mirror of
https://github.com/MicrosoftDocs/windows-itpro-docs.git
synced 2025-05-12 05:17:22 +00:00
fix: MD033/no-inline-html
- Escape elements being swallowed as HTML - Remove Head/Style that don't render on docs.ms - Use backticks where there is no formatting - Espace inside pre blocks - Remove non-docfx xref with text
This commit is contained in:
Nick Schonning
parent
9c8517cbcb
commit
2ed412cef0
@ -191,7 +191,7 @@ Set-AssignedAccess -AppUserModelId Microsoft.Windows.SecureAssessmentBrowser_cw5
|
||||
12. Create a new **Action**.
|
||||
13. Configure the action to **Start a program**.
|
||||
14. In the **Program/script** field, enter **powershell**.
|
||||
15. In the **Add arguments** field, enter **-file "<path to powershell script>"**.
|
||||
15. In the **Add arguments** field, enter **-file "\<path to powershell script>"**.
|
||||
16. Click **OK**.
|
||||
17. Navigate to the **Triggers** tab and create a new trigger.
|
||||
18. Specify the trigger to be **On a schedule**.
|
||||
|
||||
@ -172,7 +172,7 @@ Set-Service <service name> -StartupType Disabled
|
||||
|
||||
## View per-user services in the Services console (services.msc)
|
||||
|
||||
As mentioned you can't view the template services in the Services console, but you can see the user-specific per-user services - they are displayed using the <service name>_LUID format (where LUID is the locally unique identifier).
|
||||
As mentioned you can't view the template services in the Services console, but you can see the user-specific per-user services - they are displayed using the \<service name>_LUID format (where LUID is the locally unique identifier).
|
||||
|
||||
For example, you might see the following per-user services listed in the Services console:
|
||||
|
||||
|
||||
@ -12,10 +12,6 @@ author: lomayor
|
||||
ms.date: 09/05/2017
|
||||
---
|
||||
|
||||
<head>
|
||||
<style type='text/css'> table.topalign td { vertical-align: top } </style>
|
||||
</head>
|
||||
|
||||
# Azure Active Directory integration with MDM
|
||||
|
||||
Azure Active Directory is the world largest enterprise cloud identity management service. It’s used by millions of organizations to access Office 365 and thousands of business applications from Microsoft and third party software as a service (SaaS) vendors. Many of the rich Windows 10 experiences for organizational users (such as store access or OS state roaming) use Azure AD as the underlying identity infrastructure. Windows 10 provides an integrated configuration experience with Azure AD, allowing devices to be registered in Azure AD and enrolled into MDM in a smooth integrated flow.
|
||||
|
||||
@ -196,7 +196,7 @@ Required. Specifies the root CA thumbprint. It is a 20-byte value of the SHA1 ce
|
||||
Supported operations are Get, Add, Delete, and Replace.
|
||||
|
||||
<a href="" id="my-scep-uniqueid-install-subjectalternativenames"></a>**My/SCEP/*UniqueID*/Install/SubjectAlternativeNames**
|
||||
Optional. Specifies the subject alternative name. Multiple alternative names can be specified. Each name is the combination of name format+actual name. Refer to the name type definition in MSDN. Each pair is separated by semicolon. For example, multiple subject alternative names are presented in the format *<nameformat1>*+*<actual name1>*;*<name format 2>*+*<actual name2>*. Value type is chr.
|
||||
Optional. Specifies the subject alternative name. Multiple alternative names can be specified. Each name is the combination of name format+actual name. Refer to the name type definition in MSDN. Each pair is separated by semicolon. For example, multiple subject alternative names are presented in the format *\<nameformat1>*+*\<actual name1>*;*\<name format 2>*+*\<actual name2>*. Value type is chr.
|
||||
|
||||
Supported operations are Get, Add, Delete, and Replace.
|
||||
|
||||
|
||||
@ -975,7 +975,7 @@ Specifies the properties of the publisher details.
|
||||
<tr class="odd">
|
||||
<td><p>assignedTo</p></td>
|
||||
<td><p>string</p></td>
|
||||
<td><p>Format = UPN (user<xref href="domain)" data-throw-if-not-resolved="False" data-raw-source="@domain)"></xref></p></td>
|
||||
<td><p>Format = UPN (user@domain)</p></td>
|
||||
</tr>
|
||||
<tr class="even">
|
||||
<td><p>dateAssigned</p></td>
|
||||
|
||||
@ -126,7 +126,7 @@ A production ready deployment must have the appropriate certificate details as p
|
||||
|
||||
EAP XML must be updated with relevant information for your environment This can be done either manually by editing the XML sample below, or by using the step by step UI guide. After the EAP XML is updated, refer to instructions from your MDM to deploy the updated configuration as follows:
|
||||
|
||||
- For Wi-Fi, look for the <EAPConfig> section of your current WLAN Profile XML (This is what you specify for the WLanXml node in the Wi-Fi CSP). Within these tags you will find the complete EAP configuration. Replace the section under <EAPConfig> with your updated XML and update your Wi-Fi profile. You might need to refer to your MDM’s guidance on how to deploy a new Wi-Fi profile.
|
||||
- For Wi-Fi, look for the `<EAPConfig>` section of your current WLAN Profile XML (This is what you specify for the WLanXml node in the Wi-Fi CSP). Within these tags you will find the complete EAP configuration. Replace the section under `<EAPConfig>` with your updated XML and update your Wi-Fi profile. You might need to refer to your MDM’s guidance on how to deploy a new Wi-Fi profile.
