Merge remote-tracking branch 'refs/remotes/origin/sh-7964624' into sh-1607

devices/surface-hub/provisioning-packages-for-certificates-surface-hub.md

@@ -13,248 +13,209 @@ localizationpriority: medium
 
 # Create provisioning packages (Surface Hub)
 
+This topic explains how to create a provisioning package using the Windows Imaging and Configuration Designer (ICD), and apply it to Surface Hub devices. For Surface Hub, you can use provisioning packages to add certificates, install Universal Windows Platform (UWP) apps, and customize policies and settings.
 
-For Windows 10, settings that use the registry or a content services platform (CSP) can be configured using provisioning packages. You can also add certificates during first run using provisioning.
+You can apply a provisioning package using a USB during first run, or through the **Settings** app. 
 
-In this topic, you'll find the following information:
 
--   [Introduction to provisioning packages](#intro-prov-pkg)
+## Advantages
--   [What can provisioning packages configure for Microsoft Surface Hubs?](#what-can-prov-pkg)
+-   Quickly configure devices without using a MDM provider.
--   [How do I create and deploy a provisioning package?](#how-do-i-prov-pkg)
--   [Requirements](#requirements-prov-pkg)
--   [Install the Windows Imaging and Configuration Designer](#installing-wicd-prov-pkg)
--   [Create a provisioning package for certificates](#creating-prov-pkg-certs)
--   [Create a provisioning package for apps](#creating-prov-pkg-apps)
--   [Deploy a provisioning package to a Surface Hub](#deploy-to-hub-prov-pkg)
-    -   [Deploy a provisioning package using first run](#deploy-via-oobe-prov-pkg)
-    -   [Deploy a provisioning package using Settings](#deploy-via-settings-prov-pkg)
 
-### <a href="" id="intro-prov-pkg"></a>Introduction to provisioning packages
+-   No network connectivity required.
 
-Provisioning packages are created using Windows Imaging and Configuration Designer (WICD), which is a part of the Windows Assessment and Deployment Kit (ADK). For Surface Hub, the provisioning packages can be placed on a USB drive.
+-   Simple to apply.
 
-### <a href="" id="what-can-prov-pkg"></a>What can provisioning packages configure for Surface Hubs?
+[Learn more about the benefits and uses of provisioning packages.](https://technet.microsoft.com/itpro/windows/whats-new/new-provisioning-packages)
 
-Currently, you can use provisioning packages to install certificates and to install Universal Windows Platform (UWP) apps on your Surface Hub. These are the only two supported scenarios.
 
-You may use provisioning packages to install certificates that will allow the device to authenticate to Microsoft Exchange or Skype for Business, or to sideload apps that don't come from the Windows Store (for example, your own in-house apps).
+## Requirements 
 
->**Note**  Provisioning can only install certificates to the device (local machine) store, and not to the user store. If your organization requires that certificates must be installed to the user store, you must use Mobile Device Management (MDM) to deploy these certificates. See your MDM solution documentation for details.
+To create and apply a provisioning package to a Surface Hub, you'll need the following:
 
- 
+-   Windows Imaging and Configuration Designer (ICD), which is installed as a part of the [Windows 10 Assessment and Deployment Kit (ADK)](http://go.microsoft.com/fwlink/p/?LinkId=526740).
-
-### <a href="" id="how-do-i-prov-pkg"></a>How do I create and deploy a provisioning package?
-
-Provisioning packages must be created using the Windows Imaging and Configuration Designer (ICD).
-
-### <a href="" id="requirements-prov-pkg"></a>Requirements
-
-In order to create and deploy provisioning packages, all of the following are required:
-
--   Access to the Settings app on Surface Hub (using admin credentials which were configured at initial setup of the Surface Hub).
--   Windows Imaging and Configuration Designer (ICD), which is installed as a part of the windows 10 Assessment and Deployment Kit (ADK).
 -   A PC running Windows 10.
--   USB flash drive.
+-   A USB flash drive.
+-   If you apply the package using the **Settings** app, you'll need device admin credentials.
 
-### <a href="" id="installing-wicd-prov-pkg"></a>Install the Windows Imaging and Configuration Designer
+You'll create the provisioning package on a PC running Windows 10, save the package to a USB drive, and then deploy it to your Surface Hub.
 
