-bitlocker-key-surface-hub.md +++ b/devices/surface-hub/save-bitlocker-key-surface-hub.md @@ -7,7 +7,7 @@ ms.prod: w10 ms.mktglfcycl: manage ms.sitesec: library ms.pagetype: surfacehub, security -author: jdeckerMS +author: TrudyHa localizationpriority: medium --- diff --git a/devices/surface-hub/set-up-your-surface-hub.md b/devices/surface-hub/set-up-your-surface-hub.md index 96310f473c..95b7c2c92f 100644 --- a/devices/surface-hub/set-up-your-surface-hub.md +++ b/devices/surface-hub/set-up-your-surface-hub.md @@ -7,7 +7,7 @@ ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: surfacehub -author: jdeckerMS +author: TrudyHa localizationpriority: medium --- diff --git a/devices/surface-hub/setup-worksheet-surface-hub.md b/devices/surface-hub/setup-worksheet-surface-hub.md index d8e7f921c0..a77cf5850f 100644 --- a/devices/surface-hub/setup-worksheet-surface-hub.md +++ b/devices/surface-hub/setup-worksheet-surface-hub.md @@ -7,7 +7,7 @@ ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: surfacehub -author: jdeckerMS +author: TrudyHa localizationpriority: medium --- diff --git a/devices/surface-hub/surface-hub-administrators-guide.md b/devices/surface-hub/surface-hub-administrators-guide.md new file mode 100644 index 0000000000..4786082d45 --- /dev/null +++ b/devices/surface-hub/surface-hub-administrators-guide.md @@ -0,0 +1,76 @@ +--- +title: Microsoft Surface Hub administrator's guide +description: This guide covers the installation and administration of devices running Surface Hub, and is intended for use by anyone responsible for these tasks, including IT administrators and developers. +ms.assetid: e618aab7-3a94-4159-954e-d455ef7b8839 +keywords: Surface Hub, installation, administration, administrator's guide +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: surfacehub +author: TrudyHa +localizationpriority: medium +--- + +# Microsoft Surface Hub administrator's guide + + +This guide covers the installation and administration of devices running Surface Hub, and is intended for use by anyone responsible for these tasks, including IT administrators and developers. + +Before you power on Microsoft Surface Hub for the first time, make sure you've [completed preparation items](prepare-your-environment-for-surface-hub.md), and that you have the information listed in the [Setup worksheet](setup-worksheet-surface-hub.md). When you do power it on, the device will walk you through a series of setup screens. If you haven't properly set up your environment, or don't have the required information, you'll have to do extra work afterward making sure the settings are correct. + +## In this section + + + ++++ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
TopicDescription

[Intro to Microsoft Surface Hub](intro-to-surface-hub.md)

Surface Hub is an all-in-one productivity device that is intended for brainstorming, collaboration, and presentations. In order to get the maximum benefit from Surface Hub, your organization’s infrastructure and the Surface Hub itself must be properly set up and integrated. This guide describes what needs to be done both before and during setup in order to help you optimize your use of the device.

[Physically install Microsoft Surface Hub](physically-install-your-surface-hub-device.md)

The Surface Hub Readiness Guide will help make sure that your site is ready for the installation. You can download the Guide from the [Microsoft Download Center](https://go.microsoft.com/fwlink/?LinkId=718144). It includes planning information for both the 55" and 84" devices, as well as info on moving the Surface Hub from receiving to the installation location, mounting options, and a list of what's in the box.

[Prepare your environment for Microsoft Surface Hub](prepare-your-environment-for-surface-hub.md)

This section contains an overview of the steps required to prepare your environment so that you can use all of the features of Surface Hub. See [Intro to Surface Hub](intro-to-surface-hub.md) for a description of how the device and its features interact with your IT environment.

[Set up Microsoft Surface Hub](set-up-your-surface-hub.md)

Set up instructions for Surface Hub include a setup worksheet, and a walkthrough of the first-run program.

[Manage Microsoft Surface Hub](manage-surface-hub.md)

How to manage your Surface Hub after finishing the first-run program.

[Troubleshoot Microsoft Surface Hub](troubleshoot-surface-hub.md)

Troubleshoot common problems, including setup issues, Exchange ActiveSync errors.

[Appendix: PowerShell](appendix-a-powershell-scripts-for-surface-hub.md)

PowerShell scripts to help set up and manage your Surface Hub .

+ +  + +  + +  + + + + + diff --git a/devices/surface-hub/surfacehub-whats-new-1703.md b/devices/surface-hub/surfacehub-whats-new-1703.md deleted file mode 100644 index d05ed24b2a..0000000000 --- a/devices/surface-hub/surfacehub-whats-new-1703.md +++ /dev/null @@ -1,57 +0,0 @@ ---- -title: What's new in Windows 10, version 1703 for Surface Hub -description: Windows 10, version 1703 (Creators Update) brings new features to Microsoft Surface Hub. -ms.prod: w10 -ms.mktglfcycl: manage -ms.pagetype: devices -ms.sitesec: library -author: jdeckerMS -localizationpriority: medium ---- - -# What's new in Windows 10, version 1703 for Microsoft Surface Hub? - -Windows 10, version 1703 (also called the Creators Update), introduces the following changes for Microsoft Surface Hub: - -## New settings - -Settings have been added to mobile device management (MDM) and configuration service providers (CSPs) to expand the Surface Hub management capabilities. [New settings include](manage-settings-with-mdm-for-surface-hub.md): - -- InBoxApps/SkypeForBusiness/DomainName -- InBoxApps/Connect/AutoLaunch -- Properties/DefaultVolume -- Properties/ScreenTimeout -- Properties/SessionTimeout -- Properties/SleepTimeout -- Properties/AllowSessionResume -- Properties/AllowAutoProxyAuth -- Properties/DisableSigninSuggestions -- Properties/DoNotShowMyMeetingsAndFiles -
- -## Provizioning wizard - -An easy-to-use wizard helps you quickly create provisioning packages that you can apply to multiple Surface Hub devices, and includes bulk join to Azure Active Directory. [Learn how to create a provisioning package for Surface Hub.](provisioning-packages-for-certificates-surface-hub.md) - -![steps in the provision Surface Hub devices wizard](images/wcd-wizard.png) - -## Cloud recovery - -When you reset a Surface Hub device, you now have the ability to download and install a factory build of the operating system from the cloud. [Learn more about cloud recovery.](device-reset-surface-hub.md#cloud-recovery) - ->[!NOTE] ->Cloud recovery doesn't work if you use proxy servers. - -![Reinstall](images/reinstall.png) - -## End session - -**I'm done** is now **End session**. [Learn how to use End session.](i-am-done-finishing-your-surface-hub-meeting.md) - -![end session](images/end-session.png) - - - - - - diff --git a/devices/surface-hub/troubleshoot-surface-hub.md b/devices/surface-hub/troubleshoot-surface-hub.md index a8a77af3b1..cc3bd57b95 100644 --- a/devices/surface-hub/troubleshoot-surface-hub.md +++ b/devices/surface-hub/troubleshoot-surface-hub.md @@ -7,7 +7,7 @@ ms.prod: w10 ms.mktglfcycl: support ms.sitesec: library ms.pagetype: surfacehub -author: jdeckerMS +author: TrudyHa localizationpriority: medium --- @@ -417,7 +417,29 @@ Possible fixes for issues with Surface Hub first-run program.   +### Skype for Business + +++++ + + + + + + + + + + + + + + +
IssueCausesPossible fixes

Can't call a Skype consumer from my Surface Hub.

Outgoing calls aren't supported yet.

None currently.

  @@ -600,9 +622,7 @@ This section lists status codes, mapping, user messages, and actions an admin ca     -## Related content -- [Troubleshooting Miracast connection to the Surface Hub](https://blogs.msdn.microsoft.com/surfacehub/2017/01/30/troubleshooting-miracast-connection-to-the-surface-hub/)   diff --git a/devices/surface-hub/use-fully-qualified-domain-name-surface-hub.md b/devices/surface-hub/use-fully-qualified-domain-name-surface-hub.md index 512cf6b4bf..fbed027215 100644 --- a/devices/surface-hub/use-fully-qualified-domain-name-surface-hub.md +++ b/devices/surface-hub/use-fully-qualified-domain-name-surface-hub.md @@ -3,7 +3,7 @@ title: Use fully qualified doman name with Surface Hub description: Troubleshoot common problems, including setup issues, Exchange ActiveSync errors. ms.assetid: CF58F74D-8077-48C3-981E-FCFDCA34B34A keywords: ["Troubleshoot common problems", "setup issues", "Exchange ActiveSync errors"] -author: jdeckerMS +author: TrudyHa localizationpriority: medium --- @@ -16,7 +16,7 @@ There are a few scenarios where you need to specify the domain name of your Skyp **To configure the domain name for your Skype for Business server**
1. On Surface Hub, open **Settings**. -2. Click **Surface Hub**, and then click **Calling & Audio**. +2. Click **This device**, and then click **Calling**. 3. Under **Skype for Business configuration**, click **Configure domain name**. 4. Type the domain name for your Skype for Business server, and then click **Ok**. > [!TIP] diff --git a/devices/surface-hub/use-room-control-system-with-surface-hub.md b/devices/surface-hub/use-room-control-system-with-surface-hub.md index 4ff4665c6a..16fd8c71d1 100644 --- a/devices/surface-hub/use-room-control-system-with-surface-hub.md +++ b/devices/surface-hub/use-room-control-system-with-surface-hub.md @@ -7,7 +7,7 @@ ms.prod: w10 ms.mktglfcycl: manage ms.sitesec: library ms.pagetype: surfacehub -author: jdeckerMS +author: TrudyHa localizationpriority: medium --- diff --git a/devices/surface-hub/wireless-network-management-for-surface-hub.md b/devices/surface-hub/wireless-network-management-for-surface-hub.md index db080ce397..0ccd6ad70d 100644 --- a/devices/surface-hub/wireless-network-management-for-surface-hub.md +++ b/devices/surface-hub/wireless-network-management-for-surface-hub.md @@ -7,7 +7,7 @@ ms.prod: w10 ms.mktglfcycl: manage ms.sitesec: library ms.pagetype: surfacehub, networking -author: jdeckerMS +author: TrudyHa localizationpriority: medium --- @@ -24,7 +24,7 @@ If a wired network connection is not available, the Surface Hub can use a wirele ### Choose a wireless access point 1. On the Surface Hub, open **Settings** and enter your admin credentials. -2. Click **Network & Internet**. Under **Wi-Fi**, choose an access point. If you want Surface Hub to automatically connect to this access point, click **Connect automatically**. Click **Connect**. +2. Click **System**, and then click **Network & Internet**. Under **Wi-Fi**, choose an access point. If you want Surface Hub to automatically connect to this access point, click **Connect automatically**. Click **Connect**. ![Image showing Wi-Fi settings, Network & Internet page.](images/networkmgtwireless-01.png) @@ -35,7 +35,7 @@ If a wired network connection is not available, the Surface Hub can use a wirele ### Review wireless settings 1. On the Surface Hub, open **Settings** and enter your admin credentials. -2. Click **Network & Internet**, then **Wi-Fi**, and then click **Advanced options**. +2. Click **System**, click **Network & Internet**, then **Wi-Fi**, and then click **Advanced options**. 3. Surface Hub shows you the properties for the wireless network connection. ![Image showing properties for connected Wi-Fi.](images/networkmgtwireless-04.png) diff --git a/devices/surface/surface-dock-updater.md b/devices/surface/surface-dock-updater.md index 875fe51b0c..ae5f54addb 100644 --- a/devices/surface/surface-dock-updater.md +++ b/devices/surface/surface-dock-updater.md @@ -104,6 +104,33 @@ Microsoft Surface Dock Updater logs its progress into the Event Log, as shown in *Figure 8. Surface Dock Updater events in Event Viewer* +## Changes and updates + +Microsoft periodically updates Surface Dock Updater. To learn more about the application of firmware by Surface Dock Updater, see [Manage Surface Dock firmware updates](https://technet.microsoft.com/en-us/itpro/surface/manage-surface-dock-firmware-updates). + +>[!Note] +>Each update to Surface Dock firmware is included in a new version of Surface Dock Updater. To update a Surface Dock to the latest firmware, you must use the latest version of Surface Dock Updater. + +### Version 1.0.8.0 + +This version of Surface Dock Updater adds support for the following: + +* Update for Surface Dock Main Chipset firmware +* Update for Surface Dock DisplayPort firmware + +### Version 2.0.22.0 + +This version of Surface Dock Updater adds support for the following: + +* Update for Surface Dock USB firmware +* Improved reliability of Ethernet, audio, and USB ports + +### Version 2.1.6.0 + +This version of Surface Dock Updater adds support for the following: + +* Updated firmware for Surface Dock DisplayPort + ## Related topics diff --git a/mdop/agpm/choosing-which-version-of-agpm-to-install.md b/mdop/agpm/choosing-which-version-of-agpm-to-install.md index e79ec15b6e..a3062b6238 100644 --- a/mdop/agpm/choosing-which-version-of-agpm-to-install.md +++ b/mdop/agpm/choosing-which-version-of-agpm-to-install.md @@ -50,31 +50,37 @@ Table 1 lists the operating systems on which you can install AGPM 4.0 SP3, and

Supported

+

Windows Server 2012 R2

+

Windows 10

+

Supported with the caveats outlined in [KB 4015786](https://support.microsoft.com/en-us/help/4015786/known-issues-managing-a-windows-10-group-policy-client-in-windows-serv) +

+ +

Windows Server 2012 R2 or Windows 8.1

Windows Server 2012 R2 or Windows 8.1

Supported

- +

Windows Server 2012 R2, Windows Server 2012, or Windows 8.1

Windows Server 2012 or Windows 8.1

Supported, but cannot edit policy settings or preference items that exist only in Windows 8.1

- +

Windows Server 2008 R2 or Windows 7

Windows Server 2008 R2 or Windows 7

Supported, but cannot edit policy settings or preference items that exist only in Windows 8.1

- +

Windows Server 2012, Windows Server 2008 R2, or Windows 7

Windows Server 2008 or Windows Vista with Service Pack 1 (SP1)

Supported, but cannot edit policy settings or preference items that exist only in Windows Server 2012 R2, Windows Server 2012, Windows Server 2008 R2, Windows 8.1, or Windows 7

- +

Windows Server 2008 or Windows Vista with SP1

Windows Server 2012, Windows Server 2008 R2, Windows 8, or Windows 7

Not supported

- +

Windows Server 2008 or Windows Vista with SP1

Windows Server 2008 or Windows Vista with SP1

Supported, but cannot report or edit policy settings or preference items that exist only in Windows Server 2012 R2, Windows Server 2012, Windows Server 2008 R2, Windows 8.1, or Windows 7

diff --git a/windows/configure/basic-level-windows-diagnostic-events-and-fields.md b/windows/configure/basic-level-windows-diagnostic-events-and-fields.md index f62ad1e526..738d97b024 100644 --- a/windows/configure/basic-level-windows-diagnostic-events-and-fields.md +++ b/windows/configure/basic-level-windows-diagnostic-events-and-fields.md @@ -1491,7 +1491,7 @@ This event sends data about the device, including hardware type, OEM brand, mode The following fields are available: -- **ChassisType** Represents the type of device chassis, such as desktop or low profile desktop. The possible values can range between 1 - 24. +- **ChassisType** Represents the type of device chassis, such as desktop or low profile desktop. The possible values can range between 1 - 36. - **ComputerHardwareID** Identifies a device class that is represented by a hash of different SMBIOS fields. - **DeviceColor** Indicates a color of the device. - **DeviceName** The device name that is set by the user. diff --git a/windows/configure/images/oobe.jpg b/windows/configure/images/oobe.jpg index 53a5dab6bf..2e700971c1 100644 Binary files a/windows/configure/images/oobe.jpg and b/windows/configure/images/oobe.jpg differ diff --git a/windows/configure/images/setupmsg.jpg b/windows/configure/images/setupmsg.jpg index 12935483c5..06348dd2b8 100644 Binary files a/windows/configure/images/setupmsg.jpg and b/windows/configure/images/setupmsg.jpg differ diff --git a/windows/configure/kiosk-shared-pc.md b/windows/configure/kiosk-shared-pc.md index 2afc67e022..d5d72c26b4 100644 --- a/windows/configure/kiosk-shared-pc.md +++ b/windows/configure/kiosk-shared-pc.md @@ -17,7 +17,7 @@ Some desktop devices in an enterprise serve a special purpose, such as a common | Topic | Description | | --- | --- | -| [Set up a shared or guest PC with Windows 10](set-up-a-device-for-anyone-to-use.md) | Windows 10, version 1607, introduced *shared PC mode*, which optimizes Windows 10 for shared use scenarios, such as touchdown spaces in an enterprise and temporary customer use in retail. | +| [Set up a shared or guest PC with Windows 10](set-up-shared-or-guest-pc.md) | Windows 10, version 1607, introduced *shared PC mode*, which optimizes Windows 10 for shared use scenarios, such as touchdown spaces in an enterprise and temporary customer use in retail. | | [Set up a kiosk on Windows 10 Pro, Enterprise, or Education](set-up-a-kiosk-for-windows-10-for-desktop-editions.md) | You can configure a device running Windows 10 Pro, Windows 10 Enterprise, or Windows 10 Education as a kiosk device, so that users can only interact with a single application that you select. | | [Guidelines for choosing an app for assigned access (kiosk mode)](guidelines-for-assigned-access-app.md) | You can choose almost any Windows app for assigned access; however, some apps may not provide a good user experience. This topic provides guidelines to help you choose an approprate app for a kiosk device. | | [Lock down Windows 10 to specific apps (AppLocker)](lock-down-windows-10-to-specific-apps.md) | Learn how to configure a device running Windows 10 Enterprise or Windows 10 Education so that users can only run a few specific apps. The result is similar to a kiosk device, but with multiple apps available. For example, you might set up a library computer so that users can search the catalog and browse the Internet, but can't run any other apps or change computer settings. | \ No newline at end of file diff --git a/windows/configure/set-up-a-kiosk-for-windows-10-for-mobile-edition.md b/windows/configure/set-up-a-kiosk-for-windows-10-for-mobile-edition.md index 3ef7f7e374..9cb47b71cd 100644 --- a/windows/configure/set-up-a-kiosk-for-windows-10-for-mobile-edition.md +++ b/windows/configure/set-up-a-kiosk-for-windows-10-for-mobile-edition.md @@ -165,7 +165,7 @@ Apps Corner lets you set up a custom Start screen on your Windows 10 Mobile or 1. On Start ![start](images/starticon.png), swipe over to the App list, then tap **Settings** ![settings](images/settingsicon.png) > **Accounts** > **Apps Corner**. -2. Tap **Apps**, tap to select the app that you want people to use in the kiosk mode, and then tap done ![](images/doneicon.png) +2. Tap **Apps**, tap to select the app that you want people to use in the kiosk mode, and then tap done ![done icon](images/doneicon.png). 3. If your phone doesn't already have a lock screen password, you can set one now to ensure that people can't get to your Start screen from Apps Corner. Tap **Protect my phone with a password**, click **Add**, type a PIN in the **New PIN** box, type it again in the **Confirm PIN** box, and then tap **OK**. Press **Back** ![back](images/backicon.png) to the Apps Corner settings. diff --git a/windows/configure/set-up-shared-or-guest-pc.md b/windows/configure/set-up-shared-or-guest-pc.md index d0998d18c6..23d35abc14 100644 --- a/windows/configure/set-up-shared-or-guest-pc.md +++ b/windows/configure/set-up-shared-or-guest-pc.md @@ -16,24 +16,26 @@ localizationpriority: high - Windows 10 -Windows 10, version 1607, introduced *shared PC mode*, which optimizes Windows 10 for shared use scenarios, such as touchdown spaces in an enterprise and temporary customer use in retail. You can apply shared PC mode to Windows 10 Pro, Pro Education, Education, and Enterprise. +Windows 10, version 1607, introduced *shared PC mode*, which optimizes Windows 10 for shared use scenarios, such as touchdown spaces in an enterprise and temporary customer use in retail. You can apply shared PC mode to Windows 10 Pro, Pro Education, Education, and Enterprise. > [!NOTE] > If you're interested in using Windows 10 for shared PCs in a school, see [Use Set up School PCs app](https://technet.microsoft.com/edu/windows/use-set-up-school-pcs-app) which provides a simple way to configure PCs with shared PC mode plus additional settings specific for education. ##Shared PC mode concepts -A Windows 10 PC in shared PC mode is designed to be management- and maintenance-free with high reliability. In shared PC mode, only one user can be signed in at a time. When the PC is locked, the currently signed in user can always be signed out at the lock screen. Users who sign-in are signed in as standard users, not admin users. +A Windows 10 PC in shared PC mode is designed to be management- and maintenance-free with high reliability. In shared PC mode, only one user can be signed in at a time. When the PC is locked, the currently signed in user can always be signed out at the lock screen. ###Account models -It is intended that shared PCs are joined to an Active Directory or Azure Active Directory domain by a user with the necessary rights to perform a domain join as part of a setup process. This enables any user that is part of the directory to sign-in to the PC as a standard user. The user who originally joined the PC to the domain will have administrative rights when they sign in. If using Azure Active Directory Premium, any domain user can also be configured to sign in with administrative rights. Additionally, shared PC mode can be configured to enable a **Start without an account** option on the sign-in screen, which doesn't require any user credentials or authentication and creates a new local account. +It is intended that shared PCs are joined to an Active Directory or Azure Active Directory domain by a user with the necessary rights to perform a domain join as part of a setup process. This enables any user that is part of the directory to sign-in to the PC. If using Azure Active Directory Premium, any domain user can also be configured to sign in with administrative rights. Additionally, shared PC mode can be configured to enable a **Guest** option on the sign-in screen, which doesn't require any user credentials or authentication, and creates a new local account each time it is used. Windows 10, version 1703, introduces a **kiosk mode** account. Shared PC mode can be configured to enable a **Kiosk** option on the sign-in screen, which doesn't require any user credentials or authentication, and creates a new local account each time it is used to run a specified app in assigned access (kiosk) mode. ###Account management -When the account management service is turned on in shared PC mode, accounts are automatically deleted. Account deletion applies to Active Directory, Azure Active Directory, and local accounts that are created by the **Start without an account** option. Account management is performed both at sign-off time (to make sure there is enough disk space for the next user) as well as during system maintenance time periods. Shared PC mode can be configured to delete accounts immediately at sign-out or when disk space is low. +When the account management service is turned on in shared PC mode, accounts are automatically deleted. Account deletion applies to Active Directory, Azure Active Directory, and local accounts that are created by the **Guest** and **Kiosk** options. Account management is performed both at sign-off time (to make sure there is enough disk space for the next user) as well as during system maintenance time periods. Shared PC mode can be configured to delete accounts immediately at sign-out or when disk space is low. In Windows 10, version 1703, an inactive option is added which deletes accounts if they haven't signed in after a specified number of days. ###Maintenance and sleep Shared PC mode is configured to take advantage of maintenance time periods which run while the PC is not in use. Therefore, sleep is strongly recommended so that the PC can wake up when it is not is use to perform maintenance, clean up accounts, and run Windows Update. The recommended settings can be set by choosing **SetPowerPolicies** in the list of shared PC options. Additionally, on devices without Advanced Configuration and Power Interface (ACPI) wake alarms, shared PC mode will always override real-time clock (RTC) wake alarms to be allowed to wake the PC from sleep (by default, RTC wake alarms are off). This ensures that the widest variety of hardware will take advantage of maintenance periods. -While shared PC mode does not configure Windows Update itself, it is strongly recommended to configure Windows Update to automatically install updates and reboot (if necessary) during maintenance hours. This will help ensure the PC is always up to date and not interrupting users with updates. Use one of the following methods to configure Windows Update: +While shared PC mode does not configure Windows Update itself, it is strongly recommended to configure Windows Update to automatically install updates and reboot (if necessary) during maintenance hours. This will help ensure the PC is always up to date and not interrupting users with updates. + +Use one of the following methods to configure Windows Update: - Group Policy: Set **Computer Configuration > Administrative Templates > Windows Components > Windows Update > Configure Automatic Updates** to `4` and check **Install during automatic maintenance**. - MDM: Set **Update/AllowAutoUpdate** to `4`. @@ -43,21 +45,31 @@ While shared PC mode does not configure Windows Update itself, it is strongly re ###App behavior -Apps can take advantage of shared PC mode by changing their app behavior to align with temporary use scenarios. For example, an app might only download content on demand on a device in shared PC mode, or might skip first run experiences. For information on how an app can query for shared PC mode, see [SharedModeSettings class](https://msdn.microsoft.com/en-us/library/windows/apps/windows.system.profile.sharedmodesettings.aspx). +Apps can take advantage of shared PC mode with the following three APIs: + +- [IsEnabled](https://docs.microsoft.com/uwp/api/windows.system.profile.sharedmodesettings) - This informs apps when the PC has been configured for shared use scenarios. For example, an app might only download content on demand on a device in shared PC mode, or might skip first run experiences. +- [ShouldAvoidLocalStorage](https://docs.microsoft.com/uwp/api/windows.system.profile.sharedmodesettings) - This informs apps when the PC has been configured to not allow the user to save to the local storage of the PC. Instead, only cloud save locations should be offered by the app or saved automatically by the app. +- [IsEducationEnvironment](https://docs.microsoft.com/uwp/api/windows.system.profile.educationsettings) - This informs apps when the PC is used in an education environment. Apps may want to handle telemetry differently or hide advertising functionality. + ###Customization Shared PC mode exposes a set of customizations to tailor the behavior to your requirements. These customizations are the options that you'll set either using MDM or a provisioning package as explained in [Configuring shared PC mode on Windows](#configuring-shared-pc-mode-on-windows). The options are listed in the following table. | Setting | Value | |:---|:---| -| EnableSharedPCMode | Set as **True**. If this is not set to **True**, shared PC mode is not turned on and none of the other settings apply. Some of the remaining settings in **SharedPC** are optional, but we strongly recommend that you also set `EnableAccountManager` to **True**. | -| AccountManagement: AccountModel | This option controls how users can sign-in on the PC. Choosing domain-joined will enable any user in the domain to sign-in. Specifying the guest option will add the **Start without an account** option to the sign-in screen and enable anonymous guest access to the PC.
- **Only guest** allows anyone to use the PC as a local standard (non-admin) account.
- **Domain-joined only** allows users to sign in with an Active Directory or Azure AD account.
- **Domain-joined and guest** allows users to sign in with an Active Directory, Azure AD, or local standard account. | -| AccountManagement: DeletionPolicy | - **Delete immediately** will delete the account on sign-out.
- **Delete at disk space threshold** will start deleting accounts when available disk space falls below the threshold you set for **DiskLevelDeletion**, and it will stop deleting accounts when the available disk space reaches the threshold you set for **DiskLevelCaching**. Accounts are deleted in order of oldest accessed to most recently accessed.