|
||||
- For VPN, EAP Configuration is a separate field in the MDM Configuration. Work with your MDM provider to identify and update the appropriate Field.
|
||||
|
||||
For information about EAP Settings, see <https://technet.microsoft.com/library/hh945104.aspx#BKMK_Cfg_cert_Selct>
|
||||
|
||||
@ -107,7 +107,7 @@ aumid="microsoft.windowscommunicationsapps_8wekyb3d8bbwe!microsoft.windowslive.m
|
||||
|
||||
Entry | Description
|
||||
----------- | ------------
|
||||
Folder | A folder should be contained in <Applications/> node among with other <Application/> nodes, it shares most grammar with the Application Node, **folderId** is mandatory, **folderName** is optional, which is the folder name displayed on Start. **folderId** is a unique unsigned integer for each folder.
|
||||
Folder | A folder should be contained in `<Applications/>` node among with other `<Application/>` nodes, it shares most grammar with the Application Node, **folderId** is mandatory, **folderName** is optional, which is the folder name displayed on Start. **folderId** is a unique unsigned integer for each folder.
|
||||
|
||||
Folder example:
|
||||
``` syntax
|
||||
|
||||
@ -290,9 +290,9 @@ If you enable this policy setting, you have two ways to allow helpers to provide
|
||||
|
||||
To configure the list of helpers, click "Show." In the window that opens, you can enter the names of the helpers. Add each user or group one by one. When you enter the name of the helper user or user groups, use the following format:
|
||||
|
||||
<Domain Name>\<User Name> or
|
||||
`<Domain Name>\<User Name>` or
|
||||
|
||||
<Domain Name>\<Group Name>
|
||||
`<Domain Name>\<Group Name>`
|
||||
|
||||
If you enable this policy setting, you should also enable firewall exceptions to allow Remote Assistance communications. The firewall exceptions required for Offer (Unsolicited) Remote Assistance depend on the version of Windows you are running.
|
||||
|
||||
|
||||
@ -222,7 +222,7 @@ ADMX Info:
|
||||
<!--Description-->
|
||||
This policy setting specifies whether to prevent the mapping of client drives in a Remote Desktop Services session (drive redirection).
|
||||
|
||||
By default, an RD Session Host server maps client drives automatically upon connection. Mapped drives appear in the session folder tree in File Explorer or Computer in the format <driveletter> on <computername>. You can use this policy setting to override this behavior.
|
||||
By default, an RD Session Host server maps client drives automatically upon connection. Mapped drives appear in the session folder tree in File Explorer or Computer in the format `<driveletter>` on `<computername>`. You can use this policy setting to override this behavior.
|
||||
|
||||
If you enable this policy setting, client drive redirection is not allowed in Remote Desktop Services sessions, and Clipboard file copy redirection is not allowed on computers running Windows Server 2003, Windows 8, and Windows XP.
|
||||
|
||||
|
||||
@ -49,7 +49,7 @@ The following diagram shows the Update configuration service provider in tree fo
|
||||
|
||||
<p style="margin-left: 20px">Sample syncml:
|
||||
<p style="margin-left: 20px"><code>
|
||||
<LocURI>./Vendor/MSFT/Update/ApprovedUpdates/%7ba317dafe-baf4-453f-b232-a7075efae36e%7d</LocURI>
|
||||
<LocURI>./Vendor/MSFT/Update/ApprovedUpdates/%7ba317dafe-baf4-453f-b232-a7075efae36e%7d</LocURI>
|
||||
</code>
|
||||
|
||||
<a href="" id="approvedupdates-approved-update-guid-approvedtime"></a>**ApprovedUpdates/*Approved Update Guid*/ApprovedTime**
|
||||
|
||||
@ -25,7 +25,7 @@ Programming considerations:
|
||||
- Because the Windows 10 Mobile emulator does not support Wi-Fi, you cannot test the Wi-Fi configuration with an emulator. You can still provision a Wi-Fi network using the WiFi CSP, then check it in the Wi-Fi settings page, but you cannot test the network connectivity in the emulator.
|
||||
- For WEP, WPA, and WPA2-based networks, include the passkey in the network configuration in plaintext. The passkey is encrypted automatically when it is stored on the device.
|
||||
- The SSID of the Wi-Fi network part of the LocURI node must be a valid URI based on RFC 2396. This requires that all non-ASCII characters must be escaped using a %-character. Unicode characters without the necessary escaping are not supported.
|
||||
- The <name>*name\_goes\_here*</name><SSIDConfig> must match <SSID><name> *name\_goes\_here*</name></SSID>.
|
||||
- The \<name>*name\_goes\_here*\</name>\<SSIDConfig> must match \<SSID>\<name> *name\_goes\_here*\</name>\</SSID>.
|
||||
- For the WiFi CSP, you cannot use the Replace command unless the node already exists.
|
||||
- Using Proxyis only supported in Windows 10 Mobile. Using this configuration in Windows 10 for desktop editions (Home, Pro, Enterprise, and Education) will result in failure.
|
||||
|
||||
@ -43,10 +43,10 @@ Identifies the Wi-Fi network configuration. Each Wi-Fi network configuration is
|
||||
|
||||
Supported operation is Get.
|
||||
|
||||
<a href="" id="-ssid-"></a>**<em><SSID></em>**
|
||||
<a href="" id="-ssid-"></a>**<em>\<SSID></em>**
|
||||
Specifies the name of the Wi-Fi network (32 bytes maximum) to create, configure, query, or delete. The name is case sensitive and can be represented in ASCII. The SSID is added when the WlanXML node is added. When the SSID node is deleted, then all the subnodes are also deleted.
