diff --git a/.github/workflows/AutoPublish.yml b/.github/workflows/AutoPublish.yml new file mode 100644 index 0000000000..a7e46e4f16 --- /dev/null +++ b/.github/workflows/AutoPublish.yml @@ -0,0 +1,25 @@ +name: (Scheduled) Publish to live + +permissions: + contents: write + pull-requests: write + +on: + schedule: + - cron: "25 5,11,17,22 * * *" # Times are UTC based on Daylight Saving Time. Need to be adjusted for Standard Time. Scheduling at :25 to account for queuing lag. + + workflow_dispatch: + +jobs: + + auto-publish: + if: github.repository_owner == 'MicrosoftDocs' && contains(github.event.repository.topics, 'build') + uses: MicrosoftDocs/microsoft-365-docs/.github/workflows/Shared-AutoPublish.yml@workflows-prod + with: + PayloadJson: ${{ toJSON(github) }} + EnableAutoPublish: true + + secrets: + AccessToken: ${{ secrets.GITHUB_TOKEN }} + PrivateKey: ${{ secrets.M365_APP_PRIVATE_KEY }} + ClientId: ${{ secrets.M365_APP_CLIENT_ID }} \ No newline at end of file diff --git a/.github/workflows/StaleBranch.yml b/.github/workflows/StaleBranch.yml index 689edaebdc..706487d5b2 100644 --- a/.github/workflows/StaleBranch.yml +++ b/.github/workflows/StaleBranch.yml @@ -2,12 +2,17 @@ name: (Scheduled) Stale branch removal permissions: contents: write - + +# This workflow is designed to be run in the days up to, and including, a "deletion day", specified by 'DeleteOnDayOfMonth' in env: in https://github.com/MicrosoftDocs/microsoft-365-docs/blob/workflows-prod/.github/workflows/Shared-StaleBranch.yml. +# On the days leading up to "deletion day", the workflow will report the branches to be deleted. This lets users see which branches will be deleted. On "deletion day", those branches are deleted. +# The workflow should not be configured to run after "deletion day" so that users can review the branches were deleted. +# Recommendation: configure cron to run on days 1,15-31 where 1 is what's configured in 'DeleteOnDayOfMonth'. If 'DeleteOnDayOfMonth' is set to something else, update cron to run the two weeks leading up to it. + on: schedule: - - cron: "0 9 1 * *" + - cron: "0 9 1,15-31 * *" - # workflow_dispatch: + workflow_dispatch: jobs: diff --git a/includes/licensing/_edition-requirements.md b/includes/licensing/_edition-requirements.md index e071c50031..6d9d909642 100644 --- a/includes/licensing/_edition-requirements.md +++ b/includes/licensing/_edition-requirements.md @@ -41,7 +41,7 @@ ms.topic: include |**[Microsoft Defender Application Guard (MDAG) configure via MDM](/windows/client-management/mdm/windowsdefenderapplicationguard-csp)**|❌|Yes|❌|Yes| |**[Microsoft Defender Application Guard (MDAG) for Edge enterprise mode and enterprise management](/windows/security/application-security/application-isolation/microsoft-defender-application-guard/configure-md-app-guard)**|❌|Yes|❌|Yes| |**[Microsoft Defender Application Guard (MDAG) for Edge standalone mode](/windows/security/application-security/application-isolation/microsoft-defender-application-guard/md-app-guard-overview)**|Yes|Yes|Yes|Yes| -|**[Microsoft Defender Application Guard (MDAG) for Microsoft Office](https://support.microsoft.com/office/application-guard-for-office-9e0fb9c2-ffad-43bf-8ba3-78f785fdba46)**|❌|Yes|❌|Yes| +|**[Microsoft Defender Application Guard (MDAG) for Microsoft Office](/defender-office-365/app-guard-for-office-install)**|❌|Yes|❌|Yes| |**Microsoft Defender Application Guard (MDAG) public APIs**|❌|Yes|❌|Yes| |**[Microsoft Defender for Endpoint](/microsoft-365/security/defender-endpoint)**|Yes|Yes|Yes|Yes| |**[Microsoft Defender SmartScreen](/windows/security/operating-system-security/virus-and-threat-protection/microsoft-defender-smartscreen/)**|Yes|Yes|Yes|Yes| diff --git a/includes/licensing/_licensing-requirements.md b/includes/licensing/_licensing-requirements.md index ba6683b1d6..d4d3b7204e 100644 --- a/includes/licensing/_licensing-requirements.md +++ b/includes/licensing/_licensing-requirements.md @@ -1,7 +1,7 @@ --- author: paolomatarazzo ms.author: paoloma -ms.date: 11/02/2023 +ms.date: 04/14/2025 ms.topic: include --- @@ -41,7 +41,7 @@ ms.topic: include |**[Microsoft Defender Application Guard (MDAG) configure via MDM](/windows/client-management/mdm/windowsdefenderapplicationguard-csp)**|❌|Yes|Yes|Yes|Yes| |**[Microsoft Defender Application Guard (MDAG) for Edge enterprise mode and enterprise management](/windows/security/application-security/application-isolation/microsoft-defender-application-guard/configure-md-app-guard)**|❌|Yes|Yes|Yes|Yes| |**[Microsoft Defender Application Guard (MDAG) for Edge standalone mode](/windows/security/application-security/application-isolation/microsoft-defender-application-guard/md-app-guard-overview)**|Yes|Yes|Yes|Yes|Yes| -|**[Microsoft Defender Application Guard (MDAG) for Microsoft Office](https://support.microsoft.com/office/application-guard-for-office-9e0fb9c2-ffad-43bf-8ba3-78f785fdba46)**|❌|❌|❌|❌|❌| +|**[Microsoft Defender Application Guard (MDAG) for Microsoft Office](/defender-office-365/app-guard-for-office-install)**|❌|❌|❌|❌|❌| |**Microsoft Defender Application Guard (MDAG) public APIs**|❌|Yes|Yes|Yes|Yes| |**[Microsoft Defender for Endpoint](/microsoft-365/security/defender-endpoint)**|❌|❌|Yes|❌|Yes| |**[Microsoft Defender SmartScreen](/windows/security/operating-system-security/virus-and-threat-protection/microsoft-defender-smartscreen/)**|Yes|Yes|Yes|Yes|Yes| diff --git a/includes/licensing/unbranded-boot.md b/includes/licensing/unbranded-boot.md new file mode 100644 index 0000000000..b83afd7e98 --- /dev/null +++ b/includes/licensing/unbranded-boot.md @@ -0,0 +1,14 @@ +--- +author: paolomatarazzo +ms.author: paoloma +ms.date: 04/09/2025 +ms.topic: include +--- + +### Windows edition requirements + +The following list contains the Windows editions that support Unbranded Boot: + +✅ Enterprise / Enterprise LTSC\ +✅ Education\ +✅ IoT Enterprise / IoT Enterprise LTSC diff --git a/windows/client-management/mdm/policies-in-preview.md b/windows/client-management/mdm/policies-in-preview.md index 6aaae7383f..9be89eb1f4 100644 --- a/windows/client-management/mdm/policies-in-preview.md +++ b/windows/client-management/mdm/policies-in-preview.md @@ -1,7 +1,7 @@ --- title: Configuration service provider preview policies description: Learn more about configuration service provider (CSP) policies that are available for Windows Insider Preview. -ms.date: 04/04/2025 +ms.date: 04/21/2025 ms.topic: generated-reference --- @@ -111,6 +111,17 @@ This article lists the policies that are applicable for Windows Insider Preview - [StartInstallation](language-pack-management-csp.md#installlanguage-idstartinstallation) - [SystemPreferredUILanguages](language-pack-management-csp.md#languagesettingssystempreferreduilanguages) +## LanmanServer + +- [AuditClientDoesNotSupportEncryption](policy-csp-lanmanserver.md#auditclientdoesnotsupportencryption) +- [AuditClientDoesNotSupportSigning](policy-csp-lanmanserver.md#auditclientdoesnotsupportsigning) +- [AuditInsecureGuestLogon](policy-csp-lanmanserver.md#auditinsecureguestlogon) +- [AuthRateLimiterDelayInMs](policy-csp-lanmanserver.md#authratelimiterdelayinms) +- [EnableAuthRateLimiter](policy-csp-lanmanserver.md#enableauthratelimiter) +- [EnableMailslots](policy-csp-lanmanserver.md#enablemailslots) +- [MaxSmb2Dialect](policy-csp-lanmanserver.md#maxsmb2dialect) +- [MinSmb2Dialect](policy-csp-lanmanserver.md#minsmb2dialect) + ## LanmanWorkstation - [AuditInsecureGuestLogon](policy-csp-lanmanworkstation.md#auditinsecureguestlogon) @@ -218,6 +229,22 @@ This article lists the policies that are applicable for Windows Insider Preview - [DisableSubscription](windowslicensing-csp.md#subscriptionsdisablesubscription) - [RemoveSubscription](windowslicensing-csp.md#subscriptionsremovesubscription) +## WirelessNetworkPreference CSP + +- [IsEnabled](wirelessnetworkpreference-csp.md#isenabled) +- [PreferCellularOverWiFi](wirelessnetworkpreference-csp.md#prefercellularoverwifi) +- [eSIMprofilesCount](wirelessnetworkpreference-csp.md#statusesimprofilescount) +- [eSIMprofilesMatched](wirelessnetworkpreference-csp.md#statusesimprofilesmatched) +- [eSIMpolicyStatus](wirelessnetworkpreference-csp.md#statusesimpolicystatus) +- [NetworkDiscoveryOption](wirelessnetworkpreference-csp.md#parameterscellularparametersnetworkdiscoveryoption) +- [MaxRescanIntervalInSeconds](wirelessnetworkpreference-csp.md#parameterscellularparametersmaxrescanintervalinseconds) +- [PreferredProfileWakeConnectionTimerInSeconds](wirelessnetworkpreference-csp.md#parameterscellularparameterspreferredprofilewakeconnectiontimerinseconds) +- [ProfileRegistrationTimerInSeconds](wirelessnetworkpreference-csp.md#parameterscellularparametersprofileregistrationtimerinseconds) +- [ScreenOffDurationToTriggerNetworkDiscoveryInMinutes](wirelessnetworkpreference-csp.md#parameterscellularparametersscreenoffdurationtotriggernetworkdiscoveryinminutes) +- [Priority](wirelessnetworkpreference-csp.md#connectionprofilesconnectionprofileidpriority) +- [WirelessType](wirelessnetworkpreference-csp.md#connectionprofilesconnectionprofileidwirelesstype) +- [PLMNID](wirelessnetworkpreference-csp.md#connectionprofilesconnectionprofileidcellularplmnid) + ## Related articles [Policy configuration service provider](policy-configuration-service-provider.md) diff --git a/windows/client-management/mdm/policy-configuration-service-provider.md b/windows/client-management/mdm/policy-configuration-service-provider.md index d71bb02821..d622986db6 100644 --- a/windows/client-management/mdm/policy-configuration-service-provider.md +++ b/windows/client-management/mdm/policy-configuration-service-provider.md @@ -1,7 +1,7 @@ --- title: Policy CSP description: Learn more about the Policy CSP. -ms.date: 03/12/2025 +ms.date: 04/21/2025 ms.topic: generated-reference --- @@ -1120,6 +1120,7 @@ Specifies the name/value pair used in the policy. See the individual Area DDFs f - [InternetExplorer](policy-csp-internetexplorer.md) - [Kerberos](policy-csp-kerberos.md) - [KioskBrowser](policy-csp-kioskbrowser.md) +- [LanmanServer](policy-csp-lanmanserver.md) - [LanmanWorkstation](policy-csp-lanmanworkstation.md) - [Licensing](policy-csp-licensing.md) - [LocalPoliciesSecurityOptions](policy-csp-localpoliciessecurityoptions.md) diff --git a/windows/client-management/mdm/policy-csp-accounts.md b/windows/client-management/mdm/policy-csp-accounts.md index 2c00a22b4a..8500bffa81 100644 --- a/windows/client-management/mdm/policy-csp-accounts.md +++ b/windows/client-management/mdm/policy-csp-accounts.md @@ -144,7 +144,7 @@ Allows IT Admins the ability to disable the Microsoft Account Sign-In Assistant > [!CAUTION] -> If the Microsoft Account Sign-In Assistant service is disabled, the initial digital license activation with a Multiple Activation Key (MAK) will fail. +> If the Microsoft Account Sign-In Assistant service is disabled, the initial digital license activation with a Multiple Activation Key (MAK) or Digital Product Key (DPK) will fail. diff --git a/windows/client-management/mdm/policy-csp-lanmanserver.md b/windows/client-management/mdm/policy-csp-lanmanserver.md new file mode 100644 index 0000000000..7319615e1f --- /dev/null +++ b/windows/client-management/mdm/policy-csp-lanmanserver.md @@ -0,0 +1,557 @@ +--- +title: LanmanServer Policy CSP +description: Learn more about the LanmanServer Area in Policy CSP. +ms.date: 04/21/2025 +ms.topic: generated-reference +--- + + + + +# Policy CSP - LanmanServer + +[!INCLUDE [Windows Insider tip](includes/mdm-insider-csp-note.md)] + + + + + + +## AuditClientDoesNotSupportEncryption + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 24H2 [10.0.26100.3613] and later
✅ Windows Insider Preview | + + + +```Device +./Device/Vendor/MSFT/Policy/Config/LanmanServer/AuditClientDoesNotSupportEncryption +``` + + + + +This policy controls whether the SMB server will log the event when the SMB client doesn't support encryption. + +- If you enable this policy setting, the SMB server will log the event when the SMB client doesn't support encryption. + +- If you disable or don't configure this policy setting, the SMB server won't log the event. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | `int` | +| Access Type | Add, Delete, Get, Replace | +| Default Value | 0 | + + + +**Allowed values**: + +| Value | Description | +|:--|:--| +| 0 (Default) | Disabled. | +| 1 | Enabled. | + + + +**Group policy mapping**: + +| Name | Value | +|:--|:--| +| Name | Pol_AuditClientDoesNotSupportEncryption | +| Friendly Name | Audit client does not support encryption | +| Location | Computer Configuration | +| Path | Network > Lanman Server | +| Registry Key Name | Software\Policies\Microsoft\Windows\LanmanServer | +| Registry Value Name | AuditClientDoesNotSupportEncryption | +| ADMX File Name | LanmanServer.admx | + + + + + + + + + +## AuditClientDoesNotSupportSigning + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 24H2 [10.0.26100.3613] and later
✅ Windows Insider Preview | + + + +```Device +./Device/Vendor/MSFT/Policy/Config/LanmanServer/AuditClientDoesNotSupportSigning +``` + + + + +This policy controls whether the SMB server will log the event when the SMB client doesn't support signing. + +If you enable this policy setting, the SMB server will log the event when the SMB client doesn't support signing. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | `int` | +| Access Type | Add, Delete, Get, Replace | +| Default Value | 0 | + + + +**Allowed values**: + +| Value | Description | +|:--|:--| +| 0 (Default) | Disabled. | +| 1 | Enabled. | + + + +**Group policy mapping**: + +| Name | Value | +|:--|:--| +| Name | Pol_AuditClientDoesNotSupportSigning | +| Friendly Name | Audit client does not support signing | +| Location | Computer Configuration | +| Path | Network > Lanman Server | +| Registry Key Name | Software\Policies\Microsoft\Windows\LanmanServer | +| Registry Value Name | AuditClientDoesNotSupportSigning | +| ADMX File Name | LanmanServer.admx | + + + + + + + + + +## AuditInsecureGuestLogon + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 24H2 [10.0.26100.3613] and later
✅ Windows Insider Preview | + + + +```Device +./Device/Vendor/MSFT/Policy/Config/LanmanServer/AuditInsecureGuestLogon +``` + + + + +This policy controls whether the SMB server will enable the audit event when the client is logged-on as guest account. + +- If you enable this policy setting, the SMB server will log the event when the client is logged-on as guest account. + +- If you disable or don't configure this policy setting, the SMB server won't log the event. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | `int` | +| Access Type | Add, Delete, Get, Replace | +| Default Value | 0 | + + + +**Allowed values**: + +| Value | Description | +|:--|:--| +| 0 (Default) | Disabled. | +| 1 | Enabled. | + + + +**Group policy mapping**: + +| Name | Value | +|:--|:--| +| Name | Pol_AuditInsecureGuestLogon | +| Friendly Name | Audit insecure guest logon | +| Location | Computer Configuration | +| Path | Network > Lanman Server | +| Registry Key Name | Software\Policies\Microsoft\Windows\LanmanServer | +| Registry Value Name | AuditInsecureGuestLogon | +| ADMX File Name | LanmanServer.admx | + + + + + + + + + +## AuthRateLimiterDelayInMs + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 24H2 [10.0.26100.3613] and later
