From 2efba68974ecce297716f273393859f0972062ef Mon Sep 17 00:00:00 2001 From: greg-lindsay Date: Fri, 5 Mar 2021 11:28:12 -0800 Subject: [PATCH] alt text --- .../mandatory-user-profile.md | 12 +- .../diagnose-mdm-failures-in-windows-10.md | 10 +- windows/client-management/mdm/euiccs-csp.md | 30 --- .../client-management/mdm/euiccs-ddf-file.md | 206 +----------------- .../mdm/policy-csp-timelanguagesettings.md | 4 +- .../set-up-and-test-cortana-in-windows-10.md | 4 +- windows/configuration/images/Shared_PC_1.jpg | Bin 0 -> 40769 bytes .../set-up-shared-or-guest-pc.md | 28 +-- .../deploy-a-windows-10-image-using-mdt.md | 111 +++++----- .../deployment/update/media-dynamic-update.md | 3 - .../update/servicing-stack-updates.md | 7 +- .../update/update-compliance-get-started.md | 3 - .../update/waas-delivery-optimization.md | 9 +- .../update/waas-manage-updates-wufb.md | 9 +- .../update/windows-update-resources.md | 2 +- .../usmt-recognized-environment-variables.md | 12 +- ...ctive-directory-based-activation-client.md | 16 -- .../windows-10-subscription-activation.md | 1 - .../hello-feature-pin-reset.md | 4 +- .../hello-hybrid-key-whfb-settings-policy.md | 4 +- .../change-history-for-threat-protection.md | 2 +- windows/security/threat-protection/index.md | 6 +- .../mbsa-removal-and-guidance.md | 6 +- ...llect-diagnostic-data-update-compliance.md | 2 +- .../collect-diagnostic-data.md | 2 +- ...-arguments-microsoft-defender-antivirus.md | 2 +- ...-reference-microsoft-defender-antivirus.md | 2 +- ...scan-types-microsoft-defender-antivirus.md | 2 +- ...irst-sight-microsoft-defender-antivirus.md | 2 +- ...out-period-microsoft-defender-antivirus.md | 2 +- ...nteraction-microsoft-defender-antivirus.md | 2 +- ...exclusions-microsoft-defender-antivirus.md | 2 +- ...exclusions-microsoft-defender-antivirus.md | 2 +- ...-overrides-microsoft-defender-antivirus.md | 2 +- ...e-microsoft-defender-antivirus-features.md | 2 +- ...onnections-microsoft-defender-antivirus.md | 2 +- ...ifications-microsoft-defender-antivirus.md | 2 +- ...exclusions-microsoft-defender-antivirus.md | 2 +- ...n-features-microsoft-defender-antivirus.md | 2 +- ...protection-microsoft-defender-antivirus.md | 2 +- ...emediation-microsoft-defender-antivirus.md | 2 +- ...exclusions-microsoft-defender-antivirus.md | 2 +- ...iate-scans-microsoft-defender-antivirus.md | 2 +- ...ediate-scans-windows-defender-antivirus.md | 2 +- ...age-report-microsoft-defender-antivirus.md | 2 +- .../deploy-microsoft-defender-antivirus.md | 2 +- ...oyment-vdi-microsoft-defender-antivirus.md | 2 +- ...anted-apps-microsoft-defender-antivirus.md | 2 +- ...protection-microsoft-defender-antivirus.md | 2 +- .../evaluate-microsoft-defender-antivirus.md | 2 +- ...c-scanning-microsoft-defender-antivirus.md | 2 +- ...ed-updates-microsoft-defender-antivirus.md | 2 +- ...-endpoints-microsoft-defender-antivirus.md | 2 +- ...e-schedule-microsoft-defender-antivirus.md | 2 +- ...-baselines-microsoft-defender-antivirus.md | 2 +- ...evices-vms-microsoft-defender-antivirus.md | 2 +- ...rosoft-defender-antivirus-compatibility.md | 18 +- ...rosoft-defender-antivirus-in-windows-10.md | 2 +- ...fender-antivirus-on-windows-server-2016.md | 2 +- .../microsoft-defender-offline.md | 2 +- ...soft-defender-security-center-antivirus.md | 2 +- ...office-365-microsoft-defender-antivirus.md | 2 +- ...ecurity-settings-with-tamper-protection.md | 2 +- ...nteraction-microsoft-defender-antivirus.md | 2 +- ...rt-monitor-microsoft-defender-antivirus.md | 2 +- ...ined-files-microsoft-defender-antivirus.md | 2 +- ...an-results-microsoft-defender-antivirus.md | 2 +- .../run-scan-microsoft-defender-antivirus.md | 2 +- ...h-up-scans-microsoft-defender-antivirus.md | 2 +- ...tion-level-microsoft-defender-antivirus.md | 2 +- ...osoft-defender-antivirus-when-migrating.md | 2 +- ...oubleshoot-microsoft-defender-antivirus.md | 2 +- .../troubleshoot-reporting.md | 2 +- ...oup-policy-microsoft-defender-antivirus.md | 2 +- ...ig-manager-microsoft-defender-antivirus.md | 2 +- ...ll-cmdlets-microsoft-defender-antivirus.md | 2 +- .../use-wmi-microsoft-defender-antivirus.md | 2 +- ...protection-microsoft-defender-antivirus.md | 2 +- .../configure-md-app-guard.md | 7 +- .../faq-md-app-guard.md | 82 +++---- .../install-md-app-guard.md | 2 +- .../test-scenarios-md-app-guard.md | 2 +- ...Onboard-Windows-10-multi-session-device.md | 2 +- .../access-mssp-portal.md | 6 +- .../add-or-remove-machine-tags.md | 4 +- .../advanced-features.md | 4 +- ...nced-hunting-assignedipaddress-function.md | 4 +- .../advanced-hunting-best-practices.md | 4 +- ...dvanced-hunting-devicealertevents-table.md | 4 +- .../advanced-hunting-deviceevents-table.md | 4 +- ...hunting-devicefilecertificateinfo-table.md | 4 +- ...advanced-hunting-devicefileevents-table.md | 4 +- ...ced-hunting-deviceimageloadevents-table.md | 4 +- .../advanced-hunting-deviceinfo-table.md | 4 +- ...dvanced-hunting-devicelogonevents-table.md | 4 +- ...anced-hunting-devicenetworkevents-table.md | 4 +- ...dvanced-hunting-devicenetworkinfo-table.md | 4 +- ...anced-hunting-deviceprocessevents-table.md | 4 +- ...nced-hunting-deviceregistryevents-table.md | 4 +- ...etvmsecureconfigurationassessment-table.md | 4 +- ...vmsecureconfigurationassessmentkb-table.md | 4 +- ...unting-devicetvmsoftwareinventory-table.md | 4 +- ...-devicetvmsoftwarevulnerabilities-table.md | 4 +- ...evicetvmsoftwarevulnerabilitieskb-table.md | 4 +- .../advanced-hunting-errors.md | 4 +- .../advanced-hunting-extend-data.md | 4 +- .../advanced-hunting-fileprofile-function.md | 2 +- .../advanced-hunting-go-hunt.md | 2 +- .../advanced-hunting-limits.md | 2 +- .../advanced-hunting-overview.md | 2 +- .../advanced-hunting-query-language.md | 2 +- .../advanced-hunting-query-results.md | 2 +- .../advanced-hunting-schema-reference.md | 2 +- .../advanced-hunting-shared-queries.md | 4 +- .../advanced-hunting-take-action.md | 4 +- ...lerts-queue-endpoint-detection-response.md | 4 +- .../microsoft-defender-atp/alerts-queue.md | 2 +- .../microsoft-defender-atp/alerts.md | 2 +- .../android-configure.md | 4 +- .../microsoft-defender-atp/android-intune.md | 4 +- .../microsoft-defender-atp/android-privacy.md | 4 +- .../android-support-signin.md | 4 +- .../microsoft-defender-atp/android-terms.md | 4 +- .../microsoft-defender-atp/api-explorer.md | 2 +- .../microsoft-defender-atp/api-hello-world.md | 2 +- .../api-microsoft-flow.md | 4 +- .../api-portal-mapping.md | 4 +- .../microsoft-defender-atp/api-power-bi.md | 4 +- .../api-release-notes.md | 10 +- .../api-terms-of-use.md | 4 +- .../microsoft-defender-atp/apis-intro.md | 6 +- .../assign-portal-access.md | 4 +- .../attack-simulations.md | 4 +- .../attack-surface-reduction-faq.md | 4 +- .../attack-surface-reduction.md | 4 +- .../audit-windows-defender.md | 4 +- .../auto-investigation-action-center.md | 4 +- .../automated-investigations.md | 4 +- .../automation-levels.md | 4 +- .../basic-permissions.md | 4 +- .../batch-update-alerts.md | 2 +- .../behavioral-blocking-containment.md | 4 +- .../check-sensor-status.md | 4 +- .../client-behavioral-blocking.md | 4 +- .../collect-investigation-package.md | 4 +- .../microsoft-defender-atp/community.md | 4 +- .../conditional-access.md | 4 +- .../configure-arcsight.md | 4 +- .../configure-attack-surface-reduction.md | 4 +- ...re-automated-investigations-remediation.md | 4 +- .../configure-conditional-access.md | 4 +- .../configure-email-notifications.md | 4 +- .../configure-endpoints-gp.md | 4 +- .../configure-endpoints-mdm.md | 4 +- .../configure-endpoints-non-windows.md | 4 +- .../configure-endpoints-sccm.md | 4 +- .../configure-endpoints-script.md | 2 +- .../configure-endpoints-vdi.md | 4 +- .../configure-endpoints.md | 4 +- .../configure-machines-asr.md | 4 +- .../configure-machines-onboarding.md | 4 +- .../configure-machines-security-baseline.md | 4 +- .../configure-machines.md | 4 +- .../configure-microsoft-threat-experts.md | 4 +- .../configure-mssp-notifications.md | 4 +- .../configure-mssp-support.md | 4 +- .../configure-proxy-internet.md | 4 +- .../microsoft-defender-atp/configure-siem.md | 4 +- ...igure-vulnerability-email-notifications.md | 2 +- .../connected-applications.md | 4 +- .../contact-support-usgov.md | 2 +- .../microsoft-defender-atp/contact-support.md | 4 +- .../controlled-folders.md | 4 +- .../create-alert-by-reference.md | 4 +- .../custom-detection-rules.md | 4 +- .../custom-detections-manage.md | 4 +- .../customize-attack-surface-reduction.md | 4 +- .../customize-controlled-folders.md | 4 +- .../customize-exploit-protection.md | 4 +- .../data-retention-settings.md | 4 +- .../data-storage-privacy.md | 4 +- .../defender-compatibility.md | 4 +- ...nder-endpoint-false-positives-negatives.md | 4 +- .../delete-ti-indicator-by-id.md | 4 +- .../deployment-phases.md | 4 +- .../deployment-rings.md | 4 +- .../deployment-strategy.md | 4 +- .../device-timeline-event-flag.md | 4 +- .../edr-in-block-mode.md | 4 +- .../enable-attack-surface-reduction.md | 4 +- .../enable-controlled-folders.md | 4 +- .../enable-exploit-protection.md | 5 +- .../enable-network-protection.md | 4 +- .../enable-siem-integration.md | 2 +- .../microsoft-defender-atp/evaluate-atp.md | 6 +- .../evaluate-attack-surface-reduction.md | 4 +- .../evaluate-controlled-folder-access.md | 4 +- .../evaluate-exploit-protection.md | 4 +- .../evaluate-network-protection.md | 4 +- .../microsoft-defender-atp/evaluation-lab.md | 4 +- .../event-error-codes.md | 4 +- .../microsoft-defender-atp/event-views.md | 4 +- .../exploit-protection-reference.md | 4 +- .../exploit-protection.md | 4 +- .../exposed-apis-create-app-nativeapp.md | 2 +- .../exposed-apis-create-app-partners.md | 2 +- .../exposed-apis-create-app-webapp.md | 2 +- .../exposed-apis-full-sample-powershell.md | 2 +- .../exposed-apis-list.md | 2 +- .../exposed-apis-odata-samples.md | 2 +- .../feedback-loop-blocking.md | 2 +- .../fetch-alerts-mssp.md | 2 +- .../microsoft-defender-atp/files.md | 2 +- .../find-machines-by-ip.md | 2 +- .../find-machines-by-tag.md | 2 +- .../fix-unhealthy-sensors.md | 4 +- .../get-alert-info-by-id.md | 2 +- .../get-alert-related-domain-info.md | 2 +- .../get-alert-related-files-info.md | 4 +- .../get-alert-related-ip-info.md | 4 +- .../get-alert-related-machine-info.md | 4 +- .../get-alert-related-user-info.md | 4 +- .../microsoft-defender-atp/get-alerts.md | 4 +- .../get-all-recommendations.md | 4 +- .../get-all-vulnerabilities-by-machines.md | 4 +- .../get-all-vulnerabilities.md | 4 +- .../get-cvekbmap-collection.md | 4 +- .../get-device-secure-score.md | 6 +- .../get-discovered-vulnerabilities.md | 4 +- .../get-domain-related-alerts.md | 4 +- .../get-domain-related-machines.md | 4 +- .../get-domain-statistics.md | 4 +- .../get-exposure-score.md | 4 +- .../get-file-information.md | 4 +- .../get-file-related-alerts.md | 4 +- .../get-file-related-machines.md | 4 +- .../get-file-statistics.md | 4 +- .../get-installed-software.md | 4 +- .../get-investigation-collection.md | 4 +- .../get-investigation-object.md | 4 +- .../get-ip-related-alerts.md | 4 +- .../get-ip-statistics.md | 4 +- .../get-kbinfo-collection.md | 4 +- .../get-machine-by-id.md | 2 +- .../get-machine-group-exposure-score.md | 4 +- .../get-machine-log-on-users.md | 2 +- .../get-machine-related-alerts.md | 2 +- .../get-machineaction-object.md | 2 +- .../get-machineactions-collection.md | 2 +- .../get-machines-by-software.md | 2 +- .../get-machines-by-vulnerability.md | 2 +- .../microsoft-defender-atp/get-machines.md | 2 +- .../get-machinesecuritystates-collection.md | 2 +- .../get-missing-kbs-machine.md | 2 +- .../get-missing-kbs-software.md | 2 +- .../get-package-sas-uri.md | 2 +- .../get-recommendation-by-id.md | 2 +- .../get-recommendation-machines.md | 2 +- .../get-recommendation-software.md | 2 +- .../get-recommendation-vulnerabilities.md | 2 +- .../get-security-recommendations.md | 2 +- .../get-software-by-id.md | 2 +- .../get-software-ver-distribution.md | 2 +- .../microsoft-defender-atp/get-software.md | 2 +- .../get-started-partner-integration.md | 4 +- .../get-ti-indicators-collection.md | 2 +- .../get-user-information.md | 2 +- .../get-user-related-alerts.md | 4 +- .../get-user-related-machines.md | 4 +- .../get-vuln-by-software.md | 4 +- .../get-vulnerability-by-id.md | 4 +- .../microsoft-defender-atp/gov.md | 4 +- .../grant-mssp-access.md | 4 +- .../helpful-resources.md | 4 +- .../images/techniques-cmd.png | Bin 70612 -> 0 bytes .../images/techniques-hunting.png | Bin 40025 -> 0 bytes .../images/techniques-sha1.png | Bin 70616 -> 0 bytes .../images/timeline-columns.png | Bin 154819 -> 0 bytes ...port-export-exploit-protection-emet-xml.md | 4 +- .../import-ti-indicators.md | 2 +- .../indicator-certificates.md | 4 +- .../microsoft-defender-atp/indicator-file.md | 4 +- .../indicator-ip-domain.md | 4 +- .../indicator-manage.md | 4 +- ...ormation-protection-in-windows-overview.md | 4 +- .../information-protection-investigation.md | 4 +- .../initiate-autoir-investigation.md | 4 +- .../investigate-alerts.md | 4 +- .../investigate-behind-proxy.md | 4 +- .../investigate-domain.md | 4 +- .../investigate-files.md | 4 +- .../investigate-incidents.md | 4 +- .../microsoft-defender-atp/investigate-ip.md | 4 +- .../investigate-machines.md | 4 +- .../investigate-user.md | 4 +- .../microsoft-defender-atp/investigation.md | 4 +- .../ios-configure-features.md | 11 +- .../microsoft-defender-atp/ios-install.md | 4 +- .../microsoft-defender-atp/ios-privacy.md | 4 +- .../microsoft-defender-atp/ios-whatsnew.md | 36 --- .../microsoft-defender-atp/isolate-machine.md | 4 +- .../linux-exclusions.md | 4 +- .../linux-install-manually.md | 7 +- .../linux-install-with-ansible.md | 28 +-- .../linux-install-with-puppet.md | 32 +-- .../linux-preferences.md | 14 +- .../microsoft-defender-atp/linux-privacy.md | 4 +- .../microsoft-defender-atp/linux-pua.md | 4 +- .../microsoft-defender-atp/linux-resources.md | 4 +- .../linux-static-proxy-configuration.md | 4 +- .../linux-support-connectivity.md | 4 +- .../linux-support-install.md | 4 +- .../linux-support-perf.md | 4 +- .../microsoft-defender-atp/linux-updates.md | 4 +- .../live-response-command-examples.md | 4 +- .../microsoft-defender-atp/live-response.md | 6 +- .../microsoft-defender-atp/mac-exclusions.md | 4 +- .../mac-install-jamfpro-login.md | 4 +- .../mac-install-manually.md | 4 +- .../mac-install-with-jamf.md | 4 +- .../mac-install-with-other-mdm.md | 4 +- .../mac-jamfpro-device-groups.md | 4 +- .../mac-jamfpro-enroll-devices.md | 4 +- .../microsoft-defender-atp/mac-privacy.md | 4 +- .../microsoft-defender-atp/mac-pua.md | 4 +- .../microsoft-defender-atp/mac-resources.md | 4 +- .../mac-schedule-scan-atp.md | 4 +- .../mac-support-install.md | 4 +- .../mac-support-kext.md | 4 +- .../mac-support-license.md | 4 +- .../mac-support-perf.md | 4 +- .../mac-sysext-policies.md | 4 +- .../mac-sysext-preview.md | 4 +- .../microsoft-defender-atp/mac-updates.md | 4 +- .../microsoft-defender-atp/mac-whatsnew.md | 4 +- .../microsoft-defender-atp/machine-reports.md | 4 +- .../microsoft-defender-atp/machine-tags.md | 4 +- .../microsoft-defender-atp/machine.md | 4 +- .../microsoft-defender-atp/machineaction.md | 4 +- .../machines-view-overview.md | 4 +- .../microsoft-defender-atp/manage-alerts.md | 4 +- ...tp-post-migration-configuration-manager.md | 4 +- ...atp-post-migration-group-policy-objects.md | 4 +- .../manage-atp-post-migration-intune.md | 4 +- .../manage-atp-post-migration-other-tools.md | 4 +- .../manage-atp-post-migration.md | 4 +- .../manage-automation-file-uploads.md | 4 +- .../manage-automation-folder-exclusions.md | 4 +- .../microsoft-defender-atp/manage-edr.md | 4 +- .../manage-incidents.md | 4 +- .../manage-indicators.md | 4 +- .../manage-suppression-rules.md | 4 +- .../microsoft-defender-atp/management-apis.md | 4 +- .../mcafee-to-microsoft-defender-migration.md | 5 +- .../mcafee-to-microsoft-defender-onboard.md | 27 ++- .../mcafee-to-microsoft-defender-prepare.md | 31 ++- .../mcafee-to-microsoft-defender-setup.md | 104 +++++---- .../microsoft-cloud-app-security-config.md | 10 +- ...icrosoft-cloud-app-security-integration.md | 4 +- ...oft-defender-advanced-threat-protection.md | 4 +- .../microsoft-defender-atp-android.md | 4 +- .../microsoft-defender-atp-ios.md | 4 +- .../microsoft-defender-atp-linux.md | 6 +- .../microsoft-defender-atp-mac.md | 4 +- .../microsoft-defender-security-center.md | 4 +- .../microsoft-threat-experts.md | 4 +- .../migration-guides.md | 4 +- .../minimum-requirements.md | 4 +- .../microsoft-defender-atp/mssp-list.md | 4 +- .../microsoft-defender-atp/mssp-support.md | 4 +- .../network-protection.md | 4 +- .../next-gen-threat-and-vuln-mgt.md | 4 +- .../microsoft-defender-atp/non-windows.md | 4 +- .../offboard-machine-api.md | 4 +- .../offboard-machines.md | 4 +- .../onboard-configure.md | 4 +- .../onboard-downlevel.md | 4 +- .../onboard-offline-machines.md | 4 +- .../microsoft-defender-atp/onboard.md | 4 +- ...boarding-endpoint-configuration-manager.md | 4 +- .../onboarding-endpoint-manager.md | 4 +- .../onboarding-notification.md | 4 +- .../microsoft-defender-atp/onboarding.md | 4 +- .../overview-attack-surface-reduction.md | 4 +- .../overview-custom-detections.md | 4 +- .../overview-endpoint-detection-response.md | 4 +- .../overview-hardware-based-isolation.md | 4 +- .../partner-applications.md | 4 +- .../partner-integration.md | 4 +- .../microsoft-defender-atp/portal-overview.md | 4 +- .../post-ti-indicator.md | 4 +- .../preferences-setup.md | 4 +- .../prepare-deployment.md | 4 +- .../preview-settings.md | 4 +- .../microsoft-defender-atp/preview.md | 4 +- .../production-deployment.md | 4 +- .../pull-alerts-using-rest-api.md | 4 +- .../raw-data-export-event-hub.md | 2 +- .../raw-data-export-storage.md | 2 +- .../microsoft-defender-atp/raw-data-export.md | 2 +- .../microsoft-defender-atp/recommendation.md | 2 +- .../respond-file-alerts.md | 2 +- .../respond-machine-alerts.md | 2 +- .../restrict-code-execution.md | 6 +- .../microsoft-defender-atp/review-alerts.md | 2 +- .../run-advanced-query-api.md | 2 +- .../run-advanced-query-sample-powershell.md | 2 +- .../run-advanced-query-sample-python.md | 2 +- .../microsoft-defender-atp/run-av-scan.md | 2 +- .../run-detection-test.md | 4 +- .../microsoft-defender-atp/score.md | 4 +- .../security-operations-dashboard.md | 2 +- .../microsoft-defender-atp/service-status.md | 2 +- .../set-device-value.md | 6 +- .../microsoft-defender-atp/software.md | 6 +- .../stop-and-quarantine-file.md | 2 +- .../switch-to-microsoft-defender-onboard.md | 20 +- .../switch-to-microsoft-defender-prepare.md | 22 +- .../switch-to-microsoft-defender-setup.md | 30 +-- ...tec-to-microsoft-defender-atp-migration.md | 4 +- ...antec-to-microsoft-defender-atp-onboard.md | 26 +-- ...antec-to-microsoft-defender-atp-prepare.md | 22 +- ...ymantec-to-microsoft-defender-atp-setup.md | 10 +- .../techniques-device-timeline.md | 10 +- .../threat-analytics-analyst-reports.md | 4 +- .../threat-analytics.md | 4 +- .../threat-and-vuln-mgt-event-timeline.md | 4 +- .../threat-indicator-concepts.md | 4 +- .../threat-protection-integration.md | 4 +- .../threat-protection-reports.md | 4 +- .../microsoft-defender-atp/ti-indicator.md | 4 +- .../microsoft-defender-atp/time-settings.md | 4 +- .../troubleshoot-asr.md | 4 +- .../troubleshoot-collect-support-log.md | 4 +- ...bleshoot-exploit-protection-mitigations.md | 4 +- .../troubleshoot-live-response.md | 4 +- .../troubleshoot-mdatp.md | 4 +- .../microsoft-defender-atp/troubleshoot-np.md | 4 +- .../troubleshoot-onboarding-error-messages.md | 4 +- .../troubleshoot-onboarding.md | 4 +- .../troubleshoot-siem.md | 4 +- .../tvm-assign-device-value.md | 4 +- .../tvm-dashboard-insights.md | 4 +- .../tvm-end-of-support-software.md | 4 +- .../microsoft-defender-atp/tvm-exception.md | 4 +- .../tvm-exposure-score.md | 4 +- .../tvm-hunt-exposed-devices.md | 4 +- .../tvm-microsoft-secure-score-devices.md | 4 +- .../tvm-prerequisites.md | 4 +- .../microsoft-defender-atp/tvm-remediation.md | 4 +- .../tvm-security-recommendation.md | 4 +- .../tvm-software-inventory.md | 4 +- .../tvm-supported-os.md | 4 +- .../tvm-vulnerable-devices-report.md | 4 +- .../microsoft-defender-atp/tvm-weaknesses.md | 4 +- .../tvm-zero-day-vulnerabilities.md | 4 +- .../unisolate-machine.md | 4 +- .../unrestrict-code-execution.md | 4 +- .../microsoft-defender-atp/update-alert.md | 4 +- .../microsoft-defender-atp/use.md | 4 +- .../microsoft-defender-atp/user-roles.md | 6 +- .../microsoft-defender-atp/user.md | 4 +- .../view-incidents-queue.md | 4 +- .../microsoft-defender-atp/vulnerability.md | 4 +- .../web-content-filtering.md | 4 +- .../web-protection-monitoring.md | 4 +- .../web-protection-overview.md | 4 +- .../web-protection-response.md | 4 +- .../web-threat-protection.md | 4 +- .../whats-new-in-microsoft-defender-atp.md | 4 +- ...e-wdac-policy-for-fully-managed-devices.md | 4 +- .../ltsc/whats-new-windows-10-2019.md | 18 +- .../whats-new-windows-10-version-1709.md | 2 +- 473 files changed, 1100 insertions(+), 1434 deletions(-) create mode 100644 windows/configuration/images/Shared_PC_1.jpg delete mode 100644 windows/security/threat-protection/microsoft-defender-atp/images/techniques-cmd.png delete mode 100644 windows/security/threat-protection/microsoft-defender-atp/images/techniques-hunting.png delete mode 100644 windows/security/threat-protection/microsoft-defender-atp/images/techniques-sha1.png delete mode 100644 windows/security/threat-protection/microsoft-defender-atp/images/timeline-columns.png delete mode 100644 windows/security/threat-protection/microsoft-defender-atp/ios-whatsnew.md diff --git a/windows/client-management/mandatory-user-profile.md b/windows/client-management/mandatory-user-profile.md index b1ce6d51a9..211519bdec 100644 --- a/windows/client-management/mandatory-user-profile.md +++ b/windows/client-management/mandatory-user-profile.md @@ -82,30 +82,22 @@ First, you create a default user profile with the customizations that you want, 1. The sysprep process reboots the PC and starts at the first-run experience screen. Complete the set up, and then sign in to the computer using an account that has local administrator privileges. -1. Right-click **Start**, go to **Control Panel** (view by large or small icons) > **System** > **Advanced system settings**, and click **Settings** in the **User Profiles** section. Alternatively, starting in Windows 10, version 2004, open the **Settings** app and select **Advanced system settings**. - -Starting in Windows 10 version (2004) Open the Settings app and click on Advanced system settings +1. Right-click Start, go to **Control Panel** (view by large or small icons) > **System** > **Advanced system settings**, and click **Settings** in the **User Profiles** section. 