|
||||
|
||||
SSID is the name of network you are connecting to, while Profile name is the name of the Profile which contains the WiFi settings information. If the Profile name is not set right in the MDM SyncML, as per the information in the WiFi settings XML, it could lead to some unexpected errors. For example, <LocURI>./Vendor/MSFT/WiFi/Profile/<*MUST BE NAME OF PROFILE AS PER WIFI XML*>/WlanXml</LocURI>.
|
||||
SSID is the name of network you are connecting to, while Profile name is the name of the Profile which contains the WiFi settings information. If the Profile name is not set right in the MDM SyncML, as per the information in the WiFi settings XML, it could lead to some unexpected errors. For example, \<LocURI>./Vendor/MSFT/WiFi/Profile/<*MUST BE NAME OF PROFILE AS PER WIFI XML*>/WlanXml\</LocURI>.
|
||||
|
||||
The supported operations are Add, Get, Delete, and Replace.
|
||||
|
||||
|
||||
@ -144,7 +144,7 @@ R:\> Copy *.* D:\BootBackup
|
||||
Bcdboot <**OSDrive* >:\windows /s <**SYSTEMdrive* >: /f ALL
|
||||
```
|
||||
|
||||
For example: if we assign the ,System Drive> (WinRE drive) the letter R and the <OSdrive> is the letter D, this command would be the following:
|
||||
For example: if we assign the `<System Drive>` (WinRE drive) the letter R and the `<OSdrive>` is the letter D, this command would be the following:
|
||||
|
||||
```cmd
|
||||
Bcdboot D:\windows /s R: /f ALL
|
||||
|
||||
@ -156,7 +156,7 @@ Netsh trace stop
|
||||
|
||||
Open the traces in [Microsoft Network Monitor 3.4](troubleshoot-tcpip-netmon.md) or Message Analyzer and filter the trace for
|
||||
|
||||
- Ipv4.address==<client-ip> and ipv4.address==<server-ip> and tcp.port==135 or just tcp.port==135 should help.
|
||||
- `Ipv4.address==<client-ip>` and `ipv4.address==<server-ip>` and `tcp.port==135` or just `tcp.port==135` should help.
|
||||
|
||||
- Look for the “EPM” Protocol Under the “Protocol” column.
|
||||
|
||||
@ -166,7 +166,7 @@ Open the traces in [Microsoft Network Monitor 3.4](troubleshoot-tcpip-netmon.md)
|
||||
|
||||
- Check if we are connecting successfully to this Dynamic port successfully.
|
||||
|
||||
- The filter should be something like this: tcp.port==<dynamic-port-allocated> and ipv4.address==<server-ip>
|
||||
- The filter should be something like this: `tcp.port==<dynamic-port-allocated>` and `ipv4.address==<server-ip>`
|
||||
|
||||
|
||||
|
||||
|
||||
@ -91,7 +91,7 @@ Universal apps that you can distribute in the provisioning package can be line-o
|
||||
|
||||
6. In the **Available customizations** pane, click the **LicenseProductId** that you just added.
|
||||
|
||||
7. For **LicenseInstall**, click **Browse**, navigate to the license file that you renamed *<file name>*.**ms-windows-store-license**, and select the license file.
|
||||
7. For **LicenseInstall**, click **Browse**, navigate to the license file that you renamed *\<file name>*.**ms-windows-store-license**, and select the license file.
|
||||
|
||||
[Learn more about distributing offline apps from the Microsoft Store for Business.](/microsoft-store/distribute-offline-apps)
|
||||
|
||||
|
||||
@ -103,7 +103,7 @@ Universal apps that you can distribute in the provisioning package can be line-o
|
||||
|
||||
6. In the **Available customizations** pane, click the **LicenseProductId** that you just added.
|
||||
|
||||
7. For **LicenseInstall**, click **Browse**, navigate to the license file that you renamed *<file name>*.**ms-windows-store-license**, and select the license file.
|
||||
7. For **LicenseInstall**, click **Browse**, navigate to the license file that you renamed *\<file name>*.**ms-windows-store-license**, and select the license file.
|
||||
|
||||
[Learn more about distributing offline apps from the Microsoft Store for Business.](/microsoft-store/distribute-offline-apps)
|
||||
|
||||
|
||||
@ -44,7 +44,7 @@ icd.exe /Build-ProvisioningPackage /CustomizationXML:<path_to_xml> /PackagePath:
|
||||
| /CustomizationXML | No | Specifies the path to a Windows provisioning XML file that contains the customization assets and settings. For more information, see Windows provisioning answer file. |
|
||||
| /PackagePath | Yes | Specifies the path and the package name where the built provisioning package will be saved. |
|
||||
| /StoreFile | No</br></br></br>See Important note. | For partners using a settings store other than the default store(s) used by Windows Configuration Designer, use this parameter to specify the path to one or more comma-separated Windows settings store file. By default, if you don't specify a settings store file, the settings store that's common to all Windows editions will be loaded by Windows Configuration Designer.</br></br></br>**Important** If you use this parameter, you must not use /MSPackageRoot or /OEMInputXML. |
|
||||
| /Variables | No | Specifies a semicolon separated <name> and <value> macro pair. The format for the argument must be <name>=<value>. |
|
||||
| /Variables | No | Specifies a semicolon separated `<name>` and `<value>` macro pair. The format for the argument must be `<name>=<value>`. |
|
||||
| Encrypted | No | Denotes whether the provisioning package should be built with encryption. Windows Configuration Designer auto-generates the decryption password and includes this information in the output.</br></br></br>Precede with + for encryption or - for no encryption. The default is no encryption. |
|
||||
| Overwrite | No | Denotes whether to overwrite an existing provisioning package.</br></br></br>Precede with + to overwrite an existing package or - if you don't want to overwrite an existing package. The default is false (don't overwrite). |
|
||||
| /? | No | Lists the switches and their descriptions for the command-line tool or for certain commands. |
|
||||
|
||||
@ -68,8 +68,8 @@ The user agent string for the browser cannot be modified. By default, the string
|
||||
|
||||
`Mozilla/5.0 (Windows Phone 10.0; Android 4.2.1; <Manufacturer>; <Device>) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.135 Mobile Safari/537.36 Edge/12.10166`
|
||||
|
||||
- <Manufacturer> is automatically replaced with the OEM name. This is the same as the PhoneManufacturer setting value that is set as part of the customization Phone metadata in DeviceTargetingInfo.