-1.  The Windows Imaging and Configuration Designer (ICD) is installed as part of the Windows 10 ADK. The installer for the ADK can be downloaded from the [Microsoft Download Center](https://go.microsoft.com/fwlink/?LinkId=718147).
-    >**Note**  The ADK must be installed on a separate PC, not on the Surface Hub.  
 
-2.  Run the installer, and set your preferences for installation. When asked what features you want to install, you will see a checklist like the one in the following figure. Note that **Windows Performance Toolkit** and **Windows Assessment Toolkit** should be unchecked, as they are not needed to run the ICD.
+## Supported items for Surface Hub provisioning packages
 
-    Before going to the next step, make sure you have the following checked:
+Currently, you can add these items to provisioning packages for Surface Hub:
+- **Certificates** - You can add certificates, if needed, to support Microsoft Exchange and UWP apps downloaded from the Windows Store for Business.
+- **Universal Windows Platform (UWP) apps** - You can install UWP apps. This can be an offline-licensed app from the Windows Store for Business, or an app created by an in-house dev.
+- **Policies** - Surface Hub supports a subset of the policies in the [Policy configuration service provider](https://msdn.microsoft.com/library/windows/hardware/dn904962.aspx). Some of those policies can be configured with ICD.
+- **Settings** - You can configure any setting in the [SurfaceHub configuration service provider](https://msdn.microsoft.com/library/windows/hardware/mt608323.aspx).
 
-    -   **Deployment Tools**
-    -   **Windows Preinstallation Environment**
-    -   **Imaging and Configuration Designer**
-    -   **User State Migration Tool**
 
-    All four of these features are required to run the ICD and create a package for the Surfact Hub.
+## Create the provisioning package
 
-    ![Image showing Windows ADK install page - select features to install.](images/idcfeatureschecklist.png)
+Use the Windows Imaging and Configuration Designer (ICD) tool included in the Windows Assessment and Deployment Kit (ADK) for Windows 10 to create a provisioning package. When you install the ADK, you can choose to install only the Imaging and Configuration Designer (ICD).  [Install the ADK.](http://go.microsoft.com/fwlink/p/?LinkId=526740)
 
-3.  Continue with the installer until the ADK is installed. This may take a while, because the installer downloads remote content.
+1. Open Windows ICD (by default, `%windir%\Program Files (x86)\Windows Kits\10\Assessment and Deployment Kit\Imaging and Configuration Designer\x86\ICD.exe`).
 
-### <a href="" id="creating-prov-pkg-certs"></a>Create a provisioning package for certificates
+2. Click **Advanced provisioning**.
 
-This example will demonstrate how to create a provisioning package to install a certificate.
+  ![ICD start options](images/ICDstart-option.PNG)  
   
-1.  On the PC that had the Windows 10 ADK installed, open ICD and choose the **New provisioning package** tile from the main menu.
+3. Name your project and click **Next**.
 
-    ![Image showing Start page in Windows Imaging and Configuration Designer.](images/wicd-screen01a.png)
+4. Select **Common to Windows 10 Team edition**, click **Next**, and then click **Finish**.
 
-2.  When the **New project** dialog box opens, type whatever name you like in the **Name** box. The **Location** and **Description** boxes can also be filled at your discretion, though we recommend using the **Description** box to help you distinguish among multiple packages. Click **Next**.
+  ![ICD new project](images/icd-new-project.png)
 
-    ![Image showing New project screen for Windows Imaging and Configuration Designer.](images/wicd-screen02a.png)
+5. In the project, under **Available customizations**, select **Common Team edition settings**.
 
-    Select the settings that are **Common to all Windows editions**, and click **Next**.
+  ![ICD common settings](images/icd-common-settings.png)
 
-    ![Image showing project settings in Windows Imaging and Configuration Designer.](images/wicd-screen02b.png)
 
-    When asked to import a provisioning package, just click **Finish.**
+### Add a certificate to your package
+You can use provisioning packages to install certificates that will allow the device to authenticate to Microsoft Exchange, or to install apps downloaded from the Windows Store.
 