✅ Windows Insider Preview | + + + +```Device +./Device/Vendor/MSFT/Policy/Config/LanmanServer/AuthRateLimiterDelayInMs +``` + + + + +This policy controls whether the SMB server will use a default value in milliseconds for the invalid authentication delay. + +- If you configure this policy setting, the authentication rate limiter will use the specified value for delaying invalid authentication attempts. + +- If you don't configure this policy setting, the authentication rate limiter will use the default value or the value from local registry under HKLM\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | `int` | +| Access Type | Add, Delete, Get, Replace | +| Allowed Values | Range: `[0-10000]` | +| Default Value | 2000 | + + + +**Group policy mapping**: + +| Name | Value | +|:--|:--| +| Name | Pol_AuthRateLimiterDelayInMs | +| Friendly Name | Set authentication rate limiter delay (milliseconds) | +| Location | Computer Configuration | +| Path | Network > Lanman Server | +| Registry Key Name | Software\Policies\Microsoft\Windows\LanmanServer | +| ADMX File Name | LanmanServer.admx | + + + + + + + + + +## EnableAuthRateLimiter + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 24H2 [10.0.26100.3613] and later
✅ Windows Insider Preview | + + + +```Device +./Device/Vendor/MSFT/Policy/Config/LanmanServer/EnableAuthRateLimiter +``` + + + + +This policy controls whether the SMB server will enable or disable the authentication rate limiter. + +- If you disable this policy setting, the authentication rate limiter won't be enabled. + +- If you don't configure this policy setting, the authentication rate limiter may still be working depending on the delay settings (the recommended delay value is 2000ms). + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | `int` | +| Access Type | Add, Delete, Get, Replace | +| Default Value | 1 | + + + +**Allowed values**: + +| Value | Description | +|:--|:--| +| 0 | Disabled. | +| 1 (Default) | Enabled. | + + + +**Group policy mapping**: + +| Name | Value | +|:--|:--| +| Name | Pol_EnableAuthRateLimiter | +| Friendly Name | Enable authentication rate limiter | +| Location | Computer Configuration | +| Path | Network > Lanman Server | +| Registry Key Name | Software\Policies\Microsoft\Windows\LanmanServer | +| Registry Value Name | EnableAuthRateLimiter | +| ADMX File Name | LanmanServer.admx | + + + + + + + + + +## EnableMailslots + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 24H2 [10.0.26100.3613] and later
✅ Windows Insider Preview | + + + +```Device +./Device/Vendor/MSFT/Policy/Config/LanmanServer/EnableMailslots +``` + + + + +This policy controls whether the SMB server will enable or disable remote mailslots over the computer browser service. + +- If you disable this policy setting, the computer browser service will no longer run as expected. + +- If you don't configure this policy setting, the computer browser may still be working with remote mailslots enabled. + +> [!NOTE] +> This policy requires a Windows reboot to take effect. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | `int` | +| Access Type | Add, Delete, Get, Replace | +| Default Value | 0 | + + + +**Allowed values**: + +| Value | Description | +|:--|:--| +| 0 (Default) | Disabled. | +| 1 | Enabled. | + + + +**Group policy mapping**: + +| Name | Value | +|:--|:--| +| Name | Pol_EnableMailslots | +| Friendly Name | Enable remote mailslots | +| Location | Computer Configuration | +| Path | Network > Lanman Server | +| Registry Key Name | Software\Policies\Microsoft\Windows\Bowser | +| Registry Value Name | EnableMailslots | +| ADMX File Name | LanmanServer.admx | + + + + + + + + + +## MaxSmb2Dialect + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 24H2 [10.0.26100.3613] and later
✅ Windows Insider Preview | + + + +```Device +./Device/Vendor/MSFT/Policy/Config/LanmanServer/MaxSmb2Dialect +``` + + + + +This policy controls the maximum version of SMB protocol. + +> [!NOTE] +> This group policy doesn't prevent use of SMB 1 if that component is still installed and enabled. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | `int` | +| Access Type | Add, Delete, Get, Replace | +| Default Value | 785 | + + + +**Allowed values**: + +| Value | Description | +|:--|:--| +| 514 | SMB 2.0.2. | +| 528 | SMB 2.1.0. | +| 768 | SMB 3.0.0. | +| 770 | SMB 3.0.2. | +| 785 (Default) | SMB 3.1.1. | + + + +**Group policy mapping**: + +| Name | Value | +|:--|:--| +| Name | Pol_MaxSmb2Dialect | +| Friendly Name | Mandate the maximum version of SMB | +| Location | Computer Configuration | +| Path | Network > Lanman Server | +| Registry Key Name | Software\Policies\Microsoft\Windows\LanmanServer | +| ADMX File Name | LanmanServer.admx | + + + + + + + + + +## MinSmb2Dialect + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 24H2 [10.0.26100.3613] and later
✅ Windows Insider Preview | + + + +```Device +./Device/Vendor/MSFT/Policy/Config/LanmanServer/MinSmb2Dialect +``` + + + + +This policy controls the minimum version of SMB protocol. + +> [!NOTE] +> This group policy doesn't prevent use of SMB 1 if that component is still installed and enabled. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | `int` | +| Access Type | Add, Delete, Get, Replace | +| Default Value | 514 | + + + +**Allowed values**: + +| Value | Description | +|:--|:--| +| 514 (Default) | SMB 2.0.2. | +| 528 | SMB 2.1.0. | +| 768 | SMB 3.0.0. | +| 770 | SMB 3.0.2. | +| 785 | SMB 3.1.1. | + + + +**Group policy mapping**: + +| Name | Value | +|:--|:--| +| Name | Pol_MinSmb2Dialect | +| Friendly Name | Mandate the minimum version of SMB | +| Location | Computer Configuration | +| Path | Network > Lanman Server | +| Registry Key Name | Software\Policies\Microsoft\Windows\LanmanServer | +| ADMX File Name | LanmanServer.admx | + + + + + + + + + + + + + + +## Related articles + +[Policy configuration service provider](policy-configuration-service-provider.md) diff --git a/windows/client-management/mdm/toc.yml b/windows/client-management/mdm/toc.yml index 28c696c112..51966229d9 100644 --- a/windows/client-management/mdm/toc.yml +++ b/windows/client-management/mdm/toc.yml @@ -471,6 +471,8 @@ items: href: policy-csp-kerberos.md - name: KioskBrowser href: policy-csp-kioskbrowser.md + - name: LanmanServer + href: policy-csp-lanmanserver.md - name: LanmanWorkstation href: policy-csp-lanmanworkstation.md - name: Licensing @@ -999,3 +1001,8 @@ items: items: - name: WiredNetwork DDF file href: wirednetwork-ddf-file.md + - name: WirelessNetworkPreference + href: wirelessnetworkpreference-csp.md + items: + - name: WirelessNetworkPreference DDF file + href: wirelessnetworkpreference-ddf-file.md diff --git a/windows/client-management/mdm/wirelessnetworkpreference-csp.md b/windows/client-management/mdm/wirelessnetworkpreference-csp.md new file mode 100644 index 0000000000..b356a16a04 --- /dev/null +++ b/windows/client-management/mdm/wirelessnetworkpreference-csp.md @@ -0,0 +1,844 @@ +--- +title: WirelessNetworkPreference CSP +description: Learn more about the WirelessNetworkPreference CSP. +ms.date: 04/21/2025 +ms.topic: generated-reference +--- + + + + +# WirelessNetworkPreference CSP + +[!INCLUDE [Windows Insider tip](includes/mdm-insider-csp-note.md)] + + + + + + +The following list shows the WirelessNetworkPreference configuration service provider nodes: + +- ./Device/Vendor/MSFT/WirelessNetworkPreference + - [ConnectionProfiles](#connectionprofiles) + - [{ConnectionProfileID}](#connectionprofilesconnectionprofileid) + - [Cellular](#connectionprofilesconnectionprofileidcellular) + - [PLMNID](#connectionprofilesconnectionprofileidcellularplmnid) + - [Priority](#connectionprofilesconnectionprofileidpriority) + - [WirelessType](#connectionprofilesconnectionprofileidwirelesstype) + - [IsEnabled](#isenabled) + - [Parameters](#parameters) + - [CellularParameters](#parameterscellularparameters) + - [MaxRescanIntervalInSeconds](#parameterscellularparametersmaxrescanintervalinseconds) + - [NetworkDiscoveryOption](#parameterscellularparametersnetworkdiscoveryoption) + - [PreferredProfileWakeConnectionTimerInSeconds](#parameterscellularparameterspreferredprofilewakeconnectiontimerinseconds) + - [ProfileRegistrationTimerInSeconds](#parameterscellularparametersprofileregistrationtimerinseconds) + - [ScreenOffDurationToTriggerNetworkDiscoveryInMinutes](#parameterscellularparametersscreenoffdurationtotriggernetworkdiscoveryinminutes) + - [PreferCellularOverWiFi](#prefercellularoverwifi) + - [Status](#status) + - [eSIMpolicyStatus](#statusesimpolicystatus) + - [eSIMprofilesCount](#statusesimprofilescount) + - [eSIMprofilesMatched](#statusesimprofilesmatched) + + + +## ConnectionProfiles + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | + + + +```Device +./Device/Vendor/MSFT/WirelessNetworkPreference/ConnectionProfiles +``` + + + + +Profiles to connect to wireless networks in a specified priority order. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | `node` | +| Access Type | Get | + + + + + + + + + +### ConnectionProfiles/{ConnectionProfileID} + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | + + + +```Device +./Device/Vendor/MSFT/WirelessNetworkPreference/ConnectionProfiles/{ConnectionProfileID} +``` + + + + +Unique identifier of a network preference policy. Unique ID is auto-generated. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | `node` | +| Access Type | Add, Delete, Get | +| Dynamic Node Naming | ServerGeneratedUniqueIdentifier | + + + + + + + + + +#### ConnectionProfiles/{ConnectionProfileID}/Cellular + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | + + + +```Device +./Device/Vendor/MSFT/WirelessNetworkPreference/ConnectionProfiles/{ConnectionProfileID}/Cellular +``` + + + + +Identifiers for cellular networks. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | `node` | +| Access Type | Add, Delete, Get | + + + + + + + + + +##### ConnectionProfiles/{ConnectionProfileID}/Cellular/PLMNID + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | + + + +```Device +./Device/Vendor/MSFT/WirelessNetworkPreference/ConnectionProfiles/{ConnectionProfileID}/Cellular/PLMNID +``` + + + + +5- or 6-digit string identifying a cellular network. It consists of the combination of Mobile Country Code (MCC) and Mobile Network Code (MNC). + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | `chr` (string) | +| Access Type | Add, Delete, Get, Replace | +| Allowed Values | Regular Expression: `^[0-9]{5,6}$` | + + + + + + + + + +#### ConnectionProfiles/{ConnectionProfileID}/Priority + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | + + + +```Device +./Device/Vendor/MSFT/WirelessNetworkPreference/ConnectionProfiles/{ConnectionProfileID}/Priority +``` + + + + +Priority of a policy compared to the others where 1 represents the highest priority. Thus, the smaller this value is, the higher preference this specific network will receive in establishing a data connection. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | `int` | +| Access Type | Add, Delete, Get, Replace | +| Allowed Values | Range: `[1-2147483647]` | + + + + + + + + + +#### ConnectionProfiles/{ConnectionProfileID}/WirelessType + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | + + + +```Device +./Device/Vendor/MSFT/WirelessNetworkPreference/ConnectionProfiles/{ConnectionProfileID}/WirelessType +``` + + + + +Type of wireless network (either Cellular or Wi-Fi). 0 represents Cellular, and 1 represents Wi-Fi. Currently only cellular is supported. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | `bin` | +| Access Type | Add, Delete, Get, Replace | +| Default Value | 0 | + + + +**Allowed values**: + +| Value | Description | +|:--|:--| +| 0 (Default) | Cellular. | +| 1 | Wi-Fi. | + + + + + + + + + +## IsEnabled + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | + + + +```Device +./Device/Vendor/MSFT/WirelessNetworkPreference/IsEnabled +``` + + + + +It determines whether the wireless connectivity management policy is enabled or not. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | `bool` | +| Access Type | Get, Replace | +| Default Value | False | + + + +**Allowed values**: + +| Value | Description | +|:--|:--| +| False (Default) | Disable the wireless management policy. | +| True | Enable the wireless management policy. | + + + + + + + + + +## Parameters + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | + + + +```Device +./Device/Vendor/MSFT/WirelessNetworkPreference/Parameters +``` + + + + +Parameters to configure the behavior of the wireless connectivity management service. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | `node` | +| Access Type | Get | + + + + + + + + + +### Parameters/CellularParameters + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | + + + +```Device +./Device/Vendor/MSFT/WirelessNetworkPreference/Parameters/CellularParameters +``` + + + + +Parameters to configure the cellular-specific behavior of the wireless connectivity management service. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | `node` | +| Access Type | Get | + + + + + + + + + +#### Parameters/CellularParameters/MaxRescanIntervalInSeconds + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | + + + +```Device +./Device/Vendor/MSFT/WirelessNetworkPreference/Parameters/CellularParameters/MaxRescanIntervalInSeconds +``` + + + + +Maximum time (in seconds) from the point that no connection could be established using the permissible eSIM profiles on the device to the start of the next round of network discovery attempts. A smaller interval increases network discovery frequency and can decrease battery life significantly. A value of 0 means that the device is to pick a reasonable interval per its own discretion. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | `int` | +| Access Type | Get, Replace | +| Allowed Values | Range: `[0-360]` | +| Default Value | 0 | + + + + + + + + + +#### Parameters/CellularParameters/NetworkDiscoveryOption + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | + + + +```Device +./Device/Vendor/MSFT/WirelessNetworkPreference/Parameters/CellularParameters/NetworkDiscoveryOption +``` + + + + +Configures which approach should be used in the network discovery process. There are two possible values: (0) no network scan will be performed - rather, registration and connection will be attempted with each eSIM profile in descending order of preference; or (1) Network scan will be performed using the current active eSIM profile. This option works for modems that when performing a network scan show the complete list of available networks independently of which eSIM profile is active. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | `int` | +| Access Type | Get, Replace | +| Default Value | 0 | + + + +**Allowed values**: + +| Value | Description | +|:--|:--| +| 0 (Default) | No network scan will be performed -- rather, registration and connection will be attempted with each eSIM profile in descending order of preference. | +| 1 | Network scan will be performed using the current active eSIM profile. | + + + + + + + + + +#### Parameters/CellularParameters/PreferredProfileWakeConnectionTimerInSeconds + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | + + + +```Device +./Device/Vendor/MSFT/WirelessNetworkPreference/Parameters/CellularParameters/PreferredProfileWakeConnectionTimerInSeconds +``` + + + + +When the device is woken from sleep with the most-preferred profile already enabled, this value configures the amount of time (in seconds) before the agent will give up on waiting for connection re-establishment with the most-preferred profile and start network discovery. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | `int` | +| Access Type | Get, Replace | +| Allowed Values | Range: `[30-360]` | +| Default Value | 200 | + + + + + + + + + +#### Parameters/CellularParameters/ProfileRegistrationTimerInSeconds + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | + + + +```Device +./Device/Vendor/MSFT/WirelessNetworkPreference/Parameters/CellularParameters/ProfileRegistrationTimerInSeconds +``` + + + + +When evaluating eSIM profiles for connectivity, this value configures the amount of time (in seconds) that the agent will wait for network registration before considering this profile unsatisfactory and moving on to the next one. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | `int` | +| Access Type | Get, Replace | +| Allowed Values | Range: `[30-360]` | +| Default Value | 60 | + + + + + + + + + +#### Parameters/CellularParameters/ScreenOffDurationToTriggerNetworkDiscoveryInMinutes + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | + + + +```Device +./Device/Vendor/MSFT/WirelessNetworkPreference/Parameters/CellularParameters/ScreenOffDurationToTriggerNetworkDiscoveryInMinutes +``` + + + + +When the device experiences screen off and back on, this value configures the minimum duration (in minutes) of the screen off period that will trigger network discovery. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | `int` | +| Access Type | Get, Replace | +| Allowed Values | Range: `[0-30]` | +| Default Value | 10 | + + + + + + + + + +## PreferCellularOverWiFi + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | + + + +```Device +./Device/Vendor/MSFT/WirelessNetworkPreference/PreferCellularOverWiFi +``` + + + + +It determines the order of preference between Wi-Fi and cellular networks. When the value is set to "False", Wi-Fi is preferred over cellular. When the value is set to "True", cellular is preferred over Wi-Fi. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | `bool` | +| Access Type | Get, Replace | +| Default Value | False | + + + +**Allowed values**: + +| Value | Description | +|:--|:--| +| False (Default) | Prefer Wi-Fi over Cellular. | +| True | Prefer Cellular over Wi-Fi. | + + + + + + + + + +## Status + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | + + + +```Device +./Device/Vendor/MSFT/WirelessNetworkPreference/Status +``` + + + + +Nodes that indicate the status of the wireless connectivity management service. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | `node` | +| Access Type | Get | + + + + + + + + + +### Status/eSIMpolicyStatus + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | + + + +```Device +./Device/Vendor/MSFT/WirelessNetworkPreference/Status/eSIMpolicyStatus +``` + + + + +An integer indicating the current status of the wireless connectivity management service. If the value is zero, there are no errors. \n\n 0 = No errors. \n 1 = No policies are configured. \n 2 = More than one policy has the same priority. \n 3 = More than one policy references the same PLMNID. \n 4 = Invalid PLMNID for one or more of the configured profiles. \n 5 = More than one eSIM profile stored in the eUICC with the same PLMN ID. \n 6 = Invalid configuration value for one or more of the cellular parameters. Please review CSP documentation. \n\n Warning: Any of these errors will result in a complete halt of the wireless connectivity management service. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | `int` | +| Access Type | Get | + + + + + + + + + +### Status/eSIMprofilesCount + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | + + + +```Device +./Device/Vendor/MSFT/WirelessNetworkPreference/Status/eSIMprofilesCount +``` + + + + +Count of operational eSIM profiles stored in the eUICC. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | `int` | +| Access Type | Get | + + + + + + + + + +### Status/eSIMprofilesMatched + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| ✅ Device
❌ User | ✅ Pro
✅ Enterprise
✅ Education
✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows Insider Preview | + + + +```Device +./Device/Vendor/MSFT/WirelessNetworkPreference/Status/eSIMprofilesMatched +``` + + + + +Count of operational eSIM profiles stored on the eUICC whose PLMN matches one of the ConnectionProfileIDs setup under the ConnectionProfiles node. Only matched profiles with no errors will be counted. If more than one eSIM profile with the same PLMN ID is configured on the policy and/or more than one eSIM profile with the same PLMN ID is stored in the eUICC, then they won't be counted even if there is a match. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | `int` | +| Access Type | Get | + + + + + + + + + + + + + + +## Related articles + +[Configuration service provider reference](configuration-service-provider-reference.md) diff --git a/windows/client-management/mdm/wirelessnetworkpreference-ddf-file.md b/windows/client-management/mdm/wirelessnetworkpreference-ddf-file.md new file mode 100644 index 0000000000..e23616812e --- /dev/null +++ b/windows/client-management/mdm/wirelessnetworkpreference-ddf-file.md @@ -0,0 +1,543 @@ +--- +title: WirelessNetworkPreference DDF file +description: View the XML file containing the device description framework (DDF) for the WirelessNetworkPreference configuration service provider. +ms.date: 04/21/2025 +ms.topic: generated-reference +--- + + + +# WirelessNetworkPreference DDF file + +The following XML file contains the device description framework (DDF) for the WirelessNetworkPreference configuration service provider. + +```xml + +]> + + 1.2 + + + + WirelessNetworkPreference + ./Device/Vendor/MSFT + + + + + Represents information associated with wireless networks prioritization including detailed connectivity priorities for specific cellular networks with a unique PLMN_ID. + + + + + + + + + + + + + + 99.9.99999 + 1.0 + 0x4;0x1B;0x30;0x31;0x48;0x54;0x62;0x63;0x64;0x65;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x88;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xBC;0xBF;0xCA;0xCB;0xCD;0xCF;0xD2; + + + + IsEnabled + + + + + + False + It determines whether the wireless connectivity management policy is enabled or not. + + + + + + + + + + + + + + + False + Disable the wireless management policy. + + + True + Enable the wireless management policy. + + + + + + PreferCellularOverWiFi + + + + + + False + It determines the order of preference between Wi-Fi and cellular networks. When the value is set to “False”, Wi-Fi is preferred over cellular. When the value is set to “True”, cellular is preferred over Wi-Fi. + + + + + + + + + + + + + + + False + Prefer Wi-Fi over Cellular. + + + True + Prefer Cellular over Wi-Fi. + + + + + + Status + + + + + Nodes that indicate the status of the wireless connectivity management service. + + + + + + + + + + + + + + + eSIMprofilesCount + + + + + Count of operational eSIM profiles stored in the eUICC. + + + + + + + + + + + + + + + + eSIMprofilesMatched + + + + + Count of operational eSIM profiles stored on the eUICC whose PLMN matches one of the ConnectionProfileIDs setup under the ConnectionProfiles node. Only matched profiles with no errors will be counted. If more than one eSIM profile with the same PLMN ID is configured on the policy and/or more than one eSIM profile with the same PLMN ID is stored in the eUICC, then they will not be counted even if there is a match. + + + + + + + + + + + + + + + + eSIMpolicyStatus + + + + + An integer indicating the current status of the wireless connectivity management service. If the value is zero, there are no errors. \n\n 0 = No errors. \n 1 = No policies are configured. \n 2 = More than one policy has the same priority. \n 3 = More than one policy references the same PLMNID. \n 4 = Invalid PLMNID for one or more of the configured profiles. \n 5 = More than one eSIM profile stored in the eUICC with the same PLMN ID. \n 6 = Invalid configuration value for one or more of the cellular parameters. Please review CSP documentation. \n\n Warning: Any of these errors will result in a complete halt of the wireless connectivity management service. + + + + + + + + + + + + + + + + + Parameters + + + + + Parameters to configure the behavior of the wireless connectivity management service. + + + + + + + + + + + + + + + CellularParameters + + + + + Parameters to configure the cellular-specific behavior of the wireless connectivity management service. + + + + + + + + + + + + + + + NetworkDiscoveryOption + + + + + + 0 + Configures which approach should be used in the network discovery process. There are two possible values: (0) no network scan will be performed – rather, registration and connection will be attempted with each eSIM profile in descending order of preference; or (1) Network scan will be performed using the current active eSIM profile. This option works for modems that when performing a network scan show the complete list of available networks independently of which eSIM profile is active. + + + + + + + + + + + + + + + 0 + No network scan will be performed -- rather, registration and connection will be attempted with each eSIM profile in descending order of preference. + + + 1 + Network scan will be performed using the current active eSIM profile. + + + + + + MaxRescanIntervalInSeconds + + + + + + 0 + Maximum time (in seconds) from the point that no connection could be established using the permissible eSIM profiles on the device to the start of the next round of network discovery attempts. A smaller interval increases network discovery frequency and can decrease battery life significantly. A value of 0 means that the device is to pick a reasonable interval per its own discretion. + + + + + + + + + + + + + + [0-360] + + + + + PreferredProfileWakeConnectionTimerInSeconds + + + + + + 200 + When the device is woken from sleep with the most-preferred profile already enabled, this value configures the amount of time (in seconds) before the agent will give up on waiting for connection re-establishment with the most-preferred profile and start network discovery. + + + + + + + + + + + + + + [30-360] + + + + + ProfileRegistrationTimerInSeconds + + + + + + 60 + When evaluating eSIM profiles for connectivity, this value configures the amount of time (in seconds) that the agent will wait for network registration before considering this profile unsatisfactory and moving on to the next one. + + + + + + + + + + + + + + [30-360] + + + + + ScreenOffDurationToTriggerNetworkDiscoveryInMinutes + + + + + + 10 + When the device experiences screen off and back on, this value configures the minimum duration (in minutes) of the screen off period that will trigger network discovery. + + + + + + + + + + + + + + [0-30] + + + + + + + ConnectionProfiles + + + + + Profiles to connect to wireless networks in a specified priority order. + + + + + + + + + + + + + + + + + + + + + + + Unique identifier of a network preference policy. Unique ID is auto-generated. + + + + + + + + + + ConnectionProfileID + + + + + + + + + Priority + + + + + + + + Priority of a policy compared to the others where 1 represents the highest priority. Thus, the smaller this value is, the higher preference this specific network will receive in establishing a data connection. + + + + + + + + + + + + + + [1-2147483647] + + + + + WirelessType + + + + + + + + 0 + Type of wireless network (either Cellular or Wi-Fi). 0 represents Cellular, and 1 represents Wi-Fi. Currently only cellular is supported. + + + + + + + + + + + + + + + 0 + Cellular + + + 1 + Wi-Fi + + + + + + Cellular + + + + + + + Identifiers for cellular networks. + + + + + + + + + + + + + + + PLMNID + + + + + + + + 5- or 6-digit string identifying a cellular network. It consists of the combination of Mobile Country Code (MCC) and Mobile Network Code (MNC). + + + + + + + + + + + + + + ^[0-9]{5,6}$ + + + + + + + + +``` + +## Related articles + +[WirelessNetworkPreference configuration service provider reference](wirelessnetworkpreference-csp.md) diff --git a/windows/configuration/images/icons/xml.svg b/windows/configuration/images/icons/xml.svg new file mode 100644 index 0000000000..f1cd92d25d --- /dev/null +++ b/windows/configuration/images/icons/xml.svg @@ -0,0 +1,7 @@ + + + + + + + diff --git a/windows/configuration/unbranded-boot/images/boot.jpg b/windows/configuration/unbranded-boot/images/boot.jpg deleted file mode 100644 index bc46adb1cf..0000000000 Binary files a/windows/configuration/unbranded-boot/images/boot.jpg and /dev/null differ diff --git a/windows/configuration/unbranded-boot/images/boot.png b/windows/configuration/unbranded-boot/images/boot.png new file mode 100644 index 0000000000..4f8de5713b Binary files /dev/null and b/windows/configuration/unbranded-boot/images/boot.png differ diff --git a/windows/configuration/unbranded-boot/index.md b/windows/configuration/unbranded-boot/index.md index e3aa95b244..a7edd8a9cf 100644 --- a/windows/configuration/unbranded-boot/index.md +++ b/windows/configuration/unbranded-boot/index.md @@ -1,160 +1,155 @@ --- title: Unbranded Boot -description: Unbranded Boot -ms.date: 09/10/2024 -ms.topic: overview +description: Learn about Unbranded Boot, a feature that suppresses Windows elements that appear when Windows starts. Unbranded Boot can also suppress the crash screen when Windows encounters an error that it can't recover from. +ms.date: 04/11/2025 +ms.topic: how-to --- # Unbranded Boot -You can suppress Windows elements that appear when Windows starts or resumes and can suppress the crash screen when Windows encounters an error that it can't recover from. This feature is known as Unbranded Boot. +Unbranded Boot is a Windows feature that allows you to suppress Windows elements that appear when Windows starts. It can also suppress the crash screen when Windows encounters an error that it can't recover from. This feature is useful for devices that are used in public spaces, such as kiosks and digital signs, where a clean and professional appearance is important. + +[!INCLUDE [unbranded-boot](../../../includes/licensing/unbranded-boot.md)] + +## Enable Unbranded Boot + +Unbranded Boot is an optional component and isn't enabled by default in Windows. To configure it, you must first enable it. + +There are different ways to enable Unbranded Boot, select the method that best fits your needs to learn more. + +#### [:::image type="icon" source="../images/icons/control-panel.svg"::: **Control Panel**](#tab/control-panel1) + +To enable Unbranded Boot using the Control Panel, follow these steps: + +1. Open **Control Panel** > **Programs** > **Turn Windows features on or off** or use the command `optionalfeatures.exe` +1. Expand **Device Lockdown** and select **Unbranded Boot** +1. Select **OK** to enable Unbranded Boot +1. Restart