|
||||
- <Device> is replaced with the device name or phone name. This is the same as the PhoneModelName setting value that is set as part of the customization Phone metadata in DeviceTargetingInfo.
|
||||
- `<Manufacturer>` is automatically replaced with the OEM name. This is the same as the PhoneManufacturer setting value that is set as part of the customization Phone metadata in DeviceTargetingInfo.
|
||||
- `<Device>` is replaced with the device name or phone name. This is the same as the PhoneModelName setting value that is set as part of the customization Phone metadata in DeviceTargetingInfo.
|
||||
|
||||
|
||||
**Limitations and restrictions:**
|
||||
|
||||
@ -338,7 +338,7 @@ By default, this string has the format WindowsPhoneMMS/MicrosoftMMSVersionNumber
|
||||
| ADDR | Specify the absolute MMSC URL. The possible values to configure the ADDR parameter are:</br></br>- A Uniform Resource Identifier (URI)</br>- An IPv4 address represented in decimal format with dots as delimiters</br>- A fully qualified Internet domain name |
|
||||
| APPID | Set to `w4`. |
|
||||
| MS | (optional) Specify the maximum size of MMS, in KB. If the value is not a number, or is less than or equal to 10, it will be ignored and outgoing MMS will not be resized. |
|
||||
| NAME | (optional) Enter user–readable application identity. This parameter is also used to define part of the registry path for the APPLICATION parameters. The possible values to configure the **NAME** parameter are:</br></br>- Character string containing the name</br>- no value specified</br></br>If no value is specified, the registry location will default to <unnamed>. If **NAME** is greater than 40 characters, it will be truncated to 40 characters. |
|
||||
| NAME | (optional) Enter user–readable application identity. This parameter is also used to define part of the registry path for the APPLICATION parameters. The possible values to configure the **NAME** parameter are:</br></br>- Character string containing the name</br>- no value specified</br></br>If no value is specified, the registry location will default to `<unnamed>`. If **NAME** is greater than 40 characters, it will be truncated to 40 characters. |
|
||||
| TONAPID | Specify the network access point identification name (NAPID) defined in the provisioning file. This parameter takes a string value. It is only possible to refer to network access points defined within the same provisioning file (except if the INTERNET attribute is set in the NAPDEF characteristic). For more information about the NAPDEF characteristic, see [NAPDEF configuration service provider](https://msdn.microsoft.com/windows/hardware/commercialize/customize/mdm/napdef-csp). |
|
||||
| TOPROXY | Specify one logical proxy with a matching PROXY-ID. It is only possible to refer to proxies defined within the same provisioning file. Only one proxy can be listed. The TO-PROXY value must be set to the value of the PROXY ID in PXLOGICAL that defines the MMS specific-proxy. |
|
||||
|
||||
|
||||
@ -58,7 +58,7 @@ On a test machine:
|
||||
1. **Install the Microsoft Store for Business application you previously added** to your image.
|
||||
2. **Pin these apps to the Start screen**, by typing the name of the app, right-clicking and selecting **Pin to Start**.
|
||||
3. Open Windows PowerShell with administrator privileges.
|
||||
4. Use `Export-StartLayout -path <path><file name>.xml` where *<path><file name>* is the path and name of the xml file your will later import into your Windows Image.
|
||||
4. Use `Export-StartLayout -path <path><file name>.xml` where *\<path>\<file name>* is the path and name of the xml file your will later import into your Windows Image.
|
||||
5. Copy the XML file you created to a location accessible by the machine you previously used to add Store applications to your image.
|
||||
|
||||
Now, on the machine where your image file is accessible:
|
||||
|
||||
@ -188,7 +188,7 @@ To work around this, click the **App Reliability** tab above the results to see
|
||||
#### Clicking "See all…" from the App Reliability Events blade followed by clicking an app from the expanded list results in raw records instead of the App Reliability view
|
||||
To work around this, replace all of the text in the Log Search query box with the following:
|
||||
|
||||
*DHAppReliability | where AppFileDisplayName == "<Name of app as it appeared in the list>"*
|
||||
*DHAppReliability | where AppFileDisplayName == "\<Name of app as it appeared in the list>"*
|
||||
|
||||
For example:
|
||||
|
||||
|
||||
@ -27,8 +27,8 @@ Use the following information to deploy feature updates during a maintenance win