Example: The caching number is 50 and the deletion number is 25. Accounts will be cached while the free disk space is above 25%. When the free disk space is less than 25% (the deletion number) at a maintenance period, accounts will be deleted (oldest last used first) until the free disk space is above 50% (the caching number). Accounts will be deleted immediately at sign off of an account if free space is under the deletion threshold and disk space is very low, regardless if the PC is actively in use or not. | +| EnableSharedPCMode | Set as **True**. If this is not set to **True**, shared PC mode is not turned on and none of the other settings apply. This setting controls this API: [IsEnabled](https://docs.microsoft.com/uwp/api/windows.system.profile.sharedmodesettings)

Some of the remaining settings in **SharedPC** are optional, but we strongly recommend that you also set `EnableAccountManager` to **True**. | +| AccountManagement: AccountModel | This option controls how users can sign-in on the PC. Choosing domain-joined will enable any user in the domain to sign-in. Specifying the guest option will add the **Guest** option to the sign-in screen and enable anonymous guest access to the PC.
- **Only guest** allows anyone to use the PC as a local standard (non-admin) account.
- **Domain-joined only** allows users to sign in with an Active Directory or Azure AD account.
- **Domain-joined and guest** allows users to sign in with an Active Directory, Azure AD, or local standard account. | +| AccountManagement: DeletionPolicy | - **Delete immediately** will delete the account on sign-out.
- **Delete at disk space threshold** will start deleting accounts when available disk space falls below the threshold you set for **DiskLevelDeletion**, and it will stop deleting accounts when the available disk space reaches the threshold you set for **DiskLevelCaching**. Accounts are deleted in order of oldest accessed to most recently accessed.

Example: The caching number is 50 and the deletion number is 25. Accounts will be cached while the free disk space is above 25%. When the free disk space is less than 25% (the deletion number) at a maintenance period, accounts will be deleted (oldest last used first) until the free disk space is above 50% (the caching number). Accounts will be deleted immediately at sign off of an account if free space is under the deletion threshold and disk space is very low, regardless if the PC is actively in use or not.
- **Delete at disk space threshold and inactive threshold** will apply the same disk space checks as noted above, but also delete accounts if they have not signed in within the number of days specified by **InactiveThreshold** | | AccountManagement: DiskLevelCaching | If you set **DeletionPolicy** to **Delete at disk space threshold**, set the percent of total disk space to be used as the disk space threshold for account caching. | | AccountManagement: DiskLevelDeletion | If you set **DeletionPolicy** to **Delete at disk space threshold**, set the percent of total disk space to be used as the disk space threshold for account deletion. | +| AccountManagement: InactiveThreshold | If you set **DeletionPolicy** to **Delete at disk space threshold and inactive threshold**, set the number of days after which an account that has not signed in will be deleted. | | AccountManagement: EnableAccountManager | Set as **True** to enable automatic account management. If this is not set to true, no automatic account management will be done. | +| AccountManagement: KioskModeAUMID | Set an Application User Model ID (AUMID) to enable the kiosk account on the sign-in screen. A new account will be created and will use assigned access to only run the app specified by the AUMID. Note that the app must be installed on the PC. Set the name of the account using **KioskModeUserTileDisplayText**, or a default name will be used. [Find the Application User Model ID of an installed app](https://msdn.microsoft.com/library/dn449300.aspx) | +| AccountManagement: KioskModeUserTileDisplayText | Sets the display text on the kiosk account if **KioskModeAUMID** has been set. | | Customization: MaintenanceStartTime | By default, the maintenance start time (which is when automatic maintenance tasks run, such as Windows Update) is midnight. You can adjust the start time in this setting by entering a new start time in minutes from midnight. For example, if you want maintenance to begin at 2 AM, enter `120` as the value. | -| Customization: SetEduPolicies | Set to **True** for PCs that will be used in a school. When **SetEduPolicies** is **True**, the following additional settings are applied:
- Local storage locations are restricted. Users can only save files to the cloud.
- Custom Start and taskbar layouts are set.\*
- A custom sign-in screen background image is set.\*
- Additional educational policies are applied (see full list below).

\*Only applies to Windows 10 Pro Education, Enterprise, and Education | +| Customization: MaxPageFileSizeMB | Adjusts the maximum page file size in MB. This can be used to fine-tune page file behavior, especially on low end PCs. | +| Customization: RestrictLocalStorage | Set as **True** to restrict the user from saving or viewing local storage when using File Explorer. This setting controls this API: [ShouldAvoidLocalStorage](https://docs.microsoft.com/uwp/api/windows.system.profile.sharedmodesettings) | +| Customization: SetEduPolicies | Set to **True** for PCs that will be used in a school. This setting controls this API: [IsEducationEnvironment](https://docs.microsoft.com/uwp/api/windows.system.profile.educationsettings) | | Customization: SetPowerPolicies | When set as **True**:
- Prevents users from changing power settings
- Turns off hibernate
- Overrides all power state transitions to sleep (e.g. lid close) | | Customization: SignInOnResume | This setting specifies if the user is required to sign in with a password when the PC wakes from sleep. | | Customization: SleepTimeout | Specifies all timeouts for when the PC should sleep. Enter the amount of idle time in seconds. If you don't set sleep timeout, the default of 1 hour applies. | @@ -73,6 +85,7 @@ You can configure Windows to be in shared PC mode in a couple different ways: ![Shared PC settings in ICD](images/icd-adv-shared-pc.png) +- WMI bridge: Environments that use Group Policy can use the WMI bridge to configure the [SharedPC CSP](https://msdn.microsoft.com/library/windows/hardware/mt723294.aspx). ### Create a provisioning package for shared use @@ -86,7 +99,7 @@ You can configure Windows to be in shared PC mode in a couple different ways: 4. Select **All Windows desktop editions**, and click **Next**. -5. Click **Finish**. Your project opens in Windows ICD. +5. Click **Finish**. Your project opens in Windows Configuration Designer. 6. Go to **Runtime settings** > **SharedPC**. [Select the desired settings for shared PC mode.](#customization) @@ -104,7 +117,7 @@ You can configure Windows to be in shared PC mode in a couple different ways: > [!IMPORTANT]   > We recommend that you include a trusted provisioning certificate in your provisioning package. When the package is applied to a device, the certificate is added to the system store and any package signed with that certificate thereafter can be applied silently.   -12. Click **Next** to specify the output location where you want the provisioning package to go once it's built. By default, Windows ICD uses the project folder as the output location. +12. Click **Next** to specify the output location where you want the provisioning package to go once it's built. By default, Windows Configuration Designer uses the project folder as the output location. Optionally, you can click **Browse** to change the default output location. 13. Click **Next**. 14. Click **Build** to start building the package. The project information is displayed in the build page and the progress bar indicates the build status. @@ -127,45 +140,20 @@ You can configure Windows to be in shared PC mode in a couple different ways: You can apply the provisioning package to a PC during initial setup or to a PC that has already been set up. **During initial setup** -1. Start with a computer on the first-run setup screen. If the PC has gone past this screen, reset the PC to start over. To reset the PC, go to **Settings** > **Update & security** > **Recovery** > **Reset this PC**. + +1. Start with a PC on the setup screen. ![The first screen to set up a new PC](images/oobe.jpg) -2. Insert the USB drive and press the Windows key five times. Windows Setup will recognize the drive and ask if you want to set up the device. If there is only one provisioning package on the USB drive, you don't need to press the Windows key five times, Windows will automatically ask you if you want to set up the device. Select **Set up**. +2. Insert the USB drive. If nothing happens when you insert the USB drive, press the Windows key five times. + + - If there is only one provisioning package on the USB drive, the provisioning package is applied. + + - If there is more than one provisioning package on the USB drive, the **Set up device?** message displays. Click **Set up**, and select the provisioning package that you want to install. ![Set up device?](images/setupmsg.jpg) -3. The next screen asks you to select a provisioning source. Select **Removable Media** and tap **Next**. - - ![Provision this device](images/prov.jpg) - -4. Select the provisioning package (\*.ppkg) that you want to apply, and tap **Next**. - - ![Choose a package](images/choose-package.png) - -5. Select **Yes, add it**. - - ![Do you trust this package?](images/trust-package.png) - -6. Read and accept the Microsoft Software License Terms. - - ![Sign in](images/license-terms.png) - -7. Select **Use Express settings**. - - ![Get going fast](images/express-settings.png) - -8. If the PC doesn't use a volume license, you'll see the **Who owns this PC?** screen. Select **My work or school owns it** and tap **Next**. - - ![Who owns this PC?](images/who-owns-pc.png) - -9. On the **Choose how you'll connect** screen, select **Join Azure AD** or **Join a domain** and tap **Next**. - - ![Connect to Azure AD](images/connect-aad.png) - -10. Sign in with your domain, Azure AD, or Office 365 account and password. When you see the progress ring, you can remove the USB drive. - - ![Sign in](images/sign-in-prov.png) +3. Complete the setup process. **After setup** @@ -180,11 +168,11 @@ On a desktop computer, navigate to **Settings** > **Accounts** > **Work ac ## Guidance for accounts on shared PCs * We recommend no local admin accounts on the PC to improve the reliability and security of the PC. -* When a PC is set up in shared PC mode, accounts will be cached automatically until disk space is low. Then, accounts will be deleted to reclaim disk space. This account managment happens automatically. Both Azure AD and Active Directory domain accounts are managed in this way. Any accounts created through **Start without an account** will also be deleted automatically at sign out. +* When a PC is set up in shared PC mode with the default deletion policy, accounts will be cached automatically until disk space is low. Then, accounts will be deleted to reclaim disk space. This account managment happens automatically. Both Azure AD and Active Directory domain accounts are managed in this way. Any accounts created through **Guest** and **Kiosk** will also be deleted automatically at sign out. * On a Windows PC joined to Azure Active Directory: * By default, the account that joined the PC to Azure AD will have an admin account on that PC. Global administrators for the Azure AD domain will also have admin accounts on the PC. * With Azure AD Premium, you can specify which accounts have admin accounts on a PC using the **Additional administrators on Azure AD Joined devices** setting on the Azure portal. -* Local accounts that already exist on a PC won’t be deleted when turning on shared PC mode. New local accounts that are created using **Settings > Accounts > Other people > Add someone else to this PC** after shared PC mode is turned on won't be deleted. However, any new local accounts created by the **Start without an account** selection on the sign-in screen (if enabled) will automatically be deleted at sign-out. +* Local accounts that already exist on a PC won’t be deleted when turning on shared PC mode. New local accounts that are created using **Settings > Accounts > Other people > Add someone else to this PC** after shared PC mode is turned on won't be deleted. However, any new local accounts created by the **Guest** and **Kiosk** options on the sign-in screen (if enabled) will automatically be deleted at sign-out. * If admin accounts are necessary on the PC * Ensure the PC is joined to a domain that enables accounts to be signed on as admin, or * Create admin accounts before setting up shared PC mode, or @@ -209,7 +197,7 @@ On a desktop computer, navigate to **Settings** > **Accounts** > **Work ac Shared PC mode sets local group policies to configure the device. Some of these are configurable using the shared pc mode options. > [!IMPORTANT] -> It is not recommended to set additional policies on PCs configured for **Shared PC Mode**. The shared PC mode has been optimized to be fast and reliable over time with minimal to no manual maintenance required. +> It is not recommended to set additional policies on PCs configured for **Shared PC Mode**. The shared PC mode has been optimized to be fast and reliable over time with minimal to no manual maintenance required. @@ -240,6 +228,8 @@ Shared PC mode sets local group policies to configure the device. Some of these + + @@ -252,8 +242,8 @@ Shared PC mode sets local group policies to configure the device. Some of these - - + + @@ -264,17 +254,19 @@ Shared PC mode sets local group policies to configure the device. Some of these + - - - - - + + + + + + diff --git a/windows/configure/start-secondary-tiles.md b/windows/configure/start-secondary-tiles.md index 4e9328e91b..2fb633a235 100644 --- a/windows/configure/start-secondary-tiles.md +++ b/windows/configure/start-secondary-tiles.md @@ -82,7 +82,7 @@ In addition to the `./User/Vendor/MSFT/Policy/Config/Start/StartLayout` setting, ### Using a provisioning package - + #### Prepare the Start layout and Edge assets XML files The **export-StartLayout** and **export-StartLayoutEdgeAssets** cmdlets produce XML files. Because Windows Configuration Designer produces a customizations.xml file that contains the configuration settings, adding the Start layout and Edge assets sections to the customizations.xml file directly would result in an XML file embedded in an XML file. Before you add the Start layout and Edge assets sections to the customizations.xml file, you must replace the markup characters in your layout.xml with escape characters. diff --git a/windows/keep-secure/TOC.md b/windows/keep-secure/TOC.md index f0c4a89cb2..38d5a79370 100644 --- a/windows/keep-secure/TOC.md +++ b/windows/keep-secure/TOC.md @@ -21,13 +21,14 @@ #### [Deploy code integrity policies: steps](deploy-code-integrity-policies-steps.md) #### [Deploy catalog files to support code integrity policies](deploy-catalog-files-to-support-code-integrity-policies.md) ### [Deploy Device Guard: enable virtualization-based security](deploy-device-guard-enable-virtualization-based-security.md) +## [Mitigate threats by using Windows 10 security features](overview-of-threat-mitigations-in-windows-10.md) ## [Protect derived domain credentials with Credential Guard](credential-guard.md) ### [How Credential Guard works](credential-guard-how-it-works.md) ### [Credential Guard Requirements](credential-guard-requirements.md) ### [Manage Credential Guard](credential-guard-manage.md) -### [Scenarios not protected by Credential Guard](credential-guard-not-protected-scenarios.md) +### [Credential Guard protection limits](credential-guard-protection-limits.md) ### [Considerations when using Credential Guard](credential-guard-considerations.md) -### [Scripts for Certificate Authority Issuance Policies](credential-guard-scripts.md) +### [Credential Guard: Additional mitigations](additional-mitigations.md) ## [Protect Remote Desktop credentials with Remote Credential Guard](remote-credential-guard.md) ## [Protect your enterprise data using Windows Information Protection (WIP)](protect-enterprise-data-using-wip.md) ### [Create a Windows Information Protection (WIP) policy](overview-create-wip-policy.md) @@ -45,7 +46,7 @@ #### [Enlightened apps for use with Windows Information Protection (WIP)](enlightened-microsoft-apps-and-wip.md) #### [Unenlightened and enlightened app behavior while using Windows Information Protection (WIP)](app-behavior-with-wip.md) #### [Recommended Enterprise Cloud Resources and Neutral Resources network settings with Windows Information Protection (WIP)](recommended-network-definitions-for-wip.md) -#### [Using Outlook Web Access with Windows Information Protection (WIP)](using-owa-with-wip.md) +#### [Using Outlook on the web with Windows Information Protection (WIP)](using-owa-with-wip.md) ## [Windows Defender SmartScreen](windows-defender-smartscreen-overview.md) ### [Available Windows Defender SmartScreen Group Policy and mobile device management (MDM) settings](windows-defender-smartscreen-available-settings.md) ### [Set up and use Windows Defender SmartScreen on individual devices](windows-defender-smartscreen-set-individual-device.md) diff --git a/windows/keep-secure/additional-mitigations.md b/windows/keep-secure/additional-mitigations.md new file mode 100644 index 0000000000..ba119db5fa --- /dev/null +++ b/windows/keep-secure/additional-mitigations.md @@ -0,0 +1,135 @@ +--- +title: Scripts for Certificate Issuance Policies in Credential Guard (Windows 10) +description: Scripts listed in this topic for obtaining the available issuance policies on the certificate authority for Credential Guard on Windows 10. +ms.prod: w10 +ms.mktglfcycl: explore +ms.sitesec: library +ms.pagetype: security +localizationpriority: high +author: brianlic-msft +--- + +## Additional mitigations + +Credential Guard can provide mitigations against attacks on derived credentials and prevent the use of stolen credentials elsewhere. However, PCs can still be vulnerable to certain attacks, even if the derived credentials are protected by Credential Guard. These attacks can include abusing privileges and use of derived credentials directly from a compromised device, reusing previously stolen credentials prior to Device Guard, and abuse of management tools and weak application configurations. Because of this, additional mitigations also must be deployed to make the domain environment more robust. + +### Restricting domain users to specific domain-joined devices + +Credential theft attacks allow the attacker to steal secrets from one device and use them from another device. If a user can sign on to multiple devices then any device could be used to steal credentials. How do you ensure that users only sign on using devices that have Credential Guard enabled? By deploying authentication policies that restrict them to specific domain-joined devices that have been configured with Credential Guard. For the domain controller to know what device a user is signing on from, Kerberos armoring must be used. + +#### Kerberos armoring + +Kerberos armoring is part of RFC 6113. When a device supports Kerberos armoring, its TGT is used to protect the user's proof of possession which can mitigate offline dictionary attacks. Kerberos armoring also provides the additional benefit of signed KDC errors this mitigates tampering which can result in things such as downgrade attacks. + +**To enable Kerberos armoring for restricting domain users to specific domain-joined devices** + +- Users need to be in domains that are running Windows Server 2012 R2 or higher +- All the domain controllers in these domains must be configured to support Kerberos armoring. Set the **KDC support for claims, compound authentication, and Kerberos armoring** Group Policy setting to either **Supported** or **Always provide claims**. +- All the devices with Credential Guard that the users will be restricted to must be configured to support Kerberos armoring. Enable the **Kerberos client support for claims, compound authentication and Kerberos armoring** Group Policy settings under **Computer Configuration** -> **Administrative Templates** -> **System** -> **Kerberos**. + +#### Protecting domain-joined device secrets + +Since domain-joined devices also use shared secrets for authentication, attackers can steal those secrets as well. By deploying device certificates with Credential Guard, the private key can be protected. Then authentication policies can require that users sign on devices that authenticate using those certificates. This prevents shared secrets stolen from the device to be used with stolen user credentials to sign on as the user. + +Domain-joined device certificate authentication has the following requirements: +- Devices' accounts are in Windows Server 2012 domain functional level or higher. +- All domain controllers in those domains have KDC certificates which satisfy strict KDC validation certificate requirements: + - KDC EKU present + - DNS domain name matches the DNSName field of the SubjectAltName (SAN) extension +- Windows 10 devices have the CA issuing the domain controller certificates in the enterprise store. +- A process is established to ensure the identity and trustworthiness of the device in a similar manner as you would establish the identity and trustworthiness of a user before issuing them a smartcard. + +##### Deploying domain-joined device certificates + +To guarantee that certificates with the required issuance policy are only installed on the devices these users must use, they must be deployed manually on each device. The same security procedures used for issuing smart cards to users should be applied to device certificates. + +For example, let's say you wanted to use the High Assurance policy only on these devices. Using a Windows Server Enterprise certificate authority, you would create a new template. + +**Creating a new certificate template** + +1. From the Certificate Manager console, right-click **Certificate Templates**, and then click **Manage.** +2. Right-click **Workstation Authentication**, and then click **Duplicate Template**. +3. Right-click the new template, and then click **Properties**. +4. On the **Extensions** tab, click **Application Policies**, and then click **Edit**. +5. Click **Client Authentication**, and then click **Remove**. +6. Add the ID-PKInit-KPClientAuth EKU. Click **Add**, click **New**, and then specify the following values: + - Name: Kerberos Client Auth + - Object Identifier: 1.3.6.1.5.2.3.4 +7. On the **Extensions** tab, click **Issuance Policies**, and then click **Edit**. +8. Under **Issuance Policies**, click**High Assurance**. +9. On the **Subject name** tab, clear the **DNS name** check box, and then select the **User Principal Name (UPN)** check box. + +Then on the devices that are running Credential Guard, enroll the devices using the certificate you just created. + +**Enrolling devices in a certificate** + +Run the following command: +``` syntax +CertReq -EnrollCredGuardCert MachineAuthentication +``` + +> [!NOTE] +> You must restart the device after enrolling the machine authentication certificate. +  +##### How a certificate issuance policy can be used for access control + +Beginning with the Windows Server 2008 R2 domain functional level, domain controllers support for authentication mechanism assurance provides a way to map certificate issuance policy OIDs to universal security groups. Windows Server 2012 domain controllers with claim support can map them to claims. To learn more about authentication mechanism assurance, see [Authentication Mechanism Assurance for AD DS in Windows Server 2008 R2 Step-by-Step Guide](https://technet.microsoft.com/en-us/library/dd378897(v=ws.10).aspx) on TechNet. + +**To see the issuance policies available** + +- The [get-IssuancePolicy.ps1](#bkmk-getscript) shows all of the issuance policies that are available on the certificate authority. + From a Windows PowerShell command prompt, run the following command: + + ``` syntax + .\get-IssuancePolicy.ps1 –LinkedToGroup:All + ``` + +**To link an issuance policy to a universal security group** + +- The [set-IssuancePolicyToGroupLink.ps1](#bkmk-setscript) creates a Universal security group, creates an organizational unit, and links the issuance policy to that Universal security group. + From a Windows PowerShell command prompt, run the following command: + + ``` syntax + .\set-IssuancePolicyToGroupLink.ps1 –IssuancePolicyName:"" –groupOU:"" –groupName:”" + ``` + +#### Restricting user sign on + +So we now have completed the following: + +- Created a special certificate issuance policy to identify devices that meet the deployment criteria required for the user to be able to sign on +- Mapped that policy to a universal security group or claim +- Provided a way for domain controllers to get the device authorization data during user sign on using Kerberos armoring. Now what is left to do is to configure the access check on the domain controllers. This is done using authentication policies. + +Authentication policies have the following requirements: +- User accounts are in a Windows Server 2012 domain functional level or higher domain. + +**Creating an authentication policy restricting users to the specific universal security group** + +1. Open Active Directory Administrative Center. +2. Click **Authentication**, click **New**, and then click **Authentication Policy**. +3. In the **Display name** box, enter a name for this authentication policy. +4. Under the **Accounts** heading, click **Add**. +5. In the **Select Users, Computers, or Service Accounts** dialog box, type the name of the user account you wish to restrict, and then click **OK**. +6. Under the **User Sign On** heading, click the **Edit** button. +7. Click **Add a condition**. +8. In the **Edit Access Control Conditions** box, ensure that it reads **User** > **Group** > **Member of each** > **Value**, and then click **Add items**. +9. In the **Select Users, Computers, or Service Accounts** dialog box, type the name of the universal security group that you created with the set-IssuancePolicyToGroupLink script, and then click **OK**. +10. Click **OK** to close the **Edit Access Control Conditions** box. +11. Click **OK** to create the authentication policy. +12. Close Active Directory Administrative Center. + +> [!NOTE] +> When the authentication policy enforces policy restrictions, users will not be able to sign on using devices that do not have a certificate with the appropriate issuance policy deployed. This applies to both local and remote sign on scenarios. Therefore, it is strongly recommended to first only audit policy restrictions to ensure you don't have unexpected failures. + +##### Discovering authentication failures due to authentication policies + +To make tracking authentication failures due to authentication policies easier, an operational log exists with just those events. To enable the logs on the domain controllers, in Event Viewer, navigate to **Applications and Services Logs\\Microsoft\\Windows\\Authentication, right-click AuthenticationPolicyFailures-DomainController**, and then click **Enable Log**. + +To learn more about authentication policy events, see [Authentication Policies and Authentication Policy Silos](https://technet.microsoft.com/en-us/library/dn486813(v=ws.11).aspx). + +## See also + +**Deep Dive into Credential Guard: Related videos** + +[Protecting privileged users with Credential Guard](https://mva.microsoft.com/en-us/training-courses/deep-dive-into-credential-guard-16651?l=JNbjYMJyC_8104300474) diff --git a/windows/keep-secure/bitlocker-frequently-asked-questions.md b/windows/keep-secure/bitlocker-frequently-asked-questions.md index 3e39f7390e..e0f1bc14e9 100644 --- a/windows/keep-secure/bitlocker-frequently-asked-questions.md +++ b/windows/keep-secure/bitlocker-frequently-asked-questions.md @@ -85,9 +85,9 @@ You should configure the startup options of your computer to have the hard disk ## Upgrading -### Can I upgrade my Windows 7 or Windows 8 computer to Windows 10 with BitLocker enabled? +### Can I upgrade to Windows 10 with BitLocker enabled? -Yes. Open the **BitLocker Drive Encryption** Control Panel, click **Manage BitLocker**, and then and click **Suspend**. Suspending protection does not decrypt the drive; it disables the authentication mechanisms used by BitLocker and uses a clear key on the drive to enable access. After the upgrade has completed, open Windows Explorer, right-click the drive, and then click **Resume Protection**. This reapplies the BitLocker authentication methods and deletes the clear key. +Yes. ### What is the difference between suspending and decrypting BitLocker? @@ -97,44 +97,13 @@ Yes. Open the **BitLocker Drive Encryption** Control Panel, click **Manage BitLo ### Do I have to decrypt my BitLocker-protected drive to download and install system updates and upgrades? -The following table lists what action you need to take before you perform an upgrade or update installation. +No user action is required for BitLocker in order to apply updates from Microsoft, including [Windows quality updates and feature updates](https://technet.microsoft.com/itpro/windows/manage/waas-quick-start). +Users need to suspend BitLocker for Non-Microsoft software updates, such as: + +- Computer manufacturer firmware updates +- TPM firmware updates +- Non-Microsoft application updates that modify boot components -