your device to apply the changes + +#### [:::image type="icon" source="../images/icons/powershell.svg"::: **PowerShell**](#tab/powershell1) + +To enable Unbranded Boot using PowerShell, follow these steps: + +1. Open a PowerShell window with administrator privileges +1. Run the following command: + ```powershell + Enable-WindowsOptionalFeature -FeatureName Client-DeviceLockdown,Client-EmbeddedBootExp -Online + ``` +1. Restart your device to apply the changes + +--- > [!IMPORTANT] > The first user to sign in to the device must be an administrator. This ensures that the **RunOnce** registry settings correctly apply the settings. Also, when using auto sign-in, you must not configure auto sign-in on your device at design time. Instead, auto sign-in should be configured manually after first signing in as an administrator. -## Requirements +## Configure Unbranded Boot -Unbranded Boot can be enabled on: +The following instructions provide details about how to configure your devices. Select the option that best suits your needs. -- Windows 10 Enterprise -- Windows 10 IoT Enterprise -- Windows 10 Education -- Windows 11 Enterprise -- Windows 11 IoT Enterprise -- Windows 11 Education +> [!NOTE] +> If Windows is already installed, you can't apply a provisioning package to configure Unbranded Boot. Instead, you must use the command prompt to configure Unbranded Boot. -## Terminology +#### [:::image type="icon" source="../images/icons/cmd.svg"::: **Command prompt**](#tab/cmd) -- **Turn on, Enable:** To make the setting available to the device and optionally apply the settings to the device. Generally "turn on" is used in the user interface or control panel, whereas "enable" is used for command line. +You can use the `bcdedit.exe` command to configure Unbranded Boot settings at runtime. -- **Configure:** To customize the setting or subsettings. +> [!NOTE] +> `Bcdedit.exe` is a command-line tool for editing the Boot Configuration Data (BCD) of Windows. Administrator privileges are required to use BCDEdit to modify the BCD. -- **Embedded Boot Experience:** this feature is called "Embedded Boot Experience" in Windows 10, build 1511. - -- **Custom Boot Experience:** this feature is called "Custom Boot Experience" in Windows 10, build 1607 and later. - -## Turn on Unbranded Boot settings - -Unbranded Boot is an optional component and isn't enabled by default in Windows. It must be enabled prior to configuring. - -If Windows has already been installed, you can't apply a provisioning package to configure Unbranded Boot; instead you must use BDCEdit to configure Unbranded boot if Windows is installed. - -BCDEdit is the primary tool for editing the Boot Configuration Database (BCD) of Windows and is included in Windows in the %WINDIR%\\System32 folder. Administrator privileges are required to use BCDEdit to modify the BCD. - -### Turn on Unbranded Boot by using Control Panel - -1. In the Windows search bar, type **Turn Windows features on or off** and either press **Enter** or tap or select **Turn Windows features on or off** to open the **Windows Features** window. -1. In the **Windows Features** window, expand the **Device Lockdown** node, and select (to turn on) or clear (to turn off) the checkbox for **Unbranded Boot**. -1. Select **OK**. The **Windows Features** window indicates that Windows is searching for required files and displays a progress bar. Once found, the window indicates that Windows is applying the changes. When completed, the window indicates the requested changes are completed. -1. Restart your device to apply the changes. - -## Configure Unbranded Boot settings at runtime using BCDEdit - -1. Open a command prompt as an administrator. -1. Run the following command to disable the F8 key during startup to prevent access to the **Advanced startup options** menu. +1. Open a command prompt as an administrator +1. Run the following command to disable the F8 key during startup to prevent access to the **Advanced startup options** menu ```cmd bcdedit.exe -set {globalsettings} advancedoptions false ``` -1. Run the following command to disable the F10 key during startup to prevent access to the **Advanced startup options** menu. +1. Run the following command to disable the F10 key during startup to prevent access to the **Advanced startup options** menu ```cmd bcdedit.exe -set {globalsettings} optionsedit false ``` -1. Run the following command to suppress all Windows UI elements (logo, status indicator, and status message) during startup. +1. Run the following command to suppress all Windows UI elements (logo, status indicator, and status message) during startup ```cmd bcdedit.exe -set {globalsettings} bootuxdisabled on ``` -1. Run the following command to suppress any error screens that are displayed during boot. If **noerrordisplay** is on and the boot manager hits a *WinLoad Error* or *Bad Disk Error*, the system displays a black screen. +1. Run the following command to suppress any error screens that are displayed during boot. If `noerrordisplay` is set to `on` and the boot manager hits a *WinLoad Error* or *Bad Disk Error*, the system displays a black screen ```cmd bcdedit.exe -set {bootmgr} noerrordisplay on ``` -## Configure Unbranded Boot using Unattend +#### [:::image type="icon" source="../images/icons/xml.svg"::: **Unattend**](#tab/unattend) -You can also configure the Unattend settings in the [Microsoft-Windows-Embedded-BootExp](/windows-hardware/customize/desktop/unattend/microsoft-windows-embedded-bootexp) component to add Unbranded Boot features to your image during the design or imaging phase. You can manually create an Unattend answer file or use Windows System Image Manager (Windows SIM) to add the appropriate settings to your answer file. For more information about the Unbranded Boot settings and XML examples, see the settings in Microsoft-Windows-Embedded-BootExp. +You can configure the Unattend settings in the `Microsoft-Windows-Embedded-BootExp` component to add Unbranded Boot features to your image during the design or imaging phase. You can manually create an Unattend answer file or use Windows System Image Manager (Windows SIM) to add the appropriate settings to your answer file. ### Unbranded Boot settings -The following table shows Unbranded Boot settings and their values. +The following table lists Unbranded Boot settings and their values. | Setting | Description | Value | |---------|-------------|-------| -| DisableBootMenu | Contains an integer that disables the F8 and F10 keys during startup to prevent access to the Advanced startup options menu. | Set to 1 to disable the menu; otherwise; set to 0 (zero). The default value is 0. | -| DisplayDisabled | Contains an integer that configures the device to display a blank screen when Windows encounters an error that it can't recover from. | Set to 1 to display a blank screen on error; otherwise; set to 0 (zero). The default value is 0. | -| HideAllBootUI | Contains an integer that suppresses all Windows UI elements (logo, status indicator, and status message) during startup. | Set to 1 to suppress all Windows UI elements during startup; otherwise; set to 0 (zero). The default value is 0. | -| HideBootLogo | Contains an integer that suppresses the default Windows logo that displays during the OS loading phase. | Set to 1 to suppress the default Windows logo; otherwise; set to 0 (zero). The default value is 0. | -| HideBootStatusIndicator | Contains an integer that suppresses the status indicator that displays during the OS loading phase. | Set to 1 to suppress the status indicator; otherwise; set to 0 (zero). The default value is 0. | -| HideBootStatusMessage | Contains an integer that suppresses the startup status text that displays during the OS loading phase. | Set to 1 to suppress the startup status text; otherwise; set to 0 (zero). The default value is 0. | +| `DisableBootMenu` | Contains an integer that disables the F8 and F10 keys during startup to prevent access to the *Advanced startup options* menu. | - Set to `1` to disable the menu
- The default value is `0`| +| `DisplayDisabled` | Contains an integer that configures the device to display a blank screen when Windows encounters an error that it can't recover from. | - Set to `1` to display a blank screen on error
- The default value is `0`| +| `HideAllBootUI` | Contains an integer that suppresses all Windows UI elements (logo, status indicator, and status message) during startup. | - Set to `1` to suppress all Windows UI elements during startup
- The default value is `0`| +| `HideBootLogo` | Contains an integer that suppresses the default Windows logo that displays during the OS loading phase. | - Set to `1` to suppress the default Windows logo
- The default value is `0`| +| `HideBootStatusIndicator` | Contains an integer that suppresses the status indicator that displays during the OS loading phase. | - Set to `1` to suppress the status indicator
- The default value is `0`| +| `HideBootStatusMessage` | Contains an integer that suppresses the startup status text that displays during the OS loading phase. | - Set to `1` to suppress the startup status text
- The default value is `0`| -## Customize the boot screen using Windows Configuration Designer and Deployment Image Servicing and Management (DISM) +For more information about the Unbranded Boot settings and XML examples, see the settings in [Microsoft-Windows-Embedded-BootExp](/windows-hardware/customize/desktop/unattend/microsoft-windows-embedded-bootexp). -You must enable Unbranded boot on the installation media with DISM before you can apply settings for Unbranded boot using either Windows Configuration Designer or applying a provisioning package during setup. +#### [:::image type="icon" source="../images/icons/provisioning-package.svg"::: **PPKG**](#tab/ppkg) -1. Create a provisioning package or create a new Windows image in Windows Configuration Designer by following the instructions in [Create a provisioning package](/windows/configuration/provisioning-packages/provisioning-create-package). +Customize the boot screen using Windows Configuration Designer and Deployment Image Servicing and Management (DISM). -1. In the Available customizations page, select **Runtime settings** > **SMISettings** and then set the value for the boot screen settings. The following values are just examples. +You must enable Unbranded Boot on the installation media with DISM before you can apply settings for Unbranded Boot using either Windows Configuration Designer or applying a provisioning package during setup. - - **HideAllBootUI**=FALSE - - **HideBootLogo**=FALSE - - **HideBootStatusIndicator**=TRUE - - **HideBootStatusMessage**=TRUE - - **CrashDumpEnabled**=Full dump +[!INCLUDE [provisioning-package-1](../../../includes/configure/provisioning-package-1.md)] - > [!TIP] - > For more information, see [SMISettings](/windows/configuration/wcd/wcd-smisettings) in the Windows Configuration Designer reference. +|Path|Value| +|---|---| +|`Runtime settings/SMISettings/HideAllBootUI`| `TRUE` or `FALSE`| +|`Runtime settings/SMISettings/HideBootLogo`| `TRUE` or `FALSE`| +|`Runtime settings/SMISettings/HideBootStatusIndicator`| `TRUE` or `FALSE`| +|`Runtime settings/SMISettings/HideBootStatusMessage`| `TRUE` or `FALSE`| -1. Once you have finished configuring the settings and building the package or image, you use DISM to apply the settings. - 1. Open a command prompt with administrator privileges. - 1. Copy install.wim to a temporary folder on hard drive (in the following steps, it assumes it's called c:\\wim). - 1. Create a new directory. +> [!TIP] +> For more information, see [SMISettings](/windows/configuration/wcd/wcd-smisettings) in the Windows Configuration Designer reference. - ```cmd - md c:\wim - ``` +Once you finish to configure the settings and building the package or image, use DISM to apply the settings: - 1. Mount the image. +1. Open a command prompt with administrator privileges +1. Copy `install.wim` to a temporary folder on the hard drive (for example, `c:\wim`) +1. Create a new directory to mount the image: - ```cmd - dism /mount-wim /wimfile:c:\bootmedia\sources\install.wim /index:1 /MountDir:c:\wim - ``` + ```cmd + md c:\wim + ``` +1. Mount the image: + ```cmd + dism /mount-wim /wimfile:c:\bootmedia\sources\install.wim /index:1 /MountDir:c:\wim + ``` +1. Enable the feature: + ```cmd + dism /image:c:\wim /enable-feature /featureName:Client-EmbeddedBootExp + ``` +1. Commit the change: + ```cmd + dism /unmount-wim /MountDir:c:\wim /Commit + ``` - 1. Enable the feature. +--- - ```cmd - dism /image:c:\wim /enable-feature /featureName:Client-EmbeddedBootExp - ``` +In the following image: - 1. Commit the change. +1. `BootLogo` is outlined in green +1. `BootStatusIndicator` is outlined in red +1. `BootStatusMessage` is outlined in blue - ```cmd - dism /unmount-wim /MountDir:c:\wim /Commit - ``` - -In the following image, the BootLogo is outlined in green, the BootStatusIndicator is outlined in red, and the BootStatusMessage is outlined in blue. - -![unbranded boot screen](images/boot.jpg) +:::image type="content" source="images/boot.png" alt-text="Screenshot of the boot screen showing the areas that can be configured with Unbranded Boot." border="false"::: ## Replace the startup logo The only supported way to replace the startup logo with a custom logo is to modify the Boot Graphics Resource Table (BGRT) on a device that uses UEFI as the firmware interface. If your device uses the BGRT to include a custom logo, it's always displayed and you can't suppress the custom logo. - -## Suppress Errors During Boot - -Errors that occur during early Windows Boot are typically a sign of bad device configuration or failing hardware and require user intervention to recover. You can suppress all error screens during early boot by enabling the **noerrordisplay** BCD setting. - -1. Open a command prompt as an administrator. -1. Run the following command to suppress error screens during boot. - - ```cmd - bcdedit.exe -set {bootmgr} noerrordisplay on - ``` - -## Related articles - -- [Custom Logon](../custom-logon/index.md) diff --git a/windows/deployment/do/delivery-optimization-endpoints.md b/windows/deployment/do/delivery-optimization-endpoints.md index 1f8366e62b..e4f3e8e804 100644 --- a/windows/deployment/do/delivery-optimization-endpoints.md +++ b/windows/deployment/do/delivery-optimization-endpoints.md @@ -14,7 +14,7 @@ appliesto: - ✅ Microsoft Connected Cache for ISPs - ✅ Microsoft Connected Cache for Enterprise and Education - ✅ Connected Cache on a Configuration Manager distribution point -ms.date: 05/23/2024 +ms.date: 04/15/2025 --- # Microsoft Connected Cache content and services endpoints @@ -39,3 +39,4 @@ Use the table below to reference any particular content types or services endpoi | *.azure-devices.net, *.global.azure-devices-provisioning.net, *.azurecr.io, *.blob.core.windows.net, *.mcr.microsoft.com, github.com | HTTPs / 443 | IoT Edge / IoT Hub communication| [Complete list](/azure/iot-hub/iot-hub-devguide-protocols) of Azure IoT Hub communication protocols and ports. [Azure IoT Guide](/azure/iot-hub/iot-hub-devguide-endpoints) to understanding Azure IoT Hub endpoints. | Connected Cache Managed in Azure | | *.ubuntu.com, api.snapcraft.io | HTTP / 80