|
||||
1. In the Configuration Manager console, choose **Assets and Compliance> Device Collections**.
|
||||
2. In the **Device Collections** list, select the collection for which you intended to deploy the feature update(s).
|
||||
3. On the **Home** tab, in the **Properties** group, choose **Properties**.
|
||||
4. In the **Maintenance Windows** tab of the <collection name> Properties dialog box, choose the New icon.
|
||||
5. Complete the <new> Schedule dialog.
|
||||
4. In the **Maintenance Windows** tab of the `<collection name>` Properties dialog box, choose the New icon.
|
||||
5. Complete the `<new>` Schedule dialog.
|
||||
6. Select from the Apply this schedule to drop-down list.
|
||||
7. Choose **OK** and then close the **\<collection name\> Properties** dialog box.
|
||||
|
||||
|
||||
@ -26,8 +26,8 @@ The following table provides information about common errors you might run into
|
||||
| 0x80242006 | WU_E_UH_INVALIDMETADATA | A handler operation could not be completed because the update contains invalid metadata. | Rename Software Redistribution Folder and attempt to download the updates again: <br>Rename the following folders to \*.BAK: <br>- %systemroot%\system32\catroot2 <br><br>To do this, type the following commands at a command prompt. Press ENTER after you type each command.<br>- Ren %systemroot%\SoftwareDistribution\DataStore \*.bak<br>- Ren %systemroot%\SoftwareDistribution\Download \*.bak<br>Ren %systemroot%\system32\catroot2 \*.bak |
|
||||
| 0x80070BC9 | ERROR_FAIL_REBOOT_REQUIRED | The requested operation failed. A system reboot is required to roll back changes made. | Ensure that we do not have any policies that control the start behavior for the Windows Module Installer. This service should not be hardened to any start value and should be managed by the OS. |
|
||||
| 0x80200053 | BG_E_VALIDATION_FAILED | NA | Ensure that there is no Firewalls that filter downloads. The Firewall filtering may lead to invalid responses being received by the Windows Update Client.<br><br>If the issue still persists, run the [WU reset script](https://gallery.technet.microsoft.com/scriptcenter/Reset-Windows-Update-Agent-d824badc). |
|
||||
| 0x80072EE2 | WININET_E_TIMEOUT | The operation timed out | This error message can be caused if the computer isn't connected to Internet. To fix this issue, following these steps: make sure these URLs are not blocked: <br> http://<em>.update.microsoft.com<br>https://</em>.update.microsoft.com <br><http://download.windowsupdate.com> <br><br>Additionally , you can take a network trace and see what is timing out. <Refer to Firewall Troubleshooting scenario> |
|
||||
| 0x80072EFD <br>0x80072EFE <br>0x80D02002 | TIME OUT ERRORS | The operation timed out | Make sure there are no firewall rules or proxy to block Microsoft download URLs. <br>Take a network monitor trace to understand better. <Refer to Firewall Troubleshooting scenario> |
|
||||
| 0x80072EE2 | WININET_E_TIMEOUT | The operation timed out | This error message can be caused if the computer isn't connected to Internet. To fix this issue, following these steps: make sure these URLs are not blocked: <br> http://<em>.update.microsoft.com<br>https://</em>.update.microsoft.com <br><http://download.windowsupdate.com> <br><br>Additionally , you can take a network trace and see what is timing out. \<Refer to Firewall Troubleshooting scenario> |
|
||||
| 0x80072EFD <br>0x80072EFE <br>0x80D02002 | TIME OUT ERRORS | The operation timed out | Make sure there are no firewall rules or proxy to block Microsoft download URLs. <br>Take a network monitor trace to understand better. \<Refer to Firewall Troubleshooting scenario> |
|
||||
| 0X8007000D | ERROR_INVALID_DATA | Indicates invalid data downloaded or corruption occurred. | Attempt to re-download the update and initiate installation. |
|
||||
| 0x8024A10A | USO_E_SERVICE_SHUTTING_DOWN | Indicates that the WU Service is shutting down. | This may happen due to a very long period of time of inactivity, a system hang leading to the service being idle and leading to the shutdown of the service. Ensure that the system remains active and the connections remain established to complete the upgrade. |
|
||||
| 0x80240020 | WU_E_NO_INTERACTIVE_USER | Operation did not complete because there is no logged-on interactive user. | Please login to the system to initiate the installation and allow the system to be rebooted. |
|
||||
|
||||
@ -142,7 +142,7 @@ Therefore, Windows Setup failed because it was not able to migrate the corrupt f
|
||||
27:00, Info [0x0803e5] MIG Not unmapping HKCU\Software\Classes; it is not mapped
|
||||
27:00, Info [0x0803e5] MIG Not unmapping HKCU; it is not mapped
|
||||
27:00, Info SP ExecuteProgress: Elapsed events:1 of 4, Percent: 12
|
||||
27:00, Info [0x0802c6] MIG Processing GATHER for migration unit: <System>\UpgradeFramework (CMXEAgent)
|
||||
27:00, Info [0x0802c6] MIG Processing GATHER for migration unit: <System>\UpgradeFramework (CMXEAgent)
|
||||
27:08, Error SP Error READ, 0x00000570 while gathering/applying object: File, C:\ProgramData\Microsoft\Crypto\RSA\S-1-5-18 [CN]. Will return 0[gle=0x00000570]
|
||||
27:08, Error MIG Error 1392 while gathering object C:\ProgramData\Microsoft\Crypto\RSA\S-1-5-18 [CN]. Shell application requested abort![gle=0x00000570]
|
||||
27:08, Info SP ExecuteProgress: Elapsed events:2 of 4, Percent: 25
|
||||
|
||||
@ -179,5 +179,5 @@ Error creating or updating registry key: **CommercialId** at **HKLM:\SOFTWARE\Mi
|
||||
>
|
||||
> Then run the Enterprise Config script (RunConfig.bat) again.