1. In **User Profiles**, click **Default Profile**, and then click **Copy To**. - ![Example of UI](images/copy-to.png) 1. In **Copy To**, under **Permitted to use**, click **Change**. ![Example of UI](images/copy-to-change.png) -1. In **Select User or Group**, in the **Enter the object name to select** field, type `everyone` or the group of users that the profile will be assigned to, click **Check Names**, and then click **OK**. +1. In **Select User or Group**, in the **Enter the object name to select** field, type `everyone`, click **Check Names**, and then click **OK**. 1. In **Copy To**, in the **Copy profile to** field, enter the path and folder name where you want to store the mandatory profile. The folder name must use the correct [extension](#profile-extension-for-each-windows-version) for the operating system version. For example, the folder name must end with ".v6" to identify it as a user profile folder for Windows 10, version 1607. - If the device is joined to the domain and you are signed in with an account that has permissions to write to a shared folder on the network, you can enter the shared folder path. - - ![Example of UI](images/copy-to-path.png) - - If the device is not joined to the domain, you can save the profile locally and then copy it to the shared folder location. - - Optionally, you can check the **Mandatory profile** checkbox. This step is not required but will set permissions that are more restrictive and we recommend doing so. - ![Example of UI](images/copy-to-path.png) diff --git a/windows/client-management/mdm/diagnose-mdm-failures-in-windows-10.md b/windows/client-management/mdm/diagnose-mdm-failures-in-windows-10.md index 4f20ca31cd..db52ac149a 100644 --- a/windows/client-management/mdm/diagnose-mdm-failures-in-windows-10.md +++ b/windows/client-management/mdm/diagnose-mdm-failures-in-windows-10.md @@ -112,8 +112,8 @@ Example: Export the Debug logs ``` - -  +  -## Collect logs remotely from Windows 10 Holographic +## Collect logs remotely from Windows 10 Holographic or Windows 10 Mobile devices -For holographic already enrolled in MDM, you can remotely collect MDM logs through the MDM channel using the [DiagnosticLog CSP](diagnosticlog-csp.md). +For holographic or mobile devices already enrolled in MDM, you can remotely collect MDM logs through the MDM channel using the [DiagnosticLog CSP](diagnosticlog-csp.md). You can use the DiagnosticLog CSP to enable the ETW provider. The provider ID is 3DA494E4-0FE2-415C-B895-FB5265C5C83B. The following examples show how to enable the ETW provider: diff --git a/windows/client-management/mdm/euiccs-csp.md b/windows/client-management/mdm/euiccs-csp.md index 3cae935341..1f42e3e43d 100644 --- a/windows/client-management/mdm/euiccs-csp.md +++ b/windows/client-management/mdm/euiccs-csp.md @@ -38,36 +38,6 @@ Required. Indicates whether this eUICC is physically present and active. Updated Supported operation is Get. Value type is boolean. -**_eUICC_/PPR1Allowed** -Required. Indicates whether the download of a profile with PPR1 is allowed. If the eUICC already has a profile (regardless of its origin and policy rules associated with it), the download of a profile with PPR1 is not allowed. - -Supported operation is Get. Value type is boolean. - -**_eUICC_/PPR1AlreadySet** -Required. Indicates whether the eUICC already has a profile with PPR1. - -Supported operation is Get. Value type is boolean. - -**_eUICC_/DownloadServers** -Interior node. Represents default SM-DP+ discovery requests. - -Supported operation is Get. - -**_eUICC_/DownloadServers/_ServerName_** -Interior node. Optional. Node specifying the server name for a discovery operation. The node name is the fully qualified domain name of the SM-DP+ server that will be used for profile discovery. Creation of this subtree triggers a discovery request. - -Supported operations are Add, Get, and Delete. - -**_eUICC_/DownloadServers/_ServerName_/DiscoveryState** -Required. Current state of the discovery operation for the parent ServerName (Requested = 1, Executing = 2, Completed = 3, Failed = 4). Queried by the CSP and only updated by the LPA. - -Supported operation is Get. Value type is integer. Default value is 1. - -**_eUICC_/DownloadServers/_ServerName_/AutoEnable** -Required. Indicates whether the discovered profile must be enabled automatically after install. This must be set by the MDM when the ServerName subtree is created. - -Supported operations are Add, Get, and Replace. Value type is bool. - **_eUICC_/Profiles** Interior node. Required. Represents all enterprise-owned profiles. diff --git a/windows/client-management/mdm/euiccs-ddf-file.md b/windows/client-management/mdm/euiccs-ddf-file.md index 4101bc0f61..38bb8e5f6f 100644 --- a/windows/client-management/mdm/euiccs-ddf-file.md +++ b/windows/client-management/mdm/euiccs-ddf-file.md @@ -49,7 +49,7 @@ The XML below if for Windows 10, version 1803. - com.microsoft/1.2/MDM/eUICCs + com.microsoft/1.1/MDM/eUICCs @@ -58,7 +58,7 @@ The XML below if for Windows 10, version 1803. - Represents information associated with an eUICC. There is one subtree for each known eUICC, created by the Local Profile Assistant (LPA) when the eUICC is first seen. The node name is the eUICC ID (EID). The node name "Default" represents the currently active eUICC. + Represents information associated with an eUICC. There is one subtree for each known eUICC, created by the Local Profile Assistant (LPA) when the eUICC is first seen. The node name is meaningful only to the LPA (which associates it with an eUICC ID (EID) in an implementation-specific manner, e.g., this could be a SHA-256 hash of the EID). The node name "Default" represents the currently active eUICC. @@ -79,7 +79,7 @@ The XML below if for Windows 10, version 1803. - The EID. + Identifies an eUICC in an implementation-specific manner, e.g., this could be a SHA-256 hash of the EID. @@ -118,139 +118,6 @@ The XML below if for Windows 10, version 1803. - - PPR1Allowed - - - - - Indicates whether the download of a profile with PPR1 is allowed. If the eUICC already has a profile (regardless of its origin and policy rules associated with it), the download of a profile with PPR1 is not allowed. - - - - - - - - - - - text/plain - - - - - PPR1AlreadySet - - - - - Indicates whether the eUICC already has a profile with PPR1. - - - - - - - - - - - text/plain - - - - - DownloadServers - - - - - Represents default SM-DP+ discovery requests. - - - - - - - - - - - - - - - - - - - - - - - Node specifying the server name for a discovery operation. The node name is the fully qualified domain name of the SM-DP+ server that will be used for profile discovery. Creation of this subtree triggers a discovery request. - - - - - - - - - - ServerName - - - - - - DiscoveryState - - - - - 1 - Current state of the discovery operation for the parent ServerName (Requested = 1, Executing = 2, Completed = 3, Failed = 4). Queried by the CSP and only updated by the LPA. - - - - - - - - - - - text/plain - - - - - AutoEnable - - - - - - - Indicates whether the discovered profile must be enabled automatically after install. This must be set by the MDM when the ServerName subtree is created. - - - - - - - - - - - text/plain - - - - - Profiles @@ -278,7 +145,6 @@ The XML below if for Windows 10, version 1803. - Node representing an enterprise-owned eUICC profile. The node name is the ICCID of the profile (which is a unique identifier). Creation of this subtree triggers an AddProfile request by the LPA (which installs the profile on the eUICC). Removal of this subtree triggers the LPA to delete the profile (if resident on the eUICC). @@ -301,7 +167,6 @@ The XML below if for Windows 10, version 1803. - Fully qualified domain name of the SM-DP+ that can download this profile. Must be set by the MDM when the ICCID subtree is created. @@ -327,7 +192,6 @@ The XML below if for Windows 10, version 1803. - Matching ID (activation code token) for profile download. Must be set by the MDM when the ICCID subtree is created. @@ -392,70 +256,6 @@ The XML below if for Windows 10, version 1803. - - PPR1Set - - - - - This profile policy rule indicates whether disabling of this profile is not allowed (true if not allowed, false otherwise). - - - - - - - - - - - text/plain - - - - - PPR2Set - - - - - This profile policy rule indicates whether deletion of this profile is not allowed (true if not allowed, false otherwise). - - - - - - - - - - - text/plain - - - - - ErrorDetail - - - - - 0 - Detailed error if the profile download and install procedure failed (None = 0, CardGeneralFailure = 1, ConfirmationCodeMissing = 3, ForbiddenByPolicy = 5, InvalidMatchingId = 6, NoEligibleProfileForThisDevice = 7, NotEnoughSpaceOnCard = 8, ProfileEidMismatch = 10, ProfileNotAvailableForNewBinding = 11, ProfileNotReleasedByOperator = 12, RemoteServerGeneralFailure = 13, RemoteServerUnreachable = 14). - - - - - - - - - - - text/plain - - - diff --git a/windows/client-management/mdm/policy-csp-timelanguagesettings.md b/windows/client-management/mdm/policy-csp-timelanguagesettings.md index 8d2b01f4b1..8ef9349148 100644 --- a/windows/client-management/mdm/policy-csp-timelanguagesettings.md +++ b/windows/client-management/mdm/policy-csp-timelanguagesettings.md @@ -78,8 +78,7 @@ Specifies the time zone to be applied to the device. This is the standard Window -Value type is String. Supported values: -- Name of Standard Time Zone - for example, Pacific Standard Time, Mountain Standard Time. + @@ -102,3 +101,4 @@ Footnotes: - 8 - Available in Windows 10, version 2004. + diff --git a/windows/configuration/cortana-at-work/set-up-and-test-cortana-in-windows-10.md b/windows/configuration/cortana-at-work/set-up-and-test-cortana-in-windows-10.md index 55fc00aed5..da23d57297 100644 --- a/windows/configuration/cortana-at-work/set-up-and-test-cortana-in-windows-10.md +++ b/windows/configuration/cortana-at-work/set-up-and-test-cortana-in-windows-10.md @@ -19,7 +19,7 @@ ms.author: dansimp - **Cortana is regularly updated through the Microsoft Store.