Admin Templates>System>Power Management>Video and Display Settings

Turn off the display (plugged in)

*SleepTimeout*

SetPowerPolicies=True

Turn off the display (on battery

*SleepTimeout*

SetPowerPolicies=True

Admin Templates>System>Power Management>Energy Saver Settings

Energy Saver Battery Threshold (on battery)70SetPowerPolicies=True

Admin Templates>System>Logon

Show first sign-in animation

Disabled

Always

Hide entry points for Fast User Switching

Enabled

Always

Admin Templates>System>User Profiles

Turn off the advertising ID

Enabled

SetEduPolicies=True

Admin Templates>Windows Components

Do not show Windows Tips

*Only on Pro, Enterprise, Pro Education, and Education*

Enabled

SetEduPolicies=True

Turn off Microsoft consumer experiences

*Only on Pro, Enterprise, Pro Education, and Education*

Enabled

SetEduPolicies=True

Do not show Windows Tips

Enabled

SetEduPolicies=True

Turn off Microsoft consumer experiences

Enabled

SetEduPolicies=True

Microsoft Passport for Work

Disabled

Always

Prevent the usage of OneDrive for file storage

Enabled

Always

Admin Templates>Windows Components>Biometrics

Toggle user control over Insider builds

Disabled

Always

Disable pre-release features or settings

Disabled

Always

Do not show feedback notifications

Enabled

Always

Allow TelemetryBasic, 0SetEduPolicies=True

Admin Templates>Windows Components>File Explorer

Show lock in the user tile menu

Disabled

Always

Admin Templates>Windows Components>Maintenance Scheduler

Automatic Maintenance Activation Boundary

*MaintenanceStartTime*

Always

Automatic Maintenance Random Delay

Enabled, 2 hours

Always

Automatic Maintenance WakeUp Policy

Enabled

Always

Admin Templates>Windows Components>Microsoft Edge

Open a new tab with an empty tab

Disabled

SetEduPolicies=True

Configure corporate home pages

Enabled, about:blank

SetEduPolicies=True

Admin Templates>Windows Components>Search

Allow Cortana

Disabled

SetEduPolicies=True

Admin Templates>Windows Components>Windows Hello for Business

Use phone sign-in

Disabled

Always

Use Windows Hello for Business

Disabled

Always

Use biometrics

Disabled

Always

Admin Templates>Windows Components>OneDrive

Prevent the usage of OneDrive for file storage

Enabled

Always

Windows Settings>Security Settings>Local Policies>Security Options

Interactive logon: Do not display last user name

Enabled, Disabled when account model is only guest

Always

---- - - - - - - - - - - - - - - - - - - - - - - - - -
Type of updateAction

Windows Anytime Upgrade

Decrypt

[Feature updates](https://technet.microsoft.com/itpro/windows/manage/waas-quick-start) for Windows 10 (example: Windows 10, version 1703)

Suspend

Non-Microsoft software updates, such as:

-
    -

  • Computer manufacturer firmware updates

    • -

  • TPM firmware updates

    • -

  • Non-Microsoft application updates that modify boot components

    • -

Suspend

Software and [quality updates](https://technet.microsoft.com/itpro/windows/manage/waas-quick-start) from Windows Update