HTTPs / 443 | Ubuntu package updates | Used by Linux distribution image in WSL on Windows host machine to deploy Connected Cache. | Connected Cache Managed in Azure | | packages.microsoft.com | HTTP / 80
HTTPs / 443 | Microsoft package updates | Used to deploy required Connected Cache packages to Windows and Linux host machines. | Connected Cache Managed in Azure | +| aka.ms, raw.githubusercontent.com | HTTPs / 443 | Azure IoT Identity Service | Checks the identity service version file is the latest version. | Connected Cache Managed in Azure | diff --git a/windows/deployment/do/mcc-ent-edu-overview.md b/windows/deployment/do/mcc-ent-edu-overview.md index c730c9e094..ab381b007f 100644 --- a/windows/deployment/do/mcc-ent-edu-overview.md +++ b/windows/deployment/do/mcc-ent-edu-overview.md @@ -89,8 +89,8 @@ The following diagram displays an overview of how Connected Cache functions: 1. The Microsoft Connected Cache container is deployed to the device using Azure IoT Edge container management services and the cache server begins reporting status and metrics to Delivery Optimization services. 1. The DOCacheHost setting is configured using Intune or other MDM, DHCP custom option, or registry key. 1. Devices request content from the cache server, the cache server forwards the requests to the CDN and fills the cache, the cache server delivers the content requested to the devices, and uses Peer to Peer (depending on DO Download mode settings) for all DO content. -1. Devices can fall back to CDN if the cache server is unavailable for any reason or use Delivery Optimization delay fallback to http (CDN) settings to prefer the local cache server. -You can view data about Microsoft Connected Cache downloads on management portal and Windows Update for Business reports. +1. Devices can fall back to CDN if the cache server is unavailable for any reason or use Delivery Optimization delay fallback to http (CDN) settings to prefer the local cache server. If the cache server fails to respond, the client downloads the content from the CDN. To delay this behavior, set the [DelayCacheServerFallbackForeground/DelayCacheServerFallbackBackground](/windows/deployment/do/waas-delivery-optimization-reference#delay-foreground-download-cache-server-fallback-in-secs) setting to avoid the immediate fallback. You can view data about Microsoft Connected Cache downloads on management portal and Windows Update for Business reports. + ## Next steps diff --git a/windows/deployment/do/waas-delivery-optimization-faq.yml b/windows/deployment/do/waas-delivery-optimization-faq.yml index 8b0fb66a41..1ef7f16540 100644 --- a/windows/deployment/do/waas-delivery-optimization-faq.yml +++ b/windows/deployment/do/waas-delivery-optimization-faq.yml @@ -17,7 +17,7 @@ metadata: - ✅ Windows 10 - ✅ Windows Server 2019, and later - ✅ Delivery Optimization - ms.date: 02/27/2025 + ms.date: 04/14/2025 title: Frequently Asked Questions about Delivery Optimization summary: | This article answers frequently asked questions about Delivery Optimization. @@ -30,6 +30,8 @@ summary: | - [Delivery Optimization is downloading Windows content on my devices directly from an IP Address, is it expected?](#delivery-optimization-is-downloading-windows-content-on-my-devices-directly-from-an-ip-address--is-it-expected) - [How do I turn off Delivery Optimization?](#how-do-i-turn-off-delivery-optimization) - [My download is failing with error code 0x80d03002, how do I fix it?](#my-download-is-failing-with-error-code-0x80d03002--how-do-i-fix-it) + - [What do the Delivery Optimization error codes mean?](#what-do-the-delivery-optimization-error-codes-mean) + - [How does Delivery Optimization measure and throttle download bandwidth?](#how-does-delivery-optimization-measure-and-throttle-download-bandwidth) **Network related configuration questions**: @@ -74,12 +76,24 @@ sections: > [!NOTE] > Disabling Delivery Optimization won't prevent content from downloading to your devices. If you're looking to pause updates, you need to set policies for the relevant components such as Windows Update, Windows Store or Microsoft Edge browser. If you're looking to reduce the load on your network, look into using Delivery Optimization Peer-to-Peer, Microsoft Connected Cache or apply the [network throttling policies](waas-delivery-optimization-reference.md#maximum-download-bandwidth) available for Delivery Optimization. - - question: My download is failing with error code 0x80d03002, how do I fix it? answer: | If you set the DownloadMode policy to '100' (Bypass) some content downloads that require Delivery Optimization may fail with error code 0x80d03002. If you intend to disable peer-to-peer capabilities of Delivery Optimization, change the Delivery Optimization [Download mode](waas-delivery-optimization-reference.md#download-mode) setting to '0', which will disable peer-to-peer and provide hash checks. [Download mode](waas-delivery-optimization-reference.md#download-mode) set to '99' should only be used when the device is offline and doesn't have internet access. Don't set **Download mode** to '100' (Bypass), which can cause some content to fail to download. Starting in Windows 11, Download mode '100' is deprecated. + - question: What do the Delivery Optimization error codes mean? + answer: | + For a list of common Delivery Optimization error codes, visit the [Delivery Optimization Troubleshooter](http://aka.ms/do-fix). This resource provides descriptions of various error codes. Using the Delivery Optimization Troubleshooter can help you identify and resolve issues with Delivery Optimization, providing configuration values and other useful information to help address problems effectively. + - question: How does Delivery Optimization measure and throttle download bandwidth? + answer: | + By default, Delivery Optimization measures and targets to use no more than 45% of the available bandwidth during a background download or 90% for an interactive, foreground download (user initiated). The target download speed is measured for the HTTP source and Group/Internet peers. The target download speed measures the download throughput available to the source, not only the local network card. A speed test is performed dynamically every few minutes during a download, so it can adjust to congestion on the network. + + Throttling will apply only to downloads from the internet which include the HTTP source and Group peers. To make changes to the default behavior, use the settings from the Delivery Optimization section in Windows Settings (Delivery Optimization -> Advanced Options) to change these values. In addition, there are policies available to manage bandwidth usage for Delivery Optimization. To ensure smooth deployments, we recommend familiarizing yourself with the bandwidth defaults and policies available to better configure them for your environment. Note that Delivery Optimization does not manage deployment strategies. + + For more information, see [Bandwidth throttle options](delivery-optimization-configure.md#bandwidth-throttling-options). + + > [!NOTE] + > For LAN peers, neither the target download speed is calculated nor is throttling applied. - name: Network related configuration questions questions: @@ -139,7 +153,7 @@ sections: No. It relies on the cloud service for peer discovery, resulting in a list of peers and their IP addresses. Client devices then connect to their peers to obtain download files over TCP/IP. - question: How does Delivery Optimization deal with congestion on the router from peer-to-peer activity on the LAN? answer: | - Starting in Windows 10, version 1903, Delivery Optimization uses LEDBAT to relieve such congestion. For more information, see this post on the [Networking Blog](https://techcommunity.microsoft.com/t5/Networking-Blog/Windows-Transport-converges-on-two-Congestion-Providers-Cubic/ba-p/339819). + Starting in Windows 11, version 22H2, Delivery Optimization uses LEDBAT (server-side LEDBAT) and rLEDBAT (receiver-side LEDBAT) to relieve such congestion. In Delivery Optimization, LEDBAT is specifically used for P2P connections, while rLEDBAT is utilized for HTTP and Connected Cache connections, particularly for background downloads. For more information, see this post on the [Networking Blog](https://techcommunity.microsoft.com/t5/Networking-Blog/Windows-Transport-converges-on-two-Congestion-Providers-Cubic/ba-p/339819). - question: How does Delivery Optimization handle VPNs? answer: | Delivery Optimization attempts to identify VPNs by checking the network adapter type and details. A connection is treated as a VPN if the adapter description contains certain keywords, such as "VPN" or "secure." @@ -169,7 +183,7 @@ sections: For more information about remote work if you're using Configuration Manager, see this post on the [Configuration Manager blog](https://techcommunity.microsoft.com/t5/configuration-manager-blog/managing-patch-tuesday-with-configuration-manager-in-a-remote/ba-p/1269444). - question: How does Delivery Optimization handle networks where a public IP address is used in place of a private IP address? answer: | - Starting with Windows 10, version 1903 or later, Delivery Optimization no longer restricts connections between LAN peers to those using private IP addresses. If you use public IP addresses instead of private IP addresses, you can use Delivery Optimization in LAN mode. + Starting with Windows 10, version 1903 or later, Delivery Optimization no longer restricts connections between LAN peers to those using private IP addresses (defined by RFC 1918). If you use public IP addresses instead of private IP addresses, you can use Delivery Optimization in LAN mode. > [!NOTE] > If you use public IP addresses instead of private in LAN mode, the bytes downloaded from or uploaded to LAN peers with public IP addresses might be reported as coming from Internet peers. @@ -185,4 +199,3 @@ sections: 1. In the search box on the taskbar, type **Disk Cleanup**, and then select it from the list of results. 1. On the **Disk Cleanup** tab, select the **Delivery Optimization Files** check box. 1. Select **OK**. On the dialog that appears, select **Delete Files**. - diff --git a/windows/deployment/do/waas-delivery-optimization-reference.md b/windows/deployment/do/waas-delivery-optimization-reference.md index 8ea753be60..6b8d4b592b 100644 --- a/windows/deployment/do/waas-delivery-optimization-reference.md +++ b/windows/deployment/do/waas-delivery-optimization-reference.md @@ -14,7 +14,7 @@ appliesto: - ✅ Windows 11 - ✅ Windows 10 - ✅ Delivery Optimization -ms.date: 04/03/2025 +ms.date: 04/15/2025 --- # Delivery Optimization reference @@ -329,7 +329,7 @@ This policy allows you to specify how your client(s) can discover Delivery Optim - 1 = DHCP Option 235. - 2 = DHCP Option 235 Force. -With either option, the client queries DHCP Option ID 235 and use the returned value as the Cache Server Hostname. Option 2 overrides the Cache Server Hostname policy, if configured. **By default, this policy has no value.** +With either option, the client queries DHCP Option ID 235 and uses the returned value as the Cache Server Hostname. If [DOCacheHost](#cache-server-hostname) policy is also configured, then DHCP Option 235 Force (2) is required to override it. **By default, this policy has no value.** Configure this policy to designate Delivery Optimization in Network Cache servers through a custom DHCP Option. Specify the custom DHCP option on your DHCP server as *text* type. You can add one or more values as either fully qualified domain names (FQDN) or IP addresses. To add multiple values, separate each FQDN or IP address with commas. diff --git a/windows/deployment/windows-autopatch/manage/windows-autopatch-hotpatch-updates.md b/windows/deployment/windows-autopatch/manage/windows-autopatch-hotpatch-updates.md index b52cda4040..59e83f707a 100644 --- a/windows/deployment/windows-autopatch/manage/windows-autopatch-hotpatch-updates.md +++ b/windows/deployment/windows-autopatch/manage/windows-autopatch-hotpatch-updates.md @@ -1,7 +1,7 @@ --- title: Hotpatch updates description: Use Hotpatch updates to receive security updates without restarting your device -ms.date: 04/04/2025 +ms.date: 04/11/2025 ms.service: windows-client ms.subservice: autopatch ms.topic: how-to @@ -21,25 +21,20 @@ Hotpatch updates are designed to reduce downtime and disruptions. Hotpatch updat Hotpatch is an extension of Windows Update and requires Autopatch to create and deploy hotpatches to devices enrolled in the Autopatch quality update policy. -> [!NOTE] -> Hotpatch is also available on Windows Server and Windows 365. For more information, see [Hotpatch for Windows Server Azure Edition](/windows-server/get-started/enable-hotpatch-azure-edition). - ## Key benefits - Hotpatch updates streamline the installation process and enhance compliance efficiency. - No changes are required to your existing update ring configurations. Your existing ring configurations are honored alongside Hotpatch policies. - The [Hotpatch quality update report](../monitor/windows-autopatch-hotpatch-quality-update-report.md) provides a per policy level view of the current update statuses for all devices that receive Hotpatch updates. -## Release cycles +## Prerequisites -For more information about the release calendar for Hotpatch updates, see [Release notes for Hotpatch](https://support.microsoft.com/topic/release-notes-for-hotpatch-public-preview-on-windows-11-version-24h2-enterprise-clients-c117ee02-fd35-4612-8ea9-949c5d0ba6d1). +To benefit from Hotpatch updates, devices must meet the following prerequisites: -| Quarter | Baseline updates (requires restart) | Hotpatch (no restart required) | -| ----- | ----- | ----- | -| 1 | January | February and March | -| 2 | April | May and June | -| 3 | July | August and September | -| 4 | October | November and December | +- For licensing requirements, see [Prerequisites](../prepare/windows-autopatch-prerequisites.md) +- Windows 11 Enterprise version 24H2 or later +- Devices must be on the latest baseline release version to qualify for Hotpatch updates. Microsoft releases Baseline updates quarterly as standard cumulative updates. For more information on the latest schedule for these releases, see [Release notes for Hotpatch](https://support.microsoft.com/topic/release-notes-for-hotpatch-in-azure-automanage-for-windows-server-2022-4e234525-5bd5-4171-9886-b475dabe0ce8?preview=true). +- Microsoft Intune to manage hotpatch update deployment with the [Windows quality update policy with hotpatch turned on](#enroll-devices-to-receive-hotpatch-updates). ## Operating system configuration prerequisites @@ -49,28 +44,30 @@ To prepare a device to receive Hotpatch updates, configure the following operati VBS must be turned on for a device to be offered Hotpatch updates. For information on how to set and detect if VBS is enabled, see [Virtualization-based Security (VBS)](/windows/security/hardware-security/enable-virtualization-based-protection-of-code-integrity?tabs=security). -### Arm 64 devices must disable compiled hybrid PE usage (CHPE) (Arm 64 CPU Only) (Public preview) +> [!NOTE] +> Devices might be