-    ![Image showing option for importing a provisioning package.](images/wicd-screen02c.png)
+> [!NOTE]
+> Provisioning packages can only install certificates to the device (local machine) store, and not to the user store. If your organization requires that certificates must be installed to the user store, use Mobile Device Management (MDM) to deploy these certificates. See your MDM solution documentation for details.
 
-3.  ICD's main screen will be displayed. This is where you create the provisioning package. In the **Available customizations** pane, expand **Runtime settings** and then expand **Certificates**. Click **Root certificates**.
+1. In the **Available customizations** pane, go to **Runtime settings** > **Certificates** > **ClientCertificates**. 
 
-    ![Image showing Windows Imaging and Configuration Designer's man page.](images/wicd-screen03a.png)
+2. Enter a **CertificateName** and then click **Add**. 
 
-    In the center pane, you’ll be asked to specify a **CertificateName** for the Root certificate. You can set this to whatever you want. For the example, we've used the same name as the project. Click **Add**, and an entry will be added in the left pane.
+2. Enter the **CertificatePassword**. 
 
-4.  In the **Available customizations** pane on the left, a new category has appeared for **CertificatePath** underneath the **CertificateName** you provided. There’s also a red exclamation icon indicating that there is a required field that needs to be set. Click **CeritficatePath**.
+3. For **CertificatePath**, browse and select the certificate. 
 
-    ![Image showing available customizations in Windows Imaging and Configuration Designer.](images/wicd-screen04a.png)
+4. Set **ExportCertificate** to **False**.
 
-5.  In the center pane, you’ll be asked to specify the path for the certificate. Enter the name of the .cer file that you want to deploy, either by typing or clicking **Browse**. It must be a root certificate. The provisioning package created will copy the .cer file into the package it creates.
+5. For **KeyLocation**, select **Software only**.
 
-    ![icd tiles](images/wicd-screen06a.png)
 
-6.  Verify that the path is set, then click **Export** in the top menu and choose **Provisioning package**.
+### Add a Universal Windows Platform (UWP) app to your package
+Before adding a UWP app to a provisioning package, you need the app package (either an .appx, or .appxbundle) and any dependency files. If you acquired the app from the Windows Store for Business, you will also need the *unencoded* app license. See [Distribute offline apps](https://technet.microsoft.com/itpro/windows/manage/distribute-offline-apps#download-an-offline-licensed-app) to learn how to download these items from the Windows Store for Business.
 
-    ![icd tiles](images/wicd-screen07a.png)
+1. In the **Available customizations** pane, go to **Runtime settings** > **UniversalAppInstall** > **DeviceContextApp**.
 
-7.  You'll see a series of dialog boxes next. In the first one, either accept the defaults, or enter new values as needed, and click **Next**. You'll most likely want to accept the defaults.
+2. Enter a **PackageFamilyName** for the app and then click **Add**. For consistency, use the app's package family name. If you acquired the app from the Windows Store for Business, you can find the package family name in the app license. Open the license file using a text editor, and use the value between the \<PFM\>...\</PFM\> tags.
 
-    ![icd tiles](images/wicd-screen08a.png)
+3. For **ApplicationFile**, click **Browse** to find and select the target app (either an \*.appx or \*.appxbundle).
 
-    Click **Next** again in the security options dialog box, because this package doesn't need to be encrypted or signed.
+4. For **DependencyAppxFiles**, click **Browse** to find and add any dependencies for the app. For Surface Hub, you will only need the x64 versions of these dependencies.
 
-    ![icd tiles](images/wicd-screen09a.png)
+If you acquired the app from the Windows Store for Business, you will also need to add the app license to your provisioning package.
 
-    Choose where to save the provisioning package, and click **Next**.
+1. Make a copy of the app license, and rename it to use a **.ms-windows-store-license** extension. For example, "example.xml" becomes "example.ms-windows-store-license".
 
-    ![icd tiles](images/wicd-screen10a.png)
+2. In ICD, in the **Available customizations** pane, go to **Runtime settings** > **UniversalAppInstall** > **DeviceContextAppLicense**.
 
-    Review the information shown, and if it looks good, click **Build**.
+3. Enter a **LicenseProductId** and then click **Add**. For consistency, use the app's license ID from the app license. Open the license file using a text editor. Then, in the \<License\> tag, use the value in the **LicenseID** attribute.
 