Nothing

-  > **Note:**  If you have suspended BitLocker, you can resume BitLocker protection after you have installed the upgrade or update. Upon resuming protection, BitLocker will reseal the encryption key to the new values of the measured components that changed as a part of the upgrade or update. If these types of upgrades or updates are applied without suspending BitLocker, your computer will enter recovery mode when restarting and will require a recovery key or password to access the computer.   ## Deployment and administration diff --git a/windows/keep-secure/bitlocker-recovery-guide-plan.md b/windows/keep-secure/bitlocker-recovery-guide-plan.md index 1005d019ad..557719c15c 100644 --- a/windows/keep-secure/bitlocker-recovery-guide-plan.md +++ b/windows/keep-secure/bitlocker-recovery-guide-plan.md @@ -44,8 +44,8 @@ BitLocker recovery is the process by which you can restore access to a BitLocker The following list provides examples of specific events that will cause BitLocker to enter recovery mode when attempting to start the operating system drive: -- On PCs that use either BitLocker or Device Encryption when an attack is detected the device will immediately reboot and enter into BitLocker recovery mode. To take advantage of this functionality Administrators can set the **Interactive logon: Machine account lockout threshold** Group Policy setting located in **\\Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Security Options** in the Local Group Policy Editor, or use the **MaxFailedPasswordAttempts** policy of [Exchange ActiveSync](http://technet.microsoft.com/library/aa998357.aspx) (also configurable through [Windows Intune](http://technet.microsoft.com/library/jj733621.aspx)), to limit the number of failed password attempts before the device goes into Device Lockout. -- Changing the boot order to boot another drive in advance of the hard drive. +- On PCs that use either BitLocker or Device Encryption, when an attack is detected, the device will immediately reboot and enter into BitLocker recovery mode. To take advantage of this functionality Administrators can set the **Interactive logon: Machine account lockout threshold** Group Policy setting located in **\\Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Security Options** in the Local Group Policy Editor, or use the **MaxFailedPasswordAttempts** policy of [Exchange ActiveSync](http://technet.microsoft.com/library/aa998357.aspx) (also configurable through [Windows Intune](http://technet.microsoft.com/library/jj733621.aspx)), to limit the number of failed password attempts before the device goes into Device Lockout. +- On devices with TPM 1.2, changing the BIOS or firmware boot device order causes BitLocker recovery. However, devices with TPM 2.0 do not start BitLocker recovery in this case. TPM 2.0 does not consider a firmware change of boot device order as a security threat because the OS Boot Loader is not compromised. - Having the CD or DVD drive before the hard drive in the BIOS boot order and then inserting or removing a CD or DVD. - Failing to boot from a network drive before booting from the hard drive. - Docking or undocking a portable computer. In some instances (depending on the computer manufacturer and the BIOS), the docking condition of the portable computer is part of the system measurement and must be consistent to validate the system status and unlock BitLocker. This means that if a portable computer is connected to its docking station when BitLocker is turned on, then it might also need to be connected to the docking station when it is unlocked. Conversely, if a portable computer is not connected to its docking station when BitLocker is turned on, then it might need to be disconnected from the docking station when it is unlocked. diff --git a/windows/keep-secure/change-history-for-keep-windows-10-secure.md b/windows/keep-secure/change-history-for-keep-windows-10-secure.md index 050d58019e..fc22dd555a 100644 --- a/windows/keep-secure/change-history-for-keep-windows-10-secure.md +++ b/windows/keep-secure/change-history-for-keep-windows-10-secure.md @@ -25,6 +25,7 @@ This topic lists new and updated topics in the [Keep Windows 10 secure](index.md |[Windows Defender SmartScreen overview](windows-defender-smartscreen-overview.md)|New | |[Available Windows Defender SmartScreen Group Policy and mobile device management (MDM) settings](windows-defender-smartscreen-available-settings.md)|New | |[Use Windows Defender Security Center to set Windows Defender SmartScreen for individual devices](windows-defender-smartscreen-set-individual-device.md)|New | +|[Overview of threat mitigations in Windows 10](overview-of-threat-mitigations-in-windows-10.md) | Reorganized from existing content, to provide a better overview of threat mitigations. Explains how mitigations in the Enhanced Mitigation Experience Toolkit (EMET) relate to those in Windows 10. | ## January 2017 |New or changed topic |Description | @@ -32,7 +33,7 @@ This topic lists new and updated topics in the [Keep Windows 10 secure](index.md |[Determine the Enterprise Context of an app running in Windows Information Protection (WIP)](wip-app-enterprise-context.md) |New | |[Limitations while using Windows Information Protection (WIP)](limitations-with-wip.md) |Updated to include info about USB drives and Azure RMS (Windows Insider Program only) and to add more info about Work Folders and Offline files. | |[Recommended Enterprise Cloud Resources and Neutral Resources network settings with Windows Information Protection (WIP)](recommended-network-definitions-for-wip.md) |New | -|[Using Outlook Web Access with Windows Information Protection (WIP)](using-owa-with-wip.md) |New | +|[Using Outlook on the web with Windows Information Protection (WIP)](using-owa-with-wip.md) |New | | Microsoft Passport guide | Content merged into [Windows Hello for Business](hello-identity-verification.md) topics | ## December 2016 diff --git a/windows/keep-secure/credential-guard-considerations.md b/windows/keep-secure/credential-guard-considerations.md index c2bc39226d..0adc21dd7f 100644 --- a/windows/keep-secure/credential-guard-considerations.md +++ b/windows/keep-secure/credential-guard-considerations.md @@ -1,4 +1,4 @@ ---- +--- title: Considerations when using Credential Guard (Windows 10) description: Considerations and recommendations for certain scenarios when using Credential Guard in Windows 10. ms.prod: w10 @@ -17,19 +17,8 @@ author: brianlic-msft Prefer video? See [Credentials Protected by Credential Guard](https://mva.microsoft.com/en-us/training-courses/deep-dive-into-credential-guard-16651?l=mD3geLJyC_8304300474) in the Deep Dive into Credential Guard video series. - -- If Credential Guard is enabled on a device after it's joined to a domain, the user and device secrets may already be compromised. We recommend that Credential Guard is enabled before the PC is joined to a domain. -- You should perform regular reviews of the PCs that have Credential Guard enabled. This can be done with security audit policies or WMI queries. Here's a list of WinInit event IDs to look for: - - **Event ID 13** Credential Guard (LsaIso.exe) was started and will protect LSA credentials. - - **Event ID 14** Credential Guard (LsaIso.exe) configuration: 0x1, 0 - - The first variable: 0x1 means Credential Guard is configured to run. 0x0 means it’s not configured to run. - - The second variable: 0 means it’s configured to run in protect mode. 1 means it's configured to run in test mode. This variable should always be 0. - - **Event ID 15** Credential Guard (LsaIso.exe) is configured but the secure kernel is not running; continuing without Credential Guard. - - **Event ID 16** Credential Guard (LsaIso.exe) failed to launch: \[error code\] - - **Event ID 17** Error reading Credential Guard (LsaIso.exe) UEFI configuration: \[error code\] - You can also verify that TPM is being used for key protection by checking the following event in the **Microsoft** -> **Windows** -> **Kernel-Boot** event source. If you are running with a TPM, the TPM PCR mask value will be something other than 0. - - **Event ID 51** VSM Master Encryption Key Provisioning. Using cached copy status: 0x0. Unsealing cached copy status: 0x1. New key generation status: 0x1. Sealing status: 0x1. TPM PCR mask: 0x0. -- Passwords are still weak so we recommend that your organization deploy Credential Guard and move away from passwords and to other authentication methods, such as physical smart cards, virtual smart cards, or Windows Hello for Business. + +- Passwords are still weak so we recommend that your organization deploy Credential Guard and move away from passwords and to other authentication methods, such as physical smart cards, virtual smart cards, or Windows Hello for Business. - Some 3rd party Security Support Providers (SSPs and APs) might not be compatible with Credential Guard. Credential Guard does not allow 3rd party SSPs to ask for password hashes from LSA. However, SSPs and APs still get notified of the password when a user logs on and/or changes their password. Any use of undocumented APIs within custom SSPs and APs are not supported. We recommend that custom implementations of SSPs/APs are tested against Credential Guard to ensure that the SSPs and APs do not depend on any undocumented or unsupported behaviors. For example, using the KerbQuerySupplementalCredentialsMessage API is not supported. You should not replace the NTLM or Kerberos SSPs with custom SSPs and APs. For more info, see [Restrictions around Registering and Installing a Security Package](http://msdn.microsoft.com/library/windows/desktop/dn865014.aspx) on MSDN. - As the depth and breadth of protections provided by Credential Guard are increased, subsequent releases of Windows 10 with Credential Guard running may impact scenarios that were working in the past. For example, Credential Guard may block the use of a particular type of credential or a particular component to prevent malware from taking advantage of vulnerabilities. Therefore, we recommend that scenarios required for operations in an organization are tested before upgrading a device that has Credential Guard running. @@ -38,7 +27,6 @@ in the Deep Dive into Credential Guard video series. - Applications that extract derived domain credentials from Credential Manager will no longer be able to use those credentials. - You cannot restore credentials using the Credential Manager control panel if the credentials were backed up from a PC that has Credential Guard turned on. If you need to back up your credentials, you must do this before you enable Credential Guard. Otherwise, you won't be able to restore those credentials. - Credential Guard uses hardware security so some features, such as Windows To Go, are not supported. - ## NTLM and CHAP Considerations diff --git a/windows/keep-secure/credential-guard-manage.md b/windows/keep-secure/credential-guard-manage.md index a70d85eb17..e4081028d7 100644 --- a/windows/keep-secure/credential-guard-manage.md +++ b/windows/keep-secure/credential-guard-manage.md @@ -1,4 +1,4 @@ ---- +--- title: Manage Credential Guard (Windows 10) description: Deploying and managing Credential Guard using Group Policy, the registry, or the Device Guard and Credential Guard hardware readiness tool. ms.prod: w10 @@ -19,7 +19,9 @@ Prefer video? See [Protecting privileged users with Credential Guard](https://mv in the Deep Dive into Credential Guard video series. ## Enable Credential Guard -Credential Guard can be enabled by using [Group Policy](#turn-on-credential-guard-by-using-group-policy), the [registry](#turn-on-credential-guard-by-using-the-registry), or the Device Guard and Credential Guard [hardware readiness tool](#hardware-readiness-tool). +Credential Guard can be enabled either by using [Group Policy](#turn-on-credential-guard-by-using-group-policy), the [registry](#turn-on-credential-guard-by-using-the-registry), or the Device Guard and Credential Guard [hardware readiness tool](#hardware-readiness-tool). Credential Guard can also protect secrets in a Hyper-V virtual machine, just as it would on a physical machine. +The same set of procedures used to enable Credential Guard on physical machines applies also to virtual machines. + ### Enable Credential Guard by using Group Policy @@ -41,7 +43,7 @@ To enforce processing of the group policy, you can run ```gpupdate /force```. If you don't use Group Policy, you can enable Credential Guard by using the registry. Credential Guard uses virtualization-based security features which have to be enabled first on some operating systems. -### Add the virtualization-based security features +#### Add the virtualization-based security features Starting with Windows 10, version 1607 and Windows Server 2016, enabling Windows features to use virtualization-based security is not necessary and this step can be skipped. @@ -74,7 +76,7 @@ If you enable Credential Guard by using Group Policy, the steps to enable Window > [!NOTE] > You can also add these features to an online image by using either DISM or Configuration Manager. -### Enable virtualization-based security and Credential Guard +#### Enable virtualization-based security and Credential Guard 1. Open Registry Editor. 2. Enable virtualization-based security: @@ -101,22 +103,18 @@ DG_Readiness_Tool_v3.0.ps1 -Enable -AutoReboot ### Credential Guard deployment in virtual machines -Credential Guard can protect secrets in a Hyper-V virtual machine, just as it would on a physical machine. The enablement steps are the same from within the virtual machine. +Credential Guard can protect secrets in a Hyper-V virtual machine, just as it would on a physical machine. When Credential Guard is deployed on a VM, secrets are protected from attacks inside the VM. Credential Guard does not provide additional protection from privileged system attacks originating from the host. -Credential Guard protects secrets from non-privileged access inside the VM. It does not provide additional protection from the host administrator. From the host, you can disable Credential Guard for a virtual machine: +#### Requirements for running Credential Guard in Hyper-V virtual machines -``` PowerShell -Set-VMSecurity -VMName -VirtualizationBasedSecurityOptOut $true -``` - -Requirements for running Credential Guard in Hyper-V virtual machines - The Hyper-V host must have an IOMMU, and run at least Windows Server 2016 or Windows 10 version 1607. - The Hyper-V virtual machine must be Generation 2, have an enabled virtual TPM, and running at least Windows Server 2016 or Windows 10. +### Review Credential Guard performance -### Check that Credential Guard is running +**Is Credential Guard running?** -You can use System Information to ensure that Credential Guard is running on a PC. +You can view System Information to check that Credential Guard is running on a PC. 1. Click **Start**, type **msinfo32.exe**, and then click **System Information**. 2. Click **System Summary**. @@ -132,10 +130,26 @@ You can also check that Credential Guard is running by using the [Device Guard a DG_Readiness_Tool_v3.0.ps1 -Ready ``` +> [!NOTE] -### Remove Credential Guard +For client machines that are running Windows 10 1703, LSAIso is running whenever Virtualization based security is enabled for other features. -If you have to remove Credential Guard on a PC, you can use the following set of procedures, or you can [use the Device Guard and Credential Guard hardware readiness tool](#turn-off-with-hardware-readiness-tool). +- If Credential Guard is enabled on a device after it's joined to a domain, the user and device secrets may already be compromised. We recommend that Credential Guard should be enabled before the PC is joined to a domain. + +- You should perform regular reviews of the PCs that have Credential Guard enabled. This can be done with security audit policies or WMI queries. Here's a list of WinInit event IDs to look for: + - **Event ID 13** Credential Guard (LsaIso.exe) was started and will protect LSA credentials. + - **Event ID 14** Credential Guard (LsaIso.exe) configuration: 0x1, 0 + - The first variable: 0x1 means Credential Guard is configured to run. 0x0 means it’s not configured to run. + - The second variable: 0 means it’s configured to run in protect mode. 1 means it's configured to run in test mode. This variable should always be 0. + - **Event ID 15** Credential Guard (LsaIso.exe) is configured but the secure kernel is not running; continuing without Credential Guard. + - **Event ID 16** Credential Guard (LsaIso.exe) failed to launch: \[error code\] + - **Event ID 17** Error reading Credential Guard (LsaIso.exe) UEFI configuration: \[error code\] + You can also verify that TPM is being used for key protection by checking the following event in the **Microsoft** -> **Windows** -> **Kernel-Boot** event source. If you are running with a TPM, the TPM PCR mask value will be something other than 0. + - **Event ID 51** VSM Master Encryption Key Provisioning. Using cached copy status: 0x0. Unsealing cached copy status: 0x1. New key generation status: 0x1. Sealing status: 0x1. TPM PCR mask: 0x0. + +## Disable Credential Guard + +If you have to disable Credential Guard on a PC, you can use the following set of procedures, or you can [use the Device Guard and Credential Guard hardware readiness tool](#turn-off-with-hardware-readiness-tool). 1. If you used Group Policy, disable the Group Policy setting that you used to enable Credential Guard (**Computer Configuration** -> **Administrative Templates** -> **System** -> **Device Guard** -> **Turn on Virtualization Based Security**). 2. Delete the following registry settings: @@ -146,11 +160,7 @@ If you have to remove Credential Guard on a PC, you can use the following set of > [!IMPORTANT] > If you manually remove these registry settings, make sure to delete them all. If you don't remove them all, the device might go into BitLocker recovery. -3. Delete the Credential Guard EFI variables by using bcdedit. - -**Delete the Credential Guard EFI variables** - -1. From an elevated command prompt, type the following commands: +3. Delete the Credential Guard EFI variables by using bcdedit. From an elevated command prompt, type the following commands: ``` syntax mountvol X: /s @@ -180,7 +190,7 @@ If you have to remove Credential Guard on a PC, you can use the following set of For more info on virtualization-based security and Device Guard, see [Device Guard deployment guide](device-guard-deployment-guide.md). -#### Turn off Credential Guard by using the Device Guard and Credential Guard hardware readiness tool +#### Disable Credential Guard by using the Device Guard and Credential Guard hardware readiness tool You can also disable Credential Guard by using the [Device Guard and Credential Guard hardware readiness tool](https://www.microsoft.com/download/details.aspx?id=53337). @@ -188,5 +198,15 @@ You can also disable Credential Guard by using the [Device Guard and Credential DG_Readiness_Tool_v3.0.ps1 -Disable -AutoReboot ``` +#### Disable Credential Guard for a virtual machine + +From the host, you can disable Credential Guard for a virtual machine: + +``` PowerShell +Set-VMSecurity -VMName -VirtualizationBasedSecurityOptOut $true +``` + + + diff --git a/windows/keep-secure/credential-guard-not-protected-scenarios.md b/windows/keep-secure/credential-guard-not-protected-scenarios.md index f2c4d556e7..bce8580dfb 100644 --- a/windows/keep-secure/credential-guard-not-protected-scenarios.md +++ b/windows/keep-secure/credential-guard-not-protected-scenarios.md @@ -29,13 +29,9 @@ Some ways to store credentials are not protected by Credential Guard, including: - Third-party security packages - Digest and CredSSP credentials - When Credential Guard is enabled, neither Digest nor CredSSP have access to users' logon credentials. This implies no Single Sign-On use for these protocols. -- Supplied credentials for NTLM authentication are not protected. If a user is prompted for and enters credentials for NTLM authentication, these credentials are vulnerable to be read from LSASS memory. Note that these same credentials are vulnerable to key loggers as well. - ->[!NOTE] -When Credential Guard is deployed on a VM, Credential Guard protects secrets from attacks inside the VM. However, it does not provide additional protection from privileged system attacks originating from the host. - ->[!NOTE] -Windows logon cached password verifiers (commonly called "cached credentials") +- Supplied credentials for NTLM authentication are not protected. If a user is prompted for and enters credentials for NTLM authentication, these credentials are vulnerable to be read from LSASS memory. Note that these same credentials are vulnerable to key loggers as well.- +- When Credential Guard is deployed on a VM, Credential Guard protects secrets from attacks inside the VM. However, it does not provide additional protection from privileged system attacks originating from the host. +- Windows logon cached password verifiers (commonly called "cached credentials") do not qualify as credentials because they cannot be presented to another computer for authentication, and can only be used locally to verify credentials. They are stored in the registry on the local computer and provide validation for credentials when a domain-joined computer cannot connect to AD DS during user logon. These “cached logons”, or more specifically, cached domain account information, can be managed using the security policy setting **Interactive logon: Number of previous logons to cache** if a domain controller is not available. ## Additional mitigations @@ -638,42 +634,6 @@ write-host $tmp -Foreground Red > [!NOTE] > If you're having trouble running this script, try replacing the single quote after the ConvertFrom-StringData parameter. - - - -## Troubleshooting Credential Guard - - - -### Known Issues - -Microsoft is aware of certain issues with Credential Guard that affect client machines that run Windows 10. -• For devices with Credential Guard enabled, a sign-in attempt that fails because of a bad password counts as two bad password attempts instead of one. Consequently, if your enterprise has an account lockout policy based on a certain number of failed password attempts, that threshold will be reached in half the number of attempts. - -This issue has been resolved for clients that run Windows 10 version 1703. For clients that run Windows 10 version 1607, a hotfix is available for download to resolve the issue. For clients that run Windows 10 versions 1507 or 1511, no hotfix is available. For those operating systems, to resolve the issue, you can upgrade the client to a later version of Windows 10. As a workaround, administrators can either choose to increase the account lockout threshold accordingly, consistent with current security policy, or can disable Credential Guard. For further information, see Credential Guard generates double bad password count - -Credential guard has known issues on Windows 10 when used with certain third-party applications: - -• Applications Appsense and Lumension E S. are known to cause high CPU utilization on Windows 10 client machines with credential guard enabled. -• Citrix Applications are known to cause high CPU utilization on Windows 10 client machines. This issue is currently under investigation. -• Cisco Proxy Agents are known to cause authentication failure on Windows 10 client machines. This issue is currently under investigation. -• Client machines with Credential Guard enabled cannot access shares on For further information see: Machines with Credential Guard enabled unable to connect to IBM File Servers - - - - - - -### How-to - - - - - - - - - ## See also **Deep Dive into Credential Guard: Related videos** diff --git a/windows/keep-secure/credential-guard-protection-limits.md b/windows/keep-secure/credential-guard-protection-limits.md new file mode 100644 index 0000000000..d76a71f4d1 --- /dev/null +++ b/windows/keep-secure/credential-guard-protection-limits.md @@ -0,0 +1,637 @@ +--- +title: Credential Guard protection limits (Windows 10) +description: Scenarios not protected by Credential Guard in Windows 10. +ms.prod: w10 +ms.mktglfcycl: explore +ms.sitesec: library +ms.pagetype: security +localizationpriority: high +author: brianlic-msft +--- + +# Credential Guard protection limits + +**Applies to** +- Windows 10 +- Windows Server 2016 + +Prefer video? See [Credentials protected by Credential Guard](https://mva.microsoft.com/en-us/training-courses/deep-dive-into-credential-guard-16651?l=pdc37LJyC_1204300474) +in the Deep Dive into Credential Guard video series. + +Some ways to store credentials are not protected by Credential Guard, including: + +- Software that manages credentials outside of Windows feature protection +- Local accounts and Microsoft Accounts +- Credential Guard does not protect the Active Directory database running on Windows Server 2016 domain controllers. It also does not protect credential input pipelines, such as Windows Server 2016 servers running Remote Desktop Gateway. If you're using a Windows Server 2016 server as a client PC, it will get the same protection as it would when running Windows 10 Enterprise. +- Key loggers +- Physical attacks +- Does not prevent an attacker with malware on the PC from using the privileges associated with any credential. We recommend using dedicated PCs for high value accounts, such as IT Pros and users with access to high value assets in your organization. +- Third-party security packages +- Digest and CredSSP credentials + - When Credential Guard is enabled, neither Digest nor CredSSP have access to users' logon credentials. This implies no Single Sign-On use for these protocols. +- Supplied credentials for NTLM authentication are not protected. If a user is prompted for and enters credentials for NTLM authentication, these credentials are vulnerable to be read from LSASS memory. Note that these same credentials are vulnerable to key loggers as well.- +- When Credential Guard is deployed on a VM, Credential Guard protects secrets from attacks inside the VM. However, it does not provide additional protection from privileged system attacks originating from the host. +- Windows logon cached password verifiers (commonly called "cached credentials") +do not qualify as credentials because they cannot be presented to another computer for authentication, and can only be used locally to verify credentials. They are stored in the registry on the local computer and provide validation for credentials when a domain-joined computer cannot connect to AD DS during user logon. These “cached logons”, or more specifically, cached domain account information, can be managed using the security policy setting **Interactive logon: Number of previous logons to cache** if a domain controller is not available. + +## Additional mitigations + +Credential Guard can provide mitigations against attacks on derived credentials and prevent the use of stolen credentials elsewhere. However, PCs can still be vulnerable to certain attacks, even if the derived credentials are protected by Credential Guard. These attacks can include abusing privileges and use of derived credentials directly from a compromised device, reusing previously stolen credentials prior to Device Guard, and abuse of management tools and weak application configurations. Because of this, additional mitigations also must be deployed to make the domain environment more robust. + +### Restricting domain users to specific domain-joined devices + +Credential theft attacks allow the attacker to steal secrets from one device and use them from another device. If a user can sign on to multiple devices then any device could be used to steal credentials. How do you ensure that users only sign on using devices that have Credential Guard enabled? By deploying authentication policies that restrict them to specific domain-joined devices that have been configured with Credential Guard. For the domain controller to know what device a user is signing on from, Kerberos armoring must be used. + +#### Kerberos armoring + +Kerberos armoring is part of RFC 6113. When a device supports Kerberos armoring, its TGT is used to protect the user's proof of possession which can mitigate offline dictionary attacks. Kerberos armoring also provides the additional benefit of signed KDC errors this mitigates tampering which can result in things such as downgrade attacks. + +**To enable Kerberos armoring for restricting domain users to specific domain-joined devices** + +- Users need to be in domains that are running Windows Server 2012 R2 or higher +- All the domain controllers in these domains must be configured to support Kerberos armoring. Set the **KDC support for claims, compound authentication, and Kerberos armoring** Group Policy setting to either **Supported** or **Always provide claims**. +- All the devices with Credential Guard that the users will be restricted to must be configured to support Kerberos armoring. Enable the **Kerberos client support for claims, compound authentication and Kerberos armoring** Group Policy settings under **Computer Configuration** -> **Administrative Templates** -> **System** -> **Kerberos**. + +#### Protecting domain-joined device secrets + +Since domain-joined devices also use shared secrets for authentication, attackers can steal those secrets as well. By deploying device certificates with Credential Guard, the private key can be protected. Then authentication policies can require that users sign on devices that authenticate using those certificates. This prevents shared secrets stolen from the device to be used with stolen user credentials to sign on as the user. + +Domain-joined device certificate authentication has the following requirements: +- Devices' accounts are in Windows Server 2012 domain functional level or higher. +- All domain controllers in those domains have KDC certificates which satisfy strict KDC validation certificate requirements: + - KDC EKU present + - DNS domain name matches the DNSName field of the SubjectAltName (SAN) extension +- Windows 10 devices have the CA issuing the domain controller certificates in the enterprise store. +- A process is established to ensure the identity and trustworthiness of the device in a similar manner as you would establish the identity and trustworthiness of a user before issuing them a smartcard. + +##### Deploying domain-joined device certificates + +To guarantee that certificates with the required issuance policy are only installed on the devices these users must use, they must be deployed manually on each device. The same security procedures used for issuing smart cards to users should be applied to device certificates. + +For example, let's say you wanted to use the High Assurance policy only on these devices. Using a Windows Server Enterprise certificate authority, you would create a new template. + +**Creating a new certificate template** + +1. From the Certificate Manager console, right-click **Certificate Templates**, and then click **Manage.** +2. Right-click **Workstation Authentication**, and then click **Duplicate Template**. +3. Right-click the new template, and then click **Properties**. +4. On the **Extensions** tab, click **Application Policies**, and then click **Edit**. +5. Click **Client Authentication**, and then click **Remove**. +6. Add the ID-PKInit-KPClientAuth EKU. Click **Add**, click **New**, and then specify the following values: + - Name: Kerberos Client Auth + - Object Identifier: 1.3.6.1.5.2.3.4 +7. On the **Extensions** tab, click **Issuance Policies**, and then click **Edit**. +8. Under **Issuance Policies**, click**High Assurance**. +9. On the **Subject name** tab, clear the **DNS name** check box, and then select the **User Principal Name (UPN)** check box. + +Then on the devices that are running Credential Guard, enroll the devices using the certificate you just created. + +**Enrolling devices in a certificate** + +Run the following command: +``` syntax +CertReq -EnrollCredGuardCert MachineAuthentication +``` + +> [!NOTE] +> You must restart the device after enrolling the machine authentication certificate. +  +##### How a certificate issuance policy can be used for access control + +Beginning with the Windows Server 2008 R2 domain functional level, domain controllers support for authentication mechanism assurance provides a way to map certificate issuance policy OIDs to universal security groups. Windows Server 2012 domain controllers with claim support can map them to claims. To learn more about authentication mechanism assurance, see [Authentication Mechanism Assurance for AD DS in Windows Server 2008 R2 Step-by-Step Guide](https://technet.microsoft.com/en-us/library/dd378897(v=ws.10).aspx) on TechNet. + +**To see the issuance policies available** + +- The [get-IssuancePolicy.ps1](#bkmk-getscript) shows all of the issuance policies that are available on the certificate authority. + From a Windows PowerShell command prompt, run the following command: + + ``` syntax + .\get-IssuancePolicy.ps1 –LinkedToGroup:All + ``` + +**To link an issuance policy to a universal security group** + +- The [set-IssuancePolicyToGroupLink.ps1](#bkmk-setscript) creates a Universal security group, creates an organizational unit, and links the issuance policy to that Universal security group. + From a Windows PowerShell command prompt, run the following command: + + ``` syntax + .\set-IssuancePolicyToGroupLink.ps1 –IssuancePolicyName:"" –groupOU:"" –groupName:”" + ``` + +#### Restricting user sign on + +So we now have completed the following: + +- Created a special certificate issuance policy to identify devices that meet the deployment criteria required for the user to be able to sign on +- Mapped that policy to a universal security group or claim +- Provided a way for domain controllers to get the device authorization data during user sign on using Kerberos armoring. Now what is left to do is to configure the access check on the domain controllers. This is done using authentication policies. + +Authentication policies have the following requirements: +- User accounts are in a Windows Server 2012 domain functional level or higher domain. + +**Creating an authentication policy restricting users to the specific universal security group** + +1. Open Active Directory Administrative Center. +2. Click **Authentication**, click **New**, and then click **Authentication Policy**. +3. In the **Display name** box, enter a name for this authentication policy. +4. Under the **Accounts** heading, click **Add**. +5. In the **Select Users, Computers, or Service Accounts** dialog box, type the name of the user account you wish to restrict, and then click **OK**. +6. Under the **User Sign On** heading, click the **Edit** button. +7. Click **Add a condition**. +8. In the **Edit Access Control Conditions** box, ensure that it reads **User** > **Group** > **Member of each** > **Value**, and then click **Add items**. +9. In the **Select Users, Computers, or Service Accounts** dialog box, type the name of the universal security group that you created with the set-IssuancePolicyToGroupLink script, and then click **OK**. +10. Click **OK** to close the **Edit Access Control Conditions** box. +11. Click **OK** to create the authentication policy. +12. Close Active Directory Administrative Center. + +> [!NOTE] +> When the authentication policy enforces policy restrictions, users will not be able to sign on using devices that do not have a certificate with the appropriate issuance policy deployed. This applies to both local and remote sign on scenarios. Therefore, it is strongly recommended to first only audit policy restrictions to ensure you don't have unexpected failures. + +##### Discovering authentication failures due to authentication policies + +To make tracking authentication failures due to authentication policies easier, an operational log exists with just those events. To enable the logs on the domain controllers, in Event Viewer, navigate to **Applications and Services Logs\\Microsoft\\Windows\\Authentication, right-click AuthenticationPolicyFailures-DomainController**, and then click **Enable Log**. + +To learn more about authentication policy events, see [Authentication Policies and Authentication Policy Silos](https://technet.microsoft.com/en-us/library/dn486813(v=ws.11).aspx). + +### Appendix: Scripts + +Here is a list of scripts mentioned in this topic. + +#### Get the available issuance policies on the certificate authority + +Save this script file as get-IssuancePolicy.ps1. + +``` syntax +####################################### +## Parameters to be defined ## +## by the user ## +####################################### +Param ( +$Identity, +$LinkedToGroup +) +####################################### +## Strings definitions ## +####################################### +Data getIP_strings { +# culture="en-US" +ConvertFrom-StringData -stringdata @' +help1 = This command can be used to retrieve all available Issuance Policies in a forest. The forest of the currently logged on user is targeted. +help2 = Usage: +help3 = The following parameter is mandatory: +help4 = -LinkedToGroup: +help5 = "yes" will return only Issuance Policies that are linked to groups. Checks that the linked Issuance Policies are linked to valid groups. +help6 = "no" will return only Issuance Policies that are not currently linked to any group. +help7 = "all" will return all Issuance Policies defined in the forest. Checks that the linked Issuance policies are linked to valid groups. +help8 = The following parameter is optional: +help9 = -Identity:. If you specify an identity, the option specified in the "-LinkedToGroup" parameter is ignored. +help10 = Output: This script returns the Issuance Policy objects meeting the criteria defined by the above parameters. +help11 = Examples: +errorIPNotFound = Error: no Issuance Policy could be found with Identity "{0}" +ErrorNotSecurity = Error: Issuance Policy "{0}" is linked to group "{1}" which is not of type "Security". +ErrorNotUniversal = Error: Issuance Policy "{0}" is linked to group "{1}" whose scope is not "Universal". +ErrorHasMembers = Error: Issuance Policy "{0}" is linked to group "{1}" which has a non-empty membership. The group has the following members: +LinkedIPs = The following Issuance Policies are linked to groups: +displayName = displayName : {0} +Name = Name : {0} +dn = distinguishedName : {0} + InfoName = Linked Group Name: {0} + InfoDN = Linked Group DN: {0} +NonLinkedIPs = The following Issuance Policies are NOT linked to groups: +'@ +} +##Import-LocalizedData getIP_strings +import-module ActiveDirectory +####################################### +## Help ## +####################################### +function Display-Help { + "" + $getIP_strings.help1 + "" +$getIP_strings.help2 +"" +$getIP_strings.help3 +" " + $getIP_strings.help4 +" " + $getIP_strings.help5 + " " + $getIP_strings.help6 + " " + $getIP_strings.help7 +"" +$getIP_strings.help8 + " " + $getIP_strings.help9 + "" + $getIP_strings.help10 +"" +"" +$getIP_strings.help11 + " " + '$' + "myIPs = .\get-IssuancePolicy.ps1 -LinkedToGroup:All" + " " + '$' + "myLinkedIPs = .\get-IssuancePolicy.ps1 -LinkedToGroup:yes" + " " + '$' + "myIP = .\get-IssuancePolicy.ps1 -Identity:""Medium Assurance""" +"" +} +$root = get-adrootdse +$domain = get-addomain -current loggedonuser +$configNCDN = [String]$root.configurationNamingContext +if ( !($Identity) -and !($LinkedToGroup) ) { +display-Help +break +} +if ($Identity) { + $OIDs = get-adobject -Filter {(objectclass -eq "msPKI-Enterprise-Oid") -and ((name -eq $Identity) -or (displayname -eq $Identity) -or (distinguishedName -like $Identity)) } -searchBase $configNCDN -properties * + if ($OIDs -eq $null) { +$errormsg = $getIP_strings.ErrorIPNotFound -f $Identity +write-host $errormsg -ForegroundColor Red + } + foreach ($OID in $OIDs) { + if ($OID."msDS-OIDToGroupLink") { +# In case the Issuance Policy is linked to a group, it is good to check whether there is any problem with the mapping. + $groupDN = $OID."msDS-OIDToGroupLink" + $group = get-adgroup -Identity $groupDN + $groupName = $group.Name +# Analyze the group + if ($group.groupCategory -ne "Security") { +$errormsg = $getIP_strings.ErrorNotSecurity -f $Identity, $groupName + write-host $errormsg -ForegroundColor Red + } + if ($group.groupScope -ne "Universal") { + $errormsg = $getIP_strings.ErrorNotUniversal -f $Identity, $groupName +write-host $errormsg -ForegroundColor Red + } + $members = Get-ADGroupMember -Identity $group + if ($members) { + $errormsg = $getIP_strings.ErrorHasMembers -f $Identity, $groupName +write-host $errormsg -ForegroundColor Red + foreach ($member in $members) { + write-host " " $member -ForeGroundColor Red + } + } + } + } + return $OIDs + break +} +if (($LinkedToGroup -eq "yes") -or ($LinkedToGroup -eq "all")) { + $LDAPFilter = "(&(objectClass=msPKI-Enterprise-Oid)(msDS-OIDToGroupLink=*)(flags=2))" + $LinkedOIDs = get-adobject -searchBase $configNCDN -LDAPFilter $LDAPFilter -properties * + write-host "" + write-host "*****************************************************" + write-host $getIP_strings.LinkedIPs + write-host "*****************************************************" + write-host "" + if ($LinkedOIDs -ne $null){ + foreach ($OID in $LinkedOIDs) { +# Display basic information about the Issuance Policies + "" + $getIP_strings.displayName -f $OID.displayName + $getIP_strings.Name -f $OID.Name + $getIP_strings.dn -f $OID.distinguishedName +# Get the linked group. + $groupDN = $OID."msDS-OIDToGroupLink" + $group = get-adgroup -Identity $groupDN + $getIP_strings.InfoName -f $group.Name + $getIP_strings.InfoDN -f $groupDN +# Analyze the group + $OIDName = $OID.displayName + $groupName = $group.Name + if ($group.groupCategory -ne "Security") { + $errormsg = $getIP_strings.ErrorNotSecurity -f $OIDName, $groupName + write-host $errormsg -ForegroundColor Red + } + if ($group.groupScope -ne "Universal") { + $errormsg = $getIP_strings.ErrorNotUniversal -f $OIDName, $groupName + write-host $errormsg -ForegroundColor Red + } + $members = Get-ADGroupMember -Identity $group + if ($members) { + $errormsg = $getIP_strings.ErrorHasMembers -f $OIDName, $groupName + write-host $errormsg -ForegroundColor Red + foreach ($member in $members) { + write-host " " $member -ForeGroundColor Red + } + } + write-host "" + } + }else{ +write-host "There are no issuance policies that are mapped to a group" + } + if ($LinkedToGroup -eq "yes") { + return $LinkedOIDs + break + } +} +if (($LinkedToGroup -eq "no") -or ($LinkedToGroup -eq "all")) { + $LDAPFilter = "(&(objectClass=msPKI-Enterprise-Oid)(!(msDS-OIDToGroupLink=*))(flags=2))" + $NonLinkedOIDs = get-adobject -searchBase $configNCDN -LDAPFilter $LDAPFilter -properties * + write-host "" + write-host "*********************************************************" + write-host $getIP_strings.NonLinkedIPs + write-host "*********************************************************" + write-host "" + if ($NonLinkedOIDs -ne $null) { + foreach ($OID in $NonLinkedOIDs) { +# Display basic information about the Issuance Policies +write-host "" +$getIP_strings.displayName -f $OID.displayName +$getIP_strings.Name -f $OID.Name +$getIP_strings.dn -f $OID.distinguishedName +write-host "" + } + }else{ +write-host "There are no issuance policies which are not mapped to groups" + } + if ($LinkedToGroup -eq "no") { + return $NonLinkedOIDs + break + } +} +``` +> [!NOTE] +> If you're having trouble running this script, try replacing the single quote after the ConvertFrom-StringData parameter. +  +#### Link an issuance policy to a group + +Save the script file as set-IssuancePolicyToGroupLink.ps1. + +``` syntax +####################################### +## Parameters to be defined ## +## by the user ## +####################################### +Param ( +$IssuancePolicyName, +$groupOU, +$groupName +) +####################################### +## Strings definitions ## +####################################### +Data ErrorMsg { +# culture="en-US" +ConvertFrom-StringData -stringdata @' +help1 = This command can be used to set the link between a certificate issuance policy and a universal security group. +help2 = Usage: +help3 = The following parameters are required: +help4 = -IssuancePolicyName: +help5 = -groupName:. If no name is specified, any existing link to a group is removed from the Issuance Policy. +help6 = The following parameter is optional: +help7 = -groupOU:. If this parameter is not specified, the group is looked for or created in the Users container. +help8 = Examples: +help9 = This command will link the issuance policy whose display name is "High Assurance" to the group "HighAssuranceGroup" in the Organizational Unit "OU_FOR_IPol_linked_groups". If the group or the Organizational Unit do not exist, you will be prompted to create them. +help10 = This command will unlink the issuance policy whose name is "402.164959C40F4A5C12C6302E31D5476062" from any group. +MultipleIPs = Error: Multiple Issuance Policies with name or display name "{0}" were found in the subtree of "{1}" +NoIP = Error: no issuance policy with name or display name "{0}" could be found in the subtree of "{1}". +IPFound = An Issuance Policy with name or display name "{0}" was successfully found: {1} +MultipleOUs = Error: more than 1 Organizational Unit with name "{0}" could be found in the subtree of "{1}". +confirmOUcreation = Warning: The Organizational Unit that you specified does not exist. Do you want to create it? +OUCreationSuccess = Organizational Unit "{0}" successfully created. +OUcreationError = Error: Organizational Unit "{0}" could not be created. +OUFoundSuccess = Organizational Unit "{0}" was successfully found. +multipleGroups = Error: More than one group with name "{0}" was found in Organizational Unit "{1}". +confirmGroupCreation = Warning: The group that you specified does not exist. Do you want to create it? +groupCreationSuccess = Univeral Security group "{0}" successfully created. +groupCreationError = Error: Univeral Security group "{0}" could not be created. +GroupFound = Group "{0}" was successfully found. +confirmLinkDeletion = Warning: The Issuance Policy "{0}" is currently linked to group "{1}". Do you really want to remove the link? +UnlinkSuccess = Certificate issuance policy successfully unlinked from any group. +UnlinkError = Removing the link failed. +UnlinkExit = Exiting without removing the link from the issuance policy to the group. +IPNotLinked = The Certificate issuance policy is not currently linked to any group. If you want to link it to a group, you should specify the -groupName option when starting this script. +ErrorNotSecurity = Error: You cannot link issuance Policy "{0}" to group "{1}" because this group is not of type "Security". +ErrorNotUniversal = Error: You cannot link issuance Policy "{0}" to group "{1}" because the scope of this group is not "Universal". +ErrorHasMembers = Error: You cannot link issuance Policy "{0}" to group "{1}" because it has a non-empty membership. The group has the following members: +ConfirmLinkReplacement = Warning: The Issuance Policy "{0}" is currently linked to group "{1}". Do you really want to update the link to point to group "{2}"? +LinkSuccess = The certificate issuance policy was successfully linked to the specified group. +LinkError = The certificate issuance policy could not be linked to the specified group. +ExitNoLinkReplacement = Exiting without setting the new link. +'@ +} +# import-localizeddata ErrorMsg +function Display-Help { +"" +write-host $ErrorMsg.help1 +"" +write-host $ErrorMsg.help2 +"" +write-host $ErrorMsg.help3 +write-host "`t" $ErrorMsg.help4 +write-host "`t" $ErrorMsg.help5 +"" +write-host $ErrorMsg.help6 +write-host "`t" $ErrorMsg.help7 +"" +"" +write-host $ErrorMsg.help8 +"" +write-host $ErrorMsg.help9 +".\Set-IssuancePolicyToGroupMapping.ps1 -IssuancePolicyName ""High Assurance"" -groupOU ""OU_FOR_IPol_linked_groups"" -groupName ""HighAssuranceGroup"" " +"" +write-host $ErrorMsg.help10 +'.\Set-IssuancePolicyToGroupMapping.ps1 -IssuancePolicyName "402.164959C40F4A5C12C6302E31D5476062" -groupName $null ' +"" +} +# Assumption: The group to which the Issuance Policy is going +# to be linked is (or is going to be created) in +# the domain the user running this script is a member of. +import-module ActiveDirectory +$root = get-adrootdse +$domain = get-addomain -current loggedonuser +if ( !($IssuancePolicyName) ) { +display-Help +break +} +####################################### +## Find the OID object ## +## (aka Issuance Policy) ## +####################################### +$searchBase = [String]$root.configurationnamingcontext +$OID = get-adobject -searchBase $searchBase -Filter { ((displayname -eq $IssuancePolicyName) -or (name -eq $IssuancePolicyName)) -and (objectClass -eq "msPKI-Enterprise-Oid")} -properties * +if ($OID -eq $null) { +$tmp = $ErrorMsg.NoIP -f $IssuancePolicyName, $searchBase +write-host $tmp -ForeGroundColor Red +break; +} +elseif ($OID.GetType().IsArray) { +$tmp = $ErrorMsg.MultipleIPs -f $IssuancePolicyName, $searchBase +write-host $tmp -ForeGroundColor Red +break; +} +else { +$tmp = $ErrorMsg.IPFound -f $IssuancePolicyName, $OID.distinguishedName +write-host $tmp -ForeGroundColor Green +} +####################################### +## Find the container of the group ## +####################################### +if ($groupOU -eq $null) { +# default to the Users container +$groupContainer = $domain.UsersContainer +} +else { +$searchBase = [string]$domain.DistinguishedName +$groupContainer = get-adobject -searchBase $searchBase -Filter { (Name -eq $groupOU) -and (objectClass -eq "organizationalUnit")} +if ($groupContainer.count -gt 1) { +$tmp = $ErrorMsg.MultipleOUs -f $groupOU, $searchBase +write-host $tmp -ForegroundColor Red +break; +} +elseif ($groupContainer -eq $null) { +$tmp = $ErrorMsg.confirmOUcreation +write-host $tmp " ( (y)es / (n)o )" -ForegroundColor Yellow -nonewline +$userChoice = read-host +if ( ($userChoice -eq "y") -or ($userChoice -eq "yes") ) { +new-adobject -Name $groupOU -displayName $groupOU -Type "organizationalUnit" -ProtectedFromAccidentalDeletion $true -path $domain.distinguishedName +if ($?){ +$tmp = $ErrorMsg.OUCreationSuccess -f $groupOU +write-host $tmp -ForegroundColor Green +} +else{ +$tmp = $ErrorMsg.OUCreationError -f $groupOU +write-host $tmp -ForeGroundColor Red +break; +} +$groupContainer = get-adobject -searchBase $searchBase -Filter { (Name -eq $groupOU) -and (objectClass -eq "organizationalUnit")} +} +else { +break; +} +} +else { +$tmp = $ErrorMsg.OUFoundSuccess -f $groupContainer.name +write-host $tmp -ForegroundColor Green +} +} +####################################### +## Find the group ## +####################################### +if (($groupName -ne $null) -and ($groupName -ne "")){ +##$searchBase = [String]$groupContainer.DistinguishedName +$searchBase = $groupContainer +$group = get-adgroup -Filter { (Name -eq $groupName) -and (objectClass -eq "group") } -searchBase $searchBase +if ($group -ne $null -and $group.gettype().isarray) { +$tmp = $ErrorMsg.multipleGroups -f $groupName, $searchBase +write-host $tmp -ForeGroundColor Red +break; +} +elseif ($group -eq $null) { +$tmp = $ErrorMsg.confirmGroupCreation +write-host $tmp " ( (y)es / (n)o )" -ForegroundColor Yellow -nonewline +$userChoice = read-host +if ( ($userChoice -eq "y") -or ($userChoice -eq "yes") ) { +new-adgroup -samAccountName $groupName -path $groupContainer.distinguishedName -GroupScope "Universal" -GroupCategory "Security" +if ($?){ +$tmp = $ErrorMsg.GroupCreationSuccess -f $groupName +write-host $tmp -ForegroundColor Green +}else{ +$tmp = $ErrorMsg.groupCreationError -f $groupName +write-host $tmp -ForeGroundColor Red +break +} +$group = get-adgroup -Filter { (Name -eq $groupName) -and (objectClass -eq "group") } -searchBase $searchBase +} +else { +break; +} +} +else { +$tmp = $ErrorMsg.GroupFound -f $group.Name +write-host $tmp -ForegroundColor Green +} +} +else { +##### +## If the group is not specified, we should remove the link if any exists +##### +if ($OID."msDS-OIDToGroupLink" -ne $null) { +$tmp = $ErrorMsg.confirmLinkDeletion -f $IssuancePolicyName, $OID."msDS-OIDToGroupLink" +write-host $tmp " ( (y)es / (n)o )" -ForegroundColor Yellow -nonewline +$userChoice = read-host +if ( ($userChoice -eq "y") -or ($userChoice -eq "yes") ) { +set-adobject -Identity $OID -Clear "msDS-OIDToGroupLink" +if ($?) { +$tmp = $ErrorMsg.UnlinkSuccess +write-host $tmp -ForeGroundColor Green +}else{ +$tmp = $ErrorMsg.UnlinkError +write-host $tmp -ForeGroundColor Red +} +} +else { +$tmp = $ErrorMsg.UnlinkExit +write-host $tmp +break +} +} +else { +$tmp = $ErrorMsg.IPNotLinked +write-host $tmp -ForeGroundColor Yellow +} +break; +} +####################################### +## Verify that the group is ## +## Universal, Security, and ## +## has no members ## +####################################### +if ($group.GroupScope -ne "Universal") { +$tmp = $ErrorMsg.ErrorNotUniversal -f $IssuancePolicyName, $groupName +write-host $tmp -ForeGroundColor Red +break; +} +if ($group.GroupCategory -ne "Security") { +$tmp = $ErrorMsg.ErrorNotSecurity -f $IssuancePolicyName, $groupName +write-host $tmp -ForeGroundColor Red +break; +} +$members = Get-ADGroupMember -Identity $group +if ($members -ne $null) { +$tmp = $ErrorMsg.ErrorHasMembers -f $IssuancePolicyName, $groupName +write-host $tmp -ForeGroundColor Red +foreach ($member in $members) {write-host " $member.name" -ForeGroundColor Red} +break; +} +####################################### +## We have verified everything. We ## +## can create the link from the ## +## Issuance Policy to the group. ## +####################################### +if ($OID."msDS-OIDToGroupLink" -ne $null) { +$tmp = $ErrorMsg.ConfirmLinkReplacement -f $IssuancePolicyName, $OID."msDS-OIDToGroupLink", $group.distinguishedName +write-host $tmp "( (y)es / (n)o )" -ForegroundColor Yellow -nonewline +$userChoice = read-host +if ( ($userChoice -eq "y") -or ($userChoice -eq "yes") ) { +$tmp = @{'msDS-OIDToGroupLink'= $group.DistinguishedName} +set-adobject -Identity $OID -Replace $tmp +if ($?) { +$tmp = $Errormsg.LinkSuccess +write-host $tmp -Foreground Green +}else{ +$tmp = $ErrorMsg.LinkError +write-host $tmp -Foreground Red +} +} else { +$tmp = $Errormsg.ExitNoLinkReplacement +write-host $tmp +break +} +} +else { +$tmp = @{'msDS-OIDToGroupLink'= $group.DistinguishedName} +set-adobject -Identity $OID -Add $tmp +if ($?) { +$tmp = $Errormsg.LinkSuccess +write-host $tmp -Foreground Green +}else{ +$tmp = $ErrorMsg.LinkError +write-host $tmp -Foreground Red +} +} +``` + +> [!NOTE] +> If you're having trouble running this script, try replacing the single quote after the ConvertFrom-StringData parameter. + +## See also + +**Deep Dive into Credential Guard: Related videos** + +[Protecting privileged users with Credential Guard](https://mva.microsoft.com/en-us/training-courses/deep-dive-into-credential-guard-16651?l=JNbjYMJyC_8104300474) diff --git a/windows/keep-secure/guidance-and-best-practices-wip.md b/windows/keep-secure/guidance-and-best-practices-wip.md index 3294599cd2..a0cabb4a95 100644 --- a/windows/keep-secure/guidance-and-best-practices-wip.md +++ b/windows/keep-secure/guidance-and-best-practices-wip.md @@ -25,7 +25,7 @@ This section includes info about the enlightened Microsoft apps, including how t |[Enlightened apps for use with Windows Information Protection (WIP)](enlightened-microsoft-apps-and-wip.md) |Learn the difference between enlightened and unenlightened apps, and then review the list of enlightened apps provided by Microsoft along with the text you will need to use to add them to your allowed apps list. | |[Unenlightened and enlightened app behavior while using Windows Information Protection (WIP)](app-behavior-with-wip.md) |Learn the difference between enlightened and unenlightened app behaviors. | |[Recommended Enterprise Cloud Resources and Neutral Resources network settings with Windows Information Protection (WIP)](recommended-network-definitions-for-wip.md) |Recommended additions for the Enterprise Cloud Resources and Neutral Resources network settings, when used with Windows Information Protection (WIP). | -|[Using Outlook Web Access with Windows Information Protection (WIP)](using-owa-with-wip.md) |Options for using Outlook Web Access (OWA) with Windows Information Protection (WIP). | +|[Using Outlook on the web with Windows Information Protection (WIP)](using-owa-with-wip.md) |Options for using Outlook on the web with Windows Information Protection (WIP). | >[!NOTE] >Help to make this topic better by providing us with edits, additions, and feedback. For info about how to contribute to this topic, see [Contributing to TechNet content](https://github.com/Microsoft/windows-itpro-docs/blob/master/CONTRIBUTING.md). diff --git a/windows/keep-secure/override-mitigation-options-for-app-related-security-policies.md b/windows/keep-secure/override-mitigation-options-for-app-related-security-policies.md index 68ad8780c0..e207ba506e 100644 --- a/windows/keep-secure/override-mitigation-options-for-app-related-security-policies.md +++ b/windows/keep-secure/override-mitigation-options-for-app-related-security-policies.md @@ -24,11 +24,11 @@ Windows 10 includes Group Policy-configurable “Process Mitigation Options” t The Group Policy settings in this topic are related to three types of process mitigations. In Windows 10, all three types are on by default for 64-bit applications, but by using the Group Policy settings described in this topic, you can configure additional protections. The types of process mitigations are: -- **Data Execution Prevention (DEP)** is a system-level memory protection feature that enables the operating system to mark one or more pages of memory as non-executable, preventing code from being run from that region of memory, to help prevent exploitation of buffer overruns. DEP helps prevent code from being run from data pages such as the default heap, stacks, and memory pools. +- **Data Execution Prevention (DEP)** is a system-level memory protection feature that enables the operating system to mark one or more pages of memory as non-executable, preventing code from being run from that region of memory, to help prevent exploitation of buffer overruns. DEP helps prevent code from being run from data pages such as the default heap, stacks, and memory pools. For more information, see [Data Execution Prevention](overview-of-threat-mitigations-in-windows-10.md#data-execution-prevention). -- **Structured Exception Handling Overwrite Protection (SEHOP)** is designed to block exploits that use the Structured Exception Handler (SEH) overwrite technique. Because this protection mechanism is provided at run-time, it helps to protect apps regardless of whether they have been compiled with the latest improvements. +- **Structured Exception Handling Overwrite Protection (SEHOP)** is designed to block exploits that use the Structured Exception Handler (SEH) overwrite technique. Because this protection mechanism is provided at run-time, it helps to protect apps regardless of whether they have been compiled with the latest improvements. For more information, see [Structured Exception Handling Overwrite Protection](overview-of-threat-mitigations-in-windows-10.md#structured-exception-handling-overwrite-protection). -- **Address Space Layout Randomization (ASLR)** loads DLLs into random memory addresses at boot time to mitigate against malware that’s designed to attack specific memory locations, where specific DLLs are expected to be loaded. +- **Address Space Layout Randomization (ASLR)** loads DLLs into random memory addresses at boot time to mitigate against malware that’s designed to attack specific memory locations, where specific DLLs are expected to be loaded. For more information, see [Address Space Layout Randomization](overview-of-threat-mitigations-in-windows-10.md#address-space-layout-randomization). To find additional ASLR protections in the table below, look for `IMAGES` or `ASLR`. The following procedure describes how to use Group Policy to override individual **Process Mitigation Options** settings. diff --git a/windows/keep-secure/overview-of-threat-mitigations-in-windows-10.md b/windows/keep-secure/overview-of-threat-mitigations-in-windows-10.md new file mode 100644 index 0000000000..ff8d0da12b --- /dev/null +++ b/windows/keep-secure/overview-of-threat-mitigations-in-windows-10.md @@ -0,0 +1,457 @@ +--- +title: Mitigate threats by using Windows 10 security features (Windows 10) +description: This topic provides an overview of software and firmware threats faced in the current security landscape, and the mitigations that Windows 10 offers in response to these threats. +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security +localizationpriority: high +author: justinha +--- + +# Mitigate threats by using Windows 10 security features + +**Applies to:** +- Windows 10 + +This topic provides an overview of some of the software and firmware threats faced in the current security landscape, and the mitigations that Windows 10 offers in response to these threats. For information about related types of protection offered by Microsoft, see [Related topics](#related-topics). + +| **Section** | **Contents** | +|--------------|-------------------------| +| [The security threat landscape](#threat-landscape) | Describes the current nature of the security threat landscape, and outlines how Windows 10 is designed to mitigate software exploits and similar threats. | +| [Windows 10 mitigations that you can configure](#windows-10-mitigations-that-you-can-configure) | Provides tables of configurable threat mitigations with links to more information. Product features such as Device Guard appear in [Table 1](#windows-10-mitigations-that-you-can-configure), and memory protection options such as Data Execution Prevention appear in [Table 2](#table-2). | +| [Mitigations that are built in to Windows 10](#mitigations-that-are-built-in-to-windows-10) | Provides descriptions of Windows 10 mitigations that require no configuration—they are built into the operating system. For example, heap protections and kernel pool protections are built into Windows 10. | +| [Understanding Windows 10 in relation to the Enhanced Mitigation Experience Toolkit](#understanding-windows-10-in-relation-to-the-enhanced-mitigation-experience-toolkit) | Describes how mitigations in the [Enhanced Mitigation Experience Toolkit (EMET)](https://support.microsoft.com/kb/2458544) correspond to features built into Windows 10 and how to convert EMET settings into mitigation policies for Windows 10. | + +This topic focuses on pre-breach mitigations aimed at device protection and threat resistance. These protections work with other security defenses in Windows 10, as shown in the following illustration: + +Types of defenses in Windows 10 + +*Figure 1.  Device protection and threat resistance as part of the Windows 10 security defenses* + +## The security threat landscape + +Today’s security threat landscape is one of aggressive and tenacious threats. In previous years, malicious attackers mostly focused on gaining community recognition through their attacks or the thrill of of temporarily taking a system offline. Since then, attacker’s motives have shifted toward making money, including holding devices and data hostage until the owner pays the demanded ransom. Modern attacks increasingly focus on large-scale intellectual property theft; targeted system degradation that can result in financial loss; and now even cyberterrorism that threatens the security of individuals, businesses, and national interests all over the world. These attackers are typically highly trained individuals and security experts, some of whom are in the employ of nation states that have large budgets and seemingly unlimited human resources. Threats like these require an approach that can meet this challenge. + +In recognition of this landscape, Windows 10 Creator's Update (Windows 10, version 1703) includes multiple security features that were created to make it difficult (and costly) to find and exploit many software vulnerabilities. These features are designed to: + +- Eliminate entire classes of vulnerabilities + +- Break exploitation techniques + +- Contain the damage and prevent persistence + +- Limit the window of opportunity to exploit + +The following sections provide more detail about security mitigations in Windows 10, version 1703. + +## Windows 10 mitigations that you can configure + +Windows 10 mitigations that you can configure are listed in the following two tables. The first table covers a wide array of protections for devices and users across the enterprise and the second table drills down into specific memory protections such as Data Execution Prevention. Memory protection options provide specific mitigations against malware that attempts to manipulate memory in order to gain control of a system. + +**Table 1  Windows 10 mitigations that you can configure** + +| Mitigation and corresponding threat | Description and links | +|---|---| +| **Windows Defender SmartScreen**
helps prevent
malicious applications
from being downloaded | Windows Defender SmartScreen can check the reputation of a downloaded application by using a service that Microsoft maintains. The first time a user runs an app that originates from the Internet (even if the user copied it from another PC), SmartScreen checks to see if the app lacks a reputation or is known to be malicious, and responds accordingly.