temporarily ineligible because they don’t have VBS enabled or aren’t currently on the latest baseline release. To ensure that all your Windows devices are configured properly to be eligible for hotpatch updates, see [Troubleshoot hotpatch updates](#troubleshoot-hotpatch-updates). + +### Arm 64 devices must disable compiled hybrid PE usage (CHPE) (Arm 64 CPU Only) > [!IMPORTANT] > **Arm 64 devices are in public preview**. It's being actively developed and might not be complete. They're made available on a "Preview" basis. You can test and use these features in production environments and scenarios and provide feedback. -This requirement only applies to Arm 64 CPU devices when using Hotpatch updates. Hotpatch updates aren't compatible with servicing CHPE OS binaries located in the `%SystemRoot%\SyChpe32` folder. To ensure all the Hotpatch updates are applied, you must set the CHPE disable flag and restart the device to disable CHPE usage. You only need to set this flag one time. The registry setting remains applied through updates. To disable CHPE, create and/or set the following DWORD registry key: -Path: `HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management` -DWORD key value: HotPatchRestrictions=1 +This requirement only applies to Arm 64 CPU devices when using Hotpatch updates. Hotpatch updates aren't compatible with servicing CHPE OS binaries located in the `%SystemRoot%\SyChpe32` folder. + +To ensure all the Hotpatch updates are applied, you must set the CHPE disable flag and restart the device to disable CHPE usage. You only need to set this flag one time. The registry setting remains applied through updates. > [!IMPORTANT] > This setting is required because it forces the operating system to use the emulation x86-only binaries instead of CHPE binaries on Arm 64 devices. CHPE binaries include native Arm 64 code to improve performance, excluding the CHPE binaries might affect performance or compatibility. Be sure to test application compatibility and performance before rolling out Hotpatch updates widely on Arm 64 CPU based devices. +To disable CHPE, create and/or set the following DWORD registry key: +Path: `HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management` +DWORD key value: HotPatchRestrictions=1 + +> [!NOTE] +> There are no plans to support hotpatch updates on Arm64 devices with CHPE enabled. Disabling CHPE is required only for Arm64 devices. AMD and Intel CPUs don’t have CHPE. + If you choose to no longer use Hotpatch updates, clear the CHPE disable flag (`HotPatchRestrictions=0`) then restart the device to turn on CHPE usage. -## Eligible devices - -To benefit from Hotpatch updates, devices must meet the following prerequisites: - -- Operating System: Devices must be running Windows 11 24H2 or later. -- VBS (Virtualization-based security): VBS must be enabled to ensure secure installation of Hotpatch updates. -- Latest Baseline Release: Devices must be on the latest baseline release version to qualify for Hotpatch updates. Microsoft releases Baseline updates quarterly as standard cumulative updates. For more information on the latest schedule for these releases, see [Release notes for Hotpatch](https://support.microsoft.com/topic/release-notes-for-hotpatch-in-azure-automanage-for-windows-server-2022-4e234525-5bd5-4171-9886-b475dabe0ce8?preview=true). - ## Ineligible devices Devices that don't meet one or more prerequisites automatically receive the Latest Cumulative Update (LCU) instead. Latest Cumulative Update (LCU) contains monthly updates that supersede the previous month's updates containing both security and nonsecurity releases. @@ -80,6 +77,32 @@ LCUs requires you to restart the device, but the LCU ensures that the device rem > [!NOTE] > If devices aren't eligible for Hotpatch updates, these devices are offered the LCU. The LCU keeps your configured Update ring settings, it doesn't change the settings. +## Release cycles + +For more information about the release calendar for hotpatch updates, see [Release notes for Hotpatch](https://support.microsoft.com/topic/release-notes-for-hotpatch-public-preview-on-windows-11-version-24h2-enterprise-clients-c117ee02-fd35-4612-8ea9-949c5d0ba6d1). + +- Baseline: Includes the latest security fixes, cumulative new features, and enhancements. Restart required. +- Hotpatch: Includes security updates. No restarted required. + +| Quarter | Baseline updates (requires restart) | Hotpatch (no restart required) | +| ----- | ----- | ----- | +| 1 | January | February and March | +| 2 | April | May and June | +| 3 | July | August and September | +| 4 | October | November and December | + +## Hotpatch on Windows 11 Enterprise or Windows Server 2025 + +> [!NOTE] +> Hotpatch is also available on Windows Server and Windows 365. For more information, see [Hotpatch for Windows Server Azure Edition](/windows-server/get-started/enable-hotpatch-azure-edition). + +Hotpatch updates are similar between Windows 11 and Windows Server 2025. + +- Windows Autopatch manages Windows 11 updates +- Azure Update Manager and optional Azure Arc subscription for Windows 2025 Datacenter/Standard Editions (on-premises) manages Windows Server 2025 Datacenter Azure Edition. For more information, on Windows Server and Windows 365, see [Hotpatch for Windows Server Azure Edition](/windows-server/get-started/enable-hotpatch-azure-edition). + +The calendar dates, eight hotpatch months, and four baseline months, planned each year are the same for all the hotpatch-supported operating systems (OS). It’s possible for additional baseline months for one OS (for example, Windows Server 2022), while there are hotpatch months for another OS, such as Server 2025 or Windows 11, version 24H2. Review the release notes from [Windows release health](/windows/release-health/) to keep up to date. + ## Enroll devices to receive Hotpatch updates > [!NOTE] @@ -94,11 +117,11 @@ LCUs requires you to restart the device, but the LCU ensures that the device rem 1. Select **Create**, and select **Windows quality update policy**. 1. Under the **Basics** section, enter a name for your new policy and select Next. 1. Under the **Settings** section, set **"When available, apply without restarting the device ("Hotpatch")** to **Allow**. Then, select **Next**. -1. Select the appropriate Scope tags or leave as Default and select **Next**. +1. Select the appropriate Scope tags or leave as Default. Then, select **Next**. 1. Assign the devices to the policy and select **Next**. 1. Review the policy and select **Create**. -These steps ensure that targeted devices, which are [eligible](#eligible-devices) to receive Hotpatch updates, are configured properly. [Ineligible devices](#ineligible-devices) are offered the latest cumulative updates (LCU). +These steps ensure that targeted devices, which are [eligible](#prerequisites) to receive Hotpatch updates, are configured properly. [Ineligible devices](#ineligible-devices) are offered the latest cumulative updates (LCU). > [!NOTE] > Turning on Hotpatch updates doesn't change the existing deadline-driven or scheduled install configurations on your managed devices. Deferral and active hour settings still apply. @@ -106,3 +129,48 @@ These steps ensure that targeted devices, which are [eligible](#eligible-devices ## Roll back a hotpatch update Automatic rollback of a Hotpatch update isn’t supported but you can uninstall them. If you experience an unexpected issue with hotpatch updates, you can investigate by uninstalling the hotpatch update and installing the latest standard cumulative update (LCU) and restart. Uninstalling a hotpatch update is quick, however, it does require a device restart. + +## Troubleshoot hotpatch updates + +### Step 1: Verify the device is eligible for hotpatch updates and on a hotpatch baseline before the hotpatch update is installed + +Hotpatching follows the hotpatch release cycle. Review the prerequisites to ensure the device is [eligible](#prerequisites) for hotpatch updates. For information on devices that don’t meet the prerequisites, see [Ineligible devices](#ineligible-devices). + +For the latest release schedule, see the [hotpatch release notes](https://support.microsoft.com/topic/release-notes-for-hotpatch-public-preview-on-windows-11-version-24h2-enterprise-clients-c117ee02-fd35-4612-8ea9-949c5d0ba6d1). For information on Windows update history, see [Windows 11, version 24H2 update history](https://support.microsoft.com/topic/windows-11-version-24h2-update-history-0929c747-1815-4543-8461-0160d16f15e5). + +### Step 2: Verify the device has Virtualization-based security (VBS) turned on + +1. Select **Start**, and enter `System information` in the Search. +1. Select **System information** from the results. +1. Under **System summary**, under the **Item column**, find **Virtualization-based security**. +1. Under the **Value column**, ensure it states **Running**. + +### Step 3: Verify the device is properly configured to turn on hotpatch updates + +1. In Intune, review your configured policies within Autopatch to see which groups of devices are targeted with a hotpatch policy by going to the **Windows Update** > **Quality Updates** page. +1. Ensure the hotpatch update policy is set to **Allow**. +1. On the device, select **Start** > **Settings** > **Windows Update** > **Advanced options** > **Configured update policies** > find **Enable hotpatching when available**. This setting indicates that the device is enrolled in hotpatch updates as configured by Autopatch. + +### Step 4: Disable compiled hybrid PE usage (CHPE) (Arm64 CPU only) + +For more information, see [Arm 64 devices must disable compiled hybrid PE usage (CHPE) (Arm 64 CPU Only)](#arm-64-devices-must-disable-compiled-hybrid-pe-usage-chpe-arm-64-cpu-only). + +### Step 5: Use Event viewer to verify the device has hotpatch updates turned on + +1. Right-click on the **Start** menu, and select **Event viewer**. +1. Search for **AllowRebootlessUpdates** in the filter. If AllowRebootlessUpdates is set to `1`, the device is enrolled in the Autopatch update policy and has hotpatch updates turned on: + +`` +"data": { +"payload": "{\"Orchestrator\":{\"UpdatePolicy\":{\"Update/AllowRebootlessUpdates\":true}}}", +"isEnrolled": 1, +"isCached": 1, +"vbsState": 2, +`` + +### Step 6: Check Windows Logs for any hotpatch errors + +Hotpatch updates provide an inbox monitor service that checks for the health of the updates installed on the device. If the monitor service detects an error, the service logs an event in the Windows Application Logs. If there's a critical error, the device installs the standard (LCU) update to ensure the device is fully secure. + +1. Right-click on the **Start** menu, and select **Event viewer**. +1. Search for **hotpatch** in the filter to view the logs. diff --git a/windows/deployment/windows-autopatch/overview/windows-autopatch-faq.yml b/windows/deployment/windows-autopatch/overview/windows-autopatch-faq.yml index 899e555ff1..b23c1587ec 100644 --- a/windows/deployment/windows-autopatch/overview/windows-autopatch-faq.yml +++ b/windows/deployment/windows-autopatch/overview/windows-autopatch-faq.yml @@ -4,7 +4,7 @@ metadata: description: Answers to frequently asked questions about Windows Autopatch. ms.service: windows-client ms.topic: faq - ms.date: 03/31/2025 + ms.date: 04/21/2025 audience: itpro ms.localizationpriority: medium manager: aaroncz @@ -97,6 +97,71 @@ sections: - question: Can I configure when to move to the next ring or is it controlled by Windows Autopatch? answer: | You're in full control over when updates are deployed to their devices. Autopatch groups will recommend a set of intelligent defaults but those are fully customizable so that you can achieve your desired rollout. + - question: What is the expected behavior for turning on the Feature Update option for Autopatch groups? + answer: | + Starting in April 2025, default policies aren't created for new Autopatch customers. Existing customers will continue to receive support until Windows 10 reaches its End-of-Service (EOS). However, these policies won't transition to Windows 11. + + If you created an Autopatch group before April 2025: + - The Feature Update option is unselected by default. + - Selecting the Feature Update option creates a feature update policy for the newly created Autopatch group. This doesn't affect the Global DSS policy. + - The Feature Update option doesn't affect existing releases created before April 2025; these releases remain unchanged + + If you created an Autopatch group after April 2025: + - Selecting the Feature Update option creates a feature update policy and assigns it to all its deployment rings. + - Global DSS policy isn't affected. + - name: Hotpatch updates + questions: + - question: What are the licensing requirements for hotpatch updates? + answer: | + Windows 11 Enterprise E3 or E5, Windows 11 Enterprise F3 or F5, Windows 11 Education A3 or A5, or a Windows 365 Enterprise license. For more information, see [Prerequisites](../prepare/windows-autopatch-prerequisites.md). + - question: Can I still restart devices as often as I want? + answer: | + Yes, devices that install hotpatch updates are protected the moment the update is installed. However, if a user or your IT Admin wishes to restart the PC you can do it anytime. The device restarts and runs the hotpatch updates. + - question: Can I use hotpatch updates on Arm64 devices? + answer: | + Yes, hotpatch updates are available for Arm64 devices. For more information, see [Arm 64 devices must disable compiled hybrid PE usage (CHPE) (Arm 64 CPU Only)](../manage/windows-autopatch-hotpatch-updates.md#arm-64-devices-must-disable-compiled-hybrid-pe-usage-chpe-arm-64-cpu-only)). + - question: What is the default hotpatch behavior on Windows Home or Pro devices? + answer: | + Hotpatch updates aren't available to Home or Pro devices. Hotpatching requires domain admin or group policy. It's available only via Windows Autopatch update policy, which includes Windows 365 Enterprise, E3/E5, F3 and A3/A5 licenses. + - question: How do I enroll devices to receive hotpatch updates? + answer: | + For more information, see [Enroll devices to receive hotpatch updates](../manage/windows-autopatch-hotpatch-updates.md#enroll-devices-to-receive-hotpatch-updates). + - question: What if some devices in my hotpatch policy aren't eligible for hotpatch updates? + answer: | + For more information on eligibility, see [Prerequisites](../prepare/windows-autopatch-prerequisites.md) and [ineligible devices](../manage/windows-autopatch-hotpatch-updates.md#ineligible-devices). + - question: How is hotpatching different for Windows 11 Enterprise and Windows Server 2025? + answer: | + For more information, see [Hotpatch on Windows 11 Enterprise or Windows Server 2025](../manage/windows-autopatch-hotpatch-updates.md#hotpatch-on-windows-11-enterprise-or-windows-server-2025). + - question: How can I tell which of my devices installed a hotpatch update? + answer: | + Devices receiving the hotpatch update have a different KB number tracking the release and a different OS version than devices receiving the standard update that requires a restart. The monthly KB release articles indicate if the KB