-    ![icd tiles](images/wicd-screen11a.png)
+4. Select the new **LicenseProductId** node. For **LicenseInstall**, click **Browse** to find and select the license file that you renamed in Step 1.
 
-    You will see a confirmation dialog box similar to the one following. Click the link under **Output location** to open the directory containing the provisioning package.
 
-    ![icd tiles](images/wicd-screen12a.png)
+### Add a policy to your package
+Surface Hub supports a subset of the policies in the [Policy configuration service provider](https://msdn.microsoft.com/library/windows/hardware/dn904962.aspx). Some of those policies can be configured with ICD.
 
-8.  Copy the .ppkg from the output directory into the root directory of a USB drive. If it’s not at the root, it won’t be recognized by the device. You’ve finished making the provisioning package—now you just need to deploy it to the Surface Hub.
+1. In the **Available customizations** pane, go to **Runtime settings** > **Policies**.
 
-### <a href="" id="creating-prov-pkg-apps"></a>Create a provisioning package for apps
+2. Select one of the available policy areas.
 
-This example will demonstrate how to create a provisioning package to install offline-licensed apps purchased from the Windows Store for Business. For information on offline-licensed apps and what you need to download in order to install them, see [Distribute offline apps](https://go.microsoft.com/fwlink/?LinkId=718148).
+3. Select and set the policy you want to add to your provisioning package.
 
-For each app you want to install on Surface Hubs, you'll need to download:
 
--   App metadata
+### Add Surface Hub settings to your package 
--   App package
--   App license
 
-Depending on the app, you may or may not need to download a new app framework.
+You can add settings from the [SurfaceHub configuration service provider](https://msdn.microsoft.com/library/windows/hardware/mt608323.aspx) to your provisioning package. 
 
-1.  On the PC that had the Windows 10 ADK installed, open ICD and choose the **New provisioning package** tile from the main menu.
+1. In the **Available customizations** pane, go to **Runtime settings** > **WindowsTeamSettings**.
 
-    ![icd tiles](images/wicd-screen01a.png)
+2. Select one of the available setting areas.
 
-2.  When the **New project** dialog box opens, type whatever name you like in the **Name** box. The **Location** and **Description** boxes can also be filled at your discretion, though we recommend using the **Description** box to help you distinguish among multiple packages. Click **Next**.
+3. Select and set the setting you want to add to your provisioning package. 
 
-    ![icd tiles](images/wicd-screen-apps-02a.png)
 
-    Select the settings that are **Common to all Windows desktop editions**, and click **Next**.
+## Build your package
 
-    ![icd tiles](images/wicd-screen02b.png)
+1. When you are done configuring the provisioning package, on the **File** menu, click **Save**.
 
-    When asked to import a provisioning package, just click **Finish.**
+2. Read the warning that project files may contain sensitive information, and click **OK**.
 
-    ![icd tiles](images/wicd-screen02c.png)
+    > [!IMPORTANT]
+    > When you build a provisioning package, you may include sensitive information in the project files and in the provisioning package (.ppkg) file. Although you have the option to encrypt the .ppkg file, project files are not encrypted. You should store the project files in a secure location and delete the project files when they are no longer needed.
 
-3.  ICD's main screen will be displayed. This is where you create the provisioning package. In the **Available customizations** pane, expand **UniversalAppInstall** and click **DeviceContextApp**.
+3. On the **Export** menu, click **Provisioning package**.
 
-    ![icd tiles](images/wicd-screen-apps-03a.png)
+4. Change **Owner** to **IT Admin**, which will set the precedence of this provisioning package higher than provisioning packages applied to this device from other sources.
 
-    In the center pane, you’ll be asked to specify a **PackageFamilyName** for the app. This is one of the things you downloaded from the Store for Business. Click **Add**, and an entry will be added in the left pane.
+5. Set a value for **Package Version**, and then select **Next.**
 
-4.  In the **Available customizations** pane on the left, new categories will be displayed for **ApplicationFile** and **LaunchAppAtLogin** underneath the **PackageFamilyName** you just entered. Enter the appx filename in the **ApplicationFile** box in the center pane.
+    > [!TIP]
+    > You can make changes to existing packages and change the version number to update previously applied packages.
 