**More information**: [Windows Defender SmartScreen](#windows-defender-smartscreen), later in this topic | +| **Credential Guard**
helps keep attackers
from gaining access through
Pass-the-Hash or
Pass-the-Ticket attacks | Credential Guard uses virtualization-based security to isolate secrets, such as NTLM password hashes and Kerberos Ticket Granting Tickets, so that only privileged system software can access them.
Credential Guard is included in Windows 10 Enterprise and Windows Server 2016.

**More information**: [Protect derived domain credentials with Credential Guard](credential-guard.md) | +| **Enterprise certificate pinning**
helps prevent
man-in-the-middle attacks
that leverage PKI | Enterprise certificate pinning enables you to protect your internal domain names from chaining to unwanted certificates or to fraudulently issued certificates. With enterprise certificate pinning, you can “pin” (associate) an X.509 certificate and its public key to its Certification Authority, either root or leaf.

**More information**: [Enterprise Certificate Pinning](enterprise-certificate-pinning.md) | +| **Device Guard**
helps keep a device
from running malware or
other untrusted apps | Device Guard includes a Code Integrity policy that you create; a whitelist of trusted apps—the only apps allowed to run in your organization. Device Guard also includes a powerful system mitigation called hypervisor-protected code integrity (HVCI), which leverages virtualization-based security (VBS) to protect Windows’ kernel-mode code integrity validation process. HVCI has specific hardware requirements, and works with Code Integrity policies to help stop attacks even if they gain access to the kernel.
Device Guard is included in Windows 10 Enterprise and Windows Server 2016.

**More information**: [Introduction to Device Guard](introduction-to-device-guard-virtualization-based-security-and-code-integrity-policies.md) | +| **Windows Defender Antivirus**,
which helps keep devices
free of viruses and other
malware | Windows 10 includes Windows Defender Antivirus, a robust inbox antimalware solution. Windows Defender Antivirus has been significantly improved since it was introduced in Windows 8.

**More information**: [Windows Defender Antivirus](#windows-defender-antivirus), later in this topic | +| **Blocking of untrusted fonts**
helps prevent fonts
from being used in
elevation-of-privilege attacks | Block Untrusted Fonts is a setting that allows you to prevent users from loading fonts that are "untrusted" onto your network, which can mitigate elevation-of-privilege attacks associated with the parsing of font files. However, as of Windows 10, version 1703, this mitigation is less important, because font parsing is isolated in an [AppContainer sandbox](https://msdn.microsoft.com/library/windows/desktop/mt595898(v=vs.85).aspx) (for a list describing this and other kernel pool protections, see [Kernel pool protections](#kernel-pool-protections), later in this topic).