|
||||
>
|
||||
> If the script still fails, then send mail to <strong>uasupport@microsoft.com</strong> including log files from the RunConfig.bat script. These log files are stored on the drive that is specified in the RunConfig.bat file. By default this is set to **%SystemDrive%\UADiagnostics**. The log file is named with the format **UA_yyyy_mm_dd_hh_mm_ss_machineID.txt**. There will be some additional logs generated under your **<system drive>\Windows\Temp** directory with the names similar to **AslLog_....txt**. You should send those logs as well.
|
||||
> If the script still fails, then send mail to <strong>uasupport@microsoft.com</strong> including log files from the RunConfig.bat script. These log files are stored on the drive that is specified in the RunConfig.bat file. By default this is set to **%SystemDrive%\UADiagnostics**. The log file is named with the format **UA_yyyy_mm_dd_hh_mm_ss_machineID.txt**. There will be some additional logs generated under your **\<system drive>\Windows\Temp** directory with the names similar to **AslLog_....txt**. You should send those logs as well.
|
||||
|
||||
|
||||
@ -193,7 +193,7 @@ The DSMA is a well-known user account type.
|
||||
It is a user neutral account that can be used to run processes that are either multi-user aware or user-agnostic.
|
||||
The DSMA is disabled by default on the desktop SKUs (full windows SKUs) and WS 2016 with the Desktop.
|
||||
|
||||
The DSMA has a well-known RID of 503. The security identifier (SID) of the DSMA will thus have a well-known SID in the following format: S-1-5-21-<ComputerIdentifier>-503
|
||||
The DSMA has a well-known RID of 503. The security identifier (SID) of the DSMA will thus have a well-known SID in the following format: S-1-5-21-\<ComputerIdentifier>-503
|
||||
|
||||
The DSMA is a member of the well-known group **System Managed Accounts Group**, which has a well-known SID of S-1-5-32-581.
|
||||
|
||||
|
||||
@ -182,7 +182,7 @@ The User Portal and Mobile Application web services need to communicate with the
|
||||
|
||||
1. Open **Active Directory Users and Computers**.
|
||||
2. In the navigation pane, expand the node with the organization’s Active Directory domain name. Right-click the **Users** container, select **New**, and select **User**.
|
||||
3. In the **New Object – User** dialog box, type **PFWSDK_<computerName>** in the **First name** and **User logon name** boxes, where *<computer>* is the name of the primary MFA server running the Web Services SDK. Click **Next**.
|
||||
3. In the **New Object – User** dialog box, type **PFWSDK_\<computerName>** in the **First name** and **User logon name** boxes, where *\<computer>* is the name of the primary MFA server running the Web Services SDK. Click **Next**.
|
||||
4. Type a strong password and confirm it in the respective boxes. Clear **User must change password at next logon**. Click **Next**. Click **Finish** to create the user account.
|
||||
|
||||
#### Add the MFA SDK user account to the Phonefactor Admins group
|
||||
@ -192,7 +192,7 @@ Adding the WebServices SDK user account to the Phonefactor Admins group provides
|
||||
1. Open **Active Directory Users and Computers**.
|
||||
2. In the navigation pane, expand the node with the organization’s Active Directory domain name. Select **Users**. In the content pane. Right-click the **Phonefactor Admins** security group and select Properties.
|
||||
3. Click the Members tab.
|
||||
4. Click **Add**. Click **Object Types..** Type the PFWSDK_<computerName> user name in the **Enter the object names to select** box and then click **OK**.
|
||||
4. Click **Add**. Click **Object Types..** Type the PFWSDK_\<computerName> user name in the **Enter the object names to select** box and then click **OK**.
|
||||
* The computer account for the primary MFA Server
|
||||
* The Webservices SDK user account
|
||||
* Group or user account that will manage the User Portal server.
|
||||
@ -507,7 +507,7 @@ Sign in the primary AD FS server with _local administrator_ equivalent credentia
|
||||
|
||||
Sign in the primary AD FS server with _local administrator_ equivalent credentials.
|
||||
|
||||
Edit the **Register-MultiFactorAuthenticationAdfsAdapter.ps1** script adding `-ConfigurationFilePath <path>` to the end of the `Register-AdfsAuthenticationProvider` command where **<path>** is the full path to the **MultiFactorAuthenticationAdfsAdapter.config** file.
|
||||
Edit the **Register-MultiFactorAuthenticationAdfsAdapter.ps1** script adding `-ConfigurationFilePath <path>` to the end of the `Register-AdfsAuthenticationProvider` command where **\<path>** is the full path to the **MultiFactorAuthenticationAdfsAdapter.config** file.
|
||||
|
||||
### Run the AD FS Adapter PowerShell cmdlet
|
||||
|
||||
|
||||
@ -182,7 +182,7 @@ The User Portal and Mobile Application web services need to communicate with the
|
||||
|
||||
1. Open **Active Directory Users and Computers**.
|
||||
2. In the navigation pane, expand the node with the organization’s Active Directory domain name. Right-click the **Users** container, select **New**, and select **User**.
|
||||
3. In the **New Object – User** dialog box, type **PFWSDK_<computerName>** in the **First name** and **User logon name** boxes, where *<computer>* is the name of the primary MFA server running the Web Services SDK. Click **Next**.
|
||||
3. In the **New Object – User** dialog box, type **PFWSDK_\<computerName>** in the **First name** and **User logon name** boxes, where *\<computer>* is the name of the primary MFA server running the Web Services SDK. Click **Next**.