-    ![icd tiles](images/wicd-screen-apps-04a.png)
+6. Optional: You can choose to encrypt the package and enable package signing.
 
-    Generally, **LaunchAppAtLogin** should be set to **Do not launch app** or **NOT CONFIGURED**.
+    -   **Enable package encryption** - If you select this option, an auto-generated password will be shown on the screen.
 
-5.  Next, click **DeviceContextAppLicense** in the left pane. In the center pane, you’ll be asked to specify the **LicenseProductId**. Click **Add**. Back in the left pane, click on the **LicenseProductId** that you just added. In the center pane, you'll need to specify **LicenseInstall**. Enter the name of the license file that you previously downloaded from the Store for Business, either by typing or clicking **Browse**. The file will have a extension of "ms-windows-store-license".
+    -   **Enable package signing** - If you select this option, you must select a valid certificate to use for signing the package. You can specify the certificate by clicking **Browse...** and choosing the certificate you want to use to sign the package.
 
-    ![icd tiles](images/wicd-screen-apps-06a.png)
+        > [!IMPORTANT]
+        > We recommend that you include a trusted provisioning certificate in your provisioning package. When the package is applied to a device, the certificate is added to the system store and any package signed with that certificate thereafter can be applied silently. 
 
-6.  Verify that the path is set, then click **Export** in the top menu and choose **Provisioning package**.
+7. Click **Next** to specify the output location where you want the provisioning package to go once it's built. By default, Windows ICD uses the project folder as the output location.<p>
+Optionally, you can click **Browse** to change the default output location.
 
-    ![icd tiles](images/wicd-screen07a.png)
+8. Click **Next**.
 
-7.  You'll see a series of dialog boxes next. In the first one, either accept the defaults, or enter new values as needed, and click **Next**. You'll most likely want to accept the defaults.
+9. Click **Build** to start building the package. The project information is displayed in the build page and the progress bar indicates the build status.<p>
+If you need to cancel the build, click **Cancel**. This cancels the current build process, closes the wizard, and takes you back to the **Customizations Page**.
 
-    ![icd tiles](images/wicd-screen-apps-08a.png)
+10. If your build fails, an error message will show up that includes a link to the project folder. You can scan the logs to determine what caused the error. Once you fix the issue, try building the package again.<p>
+If your build is successful, the name of the provisioning package, output directory, and project directory will be shown.
 
-    Click **Next** again in the security options dialog box, because this package doesn't need to be encrypted or signed.
+    -   If you choose, you can build the provisioning package again and pick a different path for the output package. To do this, click **Back** to change the output package name and path, and then click **Next** to start another build.
     
-    ![icd tiles](images/wicd-screen09a.png)
+    -   If you are done, click **Finish** to close the wizard and go back to the **Customizations Page**.
 
-    Choose where to save the provisioning package, and click **Next**.
+11. Select the **output location** link to go to the location of the package. Copy the .ppkg to an empty USB flash drive.
 
-    ![icd tiles](images/wicd-screen-apps-10a.png)
 
-    Review the information shown, and if it looks good, click **Build**.
+## Apply a provisioning package to Surface Hub
 
-    ![icd tiles](images/wicd-screen-apps-11a.png)
+There are two options for deploying provisioning packages to a Surface Hub. You can apply a provisioning packing [during the first run wizard](#apply-a-provisioning-package-during-first-run), or using [Settings](#apply-a-package-using-settings). 
 
-    You will see a confirmation dialog box similar to the one following. Click the link under **Output location** to open the directory containing the provisioning package.
 
-    ![icd tiles](images/wicd-screen-apps-12a.png)
+### Apply a provisioning package during first run
 
-8.  Copy the .ppkg from the output directory into the root directory of a USB drive. If it’s not at the root, it won’t be recognized by the device. You’ve finished making the provisioning package—now you just need to deploy it to the Surface Hub.
+> [!IMPORTANT]
+> Only use provisioning packages to install certificates during first run. Use the **Settings** app to install apps and apply other settings.
 
-### <a href="" id="deploy-to-hub-prov-pkg"></a>Deploy a provisioning package to a Surface Hub
+1. When you turn on the Surface Hub for the first time, the first-run program will display the [**Hi there page**](first-run-program-surface-hub.md#first-page). Make sure that the settings are properly configured before proceeding.
 