** Beginning with Windows 10, version 2004, Cortana is an appx preinstalled with Windows and is regularly updated through the Microsoft Store. To receive the latest updates to Cortana, you will need to [enable updates through the Microsoft Store](https://docs.microsoft.com/windows/configuration/stop-employees-from-using-microsoft-store). ## Set up and configure the Bing Answers feature -Bing Answers provides fast, authoritative results to search queries based on search terms. If you enable this policy setting for the Cortana Windows app or Microsoft Teams display, users can ask Cortana web-related questions such as “What’s the current weather?” or “What time is it in Tokyo?” +Bing Answers provides fast, authoritative results to search queries based on search terms. When the Bing Answers feature is enabled, users will be able to ask Cortana web-related questions in the Cortana in Windows app, such as "What's the current weather?" or "Who is the president of the U.S.?," and get a response, based on public results from Bing.com. The above experience is powered by Microsoft Bing, and Cortana sends the user queries to Bing. The use of Microsoft Bing is governed by the [Microsoft Services Agreement](https://www.microsoft.com/servicesagreement) and [Privacy Statement](https://privacy.microsoft.com/en-US/privacystatement). @@ -46,4 +46,4 @@ When a user enters a search query (by speech or text), Cortana evaluates if the Bing Answers is enabled by default for all users. However, admins can configure and change this for specific users and user groups in their organization. ## How the Bing Answer policy configuration is applied -Before a query is sent to Bing for a search of public results from Bing.com, the Bing Answers service checks with the Office Cloud Policy Service to see if there are any policy configurations that pertain to the user for allowing Bing Answers to respond to questions users ask Cortana. If the user is a member of an AAD group that is assigned that policy configuration, then the appropriate policy settings are applied and a check is made again in 10 minutes. +Before a query is sent to Bing for a search of public results from Bing.com, the Bing Answers service checks with the Office Cloud Policy Service to see if there are any policy configurations that pertain to the user for allowing Bing Answers to respond to questions users ask Cortana. If the user is a member of an AAD group that is assigned that policy configuration, then the appropriate policy settings are applied and a check is made again in 10 minutes. \ No newline at end of file diff --git a/windows/configuration/images/Shared_PC_1.jpg b/windows/configuration/images/Shared_PC_1.jpg new file mode 100644 index 0000000000000000000000000000000000000000..7b993b00a8918f4ad6e00522e458bfeea2927649 GIT binary patch literal 40769 zcmeFa2|SeT-Z(zCB>TRb3Qko8kqm~hWX%#nQ6~Eqld^APCrj4I zZe}FA8CeFi{O_LUInR0OocEmbod55AKfm95Xzouw?p#|o+hjA~{K4##C5)Ke84ILdVJ>B`38>2zjYOTn+m$)cQSfWnX&}_>_i@!qjXTZ zz<>8!Ma<1&|F5t5_S#rU#qI@~p@QBH?Gz(!pf;U8DuYM$r!K|k1EX4z zF7@zzQ@bCRc##Sk(q=$dY#1C`?Xc;Wbr)5c5nf=<8N4RvJf`lND#-HY#Qtzl1EmqV z+)EBdj~5~r(Tlws&<%UK=l}G}+5zmYZOoGekA$AQ$pCVqf&e7he}`x&(Vhw_Evp~5 zthW&&7!x3$m7+PJAF}3Fyj>(*BxXyEgh)j>6%w-v-|Eqf>V{Kfx~4K!BS*0# zl{;e3_m?`DOpoP%)YIIG{CY89gGT)fZ2mVwl|=1W7U4I#*!^|5OlGVsY_4l9UV z=(w$yq$=GdDE{?gV6ceDgVTJey~bwCy_R$AJVtbjH>jYqfs_i=YHl^sF}5Dj$$#SvkCE@ zhY87sWupTx6i?8-+%|LGxd_u%XWrq0HJ-=c4se*uCc3AUg@00cr(JaJd8=#HJMW<` za1q)cVGri^?V1okgdliH?Ab(vr3r=Xu2iNh|1iy)7e+ndaW8j_7)K}~#PulzA6zsJ z>l>fX+`U)ZL2|mxxJADuhspicyy$%`n+jBlGMIRH(tpjo;NH4n$Rvjnn%Sx{!&kDV zS4c*@DwQErg0q`9a0<*mfv8uZf^I{>^C?FLl+d9EouNy7Nxn%ekFXB3sAoI=BdQT8 zCq(mO$+^ldBT_As?_5IR`Z#Mt%uq1t03xgP;fTgF?kR}TNrtna;Seg(SV>5cu%sdKbYgqdk9{JacW1X4M3tVrGEt3>_TrZ z#ybR;!R=jFGmtIJCfqA=)Ql%JMqbtK9U*+%1_cN>$|Ps zXptSXmQ_()EUs3j_w?8?PqFxABtz|Sm_CjQ@^`K_pBg{yD0H>c*17%i`CHH$k#J8_ zLGUX$%?>S571tVywzHOV2?q11^QX=p#NJLesP5Hn9yoq)>+u_&>6n1yqrB_DwD_fO$j;X(O``b#ACv@MIE*2c+DCXArqRalwY=NO7D9W&^jZk92jyN%{ z#e%%qh-89soAji7+c_eTow91_aoRRQEjB=h{(6K+$}^fxR3O|W1AZD`n26Qbv#N1c zci^>UvgPybQ^(pgCog>Qg}`n5(01KHNv%;O$;>tShW#p@rGskfgJT#SRgP0BUrRh) zNZeXUhM&!lpzCKV(~mZgH$yo?x?u@K^6yGAm&vGU&gY?xv5 zgyj3AKAEbyVxJQRY|ll{-c4~HrIS|oYvo-=uv0S05)sd~azSuX^MLJ&dS_ zybhx<`VR0XU339IE_9bYyCZ?bSzBJMh+3X|${%BUJtqUFc6w>v;HGZ_ zDjU&g=i4WPJuXC?nzvoNxj+jo3X>TBV)xRv{iB-mYxa9Y&Yg!aI$U%_2Hv4)u$mvo zd-+2uF==SAza8{p_`?Ufm+sAQ>m3(3Jg^B_%HB}!LJ=mun`x}y4rQ!Oq2>@5Q)&;Iqlmi6TS7EKn2AV%tMJX`>;Dx?AavAIT9`#QGY&>qR6}frGkp0 zsURmyz%o!lV2Fb}1Lb3qNn~r-*9xT3K!$?Dwq`O-$||AN9w)NC-)^FuJ#ezjE`V|v zwmn)egbX3+<2Rc<@@!fS2zOGP#R#5Mkg4AEOA$6Aw$_oHRRDL%MbuxcK5mCu;hGcU z8x%gR-Gi#ua@u&}-0J&9dw=BOs9&qs3T3}&X$rm=q6h~E)U%>hr%PcAMc!ag~)*}wj6W5;;+ zPrKLvc;gdhl3P>MkqTmk8z2b!m@n@P5eGvEQo$BlJf{Zs9lL!77B$Cspqp*a;6l=7 z?u!Fq(=iDrdhXfT`n`6S*f#q(G?YjMl>`^KWz4NwIZQGhol%&Wf66UVD-pvcwAZpE z=la?6kiqLYxI=!&9zyx_cARCjQ@h+V;oy>|y1CTl8nSMC@@e2Ix^8NMEWY4|`q z`{9Ek0ohNrK@VlXCA_wDgW;eML%Kzk$@LG2r}=8ySNlv7FBY?nj-BxM0>U2aBpj8PNQBlH1icmSbsyWk}cs0UOwWvue`fJh#G6GzL2+&l3i{p`v`BgR0b9gE!_)f4B zXV%9Q`_+NGe5IT%0SMGDTN+(HjOt7@GDgQD5c715b=# zqafGJ-1N(~uIi4NxGLXeHyiCtM7@HqusKZkDt?^`3RAa34O@*W7sSqwynXesL}Lke z_)EU6-vut2#Us*mop9kDO`>fBg7!MmK)QUeT2?G&`&Ixsu`7wMO)Z>3@M{ijH5Ihs zP7YB&u%kqb+PRFM422u#43C|`Yp2g|2Xx)OTc~9#a)Y0Kisj`?v)%zC#x~#Y?$jNU z%0RWb4+>`6WTQxYAWI6i>@Z}S2Ry~H7h&B;Ox`LQg8Ys*dw17E`~ioQaq1hUn}uAe zuO}zA?77aIRi5IBq%(&T^N`h3xde_1E5q&3pSwmB<`Ye~rs-w;CJJ=NOcNT>2 z>Hx)rJK zLKcf(H*lLcMMPj$!cqjQ@hjmE^L<>-RgZrCJWgvHN6+~ZY{ZT^4d#H01JA+Xn#6iM zJ7yVms052*(ap0@h;yv8@y`=DTEedoQT#Uk_Lz5kz4H3XV_$lrejS8qhUktdP@k<8 zj_tFA$c?{0Bypy2C;6mXtgBm>J4F~j_+pB@r%}824X%GJf3NAp;2`JYaAg4#u{zUC zkSBC;bVqF#@}9l%ggPgtgRFbG|3F2;7rReFD#;Hc6X?^VTf81v*|m0mcENNn(O~V> zjdKu=M7!pmoO1-m;AP5(N2lk?r-H?c#8047XJ50Y_|j7vC)qXWh-of7!?h?ZlD|F0 zoWK}{G8q4Cbv@|BzKp0TyNOEqa3m1)3el8>Ly6u5{wo6|`UZCO^5UOIE!1yL+??i; zWC@BMr|?;9T#%+~2AnU{uw5gf_)Q8Mf@9vR@Z|*mKybDl`8h#4R;%nwoR^B(7tv#0 z-}DI`84IUaCv{-i$ zImJHWX7IL*5Fb=m)Bm|7DnGkx+S-yk;888RAZRK;@wk;?gUe^B1~4U5ebAE^qyul!6jLzC4_?v(js^N`#UJO74s&v{pvAs zda>ZN_wR#SCe*xPwgGzw4r+4+X&d)|PSCzF2K26px3%U-YZu=j!7}WYL&oY;xlP*y z+o+5by%kgY*R%`qR1mK^_iZ1iov@`sb!|J5nDb~E@xyUP>H_wv2OLIVa%-8Xpk5n1n8Gs%B|R$c zpF%cv88LTs(-7}0FXJ}*tqjvgt7Fw%J3FsPhDpSF&Ag(5_VHtoWNtJQ6*Lt!L@g!LtJWj7WhUsTpoXLlDkusFsS7@_Qsj6k1Zdg$3utBpEdGnsH@qm95G zQmtLMAoM848I$jwW7}WiaM$lyEi?QL%?XWWkWY}(9R1zZQ)%)?JL_oHv&ETs6rZ;1 zXff^|s@n#KmE0lf?OY&g!1X+F@{Ghs1KJr*s{KsUTfL;Vi|HYwC7zp_C2M9OzT%Ez zbj0KM84dXcp`i%*6(w((+cmv&<85U*>BTIaiXP+t4lI zSSyB4Dd7(%saB3qL0aY4`sQ2CM3`PFU%DkA+iJw>IRwNP?N>s*S{IY^oHlD&hF08R zN~QMepOQdjYE2atTIC!?&X;v)zJ`N#*n~gd6C6Bj8}k$se~k-mJdzELhg31hTADa+^^iT4YixE1$6_=WdU8z>^h zX|{&hyqLiE*|`fC(y1OrDZ^K``8C8d@gZnA&oW zW|0q(9UNI*9sx=&{788pA~WlxB4%m}m3lPn=~{dh;EMg#szBm$sDZ+S$66k(wEEzj z<)G4>VkVxJ7GNHYb!t<02S+J+gC7gIPlVx|qG_`HVjKs3*@Lyb%F>kfy?-or^ELRA zTO9Nz&O@on$DR&{7|zD{qB9+l;KgkGUJ~FimW|NrlwfPyOo5ZgOpNt9fk$H<(`R3zRmg)`< zpU~0T-UQueT1qKdsj?qE4HkjR;u%AWsi4nxts@MRABcFVQvbKZYJN9 zsd(}rg3a5k4@|qZP$NFo9RQS6-g#G3*1L2wX##s(B&Iw}%k;A1UX92{I~sHC$3U+c z{-4hG#D;?`4om+I1YH8r0)ibTo~D8Z4gxhu=Q7=ub6*{iAF{c^) z>zcjOefrl>qU6LnD(ErT8mMx@B-4qR*>f++xp78b{rWts>I5WB(It?3l{xr zb9Bk=D18!KC8W1fsZJs-UYWW|6A zLjgQHh1mr{T=$}ac#PLWfOl&xO|GKKSJ{8Q13V0rB~n4N3R7Sb-voj%zrOt^U$MiH zr&mW8YjE&gTk5l5Q$d!Kd!pY!zCc~s?@>YVKCMrwpr4SQL+K{20OXDSoxEmmEGI3- z-)Hc1boRbH)q)8pKj_O&UtkA-3>-y&fj*f2n|VThBJHPzwLcAMdd`A{Z=CW={>0La zI2-+GOI@YBV25Lun&?SgewP^4g*4xO2cb>l7kXR&Q+gLYcp&JEZeQGZb# zKl9h$s*a)A|9%erld`x=ivK=ku}ccTpzcZq;CuXyo!?bZ|EfQ-tDt^RP{#qUi{A$D zx^naM3H{pr%cw5{>P()zZw!u)w%+y-KA)#}RpFW6dC~h$Bl%LzQ-}tsf(KNP+!e&^ zdlR8e2Uk>i&Y*J!wicV%xWb2uf^)wn1|3}GzWOeF@!X{gE~h_}ozgA7A&0wkNz&0E z;L&6HP%@uPZ_o|XBg&Gzz39%CG~-<9!pJAuJf=D~w0Vpe{#efDm=Y)TB5Oot(7N}) zNFzNwy};_1_#VAWrEffL5~#Q$g>J8qBPz=%@gHm&CLfYzTEF*6Z*i_q?g+ZOkY!>k z#YuJB4(z6OR!&@&6M&A$y zzaTXxD-gqs*fV|fpsJ)Z#N${E%Z<=}m$e;3)w=D*;mHLzCZoNDZz6*CUwzf;yEe0Xo&$8piTj$(4}@koDXp*|(cSGr~diL`#hUY2~}qdMi~k=g@_)p>32 zXs;^hGU%P?wgAdJkK$`&W5dM@S(Nb++yZ{yS34XPu4BWAn&!w1BM+Hp@O_&?oI?oEVvmF zVsl_XU0_16=b>j|S949*^l__vbxD)aj+?2jAR2v6A=)^pl>bshw4>&AGL8?@;uOl>G`V^+)Ya zF8jzlO`ggQJwW6~nZIj7(KCz?vkSh#3`u`>Tq$D|ZvCFosdd7|p;u z`$|VdL!(nwa{dBBgTI|WueVc`uhH|yQ@rPDi!@zc+(zVpTr~t^UOdTesh>~G+gP5w z5WKq6R(h<#l1uOK*?@VPeKbF3dAGz@%qv(BA)y~z@M{f`wbX}y|o?oQ`_FR&tlizrbm+gMyE4DBciPbQ>*#B@z zY}Ky+;qW;b59!c%f>x|w%)k#h*gOk8T1Gxml6Mq|Dy^3)W7`)jpXl{cJ~8vgN+3IQ zZ;Pip%LaZ}6ei|h=*R46la~|STwK_us;2E~!I4&?iDFRao|5%E5m4 zanB7_ulbMX-z=*x4j&MKPd28!SbEvRNWy^MQWnb=1C< zU#A5LO1(6DHbN2|T$e>)X411s644Ecvm@ix+wtUybk;_0A?Iz#bP%P=_ctC~p;bA;!F7tOsZ1*zw1E&sv_)g( zcNnb@vsoxPqFn(jS%;kBD+UQx($~1NY;fo^WOOAcgCi$Yv~%#q+CU``m?|dS<7r^dl@SEXR zM+#mh4sjaV^dp-5i6nj^HIA}>-gV1js(mWy-gB@qo>zf+7?c~iIDP?Xs zqZh!>*;&Q!uwR6?t*zN`3L24em>7iZ(rMJkM^?^`=)8ZB2}D4mC? zQ`W$ubGT+Rbj9U0!>8&t>qJ{p2JVEqm_1#;eOfq3`v0;^CYczBsnKnoVEwcfDQ;7R zZ^?FNvUIj-I-D?aTFaEipZ?bM2v;T%_d+1vNq__*gjY(~IX>VQut$&0Lb)Fj%eL(I zjVzerPE@_O-F)W%?e)pXckHw!wW{#D(2xhiK!ZLI2YQ^06)V1I0SUp}v)t+L)ZH!@ z2OmGVRyX~rJCX{bdx(m(5e=Sj%8%r4^16$3?1gJ*KTY(y-L~`YKEx@ zKV*x^hb~YKe3~X8nhdVXZEy0(AY0D&>jepoppA6Dnx> z${>27-G$8e={_;Wm>ARM`w_8v=6huF`gaGgWH!CVb7&C=q)Ld_K{n`1fGn?*O}N@8 zEaVBqY%9@{_-_4XuQqSkQy_ywV|nR&_QM6pezch+rKejpdt?k7(mzq+YKV$G(Ecu- zp2KHvv&}D#;hwT_Wi0spor>(aT3&+atMT=cf&op*PwH)VUKkIl$~EqPxw;n;=^f~* zV5J&b%SdEw9?3|GdXEv6x?CH#GG=8dqvm7iHSzLw8cqXg>*X47>G=G^4s0Zt5-a~Xn>>_yMY+5!#lhbc;k2E8=oR`_QizI*`@c^_yW=z=gqX3zEjzi|Tl%>+9T z&8eU>Vj)zJ-xKY(L|Hf>zO!-2wbEAToQ~;*Yasrc>3<>EJF6X}vqWUim0yy(baz706 z%S@o(k@P=16IZxFI(X~JwO^4bMUtpgg%DJV03tl2f`l-@z6F281Qo>6kAF{jtO4}3 z(*UW%9drfaxkbo#^r*#Podpn`7OhkeEjP(t^H6UzsTrWONvTB z^bz+*Z0i4r=|W+OU^d2%yw?j%p_K*yK=fbPB`C)O0jS91<$%D)=>VyMl0*u9HnI12 zWXpf2SRwe&jFbG!IMII@=MR+s*T<>&u7LhJP9LH{KMlxin0`mq6_OLcr$4Z)?jM;* zHsm|k-S|xq5ST-~h*_E61ObVUot<3c`*(|p#e`#%nZ_?L;kJI+CX zz5Z*V*u~E-eh`tn^7XT^*p-W2x!9G9zjdN^b=va0>rN=yLIfJ4qz2c{1-ki_NI|izoGHEZ!0*ai1%E+$J=_6f0 zEs*wq#AVu#z%`6gD&$vr@8tinV*QuW%)OTwJfThOBM3}c!z4E(q}l+>-@hJ;u?#7V zHmE9>5%w7z=ebxuwTZfVFP@McQF~yRq(&}->w0)%x?Gxy3^CsJ+NB}c&my*@IIUbVl56yU74uBcP=*Aw(OKt<{6fk5W0a!g_8|7hu#x_eFzJ@4Zkr&Wjc$F ziMcNMM5QK*tBVM2xiw94s%zoEbd&)LQ&f)6yT-=(jmo>4=NzVW20NQQjs%Qt-ZZ!c zOWp{sCSJiKr;tHPH74pB9w__!T@MOAWOd{S%fPUwFK7uBc}NiA_uD3ccFu%v1#a9R zek&l3Vx>ai;9OX+i-<$%po32~F~MM;!Qsi7Q3=I!y=h1nO`1Euj%kMIG&OvyWEMf`1ladS!R#^_kQFDP0v(S zP*^AQcFtSE^@ScEY?s|Tx2N&OH)cWR71n+c9PhmEO@t5PlzJ0ooAS_6q<0wxgy(!y z$;pJm(VaV!9!-ps_a^jj_HQ0ihd@-N)Nke!ksG!H>+JjBs)=U^C-6WmWi|Vq(o%~` z%dqP&E;_~nk=Luv>0@R+Vn2<1f0E@PBvc4GDoGd$Q>t+_r+vdQC*)ZYE@J1#)!Etn zPHoCIeC2S;PmgJa+dW54LO(_;Kx)yighG_Oqtjl@NNo;%OaBEUI;mY^xY;bvF!DNS z_8a%k!d7pNn{N5`?m)XZ`Xgii2l0{O^3TBjE8qN8urj_S?lgW&H=40-?KLnP^SYAD zBgBsl=$MCV2LzV;e;cv zCf^tL$uow;>%b0pY0-sL(4;sO6rKqLblJf`N%Q2+G=gBVexrRT#tBl~5@MTgGi*;0 zCfG&rwcIJIs=_Zn-Bjs0kM?8k%3+&%yv*}JaGBVUm;p|EH=%FcITu~M7p{5=mWPA5i zitD-bx$vdq6gR^i7cdnBfiO_cQW}5_nBoYC890#MU=f1=rLgEtU~^+^&QJ43Y%S;^ zza>G+6sVwY-|*0B@Mm+xs;@k$`xycg*b3Bxc~G{%B$FTKS6etvant|1PeJ~{Q~sYc z51h>+UF;!=I7@g(UNNjhTfUw;>cp&*d4AdO#kQFx((zBvqfRu!L?iWmGn-7>m1oXXSb1-^U+ z+o^L0+oY6$1K?-9u}GHB^NHKClOcu6JjF@Q1hIz_T*p4+N)bYkQh@wFk|P=Y4-i`j zAOZZf06h8}sO{P!$^(4_N6}jleu`Z?S#h>M#sP_cPHHu12&*a&f@P>(xYR?9(P{T8i?(C6V zskqOy9X^Zr`-A=f&`-jFqJlK+Nsu2VbB+CyUp*@G-g=-HjOt#n+da6u84oLqY<1>EmD6e^NcVq+_r@Dn3*`uw5Hu z-yaeEFTrL^{85tX5Wh<3*?%mdz+Q6E4be-T2oj0Jzs0!0NB1jR|A_LR_2qZA_T~8_ z54{C{Afmr%8vUUDuKvJK+h}|`{s%SU_p5SVRmt7q7?~Y$o=Ej19JdPS8{|)MxNtu- z&pdi!k*3fVgIMgxL`T?w6V37HW+;cv@L4rW{Ta*ROR*rfeec;ivo)z8i=BHj6EYp1 z&R@gs1YA8V;mVSKSYUtDRCp^M;lIWnvaRosBGM=O&}mOhmc8s1$HWsI;45{cpogvM zP2Pfs4Ze+Ao*x-^$=tbyTohql3r<0ix|0#V=!D2Ws%V|xOh_#X;0u}L-?gIl&y11b z^n*pXto)lLL;S=Tzgei&kY5=g<}Vg7{TITW|4p@;eF9EF00;d&4fHFi{xYxMNG1Lk z)AqNd`cZ=%7W#V{1WNpwpZ-;Q_m83b-M;?