installed is hotpatch capable and the corresponding OS version. The following Windows Update message appears “Great news! The latest security update was installed without a restart.” + - question: What if I restart a device after receiving a hotpatch update? + answer: | + The device stays on the hotpatch update KB/OS version after a restart. It won't receive any new features as part of the regular servicing track until the next quarterly cumulative baseline update. + - question: Do hotpatch updates only update common system binaries loaded in third-party processes or only Microsoft processes? + answer: | + Hotpatch updates aren't limited to Microsoft processes. Hotpatch updates are only created for OS binaries. Any process loading OS binaries that have hotpatch updates installed are updated before the application or operating system uses the binaries. This includes common system dynamic link libraries (DLLs) like ntdll.dll. + - question: How can I find out if a hotpatch update was applied to the specific DLL? + answer: | + You can see the hotpatch modules in the memory dump. Symbols for hotpatched DLLs depend on the function that receives the update. Some code that is hotpatch-updated could be public (symbols), while other functions could be private (no symbols). + - question: Are there kernel-mode hotpatch updates? + answer: | + Yes, there are kernel-mode hotpatch updates. + - question: What does a failure to apply a hotpatch update look like? + answer: | + Hotpatch failures are the same as CBS failures when installing other KBs (not enough disk space or download errors for example). In addition, hotpatch update errors are recorded in the event logs. Search the system log for the keyword “hotpatch” to see if your system encountered any errors. + - question: Can you switch from hotpatch update to the Standard Windows monthly updates? + answer: | + Yes, you can. You can manually download the standard Windows monthly update from the Microsoft Update Catalog. In this case, the device stops receiving hotpatch updates and receives standard Windows updates until the month after the next baseline update. Since the device is still enrolled in hotpatching, the device automatically rejoins the hotpatch cadence of updates after the update is released on the baseline month. + - question: How do hotpatch update events show up in audit logs? + answer: | + Process explorer shows it loaded in memory OS ``_hotpatch`` loaded in memory. The hotpatch update KB includes a link to the CSV file listing the update payload. + - question: Can I get security alerts through Event Tracing for Windows (ETW) about hotpatch updates? + answer: | + Hotpatch events are captured in the audit log. Search for “hotpatch” in the audit log to find related errors if any were captured. + - question: Do I need to test hotpatch updates if I already test monthly updates? + answer: | + You should test hotpatch updates when released 8 times a year (according to plan) and the regular monthly updates 12 times a year. There are no hotpatch updates for you to test in January (1B), April (4B), July (7B), or October (10B). - name: Support questions: - question: Does Windows Autopatch Support Dual Scan for Windows Update? diff --git a/windows/deployment/windows-autopatch/whats-new/windows-autopatch-whats-new-2025.md b/windows/deployment/windows-autopatch/whats-new/windows-autopatch-whats-new-2025.md index d51b82e4f8..4754455eb7 100644 --- a/windows/deployment/windows-autopatch/whats-new/windows-autopatch-whats-new-2025.md +++ b/windows/deployment/windows-autopatch/whats-new/windows-autopatch-whats-new-2025.md @@ -1,7 +1,7 @@ --- title: What's new 2025 description: This article lists the 2025 feature releases and any corresponding Message center post numbers. -ms.date: 03/31/2025 +ms.date: 04/11/2025 ms.service: windows-client ms.subservice: autopatch ms.topic: whats-new @@ -21,6 +21,15 @@ This article lists new and updated feature releases, and service releases, with Minor corrections such as typos, style, or formatting issues aren't listed. +## April 2025 + +### April feature releases or updates + +| Article | Description | +| ----- | ----- | +| [Hotpatch updates](../manage/windows-autopatch-hotpatch-updates.md) | Added [troubleshooting](../manage/windows-autopatch-hotpatch-updates.md#troubleshoot-hotpatch-updates) section | +| [FAQ](../overview/windows-autopatch-faq.yml) | Added [hotpatch updates](../overview/windows-autopatch-faq.yml#hotpatch-updates) section to the FAQ. | + ## March 2025 ### March feature releases or updates diff --git a/windows/privacy/manage-windows-1809-endpoints.md b/windows/privacy/manage-windows-1809-endpoints.md index f67087eb36..ab2077895d 100644 --- a/windows/privacy/manage-windows-1809-endpoints.md +++ b/windows/privacy/manage-windows-1809-endpoints.md @@ -459,8 +459,8 @@ If you [turn off traffic for these endpoints](manage-connections-from-windows-op | svchost | HTTPS | `*.delivery.mp.microsoft.com` | These are dependent on enabling: -- [Device authentication](manage-windows-1809-endpoints.md#device-authentication) -- [Microsoft account](manage-windows-1809-endpoints.md#microsoft-account) +- [Device authentication](#device-authentication) +- [Microsoft account](#microsoft-account) The following endpoint is used for content regulation. If you [turn off traffic for this endpoint](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-wu), the Windows Update Agent will be unable to contact the endpoint, and fallback behavior will be used. This may result in content being either incorrectly downloaded or not downloaded at all. diff --git a/windows/security/application-security/application-control/app-control-for-business/design/microsoft-recommended-driver-block-rules.md b/windows/security/application-security/application-control/app-control-for-business/design/microsoft-recommended-driver-block-rules.md index 67506d5785..533c043649 100644 --- a/windows/security/application-security/application-control/app-control-for-business/design/microsoft-recommended-driver-block-rules.md +++ b/windows/security/application-security/application-control/app-control-for-business/design/microsoft-recommended-driver-block-rules.md @@ -19,7 +19,7 @@ Microsoft has strict requirements for code running in kernel. So, malicious acto - Malicious behaviors (malware) or certificates used to sign malware - Behaviors that aren't malicious but circumvent the Windows Security Model and can be exploited by attackers to elevate privileges in the Windows kernel -Drivers can be submitted to Microsoft for security analysis at the [Microsoft Security Intelligence Driver Submission page](https://www.microsoft.com/en-us/wdsi/driversubmission). For more information about driver submission, see [Improve kernel security with the new Microsoft Vulnerable and Malicious Driver Reporting Center](https://www.microsoft.com/security/blog/2021/12/08/improve-kernel-security-with-the-new-microsoft-vulnerable-and-malicious-driver-reporting-center/). To report an issue or request a change to the blocklist, including updating a block rule once a driver has been fixed, visit the [Microsoft Security Intelligence portal](https://www.microsoft.com/wdsi) or submit feedback on this article. +Drivers can be submitted to Microsoft for security analysis at the [Microsoft Security Intelligence Driver Submission page](https://www.microsoft.com/wdsi/driversubmission). For more information about driver submission, see [Improve kernel security with the new Microsoft Vulnerable and Malicious Driver Reporting Center](https://www.microsoft.com/security/blog/2021/12/08/improve-kernel-security-with-the-new-microsoft-vulnerable-and-malicious-driver-reporting-center/). To report an issue or request a change to the blocklist, including updating a block rule once a driver has been fixed, visit the [Microsoft Security Intelligence portal](https://www.microsoft.com/wdsi). > [!NOTE] > Blocking drivers can cause devices or software to malfunction, and in rare cases, lead to blue screen. The vulnerable driver blocklist is not guaranteed to block every driver found to have vulnerabilities. Microsoft attempts to balance the security risks from vulnerable drivers with the potential impact on compatibility and reliability to produce the blocklist. As always, Microsoft recommends using an explicit allow list approach to security wherever possible. @@ -36,9 +36,9 @@ With Windows 11 2022 update, the vulnerable driver blocklist is enabled by defa > > - For Windows Insiders, the option to turn Microsoft's vulnerable driver blocklist on or off using **Windows Security** settings is grayed out when HVCI, Smart App Control, or S mode is enabled. You must disable HVCI or Smart App Control, or switch the device out of S mode, and restart the device before you can turn off the Microsoft vulnerable driver blocklist. -The blocklist is updated with each new major release of Windows, typically 1-2 times per year, including most recently with the Windows 11 2022 update released in September 2022. The most current blocklist is now also available for Windows 10 20H2 and Windows 11 21H2 users as an optional update from Windows Update. Microsoft will occasionally publish future updates through regular Windows servicing. +The blocklist is updated with each new major release of Windows, typically 1-2 times per year. The most current blocklist is now also available for Windows 10 20H2 and Windows 11 21H2 users as an optional update from Windows Update. Microsoft will occasionally publish future updates through regular Windows servicing. -Customers who always want the most up-to-date driver blocklist can also use App Control for Business to apply the latest recommended driver blocklist contained in this article. For your convenience, we provide a download of the most up-to-date vulnerable driver blocklist along with instructions to apply it on your computer at the end of this article. Otherwise, use the following XML to create your own custom App Control policies. +Customers who always want the most up-to-date driver blocklist can also use App Control for Business to apply the latest recommended driver blocklist. For your convenience, we provide a download of the most up-to-date vulnerable driver blocklist along with instructions to apply it on your computer at the end of this article. ## Blocking vulnerable drivers using App Control @@ -49,7 +49,7 @@ Microsoft recommends enabling [HVCI](../../../../hardware-security/enable-virtua ## Steps to download and apply the vulnerable driver blocklist binary -If you prefer to apply the [vulnerable driver blocklist](#vulnerable-driver-blocklist-xml) exactly as shown, follow these steps: +If you prefer to apply the vulnerable driver blocklist, follow these steps: 1. Download the [App Control policy refresh tool](https://aka.ms/refreshpolicy) 2. Download and extract the [vulnerable driver blocklist binaries](https://aka.ms/VulnerableDriverBlockList) @@ -70,4978 +70,13 @@ To check that the policy was successfully applied on your computer: ## Vulnerable driver blocklist XML -> [!IMPORTANT] -> The following policy contains **Allow All** rules. If your version of Windows supports App Control multiple policies, we recommend deploying this policy alongside any existing App Control policies. If you do plan to merge this policy with another policy, you may need to remove the **Allow All** rules before merging it if the other policy applies an explicit allow list. For more information, see [Create an App Control Deny Policy](create-appcontrol-deny-policy.md#guidance-on-creating-app-control-deny-policies). +The recommended blocklist xml policy file can be downloaded from the [Microsoft Download Center](https://aka.ms/VulnerableDriverBlockList). + +This policy contains **Allow All** rules. If your version of Windows supports App Control multiple policies, we recommend deploying this policy alongside any existing App Control policies. If you do plan to merge this policy with another policy, you may need to remove the **Allow All** rules before merging it if the other policy applies an explicit allow list. For more information, see [Create an App Control Deny Policy](create-appcontrol-deny-policy.md#guidance-on-creating-app-control-deny-policies). > [!NOTE] > To use this policy with Windows Server 2016, you must convert the policy XML on a device running a newer operating system. -The following recommended blocklist xml policy file can also be downloaded from the [Microsoft Download Center](https://aka.ms/VulnerableDriverBlockList). - -```xml - - - 10.0.27770.0 - {2E07F7E4-194C-4D20-B7C9-6F44A6C5A234} - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - 0 - - - - Microsoft Windows Driver Policy - - - - - 10.0.27770.0 - - - - {A244370E-44C9-4C06-B551-F6016E563076} - -``` - ## More information - [Merge App Control for Business policies](../deployment/merge-appcontrol-policies.md) diff --git a/windows/security/application-security/application-control/toc.yml b/windows/security/application-security/application-control/toc.yml index 3a7a1fa706..438d97451c 100644 --- a/windows/security/application-security/application-control/toc.yml +++ b/windows/security/application-security/application-control/toc.yml @@ -9,6 +9,8 @@ items: items: - name: Overview href: user-account-control/index.md + - name: UAC Architecture + href: user-account-control/architecture.md - name: How UAC works href: user-account-control/how-it-works.md - name: UAC settings and configuration diff --git a/windows/security/application-security/application-control/user-account-control/architecture.md b/windows/security/application-security/application-control/user-account-control/architecture.md new file mode 100644 index 0000000000..7f33e45173 --- /dev/null +++ b/windows/security/application-security/application-control/user-account-control/architecture.md @@ -0,0 +1,129 @@ +--- +title: User Account Control architecture +description: Learn about the User Account Control (UAC) architecture. +ms.topic: concept-article +ms.date: 04/15/2025 +--- + +# UAC Architecture + +The following diagram details the UAC architecture. + +:::image type="content" source="images/uac-architecture.gif" alt-text="Diagram that describes the UAC architecture."::: + +## User + +- **User performs operation requiring privilege**: If the operation changes the file system or registry, Virtualization is called. All other operations call ShellExecute. +- **ShellExecute**: ShellExecute calls CreateProcess. ShellExecute looks for the `ERROR_ELEVATION_REQUIRED` error from CreateProcess. If it receives the error, ShellExecute calls the Application Information service to attempt to perform the requested task with the elevated prompt. +- **CreateProcess**: If the application requires elevation, CreateProcess rejects the call with `ERROR_ELEVATION_REQUIRED`. + +## System + +- **Application Information service**: + - A system service that helps start apps that require one or more elevated privileges or user rights to run. + - The Application Information service helps start such apps by creating a new process for the application with an administrative user's full access token when elevation is required. + - Depending on the configured