**More information**: [Block untrusted fonts in an enterprise](block-untrusted-fonts-in-enterprise.md) | +| **Memory protections**
help prevent malware
from using memory manipulation
techniques such as buffer
overruns | These mitigations, listed in [Table 2](#table-2), help to protect against memory-based attacks, where malware or other code manipulates memory to gain control of a system (for example, malware that attempts to use buffer overruns to inject malicious executable code into memory. Note:
A subset of apps will not be able to run if some of these mitigations are set to their most restrictive settings. Testing can help you maximize protection while still allowing these apps to run.

**More information**: [Table 2](#table-2), later in this topic | +| **UEFI Secure Boot**
helps protect
the platform from
bootkits and rootkits | Unified Extensible Firmware Interface (UEFI) Secure Boot is a security standard for firmware built in to PCs by manufacturers beginning with Windows 8. It helps to protect the boot process and firmware against tampering, such as from a physically present attacker or from forms of malware that run early in the boot process or in kernel after startup.

**More information**: [UEFI and Secure Boot](bitlocker-countermeasures.md#uefi-and-secure-boot) | +| **Early Launch Antimalware (ELAM)**
helps protect
the platform from
rootkits disguised as drivers | Early Launch Antimalware (ELAM) is designed to enable the antimalware solution to start before all non-Microsoft drivers and apps. If malware modifies a boot-related driver, ELAM will detect the change, and Windows will prevent the driver from starting, thus blocking driver-based rootkits.

**More information**: [Early Launch Antimalware](bitlocker-countermeasures.md#protection-during-startup) | +| **Device Health Attestation**
helps prevent
compromised devices from
accessing an organization’s
assets | Device Health Attestation (DHA) provides a way to confirm that devices attempting to connect to an organization's network are in a healthy state, not compromised with malware. When DHA has been configured, a device’s actual boot data measurements can be checked against the expected "healthy" boot data. If the check indicates a device is unhealthy, the device can be prevented from accessing the network.

**More information**: [Control the health of Windows 10-based devices](protect-high-value-assets-by-controlling-the-health-of-windows-10-based-devices.md) and [Device Health Attestation](https://technet.microsoft.com/windows-server-docs/security/device-health-attestation) | + +Configurable Windows 10 mitigations designed to help protect against memory manipulation require in-depth understanding of these threats and mitigations and knowledge about how the operating system and applications handle memory. The standard process for maximizing these types of mitigations is to work in a test lab to discover whether a given setting interferes with any applications that you use so that you can deploy settings that maximize protection while still allowing apps to run correctly. + +As an IT professional, you can ask application developers and software vendors to deliver applications that include an additional protection called Control Flow Guard (CFG). No configuration is needed in the operating system—the protection is compiled into applications. More information can be found in [Control Flow Guard](#control-flow-guard). + +### Table 2  Configurable Windows 10 mitigations designed to help protect against memory exploits + +| Mitigation and corresponding threat | Description | +|---|---| +| **Data Execution Prevention (DEP)**
helps prevent
exploitation of buffer overruns | **Data Execution Prevention (DEP)** is a system-level memory protection feature available in Windows operating systems. DEP enables the operating system to mark one or more pages of memory as non-executable, which prevents code from being run from that region of memory, to help prevent exploitation of buffer overruns.
DEP helps prevent code from being run from data pages such as the default heap, stacks, and memory pools. Although some applications have compatibility problems with DEP, the vast majority of applications do not.
**More information**: [Data Execution Prevention](#data-execution-prevention), later in this topic.

**Group Policy settings**: DEP is on by default for 64-bit applications, but you can configure additional DEP protections by using the Group Policy settings described in [Override Process Mitigation Options to help enforce app-related security policies](override-mitigation-options-for-app-related-security-policies.md). | +| **SEHOP**
helps prevent
overwrites of the
Structured Exception Handler | **Structured Exception Handling Overwrite Protection (SEHOP)** is designed to help block exploits that use the Structured Exception Handler (SEH) overwrite technique. Because this protection mechanism is provided at run-time, it helps to protect apps regardless of whether they have been compiled with the latest improvements. A few applications have compatibility problems with SEHOP, so be sure to test for your environment.
**More information**: [Structured Exception Handling Overwrite Protection](#structured-exception-handling-overwrite-protection), later in this topic.

**Group Policy setting**: SEHOP is on by default for 64-bit applications, but you can configure additional SEHOP protections by using the Group Policy setting described in [Override Process Mitigation Options to help enforce app-related security policies](override-mitigation-options-for-app-related-security-policies.md). | +| **ASLR**
helps mitigate malware
attacks based on
expected memory locations | **Address Space Layout Randomization (ASLR)** loads DLLs into random memory addresses at boot time. This helps mitigate malware that's designed to attack specific memory locations, where specific DLLs are expected to be loaded.
**More information**: [Address Space Layout Randomization](#address-space-layout-randomization), later in this topic.

**Group Policy settings**: ASLR is on by default for 64-bit applications, but you can configure additional ASLR protections by using the Group Policy settings described in [Override Process Mitigation Options to help enforce app-related security policies](override-mitigation-options-for-app-related-security-policies.md). | + +### Windows Defender SmartScreen + +Windows Defender SmartScreen notifies users if they click on reported phishing and malware websites, and helps protect them against unsafe downloads or make informed decisions about downloads. + +For Windows 10, Microsoft improved SmartScreen (now called Windows Defender SmartScreen) protection capability by integrating its app reputation abilities into the operating system itself, which allows SmartScreen to check the reputation of files downloaded from the Internet and warn users when they’re about to run a high-risk downloaded file. The first time a user runs an app that originates from the Internet, SmartScreen checks the reputation of the application by using digital signatures and other factors against a service that Microsoft maintains. If the app lacks a reputation or is known to be malicious, SmartScreen warns the user or blocks execution entirely, depending on how the administrator has configured Microsoft Intune or Group Policy settings. + +For more information, see [Windows Defender SmartScreen overview](windows-defender-smartscreen-overview.md). + +### Windows Defender Antivirus + +Windows Defender Antivirus in Windows 10 uses a multi-pronged approach to improve antimalware: + +- **Cloud-delivered protection** helps detect and block new malware within seconds, even if the malware has never been seen before. The service, available as of Windows 10, version 1703, uses distributed resources and machine learning to deliver protection to endpoints at a rate that is far faster than traditional signature updates. + +- **Rich local context** improves how malware is identified. Windows 10 informs Windows Defender Antivirus not only about content like files and processes but also where the content came from, where it has been stored, and more. The information about source and history enables Windows Defender Antivirus to apply different levels of scrutiny to different content. + +- **Extensive global sensors** help keep Windows Defender Antivirus current and aware of even the newest malware. This is accomplished in two ways: by collecting the rich local context data from end points and by centrally analyzing that data. + +- **Tamper proofing** helps guard Windows Defender Antivirus itself against malware attacks. For example, Windows Defender Antivirus uses Protected Processes, which prevents untrusted processes from attempting to tamper with Windows Defender Antivirus components, its registry keys, and so on. ([Protected Processes](#protected-processes) is described later in this topic.) + +- **Enterprise-level features** give IT pros the tools and configuration options necessary to make Windows Defender Antivirus an enterprise-class antimalware solution. + + + +For more information, see [Windows Defender in Windows 10](windows-defender-in-windows-10.md) and [Windows Defender Overview for Windows Server](https://technet.microsoft.com/windows-server-docs/security/windows-defender/windows-defender-overview-windows-server). + +For information about Windows Defender Advanced Threat Protection, a service that helps enterprises to detect, investigate, and respond to advanced and targeted attacks on their networks, see [Windows Defender Advanced Threat Protection (ATP)](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp) (resources) and [Windows Defender Advanced Threat Protection (ATP)](https://technet.microsoft.com/itpro/windows/keep-secure/windows-defender-advanced-threat-protection) (documentation). + +### Data Execution Prevention + +Malware depends on its ability to insert a malicious payload into memory with the hope that it will be executed later. Wouldn’t it be great if you could prevent malware from running if it wrote to an area that has been allocated solely for the storage of information? + +Data Execution Prevention (DEP) does exactly that, by substantially reducing the range of memory that malicious code can use for its benefit. DEP uses the No eXecute bit on modern CPUs to mark blocks of memory as read-only so that those blocks can’t be used to execute malicious code that may be inserted by means of a vulnerability exploit. + +**To use Task Manager to see apps that use DEP** + +1. Open Task Manager: Press Ctrl+Alt+Del and select **Task Manager**, or search the Start screen. + +2. Click **More Details** (if necessary), and then click the **Details** tab. + +3. Right-click any column heading, and then click **Select Columns**. + +4. In the **Select Columns** dialog box, select the last **Data Execution Prevention** check box. + +5. Click **OK**. + +You can now see which processes have DEP enabled. + + + +![Processes with DEP enabled in Windows 10](images/security-fig5-dep.png) + +*Figure 2.  Processes on which DEP has been enabled in Windows 10* + +You can use Control Panel to view or change DEP settings. + +#### To use Control Panel to view or change DEP settings on an individual PC + +1. Open Control Panel, System: click Start, type **Control Panel System**, and press ENTER. + +2. Click **Advanced system settings**, and then click the **Advanced** tab. + +3. In the **Performance** box, click **Settings**. + +4. In **Performance Options**, click the **Data Execution Prevention** tab. + +5. Select an option: + + - **Turn on DEP for essential Windows programs and services only** + + - **Turn on DEP for all programs and services except those I select**. If you choose this option, use the **Add** and **Remove** buttons to create the list of exceptions for which DEP will not be turned on. + +#### To use Group Policy to control DEP settings + +You can use the Group Policy setting called **Process Mitigation Options** to control DEP settings. A few applications have compatibility problems with DEP, so be sure to test for your environment. To use the Group Policy setting, see [Override Process Mitigation Options to help enforce app-related security policies](override-mitigation-options-for-app-related-security-policies.md). + +### Structured Exception Handling Overwrite Protection + +Structured Exception Handling Overwrite Protection (SEHOP) helps prevent attackers from being able to use malicious code to exploit the [Structured Exception Handler](https://msdn.microsoft.com/library/windows/desktop/ms680657(v=vs.85).aspx) (SEH), which is integral to the system and allows (non-malicious) apps to handle exceptions appropriately. Because this protection mechanism is provided at run-time, it helps to protect applications regardless of whether they have been compiled with the latest improvements. + +You can use the Group Policy setting called **Process Mitigation Options** to control the SEHOP setting. A few applications have compatibility problems with SEHOP, so be sure to test for your environment. To use the Group Policy setting, see [Override Process Mitigation Options to help enforce app-related security policies](override-mitigation-options-for-app-related-security-policies.md). + +### Address Space Layout Randomization + +One of the most common techniques used to gain access to a system is to find a vulnerability in a privileged process that is already running, guess or find a location in memory where important system code and data have been placed, and then overwrite that information with a malicious payload. Any malware that could write directly to the system memory could simply overwrite it in well-known and predictable locations. + +Address Space Layout Randomization (ASLR) makes that type of attack much more difficult because it randomizes how and where important data is stored in memory. With ASLR, it is more difficult for malware to find the specific location it needs to attack. Figure 3 illustrates how ASLR works by showing how the locations of different critical Windows components can change in memory between restarts. + +![ASLR at work](images/security-fig4-aslr.png) + +**Figure 3.  ASLR at work** + +Windows 10 applies ASLR holistically across the system and increases the level of entropy many times compared with previous versions of Windows to combat sophisticated attacks such as heap spraying. 64-bit system and application processes can take advantage of a vastly increased memory space, which makes it even more difficult for malware to predict where Windows 10 stores vital data. When used on systems that have TPMs, ASLR memory randomization will be increasingly unique across devices, which makes it even more difficult for a successful exploit that works on one system to work reliably on another. + +You can use the Group Policy setting called **Process Mitigation Options** to control ASLR settings (“Force ASLR” and “Bottom-up ASLR”), as described in [Override Process Mitigation Options to help enforce app-related security policies](override-mitigation-options-for-app-related-security-policies.md). + +## Mitigations that are built in to Windows 10 + +Windows 10 provides many threat mitigations to protect against exploits that are built into the operating system and need no configuration within the operating system. The table that follows describes some of these mitigations. + +Control Flow Guard (CFG) is a mitigation that does not need configuration within the operating system, but does require that an application developer configure the mitigation into the application when it’s compiled. CFG is built into Microsoft Edge, IE11, and other areas in Windows 10, and can be built into many other applications when they are compiled. + +### Table 3   Windows 10 mitigations to protect against memory exploits – no configuration needed + +| Mitigation and corresponding threat | Description | +|---|---| +| **SMB hardening for SYSVOL and NETLOGON shares**
helps mitigate
man-in-the-middle attacks | Client connections to the Active Directory Domain Services default SYSVOL and NETLOGON shares on domain controllers now require SMB signing and mutual authentication (such as Kerberos).

**More information**: [SMB hardening improvements for SYSVOL and NETLOGON shares](#smb-hardening-improvements-for-sysvol-and-netlogon-shares), later in this topic. | +| **Protected Processes**
help prevent one process
from tampering with another
process | With the Protected Processes feature, Windows 10 prevents untrusted processes from interacting or tampering with those that have been specially signed.

**More information**: [Protected Processes](#protected-processes), later in this topic. | +| **Universal Windows apps protections**
screen downloadable
apps and run them in
an AppContainer sandbox | Universal Windows apps are carefully screened before being made available, and they run in an AppContainer sandbox with limited privileges and capabilities.

**More information**: [Universal Windows apps protections](#universal-windows-apps-protections), later in this topic. | +| **Heap protections**
help prevent
exploitation of the heap | Windows 10 includes protections for the heap, such as the use of internal data structures which help protect against corruption of memory used by the heap.

**More information**: [Windows heap protections](#windows-heap-protections), later in this topic. | +| **Kernel pool protections**
help prevent
exploitation of pool memory
used by the kernel | Windows 10 includes protections for the pool of memory used by the kernel. For example, safe unlinking protects against pool overruns that are combined with unlinking operations that can be used to create an attack.

**More information**: [Kernel pool protections](#kernel-pool-protections), later in this topic. | +| **Control Flow Guard**
helps mitigate exploits
that are based on
flow between code locations
in memory | Control Flow Guard (CFG) is a mitigation that requires no configuration within the operating system, but instead is built into software when it’s compiled. It is built into Microsoft Edge, IE11, and other areas in Windows 10. CFG can be built into applications written in C or C++, or applications compiled using Visual Studio 2015.
For such an application, CFG can detect an attacker’s attempt to change the intended flow of code. If this occurs, CFG terminates the application. You can request software vendors to deliver Windows applications compiled with CFG enabled.

**More information**: [Control Flow Guard](#control-flow-guard), later in this topic. | +| **Protections built into Microsoft Edge** (the browser)
helps mitigate multiple
threats | Windows 10 includes an entirely new browser, Microsoft Edge, designed with multiple security improvements.

**More information**: [Microsoft Edge and Internet Explorer 11](#microsoft-edge-and-internet-explorer-11), later in this topic. | + +### SMB hardening improvements for SYSVOL and NETLOGON shares + +In Windows 10 and Windows Server 2016, client connections to the Active Directory Domain Services default SYSVOL and NETLOGON shares on domain controllers require Server Message Block (SMB) signing and mutual authentication (such as Kerberos). This reduces the likelihood of man-in-the-middle attacks. If SMB signing and mutual authentication are unavailable, a computer running Windows 10 or Windows Server 2016 won’t process domain-based Group Policy and scripts. + +> [!NOTE] +> The registry values for these settings aren’t present by default, but the hardening rules still apply until overridden by Group Policy or other registry values. For more information on these security improvements, (also referred to as UNC hardening), see [Microsoft Knowledge Base article 3000483](https://support.microsoft.com/en-us/help/3000483/ms15-011-vulnerability-in-group-policy-could-allow-remote-code-execution-february-10,-2015) and [MS15-011 & MS15-014: Hardening Group Policy](https://blogs.technet.microsoft.com/srd/2015/02/10/ms15-011-ms15-014-hardening-group-policy/). + +### Protected Processes + +Most security controls are designed to prevent the initial infection point. However, despite all the best preventative controls, malware might eventually find a way to infect the system. So, some protections are built to place limits on malware that gets on the device. Protected Processes creates limits of this type. + +With Protected Processes, Windows 10 prevents untrusted processes from interacting or tampering with those that have been specially signed. Protected Processes defines levels of trust for processes. Less trusted processes are prevented from interacting with and therefore attacking more trusted processes. Windows 10 uses Protected Processes more broadly across the operating system, and as in Windows 8.1, implements them in a way that can be used by 3rd party anti-malware vendors, as described in [Protecting Anti-Malware Services](https://msdn.microsoft.com/library/windows/desktop/dn313124(v=vs.85).aspx). This helps make the system and antimalware solutions less susceptible to tampering by malware that does manage to get on the system. + +### Universal Windows apps protections + +When users download Universal Windows apps from the Windows Store, it’s unlikely that they will encounter malware because all apps go through a careful screening process before being made available in the store. Apps that organizations build and distribute through sideloading processes will need to be reviewed internally to ensure that they meet organizational security requirements. + +Regardless of how users acquire Universal Windows apps, they can use them with increased confidence. Universal Windows apps run in an AppContainer sandbox with limited privileges and capabilities. For example, Universal Windows apps have no system-level access, have tightly controlled interactions with other apps, and have no access to data unless the user explicitly grants the application permission. + +In addition, all Universal Windows apps follow the security principle of least privilege. Apps receive only the minimum privileges they need to perform their legitimate tasks, so even if an attacker exploits an app, the damage the exploit can do is severely limited and should be contained within the sandbox. The Windows Store displays the exact capabilities the app requires (for example, access to the camera), along with the app’s age rating and publisher. + +### Windows heap protections + +The *heap* is a location in memory that Windows uses to store dynamic application data. Windows 10 continues to improve on earlier Windows heap designs by further mitigating the risk of heap exploits that could be used as part of an attack. + +Windows 10 has several important improvements to the security of the heap: + +- **Heap metadata hardening** for internal data structures that the heap uses, to improve protections against memory corruption. + +- **Heap allocation randomization**, that is, the use of randomized locations and sizes for heap memory allocations, which makes it more difficult for an attacker to predict the location of critical memory to overwrite. Specifically, Windows 10 adds a random offset to the address of a newly allocated heap, which makes the allocation much less predictable. + +- **Heap guard pages** before and after blocks of memory, which work as tripwires. If an attacker attempts to write past a block of memory (a common technique known as a buffer overflow), the attacker will have to overwrite a guard page. Any attempt to modify a guard page is considered a memory corruption, and Windows 10 responds by instantly terminating the app. + +### Kernel pool protections + +The operating system kernel in Windows sets aside two pools of memory, one that remains in physical memory (“nonpaged pool”) and one that can be paged in and out of physical memory (“paged pool”). There are many types of attacks that have been attempted against these pools, such as process quota pointer encoding; lookaside, delay free, and pool page cookies; and PoolIndex bounds checks. Windows 10 has multiple “pool hardening” protections, such as integrity checks, that help protect the kernel pool against such attacks. + +In addition to pool hardening, Windows 10 includes other kernel hardening features: + +- **Kernel DEP** and **Kernel ASLR**: Follow the same principles as [Data Execution Prevention](#data-execution-prevention) and [Address Space Layout Randomization](#address-space-layout-randomization), described earlier in this topic. + +- **Font parsing in AppContainer:** Isolates font parsing in an [AppContainer sandbox](https://msdn.microsoft.com/library/windows/desktop/mt595898(v=vs.85).aspx). + +- **Disabling of NT Virtual DOS Machine (NTVDM)**: The old NTVDM kernel module (for running 16-bit applications) is disabled by default, which neutralizes the associated vulnerabilities. (Enabling NTVDM decreases protection against Null dereference and other exploits.) + +- **Supervisor Mode Execution Prevention (SMEP)**: Helps prevent the kernel (the “supervisor”) from executing code in user pages, a common technique used by attackers for local kernel elevation of privilege (EOP). This requires processor support found in Intel Ivy Bridge or later processors, or ARM with PXN support. + +- **Safe unlinking:** Helps protect against pool overruns that are combined with unlinking operations to create an attack. Windows 10 includes global safe unlinking, which extends heap and kernel pool safe unlinking to all usage of LIST\_ENTRY and includes the “FastFail” mechanism to enable rapid and safe process termination. + +- **Memory reservations**: The lowest 64 KB of process memory is reserved for the system. Apps are not allowed to allocate that portion of the memory. This makes it more difficult for malware to use techniques such as “NULL dereference” to overwrite critical system data structures in memory. + +### Control Flow Guard + +When applications are loaded into memory, they are allocated space based on the size of the code, requested memory, and other factors. When an application begins to execute code, it calls additional code located in other memory addresses. The relationships between the code locations are well known—they are written in the code itself—but previous to Windows 10, the flow between these locations was not enforced, which gave attackers the opportunity to change the flow to meet their needs. + +This kind of threat is mitigated in Windows 10 through the Control Flow Guard (CFG) feature. When a trusted application that was compiled to use CFG calls code, CFG verifies that the code location called is trusted for execution. If the location is not trusted, the application is immediately terminated as a potential security risk. + +An administrator cannot configure CFG; rather, an application developer can take advantage of CFG by configuring it when the application is compiled. Consider asking application developers and software vendors to deliver trustworthy Windows applications compiled with CFG enabled. For example, it can be enabled for applications written in C or C++, or applications compiled using Visual Studio 2015. For information about enabling CFG for a Visual Studio 2015 project, see [Control Flow Guard](https://msdn.microsoft.com/library/windows/desktop/mt637065(v=vs.85).aspx). + +Of course, browsers are a key entry point for attacks, so Microsoft Edge, IE, and other Windows features take full advantage of CFG. + +### Microsoft Edge and Internet Explorer 11 + +Browser security is a critical component of any security strategy, and for good reason: the browser is the user’s interface to the Internet, an environment with many malicious sites and content waiting to attack. Most users cannot perform at least part of their job without a browser, and many users are completely reliant on one. This reality has made the browser the common pathway from which malicious hackers initiate their attacks. + +All browsers enable some amount of extensibility to do things beyond the original scope of the browser. Two common examples of this are Flash and Java extensions that enable their respective applications to run inside a browser. Keeping Windows 10 secure for web browsing and applications, especially for these two content types, is a priority. + +Windows 10 includes an entirely new browser, Microsoft Edge. Microsoft Edge is more secure in multiple ways, especially: + +- **Smaller attack surface; no support for non-Microsoft binary extensions**. Multiple browser components with vulnerable attack surfaces have been removed from Microsoft Edge. Components that have been removed include legacy document modes and script engines, Browser Helper Objects (BHOs), ActiveX controls, and Java. However, Microsoft Edge supports Flash content and PDF viewing by default through built-in extensions. + +- **Runs 64-bit processes.** A 64-bit PC running an older version of Windows often runs in 32-bit compatibility mode to support older and less secure extensions. When Microsoft Edge runs on a 64-bit PC, it runs only 64-bit processes, which are much more secure against exploits. + +- **Includes Memory Garbage Collection (MemGC)**. This helps protect against use-after-free (UAF) issues. + +- **Designed as a Universal Windows app.** Microsoft Edge is inherently compartmentalized and runs in an AppContainer that sandboxes the browser from the system, data, and other apps. IE11 on Windows 10 can also take advantage of the same AppContainer technology through Enhanced Protect Mode. However, because IE11 can run ActiveX and BHOs, the browser and sandbox are susceptible to a much broader range of attacks than Microsoft Edge. + +- **Simplifies security configuration tasks.** Because Microsoft Edge uses a simplified application structure and a single sandbox configuration, there are fewer required security settings. In addition, Microsoft Edge default settings align with security best practices, which makes it more secure by default. + +In addition to Microsoft Edge, Microsoft includes IE11 in Windows 10, primarily for backwards-compatibility with websites and with binary extensions that do not work with Microsoft Edge. It should not be configured as the primary browser but rather as an optional or automatic switchover. We recommend using Microsoft Edge as the primary web browser because it provides compatibility with the modern web and the best possible security. + +For sites that require IE11 compatibility, including those that require binary extensions and plug ins, enable Enterprise mode and use the Enterprise Mode Site List to define which sites have the dependency. With this configuration, when Microsoft Edge identifies a site that requires IE11, users will automatically be switched to IE11. + +### Functions that software vendors can use to build mitigations into apps + +Some of the protections available in Windows 10 are provided through functions that can be called from apps or other software. Such software is less likely to provide openings for exploits. If you are working with a software vendor, you can request that they include these security-oriented functions in the application. The following table lists some types of mitigations and the corresponding security-oriented functions that can be used in apps. + +> [!NOTE] +> Control Flow Guard (CFG) is also an important mitigation that a developer can include in software when it is compiled. For more information, see [Control Flow Guard](#control-flow-guard), earlier in this topic. + +### Table 4   Functions available to developers for building mitigations into apps + +| Mitigation | Function | +|-------------|-----------| +| LoadLib image loading restrictions | [UpdateProcThreadAttribute function](https://msdn.microsoft.com/en-us/library/windows/desktop/ms686880(v=vs.85).aspx)
\[PROCESS\_CREATION\_MITIGATION\_POLICY\_IMAGE\_LOAD\_NO\_REMOTE\_ALWAYS\_ON\] | +| MemProt dynamic code restriction | [UpdateProcThreadAttribute function](https://msdn.microsoft.com/en-us/library/windows/desktop/ms686880(v=vs.85).aspx)
\[PROCESS\_CREATION\_MITIGATION\_POLICY\_PROHIBIT\_DYNAMIC\_CODE\_ALWAYS\_ON\] | +| Child Process Restriction to restrict the ability to create child processes | [UpdateProcThreadAttribute function](https://msdn.microsoft.com/en-us/library/windows/desktop/ms686880(v=vs.85).aspx)
\[PROC\_THREAD\_ATTRIBUTE\_CHILD\_PROCESS\_POLICY\] | +| Code Integrity Restriction to restrict image loading | [SetProcessMitigationPolicy function](https://msdn.microsoft.com/en-us/library/windows/desktop/hh769088(v=vs.85).aspx)
\[ProcessSignaturePolicy\] | +| Win32k System Call Disable Restriction to restrict ability to use NTUser and GDI | [SetProcessMitigationPolicy function](https://msdn.microsoft.com/en-us/library/windows/desktop/hh769088(v=vs.85).aspx)
\[ProcessSystemCallDisablePolicy\] | +| High Entropy ASLR for up to 1TB of variance in memory allocations | [UpdateProcThreadAttribute function](https://msdn.microsoft.com/en-us/library/windows/desktop/ms686880(v=vs.85).aspx)
\[PROCESS\_CREATION\_MITIGATION\_POLICY\_HIGH\_ENTROPY\_ASLR\_ALWAYS\_ON\] | +| Strict handle checks to raise immediate exception upon bad handle reference | [UpdateProcThreadAttribute function](https://msdn.microsoft.com/en-us/library/windows/desktop/ms686880(v=vs.85).aspx)
\[PROCESS\_CREATION\_MITIGATION\_POLICY\_STRICT\_HANDLE\_CHECKS\_ALWAYS\_ON\] | +| Extension point disable to block the use of certain third-party extension points | [UpdateProcThreadAttribute function](https://msdn.microsoft.com/en-us/library/windows/desktop/ms686880(v=vs.85).aspx)
\[PROCESS\_CREATION\_MITIGATION\_POLICY\_EXTENSION\_POINT\_DISABLE\_ALWAYS\_ON\] | +| Heap terminate on corruption to protect the system against a corrupted heap | [UpdateProcThreadAttribute function](https://msdn.microsoft.com/en-us/library/windows/desktop/ms686880(v=vs.85).aspx)
\[PROCESS\_CREATION\_MITIGATION\_POLICY\_HEAP\_TERMINATE\_ALWAYS\_ON\] | + +## Understanding Windows 10 in relation to the Enhanced Mitigation Experience Toolkit + +You might already be familiar with the [Enhanced Mitigation Experience Toolkit (EMET)](https://support.microsoft.com/kb/2458544), which has since 2009 offered a variety of exploit mitigations, and an interface for configuring those mitigations. You can use this section to understand how EMET mitigations relate to those in Windows 10. Many of EMET’s mitigations have been built into Windows 10, some with additional improvements. However, some EMET mitigations carry high performance cost, or appear to be relatively ineffective against modern threats, and therefore have not been brought into Windows 10. + +Because many of EMET’s mitigations and security mechanisms already exist in Windows 10 and have been improved, particularly those assessed to have high effectiveness at mitigating known bypasses, version 5.5*x* has been announced as the final major version release for EMET (see [Enhanced Mitigation Experience Toolkit](https://technet.microsoft.com/security/jj653751)). + +The following table lists EMET features in relation to Windows 10 features. + +### Table 5   EMET features in relation to Windows 10 features + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Specific EMET featuresHow these EMET features map
+to Windows 10 features
    +