{-CqpHKZWkUGTi?Ry1%a<|I?uRzf>2H z?f)IMy4?%t@jtJ6$p4cT1F%i(ga3|J1MC{#ojUgLx}fr@DxS)T2X$P!Y1~?gh|s zhe#TIPmvaZ>NznFnOoO2VQZ)oB?zZO%At}Z+=T(z66pge`VNvMPtWHcQ5ia;OE^3g zzG^sn0@0#EEQ{JeY@4%sd>JlPDOHR-5?6g&Iy-H+WZH8$$}k``u)y@CvvhMw{?fb$ zgkk*&ngcG0_svBpl-E@EEzKmE&VTF;FvL2Qpft!x#B?x`ol-Z5-acxUYSw+TFX~{L zr5mJkTV2?-@v@5t@74jJ1oDg8k1Ix#zZYiy-VHI`{ke>CA*5w;XCJT(OD|klQ2FEH z5V;-x>(^uTR8TpV46OVz#lHf+`O0TQbHtp~;9Xs>E!+-!3vfu=wLw&|ur%BmzrJiY zFw^&`$s#j&_13ed*6CNS*McOD%`%}<+m}zGxChX7zyWDwl!4)s+QUy85-kU<52TgG z8p?hc7aCW(V`9a{sLm$SsOeWnd;$ZuS8VGYU_I6o%@p$tXQUx^C;b(5x5jiZ*h&0q9XSqijHUjmma5F@@O-HulQ_I}4 z%3vLxNK!K>;N*%C(Q@kIh-#C@@s>*T6L&C|(?%)x+-jEx%Y%$CadFmM0cHW~Y`>FZ zu7yZ5I)pDd+aOH(Rrw` zT&`By9M&^&UQV_+_hG8T+q<_tP0wsCJT(*8e9e9YkA6~;-2Hjfh(JG5GFCa@CArp- zqtx{^#8B1A<)a4+n-{?#cpi6+fU2{6QWbWmva-iT%rf|H+sDBkuBPqj_54K0yQ&SSb|GF|#3>+nJp{_5slh3*KM#ORM_a~P6!#a3WmU5 zD#1F-G;Jn$-7CiW=xRB^GJ+kNZYmsU(^;Eh@w0x{czeM!U8@Klb4anYIM>2iz#CE8uJ&_?l{Yc=u-i}qhePrxG`AjiI z5*B#5-&X}L-CrPID7z>>Y0Pih+kVdNvHt}ZE6iIxaSfRQVk&;H6`L58tXorA@iz7( zuBxQ={q^@2V>4{P9Dn53ux846j zD0W{S?899y*rLK|F+`dZ{|1ETB7_S_aZy3c3-6rRlGGKtzRarP`N^H|gjW`KB=IcwGt@ruzL<%5dAvw=bMFX9)YWOwo!xJ{ zEUY9)xCzbSZtdNeu=ycJEA_)|XReUQ%@(0sTH;5Zs!ii!9TA*x7PJe$qvk=pM`VdS zz4d&v@YS-Cl7RV%xdCT$l?xf-xPXo!It}1V3m1|#LHsISwIRoyxj?^BQ({2<%(nY< zqQX&b{d-(S@ANp@?;Xh-^|b!9rW-&yGQr-nzh4;GI;CIuxbXPRuiX{!SYNxkHo+-d z|7$|o4alWXl8B4@!ssZ9ZIT%{EoCfCP;S!pFnh5y-B-v%mg{C-r-03a=u+pBhFaPA zU@aS8TTTIoAt)6vn)*mx>R%JiEEP`ImOt9+pvcwLP}bq!pY+Xzow(TqVbUK zsqbQ3&9yx&_Hd9;%{;_U!j8FZg_MxT8MWJ;B9bA=Q7NUH$ za;R2fe&R@J&^~QDjrf9ht_qbpk#r~N#=O26&x7fTYtG_CvzzEVPZ_dSwrtzewI$qQ zD;fiDe3H1mZQEnSD49i!yMlLV?&fnSJN0TKH_P6a>3uDS)uleqxTA?`)6?V)&O*a0 z{>CH;JR}tE31oEHU^_N|g%1tR%{glEv|nkVB*Y-uD$Eq#SCAE&+>L??SB z=Xx~Xhx`2>a_5fCDGr~a6Kk7}*|e*L_wC&%)NKIj8%m(`&=HGSFvofUq<*76EFF)t z9PJFPDibh$boOBD=slPS-Dxr9H}LZWcHkgFSmB)#VyxtPdh9XA0&U+ zZjYU8tVwXsF@-K4LAz};B7DjfRw@;#Q*ceEN3Kq71>3!O{> zBV|EEUj0N8#C2V%H+Jmz$p(znlI(K9mt>lYIqwgwe)c;a#UyyJMoqgPtk+j?_e)Lr zz^&k8k?s$*60VFVgIJK)89>ngn>NpR)6D_%z69*M<(Z&-y zHL;RxZ4kW57HeR+p*D218iI97j=VBevWT5LPY`VsJcM7U*phVt=byG(in{WuDxj#2 z-Vp|9|4HEFk|&cPXqI)pB0M>LZ?z%L>GHn14BESk$pW6w?|)Pjr~g*vzmfz9;loK@ z`?5-%qT742GbfsQtSqc`#7-JT@Lu-{&zyqN0Oz=52Oq6g!}uH-J=c5mSq7hJehIgf z#CEKnL|m-fhu3?EjCB_Ljq*%$z~L(sNU;|g*9t$sj_`^#f4+W4BKF#<-l6J_jgLU! z-kIPr*i8lLA3!-f668luP(gqjUA15bxSvmla)GM-wnlae@a^3BRX3L{ek`P3{=+Ni z;ttR+qFRU8*z>(#dg%wDkxTX%5aCy0@y^R$R^0@bN6Nv5{r1z4h)c0aK%#)EZd?!54ehsD17`dJIQj+1s#}C=QQDk-*QNL~6W1K3}nGMJB zhx2e?WyN}!fG(@ALhgKfK;c0&>XBT4SmQ~c|HAhkq@lKWL_>N+LneQL=(5caJt_YU z0Qvm`=o-I#C1m=S$E65pO6Zqv@>coxs3azXq6$DR0uBS24;JWybAP%Q@WZFJyx|}D7qgIKi!^A z5i-Of$ebO&ppkbyt9MSPcTRT*Ke@&Xu7%Ekhs#mh%!y;@wk`P|ZvC$?F1<|=ruf@# zc90r(RC$3u7+0XN1}sSh{Y0Q>q5}lza9PupL#%YQ63qsabu)!^Gr`bCM9)#*EyQ!g z9V~iQ4(bZzx~9=T-VEeoSbw12cE9~vI`H|O*zAjAW@LtrW#}%cf9H%{QtwLj|0<~l z^#30fc&6r`Q{X?|4=C{LT?G!9%v}Y(YpZu{HIB6FmhHM_|G)!BZhd$4v4E=|PkcoX z#!0ov(@(;5HZcY>$xb=NT7_u=R#_h|Yi;_88nJnELtTDZPsA6f_XP>IWU4D&P3yn3 zIu7rgzpcEW)t4I{_r%n(1JyRI$p!OTX@Ii8Wz(QRmgA610VB7sJQX#fJ-%L8V_&zH ziQ1PjZr+|zcJFJ?<*eK*ktY`8Yp2q}WsVyGD{k7-WMC6BzVAoR#+&E;;UvRfil1qX zlUT2}*GhgvwmZwTk3DiRSG85QV=Mr<+=&>10JUO?(s@?fI+4(3aJ* zf6ol7?fvp%gYvDN@!m4A`$X>SUk=Zu12+gY`R>P;M&@bp^l16qW^LDY6O6iQcDml$ zaQr&k-bJl~@Z8KCYsF5Q=&@`{z>)D^d)uBB8_^o;Yl9?t{$qZT{cF$CkJ~qvzG{vv zBfCMr{CY4kjr5qbOQjQzJ#3OsQyhMtoa-JPI3Y|RCpPHIN?i)r5T3i6US9oa;?nuY z`m0MeQ?&MUi{yrc+Ee80L&Rjf$HsAj@B)Nm*&V@W0j-~gCF)1-sJPKt?cdjM@YrVw zk^9~pFUc7HYHiB+i{#|wsRK7jMGfcvw>M!^3&x{%klmwr0p zzCB&Y_S#XYx61ee^mtn^&Tc_w*N<-spFkC8 z3QrjN;5Qpp&5r9ma8pTimUw@m`Nij^j0CAzy)Mwh0kbez<3>C2%9P~_*RYf3{)CC0 z#vvJ}9E(<4^>^a$To_C^5{;@8to$c(ohHjv>kU~y&z24ODwoAJnnoT9Sniu}z($HZ z&AM~$;L)eL-BH1Q8uPK`K9)GM$4XF9n0^DlMV4|muVt5ehPH^jgoi>?-p7fX0eQ#T zbT!3*PpzvVvT+ctp#&Kf zzeW__+2bIlIIu3<%}MOrUR|AN@UfPY=R1>lQQ>I1+L_cXkGG5hyh}FH#Gxrf1cbF# zj2K7ZMsgEXMqIefhg;>6?c8rmepz8$e3!o8mN{-9vUZJTotI~P;!~?R+#27KN;qpw z^k!Hn3t!vWyDswta-iW2+o;Lo=OdTA?UZPSdu=>3NN~Jn(F0s)`e4Es?8ptaD%k-S zmPZjr=*jDJtm!8&JIQ09OIr9HoMw$?495Dx>guwzK|@K)3pZz;-T)d{Mhx#Qk*KRF z#WeH4K`}PIBS^+#Du|z*-4HvVk1QsKPCPMBYPS10DLqcV8VEF36rjV9CG3re!0j&| zW3ZDPaxva6nN-l-6R}K!tYt60EVJ+gjFykE8D@gKN)BNb%zgO@DoC6>>s-=Cyh3^3 zx{UquQr0bL8!4mq&-*!_>h7r)#@a2t!WZ_*^TRIpx10fUj(i?#kaNa9w;Ubcn|xC^ z6Dlh)9zk38m4{~Sp0+H!W=D$TSki;IiKc@sU?JgmTnE((*PU&?%p}<<9y2lzv$F*@ z-gm0Rqn3Q|=$0h;&~;IH%Sr@Mw?K#rGA=6bzjwVld|c;Z+Qd1oQ&VClh8I8^UIvYW z)eG0iudCTp;Rge;&J#uN>)+S&cA9n2M|_Os;N}dP(360dcbB+Qga@nDa((+P8ZC%J zO~;*FVUC0IhD=srW`<>Dc9L=?=8wXJQw7`V+g`KZORLtzZS)bf*`v7|IAJeV*4-W^ z$c^|!Hg^?YdC$OEO-PMo!!mX@6jP*qKOtE)*%xr<2#2a9yxz4OO6qH9_a2tTX-GUf z6Zr+jm{9kc-8$_ZTngJI-l{43cBokN46B)LZK#2>=Uq&CJo_0|r~fCqG#NAwNrvbb zNABUgp-p#kN;*H@(g4tm%r4u&NiuJKU2mz5D-$M{Zs4e(;lyT(^~uMz$Cmrmbu)5y z#L@<@G6F>ShT>I zmL=(<&cpAY=u)tcH*G}KOS)GS=2=+I`7P8XsjljT1`K!_8zO>|r+lWTk`RZK#K_Z! zq*-=%A+5_sM|=!`{?!FV8T?B0& z)Jlo7@7XhLzp7G&giy!lZDxj^vsG1~q(4w#p{GK<0T%YXS)%^;Sk~*lB0VvZ^TOo3 zGH{`YtseIEuMt*%f24zfQA5srItD~xKi|u|IF349tTsz(q-?9Sirj0rhM-o0i9s5V~I-$=irx*2~cu< zcoyY~-}oTt)E8>Dbonr(mDOWzusNf=jv&&!ru)f741sf|9H2i?h%fqDpTcjna!cPn zTj17xn&%XbnU>JJwTwEQ-rA6xpV2`ae>p{U2R0qLddn=B$*02l`*2SYJtAWPYVAsU zS9V;o1oZ8;Iv!;7GK>6+=^JT~y{HUy{PD@&pCAXW8GO(@gpc};uhYKz2r(>`w0_tM zbx$T&D6bzjciTEiaCr{#ermXFz`<)bLF}OZOo8d35}HHf&?9Qoe5=LGVxb?wiST8U zp$R@EaV_JbyzBOmx#_U!EAnxJO!W}HH@Ye%zie_>z8{e53w`n$sb0s~gwJzs?feA{ zE;Q<>(NSL0zNlTaPeY;oMiNZ^o@}+iU@r~_fGpGiEeW&=+-B=#^l<2v&5T%WI zM`fY9+Bcjh5AG(@WoPag7PCBp15&5h{L`;yPt<*d^!f;C8HBUd>d-`T(z!aKbST-X zk@3mW#zVNcD9_(LPZtDW<`h>8cl@;l1OB;-W8VS0hVQiKCOk@=N3ii;p=ARm$S!o^ zvQ@uG3lqllt$uK~2tLa+98UCcJ#YW;GaeCpBDE)j2Q#?|2fxj+yzSRc@ ziSwsyTsyVvO*GWCDorO*FqQfQV{Z)^c)TfyFwh7LXpzP^J!uh!OAh5^`uWZ&j_JIvYM<3SfX z0+;u_gBG%#vcq`w%l^Zwd@w$IVqpu@oDRG~y1au$P+o4_KDtV`7d*Epb{**cOz4c_ zzIdGMFonMKwI(uXn7t6Zv^ukxWYzh*FiUv@W4B$9gQdA^69LXMTUfv`rUIKUNoDGd zJ%Ro0#nESFKILAwxSKZ_#yN>24OD^U&IAd$(w7NVp3w&S@gHqJ3Gd#IZXK;}rcC7F zI>w+szsMCt+GW8?N%igxZ^bFj*$GkUDij_HAKq7^4(IWunu3IQspuc%Jw^3;un9}S z-s!b{M!MOHDOGR~qzq1A33Y8X9kq2SdF|JbmpI&`PjbUNAVb+`UsE!nvHDcXUOc4X Ze`5{*ccy(p&3|Z **Windows** > **Configuration profiles** > **Create profile**. - 3. Enter the following properties: + 1. Go to the [Microsoft Endpoint Manager portal](https://endpoint.microsoft.com/#home). + 2. Select **Devices** from the navigation. + 3. Under **Policy**, select **Configuration profiles**. + 4. Select **Create profile**. + 5. From the **Platform** menu, select **Windows 10 and later**. + 6. From the **Profile** menu, select **Shared multi-user device**. - - **Platform**: Select **Windows 10 and later**. - - **Profile**: Select **Templates** > **Shared multi-user device**. + ![custom OMA-URI policy in Intune](images/shared_pc_1.jpg) - 4. Select **Create**. - 5. In **Basics**, enter the following properties: - - - **Name**: Enter a descriptive name for the new profile. - - **Description**: Enter a description for the profile. This setting is optional, but recommended. - - 6. Select **Next**. - 7. In **Configuration settings**, depending on the platform you chose, the settings you can configure are different. Choose your platform for detailed settings: - - 8. On the **Configuration settings** page, set the ‘Shared PC Mode’ value to **Enabled**. + 7. Select **Create**. + 8. Enter a name for the policy (e.g. My Win10 Shared devices policy). You can optionally add a description should you wish to do so. + 9. Select **Next**. + 10. On the **Configuration settings** page, set the ‘Shared PC Mode’ value to **Enabled**. ![Shared PC settings in ICD](images/shared_pc_3.png) - 9. From this point on, you can configure any additional settings you’d like to be part of this policy, and then follow the rest of the set-up flow to its completion by selecting **Create** after **Step 4**. + 11. From this point on, you can configure any additional settings you’d like to be part of this policy, and then follow the rest of the set-up flow to its completion by selecting **Create** after **Step 6**. - A provisioning package created with the Windows Configuration Designer: You can apply a provisioning package when you initially set up the PC (also known as the out-of-box-experience or OOBE), or you can apply the provisioning package to a Windows 10 PC that is already in use. The provisioning package is created in Windows Configuration Designer. Shared PC mode is enabled by the [SharedPC configuration service provider (CSP)](https://docs.microsoft.com/windows/client-management/mdm/sharedpc-csp), exposed in Windows Configuration Designer as **SharedPC**. diff --git a/windows/deployment/deploy-windows-mdt/deploy-a-windows-10-image-using-mdt.md b/windows/deployment/deploy-windows-mdt/deploy-a-windows-10-image-using-mdt.md index 355ea08482..2779d317f6 100644 --- a/windows/deployment/deploy-windows-mdt/deploy-a-windows-10-image-using-mdt.md +++ b/windows/deployment/deploy-windows-mdt/deploy-a-windows-10-image-using-mdt.md @@ -21,18 +21,18 @@ ms.topic: article **Applies to** - Windows 10 -This topic will show you how to take your reference image for Windows 10 (that was just [created](create-a-windows-10-reference-image.md)), and deploy that image to your environment using the **Microsoft Deployment Toolkit (MDT)**. +This topic will show you how to take your reference image for Windows 10 (that was just [created](create-a-windows-10-reference-image.md)), and deploy that image to your environment using the Microsoft Deployment Toolkit (MDT). -We will prepare for this by creating an **MDT** deployment share that is used solely for image deployment. Separating the processes of creating reference images from the processes used to deploy them in production allows greater control of both processes. We will configure **Active Directory** permissions, configure the deployment share, create a new task sequence, and add applications, drivers, and rules. +We will prepare for this by creating an MDT deployment share that is used solely for image deployment. Separating the processes of creating reference images from the processes used to deploy them in production allows greater control of on both processes. We will configure Active Directory permissions, configure the deployment share, create a new task sequence, and add applications, drivers, and rules. -For the purposes of this topic, we will use four computers: **DC01**, **MDT01**, **HV01**, and **PC0005**. +For the purposes of this topic, we will use four computers: DC01, MDT01, HV01 and PC0005. -- **DC01** is a domain controller -- **MDT01** is a domain member server -- **HV01** is a Hyper-V server -- **PC0005** is a blank device to which we will deploy Windows 10 +- DC01 is a domain controller +- MDT01 is a domain member server +- HV01 is a Hyper-V server +- PC0005 is a blank device to which we will deploy Windows 10 -**MDT01** and **PC0005** are members of the domain contoso.com for the fictitious Contoso Corporation. **HV01** is used to test the deployment of **PC0005** in a virtual environment. +MDT01 and PC0005 are members of the domain contoso.com for the fictitious Contoso Corporation. HV01 used to test deployment of PC0005 in a virtual environment. ![devices](../images/mdt-07-fig01.png) @@ -45,14 +45,14 @@ These steps will show you how to configure an Active Directory account with the On **DC01**: -1. Download the [Set-OUPermissions.ps1 script](https://go.microsoft.com/fwlink/p/?LinkId=619362) and copy it to the **C:\\Setup\\Scripts** directory on **DC01**. This script configures permissions to allow the **MDT_JD** account to manage computer accounts in the contoso > Computers organizational unit. -2. Create the **MDT_JD** service account by running the following command from an elevated **Windows PowerShell prompt**: +1. Download the [Set-OUPermissions.ps1 script](https://go.microsoft.com/fwlink/p/?LinkId=619362) and copy it to the **C:\\Setup\\Scripts** directory on DC01. This script configures permissions to allow the MDT_JD account to manage computer accounts in the contoso > Computers organizational unit. +2. Create the MDT_JD service account by running the following command from an elevated Windows PowerShell prompt: ```powershell New-ADUser -Name MDT_JD -UserPrincipalName MDT_JD -path "OU=Service Accounts,OU=Accounts,OU=Contoso,DC=CONTOSO,DC=COM" -Description "MDT join domain account" -AccountPassword (ConvertTo-SecureString "pass@word1" -AsPlainText -Force) -ChangePasswordAtLogon $false -PasswordNeverExpires $true -Enabled $true ``` -3. Next, run the **Set-OuPermissions script** to apply permissions to the **MDT\_JD** service account, enabling it to manage computer accounts in the Contoso / Computers OU. Run the following commands from an elevated **Windows PowerShell prompt**: +3. Next, run the Set-OuPermissions script to apply permissions to the **MDT\_JD** service account, enabling it to manage computer accounts in the Contoso / Computers OU. Run the following commands from an elevated Windows PowerShell prompt: ```powershell Set-ExecutionPolicy -ExecutionPolicy RemoteSigned -Force @@ -76,7 +76,7 @@ The following is a list of the permissions being granted: ## Step 2: Set up the MDT production deployment share -Next, create a new **MDT** deployment share. You should not use the same deployment share that you used to create the reference image for a production deployment. Perform this procedure on the **MDT01** server. +Next, create a new MDT deployment share. You should not use the same deployment share that you used to create the reference image for a production deployment. Perform this procedure on the MDT01 server. ### Create the MDT production deployment share @@ -85,21 +85,21 @@ On **MDT01**: The steps for creating the deployment share for production are the same as when you created the deployment share for creating the custom reference image: 1. Ensure you are signed on as: contoso\administrator. -2. In the **Deployment Workbench** console, right-click **Deployment Shares** and select **New Deployment Share**. +2. In the Deployment Workbench console, right-click **Deployment Shares** and select **New Deployment Share**. 3. On the **Path** page, in the **Deployment share path** text box, type **D:\\MDTProduction** and click **Next**. 4. On the **Share** page, in the **Share name** text box, type **MDTProduction$** and click **Next**. 5. On the **Descriptive Name** page, in the **Deployment share description** text box, type **MDT Production** and click **Next**. 6. On the **Options** page, accept the default settings and click **Next** twice, and then click **Finish**. -7. Using **File Explorer**, verify that you can access the **\\\\MDT01\\MDTProduction$** share. +7. Using File Explorer, verify that you can access the **\\\\MDT01\\MDTProduction$** share. ### Configure permissions for the production deployment share -To read files in the deployment share, you need to assign **NTFS** and **SMB** permissions to the **MDT Build Account (MDT\_BA)** for the **D:\\MDTProduction** folder. +To read files in the deployment share, you need to assign NTFS and SMB permissions to the MDT Build Account (MDT\_BA) for the **D:\\MDTProduction** folder On **MDT01**: 1. Ensure you are signed in as **contoso\\administrator**. -2. Modify the **NTFS** permissions for the **D:\\MDTProduction** folder by running the following command in an elevated **Windows PowerShell prompt**: +2. Modify the NTFS permissions for the **D:\\MDTProduction** folder by running the following command in an elevated Windows PowerShell prompt: ``` powershell icacls "D:\MDTProduction" /grant '"CONTOSO\MDT_BA":(OI)(CI)(M)' @@ -112,33 +112,33 @@ The next step is to add a reference image into the deployment share with the set ### Add the Windows 10 Enterprise x64 RTM custom image -In these steps, we assume that you have completed the steps in the [Create a Windows 10 reference image](create-a-windows-10-reference-image.md) topic, so you have a Windows 10 reference image at **D:\\MDTBuildLab\\Captures\REFW10X64-001.wim** on **MDT01**. +In these steps, we assume that you have completed the steps in the [Create a Windows 10 reference image](create-a-windows-10-reference-image.md) topic, so you have a Windows 10 reference image at **D:\\MDTBuildLab\\Captures\REFW10X64-001.wim** on MDT01. -1. Using the **Deployment Workbench**, expand the **Deployment Shares** node, and then expand **MDT Production**; select the **Operating Systems** node, and create a **folder** named **Windows 10**. +1. Using the Deployment Workbench, expand the **Deployment Shares** node, and then expand **MDT Production**; select the **Operating Systems** node, and create a folder named **Windows 10**. 2. Right-click the **Windows 10** folder and select **Import Operating System**. 3. On the **OS Type** page, select **Custom image file** and click **Next**. 4. On the **Image** page, in the **Source file** text box, browse to **D:\\MDTBuildLab\\Captures\\REFW10X64-001.wim** and click **Next**. 5. On the **Setup** page, select the **Copy Windows 7, Windows Server 2008 R2, or later setup files from the specified path** option; in the **Setup source directory** text box, browse to **D:\\MDTBuildLab\\Operating Systems\\W10EX64RTM** and click **Next**. 6. On the **Destination** page, in the **Destination directory name** text box, type **W10EX64RTM**, click **Next** twice, and then click **Finish**. -7. After adding the **Operating System**, double-click the added **Operating System** name in the **Operating Systems / Windows 10** node and change the name to **Windows 10 Enterprise x64 RTM Custom Image**. +7. After adding the operating system, double-click the added operating system name in the **Operating Systems / Windows 10** node and change the name to **Windows 10 Enterprise x64 RTM Custom Image**. -> [!NOTE] -> The reason for adding the setup files has changed since earlier versions of **MDT**. **MDT 2010** used the setup files to install Windows. **MDT** uses the **DISM** command to apply the image; however, you still need the **setup files** because some components in **roles and features** are stored outside the main image. +>[!NOTE] +>The reason for adding the setup files has changed since earlier versions of MDT. MDT 2010 used the setup files to install Windows. MDT uses DISM to apply the image; however, you still need the setup files because some components in roles and features are stored outside the main image. -![Imported OS](../images/fig2-importedos.png) +![imported OS](../images/fig2-importedos.png) ## Step 4: Add an application -When you configure your **MDT Build Lab deployment** share, you can also add **applications** to the new deployment share before creating your task sequence. This section walks you through the process of adding an application to the **MDT Production deployment** share using **Adobe Reader** as an example. +When you configure your MDT Build Lab deployment share, you can also add applications to the new deployment share before creating your task sequence. This section walks you through the process of adding an application to the MDT Production deployment share using Adobe Reader as an example. ### Create the install: Adobe Reader DC On **MDT01**: -1. Download the Enterprise distribution version of [**Adobe Acrobat Reader DC**](https://get.adobe.com/reader/enterprise/) (AcroRdrDC2100120140_en_US.exe) to **D:\\setup\\adobe** on MDT01. -2. Extract the **.exe** file that you downloaded to a **.msi** (ex: .\AcroRdrDC2100120140_en_US.exe -sfx_o"d:\setup\adobe\install\" -sfx_ne). -3. In the **Deployment Workbench**, expand the **MDT Production** node and navigate to the **Applications** node. +1. Download the Enterprise distribution version of [Adobe Acrobat Reader DC](https://get.adobe.com/reader/enterprise/) (AcroRdrDC1902120058_en_US.exe) to **D:\\setup\\adobe** on MDT01. +2. Extract the .exe file that you downloaded to an .msi (ex: .\AcroRdrDC1902120058_en_US.exe -sfx_o"d:\setup\adobe\install\" -sfx_ne). +3. In the Deployment Workbench, expand the **MDT Production** node and navigate to the **Applications** node. 4. Right-click the **Applications** node, and create a new folder named **Adobe**. 5. In the **Applications** node, right-click the **Adobe** folder and select **New Application**. 6. On the **Application Type** page, select the **Application with source files** option and click **Next**. @@ -153,7 +153,7 @@ The Adobe Reader application added to the Deployment Workbench. ## Step 5: Prepare the drivers repository -In order to deploy Windows 10 with **MDT** successfully, you need drivers for the boot images and for the actual operating system. This section will show you how to add drivers for the boot images and operating system, using the following hardware models as examples: +In order to deploy Windows 10 with MDT successfully, you need drivers for the boot images and for the actual operating system. This section will show you how to add drivers for the boot image and operating system, using the following hardware models as examples: - Lenovo ThinkPad T420 - Dell Latitude 7390 - HP EliteBook 8560w @@ -166,19 +166,19 @@ For boot images, you need to have storage and network drivers; for the operating ### Create the driver source structure in the file system -The key to successful management of drivers for **MDT**, as well as for any other deployment solution, is to have a really good driver repository. From this repository, you import drivers into MDT for deployment, but you should always maintain the repository for future use. +The key to successful management of drivers for MDT, as well as for any other deployment solution, is to have a really good driver repository. From this repository, you import drivers into MDT for deployment, but you should always maintain the repository for future use. On **MDT01**: > [!IMPORTANT] > In the steps below, it is critical that the folder names used for various computer makes and models exactly match the results of **wmic computersystem get model,manufacturer** on the target system. -1. Using **File Explorer**, create the **D:\\drivers** folder. +1. Using File Explorer, create the **D:\\drivers** folder. 