policies, the user might give consent. + +- **Elevating an ActiveX install**: + - If ActiveX isn't installed, the system checks the UAC slider level. + - If ActiveX is installed, the **User Account Control: Switch to the secure desktop when prompting for elevation** Group Policy setting is checked. + +- **Check UAC slider level**: UAC has a slider to select from four levels of notification: + - **Always notify** will: + - Notify you when programs try to install software or make changes to your computer. + - Notify you when you make changes to Windows settings. + - Freeze other tasks until you respond. + - Recommended if you often install new software or visit unfamiliar websites. + - **Notify me only when programs try to make changes to my computer** will: + - Notify you when programs try to install software or make changes to your computer. + - Not notify you when you make changes to Windows settings. + - Freeze other tasks until you respond. + - Recommended if you don't often install apps or visit unfamiliar websites. + - **Notify me only when programs try to make changes to my computer (do not dim my desktop)** will: + - Notify you when programs try to install software or make changes to your computer. + - Not notify you when you make changes to Windows settings. + - Not freeze other tasks until you respond. + - Not recommended. Choose this option only if it takes a long time to dim the desktop on your computer. + - **Never notify (Disable UAC prompts)** will: + - Not notify you when programs try to install software or make changes to your computer. + - Not notify you when you make changes to Windows settings. + - Not freeze other tasks until you respond. + - Not recommended due to security concerns. + +- **Secure desktop enabled**: The **User Account Control: Switch to the secure desktop when prompting for elevation** policy setting is checked: + - If the secure desktop is enabled, all elevation requests go to the secure desktop regardless of prompt behavior policy settings for administrators and standard users. + - If the secure desktop isn't enabled, all elevation requests go to the interactive user's desktop, and the per-user settings for administrators and standard users are used. + +- **CreateProcess**: + - CreateProcess calls AppCompat, Fusion, and Installer detection to assess if the app requires elevation. + - The file is then inspected to determine its requested execution level, which is stored in the application manifest for the file. + - CreateProcess fails if the requested execution level specified in the manifest doesn't match the access token and returns an error (ERROR_ELEVATION_REQUIRED) to ShellExecute. + +- **AppCompat**: + - The AppCompat database stores information in the application compatibility fix entries for an application. + +- **Fusion**: + - The Fusion database stores information from application manifests that describe the applications. + - The manifest schema is updated to add a new requested execution level field. + +- **Installer detection**: + - Installer detection detects setup files and helps prevent installations from being run without the user's knowledge and consent. + +## Kernel + +- **Virtualization**: Virtualization technology ensures that noncompliant apps don't silently fail to run or fail in a way that the cause can't be determined. UAC also provides file and registry virtualization and logging for applications that write to protected areas. +- **File system and registry**: The per-user file and registry virtualization redirects per-computer registry and file write requests to equivalent per-user locations. Read requests are redirected to the virtualized per-user location first and to the per-computer location second. + +The slider never turns off UAC completely. If you set it to **Never notify**, it will: + +- Keep the UAC service running +- Cause all elevation request initiated by administrators to be autoapproved without showing a UAC prompt +- Automatically deny all elevation requests for standard users + +> [!IMPORTANT] +> In order to fully disable UAC, you must disable the policy **User Account Control: Run all administrators in Admin Approval Mode**. Some Universal Windows Platform apps might not work when UAC is disabled. + +## Virtualization + +Because system administrators in enterprise environments attempt to secure systems, many line-of-business (LOB) applications are designed to use only a standard user access token. As a result, you don't need to replace most apps when UAC is turned on. + +Windows includes file and registry virtualization technology for apps that aren't UAC-compliant and that requires an administrator's access token to run correctly. When an administrative app that isn't UAC-compliant attempts to write to a protected folder, such as *Program Files*, UAC gives the app its own virtualized view of the resource it's attempting to change. The virtualized copy is maintained in the user's profile. This strategy creates a separate copy of the virtualized file for each user that runs the noncompliant app. + +Most app tasks operate properly by using virtualization features. Although virtualization allows most applications to run, it's a short-term fix and not a long-term solution. App developers should modify their apps to be compliant as soon as possible, rather than relying on file, folder, and registry virtualization. + +Virtualization isn't an option in the following scenarios: + +- Virtualization doesn't apply to apps that are elevated and run with a full administrative access token +- Virtualization supports only 32-bit apps. Nonelevated 64-bit apps receive an access denied message when they attempt to acquire a handle (a unique identifier) to a Windows object. Native Windows 64-bit apps are required to be compatible with UAC and to write data into the correct locations +- Virtualization is disabled if the app includes an app manifest with a requested execution level attribute + +## Request execution levels + +An app manifest is an XML file that describes and identifies the shared and private side-by-side assemblies that an app should bind to at run time. The app manifest includes entries for UAC app compatibility purposes. Administrative apps that include an entry in the app manifest prompt the user for permission to access the user's access token. Although they lack an entry in the app manifest, most administrative app can run without modification by using app compatibility fixes. App compatibility fixes are database entries that enable applications that aren't UAC-compliant to work properly. + +All UAC-compliant apps should have a requested execution level added to the application manifest. If the application requires administrative access to the system, marking the app with a requested execution level of *require administrator* ensures that the system identifies this program as an administrative app, and performs the necessary elevation steps. Requested execution levels specify the privileges required for an app. + +## Installer detection technology + +Installation programs are apps designed to deploy software. Most installation programs write to system directories and registry keys. These protected system locations are typically writeable only by an administrator in Installer detection technology, which means that standard users don't have sufficient access to install programs. Windows heuristically detects installation programs and requests administrator credentials or approval from the administrator user in order to run with access privileges. Windows also heuristically detects updates and programs that uninstall applications. One of the design goals of UAC is to prevent installations from being run without the user's knowledge and consent because installation programs write to protected areas of the file system and registry. + +Installer detection only applies to: + +- 32-bit executable files +- Applications without a requested execution level attribute +- Interactive processes running as a standard user with UAC enabled + +Before a 32-bit process is created, the following attributes are checked to determine whether it's an installer: + +- File name includes keywords such as "install," "setup," or "update." +- Versioning Resource fields contain the following keywords: Vendor, Company Name, Product Name, File Description, Original Filename, Internal Name, and Export Name. +- Keywords in the side-by-side manifest are embedded in the executable file. +- Keywords in specific StringTable entries are linked in the executable file. +- Key attributes in the resource script data are linked in the executable file. +- Executable file contains targeted sequences of bytes. + +> [!NOTE] +> The keywords and sequences of bytes were derived from common characteristics observed from various installer technologies. + +> [!NOTE] +> The *User Account Control: Detect application installations and prompt for elevation* policy must be enabled for installer detection to detect installation programs. For more information, see [User Account Control settings list](settings-and-configuration.md#user-account-control-settings-list). \ No newline at end of file diff --git a/windows/security/application-security/application-control/user-account-control/how-it-works.md b/windows/security/application-security/application-control/user-account-control/how-it-works.md index 628efba7cf..0d85a5660e 100644 --- a/windows/security/application-security/application-control/user-account-control/how-it-works.md +++ b/windows/security/application-security/application-control/user-account-control/how-it-works.md @@ -2,7 +2,7 @@ title: How User Account Control works description: Learn about User Account Control (UAC) components and how it interacts with the end users. ms.topic: concept-article -ms.date: 03/26/2024 +ms.date: 04/15/2025 --- # How User Account Control works @@ -34,8 +34,8 @@ When a user signs in, the system creates an access token for that user. The acce When an administrator logs on, two separate access tokens are created for the user: a *standard user access token* and an *administrator access token*. The standard user access token: - Contains the same user-specific information as the administrator access token, but the administrative Windows privileges and SIDs are removed -- It's used to start applications that don't perform administrative tasks (standard user apps) -- It's used to display the desktop by executing the process *explorer.exe*. Explorer.exe is the parent process from which all other user-initiated processes inherit their access token. As a result, all apps run as a standard user unless a user provides consent or credentials to approve an app to use a full administrative access token +- Is used to start applications that don't perform administrative tasks (standard user apps) +- Is used to display the desktop by executing the process *explorer.exe*. Explorer.exe is the parent process from which all other user-initiated processes inherit their access token. As a result, all apps run as a standard user unless a user provides consent or credentials to approve an app to use a full administrative access token A user that is a member of the Administrators group can sign in, browse the Web, and read e-mail while using a standard user access token. When the administrator needs to perform a task that requires the administrator access token, Windows automatically prompts the user for approval. This prompt is called an *elevation prompt*, and its behavior can be configured via policy or registry. @@ -91,105 +91,8 @@ The elevation process is further secured by directing the prompt to the *secure When an executable file requests elevation, the *interactive desktop*, also called the *user desktop*, is switched to the secure desktop. The secure desktop dims the user desktop and displays an elevation prompt that must be responded to before continuing. When the user selects **Yes** or **No**, the desktop switches back to the user desktop. > [!NOTE] -> Starting in **Windows Server 2019**, it's not possible to paste the content of the clipboard on the secure desktop. This is the same behavior of the currently supported Windows client OS versions. +> Starting in **Windows Server 2019**, it's not possible to paste the content of the clipboard on the secure desktop. This behavior is the same as the currently supported Windows client OS versions. Malware can present an imitation of the secure desktop, but when the **User Account Control: Behavior of the elevation prompt for administrators in Admin Approval Mode** policy setting is set to **Prompt for consent**, the malware doesn't gain elevation if the user selects **Yes** on the imitation. If the policy setting is set to **Prompt for credentials**, malware imitating the credential prompt might be able to gather the credentials from the user. However, the malware doesn't gain elevated privilege and the system has other protections that mitigate malware from taking control of the user interface even with a harvested password. While malware could present an imitation of the secure desktop, this issue can't occur unless a user previously installed the malware on the PC. Because processes requiring an administrator access token can't silently install when UAC is enabled, the user must explicitly provide consent by selecting **Yes** or by providing administrator credentials. The specific behavior of the UAC elevation prompt is dependent upon security policies. - -## UAC Architecture - -The following diagram details the UAC architecture. - -:::image type="content" source="images/uac-architecture.gif" alt-text="Diagram that describes the UAC architecture."::: - -To better understand each component, review the following tables: - -### User - -|Component|Description| -|--- |--- | -|User performs operation requiring privilege|If the operation changes the file system or registry, Virtualization is called. All other operations call ShellExecute.| -|ShellExecute|ShellExecute calls CreateProcess. ShellExecute looks for the ERROR_ELEVATION_REQUIRED error from CreateProcess. If it receives the error, ShellExecute calls the Application Information service to attempt to perform the requested task with the elevated prompt.| -|CreateProcess|If the application requires elevation, CreateProcess rejects the call with ERROR_ELEVATION_REQUIRED.| - -### System - -|Component|Description| -|--- |--- | -|Application Information service|A system service that helps start apps that require one or more elevated privileges or user rights to run, such as local administrative tasks, and apps that require higher integrity levels. The Application Information service helps start such apps by creating a new process for the application with an administrative user's full access token when elevation is required. Depending on the configured policies, the user might give consent.| -|Elevating an ActiveX install|If ActiveX isn't installed, the system checks the UAC slider level. If ActiveX is installed, the **User Account Control: Switch to the secure desktop when prompting for elevation** Group Policy setting is checked.| -|Check UAC slider level|UAC has a slider to select from four levels of notification.