  • DEP

    • +

  • SEHOP

    • +

  • ASLR (Force ASLR, Bottom-up ASLR)

    • +

DEP, SEHOP and ASLR are included in Windows 10 as configurable features. See Table 2, earlier in this topic.

+

You can install the ProcessMitigations PowerShell module to convert your EMET settings for these features into policies that you can apply to Windows 10.

    +

  • Load Library Check (LoadLib)

    • +

  • Memory Protection Check (MemProt)

    • +
LoadLib and MemProt are supported in Windows 10, for all applications that are written to use these functions. See Table 4, earlier in this topic.
    +

  • Null Page

    • +
Mitigations for this threat are built into Windows 10, as described in the “Memory reservations” item in Kernel pool protections, earlier in this topic.
    +

  • Heap Spray

    • +

  • EAF

    • +

  • EAF+

    • +
Windows 10 does not include mitigations that map specifically to these EMET features because they have low impact in the current threat landscape, and do not significantly increase the difficulty of exploiting vulnerabilities. Microsoft remains committed to monitoring the security environment as new exploits appear and taking steps to harden the operating system against them.
    +

  • Caller Check

    • +

  • Simulate Execution Flow

    • +

  • Stack Pivot

    • +

  • Deep Hooks (an ROP “Advanced Mitigation”)

    • +

  • Anti Detours (an ROP “Advanced Mitigation”)

    • +

  • Banned Functions (an ROP “Advanced Mitigation”)

    • +
Mitigated in Windows 10 with applications compiled with Control Flow Guard, as described in Control Flow Guard, earlier in this topic.
+ +### Converting an EMET XML settings file into Windows 10 mitigation policies + +One of EMET’s strengths is that it allows you to import and export configuration settings for EMET mitigations as an XML settings file for straightforward deployment. To generate mitigation policies for Windows 10 from an EMET XML settings file, you can install the ProcessMitigations PowerShell module. In an elevated PowerShell session, run this cmdlet: + +```powershell +Install-Module -Name ProcessMitigations +``` + +The Get-ProcessMitigation cmdlet gets the current mitigation settings from the registry or from a running process, or it can save all settings to an XML file. + +To get the current settings on all running instances of notepad.exe: + +```powershell +Get-ProcessMitigation -Name notepad.exe -RunningProcess +``` + +To get the current settings in the registry for notepad.exe: + +```powershell +Get-ProcessMitigation -Name notepad.exe +``` + +To get the current settings for the running process with pid 1304: + +```powershell +Get-ProcessMitigation -Id 1304 +``` + +To get the all process mitigation settings from the registry and save them to the xml file settings.xml: + +```powershell +Get-ProcessMitigation -RegistryConfigFilePath settings.xml +``` + +The Set-ProcessMitigation cmdlet can enable and disable process mitigations or set them in bulk from an XML file. + +To get the current process mitigation for "notepad.exe" from the registry and then enable MicrosoftSignedOnly and disable MandatoryASLR: + +```powershell +Set-ProcessMitigation -Name Notepad.exe -Enable MicrosoftSignedOnly -Disable MandatoryASLR +``` + +To set the process mitigations from an XML file (which can be generated from get-ProcessMitigation -RegistryConfigFilePath settings.xml): + +```powershell +Set-ProcessMitigation -PolicyFilePath settings.xml +``` + +To set the system default to be MicrosoftSignedOnly: + +```powershell +Set-ProcessMitigation -System -Enable MicrosoftSignedOnly +``` + +The ConvertTo-ProcessMitigationPolicy cmdlet converts mitigation policy file formats. The syntax is: + +```powershell +ConvertTo-ProcessMitigationPolicy -EMETFilePath -OutputFilePath [] +``` + +Examples: + +- **Convert EMET settings to Windows 10 settings**: You can run ConvertTo-ProcessMitigationPolicy and provide an EMET XML settings file as input, which will generate a result file of Windows 10 mitigation settings. For example: + + ```powershell + ConvertTo-ProcessMitigationPolicy -EMETFilePath policy.xml -OutputFilePath result.xml + ``` + +- **Audit and modify the converted settings (the output file)**: Additional cmdlets let you apply, enumerate, enable, disable, and save settings in the output file. For example, this cmdlet enables SEHOP and disables MandatoryASLR and DEPATL registry settings for Notepad: + + ```powershell + Set-ProcessMitigation -Name notepad.exe -Enable SEHOP -Disable MandatoryASLR,DEPATL + ``` + +- **Convert Attack Surface Reduction (ASR) settings to a Code Integrity policy file**: If the input file contains any settings for EMET’s Attack Surface Reduction (ASR) mitigation, the converter will also create a Code Integrity policy file. In this case, you can complete the merging, auditing, and deployment process for the Code Integrity policy, as described in [Deploy Device Guard: deploy code integrity policies](deploy-device-guard-deploy-code-integrity-policies.md). This will enable protections on Windows 10 equivalent to EMET’s ASR protections. + +- **Convert Certificate Trust settings to enterprise certificate pinning rules**: If you have an EMET “Certificate Trust” XML file (pinning rules file), you can also use ConvertTo-ProcessMitigationPolicy to convert the pinning rules file into an enterprise certificate pinning rules file. Then you can finish enabling that file as described in [Enterprise Certificate Pinning](enterprise-certificate-pinning.md). For example: + + ```powershell + ConvertTo-ProcessMitigationPolicy -EMETfilePath certtrustrules.xml -OutputFilePath enterprisecertpinningrules.xml + ``` + +#### EMET-related products + +Microsoft Consulting Services (MCS) and Microsoft Support/Premier Field Engineering (PFE) offer a range of options for EMET, support for EMET, and EMET-related reporting and auditing products such as the EMET Enterprise Reporting Service (ERS). For any enterprise customers who use such products today or who are interested in similar capabilities, we recommend evaluating [Windows Defender Advanced Threat Protection](windows-defender-advanced-threat-protection.md) (ATP). + +## Related topics + +- [Keep Windows 10 secure](index.md) +- [Security technologies in Windows 10](security-technologies.md) +- [Security and Assurance in Windows Server 2016](https://technet.microsoft.com/windows-server-docs/security/security-and-assurance) +- [Windows Defender Advanced Threat Protection (ATP) - resources](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp) +- [Windows Defender Advanced Threat Protection (ATP) - documentation](windows-defender-advanced-threat-protection.md) +- [Exchange Online Advanced Threat Protection Service Description](https://technet.microsoft.com/library/exchange-online-advanced-threat-protection-service-description.aspx) +- [Office 365 Advanced Threat Protection](https://products.office.com/en-us/exchange/online-email-threat-protection) +- [Microsoft Malware Protection Center](https://www.microsoft.com/en-us/security/portal/mmpc/default.aspx) + + diff --git a/windows/keep-secure/protect-high-value-assets-by-controlling-the-health-of-windows-10-based-devices.md b/windows/keep-secure/protect-high-value-assets-by-controlling-the-health-of-windows-10-based-devices.md index ac0409286d..9791688940 100644 --- a/windows/keep-secure/protect-high-value-assets-by-controlling-the-health-of-windows-10-based-devices.md +++ b/windows/keep-secure/protect-high-value-assets-by-controlling-the-health-of-windows-10-based-devices.md @@ -365,7 +365,7 @@ The following table details the hardware requirements for both virtualization-ba

Trusted Platform Module (TPM)

-

Required to support health attestation and necessary for additional key protections for virtualization-based security.

+

Required to support health attestation and necessary for additional key protections for virtualization-based security. TPM 2.0 is supported; TPM 1.2 is also supported beginnning with Windows 10, version 1703.

diff --git a/windows/keep-secure/troubleshoot-windows-defender-antivirus.md b/windows/keep-secure/troubleshoot-windows-defender-antivirus.md index 454f8c8257..4e7c275117 100644 --- a/windows/keep-secure/troubleshoot-windows-defender-antivirus.md +++ b/windows/keep-secure/troubleshoot-windows-defender-antivirus.md @@ -1029,7 +1029,7 @@ Description of the error.
Engine Version: <Antimalware Engine version>

NOTE:

Whenever Windows Defender, Microsoft Security Essentials, Malicious Software Removal Tool, or System Center Endpoint Protection detects a malware, it will restore the following system settings and services which the malware might have changed:

    -
  • Default Internet Explorer or Edge setting
    • +
  • Default Internet Explorer or Microsoft Edge setting
  • User Access Control settings
  • Chrome settings
  • Boot Control Data
    • diff --git a/windows/keep-secure/using-owa-with-wip.md b/windows/keep-secure/using-owa-with-wip.md index daa6be5167..c6d9bddc00 100644 --- a/windows/keep-secure/using-owa-with-wip.md +++ b/windows/keep-secure/using-owa-with-wip.md @@ -1,7 +1,7 @@ --- -title: Using Outlook Web Access with Windows Information Protection (WIP) (Windows 10) -description: Options for using Outlook Web Access (OWA) with Windows Information Protection (WIP). -keywords: WIP, Windows Information Protection, EDP, Enterprise Data Protection, WIP and OWA configuration +title: Using Outlook on the web with Windows Information Protection (WIP) (Windows 10) +description: Options for using Outlook on the web with Windows Information Protection (WIP). +keywords: WIP, Windows Information Protection, EDP, Enterprise Data Protection, WIP and OWA configuration, OWA, Outlook Web access ms.prod: w10 ms.mktglfcycl: explore ms.sitesec: library @@ -10,7 +10,7 @@ author: eross-msft localizationpriority: high --- -# Using Outlook Web Access with Windows Information Protection (WIP) +# Using Outlook on the web with Windows Information Protection (WIP) **Applies to:** - Windows 10, version 1607 and later @@ -18,7 +18,7 @@ localizationpriority: high >Learn more about what features and functionality are supported in each Windows edition at [Compare Windows 10 Editions](https://www.microsoft.com/en-us/WindowsForBusiness/Compare). -Because Outlook Web Access (OWA) can be used both personally and as part of your organization, you have the following options to configure it with Windows Information Protection (WIP): +Because Outlook on the web can be used both personally and as part of your organization, you have the following options to configure it with Windows Information Protection (WIP): |Option |OWA behavior | |-------|-------------| diff --git a/windows/manage/join-windows-10-mobile-to-azure-active-directory.md b/windows/manage/join-windows-10-mobile-to-azure-active-directory.md index 969c7bc490..61e6b65929 100644 --- a/windows/manage/join-windows-10-mobile-to-azure-active-directory.md +++ b/windows/manage/join-windows-10-mobile-to-azure-active-directory.md @@ -62,7 +62,7 @@ However, neither of these methods provides SSO in the Windows Store or SSO to re Using **Settings** > **Accounts** > **Your email and accounts** > **Add work or school account**, users can add their Azure AD account to the device. Alternatively, a work account can be added when the user signs in to an application like Mail, Word, etc. If you [enable auto-enrollment in your MDM settings](https://go.microsoft.com/fwlink/p/?LinkID=691615), the device will automatically be enrolled in MDM. -An added work account provides the same SSO experience in browser apps like Office 365 (Office portal, Outlook Web Access, Calendar, People, OneDrive), Azure AD profile and change password app, and Visual Studio. You get SSO to built-in applications like Mail, Calendar, People, OneDrive and files hosted on OneDrive without prompts for a password. In Office apps like Microsoft Word, Microsoft Excel, etc., you simply select the Azure AD account and you are able to open files without entering a password. +An added work account provides the same SSO experience in browser apps like Office 365 (Office portal, Outlook on the web, Calendar, People, OneDrive), Azure AD profile and change password app, and Visual Studio. You get SSO to built-in applications like Mail, Calendar, People, OneDrive and files hosted on OneDrive without prompts for a password. In Office apps like Microsoft Word, Microsoft Excel, etc., you simply select the Azure AD account and you are able to open files without entering a password. ## Preparing for Windows 10 Mobile diff --git a/windows/update/change-history-for-update-windows-10.md b/windows/update/change-history-for-update-windows-10.md index d1a178004f..97ece9af22 100644 --- a/windows/update/change-history-for-update-windows-10.md +++ b/windows/update/change-history-for-update-windows-10.md @@ -15,5 +15,7 @@ This topic lists new and updated topics in the [Update Windows 10](index.md) doc ## RELEASE: Windows 10, version 1703 -The topics in this library have been updated for Windows 10, version 1703 (also known as the Creators Update). - +The topics in this library have been updated for Windows 10, version 1703 (also known as the Creators Update). The following new topics have been added: +* [Windows Insider Program for Business](waas-windows-insider-for-business.md) +* [Windows Insider Program for Business using Azure Active Directory](waas-windows-insider-for-business-aad.md) +* [Windows Insider Program for Business Frequently Asked Questions](waas-windows-insider-for-business-faq.md) \ No newline at end of file diff --git a/windows/update/images/waas-wipfb-aad-classicaad.png b/windows/update/images/waas-wipfb-aad-classicaad.png new file mode 100644 index 0000000000..424f4bca0a Binary files /dev/null and b/windows/update/images/waas-wipfb-aad-classicaad.png differ diff --git a/windows/update/images/waas-wipfb-aad-classicenable.png b/windows/update/images/waas-wipfb-aad-classicenable.png new file mode 100644 index 0000000000..9cc78c2736 Binary files /dev/null and b/windows/update/images/waas-wipfb-aad-classicenable.png differ diff --git a/windows/update/images/waas-wipfb-aad-consent.png b/windows/update/images/waas-wipfb-aad-consent.png new file mode 100644 index 0000000000..aeb78e5ddf Binary files /dev/null and b/windows/update/images/waas-wipfb-aad-consent.png differ diff --git a/windows/update/images/waas-wipfb-aad-error.png b/windows/update/images/waas-wipfb-aad-error.png new file mode 100644 index 0000000000..83e6ca9974 Binary files /dev/null and b/windows/update/images/waas-wipfb-aad-error.png differ diff --git a/windows/update/images/waas-wipfb-aad-newaad.png b/windows/update/images/waas-wipfb-aad-newaad.png new file mode 100644 index 0000000000..87a6f5e750 Binary files /dev/null and b/windows/update/images/waas-wipfb-aad-newaad.png differ diff --git a/windows/update/images/waas-wipfb-aad-newdirectorybutton.png b/windows/update/images/waas-wipfb-aad-newdirectorybutton.png new file mode 100644 index 0000000000..9da18db5d1 Binary files /dev/null and b/windows/update/images/waas-wipfb-aad-newdirectorybutton.png differ diff --git a/windows/update/images/waas-wipfb-aad-newenable.png b/windows/update/images/waas-wipfb-aad-newenable.png new file mode 100644 index 0000000000..f9bbe57b26 Binary files /dev/null and b/windows/update/images/waas-wipfb-aad-newenable.png differ diff --git a/windows/update/images/waas-wipfb-aad-newusersettings.png b/windows/update/images/waas-wipfb-aad-newusersettings.png new file mode 100644 index 0000000000..ab28da5cbc Binary files /dev/null and b/windows/update/images/waas-wipfb-aad-newusersettings.png differ diff --git a/windows/update/index.md b/windows/update/index.md index 4346995b12..18f0e7fcdd 100644 --- a/windows/update/index.md +++ b/windows/update/index.md @@ -41,6 +41,7 @@ Windows as a service provides a new way to think about building, deploying, and | [Manage Windows 10 updates using Windows Server Update Services (WSUS)](waas-manage-updates-wsus.md) | Explains how to use WSUS to manage Windows 10 updates. | | [Manage Windows 10 updates using System Center Configuration Manager](waas-manage-updates-configuration-manager.md) | Explains how to use Configuration Manager to manage Windows 10 updates. | | [Manage device restarts after updates](waas-restart.md) | Explains how to use Group Policy to manage device restarts. | +| [Windows Insider Program for Business](waas-windows-insider-for-business.md) | Explains how the Windows Insider Program for Business works and how to become an insider. | >[!TIP] >Windows servicing is changing, but for disaster recovery scenarios and bare-metal deployments of Windows 10, you still can use traditional imaging software such as System Center Configuration Manager or the Microsoft Deployment Toolkit. Using these tools to deploy Windows 10 images is similar to deploying previous versions of Windows. diff --git a/windows/update/waas-configure-wufb.md b/windows/update/waas-configure-wufb.md index e3b47b2f2f..03aeba51b9 100644 --- a/windows/update/waas-configure-wufb.md +++ b/windows/update/waas-configure-wufb.md @@ -84,11 +84,11 @@ After you configure the servicing branch (CB or CBB), you can then define if, an ## Pause Feature Updates -You can also pause a device from receiving Feature Updates by a period of up to 60 days from when the value is set. After 60 days has passed, pause functionality will automatically expire and the device will scan Windows Update for applicable Feature Updates. Following this scan, Feature Updates for the device can then be paused again. +You can also pause a device from receiving Feature Updates by a period of up to 35 days from when the value is set. After 35 days has passed, pause functionality will automatically expire and the device will scan Windows Update for applicable Feature Updates. Following this scan, Feature Updates for the device can then be paused again. -Starting with version 1703, when configuring pause through policy, a start date has to be set from which the pause begins. The pause period will be calculated by adding 60 days to the start date. +Starting with version 1703, when configuring pause through policy, a start date has to be set from which the pause begins. The pause period will be calculated by adding 35 days to the start date. -In cases where the pause policy is first applied after the configured start date has passed, administrators will be able to extend the pause period up to a total of 60 days by configuring a later start date. +In cases where the pause policy is first applied after the configured start date has passed, administrators will be able to extend the pause period up to a total of 35 days by configuring a later start date. With version 1703, pausing through the settings app will provide a more consistent experience: - Any active restart notification are cleared or closed @@ -98,6 +98,8 @@ With version 1703, pausing through the settings app will provide a more consiste >[!IMPORTANT] >This policy does not apply to Windows 10 Mobile Enterprise. +> +>Prior to Windows 10, version 1703, feature updates could be paused by up to 60 days. This number has been changed to 35, similar to the number of days for quality updates. **Pause Feature Updates policies** @@ -110,7 +112,7 @@ With version 1703, pausing through the settings app will provide a more consiste You can check the date Feature Updates were paused at by checking the registry key **PausedFeatureDate** under **HKLM\SOFTWARE\Microsoft\WindowsUpdate\UpdatePolicy\Settings**. -The local group policy editor (GPEdit.msc) will not reflect if your Feature Update Pause period has expired. Although the device will resume Feature Updates after 60 days automatically, the pause checkbox will remain checked in the policy editor. To see if a device has auto-resumed taking Feature Updates, you can check the status registry key **PausedFeatureStatus** under **HKLM\SOFTWARE\Microsoft\WindowsUpdate\UpdatePolicy\Settings**. +The local group policy editor (GPEdit.msc) will not reflect if your Feature Update Pause period has expired. Although the device will resume Feature Updates after 35 days automatically, the pause checkbox will remain checked in the policy editor. To see if a device has auto-resumed taking Feature Updates, you can check the status registry key **PausedFeatureStatus** under **HKLM\SOFTWARE\Microsoft\WindowsUpdate\UpdatePolicy\Settings**. | Value | Status| | --- | --- | diff --git a/windows/update/waas-restart.md b/windows/update/waas-restart.md index 8eb41f55fc..da651bccc2 100644 --- a/windows/update/waas-restart.md +++ b/windows/update/waas-restart.md @@ -63,8 +63,6 @@ To configure active hours using Group Policy, go to **Computer Configuration\Adm ![Use Group Policy to configure active hours](images/waas-active-hours-policy.png) -To configure max active hours range, go to **Computer Configuration\Administrative Templates\Windows Components\Windows Update** and open the **Specify active hours range for auto-restarts**. This is only available from Windows 10, version 1703. - ### Configuring active hours with MDM MDM uses the [Update/ActiveHoursStart and Update/ActiveHoursEnd](https://msdn.microsoft.com/library/windows/hardware/dn904962.aspx#Update_ActiveHoursEnd) and [Update/ActiveHoursMaxRange](https://msdn.microsoft.com/windows/hardware/commercialize/customize/mdm/policy-configuration-service-provider#update-activehoursmaxrange) settings in the [Policy CSP](https://msdn.microsoft.com/library/windows/hardware/dn904962.aspx) to configure active hours. @@ -84,10 +82,64 @@ For a detailed description of these regsitry keys, see [Registry keys used to ma > >![Change active hours](images/waas-active-hours.png) +### Configuring active hours max range + +With Windows 10, version 1703, administrators can specify the max active hours range users can set. This option gives you additional flexibility to leave some of the decision for active hours on the user's side, while making sure you allow enough time for updating. The max range is calculated from active hours start time. + +To configure active hours max range through Group Policy, go to **Computer Configuration\Administrative Templates\Windows Components\Windows Update** and open the **Specify active hours range for auto-restarts**. + +To configure active hours max range through MDM, use [**Update/ActiveHoursMaxRange**](https://msdn.microsoft.com/windows/hardware/commercialize/customize/mdm/policy-configuration-service-provider?UpdatePolicies#update-activehoursmaxrange). + ## Limit restart delays After an update is installed, Windows 10 attemtps automatic restart outside of active hours. If the restart does not succeed after 7 days (by default), the user will see a notification that restart is required. You can use the **Specify deadline before auto-restart for update installation** policy to change the delay from 7 days to a number of days between 2 and 14. +## Control restart notifications + +In Windows 10, version 1703, we have added settings to control restart notifications for users. + +### Auto-restart notifications + +Administrators can override the default behavior for the auto-restart required notification. By default, this notification will dismiss automatically. + +To configure this behavior through Group Policy, go to **Computer Configuration\Administrative Templates\Windows Components\Windows Update** and select **Configure auto-restart required notification for updates**. When configured to **2 - User Action**, a user that gets this notification must manually dismiss it. + +To configure this behavior through MDM, use [**Update/AutoRestartRequiredNotificationDismissal**](https://msdn.microsoft.com/windows/hardware/commercialize/customize/mdm/policy-configuration-service-provider?UpdatePolicies#update-AutoRestartRequiredNotificationDismissal) + +You can also configure the period prior to an update that this notification will show up on. The default value is 15 minutes. + +To change it through Group Policy, select **Configure auto-restart-reminder notifications for updates** under **Computer Configuration\Administrative Templates\Windows Components\Windows Update** and select the period in minutes. + +To change it through MDM, use [**Update/AutoRestartNotificationSchedule**](https://msdn.microsoft.com/windows/hardware/commercialize/customize/mdm/policy-configuration-service-provider?UpdatePolicies#update-AutoRestartNotificationSchedule). + + +In some cases, you don't need a notification to show up. + +To do so through Group Policy, go to **Computer Configuration\Administrative Templates\Windows Components\Windows Update** and select **Turn off auto-restart notifications for update installations**. + +To do so through MDM, use [**Update/SetAutoRestartNotificationDisable**](https://msdn.microsoft.com/windows/hardware/commercialize/customize/mdm/policy-configuration-service-provider?UpdatePolicies#update-setautorestartnotificationdisable). + +### Scheduled auto-restart warnings + +Since users are not able to postpone a scheduled restart once the deadline has been reached, you can configure a warning reminder prior to the scheduled a restart. You can also configure a configure a warning prior to the restart, to notify users once the restart is imminent and allow them to save their work. + +To configure both through Group Policy, find **Configure auto-restart warning notifications schedule for updates** under **Computer Configuration\Administrative Templates\Windows Components\Windows Update**. The warning reminder can be configured by **Reminder (hours)** and the warning prior to an imminent auto-restart can be configured by **Warning (mins)**. + +In MDM, the warning reminder is configured using [**Update/ScheduleRestartWarning**](https://msdn.microsoft.com/windows/hardware/commercialize/customize/mdm/policy-configuration-service-provider?UpdatePolicies#update-ScheduleRestartWarning) and the auto-restart imminent warning is configured using [**Update/ScheduleImminentRestartWarning**](https://msdn.microsoft.com/windows/hardware/commercialize/customize/mdm/policy-configuration-service-provider?UpdatePolicies#update-ScheduleImminentRestartWarning). + +### Engaged restart + +Engaged restart is the period of time when users are required to schedule a restart. When this period ends (7 days by default), Windows transitions to auto-restart outside of active hours. + +The following settings can be adjusted for engaged restart: +* Period of time before engaged restart transitions to auto-restart. +* The number of days that users can snooze engaged restart reminder notifications. +* The number of days before a pending restart automatically executes outside of working hours. + +In Group Policy, go to **Computer Configuration\Administrative Templates\Windows Components\Windows Update** and pick **Specify Engaged restart transition and notification schedule for updates**. + +In MDM, use [**Update/EngagedRestartTransitionSchedule**](https://msdn.microsoft.com/windows/hardware/commercialize/customize/mdm/policy-configuration-service-provider?UpdatePolicies#update-EngagedRestartTransitionSchedule), [**Update/EngagedRestartSnoozeSchedule**](https://msdn.microsoft.com/windows/hardware/commercialize/customize/mdm/policy-configuration-service-provider?UpdatePolicies#update-EngagedRestartSnoozeSchedule) and [**Update/EngagedRestartDeadline**](https://msdn.microsoft.com/windows/hardware/commercialize/customize/mdm/policy-configuration-service-provider?UpdatePolicies#update-EngagedRestartDeadline) respectively. + ## Group Policy settings for restart In the Group Policy editor, you will see a number of policy settings that pertain to restart behavior in **Computer Configuration\Administrative Templates\Windows Components\Windows Update**. The following table shows which policies apply to Windows 10. diff --git a/windows/update/waas-windows-insider-for-business-aad.md b/windows/update/waas-windows-insider-for-business-aad.md index f749ef1c36..5467e01600 100644 --- a/windows/update/waas-windows-insider-for-business-aad.md +++ b/windows/update/waas-windows-insider-for-business-aad.md @@ -37,12 +37,11 @@ Simply go to **Settings > Accounts > Access work or school**. If a corporate acc ## Enroll a device with an Azure Active Directory account 1. Visit [insider.windows.com](https://insider.windows.com). Sign-in with your corporate account in AAD and follow the on-screen registration directions. 2. On your Windows 10 device, go to **Settings > Updates & Security > Windows Insider Program**. +3. Enter the AAD account that you used to register and follow the on-screen directions. >[!NOTE] >Make sure that you have administrator rights to the machine and that it has latest Windows updates. -3. Enter the AAD account that you used to register and follow the on-screen directions. - ## Switch device enrollment from your Microsoft account to your AAD account 1. Visit [insider.windows.com](https://insider.windows.com) to register your AAD account. If you are signed in with your Microsoft account, sign out, then sign back in with your corporate AAD account. 2. Click **Get started**, read and accept the privacy statement and program terms and click **Submit**. @@ -55,6 +54,46 @@ Simply go to **Settings > Accounts > Access work or school**. If a corporate acc >[!NOTE] >Your device must be connected to your corporate account in AAD for the account to appear in the account list. +## User consent requirement + +With the current version of the Feedback Hub app, we need the user's consent to access their AAD account profile data (We read their name, organizational tenant ID and user ID). When they sign in for the first time with the AAD account, they will see a popup asking for their permission, like this: + +![Feedback Hub consent to AAD pop-up](images/waas-wipfb-aad-consent.png) + +Once agreed, everything will work fine and that user won't be prompted for permission again. + +### Something went wrong + +The option for users to give consent for apps to access their profile data is controlled through Azure Active Directory. This means the AAD administrators have the ability to allow or block users from giving consent. + +In case the administrators blocked this option, when the user signs in with the AAD account, they will see the following error message: + +![Feedback Hub consent error message](images/waas-wipfb-aad-error.png) + +This blocks the user from signing in, which means they won't be able to use the Feedback Hub app with their AAD credentials. + +**To fix this issue**, an adminsitrator of the AAD directory will need to enable user consent for apps to access their data. + +To do this through the **classic Azure portal**: +1. Go to https://manage.windowsazure.com/ . +2. Switch to the **Active Directory** dashboard. + ![Azure classic portal dashboard button](images/waas-wipfb-aad-classicaad.png) +3. Select the appropriate directory and go to the **Configure** tab. +4. Under the **integrated applications** section, enable **Users may give applications permissions to access their data**. + ![Azure classic portal enable consent](images/waas-wipfb-aad-classicenable.png) + +To do this through the **new Azure portal**: +1. Go to https://portal.azure.com/ . +2. Switch to the **Active Directory** dashboard. + ![Azure new portal dashboard button](images/waas-wipfb-aad-newaad.png) +3. Switch to the appropriate directory. + ![Azure new portal switch directory button](images/waas-wipfb-aad-newdirectorybutton.png) +4. Under the **Manage** section, select **User settings**. + ![Azure new portal user settings](images/waas-wipfb-aad-newusersettings.png) +5. In the **Enterprise applications** section, enable **Users can allow apps to access their data**. + ![Azure new portal enable consent](images/waas-wipfb-aad-newenable.png) + + ## Frequently Asked Questions ### Will my test machines be affected by automatic registration? diff --git a/windows/update/waas-windows-insider-for-business-faq.md b/windows/update/waas-windows-insider-for-business-faq.md index 653d6d5c93..aa84530023 100644 --- a/windows/update/waas-windows-insider-for-business-faq.md +++ b/windows/update/waas-windows-insider-for-business-faq.md @@ -31,11 +31,12 @@ Hindi, Catalan, and Vietnamese can only be installed as a language pack over [su > To learn how to install a language pack, see [How to add an input language to your PC Additional](https://support.microsoft.com/instantanswers/60f32ff8-8697-4452-af7d-647439c38433/how-to-add-and-switch-input-languages-on-your-pc). ### How do I register for the Windows Insider Program for Business? -To register for the Windows Insider Program for Business, follow the steps below using your corporate account in Azure Active Directory (AAD). This account is the same account \that you use for Office 365 and other Microsoft services. +To register for the Windows Insider Program for Business, follow the steps below using your corporate account in Azure Active Directory (AAD). This account is the same account that you use for Office 365 and other Microsoft services. 1. Visit https://insider.windows.com and click **Get Started**. 2. Sign-in with your corporate account in AAD (username/password) and follow the on-screen registration directions. -3. Enroll your Windows 10 PC to get the latest Windows 10 Insider Preview builds. Go to **Settings > Updates & Security > Windows Insider Program**. Click **Get Started**, enter your corporate credentials that you used to register, then follow the on-screen directions. +3. Enroll your Windows 10 PC to get the latest Windows 10 Insider Preview builds. Go to **Settings > Updates & Security > Windows Insider Program**. Click **Get Started**, enter your corporate credentials that you used to register, then follow the on-screen directions. + >[!NOTE] >Make sure that you have administrator rights to your machine and that it has latest Windows updates. @@ -73,7 +74,7 @@ In just a few steps, you can switch your existing program registration from your Sign in to the Feedback Hub using the same AAD account you are using to flight builds. ### Am I going to lose all the feedback I submitted and badges I earned with my MSA? -No. However, your feedback will not be transferred from your MSA to your AAD account. You can switch back to your MSA account in the Feedback Hub to access feedback you’ve submitted and badge you’ve earned. +No. However, your feedback will not be transferred from your MSA to your AAD account. You can switch back to your MSA account in the Feedback Hub to access feedback you’ve submitted and badges you’ve earned. ### How is licensing handled for Windows 10 Insider builds? All PCs need to have a valid Windows 10 license. This requirement applies whether the device is joined to the Windows Insider Program using a Microsoft account or an Azure Active Directory account. diff --git a/windows/update/waas-windows-insider-for-business.md b/windows/update/waas-windows-insider-for-business.md index bf612c952c..5308d3e795 100644 --- a/windows/update/waas-windows-insider-for-business.md +++ b/windows/update/waas-windows-insider-for-business.md @@ -20,7 +20,7 @@ localizationpriority: high For many IT pros, gaining visibility into feature updates early—before they’re available to the CB servicing branch—can be both intriguing and valuable for future end user communications as well as provide additional prestaging for CB machines. With Windows 10, feature flighting enables Windows Insiders to consume and deploy preproduction code to their test machines, gaining early visibility into the next build. Testing the early builds of Windows 10 helps both Microsoft and its customers because they have the opportunity to discover possible issues before the update is ever publicly available and can report it to Microsoft. Also, as flighted builds get closer to their release to CB, organizations can test their deployment on test devices for compatibility validation. The Windows Insider Program for Business gives you the opportunity to: -* Get early access to Windows Insider Preview Builds +* Get early access to Windows Insider Preview Builds. * Provide feedback to Microsoft in real-time via the Feedback Hub app. * Sign-in with corporate credentials (Azure Active Directory) and increase the visibility of your organization's feedback with Microsoft – especially on features that support your productivity and business needs. @@ -56,9 +56,8 @@ Best for Insiders who enjoy getting early access to updates for the Current Bran Insiders on this level receive builds of Windows just before Microsoft releases them for CB. Although these builds aren’t final, they are the most complete and stable builds available to Windows Insider Program participants. This level provides the best testing platform for organizations that conduct early application compatibility testing on Windows Insider PCs. -* The Release Preview Ring will only be visible when your Windows build version is the same as the Current Branch -* The easiest way to go between the Development Branch to the Current Branch is to use the [Media Creation Tool](http://go.microsoft.com/fwlink/?LinkId=691209) (for PC) or [Windows Device Recovery Tool](http://go.microsoft.com/fwlink/p/?LinkId=522381) (for Mobile) to reinstall Windows -Ring +* The Release Preview Ring will only be visible when your Windows build version is the same as the Current Branch. +* The easiest way to go between the Development Branch to the Current Branch is to use the [Media Creation Tool](http://go.microsoft.com/fwlink/?LinkId=691209) (for PC) or [Windows Device Recovery Tool](http://go.microsoft.com/fwlink/p/?LinkId=522381) (for Mobile) to reinstall Windows. ### Slow @@ -66,15 +65,16 @@ The Slow Windows Insider level is for users who enjoy seeing new builds of Windo * Builds are sent to the Slow Ring after feedback has been received from Insiders within the Fast Ring and analyzed by our Engineering teams. * These builds will include updates to fix key issues that would prevent many Windows Insiders from being able to use the build on a daily basis. -* These builds are still may have issues that would be addressed in a future flight. +* These builds still may have issues that would be addressed in a future flight. ### Fast -Best for Insiders who enjoy being the first to get access to builds and feature upgrades, with some risk to their devices in order to identify issues, and provide suggestions and ideas to make Windows software and devices great +Best for Insiders who enjoy being the first to get access to builds and feature upgrades, with some risk to their devices in order to identify issues, and provide suggestions and ideas to make Windows software and devices great. * Windows Insiders with devices in the Fast Ring should be prepared for more issues that may block key activities that are important to you or may require significant workarounds. * Because we are also validating a build on a smaller set of devices before going to Fast, there is also a chance that some features may work on some devices but may fail in other device configurations. -* Windows Insiders should be ready to reinstall Windows using the [Media Creation Tool](http://go.microsoft.com/fwlink/?LinkId=691209) or [Windows Device Recovery Tool](http://go.microsoft.com/fwlink/p/?LinkId=522381) when you are significantly blocked. • Please remember to report any issue to us through the Windows Insider Feedback Hub or the Windows Insider community Forum +* Windows Insiders should be ready to reinstall Windows using the [Media Creation Tool](http://go.microsoft.com/fwlink/?LinkId=691209) or [Windows Device Recovery Tool](http://go.microsoft.com/fwlink/p/?LinkId=522381) when you are significantly blocked. +* Please remember to report any issue to us through the Windows Insider Feedback Hub or the Windows Insider community Forum. >[!NOTE] >Once your machine is updated to Windows 10 and you select your desired flight ring, the process known as "Compatibility check" will need to run in the background. There is no manual way to force this process to run. This process allows for the discovery of your OS type (32-bit, 64-bit), build edition (Home, Pro, Enterprise), country and language settings, and other required information. Once this process is complete, your machine will be auto-targeted for the next available flight for your selected ring. For the first build on any given machine, this may take up to 24 hours to complete. @@ -85,11 +85,11 @@ During your time in the Windows Insider Program, you may want to change between 1. Go to **Settings > Updates & Security > Windows Insider Program** 2. Under **Choose your level**, select between the following rings - - * [Windows Insider Fast](#fast) - * [Windows Insider Slow](#slow) - * [Release Preview](#release-preview) + * [Windows Insider Fast](#fast) + * [Windows Insider Slow](#slow) + * [Release Preview](#release-preview) -## How to switch between you MSA and your Corporate AAD account +## How to switch between your MSA and your Corporate AAD account The Windows Insider Program for Business now gives users the option to register and enroll devices using a corporate account in [Azure Active Directory](https://azure.microsoft.com/services/active-directory/) (AAD) as well as their Microsoft Account (MSA). @@ -108,11 +108,16 @@ When providing feedback, please consider the following: 3. Provide as much information to us as possible: include reproduction steps, screenshots, any detail you think would help us experience the issue as you have, so that we can work on a fix and get it into a new build as soon as possible. ### How to use your corporate AAD account for additional Feedback Hub benefits -Get even more out of the Feedback Hub by signing in to the Feedback Hub using the same corporate account in AAD that are using to flight builds. One of the benefits of submitting feedback using your AAD account is the addition of a page to the Feedback Hub for your organization. Simply click the **My Company** page in the feedback hub to see and upvote all feedback submitted by other Insiders in your organization. +Get even more out of the Feedback Hub by signing in to the Feedback Hub using the same corporate account in AAD that you're using to flight builds. One of the benefits of submitting feedback using your AAD account is the addition of a page to the Feedback Hub for your organization. Simply click the **My Company** page in the feedback hub to see and upvote all feedback submitted by other Insiders in your organization. >[!NOTE] >If you signed into the Feedback Hub previously with your MSA, your feedback and badges will not be transferred to your AAD sing-in. However, you can switch back to your MSA account in the Feedback Hub to access feedback you’ve submitted and badges you’ve earned. +>[!IMPORTANT] +>With the current version of the Feedback Hub app, we need the user's consent to access their AAD account profile data (We read their name, organizational tenant ID and user ID). When they sign in for the first time with the AAD account, they will se a popup asking for their permissions. Once agreed, everything will work fine and that user won't be asked for permissions again. +> +> If something goes wrong, it is possible that users aren't enabled to give persmissions to access their data. This can be resolved through the AAD portal. For more information about this, please see [User consent requirement](waas-windows-insider-for-business-aad.md#user-consent-requirement). + ## Not receiving Windows 10 Insider Preview build updates? In some cases, your PC may not update to the latest Insider Preview build as expected. Here are items that you can review to troubleshoot this issue: diff --git a/windows/whats-new/whats-new-windows-10-version-1507-and-1511.md b/windows/whats-new/whats-new-windows-10-version-1507-and-1511.md index f23a6b2556..a909347a7b 100644 --- a/windows/whats-new/whats-new-windows-10-version-1507-and-1511.md +++ b/windows/whats-new/whats-new-windows-10-version-1507-and-1511.md @@ -347,7 +347,7 @@ We also recommend that you upgrade to IE11 if you're running any earlier version ## Learn more -- [Windows 10 release information](https://technet.microsoft.com/en-us/windows/release-info) +- [Windows 10 release information](https://technet.microsoft.com/windows/release-info)   diff --git a/windows/whats-new/whats-new-windows-10-version-1703.md b/windows/whats-new/whats-new-windows-10-version-1703.md index 73e50ea512..3995354bb7 100644 --- a/windows/whats-new/whats-new-windows-10-version-1703.md +++ b/windows/whats-new/whats-new-windows-10-version-1703.md @@ -12,9 +12,9 @@ ms.assetid: dca7c655-c4f6-45f8-aa02-64187b202617 # What's new in Windows 10, version 1703 IT pro content -Below is a list of some of the new and updated content that discusses Information Technology (IT) pro features in Windows 10, version 1703 (also known as the Creators Update). +Below is a list of some of the new and updated content that discusses Information Technology (IT) pro features in Windows 10, version 1703 (also known as the Creators Update). -For more general info about Windows 10 features, see [Features available only on Windows 10](https://www.microsoft.com/windows/features). For info about previous versions of Windows 10, see [What's New in Windows 10](index.md). +For more general info about Windows 10 features, see [Features available only on Windows 10](https://www.microsoft.com/windows/features). For info about previous versions of Windows 10, see [What's New in Windows 10](index.md). Also see this blog post: [What’s new for IT pros in the Windows 10 Creators Update](https://blogs.technet.microsoft.com/windowsitpro/2017/04/05/whats-new-for-it-pros-in-the-windows-10-creators-update/). >[!NOTE] >Windows 10, version 1703 contains all fixes included in previous cumulative updates to Windows 10, version 1607. For info about each version, see [Windows 10 release information](https://technet.microsoft.com/en-us/windows/release-info). For a list of removed features, see [Features that are removed or deprecated in Windows 10 Creators Update](https://support.microsoft.com/help/4014193/features-that-are-removed-or-deprecated-in-windows-10-creators-update). @@ -75,6 +75,8 @@ Cortana is Microsoft’s personal digital assistant, who helps busy people get t Using Azure AD also means that you can remove an employee’s profile (for example, when an employee leaves your organization) while respecting Windows Information Protection (WIP) policies and ignoring enterprise content, such as emails, calendar items, and people lists that are marked as enterprise data. +For more info about Cortana at work, see (../configure/cortana-at-work-overview.md) + ## Deployment