2. In the **D:\\drivers** folder, create the following folder structure: - 1. **WinPE x86** - 2. **WinPE x64** - 3. **Windows 10 x64** -3. In the new **Windows 10 x64** folder, create the following folder structure: + 1. WinPE x86 + 2. WinPE x64 + 3. Windows 10 x64 +3. In the new Windows 10 x64 folder, create the following folder structure: - Dell Inc - Latitude E7450 - Hewlett-Packard @@ -193,12 +193,12 @@ On **MDT01**: ### Create the logical driver structure in MDT -When you import drivers to the **MDT driver repository**, **MDT** creates a single instance folder structure based on driver class names. However, you can, and should, mimic the driver structure of your driver source repository in the Deployment Workbench. This is done by creating logical folders in the Deployment Workbench. -1. On **MDT01**, using Deployment Workbench, select the **Out-of-Box Drivers** node. +When you import drivers to the MDT driver repository, MDT creates a single instance folder structure based on driver class names. However, you can, and should, mimic the driver structure of your driver source repository in the Deployment Workbench. This is done by creating logical folders in the Deployment Workbench. +1. On MDT01, using Deployment Workbench, select the **Out-of-Box Drivers** node. 2. In the **Out-Of-Box Drivers** node, create the following folder structure: - 1. **WinPE x86** - 2. **WinPE x64** - 3. **Windows 10 x64** + 1. WinPE x86 + 2. WinPE x64 + 3. Windows 10 x64 3. In the **Windows 10 x64** folder, create the following folder structure: - Dell Inc - Latitude E7450 @@ -209,7 +209,7 @@ When you import drivers to the **MDT driver repository**, **MDT** creates a sing - Microsoft Corporation - Surface Laptop -The preceding folder names should match the actual make and model values that MDT reads from devices during deployment. You can find out the model values for your machines by using the following command in an elevated **Windows PowerShell prompt**: +The preceding folder names should match the actual make and model values that MDT reads from devices during deployment. You can find out the model values for your machines by using the following command in Windows PowerShell: ``` powershell Get-WmiObject -Class:Win32_ComputerSystem @@ -220,7 +220,7 @@ Or, you can use this command in a normal command prompt: wmic csproduct get name ``` -If you want a more standardized naming convention, try the **ModelAliasExit.vbs script** from the Deployment Guys blog post entitled [Using and Extending Model Aliases for Hardware Specific Application Installation](https://go.microsoft.com/fwlink/p/?LinkId=619536). +If you want a more standardized naming convention, try the ModelAliasExit.vbs script from the Deployment Guys blog post entitled [Using and Extending Model Aliases for Hardware Specific Application Installation](https://go.microsoft.com/fwlink/p/?LinkId=619536). ![drivers](../images/fig4-oob-drivers.png) @@ -229,20 +229,20 @@ The Out-of-Box Drivers structure in the Deployment Workbench. ### Create the selection profiles for boot image drivers By default, MDT adds any storage and network drivers that you import to the boot images. However, you should add only the drivers that are necessary to the boot image. You can control which drivers are added by using selection profiles. -The drivers that are used for the boot images (Windows PE) are Windows 10 drivers. If you can’t locate **Windows 10** drivers for your device, a **Windows 7** or **Windows 8.1** driver will most likely work, but Windows 10 drivers should be your first choice. +The drivers that are used for the boot images (Windows PE) are Windows 10 drivers. If you can’t locate Windows 10 drivers for your device, a Windows 7 or Windows 8.1 driver will most likely work, but Windows 10 drivers should be your first choice. On **MDT01**: -1. In the **Deployment Workbench**, under the **MDT Production** node, expand the **Advanced Configuration** node, right-click the **Selection Profiles** node, and select **New Selection Profile**. -2. In the **New Selection Profile Wizard**, create a **selection profile** with the following settings: - 1. Selection Profile name: **WinPE x86** - 2. Folders: Select the **WinPE x86 folder** in **Out-of-Box Drivers**. - 3. Click **Next**, **Next**, and **Finish**. +1. In the Deployment Workbench, under the **MDT Production** node, expand the **Advanced Configuration** node, right-click the **Selection Profiles** node, and select **New Selection Profile**. +2. In the New Selection Profile Wizard, create a selection profile with the following settings: + 1. Selection Profile name: WinPE x86 + 2. Folders: Select the WinPE x86 folder in Out-of-Box Drivers. + 3. Click **Next**, **Next** and **Finish**. 3. Right-click the **Selection Profiles** node again, and select **New Selection Profile**. -4. In the **New Selection Profile Wizard**, create a **selection profile** with the following settings: - 1. Selection Profile name: **WinPE x64** - 2. Folders: Select the **WinPE x64 folder** in **Out-of-Box Drivers**. - 3. Click **Next**, **Next**, and **Finish**. +4. In the New Selection Profile Wizard, create a selection profile with the following settings: + 1. Selection Profile name: WinPE x64 + 2. Folders: Select the WinPE x64 folder in Out-of-Box Drivers. + 3. Click **Next**, **Next** and **Finish**. ![figure 5](../images/fig5-selectprofile.png) @@ -250,21 +250,22 @@ Creating the WinPE x64 selection profile. ### Extract and import drivers for the x64 boot image -**Windows PE** supports all the hardware models that we have, but here you learn how to add boot image drivers to accommodate any new hardware that might require additional drivers. In this example, you add the latest Intel network drivers to the x64 boot image. +Windows PE supports all the hardware models that we have, but here you learn to add boot image drivers to accommodate any new hardware that might require additional drivers. In this example, you add the latest Intel network drivers to the x64 boot image. On **MDT01**: 1. Download **PROWinx64.exe** from Intel.com (ex: [PROWinx64.exe](https://downloadcenter.intel.com/downloads/eula/25016/Intel-Network-Adapter-Driver-for-Windows-10?httpDown=https%3A%2F%2Fdownloadmirror.intel.com%2F25016%2Feng%2FPROWinx64.exe)). -2. Extract **PROWinx64.exe** to a temporary folder - in this example to the **C:\\Tmp\\ProWinx64** folder. Note that extracting the **.exe** file manually requires an extraction utility. You can also run the .exe and it will self-extract files to the **%userprofile%\AppData\Local\Temp\RarSFX0** directory. This directory is temporary and will be deleted when the **.exe** terminates. -3. Using **File Explorer**, create the **D:\\Drivers\\WinPE x64\\Intel PRO1000** folder. +2. Extract PROWinx64.exe to a temporary folder - in this example to the **C:\\Tmp\\ProWinx64** folder. + a. **Note**: Extracting the .exe file manually requires an extraction utility. You can also run the .exe and it will self-extract files to the **%userprofile%\AppData\Local\Temp\RarSFX0** directory. This directory is temporary and will be deleted when the .exe terminates. +3. Using File Explorer, create the **D:\\Drivers\\WinPE x64\\Intel PRO1000** folder. 4. Copy the content of the **C:\\Tmp\\PROWinx64\\PRO1000\\Winx64\\NDIS64** folder to the **D:\\Drivers\\WinPE x64\\Intel PRO1000** folder. -5. In the **Deployment Workbench**, expand the **MDT Production** > **Out-of-Box Drivers** node, right-click the **WinPE x64** node, select **Import Drivers**, and use the following driver source directory to import drivers: **D:\\Drivers\\WinPE x64\\Intel PRO1000**. +5. In the Deployment Workbench, expand the **MDT Production** > **Out-of-Box Drivers** node, right-click the **WinPE x64** node, and select **Import Drivers**, and use the following Driver source directory to import drivers: **D:\\Drivers\\WinPE x64\\Intel PRO1000**. ### Download, extract, and import drivers ### For the Lenovo ThinkStation P500 -For the **ThinkStation P500** model, you use the Lenovo ThinkVantage Update Retriever software to download the drivers. With Update Retriever, you need to specify the correct Lenovo Machine Type for the actual hardware (the first four characters of the model name). As an example, the Lenovo ThinkStation P500 model has the 30A6003TUS model name, meaning the Machine Type is 30A6. +For the ThinkStation P500 model, you use the Lenovo ThinkVantage Update Retriever software to download the drivers. With Update Retriever, you need to specify the correct Lenovo Machine Type for the actual hardware (the first four characters of the model name). As an example, the Lenovo ThinkStation P500 model has the 30A6003TUS model name, meaning the Machine Type is 30A6. ![ThinkStation image](../images/thinkstation.png) diff --git a/windows/deployment/update/media-dynamic-update.md b/windows/deployment/update/media-dynamic-update.md index 74fc796879..ea81420b8b 100644 --- a/windows/deployment/update/media-dynamic-update.md +++ b/windows/deployment/update/media-dynamic-update.md @@ -81,9 +81,6 @@ This table shows the correct sequence for applying the various tasks to the file |Add .NET and .NET cumulative updates | | | 24 | |Export image | 8 | 17 | 25 | -> [!NOTE] -> Starting in February 2021, the latest cumulative update and servicing stack update will be combined and distributed in the Microsoft Update Catalog as a new combined cumulative update. For Steps 1, 9, and 18 that require the servicing stack update for updating the installation media, you should use the combined cumulative update. For more information on the combined cumulative update, see [Servicing stack updates](https://docs.microsoft.com/windows/deployment/update/servicing-stack-updates). - ### Multiple Windows editions The main operating system file (install.wim) contains multiple editions of Windows 10. It’s possible that only an update for a given edition is required to deploy it, based on the index. Or, it might be that all editions need an update. Further, ensure that languages are installed before Features on Demand, and the latest cumulative update is always applied last. diff --git a/windows/deployment/update/servicing-stack-updates.md b/windows/deployment/update/servicing-stack-updates.md index 13487eef17..e2b6404d14 100644 --- a/windows/deployment/update/servicing-stack-updates.md +++ b/windows/deployment/update/servicing-stack-updates.md @@ -29,6 +29,8 @@ Servicing stack updates provide fixes to the servicing stack, the component that Servicing stack updates improve the reliability of the update process to mitigate potential issues while installing the latest quality updates and feature updates. If you don't install the latest servicing stack update, there's a risk that your device can't be updated with the latest Microsoft security fixes. +For information about some changes to servicing stack updates, see [Simplifing Deployment of Servicing Stack Updates](https://techcommunity.microsoft.com/t5/windows-it-pro-blog/simplifying-on-premises-deployment-of-servicing-stack-updates/ba-p/1646039) on the Windows IT Pro blog. + ## When are they released? Servicing stack update are released