-The following two methods for deploying provisioning packages apply to any kind of provisioning package that is being deployed to a Surface Hub. There is no difference in the way cert provisioning packages and app provisioning packages are installed. You may see different description text in the UI depending on what the package is for, but the process is still the same.
+2. Insert the USB flash drive containing the .ppkg file into the Surface Hub. If the package is in the root directory of the drive, the first-run program will recognize it and ask if you want to set up the device. Select **Set up**.
 
-### <a href="" id="deploy-via-oobe-prov-pkg"></a>Deploy a provisioning package using first run
+    ![Set up device?](images/provisioningpackageoobe-01.png)
 
-1.  When you turn on the Surface Hub for the first time, the first run process will display the page titled **Hi there**. Make sure the settings on this page are correct before you proceed. (See [Hi there page](first-run-program-surface-hub.md#first-page) for details.) Once you've deployed your provisioning package, the first run process will not return here. It will continue to the next screen.
+3. The next screen asks you to select a provisioning source. Select **Removable Media** and tap **Next**.
-2.  Insert the USB drive into the Surface Hub.
-3.  Press the Windows key on the separate keyboard five times. You’ll see a dialog box asking whether you want to set up your device. Click **Set Up**.
 
-    ![image with set up device message for surface hub.](images/provisioningpackageoobe-01.png)IMage
+    ![Provision this device](images/provisioningpackageoobe-02.png)
     
-4.  Click on **Removable Media** in the **Provision From** dropdown list, then click **Next**.
+4. Select the provisioning package (\*.ppkg) that you want to apply, and tap **Next**. Note that you can only install one package during first run.
 
-    ![image with provision this device page for surface hub. ](images/provisioningpackageoobe-02.png)
+    ![Choose a package](images/provisioningpackageoobe-03.png)
 
-5.  The available packages in the root directory of the USB drive will be listed. Note that you can only install one package during first run. Select the package you want to install and then click **Next**.
+5. The first-run program will show you a summary of the changes that the provisioning package will apply. Select **Yes, add it**. The package will be applied, and you'll be taken to the next page in the first-run program.
 
-    ![image with choose a package page for surface hub. ](images/provisioningpackageoobe-03.png)
+    ![Do you trust this package?](images/provisioningpackageoobe-04.png)
 
-6.  You’ll then see a dialog asking if it’s from a source you trust. Click **Yes, add it**. The certificate will be installed, and you’ll be taken to the next page of first run.
 
-    ![image with ](images/provisioningpackageoobe-04.png)
+### Apply a package using Settings
 
-### <a href="" id="deploy-via-settings-prov-pkg"></a>Deploy a provisioning package using Settings
+1. Insert the USB flash drive containing the .ppkg file into the Surface Hub.
-
-1.  Insert the USB drive into the Surface Hub you want to deploy to.
-2.  On the Surface Hub, open **Settings** and enter in the admin credentials.
-3.  Navigate to **System &gt; Work Access**. Under the header **Related settings**, click on **Add or remove a management package**.
-4.  Here, click the button for **Add a package**.
-
-    ![Image showing provisioining packages page in Settings.](images/provisioningpackagesettings-01.png)
-
-5.  Click **Removable media** from the dropdown list. You will see a list of available provisioning packages on the **Settings** page.
-
-    ![Image showing add a package page in Settings.](images/provisioningpackagesettings-02.png)
-
-6.  Choose your package and click **Add**.
-
-    ![Image showing select a package box.](images/provisioningpackagesettings-03.png)
-
-7.  You may have to re-enter the admin credentials if User Access Control (UAC) asks for them.
-8.  You’ll see a confirmation dialog box. Click **Yes, add it**. The certificate will be installed.
-
- 
-
- 
 
+2. From the Surface Hub, start **Settings** and enter the admin credentials when prompted.
 
+3. Navigate to **This device** > **Device management**. Under **Provisioning packages**, select **Add or remove a provisioning package**.
 
+4. Select **Add a package**.
 
+5. Choose your provisioning package and select **Add**. You may have to re-enter the admin credentials if prompted.
 
+6. You'll see a summary of the changes that the provisioning package will apply. Select **Yes, add it**.