|
||||
4. Type a strong password and confirm it in the respective boxes. Clear **User must change password at next logon**. Click **Next**. Click **Finish** to create the user account.
|
||||
|
||||
#### Add the MFA SDK user account to the Phonefactor Admins group
|
||||
@ -192,7 +192,7 @@ Adding the WebServices SDK user account to the Phonefactor Admins group provides
|
||||
1. Open **Active Directory Users and Computers**.
|
||||
2. In the navigation pane, expand the node with the organization’s Active Directory domain name. Select **Users**. In the content pane. Right-click the **Phonefactors Admin** security group and select Properties.
|
||||
3. Click the Members tab.
|
||||
4. Click **Add**. Click **Object Types..** Type the PFWSDK_<computerName> user name in the **Enter the object names to select** box and then click **OK**.
|
||||
4. Click **Add**. Click **Object Types..** Type the PFWSDK_\<computerName> user name in the **Enter the object names to select** box and then click **OK**.
|
||||
* The computer account for the primary MFA Server
|
||||
* The Webservices SDK user account
|
||||
* Group or user account that will manage the User Portal server.
|
||||
@ -507,7 +507,7 @@ Sign in the primary AD FS server with _local administrator_ equivalent credentia
|
||||
|
||||
Sign in the primary AD FS server with _local administrator_ equivalent credentials.
|
||||
|
||||
Edit the **Register-MultiFactorAuthenticationAdfsAdapter.ps1** script adding `-ConfigurationFilePath <path>` to the end of the `Register-AdfsAuthenticationProvider` command where **<path>** is the full path to the **MultiFactorAuthenticationAdfsAdapter.config** file.
|
||||
Edit the **Register-MultiFactorAuthenticationAdfsAdapter.ps1** script adding `-ConfigurationFilePath <path>` to the end of the `Register-AdfsAuthenticationProvider` command where **\<path>** is the full path to the **MultiFactorAuthenticationAdfsAdapter.config** file.
|
||||
|
||||
### Run the AD FS Adapter PowerShell cmdlet
|
||||
|
||||
|
||||
@ -515,7 +515,7 @@
|
||||
##### [Planning and deploying advanced security audit policies](auditing/planning-and-deploying-advanced-security-audit-policies.md)
|
||||
##### [Advanced security auditing FAQ](auditing/advanced-security-auditing-faq.md)
|
||||
###### [Which editions of Windows support advanced audit policy configuration](auditing/which-editions-of-windows-support-advanced-audit-policy-configuration.md)
|
||||
###### [How to list XML elements in <EventData>](auditing/how-to-list-xml-elements-in-eventdata.md)
|
||||
###### [How to list XML elements in \<EventData>](auditing/how-to-list-xml-elements-in-eventdata.md)
|
||||
|
||||
###### [Using advanced security auditing options to monitor dynamic access control objects](auditing/using-advanced-security-auditing-options-to-monitor-dynamic-access-control-objects.md)
|
||||
####### [Monitor the central access policies that apply on a file server](auditing/monitor-the-central-access-policies-that-apply-on-a-file-server.md)
|
||||
|
||||
@ -41,7 +41,7 @@ MpCmdRun.exe [command] [-options]
|
||||
| Command | Description |
|
||||
|:--------------------------------------------------------------------------------------------------------|:-------------------------------------------------------------------------------------------------------|
|
||||
| \-? **or** -h | Displays all available options for this tool |
|
||||
| \-Scan [-ScanType #] [-File <path> [-DisableRemediation] [-BootSectorScan]] [-Timeout <days>] [-Cancel] | Scans for malicious software |
|
||||
| \-Scan [-ScanType #] [-File \<path> [-DisableRemediation] [-BootSectorScan]] [-Timeout \<days>] [-Cancel] | Scans for malicious software |
|
||||
| \-Trace [-Grouping #] [-Level #] | Starts diagnostic tracing |
|
||||
| \-GetFiles | Collects support information |
|
||||
| \-GetFilesDiagTrack | Same as Getfiles but outputs to temporary DiagTrack folder |
|
||||
@ -49,11 +49,11 @@ MpCmdRun.exe [command] [-options]
|
||||
| \-RemoveDefinitions [-DynamicSignatures] | Removes only the dynamically downloaded Security intelligence |
|
||||
| \-RemoveDefinitions [-Engine] | Restores the previous installed engine |
|
||||
| \-SignatureUpdate [-UNC \| -MMPC] | Checks for new Security intelligence updates |
|
||||
| \-Restore [-ListAll \| [[-Name <name>] [-All] \| [-FilePath <filePath>]] [-Path <path>]] | Restores or lists quarantined item(s) |
|
||||
| \-Restore [-ListAll \| [[-Name \<name>] [-All] \| [-FilePath \<filePath>]] [-Path \<path>]] | Restores or lists quarantined item(s) |
|
||||
| \-AddDynamicSignature [-Path] | Loads dynamic Security intelligence |
|
||||
| \-ListAllDynamicSignatures | Lists the loaded dynamic Security intelligence |
|
||||
| \-RemoveDynamicSignature [-SignatureSetID] | Removes dynamic Security intelligence |
|
||||
| \-CheckExclusion -path <path> | Checks whether a path is excluded |
|
||||
| \-CheckExclusion -path \<path> | Checks whether a path is excluded |
|
||||
|
||||
## Related topics
|
||||
|
||||
|
||||
@ -83,7 +83,7 @@ Open the Intune management portal either by searching for Intune on https://port
|
||||
1. Description: *Optional*
|
||||
1. OMA-URI: **./Vendor/MSFT/Defender/SharedSignatureRoot**
|
||||
1. Data type: **String**
|
||||
1. Value: **\\<sharedlocation>\wdav-update\** (see the [Download and unpackage](#download-and-unpackage-the-latest-updates) section for what this will be)
|
||||
1. Value: **\\<sharedlocation\>\wdav-update\** (see the [Download and unpackage](#download-and-unpackage-the-latest-updates) section for what this will be)
|
||||
1. Click **Ok** to close the details blade, then **OK** again to close the **Custom OMA-URI Settings** blade. Click **Create** to save the new profile. The profile details page now appears.
|
||||
1. Click **Assignments**. The **Include** tab is automatically selected. In the drop-down menu, select **Selected Groups**, then click **Select groups to include**. Click the **VDI test VMs** group and then **Select**.
|
||||
1. Click **Evaluate** to see how many users/devices will be impacted. If the number makes sense, click **Save**. If the number doesn’t make sense, go back to the groups blade and confirm the group contains the right users or devices.
|
||||
@ -94,7 +94,7 @@ Open the Intune management portal either by searching for Intune on https://port
|
||||
1. In the **Group Policy Management Editor** go to **Computer configuration**.
|
||||
1. Click **Administrative templates**.
|
||||
1. Expand the tree to **Windows components > Windows Defender Antivirus > Security Intelligence Updates**
|
||||
1. Double-click Define security intelligence location for VDI clients and set the option to Enabled. A field automatically appears, enter *\\<sharedlocation>\wdav-update *(see the [Download and unpackage](#download-and-unpackage-the-latest-updates) section for what this will be). Click **OK**.
|
||||
1. Double-click Define security intelligence location for VDI clients and set the option to Enabled. A field automatically appears, enter *\\<sharedlocation\>\wdav-update *(see the [Download and unpackage](#download-and-unpackage-the-latest-updates) section for what this will be). Click **OK**.
|
||||
1. Deploy the GPO to the VMs you want to test.
|
||||
|
||||
#### Use PowerShell to enable the shared security intelligence feature:
|
||||
|
||||
@ -57,8 +57,7 @@ The table in this section lists the main Windows Defender Antivirus event IDs an
|
||||
|
||||
|
||||
|
||||
<style type='text/css'> table.oridealign td,th { vertical-align: top; text-align: left; } </style>
|
||||
<table class="oridealign">
|
||||
<table>
|
||||
<tr>
|
||||
<th colspan="2" >Event ID: 1000</th>
|
||||
</tr>
|
||||
@ -2716,7 +2715,7 @@ This section provides the following information about Windows Defender Antivirus
|
||||
Use the information in these tables to help troubleshoot Windows Defender Antivirus error codes.
|
||||
|
||||
|
||||
<table class="oridealign">
|
||||
<table>
|
||||
<tr>
|
||||
<th colspan="2">Error code: 0x80508007</th>
|
||||
</tr>
|
||||
@ -2916,7 +2915,7 @@ The following error codes are used during internal testing of Windows Defender A
|
||||
If you see these errors, you can try to [update definitions](manage-updates-baselines-windows-defender-antivirus.md) and force a rescan directly on the endpoint.
|
||||
|
||||
|
||||
<table class="oridealign">
|
||||
<table>
|
||||
<tr>
|
||||
<th colspan="3">Internal error codes</th>
|
||||
</tr>
|
||||
|
||||
@ -75,5 +75,5 @@ Note that "ResetPolicyId" reverts a supplemental policy to a base policy, and re
|
||||
|
||||
### Merging policies
|
||||
|
||||
When merging, the policy type and ID of the leftmost/first policy specified is used. If the leftmost is a base policy with ID <ID>, then regardless of what the GUIDS and types are for any subsequent policies, the merged policy will be a base policy with ID <ID>.
|
||||
When merging, the policy type and ID of the leftmost/first policy specified is used. If the leftmost is a base policy with ID \<ID>, then regardless of what the GUIDS and types are for any subsequent policies, the merged policy will be a base policy with ID \<ID>.
|
||||
|
||||
|
||||
@ -65,7 +65,7 @@ If you do not have a code signing certificate, see the [Optional: Create a code
|
||||
` Add-SignerRule -FilePath $InitialCIPolicy -CertificatePath <Path to exported .cer certificate> -Kernel -User –Update`
|
||||
|
||||
> [!NOTE]
|
||||
> <Path to exported .cer certificate> should be the full path to the certificate that you exported in step 3.
|
||||
> \<Path to exported .cer certificate> should be the full path to the certificate that you exported in step 3.
|
||||
Also, adding update signers is crucial to being able to modify or disable this policy in the future.
|
||||
|
||||
6. Use [Set-RuleOption](https://docs.microsoft.com/powershell/module/configci/set-ruleoption) to remove the unsigned policy rule option:
|
||||
|
||||
@ -27,7 +27,7 @@ Dynamic Code Security is not enabled by default because existing policies may no
|
||||
Additionally, a small number of .NET loading features, including loading unsigned assemblies built with System.Reflection.Emit, are not currently supported with Dynamic Code Security enabled.
|
||||
Microsoft recommends testing Dynamic Code Security in audit mode before enforcing it to discover whether any new libraries should be included in the policy.
|
||||
|
||||
To enable Dynamic Code Security, add the following option to the <Rules> section of your policy:
|
||||
To enable Dynamic Code Security, add the following option to the `<Rules>` section of your policy:
|
||||
|
||||
```xml
|
||||
<Rule>
|
||||
|
||||
Loading…
x
Reference in New Issue
Block a user