depending on new issues or vulnerabilities. In rare occasions a servicing stack update may need to be released on demand to address an issue impacting systems installing the monthly security update. Starting in November 2018 new servicing stack updates will be classified as "Security" with a severity rating of "Critical." @@ -42,6 +44,7 @@ Both Windows 10 and Windows Server use the cumulative update mechanism, in which Servicing stack updates must ship separately from the cumulative updates because they modify the component that installs Windows updates. The servicing stack is released separately because the servicing stack itself requires an update. For example, the cumulative update [KB4284880](https://support.microsoft.com/help/4284880/windows-10-update-kb4284880) requires the [May 17, 2018 servicing stack update](https://support.microsoft.com/help/4132216), which includes updates to Windows Update. + ## Is there any special guidance? Microsoft recommends you install the latest servicing stack updates for your operating system before installing the latest cumulative update. @@ -55,7 +58,3 @@ Typically, the improvements are reliability and performance improvements that do * Servicing stack update releases are specific to the operating system version (build number), much like quality updates. * Search to install latest available [Servicing stack update for Windows 10](https://portal.msrc.microsoft.com/en-us/security-guidance/advisory/ADV990001). * Once a servicing stack update is installed, it cannot be removed or uninstalled from the machine. - - -## Simplifying on-premises deployment of servicing stack updates -With the Windows Update experience, servicing stack updates and cumulative updates are deployed together to the device. The update stack automatically orchestrates the installation, so both are applied correctly. Starting in February 2021, the cumulative update will include the latest servicing stack updates, to provide a single cumulative update payload to both Windows Server Update Services (WSUS) and Microsoft Catalog. If you use an endpoint management tool backed by WSUS, such as Configuration Manager, you will only have to select and deploy the monthly cumulative update. The latest servicing stack updates will automatically be applied correctly. Release notes and file information for cumulative updates, including those related to the servicing stack, will be in a single KB article. The combined monthly cumulative update will be available on Windows 10, version 2004 and later starting with the 2021 2C release, KB4601382. diff --git a/windows/deployment/update/update-compliance-get-started.md b/windows/deployment/update/update-compliance-get-started.md index 8bf31e807a..4e77a4d513 100644 --- a/windows/deployment/update/update-compliance-get-started.md +++ b/windows/deployment/update/update-compliance-get-started.md @@ -66,9 +66,6 @@ To find your CommercialID within Azure: Once you've added Update Compliance to a workspace in your Azure subscription, you'll need to configure any devices you want to monitor. There are two ways to configure devices to use Update Compliance. -> [!NOTE] -> If you use or plan to use [Desktop Analytics](https://docs.microsoft.com/mem/configmgr/desktop-analytics/overview), follow the steps in [Enroll devices in Desktop Analytics](https://docs.microsoft.com/mem/configmgr/desktop-analytics/enroll-devices) to also enroll devices to Update Compliance. You should be aware that the Commercial ID and Log Analytics workspace must be the same for both Desktop Analytics and Update Compliance. - > [!NOTE] > After configuring devices via one of the two methods below, it can take up to 72 hours before devices are visible in the solution. Until then, Update Compliance will indicate it is still assessing devices. diff --git a/windows/deployment/update/waas-delivery-optimization.md b/windows/deployment/update/waas-delivery-optimization.md index b092e01f7d..a9ec6583a1 100644 --- a/windows/deployment/update/waas-delivery-optimization.md +++ b/windows/deployment/update/waas-delivery-optimization.md @@ -32,8 +32,8 @@ Delivery Optimization is a cloud-managed solution. Access to the Delivery Optimi For information about setting up Delivery Optimization, including tips for the best settings in different scenarios, see [Set up Delivery Optimization for Windows 10 updates](waas-delivery-optimization-setup.md). For a comprehensive list of all Delivery Optimization settings, see [Delivery Optimization reference](waas-delivery-optimization-reference.md). -> [!NOTE] -> WSUS can also use [BranchCache](waas-branchcache.md) for content sharing and caching. If Delivery Optimization is enabled on devices that use BranchCache, Delivery Optimization will be used instead. +>[!NOTE] +>WSUS can also use [BranchCache](waas-branchcache.md) for content sharing and caching. If Delivery Optimization is enabled on devices that use BranchCache, Delivery Optimization will be used instead. ## New in Windows 10, version 2004 @@ -68,9 +68,6 @@ For information about setting up Delivery Optimization, including tips for the b - Edge browser installs and updates - [Dynamic updates](https://techcommunity.microsoft.com/t5/windows-it-pro-blog/the-benefits-of-windows-10-dynamic-update/ba-p/467847) -> [!NOTE] -> Volume-licensed versions of Office 2019, such as Office Professional Plus 2019, can take advantage of Delivery Optimization for background updates. Delivery Optimization isn't available for installation or for foreground updates. The same applies to volume-licensed versions of Project 2019 and Visio 2019. - ## Requirements The following table lists the minimum Windows 10 version that supports Delivery Optimization: @@ -137,7 +134,7 @@ For more details, check out the [Adopting Windows as a Service at Microsoft](htt **Does Delivery Optimization work with WSUS?**: Yes. Devices will obtain the update payloads from the WSUS server, but must also have an internet connection as they communicate with the Delivery Optimization cloud service for coordination. -**Which ports does Delivery Optimization use?**: Delivery Optimization listens on port 7680 for requests from other peers by using TCP/IP. The service will register and open this port on the device, but you might need to set this port to accept inbound and outbound traffic through your firewall yourself. If you don't allow inbound and outbound traffic over port 7680, you can't use the peer-to-peer functionality of Delivery Optimization. However, devices can still successfully download by using HTTP or HTTPS traffic over port 80 (such as for default Windows Update data). +**Which ports does Delivery Optimization use?**: Delivery Optimization listens on port 7680 for requests from other peers by using TCP/IP. The service will register and open this port on the device, but you might need to set this port to accept inbound traffic through your firewall yourself. If you don't allow inbound traffic over port 7680, you can't use the peer-to-peer functionality of Delivery Optimization. However, devices can still successfully download by using HTTP or HTTPS traffic over port 80 (such as for default Windows Update data). If you set up Delivery Optimization to create peer groups that include devices across NATs (or any form of internal subnet that uses gateways or firewalls between subnets), it will use Teredo. For this to work, you must allow inbound TCP/IP traffic over port 3544. Look for a "NAT traversal" setting in your firewall to set this up. diff --git a/windows/deployment/update/waas-manage-updates-wufb.md b/windows/deployment/update/waas-manage-updates-wufb.md index c0367c64cf..5a410e9d8c 100644 --- a/windows/deployment/update/waas-manage-updates-wufb.md +++ b/windows/deployment/update/waas-manage-updates-wufb.md @@ -47,14 +47,11 @@ Windows Update for Business enables an IT administrator to receive and manage a Windows Update for Business provides management policies for several types of updates to Windows 10 devices: - **Feature updates:** Previously referred to as "upgrades," feature updates contain not only security and quality revisions, but also significant feature additions and changes. Feature updates are released semi-annually in the fall and in the spring. -- **Quality updates:** Quality updates are traditional operating system updates, typically released on the second Tuesday of each month (though they can be released at any time). These include security, critical, and driver updates. +- **Quality updates:** Quality updates are traditional operating system updates, typically released on the second Tuesday of each month (though they can be released at any time). These include security, critical, and driver updates. Windows Update for Business also treats non-Windows updates (such as updates for Microsoft Office or Visual Studio) as quality updates. These non-Windows Updates are known as "Microsoft updates" and you can set devices to receive such updates (or not) along with their Windows updates. - **Driver updates:** Updates for non-Microsoft drivers that are relevant to your devices. Driver updates are on by default, but you can use Windows Update for Business policies to turn them off if you prefer. -- **Microsoft product updates:** Updates for other Microsoft products, such as Visual Studio or versions of Microsoft Office that are installed by using Windows Installer (MSI). These updates are treated the same way as quality updates. Microsoft product updates are off by default, but you can turn them on with Windows Update for Business policies. +- **Microsoft product updates**: Updates for other Microsoft products, such as versions of Office that are installed by using Windows Installer (MSI). Versions of Office that are installed by using Click-to-Run can't be updated by using Windows Update for Business. Product updates are off by default. You can turn them on by using Windows Update for Business policies. ->[!NOTE] ->Versions of Office that are installed by using Click-to-Run can't be updated by using Windows Update for Business. - ## Offering You can control when updates are applied, for example by deferring when an update is installed on a device or by pausing updates for a certain period. @@ -129,7 +126,7 @@ The large number of different policies offered for Windows 10 can be overwhelmin The Update Baseline toolkit makes it easy by providing a single command for IT Admins to apply the Update Baseline to devices. You can get the Update Baseline toolkit from the [Download Center](https://www.microsoft.com/download/details.aspx?id=101056). >[!NOTE] ->The Update Baseline toolkit is available only for Group Policy. Update Baseline does not affect your offering policies, whether you’re using deferrals or target version to manage which updates are offered to your devices and when. +>The Update Baseline toolkit is available only for Group Policy. Update Baseline does not affect your offering policies, whether you’re using deferrals or target version to manage which updates are